Our University Enrollment department has been trying to contact you.
We feel you may be eligble for a degree based upon you past work experience.
The date for qualifying for our 2 week degree program is ending on
Friday, January 20th, 2006.
As of now we can only offer you a BA, BSc, or a MA.
If you enroll by the due date then your degree of
choice and transcripts could be sent to you within 2 weeks.
The above is the bulk of an email I've been getting recently. This particular one goes on:
Enrollment Office:
1-206-333-0497
Bryon Epps
BSc Education
Administration Office
Here is the email header, notice the reply goes back to "burton.com", which is a snow boarding website:
Return-Path: <lscwgjo@go.com>
Received: from 12118368 ([61.36.85.86])
by bugsbunny.castlecops.com (8.13.4/8.13.4) with SMTP id k0KHGCnI021952;
Fri, 20 Jan 2006 12:16:14 -0500
X-Sieve: CMU Sieve 2.2
Message-ID: <BAY10-F236A1BA688DC2A2827D6D0B9400@burton.com>
Received: from 61.36.85.86 by by10fd.bay10.burton.com with HTTP;
Fri, 20 Jan 2006 22:14:52 +0500
X-Originating-IP: [61.36.85.86]
X-Originating-Email: [BryonEpps@burton.com]
X-Sender: BryonEpps@burton.com
From: "College Registration" <College_Registration@burton.com>
A quick check of any email blacklists:
blacklist report via dnsstuff
Seems to be a Korean IP origination that is being actively blocked by lots of RBLs. This IP has issues.
I took the liberty to call the phone number and recorded it. Click the link below to play the WAV file:
listen to the recording
So they want the caller to leave two phone numbers, one for the night and one for the day. I wonder what's next on the list if they call?
A search on Google for that phone number reveals this:
John Chase
Chase, McKewen & Associates, LLC
16135 Preston Road
Dallas, TX 75248
Fax: 206-333-0497
Phone: 800-773-8092
Apparently that is no longer valid. A reverse phone number search at switchboard.com, phonenumber.com and whitepages.com come back empty.
Whole thing is a scam. Don't call!
This is the email I received:
This is the domain the email is spoofing for the reply:
What will these crooks try next? Using a Korean IP to pitch the sales of a degree in two weeks with a reply to a legit domain. But you need to call and leave your phone numbers. I don't think so!
