PhishBucket.org - West Union Group

May also smell like:
Cixi Sunway Trade Co. Ltd.
China Charity Foundation
China National Silk Import & Export Corp.
Spoof: Ait Automation Systems
Byzantine Art Co.
Anhui Guofeng Plastic Industry Co.

May also smell like:

PhishBucket Administrator - Another version

|2010-07-19 00:58:39

Wow, where to begin with this new version?

First, the greeting isn't something an English-speaking person would say. Next, they rave about how big their company is, but never once do they name it, except in the email address. As to that, the spaces in between every letter of the email address seem to just jump off the page at us. It's at that point you realize they're trying to impersonate Western Union. And did you notice all the spelling and grammar issues? Nice, eh?

These guys are still up to their tricks. If you look at the headers, you'll see that the recipient's spam filter caught it right away.

We just wanted YOU to know.

Message text:
Civilities

I introduce a large multinational enterprise the co-worker of the HR department of
which I am. Our company is engaged in different areas of activity, such as:
- consulting services– bank accounts opening and maintenance – private undertaking
services– etc.

We are looking for staff in Europe at the moment:
- wages 2300dollars+bonus
- 1-2 working hours per day
- flextime

If our offer is interesting for you send us the below information on our e-mail
address: c v @ h i r i n g - w e s t u n i o n . c o m [please delete spaces before
sending]

Name:Surname:Country:City:E-mail:Telephone Number:Mobile phone-number:

Attention! We need European residents only.

Please, write your Telephone Number and our manager will contact with you and answer
all your questions.

Headers:
Received: from p5B3F8E89.dip0.t-ipconnect.de ([91.63.142.137])
by [removed] with ESMTP id ZXT74730
for [removed]; Sat, 17 Jul 2010 172:30 +0100
Received: from 91.63.142.137 by mailstore1.secureserver.net; Sat, 17 Jul 2010 182:18 +0100
Message-ID:
From: "Pam.Capps"
To: [removed]
Subject: part-time job
Date: Sat, 17 Jul 2010 182:18 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01CB25C9.6E9DCA40"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Spam-Flag: YES
X-Spam-Status: Yes, hits=5.26 required=4.40 tests=RCVD_IN_SORBS_DUL=2.05,HTML_MESSAGE=0.00,BAYES_40=0.00,
MR_NOT_ATTRIBUTED_IP=0.20,FH_FAKE_RCVD_LINE_B=3.00,NO_RDNS2=0.01
version=3.2.1
X-Spam-Level: *****
X-Spam-Checker-Version: SpamAssassin 3.2.1 (1.0)