Warring! Warning! Warning!
As you know Royal Vopak NV is real and there are below information on the Vopak.com :
Vopak Terminal Laurenshaven (Rotterdam)
3197 KH Botlek Rotterdam
Port no. 4316
+31 181 240 911
+31 181 219 839
Name: Hans de Willigen
E-mail address: firstname.lastname@example.org
+31 181 240869
But please study below expectations and experiences with email@example.com and be aware that scammers spoofed the Vopak mail!
Our buyer sent us a TSA from Royal Vopak NL through email of "firstname.lastname@example.org "
I contacted to " email@example.com" and they confirmed the TSA!
Then I contacted to ferm-Rotterdam ( port of Rotterdam authority) to verify the tank farm !
First a person provided TSA for our buyer with below email and was said that we work with ROYAL VOPAK NV and can get farm tank for you easily !!
And you can see look up their website , in fact I made sure that they are scammer:
Domain Name: BALCOENERGYSERVICES.COM
Registry Domain ID: 2179188953_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2017-10-26T14:40:30Z
Creation Date: 2017-10-26T14:40:29Z
Registry Expiry Date: 2018-10-26T14:40:29Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: firstname.lastname@example.org
Registrar Abuse Contact Phone: 480-624-2505
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Name Server: NS25.DOMAINCONTROL.COM
Name Server: NS26.DOMAINCONTROL.COM
Ferm-Rotterdam sent me below letter:
Could you provide me some more information. I assume you are using Gmail. Could you click on "Show Original" option (https://www.lifewire.com/how-to-see-full-email-headers-in-gmail-1171960) and copy - paste all information? Then we can see who really send the email!
I did that you can see results below:
Message ID <email@example.com>
Created at: Fri, Jan 19, 2018 at 4:02 PM (Delivered after 33 seconds)
From: ROYAL VOPAK NV
Subject: STORAGE TANK FACILITY FULL LEASE AGREEMENT VERIFIED
SPF: NEUTRAL with IP 220.127.116.11 Learn more
DMARC: 'FAIL' Learn more
Certainly, Ferm-Rotterdam responded as following:
As can be seen from the information you provided, someone wite a @godaddy.comemail address spoofed the Vopak mail.
This can also be seen at the DMARC check, which is "FAIL".
From a legitimate conversation with someone from Vopak, this information should be provided:
SPF:PASS Meer informatie
DKIM:'PASS' with domain vopak.com Meer informatie
DMARC:'PASS' Meer informatie
Thanks for providing the information,