by wish4better
Mon Apr 16, 2018 1:02 pm
Unless I ;personally know the person, I no longer answer my phone or open emails.
I do, however, wish to share if it may help others, since I learned about employment scams the hard way.
Here is the source code (with my personal info removed) from an emailed job offer I just received with a pdf attached. If it helps just one person avoid a problem, I am happy.
Return-Path: <[email protected]>
Delivered-To:{info removed}
Received: from dovdir4-asd-04o.email.{provider}.net ([96.114.154.148])
by dovback4-asd-12o.email.{provider}.net with LMTP id 8EqMJKTS1Fp4GAAAHRBrOQ
for {info removed}; Mon, 16 Apr 2018 16:43:17 +0000
Received: from dovpxy-asc-17o.email.{provider}.net ([96.114.154.148])
by dovdir4-asd-04o.email.{provider}.net with LMTP id +D9dJKTS1FrsGwAAXA9JuA
; Mon, 16 Apr 2018 16:43:17 +0000
Received: from resimta-po-20v.sys.{provider}.net ([96.114.154.148])
by dovpxy-asc-17o.email.{provider}.net with LMTP id 4NrvBKPS1Fr5DAAA9WMgjg
; Mon, 16 Apr 2018 16:43:16 +0000
Received: from mout.gmx.net ([212.227.15.19])
by resimta-po-20v.sys.{provider}.net with SMTP
id 87DkfUf5YUSmy87DmfY00U; Mon, 16 Apr 2018 16:43:16 +0000
X-CAA-SPAM: F00000
X-Authority-Analysis: v=2.3 cv=VKjzYeHX c=1 sm=1 tr=0
a=3TOKzCKRji10XXrfGWad6Q==:117 a=G+E0Z+a9/nb1mi9oJWQYuQ==:17
a=x7bEGLp0ZPQA:10 a=nnELjvoBxHUA:10 a=khwyK8DuSVkA:10 a=Kd1tUaAdevIA:10
a=N5a5Wm-pAAAA:8 a=iegDnLO7vQKo6rpMBOwA:9 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10
a=BEySChuPAAAA:8 a=SSmOFEACAAAA:8 a=X02qDDlAAAAA:20 a=RqOAJGx8AAAA:8
a=v5jl0-dWAAAA:8 a=KZeT5yt5aGtx8OxuBHMA:9 a=n3BslyFRqc0A:10 a=x9I3668ZiE8A:10
a=2_WVlan1Y9OtAV2O8l2U:22 a=_sEUEpBP7zISb26pD9Sh:22 a=GvZCGjp9oAndjt8minEi:22
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=
Received: from [5.189.205.63] ([5.189.205.63]) by
msvc-mesg-gmx023.server.lan (via HTTP); Mon, 16 Apr 2018 18:43:12 +0200
MIME-Version: 1.0
Message-ID: <trinity-1bbfef2d-43bb-4f87-98eb-1ca7ef86dbe6-1523896992158@msvc-mesg-gmx023>
From: "Bryan Mcdonald" <[email protected]>
To: {info removed}
Subject: {info removed}, notification for you
Content-Type: multipart/mixed;
boundary=kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Date: Mon, 16 Apr 2018 18:43:12 +0200
X-Provags-ID: V03:K1:eD3Eh47JRrOZ+Rs4MAQq128T6t2dl/UJlJ7VPAf6yfj
p25sULq7vbCsUgyuRu3beRk4jvgJDKOJs/aTysWJvNTjhNMIy4
eqBxcN1G4Gl5KYQixedYRifBvPUe333dyb81HLx0wGrkSZYjDf
bq0COx13xMcJoexE7cqG5WzqcxQw9IioIFKqXcOmL9mLokjRPn
dqIhp6NZaqlyFbcNlh9LQ455prvypkek0Uv/KhKP3d/oIoimOD
kwKx4RKcHFdWBWdnXcKGY9Y4YURltMdnPkTBGlZpgVDg7zoUZL
+LskJ589v3uS/SZ1+hMjN0CqFrB
X-UI-Out-Filterresults: notjunk:1;V01:K0:SVcBPvvpS+8=:aUHEl+Ag7zl303XWZMSXVB
0x/49lD4mTEqJLNTJEQBny+GVJCn0JIJ9XcVTzM38ZIj2cZmxHezk+33/N7lHBDfiuUdj16mx
ftFwHY4Xt0nQJFaOPEAXONo18JZtPqB5/DT5nMsXajHqJLfDMJSTD8cWmE7oNgYVDYPXTEsix
iUp2hvGjHzK51v6saKZfSgCja6l2W9z5iLJOdAzZHcLscXSNBBM0Onj8Z4rDc2YlXvkJVUjVK
9GxYP/47FoaZ4DzJ1uMzWa9eQ23m//X4bLcTRl4cqu9YvQwGCf3VC/y9aUoVrd0gB9Z9d8kWB
kQfk0z/WoDq1b+wIfp2Khp8SrQagcx3y0MoPmRqCRf7Wm0NMGzg5CL3yPm3Fi+e4Nu4shbtr6
6QMtvUWOyg5saFhYmRYPtFJpbdYoOSeUbchxB0j430d9qFbwmXFBMp6OaBrqwBJ6BS77He5B4
GrbjPlKR4Y1F8FERhRbpWoJLFgjEisysP4wy2zGcG8E1xM8RkeN0i6Wv3taiTuhMt2dp8CR6r
gS23vC0SX9FG2UhZ9g2kOHO7/D35LWDIPNk+vkEbuj3WFBfrM6m5sYLyoDNkjqlrzgRFunxYi
ZxsCCK5cS3R1jb7Wg8kRZEHAcbENYhTaQC3Ro0s58Eaq2EAwR4f7juCfr/hPaAgPQPugVGG2w
G9uo=
X-CMAE-Envelope: MS4wfIIQfuSh4cmTZpjS4P3CDqx8Oac9kCc1pui9wjtAE3EcZE6c+fzYP4qXKnNtwSJGmIxzToagk5lHBkzADSLfyJx4skhqCGYESLLLrSGClFyuAdX4feDb
MFa9D4lJgSo4uz0fO4zU8Y6/30Fnf9Q+71TK35zI6HNPrM5Cl33G9GpYx/xJveFi7VPbu6PAQKO6jg==
--kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Content-Type: text/html; charset=UTF-8
<!DOCTYPE html> <html><body><div>Good day,{info removed}.</div> <div><div>We came across your resume on one of the job seeking websites. As if right now, our company have a few job opportunities to offer. If you are interested, we have provided all information needed with the file attached.</div></div> <div>Should you be interested the position, please <a href="mailto:[email protected]">reply to the our HR</a>. </div><div>Best Regards!</div> </body> </html>
--kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Content-Type: application/pdf
Content-Disposition: attachment; filename=Description-8834-VT.pdf
Content-Transfer-Encoding: base64
I do, however, wish to share if it may help others, since I learned about employment scams the hard way.
Here is the source code (with my personal info removed) from an emailed job offer I just received with a pdf attached. If it helps just one person avoid a problem, I am happy.
Return-Path: <[email protected]>
Delivered-To:{info removed}
Received: from dovdir4-asd-04o.email.{provider}.net ([96.114.154.148])
by dovback4-asd-12o.email.{provider}.net with LMTP id 8EqMJKTS1Fp4GAAAHRBrOQ
for {info removed}; Mon, 16 Apr 2018 16:43:17 +0000
Received: from dovpxy-asc-17o.email.{provider}.net ([96.114.154.148])
by dovdir4-asd-04o.email.{provider}.net with LMTP id +D9dJKTS1FrsGwAAXA9JuA
; Mon, 16 Apr 2018 16:43:17 +0000
Received: from resimta-po-20v.sys.{provider}.net ([96.114.154.148])
by dovpxy-asc-17o.email.{provider}.net with LMTP id 4NrvBKPS1Fr5DAAA9WMgjg
; Mon, 16 Apr 2018 16:43:16 +0000
Received: from mout.gmx.net ([212.227.15.19])
by resimta-po-20v.sys.{provider}.net with SMTP
id 87DkfUf5YUSmy87DmfY00U; Mon, 16 Apr 2018 16:43:16 +0000
X-CAA-SPAM: F00000
X-Authority-Analysis: v=2.3 cv=VKjzYeHX c=1 sm=1 tr=0
a=3TOKzCKRji10XXrfGWad6Q==:117 a=G+E0Z+a9/nb1mi9oJWQYuQ==:17
a=x7bEGLp0ZPQA:10 a=nnELjvoBxHUA:10 a=khwyK8DuSVkA:10 a=Kd1tUaAdevIA:10
a=N5a5Wm-pAAAA:8 a=iegDnLO7vQKo6rpMBOwA:9 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10
a=BEySChuPAAAA:8 a=SSmOFEACAAAA:8 a=X02qDDlAAAAA:20 a=RqOAJGx8AAAA:8
a=v5jl0-dWAAAA:8 a=KZeT5yt5aGtx8OxuBHMA:9 a=n3BslyFRqc0A:10 a=x9I3668ZiE8A:10
a=2_WVlan1Y9OtAV2O8l2U:22 a=_sEUEpBP7zISb26pD9Sh:22 a=GvZCGjp9oAndjt8minEi:22
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=
Received: from [5.189.205.63] ([5.189.205.63]) by
msvc-mesg-gmx023.server.lan (via HTTP); Mon, 16 Apr 2018 18:43:12 +0200
MIME-Version: 1.0
Message-ID: <trinity-1bbfef2d-43bb-4f87-98eb-1ca7ef86dbe6-1523896992158@msvc-mesg-gmx023>
From: "Bryan Mcdonald" <[email protected]>
To: {info removed}
Subject: {info removed}, notification for you
Content-Type: multipart/mixed;
boundary=kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Date: Mon, 16 Apr 2018 18:43:12 +0200
X-Provags-ID: V03:K1:eD3Eh47JRrOZ+Rs4MAQq128T6t2dl/UJlJ7VPAf6yfj
p25sULq7vbCsUgyuRu3beRk4jvgJDKOJs/aTysWJvNTjhNMIy4
eqBxcN1G4Gl5KYQixedYRifBvPUe333dyb81HLx0wGrkSZYjDf
bq0COx13xMcJoexE7cqG5WzqcxQw9IioIFKqXcOmL9mLokjRPn
dqIhp6NZaqlyFbcNlh9LQ455prvypkek0Uv/KhKP3d/oIoimOD
kwKx4RKcHFdWBWdnXcKGY9Y4YURltMdnPkTBGlZpgVDg7zoUZL
+LskJ589v3uS/SZ1+hMjN0CqFrB
X-UI-Out-Filterresults: notjunk:1;V01:K0:SVcBPvvpS+8=:aUHEl+Ag7zl303XWZMSXVB
0x/49lD4mTEqJLNTJEQBny+GVJCn0JIJ9XcVTzM38ZIj2cZmxHezk+33/N7lHBDfiuUdj16mx
ftFwHY4Xt0nQJFaOPEAXONo18JZtPqB5/DT5nMsXajHqJLfDMJSTD8cWmE7oNgYVDYPXTEsix
iUp2hvGjHzK51v6saKZfSgCja6l2W9z5iLJOdAzZHcLscXSNBBM0Onj8Z4rDc2YlXvkJVUjVK
9GxYP/47FoaZ4DzJ1uMzWa9eQ23m//X4bLcTRl4cqu9YvQwGCf3VC/y9aUoVrd0gB9Z9d8kWB
kQfk0z/WoDq1b+wIfp2Khp8SrQagcx3y0MoPmRqCRf7Wm0NMGzg5CL3yPm3Fi+e4Nu4shbtr6
6QMtvUWOyg5saFhYmRYPtFJpbdYoOSeUbchxB0j430d9qFbwmXFBMp6OaBrqwBJ6BS77He5B4
GrbjPlKR4Y1F8FERhRbpWoJLFgjEisysP4wy2zGcG8E1xM8RkeN0i6Wv3taiTuhMt2dp8CR6r
gS23vC0SX9FG2UhZ9g2kOHO7/D35LWDIPNk+vkEbuj3WFBfrM6m5sYLyoDNkjqlrzgRFunxYi
ZxsCCK5cS3R1jb7Wg8kRZEHAcbENYhTaQC3Ro0s58Eaq2EAwR4f7juCfr/hPaAgPQPugVGG2w
G9uo=
X-CMAE-Envelope: MS4wfIIQfuSh4cmTZpjS4P3CDqx8Oac9kCc1pui9wjtAE3EcZE6c+fzYP4qXKnNtwSJGmIxzToagk5lHBkzADSLfyJx4skhqCGYESLLLrSGClFyuAdX4feDb
MFa9D4lJgSo4uz0fO4zU8Y6/30Fnf9Q+71TK35zI6HNPrM5Cl33G9GpYx/xJveFi7VPbu6PAQKO6jg==
--kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Content-Type: text/html; charset=UTF-8
<!DOCTYPE html> <html><body><div>Good day,{info removed}.</div> <div><div>We came across your resume on one of the job seeking websites. As if right now, our company have a few job opportunities to offer. If you are interested, we have provided all information needed with the file attached.</div></div> <div>Should you be interested the position, please <a href="mailto:[email protected]">reply to the our HR</a>. </div><div>Best Regards!</div> </body> </html>
--kenitram-915b9c3f-c9a1-42c6-8124-2f4f01bec20f
Content-Type: application/pdf
Content-Disposition: attachment; filename=Description-8834-VT.pdf
Content-Transfer-Encoding: base64