The sender is sending you to a page at TopResearchJobs.com (see WHOIS: http://whois.domaintools.com/topresearchjobs.com), yet he claims to be sending from CareerBuilder.com, which we just aren't buying. We're pretty sure CareerBuilder hasn't given this guy his own personal email address with them, which means it can be considered forged.

The job is supposed to be an executive manager position, but the duties read like a money transfer/mule scam (in a general way--we've learned how to read between the lines). The link is provided through a URL shortening service, which means you're REALLY taking your chances, since there's no guarantee you're going to TopResearchJobs.com or any legitimate site. In fact, you could end up loading a virus or malware, like a keylogger that keeps track of everything you type to try and obtain your passwords.

We're guessing you're not looking for this kind of hassle (or hustle). Oh, and our founder, who is AmeriCanadian, can verify that Canadians don't talk like that eh. ;)

Message text:
From: Fernando Brooks [Brooks @ careerbuilder.com]
Sent: Monday, October 19, 2009 10:45 PM
To: [removed]
Subject: [removed]: new offer

To: [removed]
From: Fernando Brooks

I thought you'd be interested in this page from TopResearchJobs.com

Link:
http : // plzlink.me/5bi

Comments:
Hello,
We found your CV on the Internet. Therefore we'd like to offer you a job
of an “Executive Manager”.
Our HR department studied your curriculum vitae and work experience
and highly recommends you for this  job in our company.
 The given position consists of the following tasks:
-  timely filing of reports on the carried out work
-  record keeping of customers in the USA.
You will receive more detailed instructions during an interview over the
phone.
Person specification :
- Age: starting from 25
-  Time: must have from 1 to 2 hours of free time a day for carrying out
his duties.
- Citizenship: US
Payment for this work makes up 7000 USD a month.
The payment will be carried out to your bank account every month.
There are many candidates willing to take up this offer, therefore we're
kindly asking you not to delay with your decision about this position.

You may find detailed information about our organization at our webpage.

If this work is interesting to you, then please follow these steps:
1)        Register at our webpage. To do so CLICK ON THE LINK AT THE TOP OF
LETTER.
After doing so click on registration of "Executive Manager".
Please fill out every field correctly, since data will be checked by our
security department.
2)        Pass an interview over the phone.
3)        Sign a contract with our company.

We would like to thank you beforehand and we're looking forward to a
long-term cooperation.

Headers:
Return-Path: <researchjobs @ topresearchjobs.com>
X-Cloudmark-Score: 0
X-Connecting-IP: 209.216.201.18
X-Authority-Analysis: v=1.0 c=1 a=k1K9IpDlMI4A:10 a=ayC55rCoAAAA:8 a=lB5i6VerAAAA:8
a=bfajqqtzAAAA:8 a=_r7_k7onKK6mL4GGfCgA:9 a=ybFVzGHckoFs9iyELecA:7
a=SVJ7bOac5hapVTAIEitixjBiG3YA:4 a=B_aCAJXf4BQA:10 a=yVzzMDCNPgwX_NFW:21
a=vHU0dLW-lTb9PnZA:21
Received: from [209.216.201.18] ([209.216.201.18:41492] helo=admin.topresearchjobs.com)
        by [removed] (envelope-from <researchjobs @ topresearchjobs.com>)
        (ecelerity 2.2.2.39 r()) with ESMTP
        id AE/77-00623-2723DDA4; Tue, 20 Oct 2009 03:45:55 +0000
Received: (qmail 30058 invoked by uid 10001); 19 Oct 2009 20:45:03 -0700
Date: 19 Oct 2009 20:45:03 -0700
To: =?UTF-8?q?[removed]?= <[removed]>
Subject: [removed]: new offer
From: Fernando Brooks <Brooks @ careerbuilder.com>
Reply-To: <Brooks @ careerbuilder.com>
Precedence: bulk
Errors-To: TopResearchJobs.com <researchjobs @ topresearchjobs.com>
X-Mailer: http://www.phpclasses.org/mimemessage $Revision: 1.70 $ (mail)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Message-ID: <20091019204503.0099.researchjobs @ topresearchjobs.com>

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: