[Geldwäscher] THERUSMARKET is looking for new candidates for the position of ...

[homer]

header:

01: Return-Path: <khoi [at] appgen.com>
02: Received: from 200165033133.user.veloxzone.com.br (200.165.33.133)
03:   by 0 with SMTP; 24 Sep 2005 15:XX:XX -0000
04: Message-ID: [ID filtered]
05: From: Gopinath Cain <khoi [at] appgen.com>
06: To: poor [at] spamvictim.tld
07: Subject: THERUSMARKET is looking for new candidates for the position of Financial
08: 	Courier
09: Date: Sat, 24 Sep 2005 15:XX:XX +0000
10: MIME-Version: 1.0
11: Content-Type: text/plain;
12:   format=flowed;
13:   charset="iso-8859-1";
14:   reply-type=original
15: Content-Transfer-Encoding: 7bit
16: X-Priority: 3
17: X-MSMail-Priority: Normal
18: X-Mailer: Microsoft Outlook Express V6.00.2900.2180
19: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

THERUSMARKET is looking for new candidates for the position of Financial
Courier

Since the time when THERUSMARKET Investment & Finance company started 7 years
ago we have been catering for a wide range
of services in the field of foreign currencies conversion. Take a flavor of
our unique terms and conditions.
We work both with domestic customers from all walks of life and with
different clients worldwide.
We have been often highly praised by leading financial periodicals, whilst
according to the polling results,
we were ranked the fifth position. We managed to minimize time, necessary for
money conversion and further
transaction to any place of the globe, as well as to apply unmatched security
level for our customers.
Coupled with the fact, that our Financial Couriers staff around the world
considerably exceeds the number of
agents of our major competitor, our advantages are out of question. By
leveraging stability and reliability
of our operations we managed to get a far greater ability to gain loyalty of
our partners and confidence of our customers.

Rapid scalable worldwide deployment of the company demands further
recruitment of Financial Couriers staff.
The scope of responsibilities of a Financial Courier will involve processing
of money transfers (mainly bank transfers).
This job does not imply any relevant knowledge or experience in the field of
finance.
The candidates, able to exhibit sound, smart and prompt operations, will
qualify. You will be able to combine your main job with THERUSMARKET career.

Basic Requirements to the Candidate:
Promptness of operations, interpersonal skills, responsibility.
Ability to spend enough time for this job.
PC, Internet, email handling skills (user-level).
Basic knowledge of English.
Browse our site ( ^whois:http://therusmarketsistem.com/ ) to get more
details on Financial Courier vacancy and candidates' requirements.
To get the operational scheme details and all necessary forms, fill out the
Application Form first. We promise to react as promptly as possible.

Thank you for your interest to our offer.

THERUSMARKET Administration

Der Server hat wohl ein kleines Problem:

Beim Laden von http://therusmarketsistem.com/ ist folgender Fehler aufgetreten:
Zeitüberschreitung auf dem Server
Verbindung bestand zu therusmarketsistem.com an Port 80

[Goofy]

Die DNS-Server scheinen fürchterlich überlastet zu sein.

Nach einigen Versuchen wird allerdings ausgespuckt:
therusmarketsistem.com. A IN 43200 1.1.1.1

Das dürfte so nicht funktionieren.

[Nachtrag] Holla! Jetzt erscheinen andere IP-Addressen.
Auch hier wieder: gehostet auf infizierten bots.

Interessanter Domainname übrigens.
Soll heissen:
The-Russian-Market-System

Das ist das russische System, wie man Geld verdient.
Gut, dass wir es nun wissen.

Ach ja: vielen Dank wieder mal an Herrn Langenbach aus Düsseldorf für die wie immer verlässliche und kooperative Hilfe bei der Suche nach Geldwäschern.

[Goofy]

Momentan kommt im DNS:

therusmarketsistem.com. A IN 43200 1.1.1.1 61.36.126.15
nsa12.serverbackup64.com. [61.16.153.204]
nsa13.serverbackup64.com. [61.39.182.37]
61.16.153.204----->http://www.spamhaus.org/sbl/sbl.lasso?query=SBL31536
-->Kuvayev

Sind wohl doch feste IP´s.

Eindeutig wieder Leo.
Typisch auch die Domain serverbackup[nn].

