Looks like someone's spoofing a real cable company in China. We say spoof because we're fairly certain the real cable company wouldn't advocate the whole money transfer/mule scam process. The company site is at www.xhcable.com. Do you see this offer using a corporate email address? Nopers, not one of the (many) email addresses shown in this offer point there.

Collection agent is another job title used in these types of scams in the hopes it will distract you. The checks they send are fake. You'll withdraw what you can and wire transfer it to them, and a little while later the bank will notify you of the NSF and reverse the funds from your account, some of which you may have already parted with.

You want to know what seals the deal? There's an IP address in the headers, 41.220.75.3. A quick WHOIS shows the sender originated from Nigeria, forging the headers to make it look like the email address was from zheijiangcableincorporated.cn, which isn't even the cable company's Web site address!

You just wanted a job, right? This ain't it!

Message text:
REF: ZXC/090/09.

Dear Sir/Madam,

We avail ourselves of this opportunity to approach you for the establishment of
business relations with you. We are presently searching for Representatives /
Collection Agents who can help us establish a medium of getting to our
customers in the USA, Canada and Europe. If interested, Please contact us via
email: dliao.zhejiangcable @ btinternet.com for more information.

Respectfully Submitted,
Operations Manager.
Zhejiang Xinhua Cable Co, Ltd.
Latitude 15 Rd,Yueqing Economy Zone, Wenzhou, Zhejiang, China

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

Headers:
X-Originating-IP: [168.167.220.2]
Authentication-Results: mta252.mail.re4.yahoo.com from=zhejiangcableincorporated.cn; domainkeys=neutral (no sig); from=zhejiangcableincorporated.cn; dkim=neutral (no sig)
Received: from 168.167.220.2 (EHLO temo.bca.bw) (168.167.220.2)
     by mta252.mail.re4.yahoo.com with SMTP; Sat, 30 May 2009 06:03:03 -0700
Received: from www.bca.bw (localhost.localdomain [127.0.0.1])
     by temo.bca.bw (8.12.11/8.12.11) with ESMTP id n4UCwUq3016831;
     Sat, 30 May 2009 14:58:30 +0200
Received: from 41.220.75.3
     (SquirrelMail authenticated user pmalope)
     by www.bca.bw with HTTP;
     Sat, 30 May 2009 12:58:30 -0000 (GMT)
Date: Sat, 30 May 2009 12:58:30 -0000 (GMT)
Subject: Company Representative / Agent Wanted!
From: "Zhejiang Xinhua Cable Co, Ltd." <hire @ zhejiangcableincorporated.cn>
Reply-To: zhejiangcableincorporated @ 8u8.com
User-Agent: SquirrelMail/1.4.13
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-domain-MailScanner-Information: Please contact the ISP for more information
X-domain-MailScanner: Found to be clean
X-MailScanner-From: hire @ zhejiangcableincorporated.cn

WHOIS 41.220.75.3:
(Courtesy: http://whois.domaintools.com/41.220.75.3)
IP Location:       Nigeria  Nigeria Afrinic
Resolve Host:     mtnngprs.com
IP Address:     41.220.75.3
inetnum:        41.220.75.0 - 41.220.75.255
netname:        MTNNG-0001-MDSN01-OJT
descr:          IP Block Assigned for Mobile Data Services Network at Ojota
country:        NG
admin-c:        HM10-AFRINIC
tech-c:         HM10-AFRINIC
org:            ORG-MN1-AFRINIC
status:         ASSIGNED PA
mnt-by:         MTNNIGERA1-MNT
source:         AFRINIC # Filtered
parent:         41.220.64.0 - 41.220.79.255

organisation:   ORG-MN1-AFRINIC
org-name:       MTN Nigeria
org-type:       LIR
country:        NG
address:        Golden Plaza,
address:        Falomo Roundabout,
address:        Ikoyi
address:        Lagos
e-mail:         hostmaster @ mtnnigeria.net
e-mail:         chukwunk @ mtnnigeria.net
phone:          +234 803 200 5038
admin-c:        CN6-AFRINIC
tech-c:         BO5-AFRINIC
mnt-ref:        AFRINIC-HM-MNT
mnt-ref:        MTNNIGERA1-MNT
mnt-by:         AFRINIC-HM-MNT
source:         AFRINIC # Filtered

role:           HostMaster MTN_Nigeria
address:        Golden Plaza,
                Falomo Roundabout, Ikoyi
                Lagos State
                Nigeria
phone:          +2348032005038
phone:          +2348032009018
e-mail:         hostmaster @ mtnnigeria.net

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: