Skip to main content

Scam: Materials Intercessor | The Same German Buyer, Reworded and Sent Again the Next Morning

· 10 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

A firm in Germany needs a supplier of extracted materials from India for production in there plant. The same sender, the same dummy recipient, nineteen hours later, with every phrase swapped for a synonym.

Complete Email​

from: meoblacimpreak1973@op.pl
to: gisela@techie.com
date: 10/16/2025 9:29 AM
subject: Materials Intercessor

Mailed by: op.pl - Signed by: op.pl

Email Body​

A firm in Germany needs a supplier of extracted materials from India for production in there plant. reply for detailed.

Attacking email screenshot

Red Flags​

This is the second message from meoblacimpreak1973@op.pl in nineteen hours. The first, Materials Logistics Management, arrived at 2:16 PM the previous afternoon and said almost exactly the same thing in almost exactly the same number of words. Same free Polish mailbox, same gisela@techie.com in the To: field, same anonymous German firm, same request to reply.

Taken alone, either email is a thin fake buyer inquiry. Taken together, they are something more useful: a visible view of the machine, because the sender rewrote the message between sends and left the seams showing.

1. The Same Sentence, Run Through a Synonym Swapper​

Line the two bodies up:

  • Day 1: "Our firm in Germany needs a supplier of extracts materials from India,reply. for details."
  • Day 2: "A firm in Germany needs a supplier of extracted materials from India for production in there plant. reply for detailed."

Every moving part has been substituted while the skeleton stays identical:

Day 1Day 2
Our firmA firm
extracts materialsextracted materials
for detailsfor detailed
Materials Logistics ManagementMaterials Intercessor

This is template spinning — the standard technique for defeating spam filters that match on exact text or on the hash of a message body. Change enough tokens and the same campaign passes as a new message. Nobody rewrites a genuine business inquiry word-for-word overnight and sends it to the same recipient; you either follow up on the original thread or you telephone.

2. "Materials Intercessor" Is Not a Thing​

An intercessor is someone who intervenes on another's behalf — a religious or legal term, used for a person who prays for you or pleads your case. It has no meaning in materials sourcing, logistics, or trade. There is no such role, department, or document.

The word was not chosen because it means anything. It was chosen because it is an unusual token that spam filters have not seen before, sitting in a subject line that still has the shape of business correspondence. The previous day's subject, "Materials Logistics Management," at least sounded like a department. This one is what happens when the rotation runs past the end of the plausible vocabulary.

3. "There Plant" — a Homophone Error, Not a Typo​

  • "for production in there plant" should be their plant.

there and their are pronounced identically and spelled differently. This is not a slip of the finger — the two words share no adjacent keys. It is the error of someone composing in a language they do not read fluently, or of text produced by ear. A German procurement manager writing to overseas suppliers writes better English than this, and would in any case be more likely to write in German or use a template prepared by someone who does.

4. "Reply for Detailed" Is Not a Sentence​

  • "reply for detailed."

Day 1 had "reply. for details." — a stray full stop mid-sentence. Day 2 has "reply for detailed" — an adjective standing where a noun belongs, and a lowercase start. The specific error changed while the brokenness stayed constant, which is exactly what happens when a template is edited to look different rather than proofread to read correctly. Correctness was never the goal; difference was.

5. The Firm Got More Anonymous, Not Less​

Day 1 said "Our firm in Germany." Day 2 says "A firm in Germany."

A follow-up from a real buyer adds identity: the company name, a signature, a direct line, something to establish who is asking after the first email went unanswered. This one moved in the opposite direction. "Our firm" at least placed the sender inside the company. "A firm" describes a third party the sender is not claiming to be part of, and it is the sort of drift that happens when nobody is tracking what the message asserts because the message is not meant to survive scrutiny — only to be opened.

Still absent, for the second consecutive day: no company name, no sender name, no greeting, no signature, no address, no phone, no website. German business communications are legally required to carry an Impressum with the registered name and register number. Twice now, there is nothing here that can be looked up.

6. A German Firm, Still Writing From Free Polish Webmail​

  • meoblacimpreak1973@op.pl

op.pl is Onet Poczta, a free consumer webmail provider in Poland — the local equivalent of a Gmail address. Between the two emails the sender changed the subject, the wording, and the grammar. What did not change is the one thing a real German importer would have fixed first: the mailbox. A company sourcing materials for its own plant sends mail from its own domain.

The local part is unchanged too: meoblacimpreak1973, a random consonant string with a year suffix. Either an account created in bulk by a script, or a compromised personal mailbox whose owner has no idea it is being used to run a scam campaign.

7. The Recipient Is Still Somebody Else​

  • to: gisela@techie.com — the same address as yesterday, and still not the address of the person who received it.

The real recipient was blind-copied again. One dummy address in the To: field, the actual distribution list hidden in BCC. Two messages, nineteen hours apart, both delivered this way, tells you the size of the operation: this is not one buyer contacting one supplier twice. It is a list being worked, and the same placeholder is being reused across the whole campaign.

