Job Scam - Andon Health [email protected]

Andon Health Co, Ltd
[email protected]
http://andonhealthltd.org << No content on the site

from: Andon Health Co, Ltd <[email protected]>
reply-to: [email protected]
to: Recipients <[email protected]>
date: Sat, Mar 25, 2017 at 2:31 AM
subject: REPRESENTATIVE NEEDED

Greeting,

Our Company Andon Health Co, Ltd located in China, has a business
proposal to bring to your attention requiring your resentation
overseas. Please reply for further details: [email protected]

[email protected]

from: [email protected]
reply-to: [email protected]
to: Recipients <[email protected]>
date: Thu, May 11, 2017 at 2:52 PM
subject: REPRESENTATIVE WANTED>

Greeting,

Our Company Andon Health, Ltd located in China, has a business
proposal to bring to your attention requiring your representation
overseas. Please reply for further details: [email protected]

Hi Bill, what are they trying to accomplish here. Some guy reached out to me on linkedin and He sent me the same email. It's ridculous 10k a month. lol Do you know how this scam works. Just curious

[AlanJones]

They want you to launder money for them - the money that they will have sent to your bank account will come from the proceeds of crime.

I actually made this account just to talk about this company. The "CEO" contacted me via my personal email which I was already suspicious about. I received numerous emails after the first one and it went so far as me receiving a check which I brought to the bank along with a letter that came with it to alert them of this type of fraudulent activity going on. if this company contacts anyone please be aware that it's really too good to be true with the promising of 10k + a month. Not the first time I've been scammed and it's truly disgusting to see how low people will go to get money.

Please post the emails you got from andonhealth.org or andonhealthltd.org, with complete headers. This will explain to other potential victims what's going on and help us kill the domain.

Delivered-To: @gmail.com
Received: by 10.107.192.3 with SMTP id q3csp2454833iof;
Sat, 15 Jul 2017 08:18:44 -0700 (PDT)
X-Received: by 10.55.64.73 with SMTP id n70mr16972412qka.35.1500131924303;
Sat, 15 Jul 2017 08:18:44 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1500131924; cv=none;
d=google.com; s=arc-20160816;
b=Ibx+BOwpU4Zk9LpgRMCK7vdpFaXRo3ao4Io6FOoLpYDfxhedJ7vY3wq72funtRfEdD
h+bRHCz4SZgu3fdIHzll4ZtjBwQzi5CNNLEPU0uzAZcnagvrSXmZvtPNEZ1lZpRqVFGM
GwqYXb+TEPVGmjb9rUvi/5/rngW7HZgxGApTnxc6yX7rHehRcck7u7mnnS5Gaz3DMidf
Nmkfu9JnkjGIqNKu4IyzXeti9Rg7fYtkLTEyHddjSx8quohVibbaBhY6B9gPqK49/7uA
gDAGuVTU+pnVERNhMMxvj3p8VMVaeADl22S27w90iBbATBxB7jdjKujaTkYururzXyxP
OEwA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=to:mime-version:content-transfer-encoding:message-id:subject
:reply-to:from:date:arc-authentication-results;
bh=SBQ/vdz+BAo/pEpIKE9wtdK+39+ayJ54mcFUf8H0LnA=;
b=qZo3cn/ZagtTxCSCbvenBx5q/DL5A7Z2wnWNGNgmrs5eSEJwZeC1hlDwSlioceeXSN
nfc9+NOMfhrKc8EaHUcHhDyEdCAb1Zndm77o5/9U/gm5Kkreu/khoKxz3Y8Yaa1jNTqV
tL8vi7n36t7NvoYJruRIt7EU47Qm8URqMxlRAXUbzaxnkql2Wit+11x0d8LaVw14dcug
gXcga+UkPW97ID9jKJ9vs+bZrOdMNb2X9VHopPKOC5xyahfk1y2hS90amO3UTl6dSLNV
U68p5cOYu6q81UBv/LOf6sNamFsL2eMucPT6VUenQexYW+gchJeWuNprLGOVn4s4Fbvd
9Dow==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: best guess record for domain of [email protected] designates 200.247.246.131 as permitted sender) [email protected]
Return-Path: <[email protected]>
Received: from carteiro.stela.org.br (carteiro.stela.org.br. [200.247.246.131])
by mx.google.com with ESMTP id i1si476669qte.203.2017.07.15.08.18.34;
Sat, 15 Jul 2017 08:18:44 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 200.247.246.131 as permitted sender) client-ip=200.247.246.131;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of [email protected] designates 200.247.246.131 as permitted sender) [email protected]
Received: from localhost (localhost.localdomain [127.0.0.1]) by carteiro.stela.org.br (Postfix) with ESMTP id A9C91DB4063; Sat, 15 Jul 2017 08:36:12 -0300 (BRT)
X-Virus-Scanned: amavisd-new at carteiro.stela.org.br
Received: from carteiro.stela.org.br ([127.0.0.1]) by localhost (carteiro.stela.org.br [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JJXkCwTH+KJQ; Sat, 15 Jul 2017 08:36:12 -0300 (BRT)
Received: from carteiro.stela.org.br (carteiro.stela.org.br [192.168.0.246]) by carteiro.stela.org.br (Postfix) with ESMTP id 555BDD9DF01; Sat, 15 Jul 2017 08:36:09 -0300 (BRT)
Date: Sat, 15 Jul 2017 08:36:09 -0300 (BRT)
From: Andon Health <[email protected]>
Reply-To: [email protected]
Subject: OVER SEA REP WANTED.
Message-ID: <[email protected]>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Originating-IP: [46.31.171.86]
X-Mailer: Zimbra 7.1.3_GA_3346 (zclient/7.1.3_GA_3346)
To: undisclosed-recipients:;



Greeting,

Our Company Andon Health, Ltd located in China, has a business
proposal to bring to your attention requiring your representation
overseas. Please reply for further details: [email protected]

That email was sent from a carteiro.stela.org.br address and did not go through the mailserver of andonhealth.org. As far as I can tell from its whois record, stela.org.br is legit; most likely the scammer cracked a server there or someone's email address. Please post the headers of the email from andonhealth.org.

The email was sent from England, not China.