Sponsored by..

Wednesday, 27 February 2008

Dating Scam Sites VI

The return of a persistent spam.. which means that plenty of people are falling for it.

Hello! I am bored today. I am nice girl that would like to chat with you. Email me
at Ebba@ThePaganDoorway.info only, because I am using my friend's email to write
this. If you would like to see my pictures.
Of course, the nice girl is going to be a hideous troll or some ugly middle aged chickenboner. Whoever you are talking to, the aim is usually to bilk you out of a large pile of cash.

Current domains in this run are as follows:
  • Oldgloryshirts.info
  • Prideboundx.info
  • Selfhealdirect.info
  • Shineplug.info
  • Shinestick.info
  • Shinyglowstick.info
  • Superdoorway.info
  • Thedoorwaybeyond.info
  • Thedoorwaydomain.info
  • Thedoorwaygenerator.info
  • Theglowpup.info
  • Thegoldendoorway.info
  • Thehealcare.info
  • Thepagandoorway.info
  • Unitedimprove.info
All hosted on in Anhui, China.

Tuesday, 26 February 2008

Another dating scam

Dating scams are increasingly common and are something that I've blogged about before. It's really just a variation of the 419 Advanced Fee fraud scam, except the bait this time is usually a pretty Russian girl.

Hi! I'm a single girl and I'm 26 years old. Please take a look at my pictures and let me know if you like them! I live in Russia and I'm going to come to your country and work over there very soon! I don't know anybody over there and I thought it would be great to meet someone who is open to anything (as I am!). I would be happy to be friends, lovers or create a serious relationship! We will see what happens!

I hope you will write me back and I will write more info about myself and send more

I am writing from my friend's email address, so please make sure you do not reply directly to this email. Email me at nrochestetd0@yahoo.co.uk only.

if you don't use my personal email address then I won't be able to read your
reply and write you back. So it is very important that you get it

Ok, I guess it is now your turn. Hope to hear from you today. Bye!!

btw, i got your email from dating website

Of course, the email is going to be from some ugly middle aged Russian bloke rather than an attractive young lady, but at least this one has the decency to include a couple of photos of someone who will have nothing to do with the scam at all.


Scammers can be quite funny - this one is from someone pretending to be DAIYA PR of Japan.

Job opportunity from DAIYA PR Co., Japan

Job Location World
Company Location Japan
Employment Type Employee
Salary $7,500.00/month + BONUS system

Send your profile/resume/CV to this e-mail only:

DAIYA PR Co., Japan is expanding! This is job opportunity from famous Japan Corporation. Not just any opportunity but one that can make your career fun and rewarding. We have various positions over all US. You don’t need to move out from US, this job located in USA. If you are have all requirements you NEED to send us your resume or profile or CV for qualification. You will receive back our opinion in 1-2 days. Hurry up, this job opportunity is limited.

Requirements and skills:

1. Higher Education/College
2. 1+ Sales/Management (desired but optional)
3. Strong communicative skills
4. Must have MS Office installed (MS Word)
5. Must have U.S. citizenship
6. Adult age

This is original e-mail letter from DAIYA PR Co. This not any kind of: MLM, scam, spam. We will never ask to you to provide any kind of investments.
Gotta love the bit that says "This not any kind of: MLM, scam, spam." Clearly a big company like DAIYA PR would be soliciting replies to a Gmail address (only.. don't send it to the real company by mistake, will you?). In this case the email originates from which is a compromised machine in Turkey.. not Japan.

It isn't absolutely clear what the scam is, but they are usually money laundering operations or sometimes setting up fake companies or identities. The best thing to do is steer clear.

Note: DAIYA PR is a real company and is not connected with this scam email being sent out in its name.

Thursday, 7 February 2008

"Metrix Ventures" scam email

Some sort of modelling scam, sent to an email address from a data breach at an online retailers so you KNOW that it's a fraud. Company name given is Metrix Ventures which appears to be completely bogus, and is not related to any company of a similar name.

Subject: Job Offer
From: "Gary Pole"
Date: Thu, February 7, 2008 1:41 pm


My name is Gary Pole. Am freelance modeling agent working for Metrix Ventures which
is based in the US and has branches also in Europe.I would like us to do some works
together. I presently have good offer for you.I want to know if you are interested
in modeling because I need pictures of a good looking person (male or female) who
will be on the magazine cover of one of my clients. Please let me know if you are
interested in the deal. You stand a chance of making reasonable money and 150 Pounds
from this deal to start, and even a noticeable fame. Let me know if you are
interested in my offer and I would give you further details.

Best Regards,

Originating IP is, which is probably a compromised server. It amusingly identifies itself as project-crime.com in the email headers!

Monday, 4 February 2008

Fake "Benjamin Vincent Solicitors" mail

Another money mule fraud, this time using the name "Benjamin Vincent Solicitors".

Subject: Business Proposal
From: "Benjamin Vincent"
Date: Mon, February 4, 2008 11:13 am
To: undisclosed-recipients:;
Priority: Normal

Dear Sir/Ma’am,
I want to ask your attention to receive money on my behalf and it will
be for our mutual benefits.

Please call me if you are interested and on your response, I will send
you the full details and more information about myself and the funds.

Yours sincerely,

Benjamin Vincent
Benjamin Vincent Solicitors
49, High Street Wanstead
E11 2AA
Tel: +44 771 719 0188.

Now, Benjamin Vincent Solicitors are a real company and have nothing whatsoever to do with this fraud (you can see their details here). The scammers have used the correct address, but the "+44 7717" number is a mobile phone, not a landline. In other words, this fraud is attempting to trade of the name of a wholly innocent firm. The email addresses bvsolicit@yahoo.com and bvsolicitors@hotmail.co.uk are associated with this scam.

Tsk tsk.

Saturday, 2 February 2008

moneybookers.com / xcitinggames.com phish

It's unusual to see a moneybookers.com phish, but perhaps it shows that the phishers are moving on to different targets. This particular phish reads:

Greetings from moneybookers.com! We would like to inform you that you have received a payment from banking@xcitinggames.com.

Payment details

Amount: . 147.00
ID: 89089098
Subject: received payment
Note: Click here to accept this payment

Your money is waiting for you in your Moneybookers account.

Use this link to accept payment- www.moneybookers.com.

We hope you enjoy your cash.

One other notable feature of this phish is the use of an AOL redirector to attempt to fool spam filters, in this case eventually pointing to which is a server in Italy, probably rented with stolen credit card details.

Neither moneybookers.com nor xcitinggames.com are involved in this phish. I understand that AOL have been told about their redirector problem several times but have not acted.