Fake product queries

[Robert Baer]

I am curious as to how many (on the average) fake/phony product
queries you get per month.
These "queries" have a rather wide range of "sources": college
departments, hospitals, construction companies, electronic equipment
manufacturers, etc.

We stopped wasting our time in vetting the source of each one ages ago.

Here are two recent ones we (Oil 4 Less® LLC) have received:

-------- Original Message --------
Subject: Fluke Electronics product RFQ
From: Keith Fangohr <keith....@alliedtechequipsolutions.com
Date: Fri, January 10, 2020 8:59 am
To: in...@oil4lessllc.com


Hello Sales,

We need price and availability on the Digital Multimeter with the
model number and descriptions below:

Kindly workout the quote and email me back.

1)Fluke 87V industrial true RMS
multimeter w/Temperature........30units

Shipping: (TBD)expedite delivery requested.

Awaiting to hear from you asap.

Keith Fangohr
Allied Technology & Equipment Solutions Inc.
440 N. 4th Street Reading Pennsylvania 19601
Tel: 724-361-3253

-------- Original Message --------
Subject: CISCO ROUTER RFQ
From: Keith Fangohr <keith....@alliedtechequipsolutions.com
Date: Thu, March 05, 2020 9:44 am
To: in...@oil4lessllc.com


HELLO SALES.

I WOULD LIKE TO HAVE QUOTATION ON THE CISCO ROUTER PRODUCT PART
NUMBERS LISTED BELOW:

1)CISCO NIM-2FXS/4FXO 2-PORT FXS AND 4-PORT FXO NIM

2)Cisco NIM-2GE-CU-SFP= 2-Port Ge Wan Nim, Dual-Mod.

3)Cisco ISR 4331-V/k9.

4)Cisco ISR 5331.


ALL PARTS MUST BE GENUINE CISCO PRODUCT PARTS NOT COMPATIBLE OR
AFTERMARKET.

PAYMENT VIA:MASTER/VISA

WAITING FOR THE QUOTES SO I COULD LIST THE QTY NEEDED.

REGARDS.

Keith Fangohr
Allied Technology & Equipment Solutions Inc.
440 N. 4th Street Reading Pennsylvania 19601
Tel: 610-738-3157

[Rick C]

I get stuff like that once in a blue moon. I think they used to come in waves... very small waves. I don't recall seeing any in likely close to a year, but then I don't give them any attention anymore. Clearly they are trying to work a scam.

--

Rick C.

- Get 1,000 miles of free Supercharging
- Tesla referral code - https://ts.la/richard11209

[Klaus Kragelund]

We had a web shop where we sold children’s clothing

Once in a while we got huge orders from other countries

Typically this would be an order done paid by with a stolen credit card

Cheers

Klaus

[John Robertson]

On 2020/03/07 12:13 a.m., Robert Baer wrote:
>   I am curious as to how many (on the average) fake/phony product
> queries you get per month.

Several per day - they get binned - the usual giveaway is they don't
name any products, they simply want a list of everything with discounts.

"Have you receive my email? like last email i have mentioned we are
supply marine equipments, so if you have any require,"

"Please send in your best offer for attached products, Kindly qoute item
number 4 in a different invoice, as it will be shipped to a defferent
location."


The "Junk" button on Thunderbird makes short work of them...

John ;-#)#

--
(Please post followups or tech inquiries to the USENET newsgroup)
John's Jukes Ltd.
MOVED to #7 - 3979 Marine Way, Burnaby, BC, Canada V5J 5E3
(604)872-5757 (Pinballs, Jukes, Video Games)
www.flippers.com
"Old pinballers never die, they just flip out."

[jla...@highlandsniptechnology.com]

Some institutions must go out for N bids to buy anything. They
probably have a preferred supplier all lined up.

But then, both of those requests are not in typical English purchasing
syntax, so may be faked from asia or somewhere for some unknown
reason.





--

John Larkin Highland Technology, Inc

The cork popped merrily, and Lord Peter rose to his feet.
"Bunter", he said, "I give you a toast. The triumph of Instinct over Reason"

[Michael Terrell]

On Saturday, March 7, 2020 at 3:13:28 AM UTC-5, Robert Baer wrote:

I used to get them from my website that clearly stated that all items were NOS surplus. Requests for prices on long lists of fuses or ICs were common. Now that Earthlink has mostly shut down, they closed peoples websites without notice so I don't currently have one.

[Jon Elson]

On Sat, 07 Mar 2020 00:13:10 -0800, Robert Baer wrote:

> I am curious as to how many (on the average) fake/phony product queries
> you get per month.
> These "queries" have a rather wide range of "sources": college
> departments, hospitals, construction companies, electronic equipment
> manufacturers, etc.
>
>

I get a query every couple days wanting a price list and description
of my products, NEVER mentioning ANYTHING about our area of interest.
I just toss those. Yeah, right, they want to buy 1000 units but don't
even mention what they want to buy.

