Work-at-Home Scam - December 13, 2007 Example  (123 Express, Inc.)

Please be sure to read my Work-at-Home Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Scam Example
Received 12/13/2007

This was spam email, as While I have a resume at CareerBuilder and other job-search sites at this time, it was sent to an email address which I do NOT use for job search. (I just double-checked.)

NOTE: To allow search engines to find them, I've left the links in this email. Be careful if you check them out for yourself.

Email Headers
Received 12/13/2007

Ok... Time to check the WhoIs of 123 Express, Inc.. A quick Google search for the company name produces the site, http://www.123-express.com/.

Red Flags, for Me

Ok... The email looks legit... The site looks legit... What raises the red flags for me?

1. From the email itself:
   1. The description of the process is the same as KNOWN work-at-home job scams: "They want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud." If you aren't required to "check" the goods, they could be drugs; counterfeit money, stocks or bonds, etc. They may also "slam" you with multiple deliveries of packages you must "break down" and ship, and, when you can't handle it, or figure out they're scamming you, you end up with a bunch of packages that YOU have to cart to the cops or Postal Inspector.
   2. I have received NUMEROUS job offers, in the last couple of weeks for the same type of job, many purporting to be responding to my resume on CareerBuilder or elsewhere. While I am looking for a job, and have a resume there, the email address I use is NOT the one to which this email was sent.
   3. The position they are offering me - Correspondence Assistant/Representative - has NOTHING to do with the qualifications on my resume. So how is that perfect " for people like you[me]"?
   4. Spacing, grammar, and spelling errors are rare from a legitimate site offering a job. Numerous people have read those ads, from HR to Legal to the person who wrote it. SOMEONE would catch the errors.
   5. The email address FROM which this email was sent was NOT the same as the company offering the job. While I realize that consultant and contracting companies could be sending these emails out, there is absolutely NO indication that this is from anyone but the company, itself.
2. From the email headers:
   1. The email address FROM which it was sent was vejhabgibr@bntsolution.com. Again, why wasn't it sent from an 123-Expresss account, and why can't I simply reply to the email to get information?
   2. According to GeoBytes Spam Locator (just cut-and-paste email headers), this email was sent from 83.237.116.156, which is in Moscow, Russia, through a possible forged header (IP Address not found).... Why doesn't this match the email address of the sender (Ashlee Christie)? ... the supposed NAME of the person sending it (Rebecca doesn't sound Russian to me!)
3. From the WhoIs of the (apparent) site:

   1. bntsolution.com (email address of registrant/admin) is located in Korea (searching for bntsolutions.com - found 119 web pages - all but a few Korean; www.bntsolutions.com - found 124 web pages - all but a few Korean, and registration addresses are Korea:

      Domain Name : bntsolution.com

      ::Registrant::
      Name : BnT Solution
      Email : sclee@bntsolution.com
      Address : 2F 349-189 Sindang3-dong Jung-gu Seoul, Korea
      Zipcode : 100827
      Nation : KR
      Tel : 82-02-497-3516
      Fax :

      ::Administrative Contact::
      Name : SeungChol Lee
      Email : sclee@bntsolution.com
      Address : Shindang 3-dong, Chung-gu, Seoul
      Zipcode : 100453
      Nation : KR
      Tel : 82-02-2233-5063
      Fax : 82-02-2233-5137

      ::Technical Contact::
      Name : Whois Co., Ltd.
      Email : whois@whois.co.kr
      Address : 143-39 Shinil Bldg.1F, Samsung-dong, Kangnam-gu
      Zipcode : 135877
      Nation : KR
      Tel : 82-02-325-4259
      Fax : 82-02-325-2259

      ::Name Servers::
      www.bntsolution.com

      ::Dates & Status::
      Created Date 2002-06-27 01:46:54 EDT
      Updated Date 2005-06-29 00:45:33 EDT
      Valid Date 2008-06-27 01:52:11 EDT
      Status ACTIVE

       

   2. The address given for the 123-express registrant/admin is in California
   3. The contact phone number given (+1.9999999999) is bogus
   4. 123-express.com (website) was created October 24, 2007 for one year. If you plan on having a site for a while, you normally don't pay for it year-by-year, but you buy multiple years.
   5. Name Servers for both 123-express and bntsolution are in Russia. This mean little, but it IS curious.
4. From the website:
   1. Typical spelling, spacing and grammar errors for a foreign (normally scammer or automatically translated site). If this were a real site, wouldn't that all be taken care of, as they would have had not only the designer but others go over the site?
   2. Supposedly, they have won the following awards (see their awards page):
      1. Stevies - not according to 2005 International Stevie Award Winners
      2. I could not find a "Road to success award", or "Wales Biz [or Business] Award" for "123" anything.
5. Why am I receiving an email for a job in the US, sent by an American using a Korean address, about working for a website using Russian Nameservers, registered and administered out of California? GEEZE!

End Notes

Send comments/questions about this page to Bill Sanders at:

Go to Scams - Work-at-Home Scam Home page

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.