Sponsored by..

Wednesday, 4 December 2013

"british-googleapps.com" (and other googleapps.com domains) job scam

This following spam email is attempting to recruit money mules:

From:     arwildcbrender@victimdomain.com
to:     arwildcbrender@victimdomain.com
date:     4 December 2013 07:49
subject:     Employment you've been searching!

Hello, We have an excellent opportunity for an apprentice applicant to join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for European citizens only,This is in view of our not having a branch office presently in Europe,
also becouse of paypal and ebay policies wich is prohibit to work directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good typing skills.
If you fit the above description and meet the requirements, please apply to this ad stating your location.

You will be processing orders from your computer. How much you earn is up to you.
The average is in the region of 750-1000 GBP per week, depending on whether you work full or part time.

Region: United Kingdom only.

If you would like more information, please contact us stating where you are located and our job reference number - 42701-759/3HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Gene@british-googleapps.com
Sample subjects include:
Employment you've been searching!
Career opportunity inside
Job ad - see details! Sent through Search engine


Other "reply-to" addresses spotted:
Gene@british-googleapps.com
Dewitt@british-googleapps.com
Robbie@british-googleapps.com
Leila@british-googleapps.com


british-googleapps.com is registered with completely fake details and uses a mail server on 50.194.47.186 (Comcast Business, US) to process mail. There are several other similar domain names being used for the same scam:

british-googleapps.com
germany-googleapps.com
consulting-googleapps.com
usa-googleapps.com
us-googleapps.com
canada-googleapps.com
consult-googleapps.com
arbeit-googleapps.com
consulting-googleapps.com
job-googleapps.com


In addition to those, all these following IPs and domains are in use by the scammers either now or recently. All the domains are registered through scam-friendly Chinese registrar BIZCN to ficticious registrants.

50.194.47.186
175.67.90.27
95.94.135.113
220.67.126.175

googleapps-works.com
googleapps-work.com
googleapps-career.com
googleapps-consult.com
googleapps-jobs.com
googleapps-offer.com
googleapps-cz.com
googleapps-espana.com
googleapps-euro.com
googleapps-us.com
googleapps-usa.com
googleapps-pl.com
googleapps-work.com
googleapps-japan.com
googleapps-italy.com
googleapps-ro.com
googleapps-nl.com
googleapps-spain.com
googleapps-gb.com
googleapps-greece.com
googleapps-group.com
googleapps-japan.com
googleapps-nz.com
googleapps-offer.com
googleapp-consult.com

carrer-trade.com
us-trades.com
worlds-trade.com
google-trade.com
trades-consult.com
googletrade-usa.com
google-usatrade.com

careerin-google.com
google-lavorare.com
works-google.com
consult-google.com
consulting-google.com

apple-praca.com
careerin-mac.com‎
apple-euro.com
job-in-apple.com
jobin-apple.com

jobin-usa.com
jobin-za.com
jobin-google.com
jobin-yahoo.com
job-italia.com
job-newzealand.com
job-greece.com

munca-bucuresti.com
romania-work.com
outsourcing-lavoro.com
outsourcing-consult.com
jobs-consult.com
jobmark-eu.com
worlds-diploms.com
italia-lavorare.com
lavoro-it.com
trade-outsource.com
warszawapraca.com
usa-findjob.com

medshorediet.com
hotalibre.com
wickedpl.com
eventlore.net
elcacareo.net
washin-factory.net
australia-attractions.net
conawaystrickler.net



2 comments:

Email User said...

Thanks for this.

We have been getting them through as well.

Unknown said...

And complaining to abuse@bizcn.com results (eventually, after about 15 emails) in them telling me to report it to www.cnnic.cn but they said they only deal with .cn sites.

A global block on all bizcn.com traffic might be a nice thing to do, if it were possible.