Skip to main content

Scam: Request for Project Price Offer | Carsten Steffen, a Buyer Whose Address Is Mostly a Billing Link

· 17 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

At a glance

Verdict
ScamGet the recipient to reply asking for the requisition, so a fake document link, a malicious file or a fake order can follow.
Subject line
Request for Project Price Offer
Claimed sender
Carsten_Steffen|Client-server.Automail?campaign_label=automatic_billing&utm_source=billing&utm_campaign=billing_payment_success&utm_medium=email&email_sent=1777632925&euid=A3_da8ZlXJuINNEG4n2qRKkXaqzg&eaid=37075122222&x_eaid=084add0ccf&link_clicked=1-@caringforyouhomecare.com
Impersonates
No real organisation or personPersona: Carsten Steffen, a self-described procurement specialist who names no company
Received
· Published
Related analyses

No display name was reported; the 276-character address is mostly web-link tracking parameters. The greeting used the recipient's first name, replaced here with [recipient], and the recipient address is blurred.

Evidence: the message as received plus passive registry lookups; links and attachments are not opened. How we analyse a scam email.

We are looking for pricing for an upcoming project and would want to confirm your availability to submit a quote. A request for a quote that names no project, no product and no company, signed by a procurement specialist who names no employer, and sent from an address that runs to 276 characters, most of them the tracking code from a billing email's link, at a domain with a home-care service's name.

Complete Email​

from: Carsten_Steffen|Client-server.Automail?campaign_label=automatic_billing&utm_source=billing&utm_campaign=billing_payment_success&utm_medium=email&email_sent=1777632925&euid=A3_da8ZlXJuINNEG4n2qRKkXaqzg&eaid=37075122222&x_eaid=084add0ccf&link_clicked=1-@caringforyouhomecare.com
date: 10/02/2026 7:54 PM
subject: Request for Project Price Offer

Email Body​

Hi [recipient]

I hope you're doing well

We are looking for pricing for an upcoming project and would want to confirm your availability to submit a quote. If you are able to participate, we would gladly share the whole requisition with you.

We really appreciate your time and eagerly await your response.

Thanks,

Carsten Steffen

Procurement Specialist

Attacking email screenshot: Request for Project Price Offer, from a sender address that wraps over four lines of link-tracking parameters, asking whether the recipient can submit a quote for an upcoming project, signed Carsten Steffen, Procurement Specialist, with the recipient address blurred and the first name in the greeting pixelated

Red Flags​

This is a reply-bait quotation request, the opening move of the procurement-scam family: a buyer, a project and an invitation to quote, with everything that could be checked held back until the recipient answers. It belongs with the Blessed Rekhoto quotation request and the Handpake inquiry, with a different sender and a different text, and nothing here shows that the same hand wrote them. Its wording is ordinary and it carries no link or attachment; what gives it away first is the sender's address. Everything below comes from the message and from public WHOIS and DNS records, looked up on 16 October 2026.

  • From: the address above, with no display name
  • Length: 251 characters before the @, 276 in all

Only the first fifteen characters are a name: Carsten_Steffen, the name that signs the message. Split at the ?, at each & and before the @ so that it can be read, the whole address looks like this:

Carsten_Steffen|Client-server.Automail?
campaign_label=automatic_billing
&utm_source=billing
&utm_campaign=billing_payment_success
&utm_medium=email
&email_sent=1777632925
&euid=A3_da8ZlXJuINNEG4n2qRKkXaqzg
&eaid=37075122222
&x_eaid=084add0ccf
&link_clicked=1-
@caringforyouhomecare.com

Everything after the question mark is a query string: the part of a web address that follows a ? and carries pairs of names and values joined by &. The utm_ names (utm_source, utm_medium, utm_campaign) are the convention analytics tools use to record which campaign a click came from. link_clicked=1 records a click, and euid, eaid and x_eaid look like the identifiers such systems attach to a recipient or an account. Strings like this sit at the end of the links in marketing and billing emails. They do not belong in an email address, and nobody who expects to be written back to has an address like this.

The characters themselves are legal: |, ?, = and & are all permitted before the @. The length is not normal. RFC 5321, the standard for delivering email, sets 64 characters as the maximum for the part before the @, and 256 for a whole address with its angle brackets. Every mail server must accept addresses up to those sizes; anything longer "SHOULD be avoided", and a server may refuse it. This address has nearly four times the first limit before its @, and at 276 characters it is over the second before its brackets are counted. A real buyer's address is short because it has to work: it is typed into contact lists, read out over the phone and answered.

2. A Billing Receipt's Vocabulary on a Buyer's Request, Dated Five Months Before It​

  • campaign_label=automatic_billing, utm_source=billing, utm_campaign=billing_payment_success
  • email_sent=1777632925

Read the values rather than the names, and the address describes a different email altogether: an automatic billing message about a successful payment, sent by email, whose link was clicked. The message it is attached to is a procurement specialist asking for prices. Nothing in either half explains the other. Client-server.Automail, between the name and the question mark, sounds like a mailing system, and nothing in the message says whose.

The address also carries a date. email_sent=1777632925 is a ten-digit number, the shape of a Unix timestamp: the count of seconds since 1 January 1970 that software uses to record times. Read that way, it is 10:55 UTC on 1 May 2026, five months before this email arrived on 2 October. If it is a timestamp, whatever this string once recorded, it was not this message. It reads as tracking code taken from some other email's link and set in front of the @, whether by a person or by the software that sent the message, and nothing in the message says why. Whatever the reason, it is not what a procurement department's mail system produces.

3. caringforyouhomecare.com: a Home-Care Name Under a Buyer's Request​

  • Sending domain: caringforyouhomecare.com

After 251 characters, the address reaches its domain, and the domain has nothing to do with the story. It does not name Carsten Steffen, a buyer, a procurement department, a client-server system or a billing service. Its name is a home-care service's: caring for you home care.

The public records, looked up on 16 October 2026:

  • Registered on 1 October 2019, seven years before the email, through GoDaddy, with the owner's details hidden by the privacy service Domains By Proxy. It is registered until October 2027.
  • A working mail setup. Its mail is handled by Microsoft 365, and its SPF record, which lists the servers allowed to send its mail, ends in -all: mail from any other server should fail the check.
  • No DMARC record. There is no _dmarc record for the domain. SPF checks the envelope sender, an address the reader does not normally see, and DMARC is what ties that check to the address in the From line. Without it, nothing in the domain's records asks receiving servers to reject or quarantine a message that puts the domain's name in the From line without passing those checks.

That is the profile of an established small business's domain, not of one registered for a campaign. A domain like that ends up on a message like this in one of two ways: the From line was forged, which the missing DMARC record does nothing to discourage, or a mailbox or mail server belonging to the domain was misused. Telling the two apart needs the message's full headers, which were not captured. Nothing here suggests that the business behind the domain wrote this email, and either way the domain says nothing about who did. A procurement specialist writes from their employer's domain, and that domain carries the employer's name.

4. A Procurement Specialist Who Names No Company​

  • Signature: Carsten Steffen, Procurement Specialist, and nothing else

A procurement specialist buys on behalf of an organisation, and the organisation is the whole point: it is who the supplier quotes to, who issues the purchase order and who pays the invoice. This one never says which. There is no company name, no address, no telephone number, no website and no reference number. The message says we three times (we are looking for pricing, we would gladly share, we really appreciate) and never says who we is.

A name and a job title cost nothing to type and cannot be checked. A buyer looking for suppliers wants to be found, so the signature is usually the most complete part of a real request. Here it is the emptiest.

5. "An Upcoming Project" With Nothing in It to Price​

  • Subject: Request for Project Price Offer
  • "We are looking for pricing for an upcoming project and would want to confirm your availability to submit a quote."

The subject asks for a price offer, the body for a quote, and the document promised is a requisition: three names for a request, and no request. There is no product or service, no quantity, no specification, no location and no date by which the price is needed. The message does not say what kind of work the project is, or what the recipient's company does, so it could be sent unchanged to a printer, a software house, a builder or a caterer. That is what it was written for. A genuine request for quotation is built around what is being bought, because a supplier cannot price anything else.

