RSS

Tag Archives: Secret Shopper

“Secret Shopper®” a.k.a “James Richards”

JOB SCAM / MYSTERY “SECRET” SHOPPER SCAM

secret_shopper_scam

 

JOB APPLICATION: MYSTERY SHOPPER
From: “Secret Shopper®” <secretshop@info.net> Reply-Address: secretshopsinc@gmail.com

Dear Shopper,

Mystery shopping or a mystery consumer is a tool used externally by market research companies or watchdog organizations or internally by companies themselves to measure quality of service or compliance to regulation, or to gather specific information about products and services. The mystery consumer’s specific identity is generally not known by the establishment being evaluated. Mystery Shopping is a great way to start making money online or from home. Mystery shoppers or secret shoppers are hired to pose as customers and to anonymously evaluate the service they receive from a given business or an organization.

Mystery shoppers normally get paid between $200 per assignment. They are expected to complete their mystery shopping assignment and fill out an evaluation form, answering questions about their shopping experience in the establishment, the quality of customer service, etc. To start earning money immediately, reply this email with the following information below to sign up:

Personal Information:

FULL NAME: (As Should Appear on Payment )
STREET ADDRESS:(Not PO BOX)
CITY:
STATE:
ZIP/POSTAL CODE:
PHONE NUMBER CELL AND HOME:
EMAIL:
AGE:
SEX:
OCCUPATION:
YOUR PREFERRED MODE OF COMMUNICATION EITHER BY PHONE OR BY EMAIL:

As a “Detective Shopper” you will work and shop together for pleasure and you only work 2-3 hours twice in a week.

We are waiting your good response, Thank you.

Regards,
James Richards
MH-Recruitment
Secret Shopper® 2013.

Return-Path: secretshop@info.net
X-YahooFilteredBulk: 208.79.154.39
X-Originating-IP: [208.79.154.39]
Authentication-Results: mta1490.mail.gq1.yahoo.com
Received: from 127.0.0.1 (EHLO secure.mtplex.com) (208.79.154.39) by mta1490.mail.gq1.yahoo.com with SMTP; Fri, 17 May 2013 23:54:42 +0000
Received: from 84.111.srvc.fr ([109.74.84.111]:21318 helo=User) by secure.mtplex.com with esmtpa (Exim 4.80) (envelope-from <secretshop@info.net>) id 1UciiL-00046n-Jo; Wed, 15 May 2013 16:54:21 -0400
Reply-To: <secretshopsinc@gmail.com>
From: “Secret Shopper<AE>”<secretshop@info.net>
Subject: JOB APPLICATION: MYSTERY SHOPPER
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – secure.mtplex.com
X-AntiAbuse: Original Domain – yahoo.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – info.net

 
 

Tags: , , , , , , , , ,

“CareerBuilder.com”

WARNING – JOB SCAM / MYSTERY SHOPPER SCAM

secret_shopper_scam

Subect Line: Job Offer !

Message contains attachments1 File (38KB)
MysteryShopping-SignUp.htm
Hello,

We have an open position in your area and we would like you to participate.
We are accepting applications for qualified individuals to become mystery shoppers.
If you are interested in working with us please complete the attached form.

X-YahooFilteredBulk: 173.54.20.82
Received-SPF: fail (domain of careerbuilder.com does not designate 173.54.20.82 as permitted sender)
X-Originating-IP: [173.54.20.82]
Authentication-Results: mta1216.mail.ac4.yahoo.com from=careerbuilder.com; domainkeys=neutral (no sig); from=careerbuilder.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO njtortlaw.com) (173.54.20.82) by mta1216.mail.ac4.yahoo.com with SMTP; Sat, 23 Mar 2013 05:46:19 -0700
Received: from hosted-by.buyurl.net ([94.242.237.61]) by njtortlaw.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 23 Mar 2013 08:35:52 -0400
Message-ID: <ADC314EC286A407B81429A174839DF79@WIN-LREAI02I9GO>
Reply-To: “CareerBuilder.com” <career@careerbuilder.com>
From: CareerBuilder.com <career@careerbuilder.com>
Subject: Job Offer !
Organization: CareerBuilder.com
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
Return-Path: career@careerbuilder.com

 
2 Comments

Posted by on 03/24/2013 in Employment (Job) Scam

 

Tags: , , , , ,

“CareerBuilder.com”

WARNING – JOB SCAM / SECRET SHOPPER / FRAUD

Subject Line: Job Offer !

Message contains attachments1 File (40KB)
MysteryShopping-SignUp.htm

Hello,
We are presently recruiting for the position of a Mystery Shopper for High Net worth Individuals (HNIs). The job is both part- and full-time. You must have a continuous and unlimited access to the Internet, correct speech and excellent writing skills. Kindly bear in mind, that contenders must be prepared to withstand pressure and cope with multi-tasking. You are also not required to have any special education. You can make up to $500 – $1000 bi-weekly.If you are interested in working with us please download and complete our free application form.

Return-Path: <admin@careerbuilder.com>
X-YahooFilteredBulk: 59.188.5.37
Received-SPF: fail (domain of careerbuilder.com does not designate 59.188.5.37 as permitted sender)
X-Originating-IP: [59.188.5.37]
Authentication-Results: mta1095.mail.gq1.yahoo.com from=careerbuilder.com; domainkeys=neutral (no sig); from=careerbuilder.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO ns37.2cnx.com) (59.188.5.37) by mta1095.mail.gq1.yahoo.com with SMTP; Mon, 18 Feb 2013 15:06:58 -0800
Received: from User ([122.201.94.207]) (authenticated bits=0) by ns37.2cnx.com (8.14.4/8.14.4) with ESMTP id r1IIdDvL001040; Tue, 19 Feb 2013 02:39:14 +0800
Message-Id: <201302181839.r1IIdDvL001040@ns37.2cnx.com>
Reply-To: <admin@careerbuilder.com>
From: “CareerBuilder.com”<admin@careerbuilder.com>
Subject: Job Offer !
Career Builder CareerBuilder.com admin@careerbuilder.com

Each link below will take you to identical / similar email scams from fraudsters pretending to be Career Builder
ScamsFromMyEmail
FraudeSpam
Scam Warners
Experts Exchange

Career Builder <– this is the legitimate Career Builder website and they warn about the scam you see above. They have no affiliation with the scammers and are not responsible if you fall victim to the scams you receive. Clicking the link I’ve provided, they will tell you different ways you can project yourself from being deceived by phony online job opportunities.

 
2 Comments

Posted by on 03/11/2013 in Employment (Job) Scam

 

Tags: , , , , , , ,

“Timothy White”

WARNING – MYSTERY SHOPPER JOB SCAM

scam-warning

From: Postmaster@shopmystore.com
Subject: Become A Mystery Shopper Today.
Date: Sat, 2 Mar 2013 11:07:36 -0800

“We have a mystery shopping assignment in your area and we would like you to participate”
Mystery Shopper. is accepting applications for qualified individuals to become
mystery shoppers. It’s fun and rewarding, and you choose when and where you want to shop.
You are never obligated to accept an assignment. There is no charge to become a shopper and
you do not need previous experience.

> ABOUT US
> Mystery Shopper. is the premier mystery shopping company, serving clients across America and
> Canada with over 500,000 shoppers available and ready to help businesses better serve their
> customers. Continual investment in the latest Internet and communication technologies coupled with over
> 16 years of know-how means working with Mystery Shopper. is a satisfying and rewarding
> experience. Secret shopping as seen on ABC NEWS, NBC NEWS, L.A.TIMES. Stores and
> organizations such as Western Union, Pizza Hut, and Moneygram among many others, pay for
> Secret Shoppers to shop in their establishments and report their experiences. On top of
> being paid for shopping you are also allowed to keep purchases for free. Mystery Shopper.
> NEVER charge fees to become a shopper. Training, tips for improvement, and shopping opportunities
> are provided free to registered shoppers. Mystery shoppers are paid a prearranged fee
> for a particular shop, Mystery Shopper. has available for immediate assignment an inspection of the customer
> service of any Western Union in your area. This fee will be paid upfront. During this shop you will visit the
> location and make several observations as regards the customer service.
> You will be required to interact with the shop clerk.
> You may conduct the shop alone or as a couple.
> The assignment will pay $170.00/ assignment.
> Kindly Fill Out the application form below and we will get back to you shortly with the assignment:
>
>
> PERSONAL INFORMATION:
>
> First Name..
> Middle Name..
> Last Name..
> Street Address(Not PO Box) ..
> City, State, Zip Code ..
> Cell Phone Number ..
> Home Phone Number ..
> Age..
> Current Occupation..
> Alternate Email Address ..
> AVAILABILITY: Days/Hours Available
>
> Monday .
> Tuesday .
> Wednesday .
> Thursday .
> Friday .
> Saturday .
> Sunday .
> Hours Available:
We await your urgent response.
Thank you for your help. We look forward to working with you.

Sincerely, Timothy White

 
 

Tags: , , , , ,

“Nickelson Jones”

JOB SCAM – MYSTERY SHOPPER A.K.A SECRET SHOPPER SCAM

secret_shopper_scam

Subject Line: CAREER OPPORTUNITY……………………………….. BECOME A MYSTERY SHOPPER

Dear Candidate,

We are a full service customer experience organization that deals with
mystery shopping programs and we are accepting applications for
qualified individuals to become Evaluation Officers. It’s fun and
rewarding. There is no charge to become an Officer and you do not need
previous experience and you would be paid $300 for every duty you
carry out.
Evaluation Officers are people who provide objective and factual
feedback about the the quality of their experience at local retail
stores, restaurants, theaters, hotels, and other public establishments
that offer customer service.
We describe this function as “Evaluation shopper”, however our
organization feels that this particular position offers perhaps, one
of the most flexible opportunities for people of all stations in life
to enjoy themselves at our expense while already working or seeking
full or part time career positions.

JOB DESCRIPTION:

1.You will receive funding for the assignment.

2.You will be asked to visit a local retail stores,
restaurants,theaters, hotels, and other public establishments that
offer customer service

3.You will receive the Instruction for your assignment via email on
the location and details of the assignment.

4.You are to complete the assignment as fast and discreetly as possible.
PAYMENT TERMS:
You will receive a flat sum of $300 per assignment. The company will
furnish you with all expense needed for the assignment and any other
expense incurred during the course of executing your assignment.

Please do properly fill out the Necessary information Below in order to proceed
FULL NAME
DELIVERY ADDRESS(not p.o box)
CITY
STATE
POSTAL CODE
GENDER
PHONE NUMBER
MARITAL STATUS
AGE
EMAIL
OCCUPATION
SEX

We look forward to your anticipated response.

Regards

Nick

Return-Path: <nickjojo68@gmail.com>
X-YahooFilteredBulk: 74.125.83.65
Received-SPF: pass (domain of gmail.com designates 74.125.83.65 as permitted sender)
X-YMailISG: c72TxoMWLDt9QefxytmSEdMsw8b_LQLniFwD2sZHnMJTqrCV .whRRtJ2EK7fJVP0q_eqWBXdM8cHslhGhRtEvg5Krmc_Fb9ec4L76iSoH3RU le3FnWRA2rqQJeNCAfNuNj.ieyd19Shi4y8PrRt8fXCl3tItTFktuQxwrQMC 2y.tViezASsSnEQQS6_aoRIX6JUoE2fvc81nqli1DmOobbqYr2hxXpIp7A8U EbenZ35p6FAgiUoEGOkb74nByu7WCGM5MtfCsnAAgs_i_ej7DBqweqDi08PZ XatC1NDkWesV8YNco2rEAVnhMa39zC.FLxI7On_giCTcgPma_bPjkBbzYzc_ 953mn6PDjX9D6lzTtn37Hv8._orveyasOKRp1fMMpjGD7X70y3CkoHMfuqNQ B03KMuvMCCLDHUmJ35WO8Dn_ChYIn5lB4Qjl9kPFWeLQa3b0KSf1VyzS4TLT GaQ.MnUuhG1CaJrf3yplnbUcmuHzvIWoFUeoeXP0Kv8KUJdBDz5gvttRxcqb bxCHwol8ySakV0d362sPjiGB4s.C21tNJqHsz64OFPEy.2XChkahphy2Pext R.RGXQReuEGH5aTmzAPZn0TuS04uXOnkth6E2E6mSnIEREBIhAA8D.twXdHS S6aZt9QlwFz16_Q0IXDwOKpwFFNq7kVJ1n9aYar22zme20iib9Mhta_S4Tdc 5CKwES3L6V_g081KtiAh_5HBvVkN.km3510cngVRJHCWIpTqzv8clGbpB3jx eefCNxM0AY5ReHzAg2yuT7_GvVq28.R63CJFNiXdNspuDTDuE03OT6.K0tyD yBnKEdf6GsK9yjST1q.Nfp92muzY2MRMcWRVmBSLRzWpo007C8Dbm3Ks_QRL TT8gLiA4pAYyiUQid9vzZkSxEhgM6asVwaY6myRs0uBbz_vP07ytKuO43zqO eyLDrDRMifOXGb8fY9sy0wYfIvq3nBFEStqJGEPdSSn82xwD0kiduvwU3SiZ TBr.d0tJ6COM4zCSsaez0aQCO1oR7tnAsXzpc4A4FOIFpMtnwWsZEqbUB8Ut PjYVHAgPbnUJXCwJW1HGMp9sg5ooYe.kpdtoD.wdk7piIMMPWKOt.umzoP6F MbQg0aCx58I8crg9IZPkjIeR1SNkepYgiTRsJ1XXcmeabp.9YfFMLdULSoCp 2oM7GeBTbJzpz9P1jmK7VNZi2zkeSAEM4WKYxHEdx_TUx9jrrBeTjRdTzM7W Ryng38EM9dewz9xQlXmHiJkBzPZu1nHSuTlxJDS.OdWD5sYrIRZLbw2n51w-
X-Originating-IP: [74.125.83.65]
Authentication-Results: mta1322.mail.gq1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-ee0-f65.google.com) (74.125.83.65) by mta1322.mail.gq1.yahoo.com with SMTP; Tue, 18 Sep 2012 06:02:38 -0700
Received: by eeke49 with SMTP id e49so1247515eek.0 for <porkyexposed@yahoo.com>; Tue, 18 Sep 2012 06:02:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=AVVPLT41GgT7klca4SsjyJppmBI2iwiuy+UKWgvn/xE=; b=j7lmlS30Z9siNENo56bkGuzyXT1CR/ZrwB8qSM4grxxu45sXTbV3vT9YIIGfzu/I9W Ai3bpECh2zEK1MX5PbIjDjGPhNakRCjQ8eaLhPDkLWN985ZOY/XWAQqLdc9WmhvzSJow F1kftuM6GmzEhMwdAg6Ca3YocLWNLOJEYTVy4j3+lgvyjSswO5+Fx8TjptZBne1BPzzk rFYqGtTlSXSNMcyu7x2Wa1KAX0GO6EtWTUVtruoFLrqFAlXOPP87rhY599UBNaA3YWuz sPK8Na9NHc4Yj2WB2ux71zE3O2pH6OGQNbwnxY+v6Z7AA/U15p+p1+PSfpqwVZQ3ZuSm xAew==
MIME-Version: 1.0
Received: by 10.14.225.200 with SMTP id z48mr48600eep.39.1347973356708; Tue, 18 Sep 2012 06:02:36 -0700 (PDT)
Received: by 10.14.96.77 with HTTP; Tue, 18 Sep 2012 06:02:34 -0700 (PDT)
Message-ID: <CADWWGfB5_YrCLzx6PU1sBCuOTehQ77d=i49-1q21Ac0hwt0uYw@mail.gmail.com>
Subject: CAREER OPPORTUNITY……………………………….. BECOME A MYSTERY SHOPPER
From: Nickelson Jones nickjojo68@gmail.com

 
 

Tags: , , , , , , , ,

“Sherry Croft”

WARNING – JOB SCAM – FRAUD

SUBJECT LINE: Evaluation shopper: Now recruiting in your area

Earn $200 a week as a shopper

HEADER DETAILS:

