veterinary donation scam

This is an example of a very specific targeted scam that has surfaced several times over the past couple of years. The email address and "veterinarian" name sometimes change, and at times, a fake veterinary clinic website is used to support the scam (the last fake website was killed by 419Eater site killers), but the content does not vary much. Rather than sending to thousands of random email addresses, the scammer specifically targets animal shelters, pet rescue organizations, and veterinarians. This type of scam is particularly insidious, as these are donations that would mean a lot to most nonprofit animal organizations, and even those aware of overpayment schemes may not question this email, because the "donation" does not involve cashing checks, and the equipment is directed at the specific needs of the organization. In addition, the gmail address hides the fact that this scammer is in Africa.

This is not a real veterinarian. There are no supplies to be donated. There are, however, plenty of fees to be extracted from already struggling charities in order to deliver the imaginary equipment.

Reply-To: <[email protected]>
From: Dr. Jennifer Allen<[email protected]>
Subject: Donation Inquiry
Date: Sun, 9 Aug 2009 13:22:30 -0700
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on localhost
X-Spam-Report: * 2.1 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date * 3.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Spam-Status: Yes, score=5.3 required=5.0 tests=DATE_IN_FUTURE_12_24, FORGED_MUA_OUTLOOK autolearn=disabled version=3.0.2
X-Spam-Level: *****
X-Antivirus: avast! (VPS 090807-0, 08/07/2009), Inbound message
X-Antivirus-Status: Clean


Hi,

I am Dr. Jennifer Allen ( Veterinary Medicine), I own a veterinary Service where I practice both exotic and companion animal medicine.

We are looking to donate some pre-used items in our clinic as we have recently acquired new medical supplies and a new mobile van and now offering to donate a pre-used " all purpose" mobile van and the veterinary equipments below.

1 Ultrasound
1 Autoclave

Are you familiar with these? Let me know if these contributions Would be beneficial to your work?.

Regards,

Dr. Jennifer Allen
D.V.M.,Veterinary Medicine.
Tel/Fax - 66-2-216-3730

Are you familiar with these?

No veterinarian would see any need to ask such a question of the target audience. And one that I would hope ring alarm bells.

I had a good time with this one. There actually IS a vet in Portland with that name, I assume it's not her. I sent back (from a honeypot email address I maintain) a subtle but telling question about dosage on a particular medication that, if it's not a bot, the recipient should be able to easily answer. If not, they go on my shitlist and I will spread the word among my colleagues.

Hi and welcome to Scanwarners.
I'm not at all surprised that there is a real veterinarian with that name and location. Scammers often use the IDs of real people to try and make their scams look legit. She certainly isn't a scammer. The Internet makes it so easy to be anonymous that nobody in their right mind would scam using their real name and address.
As you've been baiting a scammer, have you been next door to www.419eater.com yet?

Still very much active scam, see below:
Return-path: <[email protected]>
Envelope-to: (yep it was me)
Delivery-date: Sun, 06 Dec 2009 22:07:34 -0700
Received: from [125.215.171.2] (helo=treasure-auction.com)
by cpanel3.zone53.net with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1NHVor-0005iN-VH
for (yep it was me); Sun, 06 Dec 2009 22:07:34 -0700
Received: from User ([58.64.127.226]) by treasure-auction.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 7 Dec 2009 12:46:42 +0800
Reply-To: <[email protected]>
From: "Jennifer Allen D.V.M."<[email protected]>
To: [email protected]
Subject: Donation Inquiry.
Date: Mon, 7 Dec 2009 11:46:33 -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-OriginalArrivalTime: 07 Dec 2009 04:46:42.0781 (UTC) FILETIME=[45C250D0:01CA76F8]
X-Antivirus: AVG for E-mail 8.5.425 [270.14.95/2546]

Yep, absolutely the same one. Notice how the scammer is still impersonating the same veterinarian, but the email address has changed again, probably because the other email has long since been closed for fraud. The scammer just switches to another free email address and keeps going.

Using - BuddyB Broadband service network

IP = 58.64.127.226 = Bangkok, Thailand

It is still active, received it today:

Return-Path: <[email protected]>
X-Original-To: Removed - Ralph
Delivered-To: Removed
Received: from avs2.arnes.si (avs2.arnes.si [193.2.1.75])
by razor4.arnes.si (Postfix) with ESMTP id 71EFD18D0CD
for <Removed Sun, 11 Jul 2010 14:21:38 +0200 (CEST)
Received: from localhost (unknown [193.2.1.75])
by avs2.arnes.si (Postfix) with ESMTP id 5F2504B801F
for <Removed >; Sun, 11 Jul 2010 14:21:38 +0200 (CEST)
X-Virus-Scanned: amavisd-new at arnes.si
X-Spam-Flag: YES
X-Spam-Score: 17.348
X-Spam-Level: *****************
X-Spam-Status: Yes, score=17.348 tagged_above=4.9 required=5.4
tests=[AWL=-0.334, BAYES_99=3.5, DCC_CHECK=2.17,
DIGEST_MULTIPLE=0.001, FORGED_MUA_OUTLOOK=3.116, FREEMAIL_FROM=0.5,
FREEMAIL_REPLYTO=2, LOCAL_P0F_EXISTS=0.01, LOCAL_P0F_W=0.12,
NOTVALID_GMAIL=1, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96,
RCVD_IN_HOSTKARMA_BL=1.5, RCVD_IN_SORBS_WEB=0.619, SPF_NEUTRAL=0.686]
autolearn=spam
X-Amavis-OS-Fingerprint: Windows 2000 SP4, XP SP1+ [Cable.BG / Teleca.SE],
(distance 18, link: ethernet/modem), [59.37.63.113:34293]
Received: from avs2.arnes.si ([193.2.1.75])
by localhost (avs2.arnes.si [193.2.1.75]) (amavisd-new, port 10024)
with ESMTP id HQb55VmF2qjD for <[email protected]>;
Sun, 11 Jul 2010 14:21:37 +0200 (CEST)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from mail1.lafrancecn.com (mail1.lafrancecn.com [59.37.63.113])
by avs2.arnes.si (Postfix) with ESMTP id ED6B04B8053
for removed Sun, 11 Jul 2010 14:21:36 +0200 (CEST)
Received: from User ([41.217.65.13]) by mail1.lafrancecn.com with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 11 Jul 2010 20:20:12 +0800
Reply-To: <[email protected]>
From: "Dr. Jennifer Allen"<[email protected]>
Subject: From Dr. Jennifer Allen
Date: Sun, 11 Jul 2010 13:20:21 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <[email protected]>
X-OriginalArrivalTime: 11 Jul 2010 12:20:13.0875 (UTC) FILETIME=[6A0FC030:01CB20F3]
To: undisclosed-recipients:;

Removed possible member email address from post - Ralph

Hi Zoran, welcome to Scamwarners,

Thank you for posting this information, i have removed what I suspect was your email address from your post.

If you have any questions please ask

Here is a scam that tries to get you to believe this person is ready to make a donation of his valuable equipment. Once you give him a call, the phishing starts and you’ll find yourself wondering how you lost so much money!

—————————

Hello,

I want to make a one-time non cash donation to a private organization who may need a vehicle for transportation or a veterinary technician who may need the tools given below.

I am offering to give away 1 pre-owned GMC Van 2006 model and the veterinary equipments below.

1 Ultrasound
1 Medical Lighting
1 Autoclave
1 Monitor
2 veterinary tables & Tubs.

I am making this donations because I own a small private animal clinic and preparing to pursue my studies in (Animal Transgenesis and Germ Cell Research).

Are you familiar with these veterinary tools? give me a detailed information about your work and why you need the vehicle or the equipments listed above.

Sincerely,

Lucy Leigh
(Dr.Vet.Med).
Tel: 668-456-055-91.

WOW, these people must be getting smarter and smarter in their scams. This is a very targeted scammer and alot of people would easily fall for them.