"Rooms, Apts and meals" Peter and Andrea Purdon

Return-Path: <[email protected]>
Received: from server.atea.net.nz (hosted-by.atea.net.nz [85.17.251.80])
(envelope-from [email protected])
Received: from ateanet by server.atea.net.nz with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1PxQpK-0003Q5-FH
for Thu, 10 Mar 2011 10:21:50 +1300
To:
Subject: May Inquiry.
From: Andrea Purdon <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Thu, 10 Mar 2011 10:21:50 +1300
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.atea.net.nz
X-AntiAbuse: Original Domain - mosquitonet.com
X-AntiAbuse: Originator/Caller UID/GID - [32007 32009] / [47 12]
X-AntiAbuse: Sender Address Domain - server.atea.net.nz
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.2.3

Hello,


My name is Andrea Purdon from M&G Investment International UK. I want to know if there is any availability for 5 guests who needs rooms, apartments and meal services if possible. They are coming for visit in your city. If there is availability, kindly let me know about the dates and the quotes.


They are looking forward to Arrive on 16th of May 2011. The ONLY mode Of Payment is :Visa , Master or Amex Card.


Write me immediately with an update on the list of all the services you can offer and available at that time. Call me anytime.


Mr Andrea Purdon.


Phone: +447045768990


Edited subject line -Jillian

Return-path: <[email protected]>
Envelope-to:
Delivery-date: Sat, 09 Apr 2011 15:32:15 -0500
Received: from [217.16.6.64] (helo=mx2.hosteur.com)
by with esmtp (Exim 4.69)
(envelope-from <[email protected]>)
id 1Q8epK-0002Px-CQ
for; Sat, 09 Apr 2011 15:32:15 -0500
Received: from localhost (mx2 [127.0.0.1])
by mx2.hosteur.com (Postfix) with ESMTP id 4FB79C81140
for ; Sat, 9 Apr 2011 22:14:40 +0200 (CEST)
X-Virus-Scanned: amavisd-new at localhost
Received: from mx2.hosteur.com ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id rjjNVkYnOxgy for ;
Sat, 9 Apr 2011 22:14:40 +0200 (CEST)
Received: from max2.hosteur.com (unknown [217.16.6.57])
by mx2.hosteur.com (Postfix) with ESMTP id 3D17AC82012
for ; Sat, 9 Apr 2011 20:13:53 +0000 (UTC)
Received: from ambass by max2.hosteur.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1Q8ejW-00043y-6H
for ; Sat, 09 Apr 2011 22:26:14 +0200
To:
Subject: Studio Inquiry.
X-PHP-Script: ambassade-madagascar.fr/site/mailer.php for 94.100.31.74
From: Andrea Purdon <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain
Message-Id: <[email protected]>
Date: Sat, 09 Apr 2011 22:26:14 +0200
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: No, score=2.3
X-Spam-Score: 23
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system "", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello, My name is Andrea Purdon from M&G Investment International
United States. I want to know if there is any availability for hiring of
your studio and recording services if possible. If there is availability,
kindly let me know about the dates and the quotes. [...]
Content analysis details: (2.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FREEMAIL_FROM Sender email is freemail
(andreapurdon[at]rocketmail.com)
-0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
[score: 0.0539]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[217.16.6.64 listed in bb.barracudacentral.org]
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL
X-Spam-Flag: NO

Hello,



My name is Andrea Purdon from M&G Investment International United States.=
I want to know if there is any availability for hiring of your studio an=
d recording services if possible. If there is availability, kindly let me=
know about the dates and the quotes.


They are looking forward to Arrive on 4th of July 2011. The ONLY mode Of =
Payment is :Visa , Master or Amex Card.


Write me immediately with an update on the list of all the services you c=
an offer and available at that time. Call me anytime.



Mr Andrea Purdon.

a new version!
Hello,
My name is Kelvin Law from M&G Investment International UK. I want to know
if there is any availability for 8 couples who needs rooms, apartments and
services. They are coming for visit in your city. If there is availability,
kindly let me know about the dates and the quotes. They are looking forward
to Arrive on 4th of September and check out- 14th September 2011.
The ONLY mode Of Payment is :Visa , Master or Amex Card. Write me
immediately with an update on the list of all the services you can offer and
available at that time.
Call me anytime.
Mr Kelvin Law..
Phone: +447045768990

Hi BFI, thanks for posting! Could you please add the email address they are using?

Hi
I have just received a similar email with subject "Lodging Inquiry"....

"My name is Mike Dane from M&G Investment International United states. I want to know if there is any availability for 5 guests who needs rooms, apartments and meal services if possible. They are coming for visit in your city. If there is availability, kindly let me know about the dates and the quotes.
They are looking forward to Arrive on 4th of October 2011. The ONLY mode Of Payment is :Visa , Master or Amex Card.
Write me immediately with an update on the list of all the services you can offer and available at that time. Call me anytime.
Mr Mike Dane."

Welcome Chuck50,
thank you for this warning, good to know you can't be scammed.
Do you still have the email address the scammer is using, or was it the same one as above? A lot of victims do a Google search of the email address they got a suspicious message from.

To other readers: No way this email quoted by Chuck50 was written by an American, the English points to a non-native speaker. The scammer is preparing a credit card scam; he will use phished details of other victims' credit cards for payment, then cancel and ask for a refund. The credit card company will eventually find out, Chuck50 would be out of his money and possibly get a visit from the police.

Got the same type of email as well today:
Email address being used is [email protected], though pretending to be from [email protected]

I've put the properties of the email below the message received via email.

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Peter Purdon
Sent: 05 September 2011 04:53 PM
Subject: Lodging / Hunting Inquiry.

Hello,



My name is Peter.A.Purdon from M&G Investment International. I want to know if there is any availability for 5 guests coming for Business meeting that needs rooms, apartments and hunting services if possible. They are coming for visit in your city. If there is availability, kindly let me know about the dates and the quotes.


They are looking forward to Arrive on 20th of October 2011. The ONLY mode Of Payment is :Visa , Master or Amex Card.


Write me immediately with an update on the list of all the services you can offer and available at that time. Call me anytime.


Director: Peter.A.Purdon
M & G International Investments UK
233 Wale Street, London EC2V 7HN
Phone: + (44) 704-5768990


---------------------------------------------------------------
Properties of email:
Return-Path: <[email protected]>
Received: (qmail 3867 invoked by uid 399); 5 Sep 2011 10:52:39 -0400
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
mail506.opentransfer.com
X-Spam-Level:
X-Spam-Status: No, score=0.1 required=5.0 tests=RDNS_NONE autolearn=disabled
version=3.2.5
Received: from unknown (HELO mail505.opentransfer.com) (98.130.1.161)
by mail506.opentransfer.com with ESMTP; 5 Sep 2011 10:52:39 -0400
X-Originating-IP: 98.130.1.161
Received: (qmail 24868 invoked by uid 399); 5 Sep 2011 14:52:39 -0000
Received: (qmail 24861 invoked by uid 399); 5 Sep 2011 14:52:38 -0000
Received: from unknown (HELO ironport-1.opentransfer.com) (76.162.254.109)
by mail505.opentransfer.com with ESMTP; 5 Sep 2011 14:52:38 -0000
X-Originating-IP: 76.162.254.109
Received: from 73.205.210.180.ds.sparkstation.net (HELO server.sothebysrealty.sg) ([180.210.205.73])
by ironport-1.opentransfer.com with ESMTP; 05 Sep 2011 10:52:38 -0400
Received: from sothebys by server.sothebysrealty.sg with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1R0aXL-0007Em-N7
Subject: Lodging / Hunting Inquiry.
From: Peter Purdon <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Sender: <[email protected]>
Date: Mon, 05 Sep 2011 10:52:35 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.sothebysrealty.sg
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server.sothebysrealty.sg

Just a follow up:

This person is using the domain server.sothebysrealty.sg , which in turn is "owned" by a domain called http://www.internationaladmin.com (blank website) which in turn is hosted with a company called Corporation Service Company http://www.cscprotectsbrands.com which auto-forwards to http://www.cscglobal.com (not sure if this is a legit company)....and there is also a http://www.cscinfo.com which auto-forwards as well to the above address.

So all-in-all, just avoid any business with the above domains perhaps.

Welcome mcmdebeer, and thank you for this detailed report. The scammers created a fraudulent domain, and then they forgot to use a true phone number.

Numbers beginning with +44 70........ are re-direct numbers which will pass on your call to anywhere in the world. A genuine company would just use a genuine UK number.

By the way, the scammer is mailing from Singapore.