Return-Path: <bounce-cgi-nf.innovahomecenter@eigbox.net>
X-YahooFilteredBulk: 66.96.185.14
Received-SPF: pass (domain of eigbox.net designates 66.96.185.14 as permitted sender)
X-YMailISG: ow0v7fwWLDvOkTZ_ziHcWwQu8NHwkWTnobRcU8fqZWs6c.Pq 5VoVxA1VFWWi2vbz3XZOFK6zyRqi3sBPAUlMxzF4bqvu8AGGLOQfPl7xI9bv ZBM4jOn1.gfr4LsCaHamzmGT08766xbtWdt3GxN881M_lnH0CWvUeQZ7RQpC CrOPSKpYFgKNF9DZEcl1phBU33SYCQ1kbEBFyK1BhyFl_B4kNcEw_2bWuIY2 olKze6Fph.9WfbOxR8EqTXzpEPaKiJn_zkBLUzjxYozt1k2hMrVEz6ndP5W3 eGzxh76HxsyZA5mlfo2IX_XWkctTtfNRDwlhkjXyrSNl_39xGTSZ084YhevR MjFv3NQQxL.BAWomUilvFPLPsKd4U.K3fXkTknbHdlvYVtG2uMwe4Zi6jh07 Ob_hJxEfSAqC2MuIhEVFPgjTE3sDDw953QEeBCVNPT.kS.5TKHVP.9EX5BfG vmJCEQ7_TKLUT7GAP0HC.8gQEgP_DKmgRMlyMy6kCLEBVYChprVbHAouh9sB 640GY6CmgLQuFuantLfH2qrUtcPLZazyhtnKifx9__tFytv7zGYnHlB1jgnX bJik4_i9Q_mIzcrQdORz41n2N.lEO7.orq20yv0XW4ND8SD0WWjGNHedU96U ZVgvPq7gzRzk2CzGT.2UuX0B9pYRRbdYsOGC9ALxGQHdApr9LZuBjac0MxLx _0JZUWglH4ZoBsJZzTscVxAC5ocrJQlctL2SBroRjno9Pq0NFz1hODqL6ZnV 95KzUfb0niaRKyPmgwv3.KG.VuEX.3OqJP5YrkYq9ZEGUgZYhHWlo2p.iU3m HhqzMg.fe7FEB4ATxqjgRLa.RG51Ms0LF4sQZh5hWvE0H_xtm2fo8uQ45hC8 LTd3uAqVMnglb_K62ekar95MLNEqGUl8Cu0X4vpWHXYGsn27yggGA0aXEsXU ZaWCxUHTRER71TnQRgypF_oIlqXbn8M_Hf20p_3zbHEOm2I47ZayWMYoLxak Wjxh_vMm1EVzOJTxA4z_lPWzu7jTib4.b0eYaqUuo7R7pdN84bWoxX0_3pKl FY18GdigdmkagbyHbGAZZbb0ZIwBGhJ1m_qx93wKwAQTpJssi1N59_6QeabZ CDQcE3sa_J9ZLvcGaiAAEyrY.WRGcSViWtpbimt4SEqtuTISkJfyFfBFuk39 1hjJgjOvUKk4z2dtApaddQ–
X-Originating-IP: [66.96.185.14]
Authentication-Results: mta1226.mail.sk1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO bosmailout14.eigbox.net) (66.96.185.14) by mta1226.mail.sk1.yahoo.com with SMTP; Fri, 01 Feb 2013 02:07:06 -0800
Received: from bosmailscan05.eigbox.net ([10.20.15.5]) by bosmailout14.eigbox.net with esmtp (Exim) id 1U1DWU-00049p-26 for deleted@yahoo.com; Fri, 01 Feb 2013 05:07:06 -0500
Received: from bosimpout03.eigbox.net ([10.20.55.3]) by bosmailscan05.eigbox.net with esmtp (Exim) id 1U1DWU-0001mT-54 for deleted@yahoo.com; Fri, 01 Feb 2013 05:07:06 -0500
Received: from boscgi4201.eigbox.net ([10.20.12.108]) by bosimpout03.eigbox.net with NO UCE id uy5S1k00M2KsGMW01y5ScB; Fri, 01 Feb 2013 05:05:26 -0500
X-Authority-Analysis: v=2.0 cv=Rt9H3VaK c=1 sm=1 a=G3xyMPWyPh0A:10 a=pe0irAIzKBIA:10 a=nDghuxUhq_wA:10 a=ecbj2ccWRGgA:10 a=d3ZwFMNkyaEA:10 a=pGLkceISAAAA:8 a=QPcu4mC3AAAA:8 a=5r8fxAsfy9EA:10 a=1Ba24gaqfRe7yr1H7EQA:9 a=DwlDvmn/BrGTgMMELokLFw==:117
X-EN-OrigOutIP: 10.20.12.108
X-EN-IMPSID: uy5S1k00M2KsGMW01y5ScB
Received: from nf.innovahomecenter by boscgi4201.eigbox.net with local (Exim) id 1U1DVy-0005as-WD for deleted@yahoo.com; Fri, 01 Feb 2013 05:06:34 -0500
X-EN-Info: U=nf.innovahomecenter P=/design/wp-includes/js/mailist.php
X-EN-CGIUser: nf.innovahomecenter
X-EN-CGIPath: /design/wp-includes/js/mailist.php
X-EN-OrigIP: 38.108.116.7
Message-Id: <1359713194-902-nf.innovahomecenter@boscgi4201.eigbox.net>
Subject: Evaluation shopper: Now recruiting in your area.
From: Sherry Croft <sherryc247@gmail.com>
Reply-To: sherryc247@gmail.com
Sender: Sherry Croft <sherryc247@gmail.com>

FROM: Sherry Croft sherryc247@gmail.com RETURN_PATH: bounce-cgi-nf.innovahomecenter@eigbox.net IP_USED: 66.96.185.14 <> 38.108.116.7 <> 10.20.12.108

 
 

Tags: , , , , , , , , ,

“Geraldine Mead”

EMPLOYMENT SCAM – MYSTERY SHOPPER – SECRET SHOPPER – FRAUD

EMAIL: Hello, There is a part time secret Shopping job available for you with a $200 salary Per Assignment pay if interested contact email:mrsneedham@live.com

HEADER:

Return-Path: <gmead@chipublib.org>
X-YahooFilteredBulk: 64.107.3.197
Received-SPF: pass (domain of chipublib.org designates 64.107.3.197 as permitted sender)
X-YMailISG: CpHLBTAWLDtoOrioXVpIJdZ7_UPTN5gg.zIryc6IPeIMVwy5 7.7iWvsHSbZnz35A4YfQXivayLPXn58O5eRc7Rz0gwIBorMUSbTKEneTqcmQ 66WF.gXOqlhN.g.QXkwo8_9rooXUJs08ZWwEEKryEd43d2lUOr7LfCR_SiEt .CAqpNhjUuHwjp.cD.TYb4xldFWnl_FsYyX7ae7b.lDYsCNfqv.XVQJkmWVi goUAG0V4J2ijRULQ_vF43Q6BU.RC_Dtt_yE8.WLN92txaKDDRkQp7uZFr7Ih X8QVOgWtUvPC1XGcvFcV5ZwnHgrb2F14LS6xtVCsMxmS4r89BWdRp2VA3toa f0xcuYk.j7zkuwRmVjktCCI.osqDCzmnafiunuywWkHYXGft9LZwRi1mNmpn L_CfxBsjW6hzpIpxp_G.5uTJrEtC.Eo.lHRb0q_6njfS0owtpz1PXAUQOslv s6nLAqs9mdamEEtEH1X8hAN4QcMWZHgCVXoKZRWkjYCnaR0SfB9NlFyEmo66 R1IKrme4beUhDCgTY8EPbxFGkhxgQul3PVhHyfb6fSGLBjxaPGQkaAW1bhtG OeNM1YbgT9OLDC1L7l94g7bf8CZu4w8_9SWEs7BadOuv0kZvGwYjaIVk1l8t GK8uNOzEPiEnorvUzn795KbSrcvfemWCcW0L4XnpfEGc7O8EDT5CG_Tggb2D J9K_9PG_thK.c4bOYgYasbM16r6XqT_k_I7htvBXGufLLYYktSJmpCrha5qY S_0ajgtvp.JIpyES70sxCwbGCGIU0BD5LDFuAmS659Vs21QuYu2E0ZF1gnzs WXRx5jtQByD_Nz6xr8DIWRcCF321e5n73R_kuXcev3xHn6lP7Ut09eNM54Db 4H2ElgE_0EtzWovfl83eU4BjTu4SU6PLsZjLi_hgTrVV2IIgp3Gqc17G1Ua. j7UeISWiY6tZpmDwIzkQClo7JDYMmxI35c4R8wlNoxJr6KGzCMDSE7vE2GC3 OTZCOwaV29hkYQAWys1V8jkxoGkZ5ZWEgDDJmFl295te3xUYs3K4uQma5ROE bFprfUxaBBRERqcSgbrvAHoKtgE5GnrkW8TD_.Bhnxd3UkM7ZuaTZ3JITqcM MsFY4cDSkaU49tMRsRv9SfhWFoK7tz7ozvVCDOYPgHV6Es78fVzhdmRd3EQQ rwSRpdqv.TjeLYq1A0l_TF0CXRRNVOeslm0A05qL7W0Db.uWfYIAqIBo57IP c7IO7xPLn.Vx_BP.pVQLX3ysQ4crsPb6H1takaFslL7EO6kscylvlkksX4.y lx2zWQ–
X-Originating-IP: [64.107.3.197]
Authentication-Results: mta1049.mail.gq1.yahoo.com from=chipublib.org; domainkeys=neutral (no sig); from=chipublib.org; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO Lorica5.chipublib.org) (64.107.3.197) by mta1049.mail.gq1.yahoo.com with SMTP; Thu, 18 Oct 2012 05:27:48 -0700
Received: from LEGATUS5.chipublib.org ([fe80::fc3e:bbbd:f296:732e]) by Gerulus.chipublib.org ([fe80::c93b:83ab:2900:a856%11]) with mapi id 14.02.0318.004; Wed, 17 Oct 2012 14:50:39 -0500
From: Geraldine Mead <gmead@chipublib.org>
REPLY-TO: “info@notice.com” <info@notice.com>
Thread-Index: Ac2soK5auidISj8cQgqi+vjL9J/VBA==
Date: Wed, 17 Oct 2012 19:50:38 +0000
Message-ID: <D70D3E6F95B6504C995A8296FD6C94520553054A@Legatus5.chipublib.org>
x-originating-ip: [172.19.3.235]

