If you learn how to read headers you'll discover that this offer was routed though a proxy server from its original location before reaching the recipient. The origin of the email? Japan. You can see in the first paragraph that the person writing is not natively English-speaking. The name "Michael Howard" is very generic; suspicious offers from foreigners very often contain names that sound like two first names, because they want to sound as 'English' as possible. They want you to respond to a generic, FREE email account, yet they point you to a domain (that apparently contains similar 'work-at-home' offers). The body of the email strikes us as a 'canned' letter, particularly where they filled in the job title. And finally, if you're still not won over that this is questionable, take a look at the info they want. Age, sex and nationality. Sure, we all know you have to be a certain age to have a job, and perhaps nationality would be important to a legitimate employer, but no one should ever be asking your gender.

Message text:
Greetings,

We are in need of MYSTERY SHOPPER WANTED earn no less than $500. Need extra
income become our [ MYSTERY SHOPPER]: earn no less than $500 per venture it
is very easy and very simple no application fees.

1}FULL NAME
2}FULL HOME ADDRESS
3}CITY
4}ZIP CODE
5}STATE
6}PHONE NUMBER
7}AGE
8}SEX
9}OCCUPATION
10}NATIONALITY
11}MARRIED
12}EMAIL ADDRESS

If you are interested in our offer, please respond with the information
listed above via our email : m.shopper101 @ rocketmail.com.
in order for us to move forward.

Best Regards,

The Hiring Manager
Michael Howard.

http :// www .workathomeincome.com
+1310-878-9647

Headers:
Return-Path: <m.shopper101 @ rocketmail.com>
Received: from proxy1.addr.com ([38.113.244.28])
     by [removed] with SMTP id 0904080619_[removed]_648628_26077694;
     Wed, 08 Apr 2009 06:20:34 -0700 EST
Received: from 61.116.180.175 (addr40.addr.com [38.113.244.204])
     by proxy1.addr.com (8.12.11/8.12.8/Submit) with ESMTP id n38BYQwT054047;
     Wed, 8 Apr 2009 04:34:27 -0700 (PDT)
Received: from phpmailer ([61.116.180.175])
     by 61.116.180.175 with HTTP (UebiMiau);
     Wed, 8 Apr 2009 04:29:45 -0700
Date: Wed, 8 Apr 2009 04:29:45 -0700
To: undisclosed-recipients:;
From: "Michael Howard." <m.shopper101 @ rocketmail.com>
Reply-to: "Michael Howard." <m.shopper101 @ rocketmail.com>
Subject: MYSTERY SHOPPER NEEDED!
Message-ID: <1ef7f29566a7aa5cffa09e22efc82454 @ 61.116.180.175>
X-Priority: 3
X-Mailer: UebiMiau [PHPMailer version 1.70 - ADDR]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

WHOIS sender IP (Japan): http://whois.domaintools.com/61.116.180.175

WHOIS workathomeincome.com (hiding behind registrar): http://whois.domaintools.com/workathomeincome.com

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: