PhishBucket Money Transfer/Mule Offers

Craigslist - Power Mobile Ltd.

Tue, 10 Nov 2009 07:04:06 +0000

Peter: It's a legitimate company and the website reference is real; but, a gmail email? Why would a UK mobile/cell provider need representatives in another country? One thing that the scammers always mention is the requirement for internet access,

PhishBucket: You should hear extremely loud bells ringing in your head when you read $180.00 per HOUR. Ridiculous! The offer is an obvious money transfer/mule scam and not something you can undo easily once you get involved. Unless you like frozen bank accounts, handcuffs and jail cells. Oh, and someone else using your identity.

As seen on Craigslist:
ACCOUNT RECEIVABLE AND PAYABLE CLERK NEEDED URGENTLY

Reply to: patrick.humanresourcesdept.ros @ gmail.com
Date: 2009-06-09, 1:50PM EDT

Do you own a computer at home?Do you have internet access on your computer?
Then you have the chance of working with our company Power Mobile Ltd.
_________________________
job Posting Description:
_________________________
We are currently seeking 24hrs part or full time employees for our ever-growing
Accounts coordinator/Receivable Department Power mobile limited.
our company is opening a job position of an account receivable and payable clerk.
Description about the Company: POWER MOBILE LTD. is a leader of the retail
revolutionary phones and sims with phones acessories in UK and we have been doing it
for over 18 years. www.powermobile.co.uk We are a fast growing company fully
committed to providing our employees with a rewarding place to work.We offer an
extraordinary work experience and a cool environment . If you are looking for a fun
place to work, filled with great people and an opportunity for growth and learning,
we are definitely the place!
________________________
Compensation:
________________________
This Accounts Receivable Clerk position pays $41,000 - $45,000 plus offers benefits
and perks.
Pay rate and work Pay: $180.00 per hour, Holiday Bonus,Maternity wages,Annual
compensation are also inquired as a compensation.
________________________
Qualifications:
________________________
*Working knowledge of accounts receivable.
*Years of experience not required.
The Accounts Receivable Clerk should be efficient, detail oriented, and value
customer service.
*Excellent verbal and written communication skills.
*Ability to organize and prioritize job tasks.
*Self-motivated.
*Intermediate level PC skills with knowledge of Windows & Microsoft Office software
applications.
*Speed and accuracy in 10 key input.
*Ability to complete work with a minimum of supervision under rigid time constraints.
*Good analytical skills.
*Detail oriented with a high degree of accuracy.
*At least One years college or Candidate must have a One-year certificate from
college or technical school;
or three to six months related experience and/or training; or equivalent combination
of education and experience.
*Must have Word processing, Spreadsheets, Database software experience.
*Honest and trustworthy, exhibiting sound business ethic.
_______________________________________
We offer competitive pay,with regular increases, and a great benefits package that
begins the first of the month following date of hire, including:
_______________________________________
*Medical insurance
*Dental insurance
*Vision insurance
*401(k) and Roth 401(k) with employer matching
*Employer paid basic group term life insurance
*Employer paid long term disability insurance
*Short term disability insurance
*Health savings accounts
*Flexible spending accounts
*18 days of paid time off a year, accrual beginning immediately.
_______________________________________
Resumes accepted by email only at:patrick.humanresourcesdept.ros @ gmail.com(No
recruiters please!)
For immediate consideration please contact Patrick Ross and Accounting e-mail resume
to: patrick.humanresourcesdept.ros @ gmail.com
_______________________________________
Compares data entered with source documents, or reenters data in verification format
on screen to detect errors.
Makes necessary corrections to information entered.
Compiles, sorts, and verifies accuracy of data to be entered.
Keeps record of work completed.
Reviews error reports and enters corrections into computer.
Transmits entered information into database.
Files or routes source documents after entry.
Responds to inquiries regarding entered data.
For immediate consideration please contact :patrick.humanresourcesdept.ros @ gmail.com
We will accept US UK and EUROPE Citizens and green card holders only for this
position.
Thanks

Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1213209865

GEC Inc aka Gold Electronic Currency Inc

Tue, 10 Nov 2009 06:50:59 +0000

In this bogus offer they leave out the duties, but it's clearly a money transfer/mule scam. The most vile part is how they mention the economic crisis--this is a way to plug in to your fear about money.

They build you up with the usual story about how they're expanding and need a way to reach new customers, and how their business involves the purchasing, exchanging and selling of digital (vaporbucks?) currency. They want you to not only be 'legally trouble free' but have a clean record too.

If the theme doesn't convince you, the many other clues are there:

♦ They open with Dear Mr. / Mrs, (bad punctuation, no name--they don't even know your gender!)

♦ Hirers don't usually greet potential candidates by telling them to pay attention

♦ Their grammar, spelling and punctuation is embarrasingly bad

♦ They say they got your info online but don't say where

♦ They are called GEC Inc. *OR* Gold Electronic Currency Inc. (they ought to make up their minds and stick with one name)

♦ They pay a basic, fixed salary a variety of ways and are ridiculously flexible about working hours; working from home is (obviously) encouraged

♦ Aside from having no criminal record, they have very generalized (lame) skill requirements

♦ They reassure you there's no investment on your part (legitimate employers and recruiters don't need to say that because their jobs are real)

♦ They state that they don't work with checks or money orders (which means they probably use stolen credit/debit card information)

♦ They claim the number of positions is limited, yet they've spammed potentially thousands of people (see their High Risk reputation at McAfee Trusted Source: http://www.trustedsource.org/query/84.10.164.209)

♦ They're so cheap (or fake) that they want you to respond to a free Gmail account and don't have a Web site or corporate email address to help you legitimize this offer

Do you smell what we smell? Rotten phish!

Message text:
Dear Mr. / Mrs,

Please, pay attention to this message.You are offered a job position by one of the
worldwide international companies. GEC inc has customers(business groups and individuals)
from more than 20 countries all over the world cooperating and using our services. We
enter new markets and expand in spite of the economical crisis situation.

We have chosen your curriculum vitae online at one of the recruiting sites.GEC inc
recruiting team considers your characteristics suitable for the position we offer.

We would like to provide you a little information about GEC inc..

Gold Electronic Currency Inc was started in 2004 as a by a group of individuals in
Warsaw, Poland.. We started to provide purchasing/exchanging/selling services to
people and companies who work with digital currencies(eGold, eBullion,
MoneyBookers,Liberty Reserve) and use it.Since then we have reached a lot by
providing the most qualified and efficient service to our customers, but we are
planning to expand more. This is why we have experienced working with east-European
countries and have just entered United States and United Kingdom Markets.

In connection with our expanding process we are searching for new employees.We would
love to cooperate with reliable, hard-working and motivated people.It must be the
person with a lot of energy, the person who is communicative and punctual,
disciplined and talented.

To apply for the position we offer you must be:

- legally trouble free
- have a clean record
- have a personal and working cell phone
- computer skilled as an intermediate user
- have an Internet access during the working hours

Among all the benefits we provide there are: fixed basic salary which is paid with a
lot of different ways, home based position opportunity, flexible schedule, bonuses
such as modern communications devices(iPhone or Blackberry cell phones, Mac book or
Sony Vaio laptops) after a trial month of our cooperation, 2-week paid vacation
twice a year, company performs all the tax payments for employee.

And a few more important things:

-There are no investments from your pocket to start
-We do not work with checks or money orders
-The number of positions is limited, you need to respond as quickly as possible

As long as there is a chance to join us, we are happy to see you among our
employees. We would really appreciate to start our cooperation.Please, email us at:
gecincdsrvc @ gmail.com

Best Regards

Headers:
X-Originating-IP: [65.55.111.87]
Authentication-Results: mta166.mail.sp2.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO blu0-omc2-s12.blu0.hotmail.com) (65.55.111.87)
     by mta166.mail.sp2.yahoo.com with SMTP; Tue, 09 Jun 2009 08:34:07 -0700
Received: from BLU133-W15 ([65.55.111.73]) by blu0-omc2-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
     Tue, 9 Jun 2009 08:33:01 -0700
Content-Type: multipart/alternative;
     boundary="_abbf6ad6-0856-40b7-9dc6-e96797d9c6a7_"
X-Originating-IP: [84.10.164.209]
From: Salamay Bussen <salamaybussen42 @ live.com>
To: [removed]
Subject: Perspective company recruiting
Date: Tue, 9 Jun 2009 15:33:01 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Jun 2009 15:33:01.0924 (UTC) FILETIME=[93293240:01C9E917]
Content-Length: 2158

WHOIS sender IP 84.10.164.209:
(Courtesy: http://whois.domaintools.com/84.10.164.209)
IP Location:     Poland Poland Warsaw Upc Telewizja Kablowa Sp. Z O.o
Resolve Host:     chello084010164209.chello.pl
IP Address:     84.10.164.209
inetnum:        84.10.154.0 - 84.10.255.255
netname:        UPC-PL
descr:          UPC Telewizja Kablowa Sp. z o.o.
descr:          CPE Customers PL
country:        PL
admin-c:        UP94-RIPE
tech-c:         HMCB1-RIPE
status:         ASSIGNED PA
remarks:        Contact abuse @ chello.pl concerning criminal
remarks:        activities like spam, hacks, portscans
mnt-by:         CHELLO-MNT
source:         RIPE # Filtered
role:           UPC Poland
address:        UPC Polska Sp. z o.o.
               Al. Jana Pawla II 27
               00-867 Warszawa
               Poland
admin-c:        UPC48-RIPE
tech-c:         UPC48-RIPE
nic-hdl:        UP94-RIPE
mnt-by:         UPC-PL-MNT
e-mail:         hostmaster @ upc.com.pl
source:         RIPE # Filtered
role:           Hostmaster Chello Broadband
address:        UPC Broadband
address:        Internet Services
address:        Erlachgasse 116
address:        A-1100 Vienna
address:        Austria
phone:          +43 1 96068 5000
fax-no:         +43 1 96068 5666
e-mail:         hostmaster @ chello.at
admin-c:        SB666-RIPE
tech-c:         SB666-RIPE
tech-c:         MS2509-RIPE
nic-hdl:        HMCB1-RIPE
mnt-by:         CHELLO-MNT
source:         RIPE # Filtered
route:          84.10.0.0/16
descr:          upc.pl
origin:         AS20947
mnt-by:         UPC-PL-MNT
source:         RIPE # Filtered

PFG Inc. aka WT Financial

Mon, 09 Nov 2009 23:45:24 +0000

Well, regardless of where this email originates, you can bet your bucket it's fraudulent. Never take a job that involves transferring funds, especially when they want you to use YOUR bank account or set up a new personal account for transactions. This is simply just NOT DONE! Legitimate companies NEVER ask their employees to use their personal bank accounts. Getting involved will likely result in financial theft, identity theft, and possibly criminal charges against you.

We don't even think they got their company name right. At first they call themselves PFG Inc. In the third paragraph they reference WT Financial. Whaaaa? They must have been in such a hurry to kick off their scam that they forgot to proofread their bogus message! Oops!

Message text:
We would like to propose you working as a part of our team in the
capacity of PFG Financial Manager. We offer you a highly rewarding job
with good promotion opportunities and no financial risk involved. We
respond to successful candidates only.

Since 1995, PFG Inc. has consistently focused on one ambition: to do
the right thing for the people who put their trust in us. Our main
goal is to help our clients to manage financial risks and to achieve
financial security through our insurance and investment products. For
now PFG Inc, has $4,1 billion in assets and approximately 3000
qualified and devoted employees that are currently working for us all
over the world.

Responsibilities
Working with us remotely as a WT Financial Manager you will have to
function no more than 5 hours per week. Your responsibility will be to
transfer funds between our investors and offshore affiliated branches
using your bank account.

Key Position Requirements
- permanent US resident 21 yrs+
- good communication skills
- active stand
- aspiration to development
- existing bank account in a major national or regional bank

Compensation
You will receive 3% of each transaction and can expect to earn up to
$70.000 a month carrying out 3 to 10 transactions per week. The money
you earn is instantly available on your account. All withholdings are
taken care of by the company.

If you are interested in the above position and would like to find out
some more about our company, please contact with me via e-mail.

Looking forward to having you in our team!

--
Sincerely,

Karen Munger
HR Department of PFG, Inc.
London, United Kingdom

Headers:
Received: from mail-fx0-f223.google.com (mail-fx0-f223.google.com [209.85.220.223])
     by nlpi109.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with ESMTP id n58HtG9e015113
     for [removed]; Mon, 8 Jun 2009 12:55:37 -0500
Received: by mail-fx0-f223.google.com with SMTP id 23so3316708fxm.0
     for [removed]; Mon, 08 Jun 2009 10:55:36 -0700 (PDT)
Received: by 10.239.152.143 with SMTP id v15mr588997hbb.26.1244483736789;
     Mon, 08 Jun 2009 10:55:36 -0700 (PDT)
Received: from 209.85.220.223 (EHLO nlpi109.prodigy.net) (207.115.36.123)
     by mta107.sbc.mail.re3.yahoo.com with SMTP; Mon, 08 Jun 2009 10:55:37 -0700
From: "Karen Munger" <pfg.munger @ gmail.com>
To: [removed]
Subject: About Job Opportunity. Please reply back. Re:
Date: Mon, 8 Jun 2009 12:55:36 -0500
Message-ID: <8993d33d0906081055m31ba2261i @ mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
     boundary="----=_NextPart_000_0025_01C9E8D8.3DEA1220"
X-Mailer: Microsoft Office Outlook 12.0
thread-index: AcnoYlP4+UhjSEWFRWiu1H+WJrNA0w==

China National Silk Import & Export Corp.

Mon, 09 Nov 2009 23:14:05 +0000

China, eh? We wonder if the Chinese are sick of being impersonated by Nigerians, because that's what's going on here. That's why it's so important to read headers (quick tip: read message headers from bottom to top to find the sender's origin). They claim they need someone to set up a branch, but this never ends up being the case. They'll end up telling you to just work from home until they get to the point of opening shop in the United States, which they never will.

This is nothing more than a money transfer/mule scam. They want you to use your own bank account to process payments that may or may not really clear. If the funds clear and you're able to wire their portion less your commission, chances are you just helped them steal that money. But what's more likely is that the check will bounce, but you'll already have wired them the money and when the bank reverses the funds (which you've already said goodbye to), your loss will double.

You just wanted a job, right? This ain't it!

Message text:
CHINA NATIONAL SILK IMPORT & EXPORT CORP
105, Bei He Yan Street Beijing
People's Republic of China.

Attn:

We need Collection Officers wanted in this region who will assist in
retrieving debts from
our clients in USA & CANADA and Representatives to assist in setting up a
Branch of our Company in his/her
country.

If interested, please supply the following:

1) Name
2) Country

Send your response via email to chinasilkcompny @ yahoo.com.cn

Respects,
Chen Yonzhe.
President.
CHINA NATIONAL SILK IMPORT & EXPORT CORP

Headers:
Return-Path: <grivas @ pampano.unacar.mx>
Received: from imss2.unacar.mx ([200.33.30.14])
        by mx.google.com with ESMTP id
b8si14365223rvf.44.2009.06.08.21.35.00;
        Mon, 08 Jun 2009 21:35:30 -0700 (PDT)
Received-SPF: pass (google.com: domain of
grivas @ pampano.unacar.mxdesignates 200.33.30.14 as permitted sender)
client-ip=200.33.30.14;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
grivas @ pampano.unacar.mx designates 200.33.30.14 as permitted sender)
smtp.mail=grivas @ pampano.unacar.mx
Received: from imss2.unacar.mx (localhost [127.0.0.1])
by localhost.pampano.unacar.mx (Postfix) with ESMTP id E910E2F1A;
Mon, 8 Jun 2009 22:20:39 -0500 (CDT)
Received: from www.unacar.mx (www.unacar.mx [200.33.30.5])by imss2.unacar.mx
(Postfix) with ESMTP id 756AE2EF8;Mon, 8 Jun 2009 22:20:38 -0500 (CDT)
Received: from 41.220.75.3       (SquirrelMail authenticated user gpacheco)
       by www.unacar.mx with HTTP; Mon, 8 Jun 2009 22:15:15 -0500 (CDT)
Message-ID: <49143.41.220.75.3.1244517315.squirrel @ www.unacar.mx>
Date: Mon, 8 Jun 2009 22:15:15 -0500 (CDT)
Subject: Spam: Free: : Collection Officer/Representative Wanted
From: "China Silk Company" <grivas @ pampano.unacar.mx>
Reply-To: chinasilkcompny @ yahoo.com.cn
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: [removed]
X-imss-version: 2.054
X-imss-result: Blocklist_Triggered
X-imss-blockedListMatch: grivas @ pampano.unacar.mx
X-IP: mtnnigeria.net

WHOIS sender IP 41.220.75.3:
(Courtesy: http://whois.domaintools.com/41.220.75.3)
IP Location:     Nigeria Nigeria Afrinic
Resolve Host:     mtnngprs.com
IP Address:     41.220.75.3
organisation:   ORG-MN1-AFRINIC
org-name:       MTN Nigeria
org-type:       LIR
country:        NG
address:        Golden Plaza,
address:        Falomo Roundabout,
address:        Ikoyi
address:        Lagos
e-mail:         hostmaster @ mtnnigeria.net
e-mail:         chukwunk @ mtnnigeria.net
phone:          +234 803 200 5038
admin-c:        CN6-AFRINIC
tech-c:         BO5-AFRINIC
mnt-ref:        AFRINIC-HM-MNT
mnt-ref:        MTNNIGERA1-MNT
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
role:           HostMaster MTN_Nigeria
address:        Golden Plaza,
                Falomo Roundabout, Ikoyi
                Lagos State
                Nigeria
phone:          +2348032005038
phone:          +2348032009018
e-mail:         hostmaster @ mtnnigeria.net

Mystery Company - sct143rentals.com

Mon, 09 Nov 2009 23:00:43 +0000

Here's a SPAM message that wants you to click on a linked image and send you to sct143rentals.com. The first problem we have with this is they're trying to send you to a site owned and hosted by someone in Romania. W...H...Y...?

SPAM is totally illegal. And though it's not necessarily illegal for Romanians to offer jobs to Americans, your common sense should tell you something in the water don't quite smell right. We believe this will lead to money transfer/mule fraud. In any case, why should you feel any obligation to send your valuable personal info to a complete stranger who clearly doesn't have the decency to write a proper message?

Message text:
- Click Show Images Above - I Found You a New Job. - Click Show Images Above -

(Link points to: http :// sct143rentals.com/39ce45784b6f1c03b8ec9e4f32ca288773829631a72401a0)

Headers:
Return-Path: <human_resources.64509884 @ sct126metropolitan.com>
Authentication-Results: mta148.mail.sp2.yahoo.com from=sct126metropolitan.com; domainkeys=neutral (no sig); from=sct126metropolitan.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO technologicaldns.net) (95.177.160.33) by mta148.mail.sp2.yahoo.com with SMTP; Mon, 08 Jun 2009 16:17:12 -0700
Received: (qmail 41480 invoked by uid 64509884); Mon, 08 Jun 2009 16:16:18 PST
Date: Mon, 08 Jun 2009 16:16:18 PST
From: <Human_Resources @ sct126metropolitan.com>
Subject: I Found You a New Job.
To: [removed]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2070offer_id9183-1233678415=:40976"
Message-ID: <66134565350.64509884.qm @ web90505>
Content-Length: 5496

WHOIS link sct143rentals.com:

(Courtesy: http://whois.domaintools.com/sct143rentals.com)
Registrant:
SC TECHNOLOGICAL SRL
bd.Panduri, 6m
Moreni, DB 00000
RO
0723639144
Domain Name: SCT143RENTALS.COM
Administrative Contact:
Gaiu, Angel technological.admin @ gmail.com
bd.Panduri, 6m
Moreni, DB 00000
RO
0723639144
Technical Contact:
Gaiu, Angel technological.admin @ gmail.com
bd.Panduri, 6m
Moreni, DB 00000
RO
0723639144
Record last updated 06-02-2009 01:47:12 PM
Record expires on 02-17-2010
Record created on 02-17-2009
Domain servers in listed order:
NS0.DIRECTNIC.COM 74.117.217.20
NS1.DIRECTNIC.COM 69.46.234.245

Craigslist - Thomas Furniture

Mon, 09 Nov 2009 22:43:14 +0000

We believe this is just another money transfer/mule scam. They need someone to do accounts receivable/payable and offer a Gmail account for replies. If they were legitimate, why wouldn't they use a corporate email address or encourage you to visit their Web site and apply online? And how exactly does this job *ATTRACT* a weekly pay? Sounds like someone needs to brush up on their English skills!

You shouldn't send your personal information to anyone you can't legitimize. Would you send your contact info to a serial killer? Of course not. Is an identity thief any better? Of COURSE not.

As seen on Craigslist:
Accounts Receivable/Accounts Payable

Reply to: job-vrwku-1212155068 @ craigslist.org
Date: 2009-06-08, 8:20PM EDT

Thomas Furniture offers a position for an Accounts Receivable/Accounts
Payable..Which Attracts weekly pay of 600-700 USD ... for more information please
contact at john.furniture01 @ gmail.com

Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1212155068

(German) Weller Investment Group

Sun, 08 Nov 2009 08:18:22 +0000

Michelle: I found this one to be questionable. Considering this “expanding” European company has no website, the bad grammar of this email, and the offer to pay just minimum wage of $1,500 a month (minimum wage based on which US state?), I wouldn’t put much stock into this. Besides, what kind of company puts you to work on a trial basis first then offer to put you through training? Shouldn’t it be the other way around?

PhishBucket: Hooray, Michelle! All the right red flags went up! Here's the deal: it's a money transfer/mule scam. You can tell because they want you to be a financial associate and they need people in the USA to 'increase financial opportunities.' The message sender shows as being from a Stacey Barbosa, yet it's signed by Mike Warkentine. They weren't consistent with their company name! Ever see McDonalds or Microsoft do that? Nopers!

Spam. Fake. Fraud. Phish. BAD!

Message text:
From: Stacey BARBOSA
To: [removed]
Sent: Mon Jun 08 16:28:26 2009
Subject: VACANT P0SITI0N ID 41816

Hello.

Please read the information below.
We are German Weller Investment Group. We initiated few many-millioned projects in
Europe. Nowadays we plan to enter in the United States market.

That is why we are looking for new employees in USA to increase financial
opportunities.
So we offer you to become our Financial Associate. This vacancy requires you to be
fair, objective, has patience and be practical. You don’t need to pay or something
to join us!!!

We guarantee you minimum wage – 1.5k bucks a month, plus you have an opportunity for
training after your trial period expire.

The Weller Investment Group corporate mission is to build unique relationships with
its partners through facilitating professional growth and development.

Please forward your respond to mike.wi.warkentine @ gmail.com

Best Regards,

Mike Warkentine
Financial Department Manager
Weller Investment Group
tel: 1-888-328-8307
fax: 1-877-784-0587

Headers:
None reported.

Craigslist - Ronald Pilatsky

Sun, 08 Nov 2009 08:08:37 +0000

We suspect this one involves fraudulent money transactions based on their wording. No organization we know of would list a job this unprofessionally. All caps, bullcrap email address, no company name, no Web site. His name is the only thing in the body of the message in lower case, which gives us the impression he filled in a canned form. That means you may have run across this scam before, but from a different name. We don't think $350 is very good compensation, and we think most people are looking for a primary means of income, not this extremely illegitimate-looking job offer.

As seen on Craigslist:
CUSTOMER SERVICE OPENING / INDIVIDUAL NEEDED (new york )

Reply to: cozzxxnet @ gmail.com
Date: 2009-06-08, 4:17PM EDT

HI MY NAME IS Ronald Pilatsky
WE ARE LOOKING FOR PART TIME WORKERS ASAP
WITH GOOD COMPENSATION
THIS JOB OFFER IS FOR THOSE WHO WANT ANOTHER MEANS OF INCOME
YOU CAN START TODAY PLEASE SEND AN EMAIL AND GET MORE INFORMATION ABOUT THIS JOB
OFFER THANKS
Ronald Pilatsky Email : cozzxxnet @ gmail.com

Location: new york
Compensation: $350
Telecommuting is ok.
This is a part-time job.
This is a contract job.
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1211739135

Craigslist - Jillard Gallery

Sun, 08 Nov 2009 07:55:30 +0000

This scam in Spain falls mainly on English plains. It's just a money transfer/mule scam badly disguised as a job processing payments for a supposed artist who's persona non grata in the UK, USA, Australia and Canada and can't do it himself. Fact is, he's not really an artist. This is not really a job. Unless snow job counts.

As seen on Craigslist:
ARTWORKS PAY THE BILLS (New York)

Reply to: job-ypjz2-1211381983 @ craigslist.org
Date: 2009-06-08, 1:25PM EDT

My name is David Singer, I am an artist with my wife Rachel Singer and we are the
owners of Jillard Gallery.I live in madrid,spain.I make original Sculptural
Paintings and sell Limited Edition Prints. I create artwork that combines sculpture
and painting using sheets of wood,metal and glass to create depth. I fragment images
into illusive shapes and paint abstract compositions on the manipulated surface. I
have been selling my art for the last 3 years and have had my work featured on
trading cards, prints and in magazines. I have sold in galleries and to private
collectors from all around the world. I am always facing serious difficulties when
it comes to selling my art works to the UK, USA, Australia and Canada,they are
always offering to pay with checks and money orders,which is difficult for me to
cash here in Madrid,Spain. It takes minimum of four weeks to clear our banks here in
the Spain as they are been treated as an out of country checks.

I am looking for a representatives in the UNITED STATES who will be working for me
as a part time worker and I will be willing to pay 10%for every transaction,which
wouldn't affect your present state of work, someone who would help me receive
payments from my customers in UK,USA,Australia and Canada. I mean someone that is
responsible and reliable, cause the cost of coming to the UK,USA,AU and CA and
getting payments is very expensive, I am working on setting up a branch in the
state, so for now I need a representative in the united state who will be handling
the payment aspect.
My customers will issue the (payments) in your name and send to you,So all you need
do is to take the cheques or money order to your bank and cash them, then deduct
your 10% and wire the balance back to me.

This business will not cost you any amount of money,my customers will send payments
to you through registered mail or courier company and the courier company will
deliver the package to your doorstep as soon as you receive the package from the
courier company,just take these payments to your bank and have them cashed..deduct
10% of the payment cashed and you will be given instruction on how to go about the
remaining 90%.We are grateful for your attention.
If you are interested, please get back to me as soon as possible with the
information below, and note all mail should be directly to my personal email
address............. (Dsingerd @ live.com)

Full Name:
Contact Address:
State:
City:
Zip code:
Home and Cell Phone numbers:
Age:
Sex:
Did you have a Checking Account..?
Occupation:

David Singer

Location: New York
This is a part-time job.
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1211381983

MG Holdings aka intdgroup.com

Sun, 08 Nov 2009 07:37:55 +0000

The email address in this offer was actually pointing to a 1x1 (pixel) image called blank.jpg. Why is this a problem? Because if you don't know any better, clicking the email address could very easily lead to the installation of malware or a virus, or some other nastiness.

As to the message itself, in legal terms it meets the definition of spam, thus you can be sure it's not something in your best interest. How can you tell it's spam? Spam is defined as unsolicited commercial email, and signs include forged or faked headers and lack of opt-out. They've also failed to tell you why they're contacting you. And if common sense prevails, she's from Poland, and you should consider it an immediate red flag when a stranger from another country contacts you about a job.

It should also disturb you that the owner of the domain being used for replies (intdgroup.com) is only being used for email. There is no Web site present. And the owner is in China, not Poland, as you might initially guess. That means the headers are probably forged.

Is this who you wanna work for? You'll probably lose money and your identity if you bite this bait.

Message text:
From: Susan Rankin <000301 @ inet20909nq-1.nat.umts.dynamic.eranet.pl>
Subject: Apply now for a 2980 USD vacancy in US
To: [removed]
Date: Sunday, June 7, 2009, 7:57 PM

Greetings,

Media Group is ready to provide part time employment in your region. Daily
occupation of 2-4 hours per day. If you are still looking for a job with one of
top-echelon companies or having problems with occupation - send your resume ONLY to
the corporate email below: usdep @ intdgroup.com
or fax it.

With regards,
Recruitment Office,
MGHOLDINGS

Headers:
None reported.

WHOIS intdgroup.com:
(Courtesy: http://whois.domaintools.com/intdgroup.com)
Domain Status: Registered And No Website
Domain Name      : intdgroup.com
PunnyCode        : intdgroup.com
Creation Date    : 2009-05-14 06:10:05
Updated Date     : 2009-09-23 19:30:55
Expiration Date : 2010-05-14 06:10:02
Registrant:
Organization   : Michell
Name           : Michell
Address        : 56/2 Sun str.
City           : Dallas
Province/State : beijing
Country        :
Postal Code    : 85230
Administrative Contact:
Name           : Michell
Organization   : Michell
Address        : 56/2 Sun str.
City           : Dallas
Province/State : beijing
Country        :
Postal Code    : 85230
Phone Number   : 86--56343365
Fax            : 86--56343365
Email          : Michell.gregory2009 @ yahoo.com
ICANN Registrar:
XIN NET TECHNOLOGY CORPORATION
Created: 2009-05-13
Expires: 2010-05-13
Updated: 2009-06-25
Registrar Status: ok
Name Server:
NS1.GOOGLE.COM (has 5,762 domains)
NS2.GOOGLE.COM (has 5,762 domains)

Craigslist - Stock Fabrics Limited

Thu, 05 Nov 2009 07:41:42 +0000

Everything is wrong with this offer, found on Craigslist. Bookkeeping (cash-basis), accounts payable and accounts receivable are all mentioned, and banks are mentioned too. This is nothing more than a badly worded money transfer/mule offer, and will not result in an income for you. If anything, it will result in a visit by the police. If you're not robbed, your identity might be compromised. If nothing happens to you, it could be that you're unknowingly stealing from someone else. Guess who goes down if that happens?

Put all the scary stuff aside. There's no information provided here that warrants you sending them anything about yourself. Once they get their hook into you they will fight tooth and nail to reel you in. You really don't need this kind of headache if you're busy looking for work. Seriously.

As seen on Craigslist:
Bookkeeper

Reply to: job-pjnnz-1209772221 @ craigslist.org
Date: 2009-06-07, 1:04PM EDT

Stock Fabrics Limited a Part-Time experienced bookkeeper we wish to employ the
service of a work at home financial . In-depth knowledge of QuickBooks Pro is a
must. Must be available online between 8am – 5pm. Duties include full-charge
bookkeeping (cash-basis) including A/P, A/R, bank and inter-company account
reconciliation, quarterly tax reports, quarterly and year-end reports and
maintenance of all documents.

Compensation: Profitable
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1209772221

Clapham Law Chamber / Mr James Martin

Thu, 05 Nov 2009 07:17:54 +0000

We suspect this is one of those offers where you end up wiring money over to take care of a bunch of expenses that crop up in the process of trying to get hired for this job, to the point where you eventually realize there's no job at the end of it all. We'd consider this a money transfer/mule offer, and not a very good one. The text in the PDF is ridiculous -- no wonder they attached that instead of including it in their spam! You don't need to feel bad about avoiding this one. They deserve nothing less for spamming people with the intent to defraud them.

Message text:
CLAPHAM LAW CHAMBER
85 Landor Road,
London, United Kingdom.
Attn: Sir/ Madam

Please find attached job offer for your attention.

You may refer this to any applicant of your choice.

Please respond with your full detailed information and your C.V.

Email:davisfirm @ gmail.com
Tel:+447024016663
Fax:+442087113591

Regards,
DAVId BILL.

Image of attached file, Job Offer.pdf:

Text of attached file, Job Offer.pdf:

OUR REF: 33XCLC
ATTN: Sir/Madam

REQUEST FOR HOUSEKEEPER
I write on behalf of my client with full corporate responsibility and legal capacity to contract.

My client is Mr James Martin, a native of Scotland residing in Greece for about a year while his family is in U.K

Mr James Martin will love to hire a caring male or female who is willing to work in London as house-keeper.

Mr James Martin has two daughters and lives at London United Kingdom.

Payment/salary shall include 1000 pounds every month and 150 pounds weekly for up keep

Note that couples may bring their spouse but other family members are not allowed.

N.B: You may recommend any caring person of your choice.

David Bill esq / James Martin

Headers:
Return-Path: <firm.bill2 @ msn.com>
Received: from blu0-omc2-s19.blu0.hotmail.com ([65.55.111.94])
     by [removed] with SMTP id 0906061030_[removed]_807829_8220501;
     Sat, 06 Jun 2009 10:31:36 -0700 EST
Received: from BLU105-W57 ([65.55.111.71]) by blu0-omc2-s19.blu0.hotmail.com
with Microsoft SMTPSVC(6.0.3790.3959);
     Sat, 6 Jun 2009 10:30:52 -0700
Message-ID: <BLU105-W57F7D62C4B8FC6C53412E8C2490 @ phx.gbl>
Content-Type: multipart/mixed;
     boundary="_7fab2553-04c6-4fcb-8076-add6402d4001_"
X-Originating-IP: [41.217.2.8]
From: CLAPHAM DAVID CHAMBERS <firm.bill2 @ msn.com>
Subject: ATTN: UK, CLAPHAM CHEMBERS JOB OFFER NEED URGENTLY.
Date: Sat, 6 Jun 2009 17:30:51 +0000
Importance: Normal
In-Reply-To: <BAY128-W16AF2227A045DD36193EB0C1490 @ phx.gbl>
References: <BAY128-W16AF2227A045DD36193EB0C1490 @ phx.gbl>
MIME-Version: 1.0
X-OriginalArrivalTime: 06 Jun 2009 17:30:52.0351 (UTC) FILETIME=[8A397CF0:01C9E6CC]
To: [removed]

Craigslist - Admin. Representatives.

Thu, 05 Nov 2009 06:40:43 +0000

Peter: They want a representative, which usually means checks. Excess capitalization, as is often the case with scammers. Use of the term advert sounds like British English; this might mean it's from an African country like NIgeria. Note in the pay section they use anum: I never seen an American use that; I think this is another British-ism.

PhishBucket: We agree with Peter wholeheartedly. And regardless of what type of scam it is (though we think it involves money muling, which is BAD), let's look at the basics. You're looking for work and stumble on this ad in Craigslist. You aren't referred to a Web site or asked to respond to a corporate email address. They don't tell you the company name, and the person doesn't even provide a contact name. You'd be sending your information to a complete and utter stranger. This isn't the way we want you to look for work. We want you to check the legitimacy of every unsolicited offer that hits your inbox. It's the only way you can stay safe! And if they don't want to tell you who they are, then they don't deserve your attention. It's really that simple.

As seen on Craigslist:
Admin. Representatives.

Reply to: job-37uyj-1208358954 @ craigslist.org
Date: 2009-06-06, 12:17PM EDT

Competent and Reliable Candidates are needed this season for a Representative Job
Position. Details are stated below:

Special Benefits Include:
• Health Insurance.
• Weekly Bonus.
• Educational Reimbursement.
• Employee Profit Sharing.

Pay: 35-45,000/Anum
Weekly Bonus Available as work commences.

Get back to us with details about the job Advert.

Regards.

Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1208358954

Craigslist - Job, "pay_payroll"

Thu, 05 Nov 2009 06:28:35 +0000

Peter: Scammers always want someone who can follow instructions; that's another clue. By the looks of the free email address, they want someone to print checks.

PhishBucket: Peter's getting really good at spotting stinky phish. He's been reporting bogus Craigslist jobs for a while now and his observations are always spot-on. The checks you'd be printing would be used in money transfer/mule scams. Are the funds real? Sometimes the names and account info are just stolen information that is slapped together, sometimes it's old but *real* account information that doesn't lead to funds. And sometimes the checks are printed using stolen names and account numbers and then sent to mules who cash them and wire transfer funds to the bad guys.

So the moral of the story is, do you want a job aiding and abetting criminals? Do you think the cops will be on your side when the shit hits the fan? We know a hairdresser whose GRANDMA was thrown in jail for this type of thing. Do you wanna end up like Grandma?

As seen on Craigslist:
Job

Reply to: job-f9dx8-1208438801 @ craigslist.org
Date: 2009-06-06, 1:04PM EDT

Are you very good on the computer?
Do you have internet connection
Are you smart?
Are you ready to act according to instruction given to you?
If yes,contact me asap

email : pay_payroll @ yahoo.com

Compensation: $1200.00USD
This is a part-time job.
Principals only. Recruiters, please don't contact this job poster.
Phone calls about this job are ok.
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1208438801

Craigslist - Donalddo Sculptures Inc. aka Ceaser Sculptures Inc.

Thu, 05 Nov 2009 05:21:46 +0000

Peter: Is the pay great or reasonable? Are they Donalddo Sculptures or Ceaser Sculptures. A quick google showed the job posted in DC also; it's probably posted other places. Since they want someone to complete the transactions, this probably involves checks.

PhishBucket: It's kind of funny when they screw up their own scam by offering up two different company names, isn't it? Nice last name, buddy. And way to spell Caesar, you fake CEO, you!

We hope our readers were too smart for this bogus Craigslist job listing. We are certain it's a money transfer/mule offer, and we're certain job seekers have better things to do with their time and money than fall for carp like this.

If you know others who are unemployed, we hope you'll tell them about PhishBucket.org and encourage them to check their suspicious offers here. Don't think for a second that scammers aren't totally taking advantage of this global unemployment problem. They're loving it.

As seen on Craigslist:
SALES REPRESENTATIVE NEEDED (Harlem / Morningside)

Reply to: ceasersculpturesinc @ yahoo.com
Date: 2009-06-05, 6:49PM EDT

DONALDDO SCULPTURES INC seeks a virtual Part Time sales representative to complete
transactions,the payment is great and reasonable,please contact us via this email
ceasersculpturesinc @ yahoo.com
Regards,
CEO
Ceaser Banks

Compensation: Contact for Compensation
This is a part-time job.
OK to highlight this job opening for persons with disabilities
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1207446990

PayPort Inc.

Sat, 31 Oct 2009 06:57:30 +0000

Lori C.: I am not sure if this is a "phishing" scam, but I thought I'd send you the information because it seems really suspicious. I recently applied for an Administrative Assistant position that had a description to support a CFO of a large ingredient corporation preparing spreadsheets and entering data and developing PowerPoint presentations and this is the reply I received back - the job description didn't mention anything about working from home or dealing with deposits for money.

PhishBucket: We're extremely relieved that the red flags of working from home and payment processing stopped Lori from following through! And look at how they split up the paragraphs! How illiterate do you have to be to create new paragraphs mid-sentence? Is that supposed to convince job seekers of your professionalism?

A Google search of 'PayPort' turned up a couple interesting things (see: http://www.google.com/search?q=payport). First, Idaho.gov uses a service called PayPort Online to allow people to sell items and accept donations or payments through a Web interface. A couple links down in the Google search results we find that PayPort is: PayPort Payment Processing and Management Software.

We think the sender of the message below used the PayPort software name as their company name to make themselves look legitimate. Their scam is summed up in this line: "Open a new account to receive and process transfers into the account from clients." They even have the gall to quote trends in the percentage of women taking administrative assistant jobs. Clearly, scammers are watching the news about unemployment too.

It's a complete and utter phishing scam.

Message text:
From: PayPort Inc.<payportinc @ aol.com>
To: [removed]
Sent: Tuesday, June 02, 2009 5:34 AM
Subject: Re: CareerBuilder Job Application : Administrative Assistant

Dear [removed],we have received your resume and your skills, experience and
education are a good match for our current needs, please read our proposition.
PayPort Incorporation
About Us
The company was founded in 1996 by Quality and Business Improvement veteran Peter
Shields, who pioneered the concept of process-based management systems.

We have grown year-on-year and have established a considerable client list ranging
from niche engineering design consultancies of 30 people, to large blue chip

multi-nationals of 6000+. PayPort`s management system is a holistic framework which
displays visual business processes to connect applications, systems and people

into an integrated solution where the workforce, regardless of their level,
understand their role within the organisation.
While the automated process is ideal in delivering efficiency, compliance and
consistency to the more structured activities, the organisation needs another
mechanism to

provide transparency and to control the decision-making elements of day-to-day
operations.

POSITION: Administrative Assistant

Thank you for your interest in the “Administrative Assistant” (Local Manager)
position. We are currently seeking highly interested individuals for this position
Nationwide

– USA. This is a part-time/full time position with excellent opportunities.

JOB DESCRIPTION:
A “Administrative Assistant” is a full-time/part-time position, demands 2-4 hours
per day and mostly home-based position. This position requires you to work closely

with corporate email, or phone to provide executive support in processing simple
banking transactions in your local branch. This is mainly accomplished by banking
in

the branch – banking by phone and online is sometimes an option. With branches
across USA and one of the largest banking networks in the world, you will always

have quick and convenient access to your accounts and wide array of banking
services. A “Administrative Assistant” needs executive skills to carry out the daily
banking

functions. The position of Administrative Assistant is the heart and soul of our
company. You have the excitement of being part of a start-up (although our
principals

have started and sold several successful online businesses) and getting the
opportunity to be one of the veterans of the team as we grow. Administrative
Assistant get

regular transfers distributed to them on a daily basis.

In Branch Services:
Open a new account to receive and process transfers into the account from clients.
Every week our Managers will contact you in the case that our USA client has no

ability to send payment to one of our offices - you should receive and send money
from your branch. We are working only with direct wire transfers (Administrative

Assistant should not accept checks or paypal). Withdraw the amount needed to send to
the client from the bank branch, and send the funds to client using a traditional

transfer system (Western Union, Money Gram, Online transfer options, and other
options available). After transfer is completed, send email to Manager the transfer
details given in the transaction within the given time period allowed in the email.

JOB OFFER:

This position is based on a salary and commission bonus structure. The commission
is 8 percents or every transaction completed on a daily basis (transfers etc), and

the basic salary is 2000 USD weekly.
Weekly Salary Example: [4000 USD] received in bank account from client, subtract 8
commission [320 USD] – therefore, and send 3680 to client as requested in email

from Manager. 3 transfers per week=960 USD commission + 2000 salary per week.
The Weekly commission ranges from [1000-3000] for a typical Administrative
Assistant. The salary of 2000 USD weekly is in addition to the commission received,
and

will be processed by direct deposit into your bank account provided to the Hiring
Manager.
PayPort Inc. rule is providing one client’s payment for one account per day – this
allows you to be free of additional taxes. We pay employer fees from the head office

every month. So you can be free from any paper work. Annual salary: 96 000 USD and
30000 Additional bonuses.

-Working hours are generally from [9:00 AM – 12:00 AM], 2-4 days per week, with
flexibility possible is coordinated with management. Longer hours may be required,

depending on current deadlines and workload.
-The position requires the individual to have Internet access and Cell Phone to
carry out transactions on a daily basis. The Email account should be checked
regularly in

the time frame that is assigned to work within the week.
-A Bank Account is required, to complete the Administrative Assistant’s transactions
on a daily basis. Your successful promotion depends on your bank choice.
-Jobs are available in most areas of the country, the majority in large towns or
cities.
-Career breaks are possible, but as with any profession, if you are considering
re-entry you must keep up to date with development with the company and industry.
-It is estimated that the majority of the 41 percents Administrative Assistant’s are
female, and this trend is rising. The typical age range for this position: 20-70
years.
-Opportunities to travel and work abroad will be determined by the nature of the
duties.
To be a successful candidate you have to possess the following:

* No Previous Special experience required
* Responsibility, humbleness, a hard-working and enthusiastic attitude
* personal and interpersonal skills
* Basic computer skills
* basic math skills
* The ability to count and make accurate transactions
* Reliable Internet access

Why You'd Want This Job

    * Steady, stable work with a large, national company
    * Great benefits including excellent health care, tuition reimbursement, and
paid vacation
    * Higher pay than other internet work — and a more professional environment
    * Clear opportunities for advancement with a well-respected national company
    * A great group of people working in a real team atmosphere
    * Opportunities throughout the U.S.
    * Full online support from our managers – you write questions - the are
supporting you by email and phone!

If you think you have what it takes to join our highly skilled team we encourage you
to apply today!
PayPort Inc. has a great team and wants you to help us in continuing to make our
team stronger and more effective. We are currently working on the East Coast,

West Coast, and Central America. To process your employment, we need some of your
personal information, our managers preparing employment documents for you.

Your Application, send it to our email, SUBJECT: “Administrative Assistant”

MESSAGE:
*Full Name:
*Birth Date:
*Address:
*City, State, Zip:
*Home Phone:
*Cell Phone:
*E-mail:

Short Essay about yourself (200 characters max.):

Send this short application to our email and a Manager should contact you shortly.
------------------------------------------------
Sincerely Peter Shields , co-owner PayPort Inc.
2100 Marina Shores Dr Virginia Beach, VA 23451
Phone/fax: +1(703) 782-1615
PayPort Inc.

Headers:

None reported.

Fernando Brooks and TopResearchJobs.com

Tue, 27 Oct 2009 05:28:23 +0000

The sender is sending you to a page at TopResearchJobs.com (see WHOIS: http://whois.domaintools.com/topresearchjobs.com), yet he claims to be sending from CareerBuilder.com, which we just aren't buying. We're pretty sure CareerBuilder hasn't given this guy his own personal email address with them, which means it can be considered forged.

The job is supposed to be an executive manager position, but the duties read like a money transfer/mule scam (in a general way--we've learned how to read between the lines). The link is provided through a URL shortening service, which means you're REALLY taking your chances, since there's no guarantee you're going to TopResearchJobs.com or any legitimate site. In fact, you could end up loading a virus or malware, like a keylogger that keeps track of everything you type to try and obtain your passwords.

We're guessing you're not looking for this kind of hassle (or hustle). Oh, and our founder, who is AmeriCanadian, can verify that Canadians don't talk like that eh. ;)

Message text:
From: Fernando Brooks [Brooks @ careerbuilder.com]
Sent: Monday, October 19, 2009 10:45 PM
To: [removed]
Subject: [removed]: new offer

To: [removed]
From: Fernando Brooks

I thought you'd be interested in this page from TopResearchJobs.com

Link:
http : // plzlink.me/5bi

Comments:
Hello,
We found your CV on the Internet. Therefore we'd like to offer you a job
of an “Executive Manager”.
Our HR department studied your curriculum vitae and work experience
and highly recommends you for this job in our company.
The given position consists of the following tasks:
- timely filing of reports on the carried out work
- record keeping of customers in the USA.
You will receive more detailed instructions during an interview over the
phone.
Person specification :
- Age: starting from 25
- Time: must have from 1 to 2 hours of free time a day for carrying out
his duties.
- Citizenship: US
Payment for this work makes up 7000 USD a month.
The payment will be carried out to your bank account every month.
There are many candidates willing to take up this offer, therefore we're
kindly asking you not to delay with your decision about this position.

You may find detailed information about our organization at our webpage.

If this work is interesting to you, then please follow these steps:
1)        Register at our webpage. To do so CLICK ON THE LINK AT THE TOP OF
LETTER.
After doing so click on registration of "Executive Manager".
Please fill out every field correctly, since data will be checked by our
security department.
2)        Pass an interview over the phone.
3)        Sign a contract with our company.

We would like to thank you beforehand and we're looking forward to a
long-term cooperation.

Headers:
Return-Path: <researchjobs @ topresearchjobs.com>
X-Cloudmark-Score: 0
X-Connecting-IP: 209.216.201.18
X-Authority-Analysis: v=1.0 c=1 a=k1K9IpDlMI4A:10 a=ayC55rCoAAAA:8 a=lB5i6VerAAAA:8
a=bfajqqtzAAAA:8 a=_r7_k7onKK6mL4GGfCgA:9 a=ybFVzGHckoFs9iyELecA:7
a=SVJ7bOac5hapVTAIEitixjBiG3YA:4 a=B_aCAJXf4BQA:10 a=yVzzMDCNPgwX_NFW:21
a=vHU0dLW-lTb9PnZA:21
Received: from [209.216.201.18] ([209.216.201.18:41492] helo=admin.topresearchjobs.com)
        by [removed] (envelope-from <researchjobs @ topresearchjobs.com>)
        (ecelerity 2.2.2.39 r()) with ESMTP
        id AE/77-00623-2723DDA4; Tue, 20 Oct 2009 03:45:55 +0000
Received: (qmail 30058 invoked by uid 10001); 19 Oct 2009 20:45:03 -0700
Date: 19 Oct 2009 20:45:03 -0700
To: =?UTF-8?q?[removed]?= <[removed]>
Subject: [removed]: new offer
From: Fernando Brooks <Brooks @ careerbuilder.com>
Reply-To: <Brooks @ careerbuilder.com>
Precedence: bulk
Errors-To: TopResearchJobs.com <researchjobs @ topresearchjobs.com>
X-Mailer: http://www.phpclasses.org/mimemessage $Revision: 1.70 $ (mail)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Message-ID: <20091019204503.0099.researchjobs @ topresearchjobs.com>

Omni Hotel Canada

Tue, 27 Oct 2009 05:11:01 +0000

We'll have to forgive Brenda, who appears to be illiterate. Doesn't really look like the mark of the manager of a chain of hotels. We happen to know that the Delta Chelsea is a somewhat upscale hotel and if they do have a division called Omni Hotel (which we don't think they do), they certainly wouldn't recruit like this!

So what's the goal here, you ask? They're going to "help" you get to Canada. Which means they're going to require some wire transfers of your money to get things going. And just when you think it's about to happen, you'll find out there's been some administrative glitch that requires you send them more money. Again and again and again, until you finally get wise or they drain you of all your money. If you're not convinced, look at what the spam filter turned up in the headers. Forgery! Fraud! Falsehoods! Oh my!

Message text:
You are invited to "work and live in canada".

By your host Brenda Berreth:

am Brenda from Canada,i am the assistant manager of Canadian Hotels,i wish to inform
you that the hotel need man and woman who can work and live in omni hotel Canada,A
Division Of Delta Chelsea Canadian Hotel Canada,hotel will care of your
tickets,accommodation lodging and the visa assistance in your country,if you are
interested,you should please contact me back via the mail box

ominicity.hotels_cana @ yahoo.ca
MANAGEMENT ARE NOT RESPONSIBLE FOR YOUR CANADA CLEARANCE VISA FEE

     Date:                Tuesday October 20, 2009
     Time:                8:00 am - 9:00 am (GMT -06:00 US/Canada Central)

Will you attend? RSVP to this invitation at:

http :// calendar.yahoo.com/advert15.omini?v=126&a1=0&iid=SxIljrx%40B5AlaHu4Rhk9UG
d%4044Oo%40IQfyxdRlx%40%40&igid=1hBmvdhbU5Il%40D38ZxbyYSd%40qIDma4xpRxe89m7bRlv%40

Copyright ? 2009 All Rights Reserved
www .yahoo.com

Privacy Policy:
http :// privacy.yahoo.com/privacy/us

Terms of Service:
http :// docs.yahoo.com/info/terms/

Headers:
Return-Path: <advert15.omini @ yahoo.com>
Received: (qmail 24868 invoked from network); 20 Oct 2009 13:39:44 -0000
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on blade5
X-Spam-Level: ******
X-Spam-Status: hits=6.3 tests=FORGED_YAHOO_RCVD,HTML_MESSAGE,JM_SOUGHT_FRAUD_3,
        J_CHICKENPOX_61,J_CHICKENPOX_65,J_CHICKENPOX_72,MISSING_MID,RDNS_NONE
        version=3.2.4
Received: from unknown (192.168.1.107)
by blade5.cesmail.net with QMQP; 20 Oct 2009 13:39:44 -0000
Received: from unknown (HELO fetchmail.cesmail.net) (64.88.168.84)
by mx70.cesmail.net with SMTP; 20 Oct 2009 13:39:44 -0000
X-Apparently-To: [removed] via 68.142.200.149; Tue, 20 Oct 2009 06:36:22 -0700
X-YMailISG:
qALPmwQWLDu_Lr8.Lcsidno6vsNbBwLvUPkUdcKhCKf3vkFAU9_XKQvuPrI97eeG.kPZlBCdS4LvemW
0lTk4JV3a.vdKxy3Z7Gu0Ze.CBhVy3_o21A8XPbQTM2jB1asrOeLHHJi2qzp_.Url54FJT0SMpOQyfE
jPkv9vM9e2MW2_QWQx951rKtCETB9Tfsr3Um9JWWv.nBHXYyWldA3DX5k24isaEqvMYwquxMoV6pBBB
U69XNi9hi3Y0qT84KwVlNf2R.v9CSJYppZrl4X50ROkT0BYt3sbZF_mJA641HKuNfGgCjCoDTrkF.ao
ivsP7zJZ8E1MfZnQHItoiN4tu92uVXxfCmOyod9g1zMfMudFtFaLVumX4tLHsmy3V7Lt.U46H7C913G
btACegKPRXF7sSu7.5R4iH_BnXgpFqlZQshNuFC5l.KzgDjPXUdlDZYCwrBremxhmW2vkPHIako3NPs
9UbIA1pCigCuyV11nRI2ONYRNAzSS_f3E7LNwoNtnTemey4V_zCmClRCrPBDhLLYl3diE_4GtAUC6Qo
88djYW.1BMPl5dvkgkWCP1bi0d1qUPcyUyCbjE-
X-Originating-IP: [68.142.206.223]
Authentication-Results: mta250.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass
(ok); from=yahoo.com; dkim=pass (ok)
Received: from pop-ssl.plus.mail.a06.yahoodns.net [206.190.53.40]
        by fetchmail.cesmail.net with POP3 (fetchmail-6.2.1)
        for [removed] (single-drop); Tue, 20 Oct 2009 09:28:52 -0400 (EDT)
Received: from 68.142.206.223 (HELO n28.bullet.mail.mud.yahoo.com) (68.142.206.223)
by mta250.mail.mud.yahoo.com with SMTP; Tue, 20 Oct 2009 06:36:22 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=gcom1024;
t=1256045782; bh=lmw2ezbI7lmRt37pCoj99NlJmHo+CE2S9cEc2OaVWZY=;
h=Received:Received:Date:Received:x-yahoo-newman-errors:MIME-Version:Reply-to:Return-Path:
Errors-To:From:To:Subject:X-Yahoo-Newman-Property:X-Yahoo-Newman-Id:X-Yahoo-Calendar-Iid:
X-RocketSRV:Content-Type;
b=ZkktF9TlNhYbYUJVXqeXi8+iWeJAYqfM80/IHBJ4W6Pekar5g/hbZD7vMCsVUL0F4q4Ly5WBFK

r6Dw/5UmjI++vP16OMLjDhKSgCvkQmlxINk+SWheFxJHZLPpR/RsFYVRLS4zguJJBnhDgRlWv3zrKyCztd+8efFW9SgbFIXLM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=gcom1024; d=yahoo.com;
b=K+RaQpmfDHwkPXatc3OyEB0k4u+jMpFXeNgowGhEJu5N2LqW8tsziYu6rM7/yQ

G2pVtRntrokmnB7CUoWVNsC0Sm9xKXii3UtRP9V58Wc6Od2XViNHhhH/uPaSp+GFO9

v4nh59WDNMN/E5JTfgXECnQ5cLIpVowKJKoP5Qp9//M=;
Received: from [68.142.194.244] by n28.bullet.mail.mud.yahoo.com with NNFMP; 20 Oct
2009 13:36:17 -0000
Received: from [209.191.92.46] by t2.bullet.mud.yahoo.com with NNFMP; 20 Oct 2009
13:36:17 -0000
Date: 20 Oct 2009 06:36:17 -0700
Received: from [127.0.0.1] by web202.cal.mud.yahoo.com with NNFMP; 20 Oct 2009
13:36:17 -0000
x-yahoo-newman-errors:
calendar-invite.mfshmzlsoqytkltpnvuw42jdnruc2mjsgu3danbvg43tmllbmr3gk4tuge2s

433nnfxgsi3mna5dcojt-stanishjohnd=yahoo.com @ returns.bulk.yahoo.com
MIME-Version: 1.0
Reply-to: advert15.omini @ yahoo.com
Errors-To: advert15.omini @ yahoo.com
From: Brenda Berreth <advert15.omini @ yahoo.com>
To: [removed]
Subject: work and live in canada
X-Yahoo-Newman-Id: advert15.omini#lh-1256045776-advert15.omini#lh:193
X-Yahoo-Calendar-Iid: SxIljrx%40B5AlaHu4Rhk9UGd%4044Oo%40IQfyxdRlx%40%40
X-SpamCop-Disposition: Blocked SpamAssassin=6

Thames Gallery of Arts

Tue, 27 Oct 2009 04:38:51 +0000

Ah...yet another gallery. Suuure. The message is filled with typos and grammar problems. They want you to process payments using your personal bank account, making excuses about why they're not willing to wait for their payments to clear. Trust us, folks, they're not going to clear AT ALL, because the payments are bogus, drawn from closed or nonexistent accounts, and it's all just a ruse to steal your money and identity. Just look at the WHOIS on the sender's IP address! When you add Nigeria into the mix (well known for financial fraud, sadly to say), it starts stinking up the place, don't you agree?

Message text:
EMPLOYMENT; JOB OFFER

Hello Dear,

We are an european art company with an immediate opening for a part-time
book keeper/administrative assistant to join our team. You will be working
for us from home. Thames Gallery Of Arts islocated in Aberdeen, Scotland. We
exhibit Contemporary art paintings by emerging and mid-career artists,
including abstracts, landscapes and figures. Our Gallery initiates and
presents an extensive program for local and national exhibitions.

The Gallery's wide client-base includes private collectors, art consultants,
corporate art consultants, architects and interior designers as well as
business, government, diplomatic and social VIPs .Our Gallery offers the
client an extraordinary opportunity to acquire some of the most carefully
curated art in the contemporary, global art market. We are yet to open an
office in the U.S or have representatives in U.S; all our sales are made
seamlessly integrated through a company-wide computer network.

Thus we need to get payments for our products as soon
as it possible and about 90% of our customers prefer to pay through
Certified Cheques and Money orders based on the amount involved.
Unfortunately, we are unable to cash these payments from the US because most
international Cheques take about 10-14 working days for cash to be made
available. We lose about 75,000 USD of net income each month because we have
money transfer delays. We have decided to open this new
job position for solving this problem.

Please note that this job may take 2-3 hours of your time on a weekly basis
and will give you lots of free time to do other jobs. We are looking only
for the worker who satisfies our requirements and will be a competent
assistant. We are glad to offer this job position to you and the best of
your cooperation is highly needed.

YOUR TASK:
1. Receive payment from Customers, No sales involved.
2. Cash Payments at your Bank or cash stores.
3. Deduct 10% which will be your percentage/pay on Per Payment processed.
4. Forward balance after deduction of percentage/pay to any of the
regional offices you will be contacted to send payment to.
Payments are to be forwarded either by Money Gram or Western Union Money
Transfer depending on the one more convenient for you.

Charges for western union/Money Gram will be paid by us and not from your
commission. Local Money transfers takes barely minutes or sometimes an hour,
so it will give us a possibility to get customer's payment almost
immediately .Also, all checks and money orders sent to you are all tax free,
so you do not have to bother about the Irs or any other government agency
when doing your taxes. Please Note that an Employment/Application Form will
be sent to you if you decide to accept our offer.

Thanks Once Again,
Dr.Ken Dominic.
Address: WILNSLOM ROAD WITHINGTON
MANCHESTER P/CODE M204BX
LONDON
Email:kendominic1 @ i12.com <Email%3Akendominic1 @ i12.com>
Thames Gallery of Arts...

Headers:
Return-Path: <drkendominic001 @ googlemail.com>
Received: from intelinet.cl ([200.29.69.2])
        by mx.google.com with ESMTP id
10si4285572agb.36.2009.06.06.22.58.06;
        Sat, 06 Jun 2009 22:58:07 -0700 (PDT)
Received-SPF: neutral (google.com: 200.29.69.2 is neither permitted nor
denied by domain of drkendominic001 @ googlemail.com) client-ip=200.29.69.2;
Authentication-Results: mx.google.com; spf=neutral (google.com: 200.29.69.2
is neither permitted nor denied by domain of drkendominic001 @ googlemail.com)
smtp.mail=drkendominic001 @ googlemail.com
Message-Id: <4a2b56ef.0a025a0a.0f51.ffffcc4dSMTPIN_ADDED @ mx.google.com>
Received: from [82.128.27.33] (helo=User)
by intelinet.cl with esmtpa (Exim 4.43)
id 1MDDbT-00068v-CS; Sun, 07 Jun 2009 04:19:50 -0400
Reply-To: <kendominic1 @ i12.com>
From: "Thames Gallery of Arts"<drkendominic001 @ googlemail.com>
Subject: EMPLOYMENT; JOB OFFER
Date: Sun, 7 Jun 2009 06:57:26 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081

WHOIS sender IP 82.128.27.33:
(Courtesy: http://whois.domaintools.com/82.128.27.33)
IP Location:     Nigeria Nigeria Lagos Multi-links Telecommunications Limited
IP Address:     82.128.27.33
organisation: ORG-AFNC1-RIPE
org-name:     African Internet Numbers Registry
org-type:     RIR
address:      see http://www.afrinic.net
e-mail:       bitbucket @ ripe.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
remarks:      For more information on AFRINIC assigned blocks, use
remarks:      AFRINIC's whois database, whois.afrinic.net.
mnt-ref:      RIPE-NCC-HM-MNT
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered
role:         The African Internet Numbers Registry
org:          ORG-AFNC1-RIPE
address:      AFRINIC, see http://www.afrinic.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
nic-hdl:      AFRI-RIPE
e-mail:       bitbucket @ ripe.net
remarks:      For more information on AFRINIC assigned blocks, connect
remarks:      to AFRINIC's whois database, whois.afrinic.net.
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered

Richard Quality Painting & Decorating

Tue, 27 Oct 2009 04:14:27 +0000

Plain and simple: real companies don't have their customer payments sent to employees to cash in their personal bank accounts. NONE. EVER! It's not a challenging job. It's not a job. He simply wants to steal your money and identity. He doesn't even spell his last name correctly in his own email address! He's especially hoping you bank with Wells Fargo. That's not cool. The message originates from Nigeria, which is well known for perpetrating these types of scams.

If you get messages asking you to perform these kinds of duties, we guarantee they're fraudulent, no matter what kind of bullcrap story they give you. Some of you are wondering what harm could be done by giving it a shot. Well, EVERY SINGLE PERSON who's gone through with it has been robbed. Can YOU afford that right now? Got a few hundred dollars or more to blow?

Message text:
Staffing and Recruiting Dept,
Hiring Manager,
Richard Quality
Painting & Decorating

We have a job opening for the position of Accounts Receivable/Payable
Clerk.Would you like to work from your home and get paid weekly?Richard
Quality Painting & Decorating specialize in serving serve the entire State &
Canada and a growing export market, particularly in the supplies of selected
Paints including Paints and Arts decorating

ABOUT US: About Our Company, Our Vision, Values, Mission and Operating
Principles have been developed to reflect not only our day-to-day work on
our core business strategies, but also to guide us through the challenges
and opportunities that come with global expansion and rapidly changing
markets.

Job Description
Your primary task for now , as a representative of the company is to
Coordinate payments from customers and help us with the payment process. You
are not involved in any sales. Once orders are received and sorted we
deliver the product to a customer.After this has been done the customer has
to pay for the products but in most cases we make our clients prepay for
orders or bank wire transfers based on the amount involved. We have decided
to open this new contract -to-hire job position for solving this problem.

Your First Primary task (Collection of Payments):
1. Payment will be send directly to you by our customer. Via Cashier check,
Money Order.
2.You must be checking your email every day to know when payment has been
wired by our clients
3. Deduct $326 which will be your Weekly pay on Payment processed.
4. Forward balance after deduction of percentage/pay to any of the offices
you will be contacted to send payment to, You'll have a lot of free time
doing another job, because this job is part time, you'll get good income
.But this job is very challenging and you should understand it.We are
considering your application because you satisfy our requirements and we are
sure you will be an earnest assistant till we start running our branch
office in your state. Get back to us with information below information, so
that we can add your mailing address to our Regional database and forward it
to our customers

N.B:- Kindly Reply to this Email (richardmcain @ gmail.com)
First Name:
Last Name:
Residential Address: Not P.O.BOX :
City:
State:
Zip Code:
Home Phone:
Cell Phone:
Email:
Do You Have A Checking/Savings Accounts With Wells Fargo?

N.B:- Kindly Reply to this Email (richardmcain @ gmail.com)

Thanks For Your Understanding.

Richard McCain

Headers:
Return-Path: <richardmcain @ gmail.com>
Received: from nmail.nesma.net.sa ([212.71.41.85])
        by mx.google.com with ESMTP id 2si988392ewy.110.2009.06.04.18.59.36;
        Thu, 04 Jun 2009 18:59:38 -0700 (PDT)
Received-SPF: neutral (google.com: 212.71.41.85 is neither permitted nor
denied by domain of richardmcain @ gmail.com) client-ip=212.71.41.85;
Authentication-Results: mx.google.com; spf=neutral (google.com: 212.71.41.85
is neither permitted nor denied by domain of richardmcain @ gmail.com)
smtp.mail=richardmcain @ gmail.com
X-Virus-Scanned: NESMA AV
Received: from [196.3.183.72] (account accounts @ mem.com.sa HELO User)
by nmail.nesma.net.sa (CommuniGate Pro SMTP 5.1.16)
with ESMTPA id 37633202; Fri, 05 Jun 2009 05:03:53 +0300
Reply-To: <richardmcain @ gmail.com>
From: "Richard McCain"<richardmcain @ gmail.com>
Subject: ***Employment Offer Letters*** ( Earn $326 Weekly)
Date: Thu, 4 Jun 2009 14:59:30 -1100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 090604-0, 04/06/2009), Outbound message
X-Antivirus-Status: Clean
Message-ID: <auto-000037633202 @ nmail.nesma.net.sa>

WHOIS sender IP 196.3.183.72:
(Courtesy: http://whois.domaintools.com/196.3.183.72)
IP Location:     Nigeria Nigeria Afrinic
IP Address:     196.3.183.72
organisation:   ORG-ST1-AFRINIC
org-name:       Suburban Telecom
org-type:       LIR
descr:          LIR Xtra Small
country:        NG
address:        Plot 30 Blantyre Street
address:        WUSE II
address:        ABUJA
address:        Abuja FCT PO 13235
e-mail:         l.okuneye @ suburbantelecom.com
e-mail:         o.adeyemi @ suburbantelecom.com
e-mail:         o.adeyemi @ suburbantelecom.com
phone:          +23495236105
fax-no:         +23495236107
admin-c:        LO1-AFRINIC
tech-c:         LO1-AFRINIC
mnt-ref:        AFRINIC-HM-MNT
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
person:         Olaosebikan adeyemi
address:        30 Blantyre Street
                Wuse II Abuja
                Nigeria
phone:          +2348063073758
fax-no:         +2348063073758
e-mail:         o.adeyemi @ suburbantelecom.com
nic-hdl:        Oa13-AFRINIC
source:         AFRINIC # Filtered

The Saatchi Gallery

Tue, 20 Oct 2009 06:09:52 +0000

Very rarely do company presidents/CEOs play an active role in hiring 'payment processors' (we call them accountants). Yet that's what this offer would have you believe. They seem to offer you the job, sight unseen, even though you're a total stranger. They feel the need to reassure you it's 100% legal (always a bad sign). They also, for some reason, have FIVE different phone numbers.