Geraldine Mead gmead@chipublib.org – info@notice.com – mrsneedham@live.com – gmead@chipublib.org 172.19.3.235 – 64.107.3.197 – 64.107.3.197

Below information provided by Zee, an online-user who received emails by the same scammer as above.

Email #1 offering £3.8 million

our mail is well received coupled with your contact details on where your consignment box will be delivered,Instruction has been placed to deliver your consignment box worth of £3.8 million once you comply with our instruction by choosing one of the delivery option below, Be inform that once the delivery charges is being received from you our International diplomat will proceed to your destination address to hand over your consignment box to you.

Email #3

FedEx Courier service office, Cotonou, Republicdu Benin
Contact CourierFEDEX INTERNATIONAL SARLLOT 20/22 HOSPITAL ROUTE COTONOU BENINREPUBLIQUE
TELL: +229 6644 7691
Email: fedex_d@y7mail.com
Motto: Honest & safty.

Your consignment box is now ready to be delivered to you and all you have to do now is to wait for the arrival of the diplomatic Agent and once he gets to your home address then he will help you to contact the money exchangers as to convert the money to dollars.

The delay we have here now is the delivery fee and once you remit it I promise not to fail you in this delivery. All you need to do is just send the fee so that the Agent wills takeoff to complete the delivery. Fail not to choose one option from those options given

Listen once he comes to you, take him to the bank you operate with so that he will present all the documents that proves the legality of the money to the bank for them to convert it and put the money in your account without any question.

Thanks

Mr. Maxwell Shargan

 
2 Comments

Posted by on 12/15/2012 in Employment (Job) Scam

 

Tags: , , , , , , , , , , , , , , , , , , , , ,

A list of three scam emails

I’ve compiled a list of THREE scams that were sent to me back in September 2012 and they kept getting pushed down in my spam box. i’ve looked up each of these scams and they ip’s and/or email-addresses have been either blacklisted, reported, or both. they are 100% scams!

______________________________________________

1) Mystery / Secret Shopper – JOB SCAM

EMAIL: Work as Evaluation shopper and earn $500 weekly reply if interested.

HEADER: 

Return-Path: <rbud743@yahoo.com>
X-YahooFilteredBulk: 74.208.4.194
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: AKqJ9t4WLDuLDZ8EZZ2u3Vhgs2RNEh4aXjZ7kSSWXBbVAv27 JuBiH_aCg6MvjBaLtMO.0JhXLKpM8ii1YEm8h.bFObLns4nMQlhEuIaOypzf YAFLEAhgf2YH3_pDJA6RPA1iH4GD82FsJ1hxzx8FwLfw9flBPA_QVArVHg_h m.nDYlX6pFBPN1kN5BXyTwsrpS8DrWxf5h9pc5u0ORutRWVmmWxtyTqongzC AZxsQhOSTAeUSgJlrWrj13kGVmyz5egnbmw71fMxby9dLjhQZ_I.65L5aVED uaj9eUARz5uXxA9Nr98SIEpyTsr7qpzboLTSAxZHGXwTxG6WaoqigWyqxPNB 8tkNBi2aZZc82kCiAZ6y4bIJIsGVQv2KbAzEQihTxZ0q8zpkpD1LLH1PGih5 a82YTC.4HsC2HXhwZeUKptTF2_JEKlnhXNn9tegHb3_vx9h2hx5nH9JlZDF9 GYjXQ4BHx8UFQ8IpAAB3lKXN1Rl1l82cHtG2x9XSWas3T71G1EnTjIW.UnJL 8Wy.OICrembxbDZik.cv_yj_7APLx4POhhoSXnmOkgg1zWZfdqVRhjOw.Pk3 qruW_GaAce8POox4vtMRUHwd5ec1p922vVYgZmceTMr2KgfAT.ALodh_crPy wYcjUG_wpNMK3q5_QGyhnzcLNz.w7boX6vI9rqYnVC93nBK6jicjPHfE_p09 EQN9gYTlrmX_OkOhZtosYI9CjI4d7awR.RjWmpFiU7w7gZSVuSbNvej7_dPA QR3_BaQXgMfbD9f9Bcd4BBm6Ncwo3hQI8pYMJMaJxjZTwQGiLQSHOAWgk1bE 3PmyPCxH2BUw6B4yjRwPf32ee.qd3yU3c9T60ZaYsOKq8H2oC34IphIKeX9c Zp_CGasShwklc4Bc6J1V4dNHSpE91ybvbKiK_QCETua1O.Jnn_BmFO.X0tBW qvW8MSKLQI3dxIVuxVD6wQqjdrlbRjBOsZTXa0ZNYeWBxEkbDTAoHvqm1GkO qOC1bLUtx2b71g3GZpPxGQb_WUnhoQRtBAtFRiB7VJj.vQ6jFEI6uxk9DeQm iEjd7zK4s4139xO7eIBpSSEy2oaUzqsEtTavLSA6KHgB87t5IQtPA6aCdsE1 3iuDjHCuQ_Tx2tw0UAgnKWm13UKA6QV84.cN
X-Originating-IP: [74.208.4.194]
Authentication-Results: mta1236.mail.bf1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mout.perfora.net) (74.208.4.194) by mta1236.mail.bf1.yahoo.com with SMTP; Thu, 27 Sep 2012 05:37:30 -0700
Received: from icpu2633.perfora.net (infong656.lxa.perfora.net [74.208.16.162]) by mrelay.perfora.net (node=mrus1) with ESMTP (Nemesis) id 0MNJ6P-1TO6Ag00Cn-006tJO; Thu, 27 Sep 2012 08:37:29 -0400
Received: from 64.62.210.227 (IP may be forged by CGI script) by icpu2633.perfora.net with HTTP id 3pIPGX-1TlNhr3xrB-00o06f; Thu, 27 Sep 2012 08:37:26 -0400
X-Sender-Info: <154550926@icpu2633.perfora.net>
Date: Thu, 27 Sep 2012 08:37:26 -0400
Message-Id: <3pIPGX-1TlNhr3xrB-00o06f@icpu2633.perfora.net>
Subject: Earn $500 as an Evaluation shopper in your area.
From: Secret shopper <rbud743@yahoo.com>
Reply-To: bunniebug@gmail.com
Content-Transfer-Encoding: 8bit
X-Provags-ID: V02:K0:q7XGMi78NyFU2vB+AV5/lUFl9H98ItYD9tLebyHhAA9 D0m97d8zgZKfxlxuq9UDrMJegI60FkR/i9yiR6s+ClfFhTdW82 rAyxkW0MOpaOrk4OGp145YpcbEzlvc2VFiYRQ/rs6aB2qcOPN3 NWsuAhg3PAiNdEwA6dwxoRHieSsNCys0MCLKU+1KwF9t3ityOb +0h6hFjTSFQcDRe/zyg06xnSxE3maK6IsAX2Nd1M4qbEFSyI9i 5Fun6VBXSQ6J+ZAUIsFI5SJ89/OaBqUYBkxv20+wKWBINPrD9L DG+HtYDgwRcz0KeXzqNl6gn4xUUQtJvPCBgosLOpKvKwgM7+xm b8vfu2v3JIk8MzEz+GiIGqRcrSOI0MNEZ0pg3V0jcmYI6z5qOg uRKeU9ng+gFFtzlnhdhW3SfwBG8kAe5MbgLNhihFFOcitw1pvf 2JJM8

Secret shopper rbud743@yahoo.com – Reply-address: bunniebug@gmail.com

______________________________________________

2) INHERITANCE SCAM – NIGERIAN SCAMMER

FROM: “BARRISTER IAIN WRIGHT” <barriainwrightchambers@yahoo.es>

EMAIL: A “Next of kin” file was attached to the email I received in my spam-filter.

