"west-es-company.com" scam job offer

This is another money mule email, soliciting replies to west-es-company.com which is hosted at 193.104.94.57 in the Russian Federation along with a whole bunch of other badness.

---

Subject: hello!
From: "Ronald"
Date: Thu, March 4, 2010 11:10 am

Hello,

My name is Ronald and our company currently has several positions it needs to fill in your region.

We are a well known company with offices throughout Europe, Asia and North America.

Our current turnover is over 130 million annually and we are still seeking for expansion.

I have 12 vacancies of Financial Assistant that need to be fulfilled immediately.

Major operational duties are prompt receiving and processing customerÂ’s payments for their further transfer according to the specified method. Detailed work scheme will be provided upon request.

I am looking for self-motivated individuals with strong work ethics and ability to schedule work hours effectively.

Requirements:

* Expert skills in managing payments and transfers between our company and clients
* Knowledge of basic payment systems
* Bank account (personal or business)
* Advanced PC and Internet skills
* Minimum 24 y.o.

Benefits:

*Salary plus commissions
*Full reimbursement of banking and Western Union fees.

NOTE: This vacancy is valid for American residents ONLY.

Contacts: Ronald@west-es-company.com

---

Avoid this one at all costs.

Stupid spammer? Or Joe Job?

Sometimes it's hard to say if a spam is a really stupid spammer, or a very sophisicated Joe Job.

---

From: "Human resources" <list@weekendsoff.info>
Reply-To: HR@internet-marketing.com
Subject: Thank you for your application

This is an automated response; please do not reply to this email

Thank you for your application, this will be reviewed shortly

The Job You Have applied for is

>>

Internet Marketing - Work from home Unlimited income

An Irish based company is looking for a motivated and dynamic individual to head up the local operations in UK, USA, Canada, Australia and New Zealand, Must be computer literate, Dynamic, and a self starter.

Previous marketing experience is desirable but not essential as
Full training is given.

For details on how to apply please click the link below

http://ec2e68oy1e-p-g0mu8cbhzr5ke.hop.clickbank.net/

>>

Many thanks

The HR Team


This email is intended for the addressee only If you have received this email in error please treat its contents as confidential and delete it immediately

---

Clickbank spam is pretty rare, simply because Clickbank will terminate spamming affiliates. Clickbank redirects to http://www.theaffiliatecode.com/cb.php?hop=bharrsunny which then affiliates to one of those stupid eBook sites called "TheAffiliateCode.com" that promises untold riches. The name "bharrsunny" is almost definitely the name of the affiliate account.

The email routes via a server at 94.136.62.178 [Webfusion - UK and currently blacklisted] and appears to originate from a Sky broadband subscriber at 90.221.179.176 (currently blacklisted). A look at the server at 94.136.62.178 throws up a number of websites, including "weekendsoff.info" (listed in the headers) and "weekendsoff.co.uk". The WHOIS details for these domains is as follows:

Domain name:
weekendsoff.co.uk

Registrant:
Bob Harris

Registrant type:
UK Individual

Registrant's address:
27 old tatham
york
YO43 4BN
United Kingdom

Registrar:
Webfusion Ltd t/a 123-Reg.co.uk [Tag = 123-REG]
URL: http://www.123-reg.co.uk

Relevant dates:
Registered on: 14-May-2009
Renewal date: 14-May-2011

Registration status:
Registered until renewal date.

Name servers:
ns.123-reg.co.uk
ns2.123-reg.co.uk

The .info domain also reveals:
Registrant Phone:+44.1430861312
Registrant Email:bh861839@aol.com

weekendsoff.co.uk is a web design outfit with some familiar looking templates (e.g. www.weekendsoff.co.uk/Shop-sites/shop3/index.html is the same as this page on Quackit) as it seems are all the other pages. Still, I guess this is all above board, isn't it?

Now, there's an uncanny match between the name "Bob Harris" and the affiliate name "bharrsunny". So, is Bob Harris really stupid? Or has someone hacked his server with a sophisticated Joe Job? But this isn't the only time this person has been fingered for spamming. I'm sure you can make up your own mind..

Mystery Shopper Scam from "linkshare.humanresources@gmail.com"

LinkShare is an affiliate marketing company, this email purports to be from "LinkShare™" (note the nice use of the TM) and states that they are a market research company.. which they are not. Originating IP is 124.243.42.42 in Korea, replies are solicited to a free Gmail account rather than linkshare.com and the email is "from" alerts@careerbuilder.com which surely ain't right.

Basically, this is a standard mystery shopper scam email and it should be avoided at all costs.

Subject: MYSTERY SHOPPER OPENING: {$150 Per Survey}
From: "LinkShare™ Corporation" <alerts@careerbuilder.com>
Date: Wed, February 24, 2010 4:46 pm
Priority: Normal

About the Company:
LinkShare™ is a market research company that uses Mystery Shopping and Mystery Consuming to measure the quality of service rendered or gather specific information
about products and services. We use mystery shoppers to get the information anonymously.

Job Description & Responsibilities:
As our mystery shopper posing as normal customers, you will expected to perform specific tasks such as purchasing a product or using a service. We presently have a
couple of outstanding contracts, which means you will visit outlets in your area. While there, you will secretly evaluate things like customer service, store
cleanliness and quality of service rendered. When you're done, submit your shoppers report to us via e-mail and get paid for your opinions.

Some of the simple questions in your Shoppers Report will be:
. How well were you treated?
. Were the employees friendly and courteous?
. Did you receive prompt service?

That's all there is to it! The answers to these kinds of questions are extremely valuable to any business - You'll be providing important information that will be
used to improve the quality of businesses everywhere. You will be provided funds in advance for any upcoming survey via Checks to cover expenses.

Where will I be mystery shopping?
The companies we deal with mostly represent large chain stores and popular franchises with hundreds and thousands of locations across the country. They are stores, services and restaurants like:

. Money Gram
. Wal-Mart
. Western Union
. Cvs

Special skills are not required for this opening. However, in order to apply for this job you must ensure you have access to your e-mail at least twice daily and must read and respond to our notifications within 24 hours.

If you would like to be considered for assignments, please fill out the Application below as we hope to Welcome You to LinkShare™!

Full Names:
Address Line 1:
Address Line 2:
City:
State:
Zip Code:
Age:
Home Phone Number
Cell / Mobile Phone Number:

All applications must be sent to: linkshare.humanresources@gmail.com

LinkShare™ Corporation
215 Park Avenue South 9th Floor
New York, NY 10003
Email: linkshare.humanresources@gmail.com

The information contained in this e-mail, and any attachment, is confidential and is intended solely for the use of the intended recipient. Access, copying or re-use of
the e-mail or any attachment, or any information contained therein, by any other person is not authorized. If you are not the intended recipient please return the e-mail to the sender and delete it from your computer.

Money mule operation morphs

This fraudulent job offer (i.e. for a money mule laundering stolen funds) originates from 109.169.243.117 and points to a server on 193.104.94.57, both in the Russian Federation. This is the same server as this scam although the domain names have changed.

Subject: Vacancy ID053 USA
Date: Wed, February 17, 2010 2:12 am

Dear job seekers!

Apply for the job. We recommend this position.

Job Description:

We are looking for people who can control the payment of our customers from your state / region.

The responsibilities of work included compiling monthly reports on the overall turnover of funds, sending documents on each transfer.

We offer you confidentially as you conduct a search to meet your career goals and we can help you to understand and communicate what makes you stand out in a crowd.

My role is to find the best candidates to meet the needs of my clients. You could be just the person I'm looking for.

Job Requirements:

As a Finance Manager, you are responsible for all aspects of operation, including customer relations, team management, financial management and team recognition/retention.

You must:
- be 23 years of age or older
- be resident of United States of America
- have a bank account
- must have full internet access (at home or at work)

Minimum qualifications include:
- Well developed analytical, communication, and interpersonal skills
- Strong operational background and knowledge
- Exceptional people skills
- Problem solving skills
- Top notch communication and writing skills
- A drive to be the best

Benefits:
- Monthly salary starting at $2000(after a month evaluation period)
- 5% commission for every task you complete
- Banking and Western Union fees covered by the company

If you are interested in applying for this position please send your resume
Cara@new-job-position.com

Robtex reports a number of dodgy domains and mail servers on that domain, all of which should be considered fraudulent.

• 7-job-net.com
• company-euro.com
• euro-shopping.net
• gold-es-net.com
• goldes-it.com
• good-nets.com
• it-financess.com
• job-for-yours.com
• mail.7-job-net.com
• mail.company-euro.com
• mail.gold-es-net.com
• mail.goldes-it.com
• mail.job-for-yours.com
• mail.online-web-net.com
• mail.people-and-job.net
• mail.web-euro-it.com
• mail.webpages-it.com
• mail.wesst-netts.com
• online-web-net.com
• people-and-job.net
• web-euro-it.com
• webcompany-es.net
• webcompany-euro.net
• webfiless.com
• webpages-it.com
• wesst-es.net
• wesst-netts.com

I'm Bob Gatchel, and I'm a spammer

OK, spam isn't exactly uncommon, and get-rich-quick MLM schemes are a bit like the dog shit that you sometimes tread on while out walking. This particular piece of spam caught my eye:

Subject: [redacted], your just released 5 Ways to Make a Fast $5,000 CD at absolutely no cost from Bob
From: "EWI" <robertallen4@ewiadvisory.com>
Date: Fri, February 12, 2010 12:43 am

Dear [redacted],

Hi, I'm Bob Gatchel and recently you visited one of my websites where you requested more information about starting your own internet based home business ... that's GREAT! And because you did this, I have a very special free gift for you -
with no strings attached!

Look ...because you took the time to learn more about this industry, I want to give you my brand new Ebook and TeleSeminar that will show you how to pick out the PERFECT online home based business for you!

It's called: "Internet Home Business EXPOSED"

And you can secure your FREE copy of this course at this website:

http://InternetHomeBusinessExposed.com

This is an info-packed 54 page ebook and 50 minute TeleSeminar that reveals the TOP 12 online based home businesses for 2010 and beyond! Discover how a new and exciting home business can:
* Give you FREEDOM form a normal 9-5 job
* Give you more free time for your family
* Give you financial stability without the struggle
* Let you live a happier & healthier life!

Look ... I did the investigating and hard research so you don't have to and can show you how to make this happen in your life!

Who am I?

Why should you listen to me?

And why should you get this course?

For the past 12 years, I've not only been earning a high six figure income using the internet from the comfort of my home ... but I've been helping others do the same as an internet marketing consultant that specializes in the fields of home based business.

My courses, training and consulting are featured all over the internet ... and my unique insights into this industry have even been featured in the worldwide best selling book: "Multiple Streams of Internet Income" by the renowned wealth trainer, Robert G. Allen.

Bottom line? I know what I'm talking about when it comes to making money from home using the internet - and I know how to help the average person achieve amazing results!

When you get your copy of "Internet Home Business EXPOSED" at:

http://InternetHomeBusinessExposed.com

You'll see how it "cuts through the fluff" and gives you everything you need to avoid the TONS of scams out there ... I've done all of the hard work and research FOR YOU to find only the 12 BEST and PROVEN ways to make big money from home - in your spare time or even help quit your job and to it FULL time like me!

Again, get this course NOW at:

http://InternetHomeBusinessExposed.com

Take your first step to living the life you deserve and the freedom to live your dreams! Take the time to get your free copy of "Internet Home Business
EXPOSED" and get started on your path to success TODAY!

Successfully Yours,

Bob Gatchel

Creator of "Internet Home Business EXPOSED"

PS - This free ebook and teleseminar are only going to be available for free for limited time only. We are going to actually start selling this course very shortly. Be sure you get your copy today while it's still free OK?

Go to:

http://InternetHomeBusinessExposed.com

We respect your privacy. To remove yourself from this mailing list, please reply to this email.

"Bob" has made a couple of newbie mistakes here - firstly, the "Reply To" address is invalid as there is no such domain as "ewiadvisory.com" and he forgot to include his postal address, which makes in non CAN SPAM compliant.

InternetHomeBusinessExposed.com is the sort of name that almost begs to ripped apart. Hosted along with hundreds of other crummy MLM sites on 74.208.120.206, the domain has private registration details, which is a shame. Not to worry, a little bit of digging turns up a valid address of:

Robert Gatchel
16 Shire Lane
Port Deposit, Maryland 21904
United States

There's also a valid "reply-to" email address you can use of bobgatchel@gmail.com.

There you go Bob, fixed that for you.

Interestingly, it turns out that Bob is a bit of a stickler for rules, which is kind of odd when you consider his non CAN SPAM compliant message. Page 73 of this planning document shows Bob objecting to his neighbour installing a mobile home on their property because it broke the deed restrictions. OK Bob, that's fair enough.. but just remember this next time you send out spam.

So what is InternetHomeBusinessExposed.com? Well, it just forwards to another site at getthescoopabout.com (again, anonymised) and it's just pushing some crappy seminar. But what are they selling?

A little more digging finds that Bob is affiliated with some outfit called the Enlightened Wealth Institute which has a non-too-pretty report at the BBB. He is also affiliated with some scientifically unproven dietary supplement from Yoli Incorporated. A quick Google of "Yoli" shows an awful lot of people pushing Yoli as an MLM rather than something you would want to put in your body.

Now, excuse me Bob.. I have some dog shit to clean up.

"7-job-net.com" Money Mule Operation

This is a straightforward money mule (i.e. money laundering) operation with a twist:

Subject: from International Consulting Company
From: "Arnulfo Salas"
Date: Thu, February 11, 2010 9:24 am

Hello

Our company(Outsourse Solution) is proud to announce you that we now have positions
available(part time)

A candidate for the Payments Processing Position must meet the following
requirements:

* Is 23 years of age or older
* Is resident of United States of America
* Is fair and objective
* Is detail oriented
* Is very observant and able to focus on details
* Is fairly intelligent
* Has patience
* Is trustworthy
* Is practical
* Types well
* Loves to learn
* Explains well in writing
* Is discreet
* Handles deadlines
* Has bank account
* Has full internet access (at home or at work)

Benefits:
* Monthly salary starting at $2000(after a month evaluation period)
* 5% commission for every task you complete
* Banking and Western Union fees covered by the company

If you are interested in becoming a Payments Processor for our company
you can request more information at Arnulfo@7-job-net.com

Thank you,
Outsourse Solution Inc.

Usually we see spam like this soliciting replies to throwaway free email addresses. In this case, 7-job-net.com is a domain that has been registered specifically for this scam, on 14th January 2010.

Registrant details show the infamous "Private person" moniker.

Aleksandr Lapatau
Email: lapatasker@earthling.net
Organization: Private person
Address: Lenina, 34, 8
City: Minsk
State: Minskaya
ZIP: 456123
Country: BY
Phone: +375.172427204

The email address is connected with at least one other scam.

Of interest is the fact that the domain is hosted on 193.104.94.57 in Russia along with the following sites:

• Westitnet.net
• Company-euro.com
• Euro-company.net
• Euro-shopping.net
• Euro-webs.net
• Good-nets.com
• It-best-eur.net
• It-financess.com
• It-netx.com
• Net-euros.com

All these sites have bogus looking registration details and are best avoided.

Old pitch, new payload

This particular pitch from the badly-spelled "Internet Service Provider Consorcium" was doing the rounds back in September 2008, and it appears to have been recycled again to deliver a brand new Bredolab payload.

Subject: Your internet access is going to get suspended
From: "ICS Monitoring Team" <*****>
Date: Mon, February 8, 2010 9:34 pm
To: *****
--------------------------------------------------------------------------

Your internet access is going to get suspended

The Internet Service Provider Consorcium was made to protect the rights of software authors, artists.
We conduct regular wiretapping on our networks, to monitor criminal acts.

We are aware of your illegal activities on the internet wich were originating from

You can check the report of your activities in the past 6 month that we have attached. We strongly advise you to stop your activities regarding the illegal downloading of copyrighted material of your internet access will be suspended.

Sincerely
ICS Monitoring Team

Attachment is report.zip which contains report.exe and of course you can probably guess that it contains something nasty.


Who know what other oldies this crew might try to use?