8. The Follow-Up Interval Is Automated, Not Human​

2:16 PM on 15 October, then 9:29 AM on 16 October. Nineteen hours between a cold first contact and a rewritten resend, with no reply in between.

No purchasing department chases an unanswered cold inquiry the next morning — and none rewrites the text before doing so. The gap is the cadence of a sending schedule, and the rewrite is what the schedule requires between rounds so the second wave is not filtered on the strength of the first.

How This Scam Works​

Two emails, one goal: convert a scraped address into a confirmed, human-attended, business-owning contact. Nothing in either message is designed to inform you. The escalation begins only after you answer.

  1. The Sweep: Identical-in-substance messages go out to a large scraped list. Subjects and wording are rotated between waves to slip past content filters, which is why "Materials Logistics Management" became "Materials Intercessor" overnight.
  2. The Filter: Non-responders cost nothing and are dropped. Responders are flagged as live and moved into a queue for manual work.
  3. Qualification: The second-stage email is warmer, longer, and far better written — now with a company name, a logo, an address, a signature. The effort appears only once you have proved you reply.
  4. Advance-Fee Variant: A substantial order is agreed, then money must move from you first: a "registration fee" with their import agent, an "export licence," a "quality certification," notary charges, or courier costs for samples. The fees are real. The order is not.
  5. Sample Theft: You are asked to send samples — often generous quantities — to a European address at your expense. The goods arrive and the buyer goes quiet.
  6. Fake Purchase Order: A convincing PO with attractive terms, followed by a request to ship on credit against a forged bank guarantee or a fraudulent letter of credit.
  7. Document Harvesting: Your catalog, price list, letterhead, GST and IEC numbers get collected, then reused to impersonate your company to its own customers.
  8. Malware or Credential Phishing: The promised "requirement list" or "purchase order" arrives as an attachment, or as a link to a portal that wants your email password.

Conclusion and Recommendations​

This is the same probe as yesterday, reworded to get past the filter that should have caught it. A free Polish mailbox, an unnamed German firm, an unnamed material, a placeholder recipient, and a request to reply — sent twice in nineteen hours because volume, not accuracy, is what makes the model work.

The pair is worth keeping side by side. A single vague email is easy to dismiss as a language barrier or a busy buyer. Two of them, rewritten overnight with "there" for "their" and "intercessor" where a department name should be, remove the ambiguity entirely.

Immediate Actions:​

  • Do Not Reply to Either Message: Not to the first, not to the "follow-up." A reply is the entire objective, and answering the second one confirms you read the first.
  • Do Not Send a Catalog, Price List, or Company Profile: Those documents are the raw material for fake orders and fake invoices issued in your name.
  • Do Not Ship Samples to an Unverified Buyer: Never at your own cost, and never before the buyer has proved they exist.
  • Block the Sender and Report as Spam: Report to your own provider and, given the odds the mailbox is compromised, to Onet as well.
  • Warn Whoever Watches the Sales Inbox: A "second attempt from an international buyer" reads as genuine interest to a salesperson under target pressure. That perception is the whole mechanism.

Verification Steps:​

  • Compare Repeat Messages Word by Word: When two emails from one sender say the same thing in different words, you are looking at a template rotation, not a follow-up. This is the single most decisive check available here.
  • Check the To: Field: If your address is not in it, you were blind-copied along with everyone else on a list.
  • Demand an Identity Before Anything Else: Company name, registered address, register number, website, landline. A genuine buyer supplies all five unprompted.
  • Look the Company Up Yourself: German companies appear in the Handelsregister. A firm that cannot be found in a public register is not a firm.
  • Search the Exact Sentence: Paste the body into a search engine. Spun templates like this show up verbatim on scam-reporting forums, often across several years and several dozen subject lines.

Additional Protection Tips​

  • Treat a Rewritten Resend as Confirmation, Not Persistence: Real follow-ups quote the original. Spun follow-ups replace it.
  • Judge Inbound Buyers by What They Can Name: Material, grade, quantity, destination port, payment terms. Two emails that name none of them are not about buying anything.
  • Treat Freemail as Disqualifying for B2B Trade: A company with a plant, containers, and customs paperwork can afford a domain.
  • Watch for Country Mismatches: Claimed location, sending domain's country, phone code, and bank country should agree. Germany plus op.pl does not.
  • Never Ship on Unsecured Credit to a New Overseas Contact: Confirmed letter of credit or verified advance payment on first orders, without exception.
  • Require a Phone Callback for Any Banking Change: To a number you held before the request arrived.
  • Keep the Ones You Catch: Filed side by side, a campaign's variants train your team faster than any generic advice, because the tell is in what changed between them.

Remember: A genuine buyer who did not hear back sends you their details. This one sent the same sentence again wearing a different coat — and a message that has to disguise itself from a spam filter is telling you what it is before you have finished reading it.

Share this post