Arnott Capital Management

This one looked very real but as always I paid a lot of attention to what is used, the domain of the email address is only 20 days old so it looks very dodgy.

Finance Officer (No Experience Required) - United Kingdom

An exciting opportunity has arisen for a Finance Officer looking to progress their career to join a growing group of companies.

Salary - £19,400 (Full-Time); £14,500 (Part-Time)

Key Skills:

A responsible attitude.
Accurate and good attention to detail.
The ability to work on own initiative.
Calmness under pressure.
Candidates must also be available to start immediately.

If you would like to apply for the role of Finance Officer please apply with your CV.

HR Manager
Jennie J. Walter
Arnott Capital Management

Growing? Looks like starting to me.

Return-Path: <[email protected]>
Delivered-To: (removed)
Received: from mxen3.enta.net (mxen3.enta.net [78.33.48.6])
by nbg-mail.viper.enta.net (Postfix) with ESMTP id EA89D2162002
for <(removed)>; Sat, 17 May 2014 09:53:42 +0100 (BST)
Received: from localhost (localhost [127.0.0.1])
by mxen3.enta.net (Postfix) with ESMTP id BDE41B97007
for <(removed)>; Sat, 17 May 2014 09:53:42 +0100 (BST)
Received: from mxen3.enta.net ([127.0.0.1])
by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024)
with ESMTP id 07639-07 for <(removed)>;
Sat, 17 May 2014 09:53:40 +0100 (BST)
X-Greylist: delayed 00:06:40 by SQLgrey-1.7.6
Received: from smtp106.biz.mail.gq1.yahoo.com (smtp106.biz.mail.gq1.yahoo.com [98.137.12.181])
by mxen3.enta.net (Postfix) with SMTP id 21FF2B97021
for <(removed)>; Sat, 17 May 2014 09:53:39 +0100 (BST)
Received: (qmail 8493 invoked from network); 17 May 2014 08:46:59 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1400316419; bh=y9O1R9ohI8Q8aNM07eQj1Einkd3aYrwzWgI0PkV96Bs=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:X-Rocket-Received:Date:From:Organization:To:Message-ID:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; b=CdcHiMPQ84NZJBff9YldDLMZnIWGNKMlrUQPKtCM9kvY+oSvrevJ9VrfNNH1/4PqMPTKQBe2EimTfVZiGNnT+s9tgdCafe0hh/GkBcyHsay3DsqInEd5w5yWhEEKpPrF8u7G+ab++LCcocV5gA+8ua73LG41ywVxgXeKloQjjY0=
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: cVScLL4VM1kI84TUZP4V2i69_edpusM74UrweZdZSfFLsTE
bYziiJAEg0JOFLyBcZ9pmB4jQ3Zap9oc0x1pVvacHw5x6hIgEVaLOjsgPhap
A2UoW3jPTaoQxqswUH3XoH996D.qB3KbkxWK054.K47__dMJWoopjIOjSH04
K6rWhMXu7yufPaujuOaSh7V4tKwTEX94UwE_f84tAC5G.UYfIx32ViKGK2Db
XMeSKjnZ2q9CDYJtcDF09XtLX8lg7Ylds4DZTxRCbgCg9uN1bHW8A6YpxKom
cBtutn4DS0PFlnsdc.UbX9fgiepXY9Uo6THLyszjhHCt8UwhByhQxnz6bBff
h1mgBbqiFQQfL6qOzGrj5w6C7LbVqD_KGhFPsbyWt0KobRMTF70wBaog8PhM
rQHqGjnewBJbn2tjghPsUwzLCYMxSeuzllLW9eVCgNOocb6pUeZn16a20SKu
9JE1NKO2YIM7jooqw7vxZKKOiHHA2ZL7N6qo_mh8s8OuI4CZkIMde
X-Yahoo-SMTP: LbT0nciswBDm28jJC4ApumKUSp204wA-
X-Rocket-Received: from [208.71.40.208] ([email protected] with plain [208.71.40.208])
by smtp106.biz.mail.gq1.yahoo.com with SMTP; 17 May 2014 08:46:59 +0000 UTC
Date: Sat, 17 May 2014 08:13:48 +0000
From: "Jennie J. Walter" <[email protected]>
Organization: Arnott Capital Management
To: (removed)
Message-ID: <[email protected]>
Subject: Offer of employment for (removed) 17/05
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.2a
X-Spam-Status: No, hits=1.107 tagged_above=-999 required=3
tests=HTML_MESSAGE=0.001, LOTS_OF_MONEY=0.001, MIME_HTML_ONLY=1.105,
RCVD_IN_DNSWL_NONE=-0.0001
X-Spam-Level: *
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Tracker: AAAAAA==

Fake site here

http://www.arnottcm.com/index.php?q=index

Changed at request of Mike Wilson

Anyone getting one of these job offers should look at how the site is shown on Google and if they see this walk away.

arnottcm.com/
A description for this result is not available because of this site's robots.txt

I have made the relevant text bold and red. The thing is that a check like this doesn't require any technical knowledge or time-wasting research.

What it means is that the website is stopping Google from 'crawling' the website contents and indexing it, effectively hiding, which is the opposite of what any regular commercial entity will do. The fraudsters do it because these websites have been cloned and produced in large numbers for unscrupulous purposes and the fraudsters only want their chosen victims to find them.

The tactic is very good at hiding/cloaking the site, but the downside is that it means that they are easy to identify with this very simple check.

[AlanJones]

Address:40 Wall St, New York, NY 10005
Phone:
E-mail:[email protected]

Legitimate companies have a phone number for their customers to contact them.

The website http://www.arnottcm.com is in the process of being reported for fraud.

It's a Grafton-Riggs money mule site. "Finance officer" is a euphemism for money laundering.

It's a Grafton-Riggs money mule site. "Finance officer" is a euphemism for money laundering.

Thought that might be the case as few positions in finance have the statement 'No Experience Required'.

Anyone getting one of these job offers should look at how the site is shown on Google and if they see this walk away.

arnottcm.com/
A description for this result is not available because of this site's robots.txt

I have made the relevant text bold and red. The thing is that a check like this doesn't require any technical knowledge or time-wasting research.

What it means is that the website is stopping Google from 'crawling' the website contents and indexing it, effectively hiding, which is the opposite of what any regular commercial entity will do. The fraudsters do it because these websites have been cloned and produced in large numbers for unscrupulous purposes and the fraudsters only want their chosen victims to find them.

The tactic is very good at hiding/cloaking the site, but the downside is that it means that they are easy to identify with this very simple check.

I'll bear that in mind was wondering what that ment when I googled the site