No headers, but it doesn't take a rocket scientist or require more than an elementary school reading level to see there's something insanely wrong with this so-called job. You have no way to legitimize this offer. 'But what if they're spoofing a real gallery by the same name?' you ask. You can tell this isn't coming from a real company because they don't list their Web address or use a corporate email account. In other words, they could be anybody. And we don't want you to recklessly share your personal information with just ANYBODY. This will lead to financial and identity theft and is best left untouched if you're looking for a genuine job.

Message text:
From: THE SAATCHI GALLERY <saatchi-gallery @ pampano.unacar.mx>
Subject: Spam: JOB OFFER AT SAATCHI GALLERY
To: [removed]
Date: Monday, October 5, 2009, 3:08 PM

THE SAATCHI GALLERY.
Duke of York's HQ,
King's Road London SW3 4SQ.
United Kingdom.

Date: 6th October, 2009.

Good day,

JOB OFFER AT SAATCHI GALLERY

We the Management, Members and staff of Saatchi Gallery will be very glad
if you can represent us in your country and act as our Saatchi Gallery
Accounts officer in your region. You job is simple, 100% legal and you do
not need any capital to start, no registration fees are attached.

Your job will be to help us establish a medium of recieving payments from
our customers in your country through you to us.

Your commission will be 10% of every payment made through you to us.

ABOUT US:

The Saatchi Gallery aims to provide an innovative forum for contemporary
art, presenting work by largely unseen young artists or by international
artists whose work has been rarely or never exhibited in the UK and the
other parts of the world.

The audience for exhibitions of contemporary art has increased widely
during the last ten years as general awareness and interest in
contemporary art has developed both in Britain and abroad.

ARE YOU INTERESTED?

For more information on how you can apply for this position, If you are
interested contact our President/CEO.

Name: Richard Wilson
Email: saatchi.gallery @ yahoo.co.uk
Phone: 0702 307 2590, 0702 303 8554, 0702 305 2889, 0702 303 9854, 0702
301 5994

Also you are to forward to us your,

Full names:....................................
Age: ..........................................
Occupation:....................................
Phone number:..................................
Full contact addresses:........................
Country:.......................................

Thanks and have a great day!

Sincerely,
Ms. Sonia Moore

THE SAATCHI GALLERY.
Copyright 2003-2009 © The Saatchi Gallery : London
Contemporary Art Gallery

Headers:
None reported.

Richard King Art

Tue, 20 Oct 2009 05:58:57 +0000

The reason they tell you reply to their free Yahoo email account (Hong Kong) is because they forged the headers, which clearly show the email was sent from Brazil. The reason they ask if you've ever done this before is because they're hoping you're an easy mark. If not, they need to figure out what it will take to make you think they're legitimate.

This is a textbook money transfer/mule offer, designed to rob you of funds and your personally identifiable information. Your bank and the police will not necessarly be on your side when (not IF) things go south.

Message text:
Good day,

My name is Dr. Richard King and I own a company that art,art painting and fabric materials in London.

I am looking for a representative in the United States Of America And Canada who will be working for me as a part time worker and i will be willing to pay Ten Percent for every transaction processed.

We are recruiting individuals to work for the company as a Representative/Book Keeper in the countries listed above. We have customers we supply weekly in those countries and our customers make payments for our supplies every week in form of Money Orders and Cashier's checks, checks which are not readily cashed outside the United States and their country of issuance.

All you need to do is receive payment from customers, get it cashed at your bank or any financial institution that does such tasks then forward the balance after deduction of your percentage to any of the offices you will be contacted to send payment to, You will be making close to $1200 weekly

If you are interested in working kindly send the below stated data to (richardkingart @ yahoo.com.hk)

FIRST NAME............
LAST NAME..............
PHYSICAL ADDRESS.............................
CITY......................
STATE..............
ZIP CODE................
COUNTRY..............
PHONE NUMBER (S)...............................

HAVE YOU DONE THIS BEFORE INDICATE YES OR NO?

Thank you for your time and warmest regards.

Yours Sincerely,

Dr. Richard King
richardkingart @ yahoo.com.hk

Headers:
Return-Path: <florenca @ buffetflorenca.com.br>
Received: from hm1065-27.hospedagemdesites.ws (
hm1065-27.hospedagemdesites.ws [201.76.50.67])
by mx.google.com with ESMTP id
38si6595101yxe.89.2009.10.12.19.40.34;
Mon, 12 Oct 2009 19:40:34 -0700 (PDT)
Received-SPF: pass (google.com: domain of
florenca @ buffetflorenca.com.brdesignates 201.76.50.67 as permitted
sender) client-ip=201.76.50.67;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
florenca @ buffetflorenca.com.br designates 201.76.50.67 as permitted sender)
smtp.mail=florenca @ buffetflorenca.com.br
Message-Id: <4ad3e8a2.2602be0a.3fe4.ffffa0b0SMTPIN_ADDED @ mx.google.com>
Received: from plesk37.hospedagemdesites.ws (201.76.50.82) by
hm1065-27.hospedagemdesites.ws (PowerMTA(TM) v3.5r7) id hqfka60jpv09 for [removed]; Mon, 12 Oct 2009 23:40:32 -0300 (envelope-from <florenca @ buffetflorenca.com.br>)
Received: (qmail 9149 invoked from network); 12 Oct 2009 23:33:51 -0300
Received: from 201-95-2-44.dsl.telesp.net.br (HELO User) (201.95.2.44)
by plesk37.hospedagemdesites.ws with SMTP; 12 Oct 2009 23:33:50 -0300
Reply-To: <richardkingart @ yahoo.com.hk>
From: "Richard King"<florenca @ buffetflorenca.com.br>
Subject: All Time Employment Offer For You
Date: Tue, 13 Oct 2009 03:33:49 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Busby Fabric aka Busby & Busby Ltd.

Sat, 17 Oct 2009 07:31:00 +0000

They claim to be from the UK but interestingly, the IP addresses in the headers show it originating from the United States. Maybe it's a non-native resident of the U.S. sending these, we're not really sure. What we are sure of is that it's a money transfer/mule scam, designed to rob you of money and personally identifiable information. People who get involved in these scams lose anywhere from a couple hundred to several thousands of dollars, and also get in trouble with law enforcement because they often look like perpetrators rather than victims. Please don't be one of those people.

Message text:
BUSBY & BUSBY LTD
THE OLD STABLES,
WINTERBORNE WHITECHURCH,
BLANDFORD FORUM,
DORSET, DT11 9AW, ENGLAND
Tel;+447045785684

About Us
========
We are an international trading company dealing on the importation and exportation
of Art work and Fabrics to America,Canada, Australia and some other European
countries.We are presently having problems handling our logistics from America and
Canada as well as trying to tackle how our payments are remitted to us back here in
United Kingdom .hence, we need to recruit a Book-Keeper/Representative. I like to
know if you will be interested in working online from home and get paid weekly
without creating inconvenience to your present job.

We serve the entire United States/Canada and Europe and a growing Import market,
particularly in the supplies of Textiles and Fabric Products. Our integrated yarn
and fabric manufacturing operations use state-of-the-art equipment from the world's
leading suppliers. Order processing, production monitoring and process flow are
seamlessly integrated through a company-wide computer network.As a book
keeper/Representative for the company all you have to do are below:

Experience And Job Description:
===============================
We are currently seeking part or full time employees for our ever-growing Accounts
Receivable Department. Through extensive demographic research, we have discovered a
wealth of untapped human resources that, for one reason or another, need the freedom
to work from home. If this sounds like you, please read on, and consider becoming
part of our company family. as part of our on going Multilevel Marketing Network, we
seek capable individuals to work for us as our representative. You can easily make
$700-$1000 or more in a week by working for us as Sub-contractor in your
geographical location, you will be in charge of collecting payment on behalf of our
affiliates and Small business organizations that are registered under us. Does it
sounds like your dream job? Well, it certainly for 10,000 + current members who are
making $700- $1,000 weekly online with this system. Note that no form of investment
of is needed from you and this job will take only 1-3 hours of your time per we!
ek.

BENEFITS ARE AS FOLLOWS:
========================
* The average monthly income is about $3000 to $4000.
* No form of investments from you.
* This job takes Less than 1-2 hours per day.
* You do not pay any form of taxes.

Kindly get back to me as soon as possible if you are interested in this job offer
with your:
*BUSBY FABRIC RECEIVING PAYMENT ACCOUNT FORM *

Full Names
Contact Home Address Plus Zip Code (Not P O Box )
Age
Phone Number
Fax Number If Any

*Do you have an exclusive relationship with another United Kingdom based company?
YES /NO.*

Your provided information will be sent for the first internal screening and
comparable of applicant's information. Please if you are interested in this position
don't hesitate to get back to me.

Regards,
Jonathan David
The Manager

Headers:
X-Originating-IP: [173.55.6.5]
Authentication-Results: mta157.mail.sp2.yahoo.com from=busby.co.uk; domainkeys=neutral (no sig); from=busby.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO NS1.ganeshserver.com) (173.55.6.5)
by mta157.mail.sp2.yahoo.com with SMTP; Mon, 05 Oct 2009 17:29:13 -0700
Received: from User ([98.140.231.73]) by ganeshserver.com with MailEnable ESMTP; Mon, 5 Oct 2009 11:54:13 -0700
Reply-To: <busbyfabrics @ aol.com>
From: "Busby Recruit"<busbyfabrics @ busby.co.uk>
Subject: Busby Fabric Employment Opportunity
Date: Mon, 5 Oct 2009 11:50:35 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 1656

Spoof: Ricoh Company Limited

Tue, 13 Oct 2009 00:48:10 +0000

It's a money transfer/mule scam that tries to fool us in a few ways but fails:

1. They start the message Dear Friend (something recruiters don't do).
2. They target the United States, Canada, UK and Europe.
3. The need someone to process their payments.
4. They want to offer you 5% of payments you process.
5. They use horrible spelling and grammar throughout the offer.
6. They don't provide a Web site address or corporate email address.
7. They want you to email a free webmail.co.za account, *South Africa's "premier" email service.
8. They claim to be in Taiwan.
9. The email originates from Nigeria.
10. They spoof the well-known company Ricoh.

Have we given you enough to decide what to do with this offer?

Message text:
Dear Friend,

We are seeking for a representative in the America,Canada, United
Kingdom,Europe. One who will act as a medium for our clients in those
areas to be reaching us with their payments and so on. PLEASE NOTE KINDLY
THAT THIS JOB ONLY APPLIES TO PEOPLE OF AGE 18 AND ABOVE.

As our representative and payment officer,you are entitled to 5% of
whatever payments made to you after which we shall direct you as to how to
remit the balance to us .It's upon this we seek your honest cooperation
and assistance to establish a cordial relationship with our clients.If you
are interested,Please, to facilitate the conclusion of this transaction if
accepted, do click reply to this email to send me promptly an email or via
our agent address with this E-mail: khareemabdul11 @ webmail.co.za the
following,

Your full names
Age,
Contact Address,
Occupation & Position held,
Fax/Tel. No.

Thanks in anticipation.

Mr. Khareem Abdul
Human Resource Dept,
E-mail: khareemabdul11 @ webmail.co.za
Ricoh Company Limited
Ricoh (Taiwan)
Head Office,
21/F, One Kowloon,
1 Wang Yuen Street,
Kowloon Bay.
www .ricoh.com

Headers:
Return-Path: <jobs @ ricoh.com>
Received: from leila.philrice.gov.ph ([202.138.172.135])
        by mx.google.com with ESMTP id
13si6347663ywh.98.2009.10.06.02.22.49;
        Tue, 06 Oct 2009 02:22:50 -0700 (PDT)
Received-SPF: neutral (google.com: 202.138.172.135 is neither permitted nor
denied by best guess record for domain of jobs @ ricoh.com)
client-ip=202.138.172.135;
Authentication-Results: mx.google.com; spf=neutral (google.com:
202.138.172.135 is neither permitted nor denied by best guess record for
domain of jobs @ ricoh.com) smtp.mail=jobs @ ricoh.com
Received: from mail1.philrice.gov.ph (localhost [127.0.0.1])
by leila.philrice.gov.ph (Postfix) with ESMTP id E5FD41F3833;
Tue, 6 Oct 2009 07:54:03 +0000 (UTC)
Received: from 82.128.16.121
        (SquirrelMail authenticated user lvmarquez)
        by mail1.philrice.gov.ph with HTTP;
        Tue, 6 Oct 2009 07:54:03 -0000 (UTC)
Message-ID: <3759.82.128.16.121.1254815643.squirrel @ mail1.philrice.gov.ph>
Date: Tue, 6 Oct 2009 07:54:03 -0000 (UTC)
Subject: WORK WITH US FOR MUTUAL BENEFIT {RESPONSE NEEDED}.....
From: "RICOH COMPANY LIMITED" <jobs @ ricoh.com>
Reply-To: khareemabdul11 @ webmail.co.za
User-Agent: SquirrelMail/1.4.10a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;

WHOIS sender IP 82.128.16.121:
(Courtesy: http://whois.domaintools.com/82.128.16.121)
IP Location:     Nigeria Nigeria Lagos Multi-links Telecommunications Limited
Resolve Host:     ml82.128.16.121.multilinks.com
IP Address:     82.128.16.121
organisation: ORG-AFNC1-RIPE
org-name:     African Internet Numbers Registry
org-type:     RIR
address:      see http://www.afrinic.net
e-mail:       bitbucket @ ripe.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
remarks:      For more information on AFRINIC assigned blocks, use
remarks:      AFRINIC's whois database, whois.afrinic.net.
mnt-ref:      RIPE-NCC-HM-MNT
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered
role:         The African Internet Numbers Registry
org:          ORG-AFNC1-RIPE
address:      AFRINIC, see http://www.afrinic.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
nic-hdl:      AFRI-RIPE
e-mail:       bitbucket @ ripe.net
remarks:      For more information on AFRINIC assigned blocks, connect
remarks:      to AFRINIC's whois database, whois.afrinic.net.
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered

ALF Cosmetics Company

Tue, 13 Oct 2009 00:22:55 +0000

Good old payment processing, which means it's a money transfer/mule scam. The just want to send you fake checks printed by other 'mules' who are falling for a different angle of the scam. They want you to withdraw whatever the bank will allow and wire transfer it over before the bank gets notice of the NSF and reverses the transaction in your account. Don't be fooled by their excuse about not having an office in the U.S. to handle the payments, because they contradict themselves a sentence later. If you don't need an office, why do they? Any legitimate company can process payments sent to them from overseas. The only reason they use excuses is they're trying to sell you a story so you'll take the bait.

Don't bite the bait!

Message text:
Good day,

Would you like to work from home and get paid weekly, without affecting your
present job?
ALF Cosmetics Company needs a book-keeper in your state to be part of its
financial team. You are to work at home and
get paid weekly without leaving or affecting your present job.

ALF Cosmetics Company is primarily a Skin Care company based in the UK,we
need someone to work for the company as a

representative/book keeper in the States. We make products like Cellex-C
Products, DCL Products, DDF Skincare,
Jan Marini Skin Care, which of course, we have various customers we make
supplies to weekly in the States.

***YOUR TASK IS TO CO-ORDINATE PAYMENTS FROM CUSTOMERS AND HELP US WITH
THE PAYMENT PROCESSING***
This is in view of not having an office presently in your Country.
You dont need to have an Office and this certainly wont disturb any form of
work you have going on at the moment.

BENEFIT IS AS FOLLOWS:-
* The average monthly income is about     $2000 USD....
* No form of investments from you....
* This job takes only 1-3 hours per day....

If you are interested in being our representative please write back to this
email:....{alf.groups @ hotmail.com <email....alf.groups @ hotmail.com>}
with the informations asked below to start receiving payments from our
customers and start cashing right away.

Kindly Fill out the form below and we will be glad to get back to you within
12 hours.
APPLICATION FORM

Full Name........
Contact Address........
Zip Code.........
City.................
State............
Country..............
Home Phone.......
Cell Phone...........
Email..............
Age...........
Occupation........

Best Regards,
Dr.Andrew

ALF Cosmetics Company
Holy Bollyvard, 14 Apt 1d, Victoria Street
Windsor, Berkshire SL4 1Yb London U.K

Headers:
Return-Path: <anonymous @ plesk12.hospedagemdesites.ws>
Received: from hm1065-11.hospedagemdesites.ws (
hm1065-11.hospedagemdesites.ws [200.234.221.157])
        by mx.google.com with ESMTP id
26si14862762yxe.111.2009.10.06.17.47.25;
        Tue, 06 Oct 2009 17:47:25 -0700 (PDT)
Received-SPF: pass (google.com: domain of
anonymous @ plesk12.hospedagemdesites.ws designates 200.234.221.157 as
permitted sender) client-ip=200.234.221.157;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
anonymous @ plesk12.hospedagemdesites.ws designates 200.234.221.157 as
permitted sender) smtp.mail=anonymous @ plesk12.hospedagemdesites.ws
Received: from plesk12.hospedagemdesites.ws (200.234.220.69) by
hm1065-11.hospedagemdesites.ws (PowerMTA(TM) v3.5r7) id hpfihq0jpv0b for ;

Tue, 6 Oct 2009 21:47:24 -0300 (envelope-from

<anonymous @ plesk12.hospedagemdesites.ws>)
Received: (qmail 24870 invoked by uid 48); 6 Oct 2009 21:47:22 -0300
Date: 6 Oct 2009 21:47:22 -0300
Message-ID: <20091007004722.24856.qmail @ plesk12.hospedagemdesites.ws>
Subject: Employment Opportunity
X-PHP-Script: www.limacbauru.com.br//index.php for 196.3.183.86
From: ALF Cosmetics Company <alf.groups @ hotmail.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit

SH Builder

Mon, 12 Oct 2009 23:24:02 +0000

This one is phishy because the email sender, Ratnakar Bouchand, wants you to email Mary Flores. Their company name, SH Builder, is referred to in the Web domain as smarthomebuild.net; the owner of which is hiding behind their registrar. If they're called SH Builder, shouldn't their domain name be smarthomebuildER.net, or are we the only ones who notice this stuff?

They don't spell it out, but since they reference commission and assure you no fee or investment is required to generate income, we're pretty confident this will lead to a money transfer/mule scam. If you look at emails sent from legitimate recruiters, they're just not written like this.

Perhaps if they need a presence in another country they should go about it the way real businesses do. Don't fool yourself into believing you're going to be opening an office for them; and please don't volunteer personal information in response to job offers if the sender can't give you any info that will help you legitimize their company!

Message text:
Greetings

SH Builder founded in 2002 is recognized in the smart-house construction.
SH Builder has to expand into new markets to keep pace with market demand.
Our organization is looking for a local resident in this area to develop
our brand and products. As we continue to take our brand worldwide we
would like to offer you our Job position. Offering competitive wages the
opportunity for commissions and advancement we are looking for honest
professional and hard working individuals to keep our goal.

We offer a variety of hiring solutions including contract contract-to-hire
direct and executive placement. We are accepting resumes from persons
who want to start Part Time and move into Full Time or just supplement
their income. Or persons who want to build with us Full Time and grow into
management.

Pay type: Salaried + Commissions

Pay rate: USD28.000 - USD55.000 /year +

Categories: Sales & Marketing

Required Travel: Negligible

Location: for United States residents only no relocation required.

There is NO required fee or investment of money and time to generate income
. If you choose to attach your resume or cover letter please format your
documents in MS Word. Come review our Job Description and set up a time for
a regional director to speak with you further. The best way to contact us
is by an email at mary.flores @ smarthomebuild.net .

Thank you for your time and attention.

Best regards

SHBuilder.

Headers:
X-Originating-IP: [65.54.246.102]
Authentication-Results: mta116.mail.ac4.yahoo.com fromhotmail.com;
domainkeysneutral (no sig); fromhotmail.com; dkimneutral (no sig)
Received: from pop.plus.mail.fy4.b.yahoo.com [206.190.53.11]
        by fetchmail.cesmail.net with POP3 (fetchmail-6.2.1)
        for x (single-drop); Thu, 08 Oct 2009 13:48:07 -0400 (EDT)
Received: from 127.0.0.1 (EHLO bay0-omc1-s30.bay0.hotmail.com) (65.54.246.102)
by mta116.mail.ac4.yahoo.com with SMTP; Thu, 08 Oct 2009 10:36:41 -0700
Received: from BAY134-W2 ([65.55.139.37]) by bay0-omc1-s30.bay0.hotmail.com with
Microsoft SMTPSVC(6.0.3790.3959);
         Thu, 8 Oct 2009 10:33:15 -0700
Message-ID: <BAY1-0CC0 @ phx.gbl>
Content-Type: multipart/alternative;
        boundary"_084d8ccd-db4a-4ba3-872e-bd6f91cbbc44_"
X-Originating-IP: [69.122.137.11]
From: Ratnakar Bouchand <ratnakarbouchand412 @ hotmail.com>
To:
Subject: Position 7836354
Date: Thu, 8 Oct 2009 12:33:15 -0500
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 08 Oct 2009 17:33:15.0584 (UTC) FILETIME[6AD21C00:01CA483D]
X-SpamCop-Checked: 64.88.168.84 206.190.53.11 65.54.246.102 65.55.139.37

Tong Park Recruitment

Mon, 12 Oct 2009 21:34:32 +0000

No headers, but it doesn't take a geek to recognize this one. They specifically ask for US citizens willing to become their 'collaborators' and want these employees to buy check-printing software. Gee, we wonder why...

In case you've never smelled this type of scam before, this is how phishers recruit people to create the bogus checks they use in all those money transfer/mule scams we report here at PhishBucket. What's especially interesting about this one is that they want you to print the checks and then CASH THEM! Are they nuts? Are YOU nuts? If you get this offer, PLEASE don't even give them the time of day. There is NOTHING LEGAL about this offer.

CareerBuilder is already aware of the scam, but it didn't actually originate from CareerBuilder (we know because we've already heard from their fraud team on this one).

Message text:

Subject: Your Job Alert from Careerbuilder!
From: jobalert @ careerbuilder..com
Date: Fri, 9 Oct 2009 12:53:10 -0500

We thought you would be interested in this job:
Executive Financial Manager Apply Now

United States
Req'd Education:     High School
Base Pay:         10% commission
Req'd Experience:     No
Employee Type:         Financial Manager
Req'd Travel:         No
Industry:         Financial Operations
Relocation Covered:     No
Manages Others:     No

ABOUT US

Tong Park Recruitment is a team of seasoned top executives in Finance and Investment Operations who have unparalleled track records of success in pharmaceutical operations. We have earned the trust and confidence of property owners in the hospitality industry worldwide with our expertise, credentials, and commitment to create value.

OUR WORK

Tong Park Recruitment provides chain pharmaceutical investment resources without the associated chain bureaucracy and their associated costs. Instead of stand-off management, Tong Park Recruitment's operations teams provide daily, hands-on involvement, thrive on interaction, and inject the intensity of firm principals into the working environment.

CURRENT RECRUITMENT

Tong Park Recruitment is currently looking for US citizens willing to become our collaborators and work with us towards structuring our worldwide investment program. We are looking for people that own check-printing equipment, or that are willing to purchase such equipment and process checks from our US customers.( the money being refunded at the end of the month or at the first cashed check ) .

JOB DESCRIPTION

The Financial Manager is required to be a US citizen with a valid checking account ( business if possible ).These transactions are fairly easy to process. The Manager will receive instructions that will guide him/her through the entire process.
Your work will consist in printing checks from our US customers, cashing them out and making further payments to our main office or to one of our regional affiliate departments.
Each transaction will be made only after prior notification by phone call or e-mail.
You are not required to have any extra knowledge or to be experienced in this business and this occupation can endow additional income to you and your family as it will not require more than few hours per week.

PAYMENT/SALARY
The payment system if flexible and easy for everyone.Each Executive Financial Manager will receive a monthly base salary of $1000, plus a 10% commission from each transaction processed.

Requirements:

- check printing equipment , software and a personal computer
- checking account at any us bank ( business accounts if possible )
- in order to apply if you do not have a check printing equipment + software :

1) *A computer system at home with internet connection is required.

2) *You will buy Versa jette M400 v7 special with 6ft usb cable and VersaInk Value Nano Combo ( http://www.g7ps.com/scripts/m400v7special.asp)

3) *You will buy the check creation software Versa Check Gold 2010 ( http://www.g7ps.com/scripts/vc_gold10.asp ) ( it comes with 150 blank checks )

4)*You will buy Standard Voucher Check Envelope For use with business or
voucher size checks. 3-9/16 H x 8-3/4W, 250 quantity.

All the items can be bought at www.versacheck.com

After you acquire the item , you can deduct the cost of them from the first check you will have to process.

Financial Managers not required to:

    * be experienced in this domain, as they will be thoroughly instructed;
    * sell products or have any contact with customers;
    * quit their current job, since this is a Partnership involving only a few hours of work per week.

Equal Opportunity Employment

We encourage and support equal employment opportunities for all associates and applicants for employment without regard to sex, race, color, religion, national origin, age, disability, marital status, sexual orientation or veteran status. Employment decisions are based on an individual's knowledge, skills, abilities, job performance, and other qualifications that may be evaluated during the first phase of employment (Instruction Period). Tong Park Recruitment maintains policies and procedures designed to comply with applicable federal, state, and local laws governing non-discrimination in employment in every location in which Tong Park Recruitment operates. Individuality is the key to our success. We treat each client, candidate and employee as an individual with their own individual needs and tailor our offerings to best fit these needs.

Total work time per week will not exceed 5-6 hours. For further information about this job offer, please contact us by email : recruiter @ tongparkesholt.com

Good Grace Fabrics

Mon, 12 Oct 2009 21:22:28 +0000

Gina Jane needs a payment processor from the U.S., Canada, or Puerto Rico. Targeting North America, are we, Gina? Oh, and Gina, why are you using an email address with the name lise.andree to send the message but asking people to respond to a free Yahoo Hong Kong account? And while we're at it, Gina, why are you recruiting people to process fake checks and keep a percentage that doesn't exist? Are you hoping you recruits are too stupid to realize the checks will bounce, reversing the transaction in their accounts and getting them in trouble with their bank and the police?

Gina doesn't care. She just wants to send you a fake check so you'll take out the money (less your nonexistent commission) and wire transfer it to her. She knows your bank will release $100-$200 right away, and if you've got a line of credit, you might even get the whole amount to them before catching wind that the check bounced across the sea.

It's not a job at all.

Message text:
Greetings

I am Mrs Gina Jane ,Manager Of Good Grace Fabrics. We need a representative
from USA /CANADA/PR who can be working for us as a Payment Officer.we
receive Payments from clients in form of Money Orders and Check for which
its always too expensive and stressful for me to come down and receive such
payment so We decided to contact you.As a Payment Officer for the company
all you have to do are below:

JOB DESCRIPTION
*. Receive Documents/Payments in form of Check, Money Order
*. Deduct 10% which will be your percentage
*. Forward balance after deduction of percentage to the company.

Email back with the Info below

NAME
FULL ADDRESS(not p.o. box)
CITY
STATE
ZIP CODE
PHONE NUMBER

REPLY TO: goodgracefabrics1980 @ yahoo.com.hk
GOOD GRACE FABRICS.

Headers:
Return-Path: <lise.andree @ wanadoo.fr>
Received: from smtp21.orange.fr (smtp21.orange.fr [80.12.242.49])
by mx.google.com with ESMTP id
21si3929798ewy.18.2009.10.10.04.22.41;
Sat, 10 Oct 2009 04:22:41 -0700 (PDT)
Received-SPF: neutral (google.com: 80.12.242.49 is neither permitted nor
denied by domain of lise.andree @ wanadoo.fr) client-ip=80.12.242.49;
Authentication-Results: mx.google.com; spf=neutral (google.com: 80.12.242.49
is neither permitted nor denied by domain of lise.andree @ wanadoo.fr)
smtp.mail=lise.andree @ wanadoo.fr
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2123.orange.fr (SMTP Server) with ESMTP id 0C63F1C001DF;
Sat, 10 Oct 2009 13:22:41 +0200 (CEST)
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2123.orange.fr (SMTP Server) with ESMTP id EE81F1C001DE;
Sat, 10 Oct 2009 13:22:40 +0200 (CEST)
Received: from User (unknown [217.108.195.26])
by mwinf2123.orange.fr (SMTP Server) with ESMTP id 8FC591C001E6;
Sat, 10 Oct 2009 13:21:42 +0200 (CEST)
X-ME-UUID: 20091010112143588.8FC591C001E6 @ mwinf2123.orange.fr
Reply-To: <goodgracefabrics1980 @ yahoo.com.hk>
From: "Gina Jane"<lise.andree @ wanadoo.fr>
Subject: VACANCY
Date: Sat, 10 Oct 2009 06:22:35 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20091010112143.8FC591C001E6 @ mwinf2123.orange.fr>
To: undisclosed-recipients:;

Spoof: Ait Automation Systems

Mon, 12 Oct 2009 20:54:10 +0000

Textbook money transfer/mule scam. You can always tell when they ask you to receive and process their customer payments or accounts receivable. If you're stil not convinced this is a big ol' scam, ask yourself why a company supposedly in Ireland sent their recruiting email from CHINA. Or why they specifically target Irish, English and Scottish women.

We believe this is a spoof of a real company in Dublin and suggest that if you recognize the company, go to their site directly to look at their job listings. We're 100% certain you won't find THIS job on their list of available positions, because these duties would be illegal and get you and them into a whole lot of trouble.

If you get other messages asking you to process payments, please report them to us and avoid responding. Once you start communicating with these people, they don't tend to leave you alone until they convince you to carry out these tasks, and doing so could get you into serious trouble with the police and your bank.

And what the hell kind of name is Wallet Freeman (their reply-to email address)? Doesn't that really say it all? Someone will be a free man with YOUR wallet.

Message text:
Dear Applicant,
    Thanks for the interest, Are you earning below what you are expected to
earn in a year? Do you dream of earning more but you don't have the right
part-time job? Well, here is your chance to supplement your income!

Ait Automation Systems is offering opportunities to qualified applicants,
working from home, earning $600.- for each transaction completed. AIT
Automation Systems is located in Dublin, and we are a leader in power and
automation technologies, which enables our utility and industrial customers
to improve performance while lowering environmental impact,The main focus of
this AIT business is to provide customers with integrated solutions for
control, plant optimization, and industry-specific application knowledge.
The industries served include oil and gas, power, chemicals and
pharmaceuticals, pulp and paper, metals and minerals, marine and
turbocharging. Key customer benefits include improved asset productivity and
energy savings,we serve customers with energy efficient and reliable
products to improve customers' productivity, including drives, motors and
generators, low voltage products, instrumentation and analytical, and power
electronics. More than two hundred thousand pro
ducts are shipped daily to end customers and channel partners, spanning a
wide range of industry and utility operations, plus commercial and
residential buildings .

We offering this chance to you, to work as a representative of our company,
due to our continued growth both in the United Kingdom and in the United
States also internationally. You will be paid $600.- for each successful
transaction and this work can be done any time of the day or night, leaving
you free to pursue other opportunities, keep your present job, spend time
with your children, etc. Because of our excellent business reputation, we
handle sensitive contracts with numerous corporations and we also provide
services directly to consumers.

JOB DETAILS
What the job entails is simply providing a cash courier service for our
accounts receivable department. We receive different forms of payment
ranging from direct bank transfer to company checks, money orders and
sometimes, even personal checks and traveler’s checks. You will be notified
when you are getting a check by a representative of our company and all you
have to do is cash it, then transfer the funds into our company account in
Dublin.

APPOINTMENT REQUIREMENTS
18 years or older legally capable and responsible ready to work 2-4 hours
per week with PC knowledge, E-mail and Internet experience (minimal). And
please know that Everything is absolutely legal, If you are interested in
our offer, please reply with these informations below.

If Interested please send the below information by email to (
walletfreeman @ live.com)

Your Full Name:
Street Address:
City:
State:
Current Occupation:
Home Phone:
Cell Phone:
Marital status:
Sex: female
Nationality English, Irish and scotch

ADVANTAGES:
You do not have to go out as you will work as an independent contractor
right from your home office. Your job is absolutely legal. You can earn up
to $3000 - $4000 monthly, depending on time you will spend for this job.
You do not need any capital to start. You can do the work easily without
leaving or affecting your present working activities. The employees who
perform their jobs diligently and work hard have a strong possibility to
become managers. Anyway our employees never leave us.

Best regards,
Diana Somers
(+44) 7031904592
(+44) 7031939650
AIT AUTOMATION
http :// www .ait-automation.se/
Registered office & Head office:
AIT LTD.Belgard Road, Dublin 24

Headers:
Return-Path: <me @ me.com>
Received: from mail.zalaszam.hu (www2.zalaszam.hu [194.88.50.4])
        by mx.google.com with ESMTP id
11si2909883fxm.16.2009.10.10.17.36.36;
        Sat, 10 Oct 2009 17:36:36 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning me @ me.com does
not designate 194.88.50.4 as permitted sender) client-ip=194.88.50.4;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of
transitioning me @ me.com does not designate 194.88.50.4 as permitted sender)
smtp.mail=me @ me.com
Received: from www3.zalaszam.hu (unknown [172.30.1.3])
by mail.zalaszam.hu (Postfix) with SMTP id 925422AC4E3;
Sun, 11 Oct 2009 02:36:33 +0200 (CEST)
Received: from mobilpeter.hu (unknown [195.56.175.17])
by mail.zalaszam.hu (Postfix) with ESMTP id 4D8722AC4E3;
Sun, 11 Oct 2009 02:36:33 +0200 (CEST)
Received: from User ([61.137.93.80] RDNS failed) by mobilpeter.hu with
Microsoft SMTPSVC(6.0.3790.3959);
Sun, 11 Oct 2009 02:36:29 +0200
Reply-To: <walletfreeman @ live.com>
From: "AIT AUTOMATION"<me @ me.com>
Subject: Are You Earning Below What You Are expected
Date: Sat, 10 Oct 2009 17:36:26 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <AUTOPETER017yRLVbND000009c6 @ mobilpeter.hu>
X-OriginalArrivalTime: 11 Oct 2009 00:36:32.0712 (UTC)
FILETIME=[E183CC80:01CA4A0A]
To: undisclosed-recipients:;

WHOIS sender IP 61.137.93.80:
(Courtesy: http://whois.domaintools.com/61.137.93.80)
role:         CHINANET HUNAN
address:      No.1 TuanJie road,ChangSha,Hunan 410005
country:      CN
phone:        +86 731 4792092
fax-no:       +86 731 4792007
e-mail:       abuse.szx @ 2118.com.cn
trouble:      send spam reports to spam.szx @ 2118.com.cn
trouble:      and abuse reports to abuse.szx @ 2118.com.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      CH632-AP
tech-c:       CS499-AP
nic-hdl:      CH636-AP
mnt-by:       MAINT-CHINANET-HN
changed:       20050816
source:       APNIC
person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam @ ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy @ cndata.com 20070416

Spoof: Spurgeons Child Care

Mon, 12 Oct 2009 20:28:35 +0000

Damn foreigners. We love 'em, but not so much when they're scamming us. Look at the first sentence and you'll see what we mean. His name Joe Howard, our name PhishBucket!

A lot of money transfer/mule scams reported over the last year have been posing as charities, but the scam is still the same: cash our customer payments at YOUR bank and wire transfer all but a percentage you keep for yourself. The problem? ILLEGAL! Please don't ever follow up on a job that asks you to use your own bank or line of credit to transact their company business. Real employers NEVER do that!

According to the headers, the email was forged to look like it was from spurgeonschildcare.org. We believe this is a spoof of a legitimate charity organization.

Message text:
Hello,
              My name Joe Howard, Financial Director Spurgeons Child Care.I
am pleased in offering you a part time paying job .Spurgeon Child needs a
representative in the United States,Canada and Europe. This project has been
developed in a way not to affect your present job nor bring you any form of
stress but in order to help take care of those extra costs in the area of
Financial Independence; we empower people by providing the keys to
controlling your income and quality of life.
           This job would be based on contract and commission terms, it is a
part-time job and it would involve quite a handful of trust and honesty.
This is tax free because we have a Provisional Tax ID ( 20-5199737) obtained
from IRS,if you would be interested in including a good-paying, part time
job to your daily list of activities. I just took time to make this
explanatory enough so you could understand what the job entails, before I go
further I thought I'd inform you of both who you would be working for and
what you would be doing. The original orphanage, in Stockwell, was our home
for most of the first century, until a move to Reigate and then Birchington,
in Kent. Since 1979, when the last orphanage closed, our work has grown and
developed across the UK and around the world. Spurgeon Child Care is one of
the UK largest Christian charities working with children, young people and
families. With over 100 projects in the UK and overseas, we are committed to
professional social work as a practical expres

                       THE JOB
we have our donors send you payments which you will receive on our behalf as
our representative in the united states in the form of money orders,cashiers
checks,bank drafts,treasury bills which are readily cashable,cash them at
your bank and deduct a 10% of the fund processed by you after which you
forward the remaining fund to any of our territorial managers wherever the
fund will be needed by western union or money gram,you only need to give two
hours a fortnight. That is 0.6% of your time.It's nothing to you but It's
everything to them. I am sending you this offer because clearing this fund
here in the uk takes longer time and 30% is deducted from it in the bank
here as commission. If you are interested, please email me back at
joehoward.spurgeon @ operamail.com so we could make concluding arrangements.

Best Regards,
Joe Howard
Financial Director
www .spurgeonschildcare.org

Headers:
Return-Path: <careers.spurgeon @ spurgeonschildcare.org>
Received: from mailto.ch (mail.jass-tool-box.ch [193.247.200.172])
        by mx.google.com with ESMTP id
u9si6724760muf.31.2009.10.11.02.57.01;
        Sun, 11 Oct 2009 02:57:04 -0700 (PDT)
Received-SPF: fail (google.com: domain of
careers.spurgeon @ spurgeonschildcare.org does not designate 193.247.200.172
as permitted sender) client-ip=193.247.200.172;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of
careers.spurgeon @ spurgeonschildcare.org does not designate 193.247.200.172
as permitted sender) smtp.mail=careers.spurgeon @ spurgeonschildcare.org
Received: from User [69.39.237.23] by mailto.ch with ESMTP
(SMTPD32-8.05) id A01046F100AA; Sun, 11 Oct 2009 11:06:24 +0200
Reply-To: <joehoward.spurgeon @ operamail.com>
From: "Joe Howard"<careers.spurgeon @ spurgeonschildcare.org>
Subject: ****** A HUMANITARIAN ORGANISATION IS RECRUITING ******
Date: Sun, 11 Oct 2009 02:08:41 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 091010-0, 10/10/2009), Outbound message
X-Antivirus-Status: Clean
Message-Id: <200910111106921.SM01608 @ User>

Mystery Company - Susan Wright

Mon, 12 Oct 2009 20:08:49 +0000

This looks to us like a money transfer/mule scam that's been worded so that they didn't have to come right out and say it.

Red flags in this offer: the sender has a very "English" name but a very foreign accent; the email address doesn't match the sender's name, the email suggests the sender is in Australia (diversiti.com.au), yet the company claims to be in the UK; you're encouraged to take this as a second job and can work from home "as a distant employee"; candidates with no criminal record are required (so that when you go down for participating in this crime it will only be a first offense and the judge will go easy on you). And finally, instead of using a corporate email address and Web site, "she" wants you to reply to an email address at ml1.net, a free email service out of...Australia.

Message text:
From: Susan Wright (iyxreadership @ diversiti.com.au)
Date: 12/10/2009 11:51:37
To: [removed]
Subject: New part-time positions available now

Hello,

Our company has an open position of regional representative in the United Kingdom.
We are currently looking for active and ambitious people who would like to work in
a well-established company. We do not have any age limitations, and if You are able
and willing to work for 12-15 hours weekly, we are waiting for You. At first You might
try this position as Your second employment in order to see if this job fits Your
preferences. If You have skills in personnel management or experience in office workflow,
this will be a plus while considering Your candidacy.

Main requirements for applicants:

* Age 23 and older (no upper limit)
* No criminal record
* Constant Internet access

You will be able to receive full salary during probation period as well. Also if You
complete the probation period successfully, You will have an option of becoming an office
worker or remaining a distant employee.

If You would like to change Your life for better and start a great career, then send us
Your resume. We will carefully consider it and give You a reply within 48 hours.

We are looking forward to receiving Your resume at susanwright @ ml1.net

We guarantee that all resumes we receive will be studied carefully and every applicant
will be notified of the results.

Best regards.

Craigslist - emnbc

Mon, 12 Oct 2009 02:48:22 +0000

Peter: They list all legitimate functions, but...all of this at home? They mention "without leaving their present Job", a classic phrase in scams, not to mention the capitalization error of Job, and the non capitalization of new york in two different places. And the vague compensation. They will probably claim they want to check your reliability first by sending you checks.

PhishBucket: We never like job postings where the employer doesn't tell you who they are or give you any way to find out. Why should you feel obligated to provide complete and utter strangers with your valuable personal information? Well, you shouldn't. Employers and recruiters have a responsibility to ensure they follow best practices, and this email demonstrates a clear lack of that knowledge.

As seen on Craigslist:
Accounts Receivable (new york)

Reply to: job-emnbc-1205808454 @ craigslist.org
Date: 2009-06-04, 7:21PM EDT

We are searching for a financial payment contractor (Accounts Receivable) for our
company who are willing to work for us from home and get paid weekly without leaving
their present Job.

Job Description-
This position will cover a large range of accounting and customer service tasks. The
job responsibilities include and are not limited to:
• Responsible for all Accounts Receivable and Accounts Payable
• Bank Reconciliation and other Month End Procedures
• Journal Entries
• Preparation and analysis of monthly, quarterly and yearly financial statements
• Preparation and filing of taxes
• Marketing
Requirements-
This position requires previous bookkeeping experience. It would be preferred if
this candidate’s qualities and knowledge include:
• Experience with Quickbooks and Excel and willingness to learn other software
• Excellent oral and written communication skills
• Vast computer skills
• Possess strong multi-tasking and organizational capabilities
• Proven characteristics of consistent accuracy and attention to detail
• A strong work ethic with the ability to meet deadlines.

Location: new york
Compensation: Good Pay
This is a part-time job.
OK to highlight this job opening for persons with disabilities
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1205808454

Golden Lace Co. Ltd.

Mon, 12 Oct 2009 02:39:17 +0000

This one is absolutely dispicable. No need to provide them with personally identifiable info like your Social Security number or passwords, but a copy of your passport or driver's license is required, otherwise you're told not to bother. They claim to be worried about making sure you won't be tempted to do the wrong thing with large sums of money. Meanwhile, what are they doing?

The email originates from Nigeria. So they're not really some company in Taiwan, and the duties they want you to perform are not only illegal, but will result in them robbing you of cash and your identity too.

We're guessing you wanted a job, not this mess, right? We say, "Hit the road, Jack!"

Message text:
Are you earning below what you expect to earn in a year? Do you
dream of earning more but you don't have the right part-time job?
Well, here is your chance to supplement your income!
Golden Lace Co. Ltd. is actively seeking For an On line Accounts
Clerk/Representatives.

PRODUCTS KEYWORD
Manufacturer and exporter of Textile (clothing) Lace supply - Bridal
lace, Chemical Gui pure lace, Sequins Laces, Embroidery Lace,
Fashion Wear Laces, Moustache Laces, Gui Pure Trimmings, motifs,
yokes, Collars, Evening dress Laces, Tulle base Laces, satin base
Laces, Taffeta Base Laces, Hand made laces, Stretch Fabrics
We have been receiving orders from some part of the Country, Which
we have not be enable to process competently since we do not have a
payment receiving personnel in those countries. We have decided to
recruit payment officers because we can not wait for 14 working days
before payment get to us because of too many delays in posting of
checks and verification. We now decided to Recruit workers who we
can use as payment Agent/Online Clerk to get our payment across to
us on TIME and also attend some seminars on our behalf.

REQUIREMENTS

1. 18 years or older.
2. Responsible, Reliable and Trustworthy.
3. Ready to work 1-2 hours per day
4. Able to check and Reply emails in the morning and night everyday.
5. We must be able to reach you on phone when needed.

ADVANTAGES

1. No form of investments from you & No registration or sign up fee.
2. It takes only 1/2 hours per day
3. You can work from your office or home.
3. Your commission is 10%and will later will increase up to 15%
4. Compensation and monthly allowance are been allocated to staffs
that puts in their best abilities when performing their jobs.

JOB DESCRIPTION

Cashing payment for our accounts receivable department.
We receive different forms of payment ranging from direct bank transfer,
cash deposit & Credit Cards Transfers. You will be notified when you are
getting any payment by a representative of our company and all you have
to do is cash it, then transfer the funds to our Company through Western
Union, Money Gram & wire transfer into our account.
If you are interested, please send the following information via email:
====================================================

Full Name:----------
Street Address:----------
City:----------
State:----------
Zip code:----------
Country:----------
Phone Number:----------
Age:----------
Sex:----------
Current Occupation:----------
Position Held:----------
Any Form of Identity by Scanning or ID Number:----------
====================================================

WARNING

If you can not meet this requirements, Please don’t
reply to this email , We are looking for people with the highest
standards of honesty and integrity only. Please do not apply if
you feel you cannot handle large sums of cash without being
tempted to perform a dishonest act. We will never ask you for
anything more than that which we have stated above. Passwords,
SSN etc, If anyone asks for those on our behalf please do not give
out this info. This is to ensure your security and non involvement
in cases of Identity theft.

VERIFICATION

Because you would be handling large sums of cash, we also require
you to Scan & attach to us a copy of your driver’s license or
international passport or the Identification Number on any of the
two for Verification. This will be used to verify your identity and to
prevent fraud.

Mr. Jack Rowland
Golden Lace Co. Ltd
210, Sinsiao Road, South District,Tainan,Taiwan
886-6-2615113
2008 (c) Golden Lace Co.
All rights reserved.

Headers:
Return-Path: <ymuliaa @ gmail.com>
Received: from edata.wavenet.com.ar ([200.49.148.82])
     by [removed] with SMTP id 0906041255_[removed]_789995_4764355;
     Thu, 04 Jun 2009 12:56:06 -0700 EST
Received: from User ([82.128.47.84])
     by edata.wavenet.com.ar (Merak 8.0.3) with ASMTP id TS564965;
     Thu, 04 Jun 2009 16:54:28 -0300
Reply-To: <candyjane44 @ yahoo.com>
From: "Golden Lace Ltd"<ymuliaa @ gmail.com>
Subject: ONLINE PART TIME JOB
Date: Wed, 3 Jun 2009 20:55:24 -0700
MIME-Version: 1.0
Content-Type: text/plain;
     charset="Windows-1251"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090604200553.4C82D317A2 @ [removed]>
To: undisclosed-recipients:;
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by coldrain.net id n54KClKO032673

WHOIS sender IP 82.128.47.84:
(Courtesy: http://whois.domaintools.com/82.128.47.84)
IP Location:     Nigeria Nigeria Lagos Cdma 1x/evdo Dial Up Pool
IP Address:     82.128.47.84
inetnum:      82.128.0.0 - 82.128.127.255
org:          ORG-AFNC1-RIPE
netname:      AFRINIC-NET-TRANSFERRED-20050223
descr:        This network has been transferred to AFRINIC
remarks:      These IP addresses are assigned in the AFRINIC region.
remarks:      Authoritative registration information for this network
remarks:      is available for query and modification in
remarks:      the AFRINIC whois database: whois.afrinic.net or
remarks:      web site: http://www.afrinic.net
remarks:      The routing registry information (route(6) objects)
remarks:      may be published in any Routing Registry, including
remarks:      RIPE Whois Database
country:      EU # country is really somewhere in African Region
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
status:       ALLOCATED PA
mnt-by:       RIPE-NCC-HM-MNT
mnt-routes:   RIPE-NCC-RPSL-MNT
source:       RIPE # Filtered
organisation: ORG-AFNC1-RIPE
org-name:     African Internet Numbers Registry
org-type:     RIR
address:      see http://www.afrinic.net
e-mail:       bitbucket @ ripe.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
remarks:      For more information on AFRINIC assigned blocks, use
remarks:      AFRINIC's whois database, whois.afrinic.net.
mnt-ref:      RIPE-NCC-HM-MNT
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered
role:         The African Internet Numbers Registry
org:          ORG-AFNC1-RIPE
address:      AFRINIC, see http://www.afrinic.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
nic-hdl:      AFRI-RIPE
e-mail:       bitbucket @ ripe.net
remarks:      For more information on AFRINIC assigned blocks, connect
remarks:      to AFRINIC's whois database, whois.afrinic.net.
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered
route:          82.128.40.0/21
descr:          MLTL IP ADDRESS BLOCK
origin:         AS36954
mnt-by:         RIPE-NCC-RPSL-MNT
mnt-by:         MLTL-INT-MNT
source:         RIPE # Filtered

The Contemporary Fine Art Gallery Eton aka Craft Centre & Design Gallery

Mon, 12 Oct 2009 01:49:31 +0000

Too bad we don't have headers, because we'd like to know where this originated from. Let's just say this: what legitimate employer would EVER require their employees to use their own credit card and bank account to transact company business? The correct answer is they don't. This scammer doesn't even want to argue about it - if you don't have their requirements you can just bugger off. We suggest you do just that and avoid being robbed. It's possible they've spoofed a real company in this offer, or that they created it to scam people - hard to say, since we're not from over there. At any rate, we wouldn't recommend answering this email if it's a job you're looking for.

Message text:

From: The Contemporary Fine Art Gallery Eton (contact @ fineartgallery.co.uk)
Subject: Less Stress Job Offer
To:
Date: Thursday, June 4, 2009, 6:38 AM

Dear Citizen,

Have you ever imagined earning more to your personal income
in a week without moving an inch from your home,simply means
less stress.The Craft Centre & Design Gallery is proud
to present Work Without Stress. I am here to bring to your
notice a Job Offer which I know it will be a great interest
to you.

Please Note:

1. you must have Credit Card Account
2. You must have Bank Account

if you don't have above Requirements do not reply.

The Contemporary Fine Art Gallery Eton
31 High Street Eton
Windsor Berkshire SL4 6AX
United Kingdom
Phone: +447024044586

I await your kind reply
lynda.gregoory @ live.com
Lynda Gregory
HRM

Azuma Tsucho Co.

Mon, 12 Oct 2009 01:28:23 +0000

Geez, we don't even need to look up the headers to see what's wrong with this offer. First off, how many CEOs do you think send out recruiting letters? Right. Okay, and how many do you know who would apologize for "encroaching in your privacy"? Hear an accent yet?

They target "America" and Canada. And then they spell it out: the money transfer scam. Just process their payments and keep 10%. We've reported HUNDREDS of these offers, and they're all bogus. Without even checking the headers we can see that the message looks like it originated from Spain, yet they claim to be in Japan and justify that by claiming to have sent it from yahoo.com.hk (in fact, after checking the headers we discovered IP 41.220.75.3, which originates in Nigeria, making the email that much more bogus).

Nice try, but not good enough.

Message text:
FROM THE DESK OF
WATARU HIRAISHI
C E O,
AZUMA TSUCHO CO, LTD.
JAPAN.

This mail is serving as an invitation to treat with the above named
company. I will not fail to state that I am sorry for encroaching in your
privacy. Our company was established in 1991. Over the years we have
accumulated invaluable experience in our business and we are proud to
claim we are second to none. Our line of business includes food produce
wholesale, export of fresh and frozen produce fish and vegetable, Soya
bean paste, pickles, seasoning, and many varieties of dry foods.

Over the years we have limited countries where our products are been
exported, due to the quality of our products we have successfully some few
customers in the America continent. Due to the increase in demand of our
products in America and Canada, we have decided to move our products fully
into the continent of America. By so doing, we are searching for reliable
persons/companies who can act as a DISTRIBUTOR/RECEIVING OFFICER who will
act as medium of reach between our customers and us in their area of
locality. Note that, if finally approved as our Representative, you are
entitled to an annual income of 10% of whatever amount you receive from
customers who are making payments for outstanding invoices on behalf of
the company.

Our account officer in Japan will convey to you the medium which you will
use to remit any funds received on our behalf. If you are interested in
being a RECEIVING OFFICER in the above location and your locality, please
get to me

Sincerely.

Wataru Hiraishi

Headers:
Return-Path: <wataruhiraishi02 @ yahoo.com.hk>
Received: from ideafix.cast-info.es (ideafix.cast-info.es [217.70.2.212])
        by mx.google.com with ESMTP id
26si2317086ewy.59.2009.06.04.06.30.20;
        Thu, 04 Jun 2009 06:30:21 -0700 (PDT)
Received-SPF: neutral (google.com: 217.70.2.212 is neither permitted nor
denied by best guess record for domain of wataruhiraishi02 @ yahoo.com.hk)
client-ip=217.70.2.212;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.70.2.212
is neither permitted nor denied by best guess record for domain of
wataruhiraishi02 @ yahoo.com.hk) smtp.mail=wataruhiraishi02 @ yahoo.com.hk
Received: from ideafix.cast-info.es (ideafix.cast-info.es [217.70.2.212])
by ideafix.cast-info.es (Postfix) with ESMTP id 0BB505BAB12;
Thu, 4 Jun 2009 15:29:51 +0200 (CEST)
Received: from mail.cast-info.es (enya.cast-info.es [217.70.2.150])
by ideafix.cast-info.es (Postfix) with ESMTP id 169075BAADD;
Thu, 4 Jun 2009 15:28:36 +0200 (CEST)
Received: from 41.220.75.3
        (SquirrelMail authenticated user cvnavas)
        by mail.cast-info.es with HTTP;
        Thu, 4 Jun 2009 15:28:53 +0200 (CEST)
Message-ID: <35470.41.220.75.3.1244122133.squirrel @ mail.cast-info.es>
Date: Thu, 4 Jun 2009 15:28:53 +0200 (CEST)
Subject: Read & Respond
From: "AZUMA TSUCHO, CO.LTD" <wataruhiraishi02 @ yahoo.com.hk>
Reply-To: wataruhiraishi02 @ gmail.com
User-Agent: SquirrelMail/1.4.8
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;
X-Virus-Scanned: ClamAV using ClamSMTP

WHOIS sender IP 41.220.75.3:
(Courtesy: http://whois.domaintools.com/41.220.75.3)
IP Location:     Nigeria Nigeria Afrinic
Resolve Host:     mtnngprs.com
IP Address:     41.220.75.3
organisation:   ORG-MN1-AFRINIC
org-name:       MTN Nigeria
org-type:       LIR
country:        NG
address:        Golden Plaza,
address:        Falomo Roundabout,
address:        Ikoyi
address:        Lagos
e-mail:         hostmaster @ mtnnigeria.net
e-mail:         chukwunk @ mtnnigeria.net
phone:          +234 803 200 5038
admin-c:        CN6-AFRINIC
tech-c:         BO5-AFRINIC
mnt-ref:        AFRINIC-HM-MNT
mnt-ref:        MTNNIGERA1-MNT
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
role:           HostMaster MTN_Nigeria
address:        Golden Plaza,
                Falomo Roundabout, Ikoyi
                Lagos State
                Nigeria
phone:          +2348032005038
phone:          +2348032009018
e-mail:         hostmaster @ mtnnigeria.net
admin-c:        CN6-AFRINIC
admin-c:        BO5-AFRINIC
tech-c:         OI4-AFRINIC
tech-c:         BO5-AFRINIC
nic-hdl:        HM10-AFRINIC
mnt-by:         MTNNIGERA1-MNT
source:         AFRINIC # Filtered

Nasseri Fabrics Ltd.

Mon, 12 Oct 2009 00:56:07 +0000

Classic money transfer/mule scam, complete with cashing checks at your bank, keeping 10% commission and wire transfering the balance. Please don't answer emails like this. As you can see from the info below, the email sender actually originates from Nigeria. They also reassure you how legal it is, which is your guarantee it's NOT at all.

First of all, legitimate companies don't ask employees to use their personal bank accounts to transact company business. EVER. Companies are also legally not allowed to base decisions on marital status, gender, nationality, age (other than being over 16 years old), or disability. So when you see someone asking those questions, RUN AWAY! And finally, as we always love to point out, since they don't have a Web site or corporate email address in the offer, and ask you to respond to a free Web mail account, we know they aren't all they claim to be.

If you get involved, you WILL be robbed. Your bank might freeze your account if they think you're trying to pass a bad check; they might call the cops; you might be arrested. You will lose the funds you wire transferred and the bank will reverse the transaction, which means you get double-whammied in the wallet. The personally identifiable info you gave the scammers will probably be rented or sold to other scammers, and from there we're sure you can imagine how bad it gets.

This is NOT a job, okay! If you see this language, please report the offer to us and keep on truckin'!

Message text:
Dear Sir/Ma,

    Would you like to work online from Home/Temporarily and get paid weekly?
We are glad to offer you for a job position at our company, NASSERI FABRICS
LTD We need someone to work for the company as a Representative/Bookkeeper
in the USA. This is in view of our not having an office presently in the
USA. You don’t need to have an Office and this certainly wont disturb any
form of work you have going at the moment.

Our integrated yarn and fabric manufacturing operations use state-of-the-art
equipment from the world's leading suppliers. Order processing, production
monitoring and process flow are seamlessly integratedthrough a company-wide
computer network.

* The average monthly income is about 4000.00 USD.
* No form of investments from you.
* This job takes only 1-3 hours per day

About the job:

We have sales representatives all over the world to distribute our products.
You know, that it's not easy to start a business in a new market (being the
US). There are hundreds of competitors, close direct contacts between
suppliers and customers and other difficulties, which impede our sales
promotion. We have decided to deliver the products upfront, it's very risky
but it should push up sales on 25 percent. Thus we need to get payments for
our products as soon as it possible. Unfortunately we are unable to open
Bank Accounts in the United US without first registering the company name.
Presently with the amount of Orders we have, we cannot put them on hold. For
fear of loosing the customers out rightly.

Secondly we cannot cash these payments from the US soon enough, as
international Checks take about 14 working days for cash to be made
Available. We lose about 75,000 USD of net income each month because we Have
money Transfer delays* your task is to coordinate payments from customers
and Help us with the payment process. You are not involved in any sales. Our
Sales Representative makes direct contact for sales of products. Once orders
are received and sorted we deliver the product to a customer (usually
through FEDEX). The customer receives and checks the products. After this
has been done The customer has to pay for the products. About 90 percent of
our customers prefer to pay through Certified Checks and Money orders based
on the amount involved.

YOUR TASK we have decided to open this new job position for solving this
problem.

Your tasks are;

1. Receive payment from Customers
2. Cash Payment at your Bank
3. Deduct 10% which will be your percentage/pay on Payment processed
4. Forward balance after deduction of percentage/pay to any of the offices
you will be contacted to send payment to.(Payment is to be forwarded by
Western Union Money Transfer). www.westernunion.com

Local Money transfers take barely hours, so it will give us a possibility to
get customer's payment almost immediately.

For example you've got 3000.00USD
You take your income: 300.00 USD
Send to us: 2700.00 USD
First month you will have 15-20 transactions on 3000.00-4000.00 USD
so you may calculate your income.
For example 10 transactions on 3500.00 USD gives you 3500.00 USD
Plus your basis monthly salary is 1000.00 USD
Total: 4500.00 USD per month

After establishing a close co-operation with us you'll be able to operate
with larger orders and you'll be able to earn more. Our payments will be
issued out in your name and you can have them cashed in your bank or other
Cashing Services. Deduct your weekly salary and forward the balance to the
company via western union money transfer.We understand it is an unusual and
incredible job position. This job takes only 3-7 hours per week. You'll have
a lot of free time doing another job, you'll get good income and regular
job.

IS THIS LEGAL?
Yes it is. As a matter of fact, our legal department checked all legal
provisions to ensure if there is any domestic or international law against
businesses or deals in this manner and also money laundry acts, also it
complies with USA Patriot Act Section 314(b)

But this job is very challenging and you should understand it. We are
looking only for the worker who satisfies our requirements, a diligent
worker, very consistent and will be an earnest assistant. We are glad to
Offer this job position to you. If you feel that you are a serious and
earnest worker and you want to work for NASSERI FABRICS LTD, Get back to us
with information below information, so that we can add your mailing address
to our Regional database and forward it to our customers for them to send
payments.

First name...................
Middle name..................
Last name....................
Address Line 1...............
Address Line 2...............
City.........................
State........................
Zip/Postal code..............
Age..........................
Marital Status...............
Nationality..................
Home phone...................
Cell phone...................
Current Occupation...........

YOU’RE PREFFERED MODE OF COMMUNICATION EITHER BY PHONE OR BY EMAIL

Your response to this email is needed, so that we can reconfirm your mailing
address details we have in our database. We will be updating you as soon as
the payment is being sent to you and you will be directed as to where to
have the remaining 90% of the money sent to, after the deduction of your 10%
pay on any payments received and processed by you.

Headers:
Return-Path: <recruit.nasseri.fabrics @ live.com>
Received: from mail.address.bg (mail.address.bg [212.39.83.188])
        by mx.google.com with ESMTP id 12si781920fgg.0.2009.06.03.21.44.45;
        Wed, 03 Jun 2009 21:44:46 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning
recruit.nasseri.fabrics @ live.com does not designate 212.39.83.188 as
permitted sender) client-ip=212.39.83.188;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of
transitioning recruit.nasseri.fabrics @ live.com does not designate
212.39.83.188 as permitted sender) smtp.mail=
recruit.nasseri.fabrics @ live.com
Received: from localhost (unknown [127.0.0.1])
by mail.address.bg (Postfix) with ESMTP id 990771B9480;
Thu, 4 Jun 2009 04:37:48 +0000 (UTC)
X-Virus-Scanned: amavisd-new at address.bg
Received: from mail.address.bg ([127.0.0.1])
by localhost (mail.address.bg [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id RQUluGqaJeZN; Thu, 4 Jun 2009 07:37:48 +0300 (EEST)
Received: from User (unknown [80.255.61.29])
by mail.address.bg (Postfix) with ESMTPA id 0CC36B02DE;
Thu, 4 Jun 2009 07:35:47 +0300 (EEST)
Reply-To: <recruit.nasseri.fabrics @ hotmail.com>
From: "Nasseri Fabrics Ltd"<recruit.nasseri.fabrics @ live.com>
Subject: ********Work While At Home********
Date: Thu, 4 Jun 2009 00:20:09 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090604043549.0CC36B02DE @ mail.address.bg>
To: undisclosed-recipients:;

WHOIS sender IP 80.255.61.29:
(Courtesy: http://whois.domaintools.com/80.255.61.29)
IP Location:     Nigeria Nigeria Lagos Reassignment To Globalcom Nigeria Customer Nigerai
IP Address:     80.255.61.29
person:       Peter Schubert
address:      25 SAKA TINUBU
              Victoria Island Lagos Nigeria
phone:        +234-805-557-9000
e-mail:       eabajue @ yahoo.co.uk
nic-hdl:      PS4344-RIPE
mnt-by:       AS22351-MNT
source:       RIPE # Filtered
person:       Muyiwa ADELIYI
address:      25 SAKA TINUBU
              Victoria Island Lagos Nigeria
phone:        +234-805-557-1011
e-mail:       mydely02 @ yahoo.com
nic-hdl:      MA3677-RIPE
mnt-by:       AS22351-MNT
source:       RIPE # Filtered

Craigslist - Tianrun Textile Development Co Ltd

Mon, 12 Oct 2009 00:07:41 +0000

You really have to look for it, but it's there. They want someone who can run cc transactions. CC stands for credit card. Feeling oogie yet? You should. We don't recommend responding to ads for part time jobs working at home processing credit card transactions. We suspect that this will lead to someone's money and identity being stolen, if not yours. You don't want to be part of the problem, do you? This may be part of a re-shipping scam, but since we only see mention of credit card transactions, we've filed it accordingly.

As seen on Craigslist:
Part Time Job Offer (Battery Park)

Reply to:johncole0014 @ gmail.com
Date: 2009-06-03, 6:56PM EDT

Tianrun Textile Development Co Ltd, This is a PART TIME position that will consist
of 15-20 hours within Monday - Friday. Looking for a part-time personal assistant.
Flexible hours within normal business hours does not affect your existing job . Must
be computer literate and strong attention to detail. Computer experience (internet),
can run cc transactions, have great phone skills, This position provides an
excellent starting salary and benefits include additional year-end contribution,this
is not a full time position.

Please forward your resume to johncole0014 @ gmail.com for a quick response and
Interview

This is a part-time job.
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1204052714

Craigslist - Check Solutions Inc.

Sun, 11 Oct 2009 23:49:56 +0000

Peter: As you have said numerous times, why would a legitimate company need to tell you
that this is legal?

PhishBucket: Glad you're listening! That's right...when they tell you it's legal, it's usually NOT. This is a job printing fraudulent checks, checks that will be used in money transfer scams JUST LIKE the ones we post here at PhishBucket.

They can't even get their story straight on who to contact. You can either email someone at a pacbell.net account (someone's Internet Service Provider email account) or you can contact someone at a free Gmail account. Some company huh? Best of all, they want to pay you a whopping $500 per hour!

You need to understand that getting involved in activities like this will likely land you in jail. You're forging checks and sending them to people whose money will be stolen from them. That makes you an accomplice. Just try and prove your innocence if you get busted.

As seen on Craigslist:
Printer/Dispatcher Needed.

Reply to:rhrizza @ gmail.com
Date: 2009-06-03, 1:29PM EDT

There are a lot of companies and websites online that print checks and offer
financial printing services but there is no company that prints checks with clients
information legally and dispatch them individually also like we do at Check
Solutions Inc.This is a 2hrs daily Job using Bank compliant Software and check
printer to print checks for clients.The printed checks would then be dispatched
using courier services like UPS to the respective clients.Everything would be done
online from your respective homes after the printing tools are purchased and set
up(This is to be purchased by the applicants and is to be purchased online.Ask for
directions to purchase your tools immediately if interested).You will be orientated
about the usage of the tools to print bank compliant checks for clients and how to
dispatch them properly to get to its destination without paying for shipping.User
would be required to have a yahoo account set up for communication purposes using
the messenger and cell phone text messaging.Contact us at nanbai @ pacbell.net if you
are interested and ready to purchase your tools to commence asap.

Compensation: $1000 for 2hrs daily job.
Telecommuting is ok.
This is a part-time job.
This is a contract job.
This is at a non-profit organization.
This is an internship job
OK to highlight this job opening for persons with disabilities
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1203451909

Craigslist - Henry Duff Collections

Sun, 11 Oct 2009 23:39:45 +0000

If this guy is running his own independent contractor service and needs someone to collect payments, it might sound like he's legitimate. Unfortunately, since his collection process involves electronic and postal services and pays weekly, we think it's a money transfer scam. We also detect an accent when we read the message, making us think it's from overseas.

If it is legitimate, then why use a Yahoo account for replies? Too cheap for a Web site and corporate email address? That's not our idea of a genuine employer. Someone who's really hiring usually doesn't feel the need to disguise their company's identity.

You get a little hint of a company name from the henryduff_collections part of the email address, but if that's all he's got, do you really think it's worth sending everything about yourself? In return for NOTHING? Seems too dangerous if you ask us!

As seen on Craigslist:
VACANCY...

Reply to:henryduff_collections @ yahoo.com
Date: 2009-06-03, 11:49AM EDT

Hello,

I run a small bill collection service as an independent contractor and would like to
expand so I can provide more effective services to my clients. I am looking for a
contact that is willing to work with me and be my link in the collection of bill
payments.

The bill payments will be sent by Electronic payment service or courier services to
you.

This will also broaden your horizons in learning different things.Since the
collection process will be via Electronic Service and Mail Service.I am offering a
weekly pay of $500 for all transactions processed weekly.

For more information as regards The Part-Time Job Offer please contact me.

Very Respectfully

Henry Duff

This is a part-time job.
This is a contract job.
OK to highlight this job opening for persons with disabilities
OK for recruiters to contact this job poster.
Phone calls about this job are ok.
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1203251577

BriCs Forex aka Bricsforex

Tue, 06 Oct 2009 08:04:39 +0000

Well sure, they have a Web site address, but apparently there's no Web site AT the address, so what good is it? We can't find out anything about them on WHOIS because they're hiding behind their registrar.

Despite these roadblocks, we're confident of a few things about this offer:

1. The email originated from Brazil and was sent to someone in the United States.
2. They wrote an extremely unprofessional letter, complete with misspellings.
3. The spelling of their company name is odd, with uppercase letters for no reason.
4. They call it an investment opportunity. Your money will be involved.

We suggest you look elsewhere.

Message text:
Greetings, [removed]

This is the place where you can earn a lot of money with or without any referrals.
You do not have to recrute anyone, neither meet anyone.
You don't have to carry any stock or be constantly travelling.

BriCs Forex can be done part or full time from the comfort of your home.
It is all up to you BriCs Forex is the best investment opportunity around.

For more information visit us at:   http :// www .brics-forex.net

Sincerely, Dirk Vera.
BriCs Forex 2009.

Headers:
X-Originating-IP: [189.72.107.74]
Authentication-Results: mta811.mail.ird.yahoo.com from=bonnygim.com; domainkeys=neutral (no sig); from=bonnygim.com; dkim=neutral (no sig)
Received: from 189.72.107.74 (EHLO autotintas1) (189.72.107.74)
     by mta811.mail.ird.yahoo.com with SMTP; Wed, 03 Jun 2009 05:45:03 -0700
Message-ID: <01c9e42f$f6ae8c80$4a6b48bd @ ggh>
From: "Heath Hebert" <ggh @ bonnygim.com>
To: [removed]
Subject: Go in Bricsforex now
Date: Wed, 3 Jun 2009 09:45:01 -0300
MIME-Version: 1.0
Content-Type: text/plain;
     format=flowed;
     charset="us-ascii";
     reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
X-Spam: Not detected

Clarkson Textiles

Tue, 06 Oct 2009 07:38:41 +0000

The headers on this show that the email went through all kinds of nonsense to get to the recipient, passing through the UK and Taiwan. And of course they want you to reply to their free Gmail address instead of a corporate email address. They don't provide a Web site address. They target residents of the United States and Canada. He claims to be the CEO of a textiles company (how many company presidents do you know who are directly responsible for hiring contractors?).

He wants you to work from home receiving their payments. In this scenario, they claim you will keep 10% as a commission and though it's not spelled out, they're going to ask you to wire transfer the balance. Once again, for the millionth time: FAKE, FAKE, FAKE! The checks are fake, the bank will reverse the funds, and you'll be out twice for the money, which you wired to a scammer overseas, making it next to impossible to get back.

The best part is they ask if you've ever done this before and ask what kind of experience yo had. If you haven't done this before, they'll have fresh new blood (you) to use and abuse, and if you have done this before and had a bad experience, they'll email you and act friendly until they can convince you they're absolutely legal. We just want to point out that real employers don't usually have to defend the legality of their companies.

This will lead to financial theft and probably identity theft too. We recommend you plug your nose and keep on lookin'!

Message text:
Greetings

I am Noel Clarkson,The CEO of CLARKSON TEXTILES. We deal in a wide
range of high performance fabrics for variety of contract market areas,
including health care hosoitality and universities.

We are searching for financial payment contractor (Accounts Receivable)
for our company who are willing to work for us from home and get paid
weekly without leaving their present Job.Our clients shall be making
payments to us for supplies in money orders so you shall help in the
processing of the payments to us here in the UK.

Subject to our satisfaction you will be paid 10% on any transaction you
are involved in. Please if you are interested send the following..

1. Full Name:
2. Full Address (Inclusive City, State and Zipcode)
3. Telephone No
4. Have you done this kind of Online Job in The Past
(Yes/No), If Yes. What was your Experience?

Thanks In advance

CEO
Noel Clarkson.

FOR U.S and Canadian Residents Only

Headers:
Return-Path: <clarksontextile @ gmail.com>
Received: from choosetop.com.tw
(59-125-73-152.HINET-IP.hinet.net[59.125.73.152])
by mx.google.com with ESMTP id
33si1915917pxi.79.2009.06.03.04.19.55;
Wed, 03 Jun 2009 04:19:56 -0700 (PDT)
Received-SPF: neutral (google.com: 59.125.73.152 is neither permitted nor
denied by domain of clarksontextile @ gmail.com) client-ip=59.125.73.152;
Authentication-Results: mx.google.com; spf=neutral (google.com:
59.125.73.152 is neither permitted nor denied by domain of
clarksontextile @ gmail.com) smtp.mail=clarksontextile @ gmail.com
Received: from localhost (localhost.localdomain [127.0.0.1])
by choosetop.com.tw (Postfix) with SMTP id 51094E717AF;
Wed, 3 Jun 2009 18:13:08 +0800 (CST)
Received: from User (unknown [217.33.221.147])
by choosetop.com.tw (Postfix) with ESMTP id D5270E717CA;
Wed, 3 Jun 2009 18:13:00 +0800 (CST)
Reply-To: <clarksontextiles1 @ gmail.com>
From: "Clarkson Textiles"<clarksontextile @ gmail.com>
Subject: Financial Payment Contractor Needed
Date: Wed, 3 Jun 2009 11:07:17 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090603101300.D5270E717CA @ choosetop.com.tw>
To: undisclosed-recipients:;

Spoof: Fulfillment-America Inc.

Tue, 06 Oct 2009 07:14:37 +0000

Okay, if this is real, then what the hell kind of name is "isxhn blv"?

Actually, this appears to be a really bad spoof of a real company (see www.fulfillmentamerica.com). The difference is the person who sent this email is trying to divert you to him/her instead of the real company by asking you to reply to a Gmail account.

It doesn't say in this email what the job entails. We suspect that since they go out of their way to mention that no personal investments are required, it's probably a money transfer/mule scam, using the real company's reputation to sneak past your radar and fool you into believing there's actually a job in it for you.

So it's not a job. Unless you want to call it a big fat snow job.

Message text:
JOB TITLE: Work from home (entry level). Contact us for further details.
EFFECTIVE DATE: As soon as possible
TYPE OF WORK: availability of work from your home,
SCHEDULE: flexible
COMPANY: Fulfillment-America Inc.

Fulfillment-America Inc.
17 Progress Road
Billerica, MA 01821
Phone 866.867.3170
Fax 866.867.3170
Toll free 866.867.3170

IMPORTANT!
YOUR PERSONAL INVESTMENTS ARE NOT REQUIRED TO APPLY FOR THIS POSITION.

JOB OVERVIEW
Founded in 1992, Fulfillment-America has been serving clients from all
the states for over 15 years. Our company has been blessed with
exceptional people and world-class clients. We work hard to understand
the unique needs of every client, and work even harder to provide
innovative solutions to those needs. The result of our effort is an
industry leading full-service fulfillment company that focuses on the
promotion and consumer marketing world. Because of our attention to
detail and vision we are continually defining industry

Headers:
X-Originating-IP: [209.85.222.123]
Authentication-Results: mta515.mail.mud.yahoo.com from=gmail.com; domainkeys=pass
(ok); from=gmail.com; dkim=pass (ok)
Received: from 209.85.222.123 (EHLO mail-pz0-f123.google.com) (209.85.222.123)
     by mta515.mail.mud.yahoo.com with SMTP; Tue, 02 Jun 2009 12:38:26 -0700
Received: by mail-pz0-f123.google.com with SMTP id 29so1015029pzk.12
     for <multiple recipients>; Tue, 02 Jun 2009 12:38:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
     d=gmail.com; s=gamma;
     h=domainkey-signature:mime-version:received:date:message-id:subject
     :from:to:cc:content-type:content-transfer-encoding;
     bh=+5aHq1ysHhopvYfuPjrFe85WSFrMLQsx1MWCelQa+/s=;
     b=lqjikmYB+HEe7DcxhHPVNr1RaGNiBfE4BUIHlApQDF8yFz95HUhZkDX0YIIeLiSBnu
     0flBqPO0MEcNt66h/LKW2hM8FqkJeg7R9OwTcGbkl5kulxQJ7YfP3cyACsNifUSX5FCB
     SM4hGhywAsfWOIPVsMl+4uX+ireDMgOa4cS2U=
DomainKey-Signature: a=rsa-sha1; c=nofws;
     d=gmail.com; s=gamma;
     h=mime-version:date:message-id:subject:from:to:cc:content-type
     :content-transfer-encoding;
     b=DXP0yGsSlA0q+NmOYs0WxDlV0PVIU89aEVad2T2Ud3BdnmFLoJ0eWjpJSryn2uN0hW
     4FMEIGnvtKeTO1Vx9bNLmvufXEFfZOPRQY69vaKfIfIVktFsE15JDWwMGodghn7D8EYD
     zEd6vBlVVUpMUNL/LSMe40nKPr+zjnJp6EJSQ=
MIME-Version: 1.0
Received: by 10.143.13.17 with SMTP id q17mr35055wfi.222.1243971505564; Tue,
     02 Jun 2009 12:38:25 -0700 (PDT)
Date: Tue, 2 Jun 2009 14:38:25 -0500
Subject: Large company is hiring new employees.Fulfillment-America Inc.Massage
     ID 18
From: isxhn blv <olga.gg72836 @ gmail.com>
To: [removed]
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Craigslist - For Students and Sit at Home Moms

Tue, 06 Oct 2009 06:53:04 +0000

We love it when they tell us it's real, because that's usually the first sign it's FAKE.

Craigslist doesn't appear to care how polluted their listings become with job scams, so we really hope you'll learn how to spot some of the clues with these ones.

In this offer, ask yourself these questions:

1. Why do they need to tell you it's real?
2. Why do they use so many exclamation marks?
3. Why are they targeting students and "sit at home" moms?
4. Why do they sound foreign?
5. Why do they list 10% as the compensation?
6. Why do they only want candidates to reply?
7. Why do they only use a craigslist.org address for reply?

We can answer some of these questions...

1. They love reassuring you it's real or legal when it's fake or illegal.
2. They use extra punctuation because they don't know it's unprofessional.
3. They target students and stay-at-home moms because they are vulnerable.
4. Based on the phrase 'sit at home mom,' we think they're from overseas.
5. They are operating a money transfer/mule scam, and want you to cash a fake check, keep 10% as a commission and then wire transfer the balance to them (which will ultimately backfire and cost YOU).
6. It's not a real job. They want victims, not help recruiting.
7. They aren't legitimate; otherwise they'd have a corporate email and web presence.

Are you convinced? We hope so!

As seen on Craigslist:
Make $600 Weekly!!!!! This is Real~~

Reply to:job-nxxw3-1201673835 @ craigslist.org
Date: 2009-06-02, 1:31PM EDT

Are you a student ?

Are you a Sit At Home Moms

Are you Looking for a Part-time Job

Are you looking for a Job....

Send your resume today and we shall contact you as soon as possible.

Compensation: 10%
This is a part-time job.
This is a contract job.
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1201673835

Mystery Company - colbert.burl9133

Sun, 27 Sep 2009 08:46:49 +0000

There was this one paragraph that made us nearly wet our collective pants:

Note: Actions depicted below, are authorized by Our Company, and therefore sustain legitimacy status. Our venerable organization doesn't condone or incite improper or out of border incentives, which may contradict to federal law.

In other words, since their company has authorized these actions, they MUST be legitimate. Um, no.

This is a flat-out money transfer SCAM, riddled with clues. Look at our FAQ and see how many you can spot.

Pat yourself on the back for dodging this bogus offer and have a safe and successful job search!

Message text:
A Job for You!
We thought you would be interested in this job:

Job Information

Job Title: Money Manager Assistant
Req'd Education: Not Specified
Company: Insurance Company
Req'd Experience: Not Specified
Job Location: United States
Base Pay: $ 2,000/month
Employee Type: Part-Time/Home-Based
Bonus: Yes

Work at home Money Manager Assistant
(part-time vacancy; 2000 usd / month):
We value your response back regarding the open vacancy Insurance Company is
offering. We're currently seeking motivated and responsible individuals to attend
the post of a 'Work at home Money Transfer Assitant'. This remote position itself
covers a broad range of directions an individual would have to perform. It's a part
time position, which let's you perform your duties directly from your home location.
In the nearest future, we're planning to achieve the expansion of our company
throughout the United States of America and United Kingdom, providing local offices
and departments in the vast areas, where logistic and insurance services are
definitely in demand. Until then, we're trying to fill in our personnel with new
individuals, which will increase the efficiency of the services we're catering. If
you wish to apply or have any questions regarding the position, feel free to contact
me back either via e-mail. Hope to hear from you soon.

In order to reduce the corporate overhead, we've implemented the thrift solution of
disseminating bases of control over certain regions of the United States of America.
It provides a great opportunity for beginners to participate in the standard
operations of the future subsidiary departments. Besides the expansion project, the
upcoming regional accountants are expected to learn a great deal about different
realms of the insurance market mainly through digesting the experience gained from
the large scale practical assignments.

1) This is part time work at home position and can easily combine this vacancy with
any other work.

2) The fixed salary is 2000 USD a month + 5% instantly from each payment processed
by you.

3) You will receive payments (Direct Bank Deposits and wire transfers) from client
within United States and send it by instant payment sistem such as Western Union.
You will receive 5% of processed amount.

4) You do not spend your own money and there are no startup fees. All charges for
withdrawal or transferring the money will be deducted from the payment.

5) To start work with us you must only have basic checking account at any bank.
Your financial information will never be disclosed to third parties.

6) You can work 2-3 hours per day.

7) This is not insurance sales position and you don't need to sell insurance, this
is Money Transfer Assistant vacancy.

8) Your education and status don't matter.

9) We do not ask any personal information and we run business according to laws of
the United States of America.

Now I will explain the details of this job.

1) An ACH or Wire transfer will be made to your bank account from our client. I'll
let you know it's exact transfer amount and date.

2) You should receive the transfer and send me the confirmation that you've
received it. Then you'll have to cash out this transfer at your bank.

3) Then you'll have to sent the money you took from you bank account via Western
Union. I'll let you know all the necessary information on this transfer(the name
of person who will receive the money and destination city/country).

4) Then you should send an email to me to confirm the Western Union transfer is
sent. This email should include sender's name, name of the city the transfer has
been sent from, exact Western Union transfer amount, and Western Union MTCN (it's
essential for receiving the money).

5) We communicate with our agents mainly by e-mail, but we will also communicate
by phone (if your e-mail is not available). It is your responsibility to check
your e-mail daily and inform us about any change in your contact information.
Supporting communication is your top-priority obligation.

6) The fixed monthly salary which is 2000 usd will be sent to you by direct
deposit after 30 day period from first transfer.

Let's see how it works. For example, 2000 usd have been transferred to your account.
The amount you'll receive for each transfer is 5% from the initial payment to your
bank account. 5% from 2000 usd is 100 usd so you'll have to send 1900 usd via
Western Union. Western Union fee(it's about 100 usd) should be deducted from 1900
usd.

Please ask me with more questions or just let me know you're ready to get started.

We do not need access to your bank accounts. This is information that you can see at
any check and only let us to send ACH and Wire transfers to this accounts.

Note: Actions depicted below, are authorized by Our Company, and therefore sustain
legitimacy status. Our venerable organization doesn't condone or incite improper or
out of border incentives, which may contradict to federal law.

Apply Now
Money Manager Assistant
If you want to apply please send all your questions and contact information at
colbert.burl9133 @ gmail.com . We're looking forward to our further communication.

ID 2727364

Headers:
X-Originating-IP: [65.55.111.89]
Authentication-Results: mta279.mail.mud.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=neutral (no sig)
Received: from 65.55.111.89 (EHLO blu0-omc2-s14.blu0.hotmail.com) (65.55.111.89)
     by mta279.mail.mud.yahoo.com with SMTP; Mon, 01 Jun 2009 03:40:22 -0700
Received: from BLU146-W36 ([65.55.111.71]) by blu0-omc2-s14.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
     Mon, 1 Jun 2009 03:39:12 -0700
Content-Type: multipart/alternative;
     boundary="_6786404a-2715-452e-b3c8-99f9cdf7e961_"
X-Originating-IP: [98.198.56.62]
From: Arun Parks <arunparks1926 @ hotmail.com>
To: [removed]
Subject: Join a perspective company
Date: Mon, 1 Jun 2009 10:39:12 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 01 Jun 2009 10:39:12.0651 (UTC) FILETIME=[33FD9DB0:01C9E2A5]
Content-Length: 5106

Spoof: Petroleos de Venezuela

Sun, 27 Sep 2009 08:21:39 +0000

Let's break this one down for you:

Paragraph 1: They make up some nonsense about where they found your info to snow you into believing it's not a coincidence that this job offer arrived in your Inbox. They claim to be with the state-owned Petroleos de Venezuela (see: http://en.wikipedia.org/wiki/Petr%C3%B3leos_de_Venezuela_S.A.).

Paragraph 2: They say you've been AUTOMATICALLY employed to work with them for an outrageous amount of money. Pardon?

Paragraph 3: They give you a whole lot of narrative about who they are. According to Wikipedia, they are into petroleum and natural gas production, refining and exporting.

Paragraph 4: They want to give you a 2-year contract.

Paragraph 5 and list: They want to ship you and your family off to the UK and serve your every need while you work for them. Sounds awesome, right?

Paragraph 6: If you don't call and start your job in the next 40 days, you will be terminated. Wait, what?

The rest: Nothing special until you get to the interesting paragraph about contacting them if you don't have passport paperwork.

Here's what happens. They claim to want you for this great job overseas in the UK, even though they've never met you. They'll tell you that passport and visa paperwork are required and have you wire funds to get the ball rolling. One thing will lead to another and they'll need more money for more associated costs until they've milked you for what they can. Do you ever make it to the UK? Well, we've never heard a success story with one of these, so you be the judge. Hard to believe the UK has anything to do with it when the sender is in Nigeria, wouldn't you agree?

Message text:
Dear Job Seeker,

We are affiliates of various job recruitment websites and your information which was
retrieved from your initial application online for an international job position
abroad has been reviewed and considered for employment in our company by the Board
Of Trustees of Petroleos de Venezuela (UK) S.A.

You have been officially and automatically employed to work as one of our newly
recruited staff with a monthly income of Twelve Thousand Five Hundred Pounds (12,
500 GBP).

We offer innovative and cost effective ancillary services including public
buildings, bridges, roads, tunnels, airports, housing, water & sewage projects,
waster water treatment plants, power stations, dams, hospitals, sports buildings,
Restoration of Monuments, Irrigation, producing Ready-Mix Concrete, ship
manufacturing, electromechanical works, consultancy, manufacturing and erection of
steel structures and quality performance in accordance with international standards
achieved by a continuously trained and skilled workforce and a fleet of modern
construction and marine equipment.

We are offering you the opportunity to work under a 2 years contract with our
company. Our aim is to improve your intellectual development so that you will have
the potential to build a career in your appointed field and in any other chosen
field of your choice especially if promoted within a period of your first three (3)
months work with our company

As a newly recruited staff of Petroleos de Venezuela (UK) SA, you are entitled to
gain from the listed free service provisions of the company as listed below;

. Quality single or family housing in company community/staff quarters.
. Personal effects shipment and excess baggage allowances.
. Access to some of the finest social and recreational facilities in UK.
. Free medical care in Petroleos de Venezuela (UK) SA Clinic for you and your family
for contract duration.
. Company Suits and free dry cleaning
. Excellent educational assistance benefits with family status.
. Complete meals also for you and your family as deemed appropriate.
. Life insurance Policy.
. Maximum and efficient security both in work place and housing Community.

This is your call up letter to resume work immediately and you are to resume work
presently in PDVSA Old Park Lane Office within a period of 40 days or this contract
will be terminated.

For proper re-confirmation and verification of your employment, kindly acknowledge
the content of this message by sending us the information below.

QUESTIONS;

ANSWERS; (write NIL for questions you dont have answer).

1.State your full name and present location.
2. Your education experience
3. Your job interest and department
4. Salary expected per month (In Pounds)

Please note that your location will determine if there might be any verbal Interview
as this may serve as the part of your final recruitment assessment based on the
acclaimed qualifications and position on your resume.

Important Notice: If you do not have residence visa documents to United Kingdom,
kindly indicate when contacting us for negotiation concerning other formalities
needed to be undergone by you before your visit to Petroleos de Venezuela (UK) S.A.

Management

Petroleos de Venezuela (UK) SA. 7, Old Park Lane, London, W1K 1QR
Company Type Government-owned
Incorporated: 1976
Employees: 44,203
Sales: US$9.5 billion

Headers:
X-Originating-IP: [212.216.176.110]
Authentication-Results: mta129.mail.re1.yahoo.com from=pdvsa.com; domainkeys=neutral (no sig); from=pdvsa.com; dkim=neutral (no sig)
Received: from 212.216.176.110 (EHLO vsmtpvtin2.tin.it) (212.216.176.110)
     by mta129.mail.re1.yahoo.com with SMTP; Sun, 31 May 2009 23:56:51 -0700
Received: from User (41.217.2.7) by vsmtpvtin2.tin.it (8.0.025) (authenticated as sending4 @ virgilio.it)
     id 4A21CDBF001C2F8D; Mon, 1 Jun 2009 08:52:18 +0200
Reply-To: <pdvsa-hr-dept @ administrativos.com>
From: "Petroleos de Venezuela (UK) SA"<new-employee-recruitment-dept @ pdvsa.com>
Subject: Your Employment Letter: Petroleos de Venezuela (UK) SA
Date: Sun, 31 May 2009 23:54:50 -0700
MIME-Version: 1.0
Content-Type: multipart/related;
     boundary="----=_NextPart_000_00B2_01C2A9A6.2AE3F1D2"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 14598

WHOIS sender IP 41.217.2.7:
(Courtesy: http://whois.domaintools.com/41.217.2.7)
IP Location:     Nigeria Nigeria Zoom Mobile Nigeria Ltd
IP Address:     41.217.2.7
inetnum:        41.217.0.0 - 41.217.127.255
netname:        ZOOMNIGERIA
descr:          ZOOM Mobile Nigeria Ltd
country:        NG
admin-c:        JA7-AFRINIC
tech-c:         JA7-AFRINIC
org:            ORG-ZMNL1-AFRINIC
status:         ALLOCATED PA
mnt-by:         AFRINIC-HM-MNT
mnt-lower:      ZOOMNIGERIA-MNT
mnt-domains:    ZOOMNIGERIA-MNT
source:         AFRINIC # Filtered
parent:         41.0.0.0 - 41.255.255.255
organisation:   ORG-ZMNL1-AFRINIC
org-name:       ZOOM Mobile Nigeria Ltd
org-type:       LIR
country:        NG
address:        8A, Adeola Odeku Street
address:        City: Victoria Island, Lagos
address:        Postal Code: 999999*
address:        Lagos
e-mail:         john.adamu @ zoomnigeria.com
phone:          +234-1-4073777
admin-c:        JA7-AFRINIC
tech-c:         JA7-AFRINIC
mnt-ref:        AFRINIC-HM-MNT
mnt-ref:        ZOOMNIGERIA-MNT
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered
person:         J Adamu
address:        8A Adeola Odeku Street Victoria Island Lagos
phone:          +23414073777
e-mail:         john.adamu @ zoomnigeria.com
nic-hdl:        JA7-AFRINIC
source:         AFRINIC # Filtered

Zerock Company

Sun, 27 Sep 2009 08:00:08 +0000

These guys aren't afraid to tell you they're from Nigeria. They have the nerve to send a PDF attachment. You should never open attachments from strangers, but you know that already (we hope), right?

You also shouldn't send your resume and personal info to a potential employer who has the gall to use a Gmail or other free Web email account. It should be an immediate red flag. Employers and recruiters aren't ashamed or discouraged from using their corporate email accounts to do such business as HIRING.

In this case, strangers are sending you an email, possibly knowing you're out of work or looking based on where they got your email address, and are hoping you'll respond out of desperation, because they know how hard it is for people to find work right now.

Please don't be a victim!

Message text:
PLEASE CAREFULLY READ THE ATTACHMENT AND CONTACT US IMMEDIATELY FOR
SCREENING AND INTERVIEW.

SPECIFY YOUR FIELD OF QUALIFICATION AND CONTACT AS SOON AS POSSIBLE.

IN CASE OF ANY QUESTIONS FEEL FREE TO CONTACT OUR EMPLOYMENT CARE LINE.

ALL RESUME SHOULD BE MAILED TO zerocknigeria @ gmail.com

THANKS
PAUL WILLIAMS
ZEROCK COMPANY

Attachment: JOB OFFER.pdf

Headers:
Received: from mail-pz0-f116.google.com ([209.85.222.116])
     by [removed] with SMTP id 0906010316_[removed]_837510_7793731;
     Mon, 01 Jun 2009 03:17:03 -0700 EST
Received: by pzk14 with SMTP id 14so326153pzk.1
     for [removed]; Mon, 01 Jun 2009 03:15:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
     d=gmail.com; s=gamma;
     h=domainkey-signature:mime-version:received:date:message-id:subject
     :from:to:content-type;
     bh=9DUdkKNb1PmFw+soU2M0s59T3rfZpZj0cAXER7t/tro=;
     b=CaC+lnAil4Xw4Pu9EzFAVd9JV381iFgkOD67LxlzhnXp5hAnYB7Tsh+f3fOtpcq3h2
     HgbFekgDEEsVqU/5zElN0SHR/kPdCp02Ks/fBwZoEFPkyS7AVAq8RvGtF+vplZr9DImj
     JPafK3jsjGHAKqLkH5D/s36J+3aRsKmNia6Os=
DomainKey-Signature: a=rsa-sha1; c=nofws;
     d=gmail.com; s=gamma;
     h=mime-version:date:message-id:subject:from:to:content-type;
     b=c+5NsdFv6djLv6+JAAXUMa6s80R0rl/ksUuA5IeyxazDdJYqZD0mBbNmfBLwQ1kr/p
     s887NRJyz7kG60fV/3K9XPFblZJsuLzAQQQt0WvG1W6RXUBxKKIhg10O5nW7dBG4eKzZ
     eFeUF3Jxw33xelgdGJgE5RR2OY5wzpP6Yc2ms=
MIME-Version: 1.0
Received: by 10.142.144.16 with SMTP id r16mr1822846wfd.349.1243850904020;
     Mon, 01 Jun 2009 03:08:24 -0700 (PDT)
Date: Mon, 1 Jun 2009 03:08:23 -0700
Message-ID: <300367d70906010308g7775443n34b297e17bfeb700 @ mail.gmail.com>
Subject: JOB OFFER
From: ZEROCK COMPANY NIGERIA <zerockcompany102 @ gmail.com>
To: [removed]
Content-Type: multipart/mixed; boundary=000e0cd3274649ad19046b469b54

Campbell Gallery aka Cromwell Gallery of Arts & Craft Limited

Sun, 27 Sep 2009 07:48:16 +0000

Unfortunately this scammer screwed it all up. Posting a bogus job listing at Craigslist.org, he started to claim he was from Campbell Gallery of Arts & Craft Limited (nice lack of plural there, buddy), but then bungled it by mixing in Cromwell Gallery of Arts & Craft Limited.

They present the typical money transfer/mule duties, which ultimately result in you losing twice the money you attempted to handle for them and losing your identity along with it. They ask you a bunch of stupid questions that include discriminatory questions like marital status, gender and nationality. They are basicaly a bunch of morons looking for a bunch of morons to rip off, but are too stupid to even post a convincing bogus job, what with the mixed up company names.

DUH.

As seen on Craigslist:
CAMPBELL GALLERY OF ARTS & CRAFT LIMITED Offer you a part time work (Battery Park)

Reply to:job-e6hft-1198005562 @ craigslist.org
Date: 2009-05-31, 11:38AM EDT

CAMPBELL GALLERY OF ARTS & CRAFT LIMITED
P.O Box 750, Manchester,
UK, M11 2BX.

Dear Sir/Madam,

My name is Chris Campbell. I am an artist with my wife Mrs Lori B.Campbell. We own
the Campbell GALLERY OF ARTS & CRAFT LIMITED in the UK. Our company deals in sales
of Arts, Crafts works and just recently in the exportation of African Arts and
Fashion. We have been receiving orders from NORTHERN AMERICA, AUSTRALIA and some
other countries in the
world, which we have not been able to process completely since we do not have a
payment receiving personnel in those Areas. We have decided to recruit payment
officers online, hence, we are looking and we need a representative to process our
payments in these areas - due to delays in processing payments e.g (checks and money
order) that comes from countries in the UK banks. Cromwell GALLERY OF ARTS & CRAFT
LIMITED needs a book-keeper in the USA, ASIA and EUROPEANS countries, so we
want to know if you will like to work online from home, getting paid weekly without
leaving or it affecting your present job?

OUR SERVICES

FLEXIBLE PROGRAM:

Two hours per day at your own choice, daytime OR evening time.

WORK AT HOME:

checking e-mail and going to the bank (Part time or full
time)Professional contact team with very good support and
communication skills.

OTHER HIGHLIGHTS:

No selling involved, no kit to buy, we don't charge you anything

MONTHLY SALARY:

$2000 per month.

COMMISSION:

10% of every payment you processed. Money order / Check that is cashed
instantly. is what you get from the total cashed amount. (EXAMPLE) If
you receive a check of $10, 000.00 your net income is $1000.00. You
will process at least 2-3 orders per day and you will earn more than
$200.00 cash in hand each day.

IMPORTANT:

You must be 18 years of age and above.

NOTE:

The higher the payment u processed the higher your net income

CROMWELL GALLERY OF ARTS & CRAFT LIMITED
Gallery Road, Dulwich Village,
London SE21 7AD
Rc:122132
United Kingdom.

EMPLOYMENT FORM

FIRST NAME .............................
MIDDLE NAME.........................
SURNAME....................................
ADDRESS....................................
CITY..............................................
STATE............................................
ZIP CODE....................................
COUNTRY.....................................
PHONE NUMBER (S)
(FIXED)........................................
(MOBILE).....................................
FAX NUMBER...........................
E-MAIL.........................................
GENDER...................................... (discrimination)
MARITAL STATUS..................... (discrimination)
OCCUPATION.............................. (none of their business)
AGE............................................... (could be discrimination)
NATIONALITY............................. (discrimination)
ID NUMBER ( optional).................................

Thanks as we await your response.Endeavor to send your response to
(mariajablob @ live.com)

Regards

Chris Campbell
CAMPBELL GALLERY OF ARTS & CRAFT LIMITED
P.O Box 750, Manchester,
UK, M11 2BX.

Compensation: Good %
This is a part-time job.
OK to highlight this job opening for persons with disabilities
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1198005562

Byzantine Art Co.

Sun, 27 Sep 2009 07:29:51 +0000

Sooner or later we hope the folks in China start getting pissed off that Nigerians are pretending to own companies over there in order to victimize English-speaking countries like the United States, UK and Canada. When you stop and think about it, it's kind of a form of terrorism. But it's the quiet kind that hardly anyone talks about, because it terrorizes individuals who become scared or humiliated to come forward.

The really crappy part about this offer is that not only do they want to steal your money and probably your identity too, but they want you to use your home equity line of credit to interact with them. Which means they plan on sending you LARGE fake checks to try to get you to wire large amounts of that line of credit to them. What'll happen is those NSFs will be deducted from your account after the fact. Essentially you lose the money twice -- once when you send it to the scammer and then again when your bank reverses the nonexistent funds.

We especially love how they tell you it's not related to money laundering and does not involve drug money. How many legitimate employers do you know who feel the need to mention that? ZERO, that's how many!

At the very least, remember this: genuine employers NEVER ask their employees to use their own bank accounts to manage company funds. EVER. Ask anyone.

Message text:
Dear Friend,

My name is Hu Chengzhong and i am an artist and the ownerof BYZANTINE ART
CO;LTD in China. I sell my products to my customers in U.S.A,Canada and Uk
which i find it very difficult in recieving my payments from them in the
past as they have requested to pay through a direct wire transfer into a
home equity line of credit account. I have had a lot of experiences in the
past when they were paying through checks and money orders.

I have resolved these issues with them that they cannot make payments via
checks and money orders any longer. We now accepted that all payments should
be made by swift wire transfer into a home equity line of credit account in
the United Sates. They requested all payments to be made into "A Home Equity
Line of Credit Account".Why they requested for such account is that the
funds will be more secured into such account and the IRS will never question
any amount of money coming in or going out of the account. I need you to be
my representative in the United States if you own such account. I will offer
you 5% of any of my payment that passed through your home equity line of
credit account. You will never invest any money at the course of this
transaction.

This transaction is 100% legal and does not relate to money laundering and
is free from Drug money. The amount of money depends on the volume of
facilities sold which ranges from $500,000.00 and above depending on the
limit of your account. I will detail you as soon as i hear from you.I will
forward a copy of my identification to you as we progress with this
transaction. Please do not forget to provide your direct telephone number so
i can also give you a call.

Email:huchengzhong1 @ yahoo.com.cn

NOTE: YOU WILL NOT PAY OUT ANY MONEY FROM YOUR POCKET TILL THE END OF THE
TRANSACTION

Best regards

Hu Chengzhong
byzantine art Company Ltd
11th Floor,byzantine
Mansion qingchun
road 164 hangzhou zhejiang
China

Headers:
Return-Path: <hu.cheng1520 @ yahoo.com.cn>
Received: from rhino.daileyenterprises.com ([216.40.230.5])
        by mx.google.com with ESMTP id
42si5201593qyk.120.2009.05.31.04.48.19;
        Sun, 31 May 2009 04:48:19 -0700 (PDT)
Received-SPF: neutral (google.com: 216.40.230.5 is neither permitted nor
denied by domain of hu.cheng1520 @ yahoo.com.cn) client-ip=216.40.230.5;
Authentication-Results: mx.google.com; spf=neutral (google.com: 216.40.230.5
is neither permitted nor denied by domain of hu.cheng1520 @ yahoo.com.cn)
smtp.mail=hu.cheng1520 @ yahoo.com.cn
Message-Id: <4a226e83.aa53f10a.2116.0621SMTPIN_ADDED @ mx.google.com>
Received: (qmail 17519 invoked from network); 28 May 2009 17:08:00 -0500
Received: from unknown (HELO User) (82.128.33.61)
by 216.40.230.116 with SMTP; 28 May 2009 17:08:00 -0500
Reply-To: <huchengzhong1 @ yahoo.com.cn>
From: "Hu Chengzhong"<hu.cheng1520 @ yahoo.com.cn>
Subject: Employment Offer!
Date: Fri, 29 May 2009 05:42:47 +0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 090527-0, 05/27/2009), Outbound message
X-Antivirus-Status: Clean

WHOIS sender IP 82.128.33.61:
(Courtesy: http://whois.domaintools.com/82.128.33.61)
IP Location:     Nigeria Nigeria Lagos Cdma 1x/evdo Dial Up Pool
IP Address:     82.128.33.61
inetnum:        82.128.32.0 - 82.128.63.255
netname:        INET-MLTL
descr:          CDMA 1x/EVDO Dial up pool
country:        NG
admin-c:        RIA27
tech-c:         RIA27
status:         ASSIGNED PA
mnt-by:         MLTL-INT-MNT
mnt-lower:      MLTL-INT-MNT
changed:        deep @ multi-links.com 20081021
parent:         82.128.0.0 - 82.128.127.255
person:       IP Admin-RIPE
address:      Multilinks Telecommunications Limited
address:      231 Adeola Odeku Str.
address:      Victoria Island, Lagos, Nigeria
e-mail:       ipadmin @ multilinks.com
remarks:      complaints/spam report : abuse @ multilinks.com
phone:        +2341774000
nic-hdl:      RIA27
changed:      techadmin @ multilinks.com 20040331
changed:      hostmaster @ afrinic.net 20050205
remarks:      data has been transferred from RIPE Whois Database 20050221

H & S International Limited

Sat, 26 Sep 2009 20:48:51 +0000

Several things should be setting off your radar when you read this offer:

1. Why is a Latvian textile company contacting you, a complete stranger, out of the blue?
2. Why do they have problems collecting their payments when legitimate companies overseas have no such problem?
3. Why are they evading tax laws in their country?
4. Why would a legitimate company want you to use your personal bank account to handle their accounts receivable?
5. How can you possibly make $3000-$4000 per month at a part time job?
6. Why do they demonstrate discriminatory practices by asking your sex and marital status (complete with typo)?
7. Why do they have to reassure you that everything's legal?

Bottom line, folks: it's fraudulent. It's illegal. They're bogus. And stupid.

Message text:
Dear Sir/Madam,
         H & S International Limited is a Latvian textile company.We
produce and distribute clothing materials such as
batiks,assorted fabrics and traditional costume worldwide.We have reached
big sales volume of textile materials in the
Europe and now are trying to penetrate the US market.Quite soon,we will open
representative offices or authorized sales
centers in the US and therefore we are currently looking for people who will
assist us in establishing a new distribution
network over there.The fact is that despite the US market is new for us we
already have regular clients also speaks for itself.

                    WHAT YOU NEED TO DO FOR US.
But we have a problem thats setting us back.We have some problem collecting
our payments from our US clients.The
international money transfer tax for legal entities(companies) in Latvia is
25%,whereas for the individual,it is only 7%.There is no
sense for us to work this way, while tax for international money transfer
made by a private individual is 7%.That's why we need you!
We need agents to receive payment for our textiles( in money orders,cheque
or bank wire transfers) from our clients in the US
and to resend the money to us via Money Gram or Western Union Money
Transfer.This way we will save money because of tax decreasing.

                   JOB DESCRIPTION
1. Recieve payment from Clients.
2. Cash Payments at your Bank.
3. Deduct 10% which will be your percentage/pay on Payment processed.
4. Forward balance afer deduction of percentage/pay to any of the
offices you will be contacted to send payment to(Payment is to be
forwarded either by Money Gram or Western Union Money Transfer).

                  HOW MUCH WILL YOU EARN?
10% from each operation! For instance: you receive 7000 USD via cheques or
money orders on our behalf.You will cash the money and keep
$700 (10% of $7000) for yourself! At the beginning your commission will
equal 10%,though later it will increase up to 12%!

                      ADVANTAGES.
You do not have to go out as you will work as an independent contractor
right from your home or office.Your job is absolutely
legal.You can earn up to $3000-4000 monthly depending on time you will spend
for this job.You do not need any capital to start.
You can do the Work easily without leaving or affecting your present Job.
        The employees who make efforts and work hard have a strong
possibility to become managers.Anyway our employees never leave us.

                        MAIN REQUIREMENTS.
(1).18 years or older legally capable,responsible and ready to work 3-4
hours per week.
(2).You must have PC knowledge,e-mail and internet experience (minimal).
       And please know that Everything is absolutely legal, that's why you
have to fill a contract!
    If you are interested in our offer,please respond with the following
details in order for us to reach you
NAME:.................................
CONTACT ADDRESS:......................
CITY..................................
STATE.................................
ZIPCODE...............................
COUNTRY...............................
PHONE NUMBERS.........................
EMAIL ADDRESS.........................
AGE:..................................
SEX:..................................
MARRITAL STATUS:......................

      Thanks for your anticipated action.And we hope to hear from you soon.
Yours faithfully,
Steve Yerrell
yerrell.steve @ ymail.com
yerrelly8899 @ aol.co.uk
for h&s international.

Headers:
Return-Path: <yerrell.steve @ live.co.uk>
Received: from lyonsdendesign.com (s116.n20.vds2000.com [66.84.20.116])
        by mx.google.com with ESMTP id
41si3300062pxi.148.2009.05.31.13.59.10;
        Sun, 31 May 2009 13:59:10 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning
yerrell.steve @ live.co.uk does not designate 66.84.20.116 as permitted
sender) client-ip=66.84.20.116;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of
transitioning yerrell.steve @ live.co.uk does not designate 66.84.20.116 as
permitted sender) smtp.mail=yerrell.steve @ live.co.uk
Received: from User (host.kiodk3k3.com [67.227.158.241] (may be forged))
(authenticated bits=0)
by lyonsdendesign.com (8.13.1/8.13.1) with ESMTP id n4VKtNlS031364;
Sun, 31 May 2009 16:55:24 -0400
Message-Id: <200905312055.n4VKtNlS031364 @ lyonsdendesign.com>
X-Orig: host.kiodk3k3.com [67.227.158.241] (may be forged)
X-Authentication-Warning: lyonsdendesign.com: lyonsden owned process doing -bs
Reply-To: <yerrell.steve @ ymail.com>, yerrelly8899 @ aol.co.uk
From: "steve Yerrell"<yerrell.steve @ live.co.uk>
Subject: NEW JOB OPENING OFFER
Date: Sun, 31 May 2009 16:56:16 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Craigslist - Spoof: Sherwin Williams

Sat, 26 Sep 2009 20:32:52 +0000

Peter: I don't understand the description, but don't you think that the scammer can come up
with an original name?

PhishBucket: We wonder how the REAL Sherwin Williams will feel about this. For those who don't know, Sherwin Williams is a store that sells PAINT. Looks like another company is getting victimized by bad guys. We're calling it a money transfer/mule scam, since they need people to 'play a part' in this little scheme.

As seen on Craigslist:
customer service

Reply to:sherwinwilliams @ sify.com
Date: 2009-05-31, 12:06PM EDT

we will be continually looking for more effective ways to increase customer
attendance at the markets but we need you to play your part as well. E-mail Us back
: sherwinwilliams @ sify.com

Telecommuting is ok.
This is a part-time job.
OK to highlight this job opening for persons with disabilities
Principals only. Recruiters, please don't contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.
PostingID: 1198045744