FRAUD - Assistant Manager Position at Shipping Solutions

Look at this scam email I received. Initial mails came true via Eures
>>>>>>>>>>>>>>>>>

Assistant Manager Position at Shipping Solutions

Thank you for being interested in Assistant Manager position, offered by Shipping Solutions.

About the Company
Shipping Solutions is a technology driven international distribution and logistics company. It has a strong presence in every major country and extensive experience in the courier and expedited cargo industry. We pride ourselves on our competitive, but extremely friendly and family oriented work environment. Our culture promotes continuous personal and professional growth, based on principles of respect, integrity, and achievement. We seek to attract and develop the most capable and skilled individuals to help us serving new clients, grow into new markets and develop new campaigns. Our company strongly believes in developing our people from an entry-level position into the future leaders of our organization.

About the Job
We are looking for individuals with a "team player" attitude, great communication skills, a great work ethic, with a flexible working schedule. We offer competitive salary and excellent benefits and are committed to demonstrating our values in all our interactions. In other words, we're a great place to work!

Join a fast-paced start up that is making history with our customers and the shipping industry. If you're a smart, self-starter with a passion to make a difference, let us hear from you. Check out the detailed job description, pay rate, hours and terms at:

http://www.ship-solutions.eu/jobs.html

To apply for the Assistant Manager position, please visit the website above and fill out the application form. Every applicant will get a reply within 3 business days. We are looking forward to welcoming you to the Shipping Solutions team.

Thank you.

Have a nice day.

Best Regards,
David Fisher
Senior HR Manager,
Shipping Solutions

OUR BENEFITS:
• Competitive Salary
• Commission/Bonus Plan
• Flexible Hours
• Medical, Dental, Vision
• Full Training
• No Experience Needed
• Growth Opportunities
• Paid Vacation
• No Hidden Fees

OUR WEBSITE:
www.ship-solutions.eu

OUR ADDRESS:
Shipping Solutions, Inc.
800 West 47th Street
Kansas City, MO 64112
United States



Shipping Solutions
800 West 47th Street, Kansas City, Missouri 64112, United States
Phone: +1 (206) 426-7081 // Fax: +1 (206) 426-7081
Email: [email protected] // Website: www.ship-solutions.eu

Thankyou dutchess for posting the story. From what I can gather shipping solutions formally called Globe. Globe had been in operation for a number of years it would appear. The name david fisher is well known in scam land whereby it has been used previous with regularity.

Your most welcome, I have much more to this story:

1) The initial mail came in tru Eures job portal (before Shipping Solutions announced themselves)
2) This mail was written in my native language Dutch, from small spelling mistakes I made out its just a good translation from English. Interesting note that these scammers do try to get smarter by each day..
but luckily me too
3) This mail came from a Dutch email address however the header of that mail clearly pointed to NC, USA
From: [email protected]
Reply-To: [email protected]
4) All following mails when Shipping Soltions announced themselves,
the headers are now pointing to center of New York USA

Find below the complete 1st initial mail + header :

Authentication-Results: xxxx.com; sender-id=temperror (sender IP is 194.109.24.35) [email protected]; dkim=none header.d=xs4all.nl; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: [email protected]
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Info: 6sSXyD95QpWupOmjzhesCaocvnSQhDJbSeliak8TaKeQi0vGS8qbw/pVMtCPJqCP2VPREag2L7qFvVaocd/lwMYBHAq/Q8Jrysr9axYdHqdIVhR+o7jbKJsXVSe8ubMzQ5tpMOHe1f0=
Received: from smtp-vbr15.xs4all.nl ([194.109.24.35]) by bay0-mc3-f35.Bay0.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 22 Aug 2011 15:43:38 -0700
Received: from workstation1 (cpe-174-107-131-081.sc.res.rr.com [174.107.131.81])
(authenticated bits=0)
by smtp-vbr15.xs4all.nl (8.13.8/8.13. with ESMTP id p7MMhar7064671
for <xxxx@xxxx>; Tue, 23 Aug 2011 00:43:37 +0200 (CEST)
(envelope-from [email protected])
MIME-Version: 1.0
Date: Mon, 22 Aug 2011 18:43:27 -0400
X-Priority: 3 (Normal)
Subject: Jobaanbieding
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: [email protected]
Reply-To: [email protected]
To: xxxx
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Message-ID: <CHILKAT-MID-a9212206-81d5-befb-c988-0845aa8eaac8@workstation1>
X-Virus-Scanned: by XS4ALL Virus Scanner
Return-Path: [email protected]
X-OriginalArrivalTime: 22 Aug 2011 22:43:38.0928 (UTC) FILETIME=[EF562300:01CC611C]


Goedemiddag!

Het snel ontwikkelen van internationale onderneming biedt een uitstekende kans om extra inkomsten. Op dit moment is er een open vacature van Assistent Manager. Dit is een werk thuis met flexibele werktijden. U hoeft niet aan speciale kennis en vaardigheden om te beginnen. U hoeft niet om geld te investeren of om de contributie te betalen. U zal slechts enkele uren nodig hebben een week en kun je makkelijk combineren ons aanbod met uw algemene activiteiten.

Onze voordelen:
- Vaste beloning
- Provisies en bonussen
- Flexibele werktijden
- Gratis bijles
- Medische verzekering
- Het werk ervaring is niet vereist
- Je hoeft niet te betalen voor iets

Onze eisen:
- Kennis van het Engels taal
- Minimale leeftijd 25 jaar
- Gezelligheid en verantwoordelijkheid
- Verlangen om te werken en te verdienen

Als U geïnteresseerd bent in ons aanbod, alstublieft, stuur bericht naar mijn persoonlijke e-mail - [email protected] - en we sturen de gedetailleerde informatie over over het bedrijf en de aangeboden functie.

Dank u.

Een mooie dag verder!

Eerbiedig,
Mark Sanders,
Work Part Time, LLC

The header is interesting because part of it doesn't seem right in my opinion. I'm no expert on headers but It appears to be from rr.com and probably someone having a piggyback on markmonitor.
rr.com seems to be legitimate and would have no knowledge one of their workstations is like a relay.
The name markasanders comes up here http://lists.cleanmx.com/pipermail/phis ... 04037.html but cannot find anything else.

More headers from Shipping Solutions : pls comment


1

Authentication-Results: xxxx.com; sender-id=temperror (sender IP is 66.192.165.130) [email protected]; dkim=none header.d=ship-solutions.eu; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: Shipping Solutions <[email protected]>
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtTQ0w9MQ==
X-Message-Info: JGTYoYF78jEq1mLwYH7xZXnURbZ2BrjBwqQc8dSYZTAe+Gznk1EhXZbXYzQ9eMVV/vZAGjEpVOlrhiT3juUN3c3u+m4+nvI011ckFisnzP7icZNxCtzLQM3RmKThBiAcw5BG8T7bS9k=
Received: from drone11.ral.icpbounce.com ([66.192.165.130]) by bay0-mc3-f18.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 24 Aug 2011 23:19:33 -0700
Date: Thu, 25 Aug 2011 02:17:51 -0400
To: xxxx@xxxx
From: "Shipping Solutions" <[email protected]>
Subject: Werk Thuis Vacature van Assistent Manager
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.codeworxtech.com) [version 2.2]
Errors-To: [email protected]
List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=1076506653&l=157593&s=NK7X&m=31351524&c=97175>
X-List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=1076506653&l=157593&s=NK7X&m=31351524&c=97175>
X-Unsubscribe-Web: <https://app.icontact.com/icp/listunsubscribe.php?r=1076506653&l=157593&s=NK7X&m=31351524&c=97175>
X-ICPINFO:
X-Return-Path-Hint: [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_705c497d465fcbedf51ce9e9ee6474d4"
Message-Id: <[email protected]>
Return-Path: [email protected]
X-OriginalArrivalTime: 25 Aug 2011 06:19:33.0931 (UTC) FILETIME=[F503D7B0:01CC62EE]


2

Authentication-Results: xxxx.com; sender-id=temperror (sender IP is 209.85.216.181) [email protected]; dkim=none header.d=shipping-solutions.eu; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: Shipping Solutions <[email protected]>
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==
X-Message-Info: DFa+w7oqK+9KtdTT4RrJBZ+RwbuQv6rfMYh3htybbdfAKZScnNCA8Uu4sIxI4T63SWTad1hMp+oAZ9ZEkc20X77n1FsqegPk04tIkML/WdkZrtymgDy+MSkop/pJFvwI5GFp6OrQU38=
Received: from mail-qy0-f181.google.com ([209.85.216.181]) by col0-mc1-f43.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 20 Sep 2011 06:47:48 -0700
Received: by mail-qy0-f181.google.com with SMTP id 7so564904qyk.5
for <xxxx@xxxx>; Tue, 20 Sep 2011 06:47:48 -0700 (PDT)
Received: by 10.224.208.67 with SMTP id gb3mr646894qab.396.1316526467913;
Tue, 20 Sep 2011 06:47:47 -0700 (PDT)
Return-Path: <[email protected]>
Received: from MacBook ([69.10.56.82])
by mx.google.com with ESMTPS id hr6sm1601685qab.6.2011.09.20.06.47.44
(version=SSLv3 cipher=OTHER);
Tue, 20 Sep 2011 06:47:47 -0700 (PDT)
Date: Tue, 20 Sep 2011 07:48:25 -0600
From: Shipping Solutions <[email protected]>
Reply-To: Shipping Solutions <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: xxxx@xxxx
Subject: xxxx
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=windows-1251
Content-Transfer-Encoding: quoted-printable
X-OriginalArrivalTime: 20 Sep 2011 13:47:48.0142 (UTC) FILETIME=[E1F444E0:01CC779B]

Header #1
Appears to be originating from the computer with IP address 66.192.165.130
From: drone11.ral.icpbounce.com
And #2
Seems to have originated from the computer with IP address 69.10.56.82
ISP is INTERSERVER.NET

Yes, my analysis show following:

Analysis header # 1:
The source host name is "drone11.ral.icpbounce.com" and the source IP address is 66.192.165.130.

Geo-Location Information
Country United States
State/Region NC
City Raleigh

Analysis header # 2:
The source IP address is 69.10.56.82.

Geo-Location Information
Country United States
State/Region NY
City New York

Note : After 1st contact made (header # 1) all the email traffic of the last weeks point now to New York (header # 2)

For Shipping Solutions website :
IP: 178.208.83.8
Decimal: 2999997192
Hostname: s4.h.mchost.ru
ISP: McHost.Ru
Organization: McHost.Ru
Assignment: Static IP

Geolocation Information
Country: Russian Federation
Latitude: 60
Longitude: 100

What is puzzling is the Received: from MacBook in the second header? There is no such domain as far as I know. Which makes me think it's been altered somehow.

The website is already blacklisted (see below
(status active. I wonder how long it takes to take them out of business) :

http://db.aa419.org/fakebanksview.php?key=61824

From the info available, the said website reads like this.
A website report about shipping-solutions.eu shows the site is currently hosted in, Russian Federation on a server with the IP 178.208.83.13. The organization linked to this IP address is McHost.Ru. shipping-solutions.eu currently estimated to receive about 0 visitors per day. Estimated value of the site is $0 USD and makes $0 USD a day.
Registrant is unknown at this point in time.

Thanks for posting this scam. It is the "work from home" scam, handling stolen goods, and work as a "mule" with forewarding payments from victims to the scammer. If this came through via Eures, you could get in touch with them, or with the CWI, and report this scam to them, so that they can get it out of their database.

Dear XXXX,

Good news. We have first task for you.

The first transfer has been made to your account at XXXX Bank.
The exact amount is 11,902.00 EUR. You should receive it today.

Your commission is 8%, that is 952.00 EUR will be credited to your balance and will be paid out later by separate wire transfer.

The next steps you should do are as follows:

1. Check your bank account periodically.

2. As soon as the transfer is on your account, you should visit your bank branch and withdraw the transfer (11,900.00 EUR) in cash.

3. Then you should send the transfer to our representative via MoneyGram or Western Union.

You can find MoneyGram offices here:
http://www.moneygram.com/eFindUs/findUs.do

And Western Union offices here:
http://www.westernunion.com/WUCOMWEB/st ... curePage=Y

Just type your city name or the nearest bigger city and you will get the addresses and phone numbers of MoneyGram or Western Union offices in your region.

4. You shouldn't pay the transfer fees yourself, you should give 11,900.00 EUR to Western Union (MoneyGram) operator and ask to deduct their fees from this amount.
For example, if the commission is 200 EUR, so the actual transfer will be 11,700.00 EUR.

5. As the amount is quite high, to avoid problems with Western Union or MoneyGram limits, please divide it into 2 parts and send to the following receivers:

First Name: OLENA
Last Name: KRYKINA
Address: 118 Nevski Avenue
City: Kiev
Postal Code: 06138
Country: Ukraine

First Name: VOLODYMYR
Last Name: GERASYMCHUK
Address: 34 Lenin Street
City: Odessa
Postal Code: 05483
Country: Ukraine

This is an instant cash payment system, not a bank transfer, so you don't need receiver's account number or whatever else. These details are enough. Make sure you didn't make a mistake in First and Last Names when filling out the sending form.

6. Please specify the purpose of transfer as "family", "personal" or "current expenses" to avoid any possible delays due to Western Union and MoneyGram policy regarding business transfers. Never tell them that this is business transfer, as it maybe delayed or even locked in their system. They may ask if you know the receiver personally, it is always better to answer that you do and it is your friend (uncle, brother, etc.) to avoid any extra questions. Personal payments are always fast and reliable.

7. It would be better to send one MoneyGram and one Western Union transfer.
If there are no MoneyGram offices in your region, you can send both transfers via Western Union, but from two different locations in order to avoid any extra questions why you're sending so much money at the same time.

8. Remember, that MoneyGram and Western Union can't accept your bank credit or debit card, only cash payments. Also note, you should have a valid photo ID with you.

9. After sending the transfer, please send me back the following info:

Transfer Amount:
Transfer Commission:
Sender's First Name:
Sender's Last Name:
Sender's City:
Sender's Country:
Money Transfer Control Number (MTCN):

Make sure to provide the correct Sender's (your) First and Last Names exactly as they're written in the sending papers.

If you have any questions, feel free to ask.

Please, keep me informed about any changes in the status of transaction.
Check your email on a regular basis and reply to my messages a.s.a.p.

Thank you.

Have a nice day.

---
Best Regards,
David Fischer
Branch Supervisor
Shipping Solutions, Inc

The address of the receiver is interesting. There are two names linked to the Nevski Avenue address. The first name used is Victor Vaschuk and the second Bogdan Panskyy.
And just having a quick look at the other address of Lenin Street Odessa, shows too many scammers are living along that road. One would not want to go and holiday anywhere near there!

Dont know about the receivers address being that important. Is it? I believe they can cash out with as little as only having to know the transaction control number and some minor id. Anyone can pick up anywhere..

About Russia, I was there many times there myself, friends called me a russian patriot.
Its a crazy country yes, but you can dress to that Just like everywhere else