A fake careerbuilder.com email about a job offer claims to notify you of some job offer like Operations Clerk/Online Office Sales.
Spoofs: jobs @careerbuilder.com | auto-notification @fiserv.com | notification @fiserv.com | service @fiserv.com | message @invoind.efax.com
They sometimes also spoof YOUR domain.
As of the first batch of these spam messages, I swear I see no payload. As in no links to any websites, no attachments. Maybe the botnet forgot?
Other emails in the spoofed fiserv.com series:
- Job Offer (Careerbuilder)
- Unable to process your most recent Bill Payment
- Fiserv Secure Email Notification
- Outgoing Money Transfer
- UPS - Your package is available for pickup
- Last Month Remit
Subject: Job Offer
Dear Job Seeking Applicant
We at Careerbuilder definitely know how hard it is to
find a decent job. Our team of submit ion technicians
analyze thousand of jobs to deliver you the best
promotional opportunities. Our business partners
ABC Business International have ranked high in our
statistics and we are promoting their Job Opportunity
directly to you for your notice:
Operations Clerk/Online Office Sales
Salary: $2,000/month (plus 5% for every completed order)
• Plan,direct, coordinate the customers;
• Receive/send payments;
• Keep accurate records of all company's transactions.
• Manage the company's online business banking.
• Strong communications skills( to be able to communicate
with customers, investors, partners, management);
• Solid analytical and problem solving skills;
• Strong planning and organizational skills to balance
and prioritize work;
• Good computer skills;
Please send your resume and cover letter at hr @abc-inter.com
to be considered for this position.
If you have any questions or need assistance, please contact
Client Support Specialist at 800-891-8880.
CareerBuilder Promotional Team
This is not a spam. If you have questions regarding this
email please contact customer support at
Received: from rrcs-208-125-189-10.nys.biz.rr.com [22.214.171.124] X-Barracuda-Envelope-From: auto-notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>
Received: from 69-178-170-5.static-ip.telepacific.net [126.96.36.199] X-Barracuda-Envelope-From: auto-notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>
Received: from 50-73-228-110-richmond.hfc.comcastbusiness.net [188.8.131.52] X-Barracuda-Envelope-From: notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>
Received: from fiserv.com [184.108.40.206] X-Barracuda-Envelope-From: auto-notification @fiserv.com From: "CareerBuilder" <jobs @careerbuilder.com>
Received: from bzq-84-109-167-187.red.bezeqint.net [220.127.116.11] X-Barracuda-Envelope-From: service @fiserv.com Received: from MAIL51. [ my domain here ] .com (10.0.0.138) by [ my domain] .com (10.0.0.192)
with Microsoft SMTP id ..... From: Administrator <administrator @ [my domain] .com>
Check out that last two. They spoofed my domain for the email to me. I don't have a Microsoft SMTP server anywhere so that helps me know it isn't me. Nor do I have a server called mail51.
Links or attachments:
As of the first batch of these, there are no attachments or links! A phishing scam with no punchline. No Viruses.
The Botnet that sent these probably missed a setting. I'm sure we will see versions later with something in them. Maybe the botnet owner really IS hiring.
If this was at least a little helpful, how about a +1, Like, or Tweet?