Spam, Right

[Larry Peterson]

I received the following email this morning.

I am curious as to how to frame in shiny black frame, gold colored background approx. 2” around magazines. I am also curious as to how much per frame I would be looking at paying.

Thank you,
Mr. Doe

Obviously spam, right. Well maybe not. I have changed the name in case this really is a real person.

The email address was from the VA :

From: "John, Doe (Columbus)" <John.Doe@va.gov>

and it came from the VA.

Received: from gwnmta2.va.gov (gwnmta2.va.gov [152.133.26.46]

So I did an IP lookup and got:

General IP Information

152.133.26.46

2558859822

gwnmta2.va.gov

Department of Veterans Affairs

Department of Veterans Affairs

None detected

Corporate

Static IP

[TH="align: right"]IP:[/TH]

[TH="align: right"]Decimal:[/TH]

[TH="align: right"]Hostname:[/TH]

[TH="align: right"]ISP:[/TH]

[TH="align: right"]Organization:[/TH]

[TH="align: right"]Services:[/TH]

[TH="align: right"]Type:[/TH]

[TH="align: right"]Assignment:[/TH]

Still Looks good.
So I did a Blacklist check at http://whatismyipaddress.com/blacklist-check and it wasn't listed at any of the 75 or so, Blacklists that it checked. So it looks legitimate.

Here are the complete headers with the name changed to protect the guy who can't write an email that doesn't look like spam.


From - Sat May 05 14:08:00 2012
X-Account-Key: account1
X-UIDL: 001a613b476c092b
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <John.Doe@va.gov>
Received: from gwnmta2.va.gov (gwnmta2.va.gov [152.133.26.46])
by www.qualityartandframe.com (8.14.2/8.14.2) with ESMTP id q4560vwT011571
for <larry@thepaperframer.com>; Sat, 5 May 2012 02:00:57 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple;
d=va.gov; i=John.Doe@va.gov; q=dns/txt; s=vasel;
t=1336231826; x=1367767826;
h=mime-version:subject:date:message-id:from:to:
content-transfer-encoding;
bh=29ARZwkEjzK7V/l96HBCuBRpDaM=;
b=IwuAhas41Db1PP87ApBhaFLQq1f77UYMXoCgVepNSsKTHJMW7qp4fZzt ImM1t+4vilQDdmFhg8ybp9ElBJpxf8VSeiI+u0h88oMF91TllDa+t21t4 xZG88j3tFASK49aApb4/ZZn4ENdbrV5Dk9pARcpMOYssD3aADLcMId/3O vu9pcLDZ0/SCiekLEHUTIGODih82hjPpxgWJpIjYXK/9Xg7FLrCWJBmva P/X/yY0zAqAvfZagrj++dJS/1DHSkjv/waZADtryh+4DXiNm+6FEMgr9v YotIXcX1rDMOE9SubkPCNRXpjsUINKzu+A7EFfVvnJsP1k0MD4orG7xMY
w==;
X-SBRS: None
X-MID: 12476041
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01CD2AD3.FE0062C2"
Subject: NFL Magazines/ESPN/sports illustrated etc.
Date: Sat, 5 May 2012 11:30:25 -0400
Message-ID: <B0313026D7DBCE4DB00CD785E23028A511581DA2@VHAV10MSGA1.v10.med.va.gov>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: NFL Magazines/ESPN/sports illustrated etc.
Thread-Index: Ac0qyk2WhascimePRH+58/jR9n+pFQ==
From: "John, Doe (Columbus)" <John.Doe@va.gov>
To: <larry@thepaperframer.com>
X-OriginalArrivalTime: 05 May 2012 15:30:25.0344 (UTC) FILETIME=[FE1DBC00:01CD2AD3]
X-Antivirus: AVG for E-mail 10.0.1424 [2411/4979]
X-Antispam: NO; Spamcatcher 6.2.1. Score 1
X-AVG-ID: ID94F3AA4-541BF20F


I also did a search on the VA's site and Googled him and the VA without a single hit.

So what do you think? Is this spam or just someone who can't write a very good email. I haven't decided if I am going to reply to him or not. The email looks legit, but it sure sounds like spam.

 

[David Waldmann]

It's spam. The VA government only buys from approved vendors, and the vendor must go through a fairly extensive application process. RFQs are submitted to applicable vendors through their ebid system.

For more info, see http://www.eva.state.va.us/

 

[Larry Peterson]

It's spam. The VA government only buys from approved vendors, and the vendor must go through a fairly extensive application process. RFQs are submitted to applicable vendors through their ebid system.

For more info, see http://www.eva.state.va.us/

This is from the Department of Veteran's Affairs, not the State of Virginia but I'm sure that this VA has just as stringent protocols as your VA.

BTW, I decided a long time ago, the only way I would ever sell to any government agency (local, state or federal) is with cash or credit card up front and no paperwork. If they want to place an order on my site, fine, but none of this going through RFQ or other time wasting process. I have sold to a few this way without issue.

 

[David Waldmann]

Oh, I saw VA.GOV and thought it was the state of VA. I'm not that familiar (I'm in VT not VA), but have had some dealings with the VA Gov't and thought that's what it was.

 

[Mike Labbe]

The va probably has an open proxy that they dont know about, which is being exploited

 

[Larry Peterson]

The va probably has an open proxy that they dont know about, which is being exploited

That could be the case. Since it looks legitimate, I thought I would bring it up here, in case some of our other brethren get similar emails.

There must be a Nigerian rule that all spam frame request must say "shiney". Maybe they re zoning out on old reruns of Firefly.

 

[ArmyFramer]

Not sure about it being spam or not, but I do stuff for VA and fed/state gov't all the time and do not have to go through the RFQ process. As long as the amount is under $2500 they do not have to do an RFQ.

 

[Ylva]

Sounds like spam...but then, you never know. Why not send him a friendly email back with some questions, some prices and your payment terms?

 

[Bill Henry-]

… or it could be that some patient from the VA slipped out of group therapy, found an idle computer, and decided to try the Nigerian scam on you.

I’d be really careful. Check it out with some administrator from the VA.