Though it doesn't say, we're 99% sure this is a money transfer/mule scam. They are asking only for a few pieces of name and provide absolutely no other information. We know it's about a job because of the subject line in the headers. Looking at the headers closely shows a spam rating of 45, and a lot of different IP addresses, indicating the sender was trying to mask his origin. Unfortunately, the headers show the originating IP and the location is Nigeria, home of the 419 scam, also known as advance fee fraud.

Message text:
COMPANY REPRESENTAIVE NEEDED CONTACT US WITH 1)Full Name (2)Full Address (3)Phone
Number(4)Occupation and Age

Headers:
Return-Path: <allangrainger @ sasktel.net>
Received: from proton.sasknet.sk.ca ([142.165.20.178])
     by [removed] with SMTP id 0904240525_[removed]_784202_20435459;
     Fri, 24 Apr 2009 05:27:00 -0700 EST
Received: from pps.filterd (proton [127.0.0.1])
     by proton.sasknet.sk.ca (8.14.3/8.14.3) with SMTP id n3OCIPAY001804;
     Fri, 24 Apr 2009 06:22:34 -0600
Received: from bgmpomr1.sasknet.sk.ca (bgmpOMR1.sasknet.sk.ca [142.165.72.22])
     by proton.sasknet.sk.ca with ESMTP id du5jjnvby-1;
     Fri, 24 Apr 2009 06:22:34 -0600
Received: from sasktel.net ([192.168.234.97]) by bgmpomr1.sasknet.sk.ca
     (SaskTel eMessaging Service)
     with ESMTP id <0KIL00JZOUDL3D10 @ bgmpomr1.sasknet.sk.ca>; Fri,
     24 Apr 2009 06:22:34 -0600 (CST)
Received: from [192.168.234.25] (Forwarded-For: [196.3.182.250])
     by cgmail1.sasknet.sk.ca (mshttpd); Fri, 24 Apr 2009 05:22:33 -0700
Date: Fri, 24 Apr 2009 05:22:33 -0700
From: all gra <allangrainger @ sasktel.net>
Subject: Region- Job Opportunities
Reply-to: tianingjing_1978 @ yahoo.co.jp
Message-id: <3af8bc5c6ae6.49f14c99 @ sasktel.net>
MIME-version: 1.0
X-Mailer: Sun Java(tm) System Messenger Express 6.1 HotFix 0.20 (built Feb 27
     2006)
Content-type: text/html; charset=us-ascii
Content-language: en
Content-transfer-encoding: 7BIT
Content-disposition: inline
X-Accept-Language: en
Priority: normal
X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.7400:2.4.4,1.2.40,4.0.166 definitions=2009-04-24_05:2009-04-23,2009-04-24,2009-04-24 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=default score=45 spamscore=45 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=5.0.0-0811170000 definitions=main-0904240051
To: [removed]

WHOIS 196.3.182.250:
(Courtesy: http://whois.domaintools.com/196.3.182.250)
IP Location:       Nigeria  Nigeria Lagos Afrinic
IP Address:     196.3.182.250
person:              Ladi Okuyene
address:      B2 Broadband Ltd.
              Wuse II postoffice,
              PO Box, 13235,
              Wuse II,
              Abuja,
              FCT,
              Nigeria
phone:              +2349523106
fax-no:              +2349523107
e-mail:              l.okuyene @ suburbantelecom.com
person:         Olaosebikan adeyemi
address:        30 Blantyre Street
                Wuse II Abuja
                Nigeria
phone:          +2348063073758
fax-no:         +2348063073758
e-mail:         o.adeyemi @ suburbantelecom.com

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: