I received another job offer today. The same one as two days ago – from a different sender, for the same company and another link.
The new header runs:
Return-Path: akstcxylbmnsdgs@xylb.com
Received: from 87-205-210-108.adsl.inetia.pl (87.205.210.108)
by xxxxxxxx.grootersnet.nl (V5.6-9, OpenVMS V8.3 Alpha);
Fri, 24 Aug 2007 23:14:43 +0100 (CET)
Return-Path: <akstcxylbmnsdgs @xylb.com>
Received: from 218.66.102.106 (HELO mail.xylb.com)
by grootersnet.nl with esmtp (?< ?*A+.7,/0 >)(7)
id S.DCAR-TAHH0N-+)
for willem@grootersnet.nl; Fri, 24 Aug 2007 21:15:33 -0100
Message-ID: <01c7e693$e85df080$6c822ecf@akstcxylbmnsdgs>
From: "Enid Mullen" </akstcxylbmnsdgs>l<akstcxylbmnsdgs @xylb.com>
To: (me)
Subject: job for you
Date: Fri, 24 Aug 2007 21:15:33 -0100
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-2";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.2663
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663</willem></akstcxylbmnsdgs>
So the sender – or relay – is Polish. Or it’s a zombie.
The message-ID is bogus (I didn’t even bother checking), so it the return address. Don’t try explaining a user “akstcxylbmnsdgs” would actually exist. I don’t think theer is such a user on XYLB.COM.
However: XYLB.COM does exist (and is valid) otherwise it wouldn’t get so far anyway.
Did the previous sender use MSN, this one seems to use good old Outlook Express. Hardly a professional method, I’d say.
If you follow the link you’ll end up on JSB Register – like the previous job offer – but the link is different:
http://58.65.239.116/zaka/
and in the page, the hiodden data is:
<input type="hidden" name="icq" value="zaka">