HEADER:

Return-Path: <barriainwrightchambers@yahoo.es>
X-YahooFilteredBulk: 98.138.91.65
Received-SPF: none (domain of yahoo.es does not designate permitted sender hosts)
X-YMailISG: M2_fjBkWLDtzFm2rFbGuKofV838RG80_qXL6ZuDED.RFpUhN QzoD5j712gVhOoEJsZ_uRf.2zvCTUEDGuBwy7ek.Z_cs1.Ow_uuIMz1W0KW5 jz3j8cAvY4pVwyF92hL8sb0bk5etdgQljeePH7D7H0t4.QwwJ0D3rZLAmRtX EA.nsroRjdhC77B3fJekjgoYlRDbjEQ04x121ZVEfEWe.3fW5SyxaTfR4KgF kzRSvkuZWiHMl.95_MNF52w6FlXZe0s57mnJ39QygzPNuwxz8r9ltiLrDxzW CEcFpO9AFuqw8nCW_R1XtK6G1b6huW8ePJC.leD0fnho.XtvHjoDVo_y2ZfO WqNr4Oio3P19odWSC_sGQEZrl0EM.EkuUagsnXV7xRvQu0jtqShpW31_Z.tT Js6CVCXWfKboozjD9cQ3Gw5bIsAuPseovHYlMJDKjcPbBvIYONMkwcJm7g2s 0kCNA.NZ8XAplJwzsrfD6kozvvEtlBUiYF3WgpuwanpG5wdit6Ji_PU9PfOC K1Yz9q3yP.kaa5agusvK9DslBIL2BI1sE8wAmfxOndoXnT_OBg1A89tKyHvi 1NU.rgxEXocZHUvCmOi6finC8JS_HOXotztzI3k1UAF3p7LtuGi1rlULN_t9 ZlqKoyi9DKSLjJr7mmT2JNYk3Dg.8I.Ufm1UafFyn.vMw8Leij6Hz2bF2v4Z iDKSJttG_KsvKA8BBFrV4D29WitXnXW952k5J4ki0t2MJGF_52sryyhf4Xbc V5VMk8lFNV3RnVxbzFZ4F.Giex.EZykeqvgYWpD19NU_Aa9Bl_Gj6jfDvnBA VxjF4ZQdNb8ILQC2s7WQ5xxYqTIRJSny3nDVLHk0CsksYsoQa1ZsyQcnzmlD .BbVo322yE5eFDLysimD_pbd9GGtPqvHK0oFnA87dDQ8m6EwoczOZyq5MLZh 6ak6I15eZdeXgBCGjDot4PbER8YPaczjKa1gS35fSifWN6mdVTfrENbi1KI3 trybU9EqYKxs.Fpi7cVpEvg3_7dDpGnTc4sHhBRgEdf1RHq4SAIt4iYl59iZ dPLvX48BTVkdm_jRpF_bSsX18FONqMeNma.2vF7zQyPEos7t9v.zV4BCFg5K D8KR4VuGmgZUv0rs9LTQMcmeGz5EdaudBaAQNTIdiFhnYQt4ueJdCwRRX.iJ 4itjVlPHvxCwCSOCk2pTW.fWLQ6tzFDa0wLErfkvjqPzSZQlvl5P_dKFrKkU Qw2FXmcwWByns0lIRh4e
X-Originating-IP: [98.138.91.65]
Authentication-Results: mta1268.mail.ac4.yahoo.com from=yahoo.es; domainkeys=neutral (no sig); from=yahoo.es; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm8-vm1.bullet.mail.ne1.yahoo.com) (98.138.91.65) by mta1268.mail.ac4.yahoo.com with SMTP; Thu, 27 Sep 2012 04:58:00 -0700
Received: from [98.138.90.50] by nm8.bullet.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
Received: from [98.138.226.126] by tm3.bullet.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
Received: from [127.0.0.1] by smtp205.mail.ne1.yahoo.com with NNFMP; 27 Sep 2012 11:57:57 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.es; s=s1024; t=1348747077; bh=hGsZAt5nOQ2q54GDVUA2RwhZC83Cp9+/EC4wFdxVyYY=; h=X-Yahoo-Newman-Id:Message-ID:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Reply-To:From:Subject:Date:MIME-Version:Content-Type:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE; b=MoAzd3e63PqKFngqb3VCbC/Uo5orULDk1RIM6/2B2RYLBM6h8uptxC+sRFQJ5iLRKi39kay5dKraN2XrKP9u9wtXAlDdkFnIeciEVnV6i7gEZEbsYRdtEOasJq/ybFCUCe0XpeR66OnUwYqE/p86ZL91DAWHBLrkFvdalJQMAxk=
X-Yahoo-Newman-Id: 947141.79026.bm@smtp205.mail.ne1.yahoo.com
Message-ID: <947141.79026.bm@smtp205.mail.ne1.yahoo.com>
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: rcoOjawVM1mWxeqldCK7BSKWgrYcBs1inBlj1z5n9ltVGqo lXNdgbkjin6Ym0hriCxY8RhKC9z3UHynFaVcypefuZJk2AfXmrAilKSE4vb5 KeOc2ioP7iy1rfjaZZVzV.cycy5VbHL7AbItmNPTqrNiyjcb6iaEiRVHxvik NfO9dnBB94DVyHbVr29ZagMutfYnQg5KSy5ewpvMP4MtcfN2sKjatIfTNS4D L4jPTAEBbDvd5mh_QaFWkJE3.eudqrsdxkVy.YLapxZkLJyfub4CI6iGV9HD D4elT72CmoNh.KfYjif0wZS8DIXtc0oDVVaNR_ovjQW27WIB3VWtwpk00VZ1 0wK_SM7gHK.xJVFiu3aG.hYTYe8.gByUW0F44tzkpBVsFkSYXI9zlI5KUuy_ pkATHZ1qonT9DuCxgQgGPlMDlUztCamZhoye_.Bt74oBCHBS2vEhHI0yvsVg X93Q9Qaw5R_gx8iEan8y1B6IR9ErqB9iC43JStRYaXZmWkR0-
X-Yahoo-SMTP: bFYQ04.swBA5PmeNAjXtnC8HS1fNQYaHrFuwM8HILFjy
Received: from User (barriainwrightchambers@41.58.49.104 with login) by smtp205.mail.ne1.yahoo.com with SMTP; 27 Sep 2012 04:57:57 -0700 PDT
Reply-To: <iainwrightchambers@yahoo.es>
From: “BARRISTER IAIN WRIGHT”<barriainwrightchambers@yahoo.es>
Subject: WITHOUT PREJUDICE..PLEASE READ MY ATTACHED LETTER AND REPLY

REPLY ADDRESS: iainwrightchambers@yahoo.es IP ADDRESS: 41.58.49.104 LOCATION: NIGERIA

______________________________________________

3) BENEFICIARY – 419 SCAM

EMAIL: Hello, 
I am Mr. David “Dave” Darrah the Assistant Director Inspection Unit/United Nations Inspection Agent in Hartsfield Atlanta International Airport Georgia USA. During my recent withheld package routine check at the Airport Storage Vault, I discovered an abandoned shipment from a Diplomat from London and when scanned it revealed an undisclosed sum of money in a metal trunk box. The consignment was abandoned because the Contents of the consignment was not properly declared by the consignee as “MONEY” rather it was declared as personal effect to avoid interrogation and also the inability of the diplomat to pay for the United States Non Inspection Charges which is $3,700USD. On my assumption, the box will contain about $2.5 Million to $3 Million and the consignment is still left in our Storage House here at the Hartsfield Atlanta International Airport Georgia till date. The details of the consignment including your name, your email address and the official document from the United Nations office in Geneva are tagged on the Metal Trunk box. 

