These guys tried to pull one over on their victim by making this money transfer/mule scam look like it came from CareerBuilder, but in our eyes they failed. Their headers give away an originating IP of 172.158.243.16 which is AOL in Germany, and passes through Earthlink (IP 209.86.89.67). So although they tried to make it look convincing, it was kind of lame. The wording of the offer took us the rest of the way in confirming our suspicions. Bottom line: it's designed to rob you of money and your identity, so unless that's the kind of thing you're into, we'd suggest moving on.

We've reported this to CareerBuilder to have them investigate the Account ID and User ID shown at the bottom of the message to see if they really exist. Our guess though is that CareerBuilder won't find a record for this account/user. We think it's just plain fake.

Message text:

 

 

 

(Image above added by PhishBucket. Images displayed in this message were actually called: cid:image001.gif @ 01CA3E74.70812240 and cid:image008.gif @ 01CA3E74.70812240 but were not submitted.)

Dear Candidate,

After viewing your resume on careerbuilder.com, we have decided to contact
you regarding an offer. We have an exciting opportunity with our company
for: Accounts Payable Manager/Payments Processor in your area with no need
of relocation.

New concept: Commissions without sales!!

Job Type:
.       Accounting - Finance
.       Admin - Clerical
.       Customer Service

Requirements:
.       Must have Microsoft Office Intermediate experience, checking emails
3 times/day
.       US citizen or permanent residence/green card holder
.       Desired Education Level: High School
.       Experience: N/A
.       Required Travel: NO
.       Relocation: NO

Benefits:
.       Attractive bonuses and commissions with each order
.       No contact with our clients

Salary and commissions:
.       Compensation: $85,000 - $95,000 per year
.       Employee Type: Full-Time/Part-Time Employee

Please let me know if you are interested.

Hiring Department

You are receiving this employment opportunity email because you uploaded
your resume on CareerBuilder. If your employment status has changed or you
no longer wish to receive these emails, you can update your privacy and
communication preferences from your resume by logging onto CareerBuilder.com
or you can block this employer from viewing your resume and sending you
candidate emails.
This email was sent from Account ID F893KIO989343KOA2 and by this logged in
User OKDYW93499
You are currently subscribed to receive "CareerBuilder.com Customer
Messages".
C CareerBuilder.com 5550-A Peachtree Parkway, Suite 200 | Norcross GA 30092

Headers:
Return-path: <candidateemail @ site.careerbuilder.com>
Received: from elasmtp-scoter.atl.sa.earthlink.net ([unknown] [209.86.89.67])
 by vms169133.mailsrvcs.net
 (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009))
 with ESMTP id <0KWU0017VB04VKI1 @ vms169133.mailsrvcs.net> for
 [removed]; Mon, 25 Jan 2010 23:52:53 -0600 (CST)
Received: from [172.158.243.16] (helo=work)
 by elasmtp-scoter.atl.sa.earthlink.net with esmtpa (Exim 4.67)
 (envelope-from <candidateemail @ site.careerbuilder.com>)
 id 1NZeLq-000264-90; Tue, 26 Jan 2010 00:52:39 -0500
Date: Tue, 26 Jan 2010 15:44:52 +0400
From: "Careerbuilder" <candidateemail @ site.careerbuilder.com>
Subject: We are looking for 10 representatives
X-Originating-IP: [209.86.89.67]
X-Originating-IP: 172.158.243.16
To: [removed]
Reply-to: <sslhireacc @ aol.com>
Message-id: <059401ca9e7d$3ec9e5c0$bc5db140$ @ careerbuilder.com>
MIME-version: 1.0
X-Mailer: Microsoft Office Outlook 12.0
Content-type: multipart/related;
 boundary="----=_NextPart_000_0595_01CA9E9E.C5DB85C0"
Content-language: en-us
Importance: High
X-Priority: 1 (Highest)
X-MSMail-priority: High
Thread-index: Acqebhv7G+UUgDBmRwmLLK1aWf4PTA==
X-ELNK-Trace:
69bff1acae05425d9754d821b67677929ef193a6bfc3dd48dbfa0b13fbf104f42c9ba339414
5f7f5ac30c6e5e32ee181350badd9bab72f9c350badd9bab72f9c
Original-recipient: rfc822;[removed]

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: