Company Representative scams, Payment Processing scams and other Employment scams.
#169763 by Diamond Tue Jun 25, 2013 3:47 pm
After some time without scam emails, I received two at once today, both very similar and most probably sent by the same scammer. They pretend to represent a bank this time! However, lack of any information, names, phones, work from home, strange email addresses and bad English give them away.

The first one:

Hello XXX XXXXX !
An affiliate of Meta Bank is hiring for business mail registrator. This at home position requires internet access. Accounting skills are not required. Potential candidates will be expected to be of full legal age and possess United States valid physical address in order to apply. Applicant has a sense of timeliness and stringency, has ability to work independently, communicate effectively with all company levels.

If you're looking for a part-time, home-based job which will require only 1 hour on a daily base - feel free to contact with your information, such as: First and Last names and e-mail if different from this one. Our representatives will contact with you shortly.


The headers follow:

Delivered-To: xxxxxxxxx@gmail.com
Received: by 10.76.114.195 with SMTP id ji3csp120944oab;
Tue, 25 Jun 2013 07:14:31 -0700 (PDT)
X-Received: by 10.68.76.34 with SMTP id h2mr13682508pbw.20.1372169669881;
Tue, 25 Jun 2013 07:14:29 -0700 (PDT)
Return-Path: <lolipop.jp-dp25133718@users110.phy.lolipop.jp>
Received: from users110.phy.lolipop.jp (users110.phy.lolipop.jp. [210.172.144.216])
by mx.google.com with ESMTP id xx2si11759114pac.248.2013.06.25.07.14.29
for <xxxxxxxx@gmail.com>;
Tue, 25 Jun 2013 07:14:29 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of lolipop.jp-dp25133718@users110.phy.lolipop.jp designates 210.172.144.216 as permitted sender) client-ip=210.172.144.216;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of lolipop.jp-dp25133718@users110.phy.lolipop.jp designates 210.172.144.216 as permitted sender) smtp.mail=lolipop.jp-dp25133718@users110.phy.lolipop.jp
Received: by users110.phy.lolipop.jp (Postfix, from userid 499)
id C5C5E7464C1; Tue, 25 Jun 2013 23:14:28 +0900 (JST)
To: xxxxxxx@gmail.com
Subject: =?UTF-8?B?VmFjYW5jeSBPZmZlciBJbmZvcm1hdGlvbg==?=
From: position@hiringcenter.in
Reply-To: position@hiringcenter.in
Errors-To: position@hiringcenter.in
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <20130625141428.C5C5E7464C1@users110.phy.lolipop.jp>
Date: Tue, 25 Jun 2013 23:14:28 +0900 (JST)


The second one I will post just in case, as it's very similar, but not exactly the same.

The text:

Hello XXXXXX XXXXXXX !
A partner of Meta Bank is hiring for business mail registrar. This at home job requires internet access. Accounting skills are not required. Potential candidates must be of full legal age and possess United States valid physical address in order to apply. Candidate should demonstrate a sense of timeliness and urgency, has ability to work independently, communicate effectively with all company levels.

If you're looking for a part-time, home-based job which will obligate only 1 hour on a daily base - feel free to reply with your information, such as: First and Last names and email if different from this one. Our managers will contact with you shortly.


And its headers:
Delivered-To: xxxxxxxxxx@gmail.com
Received: by 10.76.114.195 with SMTP id ji3csp121537oab;
Tue, 25 Jun 2013 07:22:56 -0700 (PDT)
X-Received: by 10.66.221.132 with SMTP id qe4mr33130932pac.200.1372170175810;
Tue, 25 Jun 2013 07:22:55 -0700 (PDT)
Return-Path: <chapadeo@box685.bluehost.com>
Received: from outbound-ss-1164.bluehost.com (outbound-ss-1164.bluehost.com. [74.220.219.251])
by mx.google.com with SMTP id tr9si11501935pbc.193.2013.06.25.07.22.55
for <xxxxxxxxx@gmail.com>;
Tue, 25 Jun 2013 07:22:55 -0700 (PDT)
Received-SPF: pass (google.com: domain of chapadeo@box685.bluehost.com designates 74.220.219.251 as permitted sender) client-ip=74.220.219.251;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of chapadeo@box685.bluehost.com designates 74.220.219.251 as permitted sender) smtp.mail=chapadeo@box685.bluehost.com
Message-Id: <51c9a7bf.e9e8440a.7a2e.fffffac5SMTPIN_ADDED_MISSING@mx.google.com>
Received: (qmail 31087 invoked by uid 0); 25 Jun 2013 14:22:55 -0000
Received: from unknown (HELO box685.bluehost.com) (66.147.244.185)
by soproxy4.bluehost.com with SMTP; 25 Jun 2013 14:22:55 -0000
Received: from localhost ([127.0.0.1]:47124 helo=box685.bluehost.com)
by box685.bluehost.com with esmtp (Exim 4.80)
(envelope-from <chapadeo@box685.bluehost.com>)
id 1UrU8w-0003Dp-0V
for xxxxxxxx@gmail.com; Tue, 25 Jun 2013 08:22:55 -0600
Date: Tue, 25 Jun 2013 08:22:49 -0600
To: xxxxxxxxx@gmail.com
Subject: =?UTF-8?B?V29yayBndWlkYW5jZS4=?=
X-PHP-Script: http://www.chapa-de.org/chapaadmin/wp.modules.php for 64.27.23.80
From: job-at-home@hiringpoint.biz
Reply-To: job-at-home@hiringpoint.biz
Errors-To: job-at-home@hiringpoint.biz
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Identified-User: {:box685.bluehost.com:chapadeo:box685.bluehost.com} {sentby:program running on server}

#171479 by Diamond Mon Jul 15, 2013 6:17 am
Got two more scam emails mentioning the same "Meta Bank". They're different, but I'll post only one. Of course, once again bad English and lack of any contact information or even the sender's name speak for themselves...

The text:

Dear XXXXXXX XXXXXX !

A partner of Meta Bank is hiring for business
correspondance registrator.
This at-home job which will obligate you to receive a personal paper-mail of our partners
to your address, position requires internet access.

Accounting experience
is not required. Potential candidates will be expected to be of full legal age
and possess United States valid physical address in order to apply. Candidate
has a sense of timeliness and stringency, has ability to work
individually, communicate effectively with all company levels.


If you're looking for a part-time, home-based job which will only obligate 1 hour on
a daily base - feel free to contact with your information, such as: First and Last names
and email if different from this one. Our managers will contact with you shortly.


and the headers:

Delivered-To: xxxxxxx@gmail.com
Received: by 10.76.19.11 with SMTP id a11csp175845oae;
Fri, 12 Jul 2013 11:36:06 -0700 (PDT)
X-Received: by 10.49.11.168 with SMTP id r8mr36951543qeb.34.1373654166304;
Fri, 12 Jul 2013 11:36:06 -0700 (PDT)
Return-Path: <beowolfdomain@linhostssl21.prod.mesa1.secureserver.net>
Received: from m1smtphosting01-01.prod.mesa1.secureserver.net (nat-64-202-161-71.ip.secureserver.net. [64.202.161.71])
by mx.google.com with SMTP id r1si12143537qej.21.2013.07.12.11.36.05
for <xxxxxxxxx@gmail.com>;
Fri, 12 Jul 2013 11:36:06 -0700 (PDT)
Received-SPF: pass (google.com: domain of beowolfdomain@linhostssl21.prod.mesa1.secureserver.net designates 64.202.161.71 as permitted sender) client-ip=64.202.161.71;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of beowolfdomain@linhostssl21.prod.mesa1.secureserver.net designates 64.202.161.71 as permitted sender) smtp.mail=beowolfdomain@linhostssl21.pr ... server.net
Received: (qmail 32099 invoked from network); 12 Jul 2013 18:36:05 -0000
Received: from unknown (HELO linhostssl21.prod.mesa1.secureserver.net) ([208.109.78.193])
(envelope-sender <beowolfdomain@linhostssl21.prod.mesa1.secureserver.net>)
by m1smtphosting01-01.prod.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP
for <xxxxxxx@gmail.com>; 12 Jul 2013 18:36:05 -0000
Received: from linhostssl21.prod.mesa1.secureserver.net (localhost [127.0.0.1])
by linhostssl21.prod.mesa1.secureserver.net (8.13.8/8.12.11) with ESMTP id r6CIa59V011600
for <xxxxxxxxx@gmail.com>; Fri, 12 Jul 2013 11:36:05 -0700
Received: (from beowolfdomain@localhost)
by linhostssl21.prod.mesa1.secureserver.net (8.13.8/8.12.11/Submit) id r6CIa5sj011597;
Fri, 12 Jul 2013 11:36:05 -0700
Date: Fri, 12 Jul 2013 11:36:05 -0700
Message-Id: <201307121836.r6CIa5sj011597@linhostssl21.prod.mesa1.secureserver.net>
To: xxxxxxxx@gmail.com
Subject: =?UTF-8?B?UG9zaXRpb24gaW4gTG9naXN0aWNzIC0gSW1tZWRpYXRlIFN0YXJ0?=
From: metabank@hrcenterusa.net
Reply-To: metabank@hrcenterusa.net
Errors-To: metabank@hrcenterusa.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
#171490 by Mike Wilson Mon Jul 15, 2013 8:50 am

Buying a pet online?
If the seller or shipper asks for money to be sent via Western Union, Money Gram, GreenDot MoneyPak number or mentions Cameroon it is a scam.

mikeawilsons @ gmail.com
#171812 by Mike Wilson Thu Jul 18, 2013 8:24 pm

Buying a pet online?
If the seller or shipper asks for money to be sent via Western Union, Money Gram, GreenDot MoneyPak number or mentions Cameroon it is a scam.

mikeawilsons @ gmail.com
#176523 by RonA Mon Sep 16, 2013 3:08 pm
Meta Bank is at it again. this time the email address used is
Metabank@frontstaffing.biz.

An affiliate of Meta Bank is hiring for business mail registrant. This at home position requires internet access. Accounting experience is not required. Potential candidates must be of full legal age and possess United States valid physical address in order to apply. Applicant has a sense of timeliness and stringency, has ability to work individually, communicate effectively with all company levels.

If you're looking for a part-time, home-based job which will obligate only 1 hour on a daily base - feel free to contact with your information, such as: First and Last names and email if different from this one. Our representatives will contact with you shortly.


and here is the path:
From metabank_hr@frontstaffing.biz Mon Sep 16 09:46:05 2013
X-Apparently-To: Removed (BW) via 98.138.206.239; Mon, 16 Sep 2013 09:46:06 -0700
Return-Path: <adixson@cwh15.canadianwebhosting.com>
X-YahooFilteredBulk: 64.34.111.235
Received-SPF: none (domain of cwh15.canadianwebhosting.com does not designate permitted sender hosts)
X-YMailISG: mT7viPsWLDsErCkROITi4thJpRFq5z07tqTqCaGL3LTHqJuz
ascz9PIF9RdF0DE4fX_5h1HOOIhyKwBVQeGmjb5VQoH8Tde2KxMGMzRLMd78
jxfLzd3Zv588ws8fXuKowHrLcWgPY4aa8JgQPeoJ3ciOLDKE9TrnJXc6wFfQ
rCSkIRSBx0SLUeGOER6BiyB0CJEoF7DkW8bFMN.p2VdHIgPeA8eUQzoVygOc
K20wkR.4pSoDlHoxdp92fLb8Vzkohdnr30vUrdo1My.nOrAHdtiLnZzW220z
V8VWpCdqaGJ08X.XK6htv.wwCaZERMjhVNFN3naPW46KN7gj3pLZ0KOo1iq_
B48As3kH_Cll3I6R9o5bd_cdN0FdmOf0qZXEjOaEKM_HT7XLHlpIUvrUzfk3
fPgXg9j9mBOcbRL5LcclKGdU4HLBzxi60OzRAVU_stWJLLMlhsqXxbCT1ou5
WLIu.sDXWmrmfhU0T43Ln1bcczw2wyrnpwXqh9KoWFMW_KoinIh9dazo9Iky
RZt_x8X9bQcu5G6eA0YHBXo7_PVJpSFZLRsQk7e2.trm7_wS9M21NSvH1PMY
28.W2sdGkqCwTRU05XzCoLQ32C8f2I5b69Y0lm49dJn_7.AkettUaNtzlKaN
ZkNTCIFpftFikk5R6X03_0KDGJbnLgyrZ9byHyiRcwekbor4Eok381ItbyIu
7BL9YC_URvoHhhBZlK_Wt73qSc46SZg6CymruXYKmK0uZwjKRoYD9rr.4vXY
t_DWvtSRoaUisu_aIODZoeFVT6a8xSF7lMcMd.d9MM3I_HItnsXUv.DqwwVQ
wPg5qlMy4o0SErzuIog_pTtR2wF8f6bpEt8RTd.ixX2sjUHNuzEAbs.LvNPm
R3FbbNaxyxvw8nnbtblG0Fq8.dvCUFuH9yBLb85n.7GikyR0GxOfyUtD7rr_
L6vxQh9EHEGP0OtqUr.Hxhd8reYhfa8OfAoII.XymSQZQmM_8n33VRDW9hJo
N_9ofWel_PuPLTSlkes4ZbGNoRyzpj5t83d7nRjMExz7ciSc1dFYhmZabckt
S2BCL0xw34a3KvRYcTiNrjb48rAlkuoQgi4fG0HVenNBk8z4FyTBnH9O9.q1
YwJy7WxzisY1pO_Yaz3V2jFYk4Y72brGFvu2G4C9qb7lYL0dFHSlHM9bf02V
qus4Urj1KJ02EPTy1cpG8IlkqYkZx7kdkSAitaY-
X-Originating-IP: [64.34.111.235]
Authentication-Results: mta1188.mail.gq1.yahoo.com from=; domainkeys=neutral (no sig); from=frontstaffing.biz; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO barmail5.idig.net) (64.34.111.235)
by mta1188.mail.gq1.yahoo.com with SMTP; Mon, 16 Sep 2013 09:46:05 -0700
X-ASG-Debug-ID: <removed> mw
Received: from cwh15.canadianwebhosting.com (cwh15.canadianwebhosting.com [216.187.92.75]) by barmail5.idig.net with ESMTP id LqDElG21FGRG9KWW for <REMOVED MW>; Mon, 16 Sep 2013 09:46:05 -0700 (PDT)
X-Barracuda-Envelope-From: adixson@cwh15.canadianwebhosting.com
X-Barracuda-Apparent-Source-IP: 216.187.92.75
Received: from adixson by cwh15.canadianwebhosting.com with local (Exim 4.80.1)
(envelope-from <adixson@cwh15.canadianwebhosting.com>)
id 1VLbw5-0003J7-0e
for Removed (BW); Mon, 16 Sep 2013 09:46:05 -0700
To: Removed (BW)
Subject: < Removed > MW
From: metabank_hr@frontstaffing.biz
X-ASG-Orig-Subj: =?UTF-8?B?Sm9iIE9wZW5pbmdzIGZvciBSb24gQXJiZXR0ZXIgIQ==?=
Reply-To: metabank_hr@frontstaffing.biz
Errors-To: metabank_hr@frontstaffing.biz
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <E1VLbw5-0003J7-0e@cwh15.canadianwebhosting.com>
Date: Mon, 16 Sep 2013 09:46:05 -0700
X-Barracuda-Connect: cwh15.canadianwebhosting.com[216.187.92.75]
X-Barracuda-Start-Time: 1379349965
X-Barracuda-URL: http://64.34.111.235:8000/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at idig.net
X-Barracuda-BRTS-Status: 1
X-Barracuda-Spam-Score: 0.82
X-Barracuda-Spam-Status: No, SCORE=0.82 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=3.5 tests=MIME_QP_LONG_LINE, MIME_QP_LONG_LINE_2, NO_REAL_NAME
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.140660
Rule breakdown below
pts rule name description
---- ---------------------- --------------------------------------------------
0.00 NO_REAL_NAME From: does not include a real name
0.00 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
0.82 MIME_QP_LONG_LINE_2 RAW: Quoted-printable line longer than 76 chars
Content-Length: 687

A quick reverse DNS check shows it to be a website based out of Germany.
#176553 by Mike Wilson Mon Sep 16, 2013 11:17 pm
Hello and welcome to Scamwarners,
Thank you for your post which led to additional information.

Additional email addresses and telephone numbers associated with this scam.


The above domains are in the process of being reported for fraud.

charlottehalley@ymail.com|charlotte halley|4433569876
pepperalise@yahoo.com|Alise Pepper|804-835-7117
pjones0311@gmail.com|Patrick Jones|6017600537
Robertromero32@gmail.com|Robert Romero|505-944-6299
Caseyerine@yahoo.com|Erin Casey|(630) 292-7979

Buying a pet online?
If the seller or shipper asks for money to be sent via Western Union, Money Gram, GreenDot MoneyPak number or mentions Cameroon it is a scam.

mikeawilsons @ gmail.com
#176683 by vonpaso xlura Wed Sep 18, 2013 11:40 pm
Another address apparently related (I sent an email to frontstaffing.biz from one of my fake addresses and shortly thereafter got a package mule letter to the same address) is hr@us-royalmail.com.

Return-Path: <USDeptofRoyalMail-qyuuyt1iumhkhj1i@cmail1.com>
Received: from compute1.internal (compute1.nyi.mail.srv.osa [10.202.2.41])
by sloti15t15 (Cyrus git2.5+0-git-fastmail-9406) with LMTPA;
Wed, 18 Sep 2013 12:30:24 -0400
X-Sieve: CMU Sieve 2.4
X-Spam-charsets: subject='utf-8', plain='utf-8', html='utf-8'
X-Resolved-to: ???????????@xsmail.com
X-Delivered-to: ???????????@xsmail.com
X-Mail-from: USDeptofRoyalMail-qyuuyt1iumhkhj1i@cmail1.com
Received: from mx2 ([10.202.2.201])
by compute1.internal (LMTPProxy); Wed, 18 Sep 2013 12:30:24 -0400
Received: from mx116.d.outbound.createsend.com (mx116.d.outbound.createsend.com [27.126.148.116])
by mx2.messagingengine.com (Postfix) with ESMTP id 3EF046C0471
for <???????????@xsmail.com>; Wed, 18 Sep 2013 12:30:24 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=cs2013; d=cmail1.com;
h=From:To:Reply-To:Date:Subject:MIME-Version:Content-Type:List-Unsubscribe:Sender:Message-ID; i=hr=3Dus-royalmail.com@cmail1.com;
bh=oxstco0Jb5uLaE/EI30L0CinKaE=;
b=pvZiCfiUDcawlNZdxB0xNEZoWbqkS7vAFOZx8mYXx0YQyFrD9fSyXAHDxnvXHrS9OwkC80td8ZdJ
iLsiJxt0awM2mM8JW+Nt9INjJol03UEpF8G+IE9U28SEPw+FilOqq1U1L9k/Syi0hYNKclsOPW1r
k4rsvS4nFmDNHTSwfMU=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=cs2013; d=cmail1.com;
b=XjB0YKRKYO+MmK+gWwdAObhdtGZyo3rgL58aFHdDHXuz3Uv7a3GuKyLTcDJXzjrDCF375Eewv7u9
s/Kl/1hQWMDkGL2CVSIPmpT2KxQ6jIuaOfdvWa4vPv36ET6aUeout1bOskewZnXY22xJCrHussbf
sU/xmP6xWj7vFnEdz+8=;
Received: by mx116.d.outbound.createsend.com id h77ai01hsps0 for <???????????@xsmail.com>; Thu, 19 Sep 2013 02:30:19 +1000 (envelope-from <USDeptofRoyalMail-qyuuyt1iumhkhj1i@cmail1.com>)
From: "U.S. Dept of Royal Mail" <hr@us-royalmail.com>
To: "???? ???????" <???????????@xsmail.com>
Reply-To: hr@us-royalmail.com
Date: Thu, 19 Sep 2013 02:30:17 +1000
Subject: =?utf-8?Q?Job_for_?=
=?utf-8?Q?????_????????=
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=aspNetEmail=_d5ac7ea1424a43408b0e262e3dec0fec"
X-Mailer: Create Send
X-Complaints-To: abuse@cmail1.com
List-Unsubscribe: <http://unsub.cmail1.com/t/i-u-qyuuyt-iumhkhj/>
Sender: "U.S. Dept of Royal Mail" <hr=us-royalmail.com@cmail1.com>
Received: from [71.58.172.75] by cmail1.com via HTTP; Thu, 19 Sep 2013
02:30:17 +1000
Message-ID: <cm.023017.qyuuyt.iumhkhj.i@cmail1.com>

About us

Royal Mail aims to recruit the best personnel in all areas of our business. As a world-class company, we offer roles in operations, human resources, finance, sales and marketing and IT, as well as in our management and executive teams. Our vision is to be the most successful delivery company. Royal Mail employees are at the forefront of our ambition to deliver the best possible service to our customers. In line with our ambitious programme of transformation and change – we’re modernising. This means increased investment in training and equipment, including spending on automation processes in order to make them less laborious.



"Correspondence processor" job position

9/18/2013

Dear ????,

We are looking ? person for correspondence processing. Our at-home position will take just an hour per day. So you can manage the time according your plans and just check the mailbox to count mail by end of the day.

Royal Mail assigns you to perform the following tasks:
1. Receive paper mail for our client names to your address.
2. Count and notify us via email about received paper mail.
3. Receive prepaid shipping labels via email for weekly forwarding of collected mail.
4. Forward mail to proper address according with provided information to the nearest FedEx office (or FedEx dropbox) every Tuesday.

Just click to see attached Contract, it will take you ten minutes to fill document up. After it will be sent to us, you are considered for this position and we will contact you within the next 1-2 days.

We process your compensation through PayPal weekly.

Click HERE to download contract.doc file
This URL is valid until September 25, 2013.

Completed contract send to hr@us-royalmail.com

Combine your experience and at-home location by joining our exciting US Department of Royal Mail is pleased to offer a competitive compensation and ability to have another prime job. If you will demonstrate sens of professional communication with all levels of the organization, working with us you may find an excellent career development opportunities. These are challenging and exciting times to join the Royal Mail. In return for their commitment, we can offer new staff a competitive salary plus all the training and development they need to reach their full potential.





This email was sent from a notification only address and cannot receive incoming messages.

Edit your subscription | Unsubscribe


© Copyright 2013
Royal Mail Group Limited
All rights reserved.
350 St.Marks Place Staten Island, NY 10301

This scammer doesn't know one side of the Pond from the other!

No one serving as a soldier gets tangled up in affairs of life. He wants to please his enlisting officer. 2 Tim. 2:4

Who is online

Users browsing this forum: Baidu [Spider], Google Adsense [Bot] and 20 guests