Misc Fraud. [email protected]

The script here is kinda vague but the scam probably involves fake checks.

A person with experience to carry out general P.A duties, Your skills must include a sound knowledge of Microsoft Word and Excel, efficient time management and a good telephone manner. An immediate start would be preferred -Must be enthusiastic and self motivated -Must have good command of English -Must be able to remain calm under pressure -Must be willing to learn new skills Your CV/application should include details of past and present experiences, professional or educational qualifications, Training, any skills and strength, and any information to support your application. Unsuccessful applicants will be kept informed and considered for upcoming vacancies via email. [email protected] must be Us citizen


Email header details;

X-Apparently-To: *removed* via 98.138.85.170; Fri, 24 Jun 2011 15:10:18 -0700
Return-Path: <[email protected]>
X-YahooFilteredBulk: 116.199.203.199
Received-SPF: none (domain of kalasan.idwebhost.com does not designate permitted sender hosts)
X-YMailISG: *removed loooong code thingy*
X-Originating-IP: [116.199.203.199]
Authentication-Results: mta1165.mail.sk1.yahoo.com from=vegemail.com; domainkeys=neutral (no sig); from=vegemail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO kalasan.idwebhost.com) (116.199.203.199) by mta1165.mail.sk1.yahoo.com with SMTP; Fri, 24 Jun 2011 15:10:18 -0700
Received: from nobody by kalasan.idwebhost.com with local (Exim 4.69) (envelope-from <[email protected]>) id 1QaDg3-0002uX-W9 for *removed*; Sat, 25 Jun 2011 04:12:36 +0700
To: *removed*
Subject: PERSONAL ASSISTANT NEEDED
X-PHP-Script: http://www.indomurayama.co.id/imageslama/khalif.php for 82.128.82.193
From: Home Biz <[email protected]>
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Date: Sat, 25 Jun 2011 04:12:35 +0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - kalasan.idwebhost.com
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - kalasan.idwebhost.com
X-Source: /usr/bin/perl
X-Source-Args: fd - (child) (PT) checking user processes
X-Source-Dir: /etc/csf

More of the scammers script and details of his mule which might help those searching the internet.



Hello *****,
How are you doing today?Sorry for delayed responce in getting back to you, I am pleased to inform you that the funds for donations to the orphanage has been sent and you will be getting it any moment from now via fedex courier service with tracking number *removed* The payment was sent to your home address, kindly make sure you get a hold of the Payment so that you can proceed on your first assignment.However, I contacted the orphanage home and I was given the list of the items needed, The items are much and it will cost a lot of money to get them shipped, so we have since come to a conclusion. They will be getting the items themselves,all you need do is just to receive the payment, have it cashed at your bank deduct your own pay of $400 for the week, and then you have the remaining funds sent via Western Union Money Transfer to the orphanage home for a start,work will begin proper next week.

Below is the person in charge of the Orphanage Western Union information to send the funds..

Name: Carlos Lopes
Address: 638 Madison Ave,
City: Bronx
State: 10456
Zip Code: New York

When sending the funds, ensure you send it using the money in minute optionKindly get back to me with the folllowing information after funds sent out including:
1...Exact Amount Sent afte charges deducted (Kindly have them deduct all charges to have the money sent from our own pay as it does not affect your pay in any way)
2...10 digit Money Transfer Control Number

I will be waiting to read back from you and I also have some other assignment for you to be done next week.I want you to be rest assured that I'll never stress you at all in any assignment given to you and I promise to pay your fee weekly as we both agreed.

Take good care of yourself and have a blessed day.
Await your response.

Regards
Robin Kimball



Email header details;

Delivered-To: *removed*
Received: by 10.223.74.137 with SMTP id u9cs67827faj;
Tue, 12 Jul 2011 05:28:28 -0700 (PDT)
Received: by 10.90.249.5 with SMTP id w5mr41988agh.40.1310473707297;
Tue, 12 Jul 2011 05:28:27 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mwsmtp01vmoc.mail2world.com (mwsmtp01vmoc.mail2world.com [209.67.128.171])
by mx.google.com with ESMTP id b14si6680409anp.23.2011.07.12.05.28.25;
Tue, 12 Jul 2011 05:28:26 -0700 (PDT)
Received-SPF: neutral (google.com: 209.67.128.171 is neither permitted nor denied by best guess record for domain of [email protected])

client-ip=209.67.128.171;
Authentication-Results: mx.google.com; spf=neutral (google.com: 209.67.128.171 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from mail pickup service by mwsmtp01vmoc.mail2world.com with Microsoft SMTPSVC;
Tue, 12 Jul 2011 05:28:25 -0700
auth-sender:[email protected]
Return-Path: <[email protected]>
Received: from 10.1.106.91 unverified ([10.1.106.91]) by mwsmtp01vmoc.mail2world.com with Mail2World SMTP Server;
Tue, 12 Jul 2011 05:28:24 -0700
Thread-Topic: PAYMENT PACKET AND ASSIGNMENT
Received: from [82.128.82.205] by vegemail.com with HTTP; 7/12/2011 5:28:24 AM PST
X-M2WAction: reply
thread-index: AcxAjzGCK/PTQmyaS0i6C29atCgjuQ==
From: "Home Biz" <[email protected]>
To: <*removed*>
Subject: PAYMENT PACKET AND ASSIGNMENT
Date: Tue, 12 Jul 2011 05:28:24 -0700
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_1CEB4_01CC4054.8525A890"
X-Mailer: Microsoft CDO for Exchange 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325
X-OriginalArrivalTime: 12 Jul 2011 12:28:25.0167 (UTC) FILETIME=[321575F0:01CC408F]