From: [victim]
Date: 2 July 2012 20:48:51 GMT+01:00
To: [victim]
Subject: Recruitment in the large company
We have an excellent opportunity for an apprentice applicant to join a rapidly expanding company.
An at home Key Account Manager Position (Ref: 58020-095/1HR) is a great opportunity for stay at home parents or anyone who wants to work in the comfort of their own home.
This is a genuine offer and not to be confused with scams!
The successful candidate must have the ability to handle calls efficiently whilst maintaining the highest levels of customer service and being courteous.
Applicants must have an excellent telephone manner, have a friendly approach, excellent communication skills and be computer literate.
You must have the ability to type and talk at the same time to customers,
as you will be taking customer details over the phone and inputting data onto company database.
Requirements: computer with Internet access, valid email address, good typing skills.
If you fit the above description and meet the requirements, please apply to this ad stating your location.
You will be processing orders from your computer. How much you earn is up to you.
The average is in the region of US$600- US$750.00 per week, depending on whether you work full or part time.
If you would like more information, please contact us stating where you are located and our job reference number - 58020-095/1HR.
Please only SERIOUS applicants.
Our contacts: Olin@careerin-finance.com
Thank You!
The email may appear to come from the recipient (see "why am I sending myself spam?". The domain careerin-finance.com was registered on 2nd July 2012 and solicits replies via a server at 37.247.48.176 (Prometeus, Italy).
Registrant details for the domain are no doubt fake:
Helen R. Espinoza
Helen Espinoza info@careerin-finance.com
413-845-0684 fax: 413-845-0331
3093 Trouser Leg Road
Springfield MA 01103
us
Helen Espinoza info@careerin-finance.com
413-845-0684 fax: 413-845-0331
3093 Trouser Leg Road
Springfield MA 01103
us
The domain is registered through scam-friendly Chinese registrar BIZCN.COM, Inc.
Nameservers are:
ns1.readycarts.com (37.247.48.176)
ns2.readycarts.com (12.199.102.98)
The 12.199.102.98 is registered to Barnes and Noble in the US. Is there a compromised server here? It's hard to be certain.
The following IPs and domains all seem to be connected:
12.199.102.98
24.217.45.10
37.247.48.176
62.108.39.201
agentrachel.net
americafindjob.com
jobbinthai.com
latviafindjob.com
readycarts.com
4 comments:
I'm getting a lot of these spam messages on my private mail server. It appears to be a botnet operation since they're coming from a lot of different IPs.
One thing they all have in common is an email address at the bottom in the form of:
"Our contacts: @careerin-finance.com"
For being a fairly sophisticated spamming campaign, you'd think they would at least cycle through a few different domain names for their contact email.
I'm IT for a company whose entire staff has received these same emails. Does your company host it's own email server?
been seeing this pop up on many of our exchange servers in the past week - anyone with an idea of when Spamhaus or the others will catch up?
Shawn, are you still seeing these emails on your servers?
Post a Comment