Company Representative scams, Payment Processing scams and other Employment scams.
by gilgonz24 Wed Mar 23, 2016 8:12 pm
Received this from Sofia Bruno at Italianstyle-srl.net

(there is also a website and facebook page: Italianstyle-srl.it which appears to be legit)

The question is: Are the scammers in collusion with the website or are they piggy backing off a legit business?)

What I received:

Good day and I apologize for inconvenience!

How are you doing? I am very concerned because I already sent you 2-3 messages about your resume we had reviewed. Once again, we are
ready to offer you the position of a travel coordinator with us. Please see below a copy of my previous email with all the necessary
documents that you should sign if you are interested in the position offered. Please read all of the documents and let me know about
your decision.

*****************************************

As you know, my name is Sofia Bruno and I will be your personnel manager. I am very glad you are interested in our job offer.
My principal task is to lead you through the whole process of work as a Travel Coordinator with us and explain what you are supposed
to do. You will find description of all of your future duties in this letter. They are simple enough. So, I think you'll understand
everything quite easily.

First of all, I would like to tell you a few words about us, Italian Style Srl international agency. We are engaged in providing tourist
services enabling our customers to travel anywhere in the world. Our Company is a leading travel agency in Central and Western Europe
and now we start providing our services in North America, including the United States of America, of course. Main office is located
in Italy. We also have offices in the United Kingdom, France, Germany, Greece, Poland and Russian Federation.
We offer such services as best selection of flights, hotels and vacation packages using innovative search engines. However, our main
field of activities is providing individual tours, including extreme travels and VIP tours. We are aimed at giving each client of ours
everything he or she wants as our business success and growth is wholly dependent on our valued clients. Therefore, we do everything
to help our customers enjoy our services and are eager to provide them with the best flights and travel tours.
I am honored to inform you that you are welcome to become an employee of our company as your resume fully meets our expectations and
requirements. Thus, we would like to offer you a chance to become a Travel Coordinator with us. This position is only limited to a
certain number of persons at this time, so please make up your mind ASAP.

The process of getting and processing payments from our clients (in form of checks) is as follows:
1. Our customers make payments via bank checks by means of sending the checks to your home address;
2. We inform you about a transaction by emailing you a special form containing all required information;
3. After you receive a payment from a customer, you are supposed to exchange it for cash;
4. Then you should transfer 95% of the received amount to our company manager via Western Union, Money Gram, P2P agents, etc. (transfer method to be specified by us each time; transaction fee is covered by us), the rest of the amount - 5% is your remuneration each time;
5. Inform us about details of transfer (you will be asked to email transaction complete report each time)
6. Regional Executive receives money from you.


************ APPLICATION PROCESS IS ONLY 3 STEPS. ************

Application process:
I have attached 4 files to this email: Job Description, FAQ, Employment Application and Employment Agreement in MS Word format
(if you are unable to open MS Word files, please let me know).

1. Please read the Job Description file carefully and respond to me with your questions and/or confirmation of your wish to work
with us.
2. If you agree to the job offer, please fill out the Employment Agreement and Employment Application and send these back via
e-mail or fax these at 214-594-9903.
3. When you send the documents back to me, I will forward your application documents to our HR department immediately.

You can find more information at our web-site ( http://www.italianstyle-srl.it ) or feel free to ask any questions about your job duties
and salary via email. On my part, I will do my best to provide you with all necessary instructions and answers to your questions. You can
ask me for any information you might be interested in. Please inform me about your decision (whether it is positive or not) as soon as
possible as at this time we are considering a number of other candidates as well and would like to fill mentioned position ASAP. Please
give your answer within next several days.
Have a nice day!


Sincerely,
Sofia Bruno
fax: 1 (214) 594-9903
tel: 1 (214) 206-1312
Italian Style Srl
Advertisement

by Mike Wilson Wed Mar 23, 2016 8:17 pm
Hello gilgonz24,
These employment scammers will often piggy back on a legitimate site to add credibility to their scam. The real clue is the reply to email address.
Please post the originating email address and the reply to email address from the email that you posted.

This is definitely a scam

It is ALWAYS a scam
If the pet seller or shipper asks for money to be sent via Western Union, Money Gram, any brand of gift card. Walmart To Walmart , Zelle , PayPal friends and family option, or mentions Cameroon
by vonpaso xlura Wed Mar 23, 2016 10:19 pm
italianstyle-srl.net is registered by hidden; its website redirects to italianstyle-srl.it. Please post the complete headers of the email so that we can kill the fake domain.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by HillBilly Wed Mar 23, 2016 10:22 pm
gilgonz24 wrote:this is the originating email address and the reply to address: Sofia@Italianstyle-srl.net



the above address does not = @italianstyle-srl.it . Seems they were both created about the same time, and look like duplicates of each other, but the italianstyle-srl.net is hidden behind a privacy protect service, and the other one is not.

Please post the complete headers from the email you have received, removing your personal information before posting it. You can find out how to reveal the complete headers at the links at the bottom of my post.

by gilgonz24 Wed Mar 23, 2016 11:49 pm
X-Ui-Out-Filterresults: notjunk:1;V01:K0:as0bHt4SBq0=:H5XuvdqLYDL2Vnn9KvuknB /J3GpoDvJy1K0krY5w0FxwNnNRpZKjfbac2utFasZGDFcPmGncrXA9/fKkAJGFEgD62SuLkz8 L8SBukalWuoXTkQVqyqNH9wzQv3fDjnmlie+8ryKD2IaSCWVYnTQ3auJY/TPjeCTndMjA8gYO 4B9ov0ryAW9nNSOm2PbxMbktlymdnnLkIc8sWRR3W+Ycq4UEX+dJDJ5gzBZIZRXqcx+sIfGeD XyDSKwkRqQf8vyHZOnSZSLcH9nVlwDN9xwjjO9O75umpSC7hfE5nN1t66yu7tpcy8AuJrJmLI C9IDWRdeSEYtMdu5g9Kq+PMy0Uzi0HyQOR+eVUT6klid6GsT7V3hCdDrHphZU38+kEfdPR3H0 oCTxsXa8aR0pC5vjQuRD3zAap3nocA81DncGNBTpIedD0Qj0w4i0AClFU1EVe6wTrY822pATY AxJToU2BuYqY5K9KZSnvvLGNiShI9HHMnrNfSvP7Cq0GgNYMcpsBqrSEtReP9zWBwP3SpBEu2 QyBCGJWJggkvyI+9/An84KoOLu2ulHMnMGKMg7vz97FfbqD8Y00JnF56otRXfA5W32XeQ8+vx cnvHB9OONDr5M07Ipgghis3k6EzPM86uOwADqj3SjzzpZDAhtZ9n56ImosX10VCeNZ3bf/3nE XtOwzACBHsUvXPqeAQXRNRJHTtgJvw4IUsNvCRrNHvgjUxp+dzjaWM30kBGLXojVS0iL1t+2l vHrEsyy5BYUaHjc0
In-Reply-To: <[email protected]>
X-Received: by 10.55.41.205 with SMTP id p74mr4049744qkp.65.1458743912257; Wed, 23 Mar 2016 07:38:32 -0700 (PDT)
Return-Path: <[email protected]>
Organization: Italian Style Srl
Mime-Version: 1.0
Authentication-Results: mx.google.com; spf=neutral (google.com: 74.208.4.194 is neither permitted nor denied by domain of [email protected]) [email protected]
X-Priority: 3 (Normal)
Content-Transfer-Encoding: 7bit
Message-Id: <[email protected]>
X-Provags-Id: V03:K0:x6vJkXVdiujlYemKKbAh5yzuI9pC7EYXc7Z8djRjtnuFwz96ACu xcnbnL4kdIqTlrLck4TGlGlrz6cC4MRUCx2fFLmi4A2/dnwU1D61ywLyXAFytsKI2chM4Gg LZuAvZRqk3ctcGDqjifbQo0uf+8EVifjGrfGv/UH18BxpkN/lctOeQt/W62lfON/91Va9Gd dTz7ByCYbc2ik+G5qhnHw==
References: <[email protected]>
Content-Type: text/plain; charset=us-ascii
Delivered-To:
Received-Spf: neutral (google.com: 74.208.4.194 is neither permitted nor denied by domain of [email protected]) client-ip=74.208.4.194;
Received: by 10.83.35.81 with SMTP id j78csp69643yxj; Wed, 23 Mar 2016 07:38:32 -0700 (PDT)
Received: from mout.perfora.net (mout.perfora.net. [74.208.4.194]) by mx.google.com with ESMTPS id u19si2394061qka.36.2016.03.23.07.38.32 for <xxxxxxxxxxx> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 23 Mar 2016 07:38:32 -0700 (PDT)
Received: from [10.100.0.63] ([217.170.192.70]) by mrelay.perfora.net (mreueus003) with ESMTPSA (Nemesis) id 0MZVnv-1aUmTq00Dd-00LGr0 for <xxxxxxxxx>; Wed, 23 Mar 2016 15:38:31 +0100
Did You Receive the Documents?
Last edited by Bryon Williams on Thu Mar 24, 2016 1:15 am, edited 1 time in total. Reason: Removed personal information.
by Bryon Williams Wed Mar 23, 2016 11:56 pm
Domain Name: ITALIANISTYLE-SRL.NET
Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: DNS1.NAME-SERVICES.COM
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Name Server: DNS5.NAME-SERVICES.COM
Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
Updated Date: 14-mar-2016
Creation Date: 14-mar-2016
Expiration Date: 14-mar-2017

Registrant Name: WHOIS AGENT
Registrant Organization: WHOIS PRIVACY PROTECTION SERVICE, INC.
Registrant Street: PO BOX 639
Registrant Street: C/O ITALIANISTYLE-SRL.NET
Registrant City: KIRKLAND
Registrant State/Province: WA
Registrant Postal Code: 98083
Registrant Country: US
Registrant Phone: +1.4252740657
Registrant Phone Ext:
Registrant Fax: +1.4259744730
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:

Please contacta moferatorstor if you have a question or information about this post.



Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
by gilgonz24 Thu Mar 24, 2016 12:07 am
Looks like she is also using a .org:

X-Sg-Eid: 7DVSimlRJQIdEjB8KbG6EtSdw6+2fywgrzmkPZecRgD4ZKq4QKQrh2VIFUZWWFxmG+uMJ1ZQ/5Zwk2 b4Vem0m56MMC2ZXmt8ulGp4oslNwACn54OCl12ZxZprtKQZWuSzb1hBEzleMs8qCPuOUg2uqzLAQAq AuXd5uyK8+UzwmvovvAbs/8H0CRV+/oSDPEBK+jHxIpSkY5mkdYC1VlXKDbvKvB7CwdEvOTbAkm+eg Q=
Return-Path: <bounces+2476404-183a
@sendgrid.net>
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-03-21_08:,, signatures=0
Mime-Version: 1.0
X-Icloud-Spam-Score: 33002230 f=italianstyle-srl.org;e=sendgrid.net;is=yes;ir=no;pp=ham;spf=pass;dkim=?;dmarc=?;wl=absent;pwl=absent;clxs=ham;clxl=absent
X-Proofpoint-Spam-Details: rule=notspam policy=default score=3 spamscore=3 clxscore=714 suspectscore=7 malwarescore=0 phishscore=0 adultscore=0 bulkscore=96 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1510270003 definitions=main-1603210248
Authentication-Results: st11p00im-smtpin015.me.com; spf=pass (st11p00im-smtpin015.me.com: domain of bounces+2476404-183a-
@sendgrid.net designates 173.193.132.134 as permitted sender) smtp.mailfrom=bounces+2476404-183a- @sendgrid.net;
Authentication-Results: st11p00im-smtpin015.me.com; dkim=pass (1024-bit key) header.d=sendgrid.me [email protected] header.b=QaHw13U3; dkim-adsp=none
X-Mantsh: 1TEIXWV4bG1oaGkdHB0tNT0ReQ0QYExoYEQpMQxcbHQQbHRgEEhkEGxMQGx4aHxo RCkxZFx0bHhEKWU0XZEVeYF9EQREKWUkXBxsTcR4GBxN3BhsaEwYaBhoGHB4GHBpxGRAadwYaB hoGGgYaBhoGGnEaEBp3Bh8aGhEKWV4XaGN5EQpDThcYW2xia2NOSElwSWNaa04FclsFSR9Ec0N HH395E2VJSBEKWFwXGQQaBBgSB01OEhxME05PBRsdBBsdGAQSGQQbExAbHhofGhEKXlkXZWBIT HMRCk1cFxsYExEKTFoXaWhtTWtrEQpDWhcbHRkEGxMZBBsZGAQbGR4RCkJeFxsRCllFFxIRCkV JFxoRCkVmFxkRCkJFF25sGHBcb3hNXU1kEQpCThdnWxpheRlHYnxZTxEKQkwXbB1jfUdAH15fG WERCkJsF2sdBV1fE0ceRF5JEQpCQBdnZ1psaGZ/c2gSQREKQlgXbR1jHk5tHRhjcHoRCkJ4F2Z CTRwFQ2JQemlSEQpwaBdgBR8ef1ITWWJTeRAfGxEKcGgXekx5GGRrbV9wU2YQHhoRCnBoF29Df 3JBSVocXFxyEBoRCnBoF2huEm5zSRsBGkNLEBoRCnBoF2ZsHnNTE0leZXxSEBoRCnB/F2J6fGd ubkJtSEtjEBsfEQpwXxdgAVlbeHIbbGBsHRAaEQpwfRdsGkZ/QE9te09hZBAaEQpwbBdjS18FZ 0FNRElOaBAHGRoRCnBDF3ofUmZuYxJ/fXBfEBoRCm1+FxoRClhNF0sR
X-Clx-Unspecialscore: 714
X-Clx-Spam: false
Content-Transfer-Encoding: quoted-printable
Dkim-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.me; h=content-transfer-encoding:content-type:from:mime-version:subject:to; s=smtpapi; bh=T0/pfZ4oz0Xlp2CQ/iRtvFi7sW4=; b=QaHw13U3leU2RdBOtL cPWdDC7REt44xT5R/ax8Qpy316Btz65bHbq2P14dJEM9k+/3Ot6nR5EZPMmUZBOP G8TQISCwbKeTPxyHNcK7Pir+hORdhcI0d/qq+olf3e3PsQM7UguWyOJwIjdDw8lG Oe8gHchahk6mxoT20dQ4ofmy8=
Message-Id: <[email protected]>
X-Clx-Score: 714
X-Clx-Shades: NotJunk
Content-Type: text/html; charset=UTF-8
X-Dmarc-Info: pass=?; dmarc-policy=(noPolicy); s=; d=
Received-Spf: pass (st11p00im-smtpin015.me.com: domain of [email protected] designates 173.193.132.134 as permitted sender) receiver=st11p00im-smtpin015.me.com; client-ip=173.193.132.134; helo=o9.shared.sendgrid.net; envelope-from=bounces+2476404-183a-
Received: from st11p00im-smtpin015.me.com ([17.172.80.99]) by ms02552.mac.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected]; Mon, 21 Mar 2016 15:29:01 +0000 (GMT)
Received: from o9.shared.sendgrid.net (o9.shared.sendgrid.net [173.193.132.134]) by st11p00im-smtpin015.me.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTPS id <[email protected]> (ORCPT [email protected]); Mon, 21 Mar 2016 15:29:01 +0000 (GMT)
Received: by filter0481p1mdw1.sendgrid.net with SMTP id filter0481p1mdw1.303.56F012FA36 2016-03-21 15:27:54.417868824 +0000 UTC
Received: from MjQ3NjQwNA (unknown [50.44.113.254]) by ismtpd0003p1lon1.sendgrid.net (SG) with HTTP id dYepKIzgTjO1K4TIWsfAGA
by Terminator5 Thu Mar 24, 2016 12:43 am
Money mule scam . You'll get fake checks to exchange for cash . :yikes:

Daniel 8 :25
by vonpaso xlura Thu Mar 24, 2016 12:56 am
We also need the outgoing headers. Please post the message that you sent, to which the above message is the reply, with complete headers.

There are italianstyle-srl.net and italianistyle-srl.net. Both redirect to the legitimate site, both were registered by hidden, but they're at different registrars, nameservers, and hosters. Reporting italianstyle-srl.net without an email as evidence may be difficult.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by AlanAZ Wed Mar 30, 2016 12:46 pm
I received this today (I <redacted> my last name and email local-part):

Wed, 30 Mar 2016
Good day Alan <redacted>!
I believe that this offer could be interesting for you.
We have seen your CV on the pretenders’ website, so we made a decision to forward a position proposition to you. The key benefit of our proposition is the possibility for career development and flexible work hours that can provide you with an opportunity to join this position with your principal one if required.
My name is Sofia Bruno and I’m the agent of the company Italian Style Srl. Because of the personnel’s enlargement, we are looking for another Travel Coordinator.
By working a few hours per week, you will receive a possibility to get from three to four thousand dollars. You must confess that it is an exceedingly good proposition for the vacancy requiring just from five to six hours of your spare time.
In addition to the salary specified, you will also receive such advantages: improve your skills and habits; additional remuneration;an opportunity to labour with communicative and attractive group of people; In case our proposition is attractive for you or you’ve got some questions, please contact me. I am looking forward to getting your answer.
Best regards,
Sofia Bruno
Italian Style Srl
-----------------------------------header info below----------------------------------------------------------------------------------

