The sender makes the email appear to have come from the UK but actually originates from Israel. The offer is a money transfer/mule scam and should be avoided. They target American and Canadian recipients. The name used in the email is generic and doesn't match anything in the headers, which contain proof that the sender tried to forge information.

Message text:
Alfa Pumps & Systems announces a new job opening and proposes you to join
our team. Our company provides multiple services, including financial and
specifically escrow services for online auctions. Our clients are large
auctions with a large number like ebay.com, yahoo.com and private auctions
with a small number of clients.

All payments from our customers are processed via bank transfers. We need
to get payments for our products as soon as it possible to be able to
provide our services quickly. The problem is that we are unable to process
customer’s payments fast enough because international bank transfers take
about 7-15 working days to complete. We lose much money because of delays
that’s why we have opened this new job position for solving this problem.

Please note: this job takes 2-3 hours a day and gives much free time to be
employed elsewhere. We are looking only for applicants who meet our
requirements and can be successful employees in nearest future. (USA and
Canada Only)

Your functions:
1. Receive payments from our customers;
2. Deduct 8% (your commission);
3. Forward payments according instructions to any of our offices.

Financial Agent position is offered on Trial Period basis. If interested
reply to this email with the following information;
First name,
Last name,
Country (USA and Canada Only),
Age,
Contact phone.
Preferred call time.
.
Regards to you,
Waiting for reply
Paul Terry

Headers:
X-Originating-IP: [131.251.0.113]
Authentication-Results: mta107.mail.re4.yahoo.com  from=Cardiff.ac.uk; domainkeys=neutral (no sig)
Received: from 131.251.0.113  (EHLO hermes2.cf.ac.uk) (131.251.0.113)
  by mta107.mail.re4.yahoo.com with SMTP; Sun, 07 Dec 2008 08:48:59 -0800
Received: from walnut.cf.ac.uk ([131.251.0.13] helo=squirrel.cf.ac.uk)
    by hermes2.cf.ac.uk with smtp (Exim 4.69)
    (envelope-from <shamja @ cf.ac.uk>)
    id 1L9Mks-0004rD-5k; Sun, 07 Dec 2008 16:45:14 +0000
Received: from 131.251.0.136 (proxying for 217.21.79.163)
        (SquirrelMail authenticated user shamja)
        by walnut.cf.ac.uk with HTTP;
        Sun, 7 Dec 2008 16:45:14 -0000 (GMT)
Date: Sun, 7 Dec 2008 16:45:14 -0000 (GMT)
Subject: Important Notice!
From: aldhouse-greenmj @ Cardiff.ac.uk
Reply-To: 8185410 @ gmail.com
User-Agent: SquirrelMail/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
X-Priority: 3
Importance: Normal
X-Virus-Scanned: Cardiff University Sophos AV
Content-Length: 798
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by coldrain.net id mB7GpiVq028018

WHOIS sender IP 217.21.79.163:
(Courtesy: http://whois.domaintools.com/217.21.79.163)
IP Location:       Israel  Israel Il-ipplanet
Resolve Host:     217.21.79.163.satcom-systems.net
IP Address:     217.21.79.163
Blacklist Status:     Clear
inetnum:        217.21.64.0 - 217.21.95.255
org:            ORG-IPNL1-RIPE
netname:        IL-IPPLANET-20000926
descr:          Gilat Satcom
country:        IL
admin-c:        TECH6-RIPE
tech-c:         TECH6-RIPE
status:         ALLOCATED PA
remarks:        Please send abuse notifications to abuse @ ipplanet.com
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      AS12491-MNT
mnt-routes:     AS12491-MNT
source:         RIPE # Filtered
organisation:   ORG-IPNL1-RIPE
org-name:       Gilat Satcom
org-type:       LIR
address:        Gilat Satcom
                21 Yegia Kapayim St.
                49130 Petach-Tikva
                ISRAEL
phone:          +972 3 9255015
fax-no:         +972 3 9255116
admin-c:        AH2932-RIPE
admin-c:        ZIV1971-RIPE
mnt-ref:        AS12491-MNT
mnt-ref:        RIPE-NCC-HM-MNT
mnt-by:         RIPE-NCC-HM-MNT
source:         RIPE # Filtered
person:         Tech IP Planet
address:        21 Yegia Kapaim St.
address:        Petach-Tikva
address:        Israel
phone:          +972 3 9255015
fax-no:         +972 3 9217938
abuse-mailbox:  abuse @ gilat.net
nic-hdl:        TECH6-RIPE
mnt-by:         AS12491-MNT
source:         RIPE # Filtered
route:        217.21.76.0/22
descr:        Hally Computers and Engineering Ltd
origin:       AS15811
mnt-by:       HALLY-MNT
source:       RIPE # Filtered
route:          217.21.64.0/19
descr:          Gilat Satcom
origin:         AS12491
mnt-by:         AS12491-MNT
source:         RIPE # Filtered

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: