We blogged already about Nigerian scams which make the usual mistakes associated with this kind of fraud. This time, we received an email which seemed to be adapted to the European civilization.

Fig. 1: Nigerian scam mails seem to get better adopted to the target audience.

I got really excited when I’ve seen that he is not “Mr.”, “Doctor” or “Barister”, his email address is not mr.something@host.com, he wants to invest Euros and not US dollars, and so on. But, this was only at the first sight.

A closer look reveals that it is the same old scam:

• Bad English language
• The country prefix of the telephone number is from Ivory Coast (I don’t know if the number exists)
• The headers show that the email was sent through a bot residing in Germany (see also our “Phishing and Malware Statistics” for Germany)
• They start the email with “Dear Sir” and any decent filter will penalize them for this
• The subject of the email is written with capital letters
• It mentions something about “account” and money “transfer”

An interesting thing showing how different our cultures are, is the fact that all these scams have something in common: They write the contact email address in the body of the email, even if they use the same address in either “From” or “Reply-To” field.

Would you write your email address in the body of the email if you expect the recipient of your email to get back to you?

Avira Antispam from the Premium Security Suite detects this message as Spam without even making use of the RBLs. As usual, we recommend that you never contact these guys and never believe offers which are too good to be true.

Sorin Mustaca
Manager International Software Development