Just another bogus money transfer/mule offer masquerading as a mystery shopper offer. We know this because the headers show the email originated from Nigeria, home of the money mule scam. These scams, originally known as '419' or advance fee fraud, are really all efforts to rob you or launder stolen money through you. No matter how you slice it, they're trying to get you to do something that will hurt YOU. If you get robbed, they win. If you get caught, they win. Because they can always hire another mule. Don't be one, okay?

Message text:
There is no charge to become a secret shopper/Great opportunity to
have fun and get paid while Shopping. Your job will be to evaluate and
comment on Customer Service in a wide Variety of shops,Stores,
restaurant and services in your Area.

You'll be paid to shop and dine out-plus,you can also get free meals,
Free merchandise, Free services, free Entertainment, Free travel and
more. Great Pay. Fun Work. Flexible Schedules.No experience
required.If you can shop-you are qualified!

For Information on how to get started
contact

Mr. John Martins
Recruiting Officer
PYC Mystery Shopper LLC
zeedmonth00 @ aol.com

Headers:
Return-Path: <do_not_reply @ shopper.com>
Received: from mail.Pioneersholding.com (mail.pioneersholding.com
[217.139.37.38])
        by mx.google.com with ESMTP id u10si1198588bkz.89.2010.03.18.15.58.40;
        Thu, 18 Mar 2010 15:58:41 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning
do_not_reply @ shopper.com does not designate 217.139.37.38 as permitted
sender) client-ip=217.139.37.38;
Authentication-Results: mx.google.com; spf=softfail (google.com:
domain of transitioning do_not_reply @ shopper.com does not designate
217.139.37.38 as permitted sender) smtp.mail=do_not_reply @ shopper.com
Received: from User ([82.128.22.36]) by mail.Pioneersholding.com with
Microsoft SMTPSVC(6.0.3790.3959);
         Fri, 19 Mar 2010 00:58:53 +0200
From: "John Martins"<do_not_reply @ shopper.com>
Subject: 2010 Secret Shopper Recruitment Process
Date: Thu, 18 Mar 2010 23:58:30 +0100
MIME-Version: 1.0
Content-Type: text/plain;
        charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Return-Path: do_not_reply @ shopper.com
Message-ID: <FRONT02idcDjoYAPNXR000005d4 @ mail.Pioneersholding.com>
X-OriginalArrivalTime: 18 Mar 2010 22:58:55.0259 (UTC)
FILETIME=[95E1A6B0:01CAC6EE]

WHOIS IP 82.128.22.36:
(Courtesy: http://whois.domaintools.com/82.128.22.36)
IP Location:       Nigeria  Nigeria Lagos Multi-links Telecommunications Limited
Resolve Host:     ml82.128.22.36.multilinks.com
IP Address:     82.128.22.36
inetnum:      82.128.0.0 - 82.128.127.255
org:          ORG-AFNC1-RIPE
netname:      AFRINIC-NET-TRANSFERRED-20050223
descr:        This network has been transferred to AFRINIC
remarks:      These IP addresses are assigned in the AFRINIC region.
remarks:      Authoritative registration information for this network
remarks:      is available for query and modification in
remarks:      the AFRINIC whois database: whois.afrinic.net or
remarks:      web site: http://www.afrinic.net
remarks:      The routing registry information (route(6) objects)
remarks:      may be published in any Routing Registry, including
remarks:      RIPE Whois Database
country:      EU # country is really somewhere in African Region
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
status:       ALLOCATED PA
mnt-by:       RIPE-NCC-HM-MNT
mnt-routes:   RIPE-NCC-RPSL-MNT
source:       RIPE # Filtered
organisation: ORG-AFNC1-RIPE
org-name:     African Internet Numbers Registry
org-type:     RIR
address:      see http://www.afrinic.net
e-mail:       bitbucket @ ripe.net
admin-c:      AFRI-RIPE
tech-c:       AFRI-RIPE
remarks:      For more information on AFRINIC assigned blocks, use
remarks:      AFRINIC's whois database, whois.afrinic.net.
mnt-ref:      RIPE-NCC-HM-MNT
mnt-by:       RIPE-NCC-HM-MNT
source:       RIPE # Filtered

Comments

Add New Search RSS

The views expressed and the links provided on our comment pages are the personal views of individual contributors and do not necessarily reflect the views of PhishBucket.org.

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: