Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
by d1ddyd Sun Apr 24, 2011 6:10 am
I get a lot of spam emails having my email address posted all over the web for my business but when this came through I wondered if this was some sort of scam. As you can see the gentleman's English grammar is appalling. Also included as an attachment was a *.xls file claiming to be a price list of the companies products. (some kind of hacking/phishing code hidden in a macro maybe?).
Also found it strange that the web address was included at the bottom but is not a complete address. It just says 'www.td-lighting'.
Thanks for reading any help with this, much appreciated.


from QIANCHUN <[email protected]>
to ME
date 24 April 2011 03:30
subject stage lighting12

hide details 03:30 (7 hours ago)


Dear Sir

Thank you for your time

Yeah, we sent all DJ lighting equipment price list , also included some led lighting product price list yesterday, these are produced by our own factory,if you need more information from us, please let us know soonest

thanks again

www.td-lighting

td lighting manufactory co.ltd

___________________________________________________________________


Delivered-To: (my email address)
Received: by 10.143.161.5 with SMTP id n5cs52237wfo;
Sat, 23 Apr 2011 20:22:05 -0700 (PDT)
Received: by 10.216.136.151 with SMTP id w23mr2116915wei.86.1303615323072;
Sat, 23 Apr 2011 20:22:03 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mx-h.b-one.net (mx-h.one.com [91.198.169.55])
by mx.google.com with ESMTP id q3si9570340weh.190.2011.04.23.20.22.01;
Sat, 23 Apr 2011 20:22:03 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 91.198.169.55 as permitted sender) client-ip=91.198.169.55;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 91.198.169.55 as permitted sender) [email protected]
Received: by mx-h.b-one.net (Postfix, from userid 106)
id 43CE822EBE3D; Sun, 24 Apr 2011 05:22:01 +0200 (CEST)
X-Virus-Scanned: by one.com
Received-SPF: pass (mx-h: domain of [email protected] designates
220.181.14.61 as permitted sender)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from m14-61.vip.163.com (m14-61.vip.163.com [220.181.14.61]) by
mx-h.b-one.net (Postfix) with ESMTP id 305C722EBE3D for
<my other email address>; Sun, 24 Apr 2011 05:21:49 +0200 (CEST)
Received: from qiaochun76 ( [58.254.118.40] ) by ajax-webmail-wmsvr11
(Coremail) ; Sun, 24 Apr 2011 10:30:39 +0800 (CST)
Date: Sun, 24 Apr 2011 10:30:39 +0800 (CST)
From: QIANCHUN <[email protected]>
To: <my email address>
Message-ID: <[email protected]>
Subject: stage lighting12
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_42485_1659259814.1303612239243"
X-Originating-IP: [58.254.118.40]
X-Priority: 3
X-Mailer: Coremail Webmail Server Version SP_ntes V3.5 build
110215(12912.3637.3636) Copyright (c) 2002-2011 www.mailtech.cn 163vip
X-CM-TRANSID: bwiowKCLWdxPi7NNCqkaAA--.1857W
X-CM-SenderInfo: 5tld0upkxqllg6yl1hqrwthudrp/1tbiBwkr2k2n+FdJvwAAsM
X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

------=_Part_42485_1659259814.1303612239243
Content-Type: multipart/alternative;
boundary="----=_Part_42487_1907827531.1303612239243"

------=_Part_42487_1907827531.1303612239243
Content-Type: text/plain; charset=GBK
Content-Transfer-Encoding: 7bit

Dear Sir

Thank you for your time

Yeah, we sent all DJ lighting equipment price list , also included some led lighting product price list yesterday, these are produced by our own factory,if you need more information from us, please let us know soonest

thanks again

www.td-lighting

td lighting manufactory co.ltd


------=_Part_42487_1907827531.1303612239243
Content-Type: text/html; charset=GBK
Content-Transfer-Encoding: 7bit

<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US">Dear Sir<o:p></o:p></SPAN></P>
<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US">Thank you for your time<o:p></o:p></SPAN></P>
<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US">Yeah, we sent all DJ lighting equipment price list , also included some led lighting product price list yesterday, these are produced by our own factory,if you need more information from us, please let us know soonest<o:p></o:p></SPAN></P>
<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US">thanks again<o:p></o:p></SPAN></P>
<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US"><A href="http://www.td-lighting/">www.td-lighting</A><o:p></o:p></SPAN></P>
<P><SPAN style="FONT-FAMILY: Arial; COLOR: black; FONT-SIZE: 10.5pt" lang="EN-US">td lighting manufactory co.ltd<o:p></o:p></SPAN></P>
<P>&nbsp;</P>
------=_Part_42487_1907827531.1303612239243--

------=_Part_42485_1659259814.1303612239243
Content-Type: application/vnd.ms-excel; name="LED lights00.xls"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="LED lights00.xls"
Advertisement

by jolly_roger Sun Apr 24, 2011 8:17 am
Yes d1ddyd it seems strange to me. The td-lighting webpage shows different lighting components and is located in China
Registrant: Contact Privacy Inc. Customer 0126680149
96 Mowat Ave Toronto, ON M6K 3M1 CANADA
Record created on 19-Feb-2011.
Record expires on 19-Feb-2012.
When viewing the webpage, an address at the base of the page says 163.com
The ICANN Registrar shows this to be NETWORK SOLUTIONS, LLC.
Anything to do with network solutions means spam. May I suggest to simply delete the email and do not respond in any way to it otherwise you will be drowning in more spam.

Who is online

Users browsing this forum: Bing [Bot], ClaudeBot, Google [Bot] and 21 guests