From "Sofia Bruno" Wed Mar 30 14:57:00 2016
X-Apparently-To: <redacted>@yahoo.com; Wed, 30 Mar 2016 14:57:38 +0000
Return-Path: <bounces+2563208-fba9-<redacted>[email protected]>
Received-SPF: pass (domain of sendgrid.net designates 192.254.126.78 as permitted sender)
aSEgSSBiZWxpZXZlIHRoYXQgdGhpcyBvZmZlciBjb3VsZCBiZSBpbnRlcmVz
dGluZyBmb3IgeW91LiBXZSBoYXZlIHNlZW4geW91ciBDViBvbiB0aGUgcHJl
dGVuZGVyc.KAmSB3ZWJzaXRlLCBzbyB3ZSBtYWRlIGEgZGVjaXNpb24gdG8g
Zm9yd2FyZCBhIHBvc2l0aW9uIHByb3Bvc2l0aW9uIHRvIHlvdS4gVGhlIGtl
eSBiZW5lZml0IG9mIG91ciBwcm9wb3NpdGlvbiBpcyB0aGUgcAEwAQEBAQ--
X-YMailISG: O4nTIgcWLDumclriX0GhVzJZ6sPna1lQwqFCFAqVojW0NdIg
Xe0B4QQa47G177OsHAdTJ3jc4ELofp83mpVEllqRNw44C4buXqCqWXsERJ0U
WUDcVmo7IiTRfLo6oqWfIUm58IplYp9nXVrFqdIDs58uhw5mhaiAp8R15Zt3
dNWj.beFpbFBroSE1AYTJ0Jrb_CWue6LXqqUYiWA4qFh7stxHbAqSZhmju3e
QWDe2reE5Q_k9wiwjbw1JOtTj3jjW5dhRrz4mvO9YdyfFuy1ZsCnfN3sqleG
EfMgeoFivBnGisgotgWosw1xHISDXuqEsnQzUknoq6qcXOn9f2FhQ8laCIlr
fwMUcviWqy2GtvST2evG9pyZKsODy8SbFiH9_s3dQuxiv5di0bguwfnKGlkP
XHCzJFMquKP9zHxnN8jpPE5uf0eDYIzfu75qr4Zu_gPxLoz_zH.Rv.StlLnp
jH0KJs0V.4RhVU2HTCLQEGF2a8iKAnX_P6tGXBjf1fOzjlEn6_RxDqcwMusz
vtDVRlXQ4fvP8hrPGqQydcb.Vf7e9M15xeP5oVCgmkXi99ht6ztYTHxYFg0M
LlHhkQGmv8eQuZxSksvNpBGd3QqlFAA3Rt_mDBW7nDXoQRMR605j5ukjMbV8
x_7qkCE6Our91zd.uFWtryzX8v.QrtRxIS0OVeoLXngT8rSmPGE9a_F9vkFF
Sx5WzoZ_Avf7jMWj6TobkIy0Gop96VSsAYNJX.X1lgkkUIlnicwdoCDPLDxa
zygC_jDWAm5OmMSeElzf4WZHZHJv_rbc2hCVuIiFJeDEOpMvEVxCNwsDVtcl
Yti07FRsRVZSVN0eaz3jvZ_ta55tEkPIbvxHVIQn3su4wrZnJ_tuy2S8IN1z
9aV3Bse.Hdn1UAueA7JJFFo.QrfL2qob8LC0_Dl78DtObaQ2gsaLyr3hDDrQ
xSMSyz5zUitYCravBtI6tIcguRRHO2clHoQsowlQ0JNqtlhWrNpqnYc8t.uc
f_DMtL6BtzSoswUn5ibv7FqaVSb4yfqj0cTzyaKErJTpsc.Q1V6M1wkF7MKT
Ms97jMwvdfMpzlaFJzxUEumFFFbDqzFktcWLkPVZl2_709xYfD9BgIN2aRIQ
.dKki6CoL1FJSV7sp3AYOnGAf1xBf6vvPDIcEzSdjWx5HdTM2BRWslSdvy.i
KEsXzizW5_gZTF0_tC2Zrm.6sARWWH_fvi9HDz2GwzRhQD3DxxMf0IIMB4kn
98nbTAZoyeYJbLW6Rfq6AV_.HFjS89fIb0nPdHN5XRE2exooN.XmS9hhtQUp
663dFSHXOLUKjfc6xxDsSnny9B9q8qT2O_eaxk8rVv8hD2l0PLvL4yPw3Mrr
MQ5Qu5kvcfS422.LztCSUys2kRn2FBkpq9csq3Qr3zB_Xyp4O6RL3AVuu23R
bApTRi5PgpdMVvS8IJDR6y7r6xLjVmZV0IndxrLc51H188aDiDR.fZCbpwpp
yxY.HUpxMa0krYflKXf8YQ--
X-Originating-IP: [192.254.126.78]
Authentication-Results: mta1179.mail.bf1.yahoo.com from=pfkksiww.ga; domainkeys=neutral (no sig); from=sendgrid.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO o192254126x78.outbound-mail.sendgrid.net) (192.254.126.78)
by mta1179.mail.bf1.yahoo.com with SMTPS; Wed, 30 Mar 2016 14:57:38 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.net;
h=content-transfer-encoding:content-type:from:mime-version:subject:to;
s=smtpapi; bh=gIzmho6yBtwpt9e6MyNqJMrxxPA=; b=BbPK4pqoJQxMMQs9G5
465vXp+AqJKcWvBWXJ4skeOB+LmGYJs+5a3XIH/5xLEnQwUaixjFSFo7jPVUFoVE
7wpiATP/RZz8U+rr6Jz5sWTtEWixom8DPUS4sq/UyjCnVBh1CHY1fngQm+E9mf71
nG4AoulGQMs+dHwXqoPwImswA=
Received: by filter0588p1mdw1.sendgrid.net with SMTP id filter0588p1mdw1.3257.56FBE93C44
2016-03-30 14:57:00.491433862 +0000 UTC
Received: from MjU2MzIwOA (71-219-49-41.slkc.qwest.net [71.219.49.41])
by ismtpd0004p1lon1.sendgrid.net (SG) with HTTP id 3WtlxIsLRZWx27LTbrtC7A
for <<redacted>@yahoo.com>; Wed, 30 Mar 2016 14:57:00.558 +0000 (UTC)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
Date: Wed, 30 Mar 2016 14:57:00 +0000
From: "Sofia Bruno" <[email protected]>
Mime-Version: 1.0
Subject: Alan <redacted>, invite you to join us
To: <redacted>@yahoo.com
Message-ID: <[email protected]>
X-SG-EID: dK8WelB3nAb57v0yyDq0I1kdReYzE8uuYp/Q8/zgk0uCwPnrC/a8E9OFV8DBiaHk9KO1k/C6vnO/Hv
y8KeMHFyddXTU4NSriLhZWyEykkCjEk58aVON/+RbsI0zfeRW46oKoEkNQIGehEBKutQv4reHa9puS
NOX/qVyC+jPIZ817Qdy0YIus14OsrLmgqPjCWVmP48U9ayug1GXhIKs57w==
Content-Length: 1997
Last edited by AlanAZ on Wed Mar 30, 2016 12:59 pm, edited 1 time in total.
by AlanAZ Wed Mar 30, 2016 12:56 pm
and a second email was in my spam folder, from a different email addr:

Wed, 30 Mar 2016
Hello Alan <redacted>!
Because I have not obtained your answer, I ’d like to know if you have familiarized yourself with our offer and if you require some explanations having to do with the data provided. Not long ago I’ve submitted to you the information offering the post of Tour Coordinator in one of the divisions of our company. My name’s Sofia Bruno, the agent of the organization Italian Style Srl. We are looking forward to hearing from you and issues if any.
Best wishes,
Mrs. Sofia S. Bruno
Italian Style Srl
--------------------------------------------------------------------------------------------------------------

From "Sofia Bruno" Wed Mar 30 16:46:09 2016
X-Apparently-To: <redacted>@yahoo.com; Wed, 30 Mar 2016 16:46:13 +0000
Return-Path: <bounces+2560301-a2e6-<redacted>[email protected]>
X-YahooFilteredBulk: 167.89.95.69
Received-SPF: pass (domain of sendgrid.net designates 167.89.95.69 as permitted sender)
X-YMailISG: dxJoiD8WLDvq7W99GGsSwuF2KXiPOMJb9vHSsl58__HgwzmG
RyGcnp841f9a2q4cBsGTZdfn0UHGEuHlhqjQkJkkqTbbRYIG.dZb6kgCLFJJ
zDMbaJHZ6k2KRkaHfPuaGOAw86Q4XAPPA9wA3AnqvzHyGx9vkWxHCz3moVto
TvgcMG4ruxO1Jy91kW.OJHuYbzrCEQUQ_jR6r3N8isuskmd3T7RH8VPDV63M
bVBVhgia5H2N.SoB_mHEUhLkqw4Zrfx6JyUyqVO53JYH_tgjYXJ35qrdmf9b
JWzMIOAonMR2QgBcmsct4jQx4DRkH8MXLwrg2eXYBDBGLNLkbNo5EaiqXgSu
6pta1RX_PKYFWMBuKjBhEkrL3LriIawCghlJzInoSf7BoeMugCU_jkzyvip9
tfzk_OzMXdHSxf2nXkVHIbhK6VsW9XkOYtsHg6vDG3Mj3DKVAV5RjVauzp8k
vxxGFTGiWhNtT06ZgDeo_WTKGkQhhQIvkJeHX7cAQ3rDrshchGfmv0R5P.3Q
Nw4rsWtAN5S0enxxLjk_IYkAgS.FhLdmKwIDelhJjR_DI23tZfcaY_7_Tks1
Gjs6x0QAS7bYkKJa7Fh4NTo_Fry9l0laXlmnS12XNHN4Br31q69KPMAUTWf_
0I3JB4P1g7HdctZjWjGXZEmVaTefkjV6_xKbaAhTYVBAzZtqFyJ_kaWZYWcs
5qtgDKmFyCgCnoA33_FywwslNNn1mF8BR2O2tRYwkhNDN_H8utpgCkNSnn4b
4TVThMdV4wrmYIW09xYeneksZGKdp7OqT6WCLi.LsayCAaLje.GJFvMeRizK
gGtIKAyWm7FfJhlmT3AsKZppYG6QqWDuZZ5cJSxAvT.d5CfxsXarWdrhK_Vi
OydOtvoTLhO9MoHyH3Ysk_yrU7wisf7cYb626PCNRyEI3pFdEDUbpnSvEL_j
C3JiXZhNQqXAWLwgVZF0TFrk6RJ1N8.nGndh.lKa4dli2sxTus9E38GdjyUb
2MMiybTVtsJIcckMOGprTtRxoXah30h_rBAnZ1lWQ51psM1xH8Lj63Sdg.2t
ZC4Mh7hWH7Ok3IvBBGczGh.jk6F8vA0XnAeU_VGcRW9uJVDyNyfaLyJGcYPM
9TWfhg.BxNfDIb0OfbedslqilYt1Aoe_JCXKlorQvdKBv5bPRFKye9z5TkR9
Bf.ifVuyPx9VVr8QhHp7i7YURfRLuelDlTDxyQv3hLYEB4.4g52V3a3UE7l8
S5pppdM4fXc4DUg0j9z.btCbbwfSY5dO8kMv8GFkBvtP2PlZYTyNaXJE.8g5
YWEGLCms2o4wZjzvSwSnRsYCIaKGAk5f.hwEwu7WQ0eOviEoJQBEAwQZU6_r
Ldu9hxxykAs__eYUBf9cNZ4MYDcZ7bAgTSdpGGlDuViE7lZKA3Ga7y6L1Qw2
8roORms8qeHB_8kFnv6HBYwhZ0hIMBujXxjk64I6ngCOjxewj1Juvir6MJTD
N2TB8JUn0ym97oqsMCTHq9wjLskrLmEwTKY1kBBmK_ueZlovwzVcQzoPfn1P
3yZPSWUGm6rvkchg2Hdy9crZydAStNjYzaVg7pXcuUDA01KiDsQlVTHSZvnD
nFakg0xvML5tedW8uFQAYvg-
X-Originating-IP: [167.89.95.69]
Authentication-Results: mta1684.mail.gq1.yahoo.com from=ieooalw.ml; domainkeys=neutral (no sig); from=sendgrid.net; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO o1678995x69.outbound-mail.sendgrid.net) (167.89.95.69)
by mta1684.mail.gq1.yahoo.com with SMTPS; Wed, 30 Mar 2016 16:46:12 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.net;
h=content-transfer-encoding:content-type:from:mime-version:subject:to;
s=smtpapi; bh=K820/Lkr/obqMyW8SD6VO/wRSXk=; b=Kx4z0wqOAqzD9SdxKi
Y/Uo5bLeVitzHfj4GMeiPAi8pjk0n1PcylQ3SdnZeFoMhiL8HwyIkaw4edW1/+2j
hEcd82OsEIGaEKXGHYRgyVM2Upz2hLw30lM+gHjTUHxLuq2jF1HGQVtcjxPHYO3n
FFiVFLsHWPjZrWpDlKkBcjIq8=
Received: by filter0467p1mdw1.sendgrid.net with SMTP id filter0467p1mdw1.22724.56FC02D129
2016-03-30 16:46:09.690420542 +0000 UTC
Received: from MjU2MDMwMQ (unknown [138.186.119.229])
by ismtpd0002p1lon1.sendgrid.net (SG) with HTTP id 7GaeVI3ETOyz7hxmvwy9-g
for <<redacted>@yahoo.com>; Wed, 30 Mar 2016 16:46:09.813 +0000 (UTC)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
Date: Wed, 30 Mar 2016 16:46:09 +0000
From: "Sofia Bruno" <[email protected]>
Mime-Version: 1.0
Subject: Alan <redacted>, communicate with us immediately
To: <redacted>@yahoo.com
Message-ID: <[email protected]>
X-SG-EID: dK8WelB3nAb57v0yyDq0I1kdReYzE8uuYp/Q8/zgk0vn9B0JMIqyY06XGvx+Fonk1t8IHKef07fW2G
Ga433AVplrUkNfkOc4H5QIs0tywmGIRTGvaYfn0Dp07zq1GlLYIbOesT9Rg5TMof9Oj0U7Zasp6inl
pZUvZI9IfxhwPtadGeHoIJ1VFZiJQJ8jfnGPsBlqqaS6VRG1ZynEYNhUZQ==
Content-Length: 1270
by vonpaso xlura Wed Mar 30, 2016 9:22 pm
pfkksiww.ga and ieooalw.ml are free domains registered with Freenom. Both have a webpage that simply says the URL of another website. The emails supposedly sent by them were sent through other mailservers, so we need outgoing headers. If you sent an email to either of these domains and received a reply, please post both what you sent and the reply, with complete headers.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10

Who is online

Users browsing this forum: ClaudeBot and 6 guests