Strange old world phising

For the last few days I've been recieving a variation on a old phising style were people try to get you to respond to a fake order and then as part of the data protection process they get you to give them your card number again which they say they have already but just need you to confirm. Its a simple confidence trick and done probably many times a day. Well the IP comes back to 203.82.37.115 which traces back to:


inetnum: 203.82.32.0[whois][trace][reverse ip] - 203.82.47.255[whois][trace][reverse ip]
netname: FIBERCITYNET
descr: FiberCity
descr: ISP
descr: Makati, Philippines


Here are the email messages from the scammer:


from Customer support Colon Pro
to
cc Support@colonprocleanse.com
date 7 June 2009 15:09
subject Call regarding CP92246

Hello

Thank you for your call regarding:

Order ID
CP92246

We have cancelled your subscription and you will NOT be billed for any future orders effective 6/06/2009

We have also noted your feedback:
you called and updated you refund... you received again another charged.. you requested for refudn.. you will return the bottle..

We have forwarded a copy to the appropriate department for review. You will have a response via email in the next 24-48 hrs.

If you have any questions or concerns, please contact customer support at the following email:

Support@colonprocleanse.com

Thank you
Customer Support

----

from	Customer support
to
date		8 June 2009 18:10
subject		Re: Call regarding CP92246
mailed-by		gmail.com

Hi,

Thank you for your email.

As part of our policy, a cancellation of the original purchase can only occur after you have received the order, and sampled the actual product itself. This is the entire purpose of the trial order.

As such, should you wish to cancel your order beyond the first sample, please email us when you have received your order, and do state the reason then that you are not satisfied with the product.

If you are satisfied with the product received, please do nothing, and we will only charge you for the bottle received in a few days thereafter.

If you have however changed your mind about your order, then the original package of 30 capsules must then be sent back in its unopened form (since we are assuming you are changing your mind about the entire order given that you are contacting us prior to receiving the shipment).

To do so, please simply advise us via return email that you wish to return the package, and we can provide you with a RMA# and address, and once you give us the tracking number for the return package, we can cancel your order accordingly.

Thank you for understanding our try first, pay later trial policy (which is not meant for abuse of the ‘trial’, which I am sure you can understand many unscrupulous customers attempt to do).

We trust that you will indeed be delighted with the product and will choose to keep it, in which case you will be billed only for the item received.

We will however cancel ALL future bills after that, so only the original package of 30 pills will be charged to your card.

If you should have any further questions, please also feel free to let me know.

Best regards,

Shane West

Customer support

----

	from	Customer support
to
date		9 June 2009 03:44
subject		Re: Call regarding CP92246
mailed-by		gmail.com

Dear Customer

Thank you for your email and inquiry

Please let me know:

1. The amount that was deducted from your card

2. The charge descriptor that appears on your card's statement

I will be most happy to assist you on this matter thereafter

Thank you and best regards,

Victoria Carols

Customer Support

----- Original Message -----

From: iron man

To: revkev@gmail.com

Cc: Support@colonprocleanse.com

Sent: Saturday, June 06, 2009 1:19 PM

Subject: Call regarding AP97972

Delivered-To:
Received: by 10.103.227.11 with SMTP id e11cs119919mur;
     Mon, 8 Jun 2009 03:38:54 -0700 (PDT)
Received: by 10.141.201.1 with SMTP id d1mr5430530rvq.16.1244457532844;
     Mon, 08 Jun 2009 03:38:52 -0700 (PDT)
Return-Path: 
Received: from mail-px0-f197.google.com (mail-px0-f197.google.com [209.85.216.197])
     by mx.google.com with ESMTP id 36si4630554pzk.102.2009.06.08.03.38.50;
     Mon, 08 Jun 2009 03:38:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of colonpowercs@gmail.com designates 209.85.216.197 as permitted sender) client-ip=209.85.216.197;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of colonpowercs@gmail.com designates 209.85.216.197 as permitted sender) smtp.mail=colonpowercs@gmail.com; dkim=pass (test mode) header.i=@gmail.com
Received: by mail-px0-f197.google.com with SMTP id 35so1122770pxi.24
     for ; Mon, 08 Jun 2009 03:38:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
     d=gmail.com; s=gamma;
     h=domainkey-signature:received:received:message-id:from:to:references
      :subject:date:organization:mime-version:content-type:x-priority
      :x-msmail-priority:x-mailer:x-mimeole;
     bh=QDNBh8oCj+TEJnbQk0To3SUjRoq7fV6as7GErCV/tyw=;
     b=FLX/bcOUMIJONJAmW+w8ZYZX4WgeEWWyMqoqmwcVHTYW+htSl69GBjHOEbLuEUe0Le
      XpDc/J0CKARzVMXc0s5uYymf8AuPRGbRCfkleXg8lauVwJkkm7exZLgHv5NVOlRr5t1r
      MjSypoRoTRj2nRsAbbmKENCbl6gUVwzVokAdo=
DomainKey-Signature: a=rsa-sha1; c=nofws;
     d=gmail.com; s=gamma;
     h=message-id:from:to:references:subject:date:organization
      :mime-version:content-type:x-priority:x-msmail-priority:x-mailer
      :x-mimeole;
     b=Wtesu2wAX135nz/zws7rexVZV7Ly3x7rSnyaDk3PT7nxm0BTvkT7Q2GSXuirp/WF/a
      IXs2CJQkIRx79EwknXjmdp0uc20xCEck4avPdXhRSlFYvTmZH1qFwMOWDhcjd/YrIMYj
      lw8bwziRwpinGt5yEIayvUON6dl+GgyqUsxsU=
Received: by 10.142.246.19 with SMTP id t19mr2347662wfh.146.1244457530836;
     Mon, 08 Jun 2009 03:38:50 -0700 (PDT)
Return-Path: 
Received: from contactda4b18d ([203.82.37.115])
     by mx.google.com with ESMTPS id b39sm14843325rvf.9.2009.06.08.03.38.48
     (version=SSLv3 cipher=RC4-MD5);
     Mon, 08 Jun 2009 03:38:50 -0700 (PDT)
Message-ID: <13e801c9e8ac$52702530$cf03a8c0@contactda4b18d>
From: "Customer support" 
To: 
References: <7d0a08030906061319u73d23dddm33c8d7c2fec8492f@mail.gmail.com>
Subject: Re: Call regarding CP92246
Date: Mon, 8 Jun 2009 19:44:29 -0700
Organization: Colonprocleanse
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_13A5_01C9E871.89AE4DA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_13A5_01C9E871.89AE4DA0
Content-Type: text/plain;
charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hello Thank you for your call regarding: Order ID CP92246 We have cancelled your subscription and you will NOT be billed for any future orders effective 6/06/2009 We have also noted your feedback: you called and updated you refund... you received again another charged.. you requested for refudn.. you will return the bottle.. We have forwarded a copy to the appropriate department for review. You will have a response via email in the next 24-48 hrs. If you have any questions or concerns, please contact customer support at the following email: Support@colonprocleanse.com Thank you Customer Support