[corlis]

Hier auch aufgeschlagen:

header:

01: From - Sat Sep 24 xx:xx:xx 2005
02: Received: from [61.79.95.65] (helo=61.79.95.65)
03: 	by mx27.web.de with esmtp (WEB.DE 4.105 #297)
04: 	ID: [ID filtered]
05: 	for poor [at] spamvictim.tld; Sat, 24 Sep 2005 xx:xx:xx +0200
06: Received: from unknown (HELO localhost) (127.0.0.1)
07:     by localhost.nyhg.com with SMTP; Sat, 24 Sep 2005 xx:xx:xx +0000
08: Received: from 170.73.62.124 (170.73.62.124[170.73.62.124])
09:        by 61.79.95.65 (IMP) with HTTP
10:        for <poor [at] spamvictim.tld>; Sat, 24 Sep 2005 xx:xx:xx +0000
11: Message-ID: [ID filtered]
12: From: "THERUSMARKET Administration" <tcrasoctrkst [at] iastate.edu>
13: To: "poor [at] spamvictim.tld" <poor [at] spamvictim.tld>
14: Subject: THERUSMARKET is looking for new candidates for the position of Financial
15: 	Courier
16: Date: Sat, 24 Sep 2005 xx:xx:xx +0000
17: MIME-Version: 1.0
18: Content-Type: text/html; charset="iso-8859-1"
19: Content-Transfer-Encoding: 8bit
20: User-Agent: Internet Messaging Program (IMP) 3.2.2
21: X-Originating-IP: 170.73.62.124
22: Sender: tcrasoctrkst [at] iastate.edu

[dk99hi]

Ich hab mal das Formular ausgefühlt.

Kurz darauf bekam ich Post von Aleksandr Denisov < job@therusmarket.com >

Das da immer noch Leute darauf reinfallen.

Financial Courier Profile



As soon as an interbank transfer operation is performed with your bank account, the funds immediately get “Available in the Account” status.

Check your electronic account balance. In case the balance is positive, contact our operator to get the details of further transfer: Name, Surname, City, Country, Transfer Purpose – a present to a friend (if specified this way, the tax privileges are applied in accordance with the legislation of the Russian Federation).

Be sure you have an ID (passport, driving license) to withdraw money from the account, and a mobile phone, as it is quite possible to perform the withdrawal operations at least 3 times a day.

Remember that a Western Union transfer lumpsum amount shall not exceed 6000 EUR. If the amount is bigger, transfer the difference with another Western Union Agency. After you withdraw money from your account, transfer 90% of the amount with any Western Union Agency you like, while keeping 10% as your commission. Carefully check the spelling of your name and surname (Important: You shall write only your NAME and SURNAME, the middlename is redundant). Further please compare the identity of your details with the details from our operator.

After you perform the operation, duly inform our operator about the following: Sender’s Name, City, Country, MTCN (money transfer control number), Transfer Amount.

Be sure you have enough free time to perform all operations when needed, as you might be requested to make 2-3 or even more transfers during the day.

Strictly follow the a.m. payment pattern. All information is complete, efficient and therefore should not evoke any further questions. Important: our Company is not liable to provide any detailed information pertaining to our operations, being a confidential issue subject to commercial security policy of the Company.





Before You Start:

Email us with a scanned copy of your ID (passport or driving license).

Specify your actual domicile details, home and mobile contact phone numbers.

Plan your working schedule with respect to the perspective of making transfers when needed.

Be sure to perform a Western Union transfer within 1 or no later than 2 hours.

Browse www.westernunion.com site to get the transfer details. The last, but not the least task is to choose the nearest WU Agency and to inquire about the working hours. Important: Never perform transfers by phone, if the amount exceeds 1000 EUR.

Fill out your electronic account details as follows: Account Holder’s Name, Account Number, Sort Code, Bank Name.



Don’t hesitate to contact our operator soonest possible in case of any unforeseen circumstances. We’ll do our utmost to promptly solve the problem.





Why You?

Our Company is one of the biggest electronic money transfer service providers worldwide. With our headquarters in Moscow (Russia) and Kiev (Ukraine), we are present in many countries, while constantly extensively spreading worldwide. Our financial couriers make transfers with various electronic payment systems, including Webmoney.ru, E-gold.com. Our operations are absolutely legal and licensed and comply with law regulations (the comprehensive legal company statement is available at request).



Our policy does not envisage considerable investments into establishing new offices and branches, instead we prefer to combine our efforts with financial couriers worldwide, who perform the so-called “distance job”.



You are offered a 10% commission from each transfer amount, while Western Union fee shall be charged to our account.



Failure to Follow Your Obligations

Should you fail to contact us within 4 hours after the WU transfer to your account is performed, or equally you do not answer the phone, or not available by e-mail, or fail to notify us about the delay, our client is mailed with the claim and the request to check your account balance. In case the funds are withdrawn from your e-account, the claim is sent to your bank.



If you agree with the a.m. statement, follow the instructions in “Before You Start” section.



Thank you for interest to our offer and looking forward to your positive decision to join out team. The mutually advantageous cooperation is guaranteed!



Sincerely yours,

THERUSMARKET.COM Administration

[Silke074]

Hi,

hab ich heute früh bekommen:

X-Apparently-To: meinemail [at] yahoo.de via 217.12.13.54; Sat, 24 Sep 2005 15:33:27 -0700
X-YahooFilteredBulk: 83.52.63.217
X-Originating-IP: [83.52.63.217]
Return-Path: <877just@about.com>
Authentication-Results: mta142.mail.scd.yahoo.com
from=about.com; domainkeys=neutral (no sig)
Received: from 83.52.63.217 (HELO 217.Red-83-52-63.dynamicIP.rima-tde.net) (83.52.63.217)
by mta142.mail.scd.yahoo.com with SMTP; Sat, 24 Sep 2005 15:33:27 -0700
Message-ID: <a68301c5c156$d2baf352$ce44b795@about.com>
From: Elizabet Marsh <877just@about.com>
To: meinemail [a] yahoo.de
Subject: THERUSMARKET is looking for new candidates for the position of Financial Courier
Date: Sat, 24 Sep 2005 22:25:39 +0000
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

THERUSMARKET is looking for new candidates for the position of Financial
Courier

Since the time when THERUSMARKET Investment & Finance company started 7 years
ago we have been catering for a wide range
of services in the field of foreign currencies conversion. Take a flavor of
our unique terms and conditions.
...
The scope of responsibilities of a Financial Courier will involve processing
of money transfers (mainly bank transfers).
This job does not imply any relevant knowledge or experience in the field of
finance.
The candidates, able to exhibit sound, smart and prompt operations, will
qualify. You will be able to combine your main job with THERUSMARKET career.
...
Browse our site ( http://therusmarketsistem.com/ ) to get more
details on Financial Courier vacancy and candidates' requirements.
To get the operational scheme details and all necessary forms, fill out the
Application Form first. We promise to react as promptly as possible.

Thank you for your interest to our offer.

THERUSMARKET Administration

----

Ich hab das mal ein bisschen abgekürzt und meine Mailadresse rausgelöscht.
Das hier ist das erste Mal, dass ich hier was ins Forum poste, ich hoffe ich hab alles richtig gemacht.

Silke074

[oliveer]

Received: from [218.149.237.197] (helo=218.149.237.197)
by mx32.web.de with smtp (WEB.DE 4.105 #297)
id 1EJQCb-0001Id-00
for xxx; Sun, 25 Sep 2005 08:41:34 +0200
Message-ID: <953e01c5c19a$080f36ec$dd75f1c5@about.com>
From: Margarit Roberts <834matther@about.com>
To: xxx
Subject: THERUSMARKET is looking for new candidates for the position of Financial Courier
Date: Sun, 25 Sep 2005 06:31:58 +0000
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Sender: 834matther@about.com

Bei mir auch aufgeschlagen - aber heute wundert mich eh nix mehr ...

@Silke074 : Für dein erstes Posting ist es doch schon recht ordentlich geworden. Du kannst die eMail eigentlich ruhig in der Unsprungslänge lassen, solange du die 10.000 Zeichen hier nicht überschreitest. Ach so, reicht wenn du deine eMail-Adresse auch einfach durch z.B. XXX ersetzt, ist dann einfacher und du mußt dann nicht soviel schreiben.

in diesem Sinne

Oliver

[Goofy]

Ist dasselbe wie hier.

Die Mods legen das sicherlich zusammen.

@ Silke074
Falls Du es noch nicht weisst: Hintergrund dieser Mails ist die Suche nach willigen Opfern, die Geldwäscher für Phishing werden sollen. Daher posten wir diese Mails unter der Rubrik "Phishing".