JobFairy.com Weblog: Anatomy of a scam

11.30.2006

Anatomy of a scam

Note from JobFairy.com: First scam I've seen where they spoofed careerbuilder.com. I've also enclosed a helpful screen capture of the email I got. Note the spammer's lack of familiarity with the English language and the inept way they can't even copy/paste from Career Builder's actual verbiage. I've made some comments on the screen capture in red. Below is the full text of the spam email so you can see the way they thread their way through a series of faked domains and Yahoo accounts. Also note the use of Outlook Express 5(They're up to 6 now)... Wouldn't a large financial concern have the budget for at least Office 2000, let alone Outlook for XP or 2003? It's so great to pick apart the email properties and reveal the maggots underneath...!

Received: (qmail 26685 invoked from network); 30 Nov 2006 16:28:16 -0000
Received: from unknown (HELO pre-smtp06-02.prod.mesa1.secureserver.net) ([64.202.166.32])
(envelope-sender )
by smtp17-02.prod.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP
for ; 30 Nov 2006 16:28:16 -0000
Received: (qmail 11010 invoked from network); 30 Nov 2006 16:28:16 -0000
Received: from smtp102.biz.mail.mud.yahoo.com ([68.142.200.237])
(envelope-sender )
by pre-smtp06-02.prod.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP
for ; 30 Nov 2006 16:28:08 -0000
Received: (qmail 17372 invoked from network); 30 Nov 2006 16:26:57 -0000
Received: from unknown (HELO localhost) (info146@alkoloidz.com@4.79.181.228 with login)
by smtp102.biz.mail.mud.yahoo.com with SMTP; 30 Nov 2006 16:26:56 -0000
X-YMail-OSG: ryBIMmoVM1msYdLiPYlkF4SqVDVJbch8NnSD3d3dCE916NyRWjy
UzLG1cGN0WzfJrbsMoyNSyxAkFTDAlT83wb_L82zt74o8EfDZnIff6dOEwDmMug6jBYzJ
Date:Thu, 30 Nov 2006 16:26:56 -0800
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
Envelope-to: XXX
X-Mailer: Mykko XMailer v.3.17
Reply-To: Narelle Towie
X-Priority: 3 (Normal)Message-ID: <20061130422983.89947.qmail@web34821.mail.yahoo.com>
From: Narelle Towie
To: XXX
Subject: Hi. Job offer for XXX.
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----------"
X-Nonspam: None

-----Original Message-----
From: Narelle Towie [mailto:Narelle_Towie@londonsgoldexchange.com]
Sent: Thursday, November 30, 2006 5:27 PM
To: XXX
Subject: Hi. Job offer for XXX.

Job offer
Dear XXX
We have found your resume at careerbuilder.com.
We would like to suggest you a position of a Transfer Manager in
our company.The task of the Transfer Manager is to process payments
between our clients and our company via bank checks.
The job is related to remote Internet operations.
Every payment order will be accompanied with detailed instructions.
It's a commission based position. We guarantee that you get 10% of each processed payment.

General requirements:
- Ability to create good administrative reporting;
- Prior customer service experience is a good benefit, but not a must;
- Willingness to work at home and take the responsibility to set up and achieve goals;
- Honesty, responsibility and promptness in operations;
- Effective interaction with customers;
- Familiarity to online work, Internet and e-mail skills;
- 3-5 hours per week

Salary: $600-$1200 per week

This job will allow you to:
- Efficiently work at home;
- Get additional extra time;
- Achieve financial independence without having to follow the standard working day schedule (only 1-3 hours per day);
- Develop high self-respect and esteem.
- Become able to share time and money with others less fortunate than you;

Current Vacancies: 5

If you are interested in working with us, or if you need more information, you can contact me directly at my personal email address.

I'll need your full name, telephone number and mail address so I can send you the contract and other paperwork necessary to get started. I'm looking forward to hearing from you soon.
If you agree with our conditions - feel free to sign the contract, send it to me and get ready to start!

If you want visit our website click here

If you have questions or comments for CareerBuilder.com, please use our feedback form. This email was sent from Account ID A7C790659DQ7NJB98P5 and by this logged in User U8B54C6Z4QFLL3Q99PX DISCLAIMER Please be aware that the content of this email has not been reviewed or approved by CareerBuilder and is in no wayendorsed by CareerBuilder. You are solely responsible for any response you choose to provide to this email and you do so at your own risk. If you have questions regarding the legitimacy of the position being offered please contact the CareerBuilder Site Integrity Team by emailing CSI@CareerBuilder.com. Please also review common scams and tips for protecting yourself on CareerBuilder's Fraud Page.

posted by Shocking Pink # 2:34 PM

Comments:

Also, they are doing one now that looks as if it's coming from monster.com. What idiots they are to send scams right into the inbox of The Shocking Pink Fairy. Who's capable of picking an email apart to see if it's legit or not. And knows just who to contact to shut their happy asses down. Hope they DIAF.

# posted by Shocking Pink : 7:21 PM

11.30.2006

Anatomy of a scam

Archives