Engr. Ping [email protected] MONEY MULE

Header Analysis Quick Report
Originating IP: 196.46.245.152
Originating ISP: Airtel Networks Limited
City: n/a
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.170.6 with SMTP id t6csp125710ioe;
Wed, 8 Apr 2015 19:37:18 -0700 (PDT)
X-Received: by 10.66.137.2 with SMTP id qe2mr51433495pab.77.1428547037829;
Wed, 08 Apr 2015 19:37:17 -0700 (PDT)
Return-Path: <[email protected]>
Received: from server.southernnevadaseo.com (server.southernnevadaseo.com. [198.57.170.137])
by mx.google.com with ESMTPS id xt6si18915048pbc.59.2015.04.08.19.37.17
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 08 Apr 2015 19:37:17 -0700 (PDT)
Received-SPF: none (google.com: [email protected] does not designate permitted sender hosts) client-ip=198.57.170.137;
Authentication-Results: mx.google.com;
spf=none (google.com: [email protected] does not designate permitted sender hosts) [email protected]
Received: from southeu7 by server.southernnevadaseo.com with local (Exim 4.85)
(envelope-from <[email protected]>)
id 1Yg2LD-0008Bc-Am
for <snipped>; Thu, 09 Apr 2015 02:37:15 +0000
To: <snipped>
Subject: Job Offer
X-PHP-Script: southernnevadaseo.com/hotmail,gmail.php for 196.46.245.152
From: Zhang <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Thu, 09 Apr 2015 02:37:15 +0000
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.southernnevadaseo.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server.southernnevadaseo.com
X-Get-Message-Sender-Via: server.southernnevadaseo.com: authenticated_id: southeu7/only user confirmed/virtual account not confirmed
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php
X-Source-Dir: southernnevadaseo.com:/public_html

We are in need of individuals who can stand as our USA, UK and Europe based representative where our customers can contact you and you can help us attend to customers closer to them and also receive payments from our customers in USA, UK and Europe as we do not run an account in these regions you do not have to be a citizen of the above listed countries but as long as you reside in either USA, UK and Europe you are qualified Salary: 4,850 USD month!(Minimum) Position: Company Representative Experience: None - We will guide you through! Requirements: Positive Attitude, Honesty and Integrity. Schedule: 4+ hours/week. You choose your hours! Employment type: Part-time Note: This does not affect your other jobs as it is on a part-time basis, none of our staff we ask you to pay an upfront to get this employment. For more information, contact Engr. Ping, Regional Representative, E-mail : [email protected]

They are posing as Guangdong Chemical, Ltd Asia

Delivered-To: <snipped>
Received: by 10.194.89.193 with SMTP id bq1csp2283907wjb;
Tue, 14 Apr 2015 15:33:35 -0700 (PDT)
X-Received: by 10.152.88.1 with SMTP id bc1mr21078792lab.79.1429050814865;
Tue, 14 Apr 2015 15:33:34 -0700 (PDT)
Return-Path: <[email protected]>
Received: from forward17h.cmail.yandex.net (forward17h.cmail.yandex.net. [87.250.230.159])
by mx.google.com with ESMTPS id jv1si2272054lbc.13.2015.04.14.15.33.34
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 14 Apr 2015 15:33:34 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 87.250.230.159 as permitted sender) client-ip=87.250.230.159;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 87.250.230.159 as permitted sender) [email protected];
dkim=pass [email protected]
Received: from web30h.yandex.ru (web30h.yandex.ru [84.201.187.164])
by forward17h.cmail.yandex.net (Yandex) with ESMTP id 03A3E20ED5
for <<snipped>>; Wed, 15 Apr 2015 01:33:33 +0300 (MSK)
Received: from 127.0.0.1 (localhost [127.0.0.1])
by web30h.yandex.ru (Yandex) with ESMTP id A186A26C0053;
Wed, 15 Apr 2015 01:33:33 +0300 (MSK)
DKIM-Signature: <snipped>
Received: by web30h.yandex.ru with HTTP;
Wed, 15 Apr 2015 01:33:33 +0300
From: Zhang Ping <[email protected]>
Envelope-From: [email protected]
To: <<snipped>>
In-Reply-To: <CA+67fMhn=u=OeKQer7djJBvB_bbuGrHwXzPEFFX8vcfWyp82fw@mail.gmail.com>
References: <CA+67fMhn=u=OeKQer7djJBvB_bbuGrHwXzPEFFX8vcfWyp82fw@mail.gmail.com>
Subject: Re: Dear Employee ( Employment Details )
MIME-Version: 1.0
Message-Id: <[email protected]>
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Date: Tue, 14 Apr 2015 23:33:33 +0100
Content-Transfer-Encoding: base64
Content-Type: text/html; charset=koi8-r

Dear Employee ,

Guangdong Chemical, Ltd Asia is looking for a part time representative in your region, no additional or formal skills required for this type of work at home job. We aim to support long-term economic growth, social stability, prosperity and progress in the regions where we operate, as well as caring for the environment and ensuring sustainable use of natural and human resources.

We want to achieve consistent and long-term growth of our business, transforming Guangdong Chemical, Ltd Asia into a leading global chemical and natural resource company. We are a reliable manufacturer and exporter chemical, Steel sheet, Steel coil and more Products on the international energy market.

Guangdong Chemical, Ltd Asia is one of the world's biggest vertically integrated companies for production of Chemical ,Steel sheet, Steel coil and more Products. The Company is a leader on Asia and international markets in its core business.Every day millions of people in 30 countries of the world buy our products, and use those products to improve the quality of their lives. Every day more than 150,000 people unite their efforts and talents to give our Company a leading market position.

Guangdong Chemical, Ltd Asia sets itself the objectives to create new value, maintain business stability and provide shareholders with high return on their investments through asset value appreciation and cash dividends.

Guangdong Chemical, Ltd Asia will use all available means to achieve these objectives, including further efforts to reduce costs, operating efficiency increases, improvement of product and service quality, and application of the latest technologies.

In other to facilitate this employment process as a part time representative in your region, you are advised to provide us the details as listed below:

Your Full name:
House and Mailing Address:
Age:
Phone No:
Country:

More details about your job description will be sent to you in our next email.

Best regards,
Mr Ping
Recruitment Officer & Legal Representative

This email from them lays out the money mule job:

Delivered-To: <snipped>
Received: by 10.194.89.193 with SMTP id bq1csp2896756wjb;
Wed, 15 Apr 2015 14:14:02 -0700 (PDT)
X-Received: by 10.152.22.104 with SMTP id c8mr25319777laf.87.1429132442010;
Wed, 15 Apr 2015 14:14:02 -0700 (PDT)
Return-Path: <[email protected]>
Received: from forward17m.cmail.yandex.net (forward17m.cmail.yandex.net. [2a02:6b8:b030::9e])
by mx.google.com with ESMTPS id r2si4851123lbf.41.2015.04.15.14.14.01
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 15 Apr 2015 14:14:02 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a02:6b8:b030::9e as permitted sender) client-ip=2a02:6b8:b030::9e;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a02:6b8:b030::9e as permitted sender) [email protected];
dkim=pass [email protected]
Received: from web16m.yandex.ru (web16m.yandex.ru [37.140.138.107])
by forward17m.cmail.yandex.net (Yandex) with ESMTP id 32F7F21100
for <<snipped>>; Thu, 16 Apr 2015 00:14:01 +0300 (MSK)
Received: from 127.0.0.1 (localhost [127.0.0.1])
by web16m.yandex.ru (Yandex) with ESMTP id B4470DE02F4;
Thu, 16 Apr 2015 00:14:00 +0300 (MSK)
DKIM-Signature: <snipped>
Received: by web16m.yandex.ru with HTTP;
Thu, 16 Apr 2015 00:14:00 +0300
From: Zhang Ping <[email protected]>
Envelope-From: [email protected]
To: <<snipped>>
In-Reply-To: <CA+67fMiMbfCfgAh=bUFaFqzbzccFSg0MMVv3wUR3GHLspcWwHA@mail.gmail.com>
References: <snipped>
Subject: Re: Dear ( Employment Details ) Identification
MIME-Version: 1.0
Message-Id: <[email protected]>
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Date: Wed, 15 Apr 2015 22:14:00 +0100
Content-Transfer-Encoding: base64
Content-Type: text/html; charset=utf-8

Greetings, With regards to your mail please note the following

After full discussion with the management board of Guangdong we would like to give you the opportunity of working with our organization and your employment is based on the following;

Salary: 4,850 USD month!(Minimum)
Position: Company Representative
Experience: None - We will guide you through!
Requirements: Positive Attitude, Honesty and Integrity.
Schedule: 4+ hours/week. You choose your hours!
Employment type: Part-time

For a start, we would do most of the work with regards to contacting the customer and discussing quality and quantity of goods and services wanted.

As soon as a customer indicates willingness to pay for our services or goods, we will give to them your contact details for them to make payment to us through you as our agent after-which you would cash the customers payment at your bank and then we would inform you accordingly.Also you get 2% extra of any payment that is made through you as our agents commission so any payment that comes through you from our customers you get an instant 2% extra and this is not part of your salary as your salary would also be paid to you at the end of the month.When payment has been made, we will also inform you but will need you to confirm to us within the shortest possible time so that we can deliver services almost as soon as payment is made you will then be advised on how to get the funds over to us.

You may also be advised to contact our customers requesting payment only either via phone or e-mail as you deem comfortable by you. You will also be expected to keep me updated on your correspondence with him also when products are shipped out invoices would be sent to you and then you would then send the invoices to the customer after that when we are satisfied that you understand the business then customers in your region can contact you directly for purchase of products and you would the get back to us.

Note: you must be available to answer phone calls from our customers as our representative therefore you must either have to get a phone which we can contact you on and also keep us updated regularly and finally your must be quick to read and reply your email also we would need you to send to us a form of identification either a scanned copy of your passport or an identification card which would be uploaded as our newly employed worker.

I do hope you understand your role for now and if there will be any change, I will let you know before time meanwhile kindly

confirm the receipt of this email by replying us back ..

Note: This does not affect your other jobs as it is on a part-time basis We would NEVER ask for upfront payment from you or our workers.

Your prompt response to this mail will be highly appreciated.

Regards
Ping

Delivered-To: <snipped>
Received: by 10.27.132.212 with SMTP id g203csp919332wld;
Fri, 30 Oct 2015 00:45:13 -0700 (PDT)
X-Received: by 10.112.168.228 with SMTP id zz4mr3229883lbb.73.1446191113424;
Fri, 30 Oct 2015 00:45:13 -0700 (PDT)
Return-Path: <[email protected]>
Received: from forward17j.cmail.yandex.net (forward17j.cmail.yandex.net. [2a02:6b8:0:1630::f4])
by mx.google.com with ESMTPS id p74si3953339lfd.22.2015.10.30.00.45.13
for <<snipped>>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 30 Oct 2015 00:45:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a02:6b8:0:1630::f4 as permitted sender) client-ip=2a02:6b8:0:1630::f4;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a02:6b8:0:1630::f4 as permitted sender) [email protected];
dkim=pass [email protected]
Received: from web18j.yandex.ru (web18j.yandex.ru [5.45.198.59])
by forward17j.cmail.yandex.net (Yandex) with ESMTP id 08F5B21316
for <<snipped>>; Fri, 30 Oct 2015 10:45:12 +0300 (MSK)
Received: from 127.0.0.1 (localhost [127.0.0.1])
by web18j.yandex.ru (Yandex) with ESMTP id 7F5284240197;
Fri, 30 Oct 2015 10:45:12 +0300 (MSK)
DKIM-Signature: <snipped>
Received: by web18j.yandex.ru with HTTP;
Fri, 30 Oct 2015 10:45:12 +0300
From: Zhang Ping <[email protected]>
Envelope-From: [email protected]
To: <<snipped>>
Subject: Re: Dear ( Welcome ) Identification
MIME-Version: 1.0
Message-Id: <[email protected]>
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Date: Fri, 30 Oct 2015 08:45:12 +0100
Content-Transfer-Encoding: 7bit
Content-Type: text/plain

We would like to know if you are still interested in working with us as our company representative cos we currently have some customers in your region which you can attend to and supply has already been made to them we need a representative to attend to them immediately, if Yes, kindly confirm with us of the following details:

***Form of identification
***Home and mailing addressing
***Full Bank Account Details
***Mobile Phone Number

Regards

Ping