You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Hardin <jh...@impsec.org> on 2013/03/22 05:29:47 UTC
"send a quote" spams?
I've been seeing "We'd like to buy your product, please send a quote"
messages for a while now; some of them are fairly obvious phishes sending
the user to a website where they enter their username and password to see
the "product specifications", but there are others whose purpose isn't
obvious - no URL, nothing beyond just "send us a quote for 5000 units of
your product".
Does anybody know the rationale behind these seemingly pointless spams?
Are they a 419 variant of some sort? That seems sort of inefficient given
that they will probably primarily reach of people who, like me, aren't
selling anything.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Gun Control: The theory that a woman found dead in an alley, raped
and strangled with her panty hose, is somehow morally superior to
a woman explaining to police how her attacker got that fatal bullet
wound. -- L. Neil Smith
-----------------------------------------------------------------------
294 days since the first successful private support mission to ISS (SpaceX)
Re: "send a quote" spams?
Posted by Bowie Bailey <Bo...@BUC.com>.
On 3/22/2013 7:53 AM, Kevin A. McGrail wrote:
> On 3/22/2013 12:41 AM, David B Funk wrote:
>> On Thu, 21 Mar 2013, John Hardin wrote:
>>
>>> I've been seeing "We'd like to buy your product, please send a quote"
>>> messages for a while now; some of them are fairly obvious phishes
>>> sending the user to a website where they enter their username and
>>> password to see the "product specifications", but there are others
>>> whose purpose isn't obvious - no URL, nothing beyond just "send us a
>>> quote for 5000 units of your product".
>>>
>>> Does anybody know the rationale behind these seemingly pointless
>>> spams? Are they a 419 variant of some sort? That seems sort of
>>> inefficient given that they will probably primarily reach of people
>>> who, like me, aren't selling anything.
>> The variant of that theme that I've seen is "we like your product, do
>> you accept
>> credit cards from -name-of-country-here-?"
>>
>> I'm guessing it's some kind of laundering stolen CC#s scam.
>>
> Agreed. They typically then pair it with either A) shipping to a
> international broker or B) asking you to pay the broker and shipping
> fees and add it to the credit card which turns out to be stolen.
>
> I see these and assumed it was because of our line of business. Will try
> and take a closer look at this.
I see these from time to time and just feed them to Bayes. Any serious
buyer would at least take the time to look at our website and see what
we sell.
--
Bowie
Re: "send a quote" spams?
Posted by John Hardin <jh...@impsec.org>.
On Fri, 22 Mar 2013, Kevin A. McGrail wrote:
> On 3/22/2013 12:41 AM, David B Funk wrote:
>> On Thu, 21 Mar 2013, John Hardin wrote:
>>
>> > I've been seeing "We'd like to buy your product, please send a quote"
>> > messages for a while now; some of them are fairly obvious phishes
>> > sending the user to a website where they enter their username and
>> > password to see the "product specifications", but there are others whose
>> > purpose isn't obvious - no URL, nothing beyond just "send us a quote for
>> > 5000 units of your product".
>> >
>> > Does anybody know the rationale behind these seemingly pointless spams?
>> > Are they a 419 variant of some sort? That seems sort of inefficient
>> > given that they will probably primarily reach of people who, like me,
>> > aren't selling anything.
>>
>> The variant of that theme that I've seen is "we like your product, do you
>> accept
>> credit cards from -name-of-country-here-?"
>>
>> I'm guessing it's some kind of laundering stolen CC#s scam.
>
> Agreed. They typically then pair it with either A) shipping to a
> international broker or B) asking you to pay the broker and shipping fees and
> add it to the credit card which turns out to be stolen.
Ah, ok, that makes sense. The non-obvious-phishing ones I've seen don't
discuss payment, but they may only be the initial lure and if there's a
response then they may try the scam.
Thanks!
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim V: Close air support and friendly fire should be easier to
tell apart.
-----------------------------------------------------------------------
295 days since the first successful private support mission to ISS (SpaceX)
Re: "send a quote" spams?
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 3/22/2013 12:41 AM, David B Funk wrote:
> On Thu, 21 Mar 2013, John Hardin wrote:
>
>> I've been seeing "We'd like to buy your product, please send a quote"
>> messages for a while now; some of them are fairly obvious phishes
>> sending the user to a website where they enter their username and
>> password to see the "product specifications", but there are others
>> whose purpose isn't obvious - no URL, nothing beyond just "send us a
>> quote for 5000 units of your product".
>>
>> Does anybody know the rationale behind these seemingly pointless
>> spams? Are they a 419 variant of some sort? That seems sort of
>> inefficient given that they will probably primarily reach of people
>> who, like me, aren't selling anything.
>
> The variant of that theme that I've seen is "we like your product, do
> you accept
> credit cards from -name-of-country-here-?"
>
> I'm guessing it's some kind of laundering stolen CC#s scam.
>
Agreed. They typically then pair it with either A) shipping to a
international broker or B) asking you to pay the broker and shipping
fees and add it to the credit card which turns out to be stolen.
I see these and assumed it was because of our line of business. Will try
and take a closer look at this.
Regards,
KAM
Re: "send a quote" spams?
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 21 Mar 2013, John Hardin wrote:
> I've been seeing "We'd like to buy your product, please send a quote"
> messages for a while now; some of them are fairly obvious phishes sending the
> user to a website where they enter their username and password to see the
> "product specifications", but there are others whose purpose isn't obvious -
> no URL, nothing beyond just "send us a quote for 5000 units of your product".
>
> Does anybody know the rationale behind these seemingly pointless spams? Are
> they a 419 variant of some sort? That seems sort of inefficient given that
> they will probably primarily reach of people who, like me, aren't selling
> anything.
The variant of that theme that I've seen is "we like your product, do you accept
credit cards from -name-of-country-here-?"
I'm guessing it's some kind of laundering stolen CC#s scam.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{