The only part of the message that is about the recipient is the greeting, and it is a first name: the one detail a mass mailer can fill in from an address or a contact page without knowing anything else about the business it is writing to.

6. "We Would Gladly Share the Whole Requisition": Nothing Arrives Until You Say Yes​

  • "would want to confirm your availability to submit a quote"
  • "If you are able to participate, we would gladly share the whole requisition with you."
  • "We really appreciate your time and eagerly await your response."

The message asks for one thing: a yes. The requisition, the one document that would say what the project is, who it is for and whether it is real, is offered only to those who reply. A buyer with a real requirement sends it, or a summary of it, with the first message, because the supplier needs it to decide whether to quote at all. Holding it back reverses the order: the supplier has to commit before it can see anything.

That order is the design. A first message with no link and no attachment gives a mail filter nothing to inspect, and reads as an ordinary sales lead. Whatever is sent in answer to yes, please send it then arrives inside a conversation the recipient started, as a reply to the recipient's own message, which is where filters and people are least suspicious. Share is the verb of file-sharing services, and what the requisition typically turns out to be is described under How This Scam Works. The closing line, eagerly await your response, is the only pressure in the message, and it presses for the same thing: the reply.

7. Press Reply, and Read Where the Answer Would Go​

The message wants a reply and gives nowhere to send one but the From line: no telephone number, no second address, no website. Press Reply, and unless the message carries a Reply-To header, the answer is addressed to the 276-character address in Red Flag 1. It would have to be accepted by every server along the way, at a length the standard says to avoid, and then find a mailbox of that name in the mail system of a domain named for home care.

Campaigns of this kind typically set a Reply-To header that sends answers somewhere else, often to a free mailbox, and it shows only in the To field of the reply itself. The full headers were not captured for this post, so where a reply would actually have gone is not known. That is the check worth making on any message like this: press Reply, and before typing a word, read the address the answer is about to go to.

How This Scam Works​

The email is bait for one reply. It carries no link and no attachment, names no price and asks for nothing but an answer, which is why it can pass for an ordinary sales lead. What follows a reply was not observed (we do not reply), but quotation-request lures of this kind are well documented, and they typically run like this:

  1. The List: One template goes to business addresses harvested in bulk from websites and directories. It names no product and no project, so it fits any supplier, and the greeting is filled with a first name, the one detail an address or a contact page supplies by itself.
  2. The Borrowed Sender: The message goes out under a domain that has nothing to do with the story, here one with a home-care service's name. Lures like this typically come from domains that are forged in the From line or taken over from small businesses, so that the sender's own name appears nowhere.
  3. The Reply: Yes, please send it confirms a live mailbox, read by someone who prepares quotes and is willing to engage, and it opens a conversation the recipient started.
  4. The Requisition: The promised document then arrives, typically in one of three shapes: a link to view it on a page styled as a file-sharing or e-signature service, which asks for the recipient's email password before it will show anything; an attachment that is really an archive, a script or a program given a document's name; or a plausible request for quotation, with an itemised list on a letterhead, which leads to the order below.
  5. The Mailbox: A password typed into that page hands over the mailbox. A captured business mailbox is typically used to send the same lure to everyone in its contacts, under a name they already trust, and to watch for invoices and payments that can be redirected. That is one way a small business's domain ends up on a message like this one.
  6. The Order: In the procurement branch, the quote is accepted with little negotiation and a purchase order follows, often on the borrowed letterhead of a real organisation, asking for delivery on credit to an address that is not the buyer's. The goods are collected and the invoice is never paid. Another branch asks the supplier to pay first: a vendor-registration fee, a tender-document fee or a courier charge.
  7. The Rotation: When an address or a domain stops working, the same template goes out from another. Nothing in it belongs to any one sender, so nothing in it has to change.

Conclusion and Recommendations​

There is no company, no project, no product and no requisition in this message. There is a name with a job title and nothing behind it, a request for prices on nothing in particular, a promise to share the details once the recipient says yes, and a sender address that is mostly another email's tracking code, ending in a domain with a home-care service's name that has nothing to do with any of it.

The text is short, polite and nearly free of errors, and on its own it would pass for a sales lead. The tells are around it: an address no buyer would have, a domain with someone else's name on it, and a request that cannot be priced until you answer. A buyer who will not say what they are buying, or who they are, is not asking for a price. They are asking whether you will answer.

Immediate Actions:​

  • Do Not Reply, Not Even to Say Yes: A reply confirms a live mailbox read by someone who prepares quotes, and it is the only thing the message was sent to get. Whatever comes back then arrives inside a conversation you started.
  • Do Not Send Prices, a Catalogue or a Company Profile: Price lists, letterheads, signatures and bank details are the raw material for fake orders and fake invoices issued in your name.
  • If a "Requisition" Arrives Anyway, Do Not Open It: A link to view a document, a file to download or an attachment that follows this message is what the first message was clearing the way for. Do not enter your email password on any page it leads to.
  • Report It: Use your mail client's junk or phishing report so the campaign is scored, and forward the message to CERT-In at incident@cert-in.org.in. If money was lost, report it on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930.
  • If Anyone Has Already Replied, Stop There: Send nothing further and open nothing that comes back. If a password was typed into a page reached from this thread, change it at once from a trusted device, then check the mailbox's sign-in history and its forwarding and inbox rules for anything you did not set.
  • Warn Whoever Reads the Sales Inbox: A polite request for a quote reads as a lead to the person whose job is to answer leads. One sentence of warning removes most of its force.

Verification Steps:​

  • Read the Whole Sender Address: A person's address is a name or a role, an @ and a domain. If the part before the @ contains ?, = and &, or runs on for several lines, it is not anyone's mailbox.
  • Compare the Domain With the Story: A procurement specialist writes from the employer's domain. Ask what caringforyouhomecare.com has to do with a buyer, a project or a billing system. Here, the answer is nothing.
  • Check Where a Reply Would Go: Press Reply and read the To field before typing anything. If it is not the sender's address, a Reply-To header is at work, and the address you were not shown is the one the sender reads.
  • Ask What Is Being Priced: The product or service, the quantity, the specification, the delivery location and the date it is needed. A genuine request for quotation states them before you agree to anything.
  • Ask Who Is Asking: The company's registered name, address and website, then a switchboard number you find yourself. A signature that is a name and a job title gives you nothing to check.
  • Search the Wording: Paste We are looking for pricing for an upcoming project and would want to confirm your availability to submit a quote into a search engine. Templates like this are often reported word for word, under other names.

Additional Protection Tips​

  • Open the Sender's Address: Mail clients often show a display name and hide the address behind it. Look at the address itself: here it gave the message away before the first line of the body.
  • Treat "Details on Request" as a Tell: A genuine request for quotation arrives complete, with the specification attached. A message that holds the request back until you reply is asking for the reply, not the price.
  • Never Sign In to Read a Document Someone Emailed You: A page that asks for your email password before it will show a shared file is the commonest shape of the next step in lures like this. Open shared documents only from services you signed in to yourself.
  • Turn On Multi-Factor Authentication for Every Mailbox That Handles Quotes: If a password is ever typed into the wrong page, a second factor is what keeps the mailbox from being taken over and turned on your customers.
  • Publish DMARC on Your Own Domain: The domain this message came from publishes no DMARC record, so nothing asks receiving servers to refuse mail that forges it. A DMARC policy on your own domain, raised to p=reject once your genuine mail is confirmed to pass, tells them to refuse mail that puts your name in the From line without your authority.
  • Give Shared Mailboxes a Rule: Sales and contact inboxes receive more of this mail than anyone. A standing rule costs nothing: no quote is prepared for a buyer who has not been identified through a route you found yourself.
  • Keep the Ones You Catch: File this beside the last quotation scam that reached you. Templates like this change their wording often, and they are easiest to recognise by their shape.

Remember: A real request for a quote arrives with the request in it: what to price, how much, by when, and who is asking, from an address at their own company. When the details only arrive after you answer, the details are not the point. Your answer is.

Share this post