Work-at-Home Scam - 12/02/2007 Example  (Cargo Express)

Please be sure to read my Work-at-Home Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Scam Example
Received 12/02/2007

This was spam email, as While I have a resume at CareerBuilder at this time, it was sent to an email address which I do NOT use for job search. (I double-checked.)

Email Headers
Received 12/02/2007

Ok... Time to check the WhoIs of CargoExp.org - from the email to which I am to reply, and the Reply-to in the email headers. A quick Google search for the company name produces the site, http://www.cargoexp.org/, aka http://www.cexpress.info/. (Here's a 24-page (744.28KB) PDF of the complete printed site, if the link doesn't work.)

Red Flags, for Me

Ok... The email looks legit... The site looks legit... What raises the red flags for me?

1. From the email itself:
   1. The description of the process is the same as a KNOWN work-at-home job scam: "They want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud." If you aren't required to "check" the goods, they could be drugs; counterfeit money, stocks or bonds, etc. They may also "slam" you with multiple deliveries of packages you must "break down" and ship, and, when you can't handle it, or figure out they're scamming you, you end up with a bunch of packages that YOU have to cart to the cops or Postal Inspector.
   2. I have received NUMEROUS job offers, in the last couple of weeks for the same type of job, many purporting to be responding to my resume on CareerBuilder. While I am looking for a job, and have a resume there, the email address I use there is NOT the one to which this email was sent, meaning this was spam email.
   3. The position they are offering me - merchandise manager (sometimes not named) - has NOTHING to do with the qualifications on my resume. So what makes me right for it, or it right for me?
   4. Spacing, grammar, and spelling errors are rare from a legitimate site offering a job. Numerous people have read those ads, from HR to Legal to the person who wrote it. SOMEONE would catch the errors.
2. From the email headers:
   1. The email address FROM which it was sent was no_reply@careerbuilder.com. If CareerBuilder sends out a job offer based on your resume, you KNOW 1) It CAME from CareerBuilder, and 2) The person's name is used with a different "careerbuilder.com" email address (I'll not put them here... If you actually get emails from companies there, you know what they are.) Again, why wasn't it sent from a real careerbuilder email address, or a real CargoExp.org account, and why can't I simply reply to the email to get information?
   2. According to GeoBytes Spam Locator (just cut-and-paste email headers), this email was sent from 207.58.149.84, which is in New York, New York. Why doesn't this match the email address of the supposed email address of the person sending it (Cargo Express is based in the UK/Europe/Scandanavia.)
3. From the WhoIs of the (apparent) site:
   1. Timing!
      1. The site was created on: 07-May-2007 21:17:46 UTC
      2. The site expires on: 07-May-2008 21:17:46 UTC

      Note that this website was created just a few months ago, and expires in just a few months. I realize that there are still businesses out there without a web presence, and some start out slow - going year-by-year, rather than purchasing a large number of years, but these, I would think, are normally new businesses... Not one that's been around since 1965, as the Cargo Express site says.
      

   2. Glenrothes, Beijing, GB? Glenrothes is in Scotland, and GB stands for Great Britain (United Kingdom - admittedly where Scotland is located, but... ), Beijing is in China, isn't it?
   3. As for the rest of the address, the "zip code" (us version would be a zip code) of "KY7 6BL" IS in Fife is a county in Scotland, and Glenrothes is in Scotland. Still, where does Beijing come in?
   4. There are five (ONLY 5!) Google search results for fife "18 Park View" and seven (ONLY 7!) for fife "18 ParkView", and NONE found for "18 Park View" Glenrothes OR "18 ParkView" Glenrothes
   5. +44 is the Country Code to dial a number in the United Kingdom.
4. Why am I receiving an email for a job in the US, from a New Yorker, about working for a website registered and administered out of the UK that is registered using questionable locations (Beijing, GB), which apparently is close to the address used (invalid or not) by someone who created a mirror of the international law-enforcement website (Interpol), so they could scam people?

End Notes

Send comments/questions about this page to Bill Sanders at:

Go to Scams - Work-at-Home Scam Home page

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.