Submit to DiggSubmit to FacebookSubmit to Google PlusSubmit to StumbleuponSubmit to Twitter

A fake careerbuilder.com email about a job offer claims to notify you of some job offer like Operations Clerk/Online Office Sales.

Spoofs: jobs @careerbuilder.com | auto-notification @fiserv.com | notification @fiserv.com | service @fiserv.com | message @invoind.efax.com

They sometimes also spoof YOUR domain.

As of the first batch of these spam messages, I swear I see no payload. As in no links to any websites, no attachments. Maybe the botnet forgot?

Other emails in the spoofed fiserv.com series:


Subject: Job Offer

Dear Job Seeking Applicant

We at Careerbuilder definitely know how hard it is to
find a decent job. Our team of submit ion technicians
analyze thousand of jobs to deliver you the best
promotional opportunities. Our business partners
ABC Business International have ranked high in our
statistics and we are promoting their Job Opportunity
directly to you for your notice:

Description

Operations Clerk/Online Office Sales

Salary: $2,000/month (plus 5% for every completed order)

Job duties:

• Plan,direct, coordinate the customers;

• Receive/send payments;

• Keep accurate records of all company's transactions.

• Manage the company's online business banking.

Requirements
Qualifications requirements:

• Strong communications skills( to be able to communicate
with customers, investors, partners, management);

• Solid analytical and problem solving skills;

• Strong planning and organizational skills to balance
and prioritize work;

• Good computer skills;

Please send your resume and cover letter at hr @abc-inter.com
to be considered for this position.

If you have any questions or need assistance, please contact
Client Support Specialist at 800-891-8880.

Thank you,
CareerBuilder Promotional Team

This is not a spam. If you have questions regarding this
email please contact customer support at

800-891-8880.

Fake careerbuilder email.

Headers sample:

Received: from rrcs-208-125-189-10.nys.biz.rr.com  [208.125.189.10]
   X-Barracuda-Envelope-From: auto-notification @fiserv.com
   From: "CareerBuilder" <jobs @careerbuilder.com>

Received: from 69-178-170-5.static-ip.telepacific.net [69.178.170.5] X-Barracuda-Envelope-From: auto-notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>

Received: from 50-73-228-110-richmond.hfc.comcastbusiness.net [50.73.228.110] X-Barracuda-Envelope-From: notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>

Received: from fiserv.com [72.54.132.178] X-Barracuda-Envelope-From: auto-notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>

Received: from bzq-84-109-167-187.red.bezeqint.net [84.109.167.187] X-Barracuda-Envelope-From: service @fiserv.com Received: from MAIL51. [ my domain here ] .com (10.0.0.138) by [ my domain] .com (10.0.0.192)
with Microsoft SMTP id ..... From: Administrator <administrator @ [my domain] .com>

Check out that last two. They spoofed my domain for the email to me. I don't have a Microsoft SMTP server anywhere so that helps me know it isn't me. Nor do I have a server called mail51.

Links or attachments:

As of the first batch of these, there are no attachments or links! A phishing scam with no punchline. No Viruses.

The Botnet that sent these probably missed a setting. I'm sure we will see versions later with something in them. Maybe the botnet owner really IS hiring.

 

If this was at least a little helpful, how about a +1, Like, or Tweet?

{jcomments on}