Return-path: [nobody@air.host-care.com]
and
X-PHP-Script: gtucampus.com/uploads/resume/kam.php for 120.141.49.248
which tells me this scammer used a PHP script called kam.php uploaded to a website that is an ecollege called Gujarat Technical University. Source of the email is Malaysia. If you google kam.php, you will see other computers that have had this php file uploaded to, so all this tells you is the scammer is using hijacked computers to send their email out (which is typical).
Here is the full email:
From: Mr Eric Acis [engericacis@gmail.com]
Subject: Enquiry
Hello,
I am interested in placing an order and i would like to know the following.
-If you accept credit card and
-If you ship internationally
I certainly appreciate a prompt reply from you.
Sincerely
Didn't even sign his name. Short and simple until he gets a reply and then the Looong Story will come out he either works or lives in one place and is moving (lately it is to Australia) and he has a third party shipper handling his move and he'll send a check or pay by credit card immediately, please send him your website and list of products so he can choose (which doesn't even make sense, but this is their templated formula of the scam usually).
Thank you for posting this- Received a nearly identical email this morning. Usually when I receive genuine inquiries about my work, the focus is on the items by name, and not payment, shipping, etc. Most people could care less about how items are shipped! Ugh these people are scary!
ReplyDeleteWe just heard from Mr. Eric Acis and he is now using a different email address. He is using engericacis@blumail.org.
ReplyDeleteSince we are a larger company, when we get the ones that say they are using their own shipper, we explain that we do not allow outside freight companies on the premises and company policy is that we use our shipper to their location. This deters them every time.
Thanks for your site – it's a great help!!!!