However, to enable me confirm if you are the actual recipient of this consignment as the Assistant director of the Inspection Unit, I will advise you provide your current Phone Number and Full Address, to enable me cross check if it corresponds with the address on the official documents including the name of nearest Airport around your city. Please note that this consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delays in concluding the clearance processes so as a result of this, I will not be able to receive your details on my official email account. So in order words to enable me cross check your details, I will advise you send the required details to my private email address which is ( davidddarrah@zing.vn ) for quick processing and response. Once I confirm you as the actual recipient of the trunk box, I can get everything concluded within 3-6 hours upon your acceptance and proceed to your address for delivery. 
Lastly, be informed that the reason I have taken it upon myself to contact you personally about this abandoned consignment is because I want us to transact this business and share the money 70% for you and 30% for me since the consignment has not yet been returned to the United States Treasury Department after being abandoned by the diplomat so immediately the confirmation is made, I will go ahead and pay for the United States Non Inspection Fee of $3,700 dollars and arrange for the box to be delivered to your doorstep Or I can bring it by myself to avoid any more trouble but you have to assure me of my 30% share. 

Mr. David “Dave” Darrah 
Assistance Inspection Director 
Hartsfield Atlanta International Airport 
574 Airport South Pkwy 
Atlanta, GA 30349-8642

HEADER:

Return-Path: <pop@allencountyohio.com>
X-YahooFilteredBulk: 76.2.207.6
Received-SPF: none (domain of allencountyohio.com does not designate permitted sender hosts)
X-YMailISG: EUAkKlQWLDtsLHISUQeKpcEKYRzqJ7wJNr_C7p9ML278m16_ Za6J9Pq_buEhDSzzga9w7u3z1iiVkG7gWd3.2GgTG8oqtDYIY8JzWTuAyM.W WLRMqYmljQmJWsOxzbD8S_fg8qHSwLKsMrgjFNK__hHCWl_OkV2lCszsEvIo k27rgsD051sETLW6NnPpM5Y0gQvMg0ZtrVWFgeC.9GTGxpsgbdMFgmTRfqmM pheXss97gqtPwEg8Visf4uC1SekpoOiJm3EwqEomx9xhSJT79hjaDWhgzH6_ COw4PblMM0YnLd9ye88K602PP4Itc87alAKLw9aAh2N61EqrpnDdzqGvP0PZ HfeXg75.3G2CXJAiHD0FHo9JgFp7aG9KyBmrFWRU5648VTW3mDKWe2C25sU4 98uMND3e3IyyDdn1_MHnUp537ptCYyHU6paAoF.omX_bckCR1_VtbfFifDzv _3ILiunWcszXX50ipE1PPMoucSObhqP4Gc2UPSwgz1IBcjQ.YxxbHwcsCz6h vUw3MG57kjqDaJWcy7ip0UHvAnkL64hsG8UKNWHQFtXI3hKpZmc7pOZN42Ai SiJass6CfuEA_t0BXQjGsOrKMoSy.baT7g5EOOpiLtalKToSBZ2KQUBykov1 ODt408PwIyv_UTtB9Vn44XSBJRdE1pVeBwI70kTBC7XD7iU5RfQEau1BG5.8 .QV9vamuNCWep66Ro4xk67qxP6uFL5Q7AbQkujfaZt48c9Dlqae4ZQYuBY58 q4tchcGcICVFhqNUkkDxvwp0xBFxpRplgsJNrg4cKiYTWNQjtcDifMnu.4tE ZMaxugmgEuDm_fMvwqdzJ4sSf29PXJGtI5UserjFwSqYNUhP.PdnaRPwmsvj MeNyxMnzF79dlwPy5dvtSHHyshVxes0Kav8q7gwt8IvbjDFCPrQs2yYehH0W 63ywC7.8X7qlHDgqBcijwuALY9.aI79s77ktX.3z2ITl4YjnXnLRnar5.uhg FL68BNGEBL889saAu6hE0kDLmVkjZ8.COuqfoJc2bkgkT_..DnxIummB1vyv _xT9agrwPBPnUSAlr4CuMCm0hNl30RlWKczWH5sSV1o72hzr5Y6aQY.ZV2Gi .miiKTWsDm1oPmRIR1XtGbCqdrWipNC0MDw4U_NDKhgsqe_vSZC.4xB0.FXJ AmJK6BheyqKbdPqbEmwIQJyDDTBZQlC1QR_m0qgumrsxGuM86obaeiFMLugP M0KnER8ZIyhxrn0ZYCLRCkBF7JcP4l1ZQ.x9pI58fA8YQXHL2.e.Uaqv45PB nW1q.c60yFPROZVrD0jAphIl74s0LojMk0tLhgnvWODWpMVigRHIQXPjwC3N CkpHlCjBQGVFLSppGYFJdqcLxysTIF0ZfcTNB6jwLcwa7EoynkQahjiudRpm _rJngrLoamoCJcV53j5adQ.GLSpkcTsSNjZ6fBDmjeEnr5sklf7302qx3lGz m6UkBOA_.jgAksqlCvX3yDdeNH0_gwNaP.eqIvVP3pOyD7d6glmnjQVHKsr_ ARaX9Yl5LxZKu9MMZFP7uGcbf7L9Ei_RlRJ6UU2F5Q–
X-Originating-IP: [76.2.207.6]
Authentication-Results: mta1089.mail.ac4.yahoo.com from=allencountyohio.com; domainkeys=neutral (no sig); from=allencountyohio.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.allencountyohio.com) (76.2.207.6) by mta1089.mail.ac4.yahoo.com with SMTP; Thu, 27 Sep 2012 01:35:25 -0700
Received: from localhost (localhost [127.0.0.1]) by mail.allencountyohio.com (Postfix) with ESMTP id 2D621122C8C; Mon, 24 Sep 2012 13:25:46 -0400 (EDT)
X-Virus-Scanned: amavisd-new at allencountyohio.com
Received: from mail.allencountyohio.com ([127.0.0.1]) by localhost (mail.allencountyohio.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J5DNgyAg-5Go; Mon, 24 Sep 2012 13:25:45 -0400 (EDT)
Received: from mail.allencountyohio.com (mail.allencountyohio.com [76.2.207.6]) by mail.allencountyohio.com (Postfix) with ESMTP id 8E249122A27; Mon, 24 Sep 2012 13:25:35 -0400 (EDT)
From: “Mr. David Dave Darrah” <pop@allencountyohio.com>
Reply-To: “Mr. David Dave Darrah” <davidddarrah@zing.vn>
Message-ID: <683849525.104969.1348507535471.JavaMail.root@allencountyohio.com>
Subject: Await your Urgent Responds !!!!
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: [64.250.124.220]
X-Mailer: Zimbra 7.2.0_GA_2669 (ZimbraWebClient – FF3.0 (Win)/7.2.0_GA_2669)

Mr. David Dave Darrah – davidddarrah@zing.vn – pop@allencountyohio.com – 64.250.124.220 – 76.2.207.6 – 

 

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

“John Smith” a.k.a “Norman Williams”

WARNING – JOB SCAM / NIGERIAN SCAMMER

John Smith also uses the names;
Norman Williams
Norman Williey
John Smith
Luis Williamson
Luis Williams
Smithson Smith

The newest name is Norman Williams and he is roaming job sites http://www.seek.com.au  www.buyandsell.ie  www.adlists.net — I’ve posted all the emails in order from newest to oldest received.

Date: Sun, 10 Mar 2013 06:07:45 +0000
Subject: Re: Personal Assistant posting http://www.glengarriff.ie
From: normanwilliey1@gmail.com

Hello,

Am still expecting your response regarding the email below, please advise.

Thank you

On Saturday, March 9, 2013, norman william <normanwilliey1@gmail.com> wrote:

Dear J,

Thanks for the feed back to my message concerning the PA i need. Do take time to go through this introductory mail and feel free to pass any questions on my profile briefly:

I’m Norman Williams, 53 years old and a father of 2 wonderful kids, a successful entrepreneur and investor and co owner of Norman Williams & associates. I’m also a research journalist and I travel every now and then within and outside the United Kingdom and Europe working on various independent projects, this is why I need someone who can help keep up to date with all of my activities especially when I’m away and a midst my busy schedule.