Then, every few weeks I get some like you mention, where they want to buy
hundreds of Fluke DVMs or computer motherboards or something that we do
not sell. (We are a manufacturer of motion control products, not a
distributor of general electronic stuff.)

About two years ago I got a call from my bank asking if I was expecting a
big check. I was not. Some scammer had mailed a fabricated check to my
bank with no prior notice, and then wanted me to send some portion to
them. I got in touch with the trucking company the check was drawn on,
and they were in total panic mode as a bunch of these bogus checks had
been sent to various outfits, and many deposited them. They were not
going to be able to meet their payroll! I managed to get the check,
cover letter and envelope from my bank, and reported that I had all this
to the postal inspection service, but never even heard back.

So, that's MY bogus order story.

Jon

[Rick C]

I haven't had one of these in a while and I just got one today...

Hello,
I would like to inquire about Trickle Charger you sell,so email me availability and let me know the types of payment you accept.Hope to hear back from you ASAP.

Best Regards,

Bill Dyer
Dyer Product Inc,
San Francisco, CA 94133


The funny part is they didn't send it to the email address listed on the web site. Rather they sent it to an email address associated with posting here!

--

Rick C.

+ Get 1,000 miles of free Supercharging
+ Tesla referral code - https://ts.la/richard11209

[Robert Baer]

** ANOTHER fake e-mail, no order this time **
Dear Supplier,

My name is Amanda McDonnell, The Director of Procurement Harvard
University. The University is required to have a W-9 (modified) on file
for every companies with which it does business.


Please include a completed W-9 to your response.

Thank you!

Amanda McDonnell
Director of Procurement, Financial Accounting and Reporting
Harvard University
1033 Massachusetts Avenue, 2nd Floor
Cambridge, MA 02138
P: (617) 714-9955
F: (617) 714-0073

[Rick C]

What is the return email address?

--

Rick C.

-- Get 1,000 miles of free Supercharging
-- Tesla referral code - https://ts.la/richard11209

[Robert Baer]

Amanda McDonnell <procu...@harvardprocurements.com>

[Robert Baer]

Here is a well-crafted fake RFQ:
http://www.oil4lessllc.org/VA/

[Robert Baer]

Subject:
Request For Quotation
From:
Rich McDowell <ri...@mohrsengineering.com> (Add as Preferred Sender)
Date: Tue, Jun 23, 2020 8:54 am
To: in...@oil4lessllc.com
Hello Sales,

We need a quote proposal on this items (1) Seagate Backup Plus Slim 2TB
USB 3.0 Portable External Hard Drive (2) Intel Core i7-9700KF 3.6 GHz
Eight-Core LGA 1151 Processor (3) Zebra 800015-440 YMCKO Color Ribbon -
200 Images - i Series.

Please advise price and availability before we list the quantities needed.

Looking forward to hear back from you.

Regards,

Rich McDowell
President
T: 810-216-9201 | F: 810-216-4402
Mohr Engineering | 1351 Rickett Rd | Brighton, MI 48116.

[Robert Baer]

Subject:
GARMIN GPS UNITS NEEDED!
From:
Dan Ariens <dan.a...@ariensspecialtybrandllc.com> (Add as Preferred
Sender)
Date: Tue, Jun 23, 2020 12:44 pm
To: in...@oil4lessllc.com
Attn:Sales Dept,

I would like to request a quote on Garmin Gpsmap with
the model number below :

Manufacturer Mfg Part #
1) Garmin Gpsmap 78sc 010-00864-02 ........15 Units
2) Garmin Gpsmap 78s 010-00864-01 ........15 Units

Condition:New (NOT Refurbished) Please take note
Shipping method to be determined after receiving your quotation.
Payment via credit card :Visa/Master

Awaiting to hear from you with the pricing and availability
I look forward to your response asap.

Dan Ariens
ARIENS SPECIALTY BRANDS LLC.
401 S Wright Rd Janesville WI 53546
Phone:608-728-7733

[Jeff Liebermann]

Mohr Engineering is a real company:
<http://www.mohrengineering.com>
However, the senders email address is slightly different as:
mohr(s)engineering.com
Note the added "s".

Digging into whois, I find that the domain registration for
mohrsengineering.com is now one day old:
<https://whois.domaintools.com/mohrsengineering.com>
That's a sure sign of a "throw away" domain.

It's difficult to tell where they're located. Traceroute isn't very
helpful. The IP address of the server seems to be a dumping ground or
throw away bulk DNS names with 678 domains sharing the same server.
Email works, but nothing else:
<https://mxtoolbox.com/SuperTool.aspx?action=a%3amohrsengineering.com&run=toolpage>
<https://mxtoolbox.com/SuperTool.aspx?action=mx%3amohrsengineering.com&run=toolpage>

The registrant, WhoisGuard Protected, is allegedly located somewhere
in Panama. Trying to contact the registrant is unlikely to succeed
because they are hiding behind the stupid ICANN privacy restrictions.
https://www.namecheap.com/security/what-is-domain-privacy-definition/
along with all the other spammers and scam artists.

I don't know exactly what their scam might be, but since this seems to
be a chronic problem for you, I thought it might be useful to
demonstrate how to research such messages.




--
Jeff Liebermann je...@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

[Anthony Stewart]

On Wednesday, 24 June 2020 01:19:30 UTC-4, Jeff Liebermann wrote:

> The registrant, WhoisGuard Protected, is allegedly located somewhere
> in Panama. Trying to contact the registrant is unlikely to succeed
> because they are hiding behind the stupid ICANN privacy restrictions.
> https://www.namecheap.com/security/what-is-domain-privacy-definition/
> along with all the other spammers and scam artists.

Domain name: MOHRSENGINEERING.COM
Registry Domain ID: 2541031096_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2020-06-23T06:21:07.00Z
Registrar Registration Expiration Date: 2021-06-23T06:21:07.00Z
Registrar: NAMECHEAP INC
Registrar IANA ID: 1068
Registrar Abuse Contact Email: ab...@namecheap.com
Registrar Abuse Contact Phone: +1.6613102107
Reseller: NAMECHEAP INC

Namecheap 11400 W Olympic Blvd, Los Angeles, CA 90302

certain fraud Reply to FBI if you care https://www.ic3.gov/default.aspx

https://efraudsters.com/us/fraudsters/6613102107/

[Robert Baer]

I think the overall idea is to have the victim buy and deliver the
stuff on some kind of payment promise that looks OK but is fractured.
Money orders of any type and source can be counterfeited.
Even real genuine money orders can be cashed in before presentation.
I know of a real genuine money order bought at a reliable store here
in Lacey where this happened.
One can cash a check these daze using their 'phone.
Security of process sux.
Person "X" at store generated MO properly and handed it over to buyer.
Later "X", having all info, and their 'phone, cashed it.
POOF!

Hell, an industrious person might even cash a check using their
'phone and ten seconds later cash it at an ATM; double your money and
double your "fun".
Generate 10 checks and in a time space of a few minutes double them
this way.
"Instant" riches.

[Robert Baer]

** FIST ONE THIS WEEK **
Date: Wed, 24 Jun 2020 10:54:09 +0000 [03:54:09 PDT]
From: Katherine Lopez - Official States Persona
<whqesukix...@newjerseygov.mooo.com>Add
whqesukix...@newjerseygov.mooo.com to my Address Book
To: rober...@localnet.comAdd rober...@localnet.com to my Address Book
Subject: Re: robertbaer Please Approve - ORD#0879 (06/24/2020 10:54:09 am)
Part(s):
2 D035465767978.xls.img [application/octet-stream] 1,227 KB
Download

HTML Click HERE to view HTML content in a separate window.

Hello robertbaer,

We called your office earlier regarding the below enquiry and could not
get reply yet.

Please help on this as we need this order Asap.

Kindly give me a call upon receipt of this mail to approve our order.
** END FIRST ONE **

** SECOND ONE THIS WEEK **
Date: Wed, 24 Jun 2020 21:10:57 +0100 [13:10:57 PDT]
From: Such-uni Lang <tk...@dassd.co.uk>
To: Such-uni Lang <tk...@dassd.co.uk>
Subject: Approved Quotation + Purchase Order QHS-6864747990 // Poly
Int'l Limited (Shenzhen Office)
Part(s):
2 Purchase Order QHS-6864747990~PDF.7z
[application/x-7z-compressed] 507 KB Download

This message was written in a character set (UTF-8) other than your own.
If it is not displayed correctly, click here to open it in a new window.


HTML Click HERE to view HTML content in a separate window.


Dear Sir,



Thanks for your quotation. We are happy to inform you that it was
approved by our director

Kindly find attached purchase Order, Please let us know they
availability of you getting the order dispatched

Please provide acceptance with stamp & signature while we wait for your
proforma invoice to proceed the down payment



Thanks & Best regards

Such-uni Lang
Poly Int'l Limited(Shenzhen Office)
Tel.:+86-755-25109627 Fax.:+86-755-25132284
Moble/Wechat/Whatsapp: +86-13410165659 QQ:895864120
Email:Thin...@vip.163.com ; over...@polymillion.com
ADD.:West 27F, Wenhua Building, East Shennan Road, Luohu District,
Shenzhen, China
** END SECOND ONE THIS WEEK **

Be advised they got no such quotation from me or my company.

[Jack M]

responding to
http://www.electrondepot.com/electrodesign/fake-product-queries-953331-.htm ,
Jack M wrote:

Rick,
We received an email from the same Bill Dyer requesting 10 of our bike racks
to be shipped to New Zealand. I am assuming it's some kind of scam. Your
thoughts?
Jack M.

--

[Ricketty C]

You can converse with him a bit to ask questions about shipping and payment, etc. While they will have canned responses I'm sure, it will take someone's time to read your post. You should put as much junk and promotional info as possible. Spend some time discussing part numbers and finish. It would seem they at least looked at your web site to know something you sell.

I don't know how the scam works exactly. Usually they don't want the items. They want money. One way of getting that is to pay with a larger check than the purchase and get the difference in cash somehow. Usually this is done in person with a check from some apparently reliable source. Buy $3,000 of stuff, use a $5,000 check and get $2,000 back.

I'm curious about how they plan to pull this off. On the other hand, by acknowledging the email you are reinforcing that it is a valid email address and may get more from others. It might be best if you just ignore it completely.

Is there any reason why anyone in New Zealand would want to buy your bike racks? Where in the world are you?

--

Rick C.

-+ Get 1,000 miles of free Supercharging
-+ Tesla referral code - https://ts.la/richard11209

[Michael Langford]

Bill Dyer <maryk...@gmail.com>

11:55 AM (5 minutes ago)

to me
Why is this message in spam?

It is similar to messages that were identified as spam in the past.

Greetings,
Hope you're good. Through my search for Barn Birdhouse, I came across your address. Kindly let me know if you have it for sales. Also what are your payment terms and do you consider credit card an option? Will await your responses.

Best Regards,

Bill Dyer
Dyer Product Inc,

Glendale, CA 91203, USA

[Dave Gore]

Another one from Glendale. They seem to like the name Bill

Mr. Reeder <charles...@gmail.com>

Nov 16, 2021, 10:29 AM

to me

Greetings,
Hope you are fine. Well I am in the market to purchase Tire Carrier and through my search I came across your address. Kindly let me know the models you have or a link to the ones you have in stock. Also want to know whether you consider credit card an option for payment? Write soon.

Best Regards,

Bill Reeder
Reeder Equipment Co.
Glendale, CA 91203, USA

[Clive Arthur]

On 07/03/2020 08:13, Robert Baer wrote:
>   I am curious as to how many (on the average) fake/phony product
> queries you get per month.
>

<snip>

Don't knock fake products! I was once asked to sort out a problem with
about 20 non-working processor boards which all had different symptoms.
Turned out to be probably reject/fake static RAM chips - at that time
the code ran from RAM after being copied from EPROM.

It took a while to work out, but then ka-ching!

--
Cheers
Clive

[Robert Baer]

Common fake e-mail "queries" supposedly from head of University
department or mid-size business.
Variant includes a list of rather specific semi-exotic items.
Items mentioned not related to your business.

Have yet to figure out why they waste their time and internet bandwidth.



--
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Spehro Pefhany]

On Tue, 30 Nov 2021 19:36:50 -0800, Robert Baer
<rober...@localnet.com> wrote:

>
>> Greetings,
>> Hope you are fine. Well I am in the market to purchase Tire Carrier and through my search I came across your address. Kindly let me know the models you have or a link to the ones you have in stock. Also want to know whether you consider credit card an option for payment? Write soon.
>>
>> Best Regards,
>>
>> Bill Reeder
>> Reeder Equipment Co.
>> Glendale, CA 91203, USA
>>
>>
> Common fake e-mail "queries" supposedly from head of University
>department or mid-size business.
> Variant includes a list of rather specific semi-exotic items.
> Items mentioned not related to your business.
>
> Have yet to figure out why they waste their time and internet bandwidth.

I get these regularly. It's a classic overpayment scam. They get you
to ship something to some fake address with check or credit card
payment. They will overpay the amount on some pretext.

Then ask you to credit the overpayment to some shady account.
Irrevocably.

By the time the credit card or check is detected as stolen they hope
to have your cash in hand. They may not care about the goods at all,
especially if they're holed up in a boiler room in Nigeria or Benin.

https://en.wikipedia.org/wiki/Overpayment_scam

Why is the quality so low? That, in itself, acts as a filter. If they
get a response it's probably someone vulnerable. If you've got free
time and confidence in your firewalls you can string them along for
amusement. Maybe confidence in physical security if you take it too
far.

Like that data scientist who was murdered in Chicago a couple weeks
ago, for a phone and laptop, pawned for $100, they dont give a s**t
about what it costs you, only the amount they can pocket.

https://chicago.cbslocal.com/2021/11/10/university-of-chicago-student-killed-in-robbery-shaoxiong-zheng/


--
Best regards,
Spehro Pefhany