Sponsored by..

Sunday, 11 July 2010

hiring-westunion.com scam email

This scam email is recruiting people for money laundering and other criminal activities using the fraudulent domain hiring-westunion.com:

From: Molly Leary
Date: 11 July 2010 01:23
subject: Open Positions

Greetings


I’m addressing you on behalf of the HR department of a large company. Our company covers a wide range of businesses:
- real estate
– accounts opening
– undertaking services
– etc.

We need a person to fill the vacancy of a regional manager in Europe:
- salary 2.400 euro + bonus
- 2–3 working hours per day
- flexible work time


If you are ready to work as a regional manager in Europe send us the below information on email:
c v @ h i r i n g - w e s t u n i o n . c o m [please delete spaces before sending]
Full name:
Country:
E-mail:
Mobile phone-number:



Note! We are searching Europeans only!

Please, write your name and Telephone Number so that our manager could contact you and conduct an interview. 
This domain attempts to pass itself off as the legitimate Western Union company, it was registered a few days ago to what appears to be a real address but is almost definitely fake too:

Domain name: hiring-westunion.com

Registrant Contact:
   PBsoft, inc
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Administrative Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Technical Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Billing Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

DNS:
ns1.pegas-dns.org
ns2.pegas-dns.org

Created: 2010-06-22
Expires: 2011-06-22

The registrar is the scammer's favourite, BIZCN.com of China. The web server and mail is hosted on 178.162.135.108 on PegasHosting Network in the Ukraine. Email originated from 201.246.77.170, an ADSL subscriber in Chile.

This is not a real job, anything that they offer is likely to be some sort of criminal activity such as money laundering, parcel reshipping and other fraudulent back office functions.

Update 19/7/10: the spam is being sent out again, now hosted on 79.119.213.2 in Romania along with  Westunionhiring.com - if you get this, send an abuse complain to the host at abuse -at- rcs-rds.ro
Posted by at
Labels: , , , , ,

3 comments:

Мартинката said...

Slightly different version:

Return-path:
Envelope-to: me@mydomain.com
Delivery-date: Wed, 14 Jul 2010 20:22:25 +0000
Received: from [189.13.73.138] (helo=20158243007.user.veloxzone.com.br)
by mbox.freehostia.com with esmtp (Exim 4.63)
(envelope-from )
id 1OZ8TI-0005wO-Ky
for me@mydomain.com; Wed, 14 Jul 2010 20:22:25 +0000
Received: from 189.13.73.138 by mx1.e-mailscanner.com; Wed, 14 Jul 2010 17:21:47 -0300
Message-ID: <000d01cb2392$2f10d220$6400a8c0@cylindersrxr1>
From: "Kaplan1966"
To:
Subject: part-time employment
Date: Wed, 14 Jul 2010 17:21:47 -0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01CB2392.2F10D220"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0007_01CB2392.2F10D220
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Civilities

I am a manager of the HR department of a large multinational company. Our =
enterprise is connected with a great number of various activities, like:
- supporting business in Europe and other countries=96 bank accounts openin=
g and maintenance =96 private undertaking services=96 etc=2E


Currently, we are looking for managers in Europe:
- salary 2.400 dollars + bonus
- 2=963 working hours per day
- flextime

If you have a wish to become a part of our team, please inform us the follo=
wing on email:h r m @ h i r i n g - w e s t u n i o n . c o m [please delet=
e spaces before sending]
Full name:Country:E-mail:Mobile phone-number:



Attention! We need European residents only=2E


Please, write your name and Telephone Number so that our manager could cont=
act you, ask the necessary questions and answer yours=2E
------=_NextPart_000_0007_01CB2392.2F10D220
Content-Type: text/html;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


Civilities




I am a manager of the HR department of a large multinational company. Our =
enterprise is connected with a great number of various activities, like:
- supporting business in Europe and other countries
=96 bank accounts op=
ening and maintenance
=96 private undertaking services
=96 etc=2E





Currently, we are looking for managers in Europe:

- salary 2.400 dollars + bonus

- 2=963 working hours per day

- flextime




If you have a wish to become a part of our team, please inform us the follo=
wing on email:
h r m @ h i r i n g - w e s t u n i o n . c o m [please d=
elete spaces before sending]

Full name:
Country:
E-mail:
Mobile phone-number:







Attention! We need European residents only.




Please, write your name and Telephone Number so that our manager could cont=
act you, ask the necessary questions and answer yours=2E


------=_NextPart_000_0007_01CB2392.2F10D220--

15 July 2010 at 18:59
Unknown said...

...and another source?

Return-path:
Envelope-to: xxxx@xxxx.xxx
Delivery-date: Tue, 20 Jul 2010 02:35:50 -0400
Received: from [119.226.4.114] (helo=segment-119-226.sify.net)
by server2.namecheaphosting.com with esmtp (Exim 4.69)
(envelope-from )
id 1Ob6QZ-0007Df-6z
for xxx@xxxx.xxx; Tue, 20 Jul 2010 02:35:49 -0400
Received: from 119.226.4.114 by mail-fwd.wh.ocn.ne.jp; Tue, 20 Jul 2010 12:04:44 +0530
Message-ID: <000d01cb27d5$a422ea20$6400a8c0@pimentost5>
From: "Lanny Timmons"
To:
Subject: Representatives Wanted
Date: Tue, 20 Jul 2010 12:04:44 +0530
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01CB27D5.A422EA20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Spam-Status: No, score=3.8
X-Spam-Score: 38
X-Spam-Bar: +++
X-Spam-Flag: NO

This is a multi-part message in MIME format.

------=_NextPart_000_0007_01CB27D5.A422EA20
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
etc....

20 July 2010 at 09:24
Unknown said...

Return-Path:
Received: from silver.nbs.no ([unix socket])
by silver (Cyrus v2.2.3) with LMTP; Mon, 19 Jul 2010 07:32:42 +0200
X-Sieve: CMU Sieve 2.2
Received: from localhost (localhost [127.0.0.1])
by silver.nbs.no (Postfix) with ESMTP id 1B33825D187
for <****@****.***>; Mon, 19 Jul 2010 07:32:42 +0200 (CEST)
X-Virus-Scanned: by amavisd-new at nbs.no
Received: from silver.nbs.no ([127.0.0.1])
by localhost (silver.nbs.no [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id RcLiBWdYUaHg for <****@****.***>;
Mon, 19 Jul 2010 07:32:41 +0200 (CEST)
Received: from lead.logiq.no (lead.logiq.no [195.1.19.12])
by silver.nbs.no (Postfix) with ESMTP id 69F1D258A77
for ; Mon, 19 Jul 2010 07:32:41 +0200 (CEST)
Received: from lead.logiq.no (127.0.0.1) by lead.logiq.no (MlfMTA v3.2r9) id h8fhni0171sp for <****@****.***>; Mon, 19 Jul 2010 07:32:41 +0200 (envelope-from )
Received: from KIEGOTIXAJ ([84.114.249.104])
by lead.logiq.no (nbsMX)
with ESMTP; Mon, 19 Jul 2010 07:32:41 +0200
Received: from 84.114.249.104 by server501.appriver.com; Mon, 19 Jul 2010 07:32:37 +0100
Message-ID: <000d01cb2703$cc84ee00$6400a8c0@grandstandingrjh>
From: "Beulah.Dill"
To: <***@***.***>
Subject: Hiring
Date: Mon, 19 Jul 2010 07:32:37 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01CB2703.CC84EE00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Mlf-KeyWords: residents,bonus,filled,countries,vacancies,country,hiring,compliments,delete,dep
X-Mlf-Language-Detected: NoLanguageFilter_english
X-Mlf-Connecting-IP: 84.114.249.104
X-Mlf-Country-Code: AT
X-Mlf-Threat: nothreat
X-Mlf-Threat-Detailed: nothreat;none;none;none
X-Mlf-UniqueId: i201007190532400087811

23 July 2010 at 12:52

Post a Comment

Subscribe to: Post Comments (Atom)