I have had a previous Personal Assistant who has been very commendable in her activities and who has been part of my life for the past 6 months, she has since moved on with her personal life and it has affected me in a way. I found her previously on the craigslist website and I sincerely hope I will be able to find someone again who will be as efficient as she has been. Please note that you are being hired only on a personal level. All correspondences would be made and promptly reported to me personally. The position is part time and home-based meaning you can work most times from your home as long as you have a regular internet access. You are also hired on a trial basis for now until we are able to see how well we fit in, this however does not affect your weekly wage.Most of your activities will be carried out locally and most official packages will be delivered via posts. You will be actively involved in my personal, business and financial life. In summary, your activities as my assistant among other things will include;

Acting as an alternative telephone correspondence;
Running personal errands, supervisions and monitoring;
Organizing and maintaining diaries, memos and making appointments;
Dealing with incoming email, faxes and post;
Carrying out background research and presenting findings;
A personal reminder for Schedules, programs, flights and keeping me up to date with them as they come up;
Arranging travel and accommodation
Carrying out specific projects and research;
Taking on some of the my responsibilities and working more closely with management and other staff related to me;
Making regular contacts and drop-offs on my behalf.
Handling and monitoring financial activities.
Processing and taking charge of weekly payments and purchases.
You will also be a part of my household and a helping hand to issues as they arise.
General clerical activities.
Basic wage is 500 euro per week.
>
Any extra personal expenses (transport, gas, etc) incurred by you while on an errand or otherwise will also be reimbursed by me at the end of each working week.This position is very flexible and it is difficult judging the exact number of hours you will be doing, just bear it in mind that there will be busier weeks than others with a steady pay. Working with me is basically about instructions and following them, my only fear is that I may come at you impromptu sometimes, so I need someone who can be able to meet up with my irregular timings. There is also a very sensitive issue on trust, dedication and accountability which I believe will resolve itself as time goes on.
>
>
> This is only an introductory e-mail, as time goes on we should be able to arrange a proper meeting to get things started officially. I’m currently in England now for a project, however, I do have a number of things you could help me with immediately, prior to my arrival.Due to the excessive number of responses to my Ad, do provide the following details about yourself for my personal record update and to filter applicants;

> Full Names:
> Full Contact Address ( Not P.O BOX)
> City
> State
> Zip Code
> Phone Number (H)
> Phone Number (M)
> Occupation (if any)
> Age

I hope you can be available for me immediately before I arrive, it certainly can act as a stable foundation to our impending working relationship.I will be waiting in anticipation of a good response from you soon.
>
>
> Regards,
> Norman William
>
> On Friday, March 8, 2013, <@hotmail.com> wrote:
>> Dear Norman
>>
>> Further to viewing your posting for a Personal Assistant on the Glengarriff website, I would like to request any further detail regarding this vacancy that you are happy to provide at this time. I would welcome the opportunity to submit a tailored response to your advert and look forward to hearing from you in due course.
>>
>> Yours sincerely,
J

Nov. 23, 2012 EMAIL: Hello,

I’m John smith, 52yrs, and a father of 2 wonderful kids, a successful entrepreneur and investor. I’m also a research journalist and I travel every now and then within and outside the US working on various independent projects ( Artwork ), this is why I need someone who can help keep up to date with all of my activities especially when I’m away and amidst my busy schedule.

I would love to meet up with you to talk about this job but I am currently away on business in Australia , so there will be no interview.I will be back by the end of January . I will prepay you in advance to do my shopping. I will also have my mails and packages forwarded to your address. If you will be unable to stay at your house to get my mails, I can have it shipped to a post office near you and then you can pick it up at your convenience. When you get my mails/packages you are required to mail them to addresses that I will send you, and don’t worry, all expenses and taxes will be covered by me. I will be paying you $300 weekly. I need your service because I am constantly out of town.If you don’t mind I will meet up with you when I return and then we can talk about the possibility of making this long term.

I will email you the list and pictures of what to shop for when I am ready,no heavy packages is involved.You can do the shopping at Sears, Wal-Mart, Kmart and Best buy or any other stores. I will provide you my UPS account number for shipping. I will provide clear set of instructions for each task I need to be done as well as the funds to cover them. I will mail you money to do my shopping plus upfront payment for your service.

This position is home-based and flexible part time job,you can be in any location you will be working from your home doing all the activities.All you need do is to check your emails twice daily and keep your phone on most times in case I might need to call you from anywhere I may be.I do have a number of things you could help me with next week if you will be available to start.This can act as a stable foundation to our working relationship.

For proper review(since i am not available now to set up a face-to-face interview) supply out correctly the information below:
Full Name:
Full Address:
P.O.BOX:
City:
State:
Zip Code:
Phone Number:
Email:
Country: US
Age:
Salary: $300 weekly($1,200 monthly)
Also,there will be compensation for efficiency and hard working.

HEADER:

Return-Path: <johnsmith141984@southfloridaexplorers.org>
X-YahooFilteredBulk: 195.173.77.134
Received-SPF: none (domain of southfloridaexplorers.org does not designate permitted sender hosts)
X-YMailISG: RsIvlGAWLDv6WzES.OVpYvmh9kBT3ofYMJ5kYPDwH1nc5RZ8 6zpsBJGS5WpEXpWkcDMtW30am9n2Ky0GaKL2X74GJScVkZ1NED9iJ2knokdf bO9jpVhGCw9d3TjoMiRW0iO_Jk2zSFzuodBh2p0W6DyP5BAJMFnwveUb5CJP t3qk9zr1wI7sEZVnBQdC3gGy0b4y0fmO1.sh1.6NkIFM_BxFCVBzq1HpUdzs NKvhOadbGWpTaI223FxJznkMzk2IjqcsCj4fLmyMg03Et3XvL727mPh0IrZa Z2Tdz03isz6ggN46qxKmkgLrKCEpS4o0PvFjc3zVDvoIWrd2_BBwro8aTsWt 1k5UM3dlkC7HS7j.C.50czgHLbLhVHozjkYInMUNdTctSwqClACPMWqRl0tR n_QVx24y75zXLj7Qx_Q3vFFtVADbWCUEPNORbEKPSJjV42UCujs0LHeLE3x9 1KzoYJfR8RijQVy118uwNxQv9hDq.ANuUAfL2uZevBpD87158bvxMw2W7hlY DoOTJfsO.5UKR2vUNcV_vtSL622LRyZ9WQYGeLCzyce5yLwSV2xEQnq0oI2C nVd5SS1RPovRslSmidX_fSNT1LJ0xnjRF.gMMGpDrZAgRbNJe0qy9y.GZFjo W8lhN4GpLxEsWMWyeOSEONyxtqbg4O0g19fsI0r0uoSUFg4Bls0tIMEOz9m6 f_s_JEA3oYfeFovXxnmX10jnNifhZSpq7JOghhcIBGyMayJbBTOqYDg7g.i5 YdD_K2WptA7gRBmeknDbqKjiKiZcVekqjhb0ZKVKwDFHk_3kFQhnLLG1PblU tszT1QW39hVaDlv9bGPzPn4vKqnYHm5YpPW1vrsOV8mWRaHM0tvkZDKPelei E0GYT.RSHWTG5l8_FQAYSRaEYxHFOfe0BdropDVlsa5ofhoLR5tHBppiS9G4 lQJmiEnB.NRf5KJuF3l8CKOkxPap9uHAuXagQqaeiRgc.Sm1AN1qZ1w_ccs5 hih0zWBECpWskt36uzVn92_0UuEFXKlPbzzjbB_tk9J._Ud1TmATJbYjMNRN pQyvG9n8Vxx_5oIr2e5jTD.zbADU4uwlrIF4bxdaivw4wSLftAL_cK3AhKLW E5JGFvA_qMqKa9NipI9SxADWoKRjaHfmfQsFWZ0UvcoFqlr4fon_h9HNf_XN caW2Dwkh2cQgkJheLC4yojaLFB8P1ojCY.bwGQOcKjQeHHz7KFUuGoTajVNd riZiRYqrRxOGjIsGATrdB9b1Jb2L2xwPgnhh.mojn8abSW68Dj_KeUwjG.xX lJigVEXn5Vy5UfUqn9Uu9ht4UplxpasFYH_fRR0PZwN77sF7KTW98F.cSVDv R7WQ0JsDGI7lbSSMHWT7NfY8uqZDdvERbANY5Sz6W_C.N3OTNxvXpYU2CIs2 Yo8-
X-Originating-IP: [195.173.77.134]
Authentication-Results: mta1267.mail.sk1.yahoo.com from=southfloridaexplorers.org; domainkeys=neutral (no sig); from=southfloridaexplorers.org; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO anchor-post-3.mail.demon.net) (195.173.77.134) by mta1267.mail.sk1.yahoo.com with SMTP; Fri, 23 Nov 2012 11:24:28 -0800
Received: from [80.177.76.243] (helo=geemarc.com) by anchor-post-3.mail.demon.net with esmtp (Exim 4.69) id 1TbyrT-000362-nK; Fri, 23 Nov 2012 19:24:27 +0000
Received: from User ([24.97.23.218]) by geemarc.com with Microsoft SMTPSVC(6.0.3790.4675); Fri, 23 Nov 2012 19:24:25 +0000
Reply-To: <johnsmith141984@yahoo.com>
From:
“John Smith”<johnsmith141984@southfloridaexplorers.org>
Subject: Personal Assistant!! $300 weekly ($1,200 monthly)
Date: Fri, 23 Nov 2012 14:19:01 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Bcc:
Message-ID: <GDC01BHksQ6KLV47ozI00001290@geemarc.com>
X-OriginalArrivalTime: 23 Nov 2012 19:24:25.0312 (UTC) FILETIME=[26085600:01CDC9B0]
Content-Length: 2415

SEPTEMBER 2012 EMAIL – 

Subject Line: Personal Assistant!! $300 Weekly
From: “Smithson Smith” <johnsmith010218@me.com>

I would love to meet up with you to talk about this job but i am currently away
on business. I am presently in Madrid Spain for a short business trip so there
will be no interview. I will pre-pay you in advance to do my shopping. I will
also have my mails and packages forwarded to your address. If you will be unable
to stay at your house to get my mails, I can have it shipped to a post office
near you and then you can pick it up at your convenience. When you get my
mails/packages; you are required to mail them to where I want them mailed to.
You don’t have to put money out of your pocket, all you have to do is have
packages shipped to your house and do my shopping. You are allowed to open the
packages to reveal its content.

The content of the packages are computer,electronics,clothing, bibles business
and personal letters. All expenses and taxes will be covered by me. You will
work between 10 and 15hrs a month. How much will you charge per week? I will pay
$300.00 weekly for this position.That is not a bad offer is it? I need your
service because I am constantly out of town. I work in real estate and i own an
Art Gallery in Madrid. I will return to USA November, 2012 so this process will
be going on till i get back in November. If you don’t mind, I will meet up with
you when i return and then we can talk about the possibility of making this long
term.

Well, let me know if you are able to handle the position. Hope to hear from you,
i will email you the list and pictures of what to shop for when i am ready. No
heavy packages is involved, You can do the shopping at any nearest stores. You
will be shopping for Electronics and clothing’s. I will provide you my personal
UPS account number for Shipping. All you have to do is provide my account number
to UPS and shipping charges will be applied into the account. I will provide
clear set of instructions for each task i need done as well the funds to cover
them.

If I were to mail you money to do my shopping plus upfront payment for your
service, where would you want it mailed to? How should your name appear on the
money order/Cashier’s check Maybe you can provide me with the following details
below :

Full Name:
Full Address:
P.O.BOX:
City:
State:
Country: US
Zip Code:
Phone Number:
Age:

Thanks and please get back to me asap and
confirm this mail asap.

Sincerely

HEADER DETAILS:

Return-Path: <johnsmith010218@me.com>
X-YahooFilteredBulk: 69.61.100.40
Received-SPF: softfail (transitioning domain of me.com does not designate 69.61.100.40 as permitted sender)
X-Originating-IP: [69.61.100.40]
Authentication-Results: mta1183.mail.gq1.yahoo.com
Received: from 127.0.0.1 (EHLO vES2k301.AAILive.pri) (69.61.100.40) by mta1183.mail.gq1.yahoo.com
Received: from User ([66.15.126.19]) by vES2k301.AAILive.pri with Microsoft SMTPSVC(6.0.3790.3959);
Reply-To: johnsmith010218@yahoo.com
From: “Smithson Smith”<johnsmith010218@me.com>
Subject: Personal Assistant!! $300 Weekly
Return-Path: johnsmith010218@me.com
Message-ID: <VES2K301RNpggkzpB8J00005f7d@vES2k301.AAILive.pri>

John Smith <> johnsmith141984@southfloridaexplorers.org <> johnsmith141984@yahoo.com

This scammer is also using the IP address 82.128.39.179 Location: Lagos Nigeria – FROM THE INTERNATIONAL POLICE AUTHORITY UNITED STATES SECTION (INTERPOL)
Name: Luis Williamson
Email: luisiwilliams@gmail.com
Phone: +234-8059523125

62.49.15.17 – Leeds, Liverpool (UK)

MYSTERY SHOPPER (SECRET SHOPPER) – 195.173.77.134 and 41.155.42.70 which is a Lagos Nigeria IP location with a VERY bad IP that’s been black-listed on multiple anti-scam sites. Name: John Taylor – jtaylorcode@aol.com> Message ID: ATHENAxnIVgEkzyTwrk00000521@athena.shepherdeurope.local (and) 229e.efd194f.3c53d999@aol.com

41.155.42.70 also lists starcomms which is a telecom operator company in Nigeria

According to Project Honey Pot the IP address of 195.173.77.134 (which isn’t the scammers real life location but is used to confuse potential victims.) is a dictionary attacker, spam sender and mail server – believe is list of spam/scam sent by the same IP address. If you get an unknown email from this IP, stay away!

Example Messages Sent From 195.173.77.134
From:  Western Union info@westernunion.ch
Subject: Notification
From:  Hajia Zainab Hassan zhassan00@mail.com
Subject: Business Proposal  Response Required
From:  Hajia Zainab Hassan  zhassan00@mail.com
Subject: Business Proposal  Allah Afiz
From:  Hajia Zainab Hassan – zhassan00@mail.com
Subject: Business Proposal – Allah Afiz
From: “FHCD”<emersovest000@mail.com>
Subject: Security Alert .. Read Carefully And Respond ..
From:  Enquiry Notice  williamshaha@freenet.de
Subject: Answer This Questions.
From:  ANDY LAU  andylauboa@gmail.com
Subject: URGENT; DID YOU AUTHORISE LEE FUI FUI
From:  ANDY LAU  andylauboa@gmail.com
Subject: URGENT; DID YOU AUTHORISE LEE FUI FUI
From:  Dean Harry Associates – info@noreply.com
Subject: Will Execution
From:  Mrs. Grace Spencer  mrs_gracespencer@yahoo.co.uk
Subject: MESSAGE FROM GRACE SPENCER
From: Alain Othman  alainothman@ecotermo.ru
Subject: Inquiry for Investment
Below are usernames used by spammer/scammers using this same IP address
Example User Names Used By 195.173.77.134
User-namehui_winney
User-namemaisha.czysz
User-namefortnightguiltless3
User-namecharita_gahr
User-namejewel.f.dayley
User-namejosefina.t.alvorez
User-namekimberly_c_wehrmann
User-namemayola_bozzo
User-nameedakwong
User-namegrims2889
User-namelessig4902
User-namecloukidis4
User-namenella.s.stopp
User-namesheldon.ferell
User-namebranda.amour
User-nameroderick.keister
User-nameloan.forro
User-namekatharyn_seckler
User-nameknowingnoella
User-namelulu.w.eggert
User-nameywe3369
User-nameogbochner3
User-namepointlesspossibility4
User-namebrigitte_mouzas
User-nameaogan001
User-nameesotericphilbrook
User-namemsk2958
User-nameyuonne3910
User-namegerry.cromer
User-nameservopearlie

Visit Project Honey Pot if you would like to check out a particular IP address. If there is no information on that address and you believe it’s from a scammer then report him and let PHP do the rest! 🙂

When I look up information from this scammers email header (which is a Nigerian location) – a previous phishing scam I’ve added on October 10, 2012 pops up. To view the phishing scam click: hanscgroot@aim.com FYI, this phishing scam emailed under 41.138.187.80 by webmail-d041.sysops.aol.com ( 205.188.181.84 ) – Additional email addresses and scams in the comment box of that post as well.

 
1 Comment

Posted by on 11/23/2012 in Employment (Job) Scam

 

Tags: , , , , , , , , , , , , , , , , , , , ,

 
%d bloggers like this: