Money Mule Employment scam email from Zhou Kim zhoukim9@zwtcoltd.jp.tn zhou.kim@zwtcoltd.com

Originating IP: 154.66.62.255
Originating ISP: Smile-nigeria-as
City: Lagos
Country of Origin: Nigeria

from: zwt co ltd <zhoukim9@zwtcoltd.jp.tn> 
reply-to: zhou.kim@zwtcoltd.com
to: 
date: Wed, Oct 26, 2016 at 4:41 AM
subject: 

Hello!

My company would like to offer you the opportunity to represent us in your region as our regional account representative. Kindly let us know if you are available to this offer so we can send you detail information about this job.

Regards
Zhou Kim
zhou.kim@zwtcoltd.com

The domain name zwtcoltd.com is a fake company domain being used for email only to give the appearance that it's a legitimate company!  The WHOIS lookup shows that it is a one-year only domain registration to a freemail email address worgu@yandex.ru using the freemail Yandex mailserver to send emails.  As you can see above, the IP of the emails show that they are coming from Nigeria.  There is no website or legitimate company tied to this domain name:

Start of Authority
mname: dns1.yandex.net rname: worgu.yandex.ru
serial: 2016032203
refresh: 14400 retry: 900
expire: 1209600 minimum: 14400
Nameservers
dns1.yandex.net, dns2.yandex.net
Mail Exchangers
mx.yandex.net(10)
Domain Name: zwtcoltd.com
Registry Domain ID: 2014536664_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: https://www.namesilo.com/
Updated Date: 2016-10-25
Creation Date: 2016-03-22
Registrar Registration Expiration Date: 2017-03-22
Registrar: NameSilo, LLC
Registrar IANA ID: 1479
Registrar Abuse Contact Email: abuse@namesilo.com
Registrar Abuse Contact Phone: +1.6024928198
Reseller: QHOSTER.COM
Status: clientUpdateProhibited
Status: clientRenewProhibited
Status: clientDeleteProhibited
Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Henri Rajaonarivelo
Registrant Organization:
Registrant Street: 52 Lansdowne Avenue
Registrant City: Carleton Place
Registrant State/Province: ON
Registrant Postal Code: K7C 2T8
Registrant Country: CA
Registrant Phone: +1.6132533214
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: hfrajaonarivelo@gmx.com
Registry Admin ID:
Admin Name: Henri Rajaonarivelo
Admin Organization:
Admin Street: 52 Lansdowne Avenue
Admin City: Carleton Place
Admin State/Province: ON
Admin Postal Code: K7C 2T8
Admin Country: CA
Admin Phone: +1.6132533214
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: hfrajaonarivelo@gmx.com
Registry Tech ID:
Tech Name: Henri Rajaonarivelo
Tech Organization:
Tech Street: 52 Lansdowne Avenue
Tech City: Carleton Place
Tech State/Province: ON
Tech Postal Code: K7C 2T8
Tech Country: CA
Tech Phone: +1.6132533214
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: hfrajaonarivelo@gmx.com
Name Server: DNS1.YANDEX.NET
Name Server: DNS2.YANDEX.NET
DNSSEC: unsigned