We suspect these guys want to make you feel like you're part of something bigger, but criminal mule ring probably wasn't quite what you had in mind.

This reads like a money transfer/mule scam (for proof, simply compare to the other money transfer/mule offers we've reported), which means you'd lose money and probably your identity by getting involved. The hallmarks are all there: the odd salutation; the unprofessional tone; the claim to be in the UK requiring someone to take their US payments; the Gmail reply address; the Craigslist reference in the headers; the sender origin of Lebanon (as opposed to Cardiff, where they claim to be).

Message text:
Good day,

Would you like to work from home and get paid weekly, without affecting your
present job?

Malvern Cosmetics needs a book-keeper in your state to be part of its financial
team. You are to work at home and get paid weekly without leaving or affecting your present
job.

Malvern Cosmetics is primarily a Skin Care company based in the UK,we need someone
to work for the company as a
representative/book keeper in the States. We make products like Cellex-C Products,
DCL Products, DDF Skincare,
Jan Marini Skin Care, which of course, we have various customers we make supplies to
weekly in the States.

***YOUR TASK IS TO CO-ORDINATE PAYMENTS FROM CUSTOMERS AND HELP US WITH
THE PAYMENT PROCESSING***
This is in view of not having an office presently in your Country.
You dont need to have an Office and this certainly wont disturb any form of
work you have going on at the moment.

BENEFIT IS AS FOLLOWS:-
* The average monthly income is about $2000 USD....
* No form of investments from you....
* This job takes only 1-3 hours per day....

If you are interested in being our representative please write back to this
email:....{malverncosmetics1 @ gmail.com}
with the informations asked below to start receiving payments from our customers and
start cashing right away.

Kindly Fill out the form below and we will be glad to get back to you within 12 hours.
APPLICATION FORM

Full Name........
Contact Address........
Zip Code.........
City.................
State............
Country..............
Home Phone.......
Cell Phone...........
Email..............
Age...........
Occupation........

Best Regards,
Malvern Cosmetics

Malvern Cosmetics
17a Station Road,
Llanishen,
CARDIFF,
CF14 5LS

Headers:
Return-Path: <jobs @ craiglist.org>
Delivered-To: [removed]
Received: from Postfix filter 42a77884ce2a0a03efc6bb50a6dcdb21 (smtp-in-132 [127.0.0.1])
by smtp-in-132.livemail.co.uk (Postfix) with SMTP id 9EB711E69C4
for [removed]; Wed, 30 Dec 2009 21:06:43 +0000 (GMT)
Received: from mail.sandstormnet.com (static-71-123-233-68.dllstx.fios.verizon.net [71.123.233.68])
by smtp-in-132.livemail.co.uk (Postfix) with ESMTP id 3EBEA1E69B2
for [removed]; Wed, 30 Dec 2009 21:06:43 +0000 (GMT)
Received: from mail.richins.org ([172.16.0.108])
by mail.sandstormnet.com with esmtp (Exim 4.63)
(envelope-from <jobs @ craiglist.org>)
id 1NQ5kO-0004tC-JB
for [removed]; Wed, 30 Dec 2009 15:06:27 -0600
Received: from User ([77.42.247.115]) by mail.richins.org with Microsoft SMTPSVC(6.0.3790.1830);
Wed, 30 Dec 2009 14:51:10 -0600
Reply-To: <malverncosmetics1 @ gmail.com>
From: "Malvern Cosmetics" <jobs @ craiglist.org>
Subject: Employment Opportunity
Date: Wed, 30 Dec 2009 22:44:25 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <RICHWEBONKfv0jdPT5u00003b83 @ mail.richins.org>
X-OriginalArrivalTime: 30 Dec 2009 20:51:11.0064 (UTC) FILETIME=[D171CD80:01CA8991]
X-Spam-Score: 11.2 (+++++++++++)
X-Spam-Report: Spam detection software, running on the system "ss-mail-01.plgn.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Good day, Would you like to work from home and get paid weekly,
without affecting your present job? Malvern Cosmetics needs a book-keeper
in your state to be part of its financial team. You are to work at home and
get paid weekly without leaving or affecting your present job. [...]
Content analysis details: (11.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 DNS_FROM_RFC_DSN RBL: Envelope sender in dsn.rfc-ignorant.org
1.6 MISSING_HEADERS Missing To: header
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.8 DOS_OE_TO_MX Delivered direct to MX with OE headers
To: undisclosed-recipients: ;
X-Original-To: [removed]

WHOIS sender IP 77.42.247.115:
(Courtesy: http://whois.domaintools.com/77.42.247.115)
netname: OGERONET
remarks: INFRA-AW
descr: Corporate 2
country: lb
admin-c: AD12345-TC
tech-c: NA12345-GS
status: Assigned PA
mnt-by: toufic-mnt
source: RIPE # Filtered
person: Toufic Chebaro
address: Mina El Hosn Beirut Lebanon
phone: +9611374610
nic-hdl: AD12345-TC
source: RIPE # Filtered
person: Gaby Smayra
address: Mina El Hosn Beirut Lebanon
phone: +9613081349
nic-hdl: NA12345-GS
source: RIPE # Filtered
route: 77.42.240.0/21
descr: Corporate 2
origin: AS42003
mnt-by: toufic-mnt
source: RIPE # Filtered

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: