These guys can't make up their minds what to call themselves. The Subject line and From line say "Metal Group PLC" while the body of the message says "Metals UK Ltd." They address the email Dear Sir/Madam; the From addres and Reply-to address are completely unrelated; the job is as a payment rep, allegedly to collect "out standing" payments from their customers. The email is signed with a very English-speaking-person type of name. The From email address is forged because a WHOIS on the originating IP address shows it's from Nigeria, well-known for advance fee fraud scams.

What we're trying to say is this is a money transfer/mule scam and likely to cost you much, much more (frozen bank account, monetary loss, criminal charges, identity theft) than you could ever hope to make.

Message text:
Dear Sir/Madam

Metals UK Ltd is in search for a payment rep that will act as a link
between us and our customer and will also be responsible for the
collection of out standing payment from our customer to us. Interested
personnel should please Get Back To Us,

Regards
Jill Eastbury
International Logistics Controller

Headers:
Return-Path: <mtl @ communications.com>
Received: from servidor.peot.gob.pe ([200.121.57.71])
     by [removed] with SMTP id 0904250640_[removed]_762369_2690498;
     Sat, 25 Apr 2009 06:41:19 -0700 EST
Received: by servidor.peot.gob.pe (Postfix, from userid 48)
     id B0622D800A6; Sat, 25 Apr 2009 07:22:27 +0000 (UTC)
Received: from 196.207.3.12 (proxying for 10.0.0.62)
     (SquirrelMail authenticated user gerenciageneral)
     by www.peot.gob.pe with HTTP;
     Sat, 25 Apr 2009 07:22:27 -0000 (UTC)
Message-ID: <60503.196.207.3.12.1240644147.squirrel @ www.peot.gob.pe>
Date: Sat, 25 Apr 2009 07:22:27 -0000 (UTC)
Subject: Massage From Metal Group PLC.
From: "METAL GROUP PLC" <MTL @ communications.com>
Reply-To: metalgroupplc @ 9.cn
User-Agent: SquirrelMail/1.4.6-7.el4.centos4
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1

WHOIS sender IP 196.207.3.12:
(Courtesy: http://whois.domaintools.com/196.207.3.12 )
IP Location:       Nigeria  Nigeria Netcom Africa Limited
Resolve Host:     196-207-3-12.netcomng.com
IP Address:     196.207.3.12
person:       Kunle Abiola
address:      Dovelink Limited
              Lagos, NG
phone:        +234 803 327 2213
e-mail:       kchelsea2001 @ yahoo.com

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: