Sponsored by..

Showing posts with label Dating Scams. Show all posts
Showing posts with label Dating Scams. Show all posts

Monday 12 September 2011

bundespolizei-online.com is not the Bundespolizei

bundespolizei-online.com is a fake domain pretending to be the Bundespolizei (German Federal Police). It appears to be part of a malware scam that has been around for a while, where the victim is told that they have done something illegal and need to pay a fine to the police.

The text of the message might vary, but the last scam domain  was used in conjunction with a message that read:

Es ist ungesetzliche Tätigkeit enthüllt
Achtung!!!
Ein Vorgang illegaler Aktivitäten wurde erkannt.
Das Betriebssystem wurde im Zusammenhang mit Verstoßen gegen die Gesetze der Bundesrepublik Deutschland gesperrt! Es wurde folgender Verstoß festgestelltt: Ihre IP Adresse lautet "x.x.x.x" mit dieser IP wurden Seiten mit pornografischen Inhalten,Kinderpornographie, Sodomie und Gewalt gegen Kinder aufgerufen Auf Ihrem Computer wurden ebenfalls Videodateien mit pornografischen Inhalten, Elementen von Gewalt und Kinderpornografie festgestellt! Es wurden auch Emails in Form von Spam, mit terroristischen Hintergründen, verschickt. Diese Sperre des Computers dient dazu, Ihre illegalen Aktivitäten zu unterbinden.
Ihre IP: x.x.x.x
Location: XXXXX
ISP: XXXXX
Um die Sperre des Computers aufzuheben, sind Sie dazu verflichtet eine Strafe von 100 Euro zu zahlen. Sie haben zwei Möglichkeiten die Zahlung von 100 Euro zu leisten.

    1) Die Zahlung per Ukash begleichen:
    Dazu geben Sie bitte den erworbenen Code in das Zahlungsfeld ein und drücken Sie anschliessend auf OK (haben Sie mehrere Codes,so geben Sie Diese einfach nacheinander ein und drücken Sie anschliessend auf OK) Sollte das System Fehler melden,so müssen Sie den Code per Email (einzahlung@dpolg-bundespolizei.org) versenden.
    2) Die Zahlung per Paysafecard begleichen:
    Dazu geben Sie bitte den erworbenen Code (gegebenfalls inkl. Passwort) in das Zahlungsfeld ein und drücken Sie anschliessend auf OK (haben Sie mehrere Codes,so geben Sie Diese einfach nacheinander ein und drücken Sie anschliessend auf OK) Sollte das System Fehler melden,so müssen Sie den Code per Email(einzahlung@dpolg-bundespolizei.org) versenden.
This roughly translates as:

It is illegal activity revealed
Attention!
An operation of illegal activity has been detected.
The operating system was blocked in connection with Violating the laws of the Federal Republic of Germany! It was festgestelltt following violation: Your IP address is "xxxx" with the IP were pages containing pornography, child pornography, bestiality and violence invoked against children on the computer were also video files containing pornography, found elements of violence and child pornography! There were also emails sent in the form of spam, with terrorist backgrounds. This serves to lock the computer to stop your illegal activities.
Your IP: x.x.x.x
Location: XXXXX
ISP: XXXXX
To unlock the computer, you have to pay a penalty verflichtet of 100 €. You have two ways to make the payment of 100 €.

     1 pay) Payment via Ukash:
     You enter the acquired code into the payment box and then press OK (you have multiple codes, enter this simply a sequence, then press OK) If the system is wrong, you have the code by email (einzahlung@dpolg-bundespolizei.org) ship.
     2) The payment by paysafecard to pay:
     You enter the acquired code (if necessary including password) into the payment box and then press OK (you have multiple codes, enter this simply a sequence, then press OK) If the system is wrong, so you must send the code by email (einzahlung@dpolg-bundespolizei.org).

A €100 fine for terrorist likes and download child pornography? Obviously this is nonsense, but the victim might well try to pay to get rid of the trojan.

The bundespolizei-online.com is quite interesting to look at. First, there is the WHOIS record:

    Steffen Schüssler
    Email: t-mart-admin@teiekom.de
    Organization: Hostmaster T-Systems
    Address: Vahrenwalder Strasse 240-247
    City: Hannover
    State: Hannover
    ZIP: 30159
    Country: DE
    Phone: +49.43171633486
    Fax: +49.43171633486

It looks legitimate enough. T-Systems is the hosting division of Deutsche Telekom, and the email address looks legitimate at first glance.. but wait, it says teiekom.de and not telekom.de which can't be right.

The domain is registered through the Russian registrar Regtime Ltd. The site bundespolizei-online.com is hosted on 193.105.240.204 in Latvia. Latvia is pretty much a hotbed of crime, and the AS12578 block has a pretty bad reputation, and the whole 193.105.240.0/24 range looks quite toxic. As is common with malicious sites such as this, all the mail is handled by Google.

So.. if you see a message soliciting an email reply to bundespolizei-online.com or running on the same website then it is malware, and you should try to disinfect your machine using up-to-date antivirus software, or you could try following the instructions here.

Friday 23 July 2010

Romance Scams

A couple of interesting news stories recently illustrate the dangers of "Romance Scams" or Dating Scams which illustrate the dangers involved. In one, a woman called Brenda Parke details how she was ripped off  by a fraudster to the tune on £57,000.. and kudos to her for having the courage to come forward and shine a light on this activity.

But this isn't the only case, a recent BBC Crimewatch film reveals more about this operation, leading to a successful capture of a romance fraudster in Ghana. In this case the victim had sent £45,000 already and was about to send a staggering £120,000 before the police intervened.

Although most of the dating scam spam I see is Russian in origin, it is also a major criminal activity in Ghana in particular.

Thursday 13 May 2010

Dating scam: "I will be glad to get to know you"

There have been quite a few dating scams soliciting replies to BonBon.net lately, and coming with an attached photo. This one is meant to be "Anete".. what do you mean, you don't remember Anete? Anyway, it's probaly some fat sweaty Russian bloke trying to part you from your cash, so avoid this one.

Subject: I will be glad to get to know you

Hello! How are you? I hope you are ok. I am Anete.
You remember, we have got acquainted with you at dating site?
You have given me your email and today I write to you.
I think, now we can begin our acquaintance. I will be glad! Hope you too.
I am 30 years old. I want to find the man and to create serious relationship.
I want, that you have answered me if you still want to know me.
I send you my photos, and I want, that you do the same.
I will be glad to get to know you more close.

Please reply only to my personal e-mail:  utinanete@BonBon.net

I look forward your answer. With the best regards, Anete...

Thursday 6 May 2010

"I live in a city under name Kirov"

Unlike some other dating scam emails promoting very young women, this particular one claims to be from a 37-year-old economist, which I guess might say something about their target audience. In reality, "Mariya" is probably a fat sweaty male Russian who is trying to scam you out of some money.

Date: 6 May 2010 09:44
Subject: I live in a city under name Kirov

Hello my the surprised Friend!

I understand, that you are surprised now, when this letter has arrived to you. BUT I ASK YOU TO SPEND 5 MINUTES, your time and have read it up to the end then probably it will change your and my life. At first I wish to tell a little about myself. My name is Mariya. To me of 37 years. I live in a city under name Kirov, it is a small city in northern part of Russia. I not married and never was. I also do not have children. I have left school then has finished institute on a
trade of "economist". If it is interesting to you I will necessarily tell about it, but now not in it the purpose dear friend. Recently, I watched TV and saw, that in Russia there are 35000000
women who live without men, and there are such agencies of marriage which have many electronic addresses, and such agency can help to find for women the suitable man. I have gone to one of such agencies, and have addressed to them with inquiry that they have found for me the
good man. They have informed at once me, that in Russia I should search for the good and decent man very long time. Then they have offered me acquaintance to the man from other country, on what I have looked from a positive side. As I know, that at us in the country of the man, do not appreciate women, is possible because women several times more.

In general, I have agreed to strike up acquaintance to the man from other country, and they have given me your electronic address. Having told that you the lonely fair and decent man who searches for the woman for creation of relations. Then I took your electronic address and have gone to the cafe Internet to write you the letter. Here now you can my letter see. I have written you it with hope, that you will answer to me. I have inserted one my photo that you could see, my appearance and to solve for you directly completely, you will like to begin dialogue and relations with me or not. Only I ask, concern my letter seriously, look my photo, the letter, think and solve, precisely you would like to have the correspondence with me? I do not wish to be the friend, it is not necessary, I am ready to serious relations. It is very necessary to love, give my love to the MAN and family creation. If you really wish to have serious relations with me
write to me. If you do not want to have a relationship with me, just do not respond to my letter, I can understand everything myself. And nevertheless, I wish to tell to you, that my photo is made not professionally, but you see me, such what I in a life. And you can precisely define such woman as I am necessary for you or not. Very big inquiry as wanted if you however interested in me write to me about your e-mail where we can speak with you and small good photos you. Like everything, that I wished to tell you, and now I only need to wait from you for the answer, and I hope you write to me. If I was not pleasant to you, or serious relations are not necessary for you then do not write me anything, I will understand!

I hope your new friend, I hope that I can become for you friend Mariya!

You can send your letter and photo to this email address: mashalovers@BonBon.net

The lonely woman from Russia Mariya.

Friday 30 April 2010

"I am looking for the second half"

A straightforward dating scam email, but one notable for including a picture of a pretty Russian girl, which most spammers don't bother with. In any case, if you respond to "Natalia" (who is probably note even a woman in real life) then you'll soon find that she has unexpected "expenses" that will require you to send money..


Subject: I am looking for the second half

HELLO!!! My name is Natalia! I live in Russia, dating site, I am looking for the second half. I want to find true love, I loved your profile, I would like to continue with you dialogue.

If you do not mind to write me an e-mail: mamaevanatalia20@HotPOP.com

I am very tired of being single. I really want to build a serious relationship. I'll be glad to communicate ..... Natalia



Monday 18 January 2010

Is Q-dating.com a fake?


At first this looks like some random spam:

Subject: Find a sexdate - Free registration!
From: "Q-dating" <info@qdates.net>
Date: Mon, January 18, 2010 3:19 pm

Having trouble reading this email?

FIND A SEXDATE IN YOUR OWN AREA?

www.Q-Dating.com
[http://mailings.email-pro.net/link.php?M=000&N=143&L=118&F=T]

Chantal 24 jaaronline

Single, searching for sexdate!
I'm not ready to settle down
and looking for a sexbuddy
Irene 34 jaaronline

Married, looking for date.
I am a loving wife of 34 years looking for a nice man.
The best dating site of the UK. Advanced searching, Instant chat, test it
now FREE! Click here

Click here to unsubscribe
[http://mailings.email-pro.net/unsubscribe.php?M=000&C=00000&L=7&N=143]
After a bit of "wtf" I decided to check out the WHOIS details to see who was spamming:

Company: Realcom Limited
Name: Andy Ling
Address: 33, Throgmorton street
City: LONDON
Country: UNITED KINGDOM
Postal Code: EC2N 2BR
Phone: +44 7937 082 210
Fax:
Email: realcomltd@hotmail.com
Oh, well that's kind interesting.. they appear to be based in the UK. A quick check at Companies House does come up with a Realcom Ltd.. but it's a wholly innocent and unconnected company in Oxfordshire.

There's not much of a web presence about from this Dutch-language review [autotranslated] which also complains that the site is a fake and that unauthorised credit card transactions have been made.

A bit of searching around finds some related domains:
Q-dating.com [94.229.169.102]
Q-dating.eu [78.109.162.121]
Qdates.net [78.109.162.122]
Q-dating.be [78.109.162.119]
Q-dating.de [78.109.162.119]
Q-dating.net [78.109.162.119]
Credifact.net [94.229.169.102]
Megacasting.eu [94.229.169.102]
Email-pro.net [Parked].. mailings.email-pro.net is on 78.109.162.119

All infrastructure is supplied by UKFast (abuse -at- ukfast.co.uk)

There are plenty of other dating sites to choose from.. some of them may even be genuine. But given the complaints and the questionable WHOIS details, then probably best to avoid this one.

Tuesday 22 December 2009

mailbox-email.com scam

Part of a long running dating scam, mailbox-email.com looks like a free email service, but isn't. Hosted on 222.170.127.122 in China, the server also hosts various fake dating and prescription sites.

All of these following sites are some scam or another, avoid them:
  • Adltfuntime.com
  • Adultmeetspot.com
  • Amazmail.com
  • Aprofilepage.com
  • Blowingawaytherestnow.com
  • Email-mailbox.com
  • Findallthebestherenow.com
  • Findnewfriend.net
  • Free-email-chat.com
  • Free-email-connect.com
  • Free-email-fun.com
  • Free-email-live.com
  • Freeextender.net
  • Freemailaccounts.net
  • Freemailnow.net
  • Getitatrxcenternow.com
  • Greatestofrxznow.com
  • Happeningrxcenternow.com
  • Hotlivemailchat.com
  • Kingofthekingofrxznow.com
  • Myemailhome.net
  • Netherlandsdns.com
  • Nodocneededforrxmedznow.com
  • Plygroundadlt.com
  • Realdealrxbrandnamesnow.com
  • Sexyhotlivechat.com
  • Skinny-me.info
  • Ysjhdfjd.com
  • Zeuhiuer.com

Saturday 5 December 2009

"freeemailnow.net" scam

The domain freeemailnow.net looks like.. well, it looks like a free e-mail provider. But it isn't, it's part of some sort of fraudulent scheme, most likely a dating scam.

The pitch arrives something like this:

Subject: your profile
From: "Pasquale Clay"
Date: Fri, December 4, 2009 11:55 pm

Hey!
I know you dont know me, but I d like to get to know you.
I stumbled upon your contact information, am looking for a chat friend and maybe more.
Write me back at: snowfall1@freeemailnow.net

i am anxious to talk with you
A look at the SOA records points to ns1.netherlandsdns.com and admin.affilnet.net - affilnet.net is familiar, indicating that this is a re-run of the warmfuzzylove.com scam but again annoyingly missing a picture of a pretty Russian girl.

The registration details for freeemailnow.net are anonymous, nameservers are ns1.netherlandsdns.com and ns2.netherlandsdns.com, both on 222.170.127.122 in China along with freeemailnow.net itself.

There's a bunch of fake pharma sites sharing the same server:

  • Acquireflowherenow.com
  • Acquirerxmedzherenow.com
  • Allthebestatyourfingertips.com
  • Alwaysbetterrx.com
  • Anyrxmedications.com
  • Beatingallcompetition.com
  • Besatifiedmedsnow.com
  • Bestrxbuyshere.com
  • Blowingawaytherestnow.com
  • Championrxsource.com
  • Cheapcodeines.com
  • Choosefr0mthebest.com
  • Codeineoffers.com
  • Codeinepromo.com
  • Crazymedsupplyforyou.com
  • Discount-codeine.com
  • Easyrxhere.com
  • Expressmedz4u.com
  • Findallthebestherenow.com
  • Fingtertiprxmedacces.com
  • Firerxmedication.com
  • Flowagerofgood.com
  • G00dsonline.com
  • Getallyourfavorites.com
  • Getitatrxcenternow.com
  • Getmedicatedonline.com
  • Getrxeasily.com
  • Getrxeasilyonline.com
  • Getrxmedicationsherenow.com
  • Goodzchoices.com
  • Greatestofrxznow.com
  • Greatmedicalshere.com
  • Greatrxdepot.com
  • Greatrxg00ds.com
  • Greatrxonline4u.com
  • Grillindealz4u.com
  • Happeninggoodtime.com
  • Happeningrxcenternow.com
  • Honorablechoice.com
  • Incrediblerx4u.com
  • Kingofthekingofrxznow.com
  • Maxsav3r.com
  • Maxsaverz.com
  • Meddiezcenter.com
  • Medzfromonlinetoyourhome.com
  • Mosthighlysoughtafter.com
  • Neverendingflowages.com
  • Neverwaitrx.com
  • Newrx4champions.com
  • Niceflowofmedz.com
  • Nodocneededforrxmedznow.com
  • Nomorewaitinginlinenow.com
  • Onpointflowage.com
  • Qualitycodeine.com
  • Quickrxmedications.com
  • Readysetgetmedz.com
  • Realdealrxbrandnames.com
  • Realdealrxbrandnamesnow.com
  • Realdealrxrefills.com
  • Refillrx-depot.com
  • Reliableflowagehere.com
  • Reliablemedsource4u.com
  • Reliablerx4uonline.com
  • Rightrxchoice.com
  • Rx-refilldepot.com
  • Rxmainsource.com
  • Rxmedsolution4unow.com
  • Rxmedzatthefingers.com
  • Rxmedzinnotime.com
  • Rxremedies4u.com
  • Rxthatbeatsallothers.com
  • Rxwindowonline.com
  • Rxsourceforwinners.com
  • Selectfromallthebestmeds.com
  • Selectionfromthebest.com
  • Simeplyarx.com
  • Smokingdealz4u.com
  • Swiftestmedz.com
  • Theeasyreliablesourcenow.com
  • Theflowageoccurshere.com
  • Themybetterrx.com
  • Toprxsuppliers.com
  • Toprxsupplierz.com
  • Uniqueflowagesnow.com
  • Wehaveallyourfavorites.com
  • Wehavethemforyou.com
  • Wehavewhaturlookingfornow.com
  • Wehavewhatyourlooking4.com
  • Your-rxs.com
  • Netherlandsdns.com
Anyway, this is the same old scam and it should be avoided along with the fake RX sites that go with it.

Friday 13 November 2009

warmfuzzylove.com scam

Another dating scam, but they could even be bothered with a picture of a pretty Russian girl.

Subject: re:
From: "jody"
Date: Fri, November 13, 2009 10:49 pm

Hi there:

My name is jody. I was just looking at your picture online and i would
love to chat with you tonight. i just moved close to you and i have no
friends yet :(

you can send a message to my private email jody@warmfuzzylove.com

i would love to hear from you !!!!
warmfuzzylove.com was registered with anonymous details on 4th November 2009 and is hosted on 98.126.22.178 which also handles all the mail. The same server also hosts personals-online.net and singasong4u.com, both also recently registered with anonymous details.

Of course, "Jody" is probably a fat middle-aged man from a former Soviet Republic who will unexpectedly need some money wiring to them. Avoid.

Monday 5 January 2009

"Dating Service" bogus job offer

This is most likely a money mule operation, or perhaps one of those sophisticated scams where the bad guys recruit a whole virtual office staff to run the scam for them. Either way, avoid at all costs.

Subject: Available positions for new year. Reg.ID: SGF-SF7S8

To Your Attention,

Dating Service announces new job openings in 2009:

Part time employment is now available in our company for USA people.

Feel free to request an application by e-mailing us only at: Dating.Srvc@gmail.com

Best Regards,
Dating Service

Friday 31 October 2008

Dating scams and 79.135.168.*

We've seen this type of dating scam several times before. No good will come of engaging "Chantel" in conversations as she doesn't really exist. It will be some fat sweaty Russian bloke probably.

Subject: hi from chantel

hello, I am pretty russian girl, bored tonight.
would you like to chat with me and see my pics?
if so then email me at echantel39@officialsup.com
This is hosted on 79.135.168.36 which has been fingered before for fraud. Allegedly, the netblock is registered to an outfit in the Lebanon:


inetnum: 79.135.168.0 - 79.135.168.255
netname: LB-NET
descr: Lebanon private dedicated service
country: LB
admin-c: MHB1111-RIPE
tech-c: MHB1111-RIPE
remarks: abuse mailbox: moh.b@lubnannetworks.biz
status: ASSIGNED PA "status:" definitions
mnt-by: SISTEM-NET-MNT
source: RIPE # Filtered

person: Mohamed Baga
address: Basha Garden bldg, 5th floor LB
address: Jisr El Bacha Main Road
address: Beirut - Lebanon
e-mail: moh.b@lubnannetworks.biz
remarks: abuse mailbox: moh.b@lubnannetworks.biz
phone: +961 1 512341
nic-hdl: MHB1111-RIPE
source: RIPE # Filtered

% Information related to '79.135.160.0/19AS44097'

route: 79.135.160.0/19
descr: Sistemnet Telecom
origin: AS44097
mnt-by: Sistem-Net-MNT
But just a few IP addresses away is another netblock that we have seen before in Turkey. The whole netblock is a complete sewer and is listed on the Spamhaus DROP List. There are 2000+ domains in this /24 block, but just for brevity I will list the ones on this server - avoid them all.

  • Abgol.com
  • Amnocx.com
  • Bestsup.com
  • Cahla.com
  • Cardrealc.com
  • Centralrd.com
  • Direktmal.com
  • Equipyard.com
  • Escitatop.com
  • Eupoc.com
  • Ezshl.com
  • Firstlam.com
  • Flasheon.com
  • Flhnation.com
  • Flhplanet.com
  • Flhsupplies.com
  • Freeldp.info
  • Gbizc.info
  • Gbladx.info
  • Gblhome.info
  • Gblwizard.info
  • Golbalhobby.com
  • Goldenttamil.com
  • Goldirecto.com
  • Goldpug.info
  • Golguia.com
  • Golmundo.com
  • Golottoclub.com
  • Golsitio.com
  • Goltierra.com
  • Gosfordw.com
  • Hlgag.com
  • Hollandlopflags.com
  • Hyperlam.com
  • Jenniferlop.com
  • Jflyik.com
  • Ldphome.info
  • Ldpwizard.info
  • Lgbidxx.info
  • Lopguide.com
  • Meinmal.com
  • Miniplushlop.com
  • Modhl.com
  • Morerd.com
  • Moresup.com
  • Nitgbx.info
  • Officialflh.com
  • Officialgbl.info
  • Officialldp.info
  • Officialshl.com
  • Officialsup.com
  • Oldpee.info
  • Onlineflh.com
  • Onlineshl.com
  • Onlinesup.com
  • Pacanimal.com
  • Planetflh.com
  • Planetsup.com
  • Rdplanet.com
  • Revaloplast.com
  • Shemalglobal.com
  • Shlcentral.com
  • Shlnation.com
  • Shlsupplies.com
  • Shlwizard.com
  • Solidgoldent.com
  • Soundevelop.com
  • Superldp.info
  • Superlop.com
  • Supplanet.com
  • Supwizard.com
  • Tapthelop.com
  • Theloppet.com
  • Upflyp.com
  • Uplea.com
  • Virtualldp.info
  • Virtualsup.com
  • Virtuellmal.com
  • Wildevelop.com
  • Wildpin.info
  • Worldpivot.info
  • Worldplayservices.info
  • Yourldp.info
  • Yourlopmen.com
  • Yourloprabbit.com
Namesevers are NS1.DROREAL.COM and NS2.DROREAL.COM, both on 79.135.168.36.

Thursday 9 October 2008

Dating scams, onlineflh.com and 79.135.167.*

I have covered this particular group of dating scam sites before, but this time there's a slight shift in the way that it works. In this case, the parenthesis-laded email looks something like:

hey^) how are you?) do you have a girlfriend?)... i have not boyfriend(( I very
want to meet real men...which will know woman's need ...like in a cinema ... you
know))))lets chat!) i am pretty girl)) I have a lot of time for meetings and if you
have any ideas how to spend it with me... just email me back at
CAROLINE@onlineflh.com and i will reply back with some nice ;) photos with me
...and maybe, you will want to write me again))) CAROLINE@onlineflh.com

Perhaps "Caroline" is trying to data a LISP programmer? There's no website for onlineflh.com, but mail is handled by 79.135.167.51 which is the same as before.. although now the only two websites on that server are Ammae.com and Amnocx.com.

In these circumstances, a tool like Robtex can be useful. It turns out that 79.135.167.51 is a infrastructure server for a number of domains. The IP address noted as belonging to a ROKSO listed spammer, most likely some affiliate of the Russian Business Network (RBN).

Supported domains are:
  • alllam.com
  • cardrealc.com
  • ezshl.com
  • famplayfit.cn
  • firstlam.com
  • flasheon.com
  • gosfordw.com
  • llcam.com
  • morerd.com
  • onlineflh.com
  • onlineshl.com
  • planetflh.com
  • rdplanet.com
  • towadapointhalf.cn
  • virtuellmal.com
The whole 79.135.167.* block is a complete sewer of fake antivirus, dating, medication and codec sites. The netblock is registered to "TTNet Autonomous System Turk Telekom A S Aydinlikevler ANKARA 06103 TURKEY", but most likely under the control of the RBN. There's an interesting writeup about this netblock here.

The Spamhaus DROP list goes further and lists the entire 79.135.160.0/19 block (79.135.160.0 - 79.135.191.255) as being rogue. That's probably overkill as there do seem to be some legitimate (mostly Turkish) websites hosted in that range.

These were more fun when they had a picture of a pretty girl attached.

Thursday 11 September 2008

Dating scams

Dating scams are usually a variant of the advanced fee fraud - some pretty girl (probably some ugly bloke in reality) sends you some random photos and explains that they want to move to your country and move in with you.. but can they have some money first? The basic operation of these scams is described here. To make it look more credible, sometimes fake dating sites are set up to give the whole thing an air of legitimacy.

This current batch of fake sites is being advertised with an email similar to the following:

i need you

i am Nice Girl good looking girl who is looking to chat with you.
e-mail me back at UcWkS@lam2you.com

i will reply back with some really nice pictures.

The domain lam2you.com has a corresponding web site on 79.135.167.51 calling itself "Online sexiest dating site". As it happens, there are a whole bunch of other domains on the same server, also describing themselves as "Online sexiest dating site", all best avoided.

  • Amnocx.com
  • Anandaperumal.com
  • Bardline.com
  • Benrd.com
  • Bestdre.info
  • Cardrealc.com
  • Centralrd.com
  • Cowarddean.com
  • Direktmal.com
  • Dracingsite.info
  • Dracingworld.info
  • Draic.info
  • Dreguide.info
  • Drkin.info
  • Drmarksite.info
  • Drmarkworld.info
  • Drseusssite.info
  • Equipyard.com
  • Evram.info
  • Ezelive.info
  • Ezrdhome.com
  • Firstlam.com
  • Fordhx.com
  • Frcis.info
  • Freegbl.info
  • Freeksite.info
  • Freeldp.info
  • Friguide.info
  • Frutis-basket.info
  • Gardevin.com
  • Gbbed.info
  • Gbizc.info
  • Gbladx.info
  • Gblhome.info
  • Gblwizard.info
  • Gbowrxx.info
  • Glocentral.info
  • Gloplanet.info
  • Gobobrom.com
  • Gocarthq.com
  • Gocartutah.com
  • Goldpug.info
  • Gosfordw.com
  • Greatrom.com
  • Guyvr.info
  • Hardjam.com
  • Hote2youx.info
  • Hyperlam.com
  • Imalonline.com
  • Justgbl.info
  • Justrd.com
  • Justvre.info
  • Ldphome.info
  • Ldpwizard.info
  • Lesdv.com
  • Lesjr.com
  • Letsgocart.com
  • Lgbidxx.info
  • Maldirekt.com
  • Malkostenlos.com
  • Malplatz.com
  • Malprojekt.com
  • Malwelt.com
  • Malzentrale.com
  • Mediagocart.com
  • Medmallist.com
  • Meinmal.com
  • Menziesmalvern.com
  • Moonboardm.com
  • Morerd.com
  • Mygbl.info
  • Nitgbx.info
  • Nvromx.info
  • Officialgbl.info
  • Officialldp.info
  • Officialrd.com
  • Oldpee.info
  • Onlinegbl.info
  • Ovrom.info
  • Pacanimal.com
  • Phillymedicalmal.com
  • Qualitaetmal.com
  • Razales.com
  • Rd2you.com
  • Rdnation.com
  • Rdplanet.com
  • Saravanaperumal.com
  • Searchesrom.com
  • Shemalglobal.com
  • Supergbl.info
  • Superldp.info
  • Superrd.com
  • Superromics.com
  • Tomalonline.com
  • Topeguidex.info
  • Virtualgbl.info
  • Virtualglo.info
  • Virtualldp.info
  • Virtuellmal.com
  • Vrehome.info
  • Warmalonline.com
  • Wildpin.info
  • Wirelesamerica.com
  • Wizardrd.com
  • Worldpivot.info
  • Worldplayservices.info
  • Yourfr.info
  • Yourgbl.info
  • Yourldp.info
  • Capvr.info
  • Davidre.info
  • Virtualvre.info
  • Vreproject.info
  • Vrewizard.info
One thing of note is that the name servers used here are ns1.droreal.com and ns2.droreal.com which appears to be a domain name used to support other dating scam sites.

Tuesday 26 February 2008

Another dating scam

Dating scams are increasingly common and are something that I've blogged about before. It's really just a variation of the 419 Advanced Fee fraud scam, except the bait this time is usually a pretty Russian girl.

Hi! I'm a single girl and I'm 26 years old. Please take a look at my pictures and let me know if you like them! I live in Russia and I'm going to come to your country and work over there very soon! I don't know anybody over there and I thought it would be great to meet someone who is open to anything (as I am!). I would be happy to be friends, lovers or create a serious relationship! We will see what happens!

I hope you will write me back and I will write more info about myself and send more
photos!!!!!!!!!!!

I am writing from my friend's email address, so please make sure you do not reply directly to this email. Email me at nrochestetd0@yahoo.co.uk only.

if you don't use my personal email address then I won't be able to read your
reply and write you back. So it is very important that you get it
right.

Ok, I guess it is now your turn. Hope to hear from you today. Bye!!

btw, i got your email from dating website

Of course, the email is going to be from some ugly middle aged Russian bloke rather than an attractive young lady, but at least this one has the decency to include a couple of photos of someone who will have nothing to do with the scam at all.

Thursday 9 August 2007

Email "dating scams"


Sometimes scammers will try to lure you with a "dating scam" - usually a trick to gain money or possibly a visa. The basic setup is described here at Hoax-Slayer.com.

Often, these scams will use a throwaway email address at Hotmail, Yahoo or Gmail for responses, however these are often shut down so the latest trick is to register domains that look like genuine webmail addresses but aren't. Here's an example:

Hello! I am bored this afternoon. I am nice girl that would like to chat with you. Email me at mcmm@mailmessagecenter.info only, because I am writing not from my personal email. Don't miss some of my naughty pictures.
(Note the phrase "I am writing not from my personal email", because this comes from a spoofed address to make it harder to block.)

Now, mailmessagecenter.info looks like the sort of domain name you'd associate with a webmail account. In fact, it's hosted on a Chinese server at 124.254.2.226 along with a number of other domains. It appears that all of these domain names have been created to pursue this scam, so if you receive and email from any of them then just delete it.

  • Freemailwap.info
  • Imailmessage.info
  • Imailvision.info
  • Jumpcutpost.info
  • Jumpemail.info
  • Latinmailemail.info
  • Lonelyheartwaiting.com
  • Lovegalaxys.com
  • Loveisspecial.com
  • Loveonlylove.com
  • Mailmessagecenter.info
  • Mailmessageonline.info
  • Mailownemail.info
  • Mailvisionworld.info
  • Outmaildirect.info
  • Penmailpro.info
  • Postionvision.info
  • Presummermail.info
  • Romanticloveforever.com
  • Simpleitislove.com
  • Thaibestmail.info
  • Theamericanmail.info
  • Thefriendlymail.info
  • Thelovingplace.net
  • Tonsofloves.com
  • Worldmeetlove.com
Some of these sites are fake mail sites, others are fake dating sites. Unlike many scams, there's a fair level of sophistication to this one so it's quite possible to see that it might drag in some unsuspecting victims.