"Your Job Application is Pending" / rockingcreditoffer.com scam

We've seen a variant of this "Rock Force Management" scam a couple of times before (here and here).

Date:      Sun, 3 Jun 2012 21:04:25 +0200
From:      "Gracie Vega" [bog@cerex.com]
Subject:      Your Job Application is Pending

Hello Advantage


Thank you for submitting your information for potential employment opportunities.
We look forward to reviewing your application,
but can not do so until you complete our internal application.

Prior to begin able to be considered, you will first need you to formally apply.
Please go here to begin the process:

http://5url.net/e7D

Also, the following perks are potentially available:

- Paid Time Off
- Health Benefits Package
- Higher than average salaries
- Tuition Reimbursement
- Extensive 401(k)program

Please take the time to follow the directions and complete the entire application process.

---------- 

Then we get bounced through a series of redirectors:
5url.net/e7D  ->
xkteen.com.br/conlact.php?c=rockingcreditoffer&t=com?dejaryfi ->
rockingcreditoffer.com?dejaryfi

One characteristic of these scam pages is the number "(240) 718-4632" which is displayed on each one.

After filling in some basic details, the scam starts to become clear.

All job applicants on this site are now required to check their credit score online and submit them here in order to proceed.


The purpose of this verification is to prevent fraud and authenticate the profile of all our applicants. Please take note this is a verification process only and the result of your credit score will not in any way affect your job application. We just need to know that you are a real person.

There's a button labelled "Please click here to obtain your credit score (Authorized Credit Retrieval Agent)" which is this case leads to a 404 page, but before we have seen it going to a get-rich-quick scam page instead.

The problem is that by the time the scam becomes apparent, you have already furnished the scammers with your personally identifiable information which they will sell on to other scammers and spammers.

In this case the originating IP was 222.253.76.159 in Vietnam, the rockingcreditoffer.com scam site was hosted on 91.217.162.100 (Voejkova Nadezhda, a Russian firm hosting across the border in Ukraine). Give this one a wide berth..

Fake job and credit check sites to avoid

A little cluster of spam/scam sites on 95.142.173.176, running a scam related to this one. Avoid.

creditdealmanagement.com
creditlevelreport.com
hotdealsmanagement.com
hotoffermanagement.com
rockingdealmanagement.com
rockingdealmanagements.com
rockingoffermanagement.com
rockingscoremanagement.com
tql-billing.com

The WHOIS details are as follows:
creditdealmanagement.com
  Aleje Ujazdowskie 88-44
  Warszawa
  Warszawa,
  PL
  00545
  name:(Sophie Ellis)
  mail:(admin@creditdealmanagement.com)
  +022.8260898
  +022.8260898
  Hot Date

creditlevelreport.com
   NA
   Torrie Ots admin@creditlevelreport.com
   +14122666060 fax: +14122666060
   123 6th Street
   Pittsburgh PA 64213
   us

hotdealsmanagement.com
  name:(Sophie Ellis)
  Email:(admin@creditdealmanagement.com)
  tel-- +022.8260898  
  fax:(+022.8260898)
  Hot Date
  Aleje Ujazdowskie 88-44
  Warszawa
  Warszawa,
  PL
  zipcode:00545

hotoffermanagement.com
  Aleje Ujazdowskie 88-44
  Warszawa
  Warszawa,
  PL
  00545
  name:(Sophie Ellis)
  mail:(admin@creditdealmanagement.com)
  +022.8260898
  +022.8260898
  Hot Date

rockingdealmanagement.com
  name:(Niko Irlung)
  Email:(admin@rockingoffermanagement.com)
  tel-- +022.4860345
  fax:(+022.4860345)
  Rockinig
  Aleje Ujazdowskie 54C
  Warszawa
  Warszawa,
  PL
  zipcode:00541

rockingdealmanagements.com
   NA
   Yawn Paul admin@rockingscoremanagement.com
   +14122821060 fax: +14122821060
   34G W C Jobs
   Pittsburgh PA 64421
   us

rockingoffermanagement.com
  Niko Irlung admin@rockingoffermanagement.com
  +022.4860345
  +022.4860345
  Rockinig
  Aleje Ujazdowskie 54C
  Warszawa,
  Warszawa,
  PL 00541

rockingscoremanagement.com
   NA
   Yawn Paul admin@rockingscoremanagement.com
   +14122821060 fax: +14122821060
   34G W C Jobs
   Pittsburgh PA 64421
   us

tql-billing.com
  Aleje Ujazdowskie 87-44
  Warszawa
  Warszawa,
  PL
  00540
  name:(Dill Nilson)
  mail:(admin@tql-billing.com)
 +022.8277528
 +022.8277528    TQL

Fake jobs: euro@ultraups.com

The "Lapatasker" money mule recruiters have been fairly quiet for a while, but here is a new one:

From:  Barrmanager@pacbell.net maurogonzal22@gmail.com
Date: 28 January 2012 01:39
Subject: Parttime Job

Compliments

I am the personnel department manager and I am appealing to you in the name of the large-scale and first-rate partnership.

Our company is met in many departments, such as:
- property
- bank account operations
- transportation and logistics
- private enterprise service
- etc.

We need a person to fill the vacancy of a regional manager in Europe:
- salary 2.600 euro + bonus
- 2 - 3 working hours per day
- individual time-table


If our offer is interesting for you email us the required information:
e u r o @ u l t r a u p s . c o m (Please Delete Spaces In Email Address Before Mailing Us)
Full name:
Country:
City
E-mail:
Contact phone number:



Attention! We need just the people residing in EU.

Please, write your Telephone Number and our manager will contact with you and answer all your questions. 

The "jobs" offered are illegal activities such as money laundering, so signing up to them could land you in serious trouble with law enforcement and seriously out of pocket.

The domain was registered a while ago, probably with fake registrant details:
    Alexis Putt
    Email: alexisputt@yahoo.co.uk
    Organization: Alexis Putt
    Address: St Katharine's Way 12
    City: London
    State: London
    ZIP: E1W 1DD
    Country: GB
    Phone: +44.0113343341

If you have any more example emails, please consider sharing them in the comments.

Scam: "CareerQuick Staffing" / careermanagement.com.ua

This is another take on RockSmith Management scam, linked to these dodgy work-at-home sites, apparently with an Australian connection.

Date:      Mon, 26 Sep 2011 05:48:19 +0530
From:      "Terence Mooney" [terence.mooney@voicecom.co.za]
Subject:      Reminder: Employment Opportunity Followup

Hello

Thank you for submitting your information for potential employment opportunities.
We look forward to reviewing your application, but can not do so until you complete our
internal application.

The pay range for available positions range from $35.77 per hour to $57.62 per hour.
Prior to begin able to be considered, you will first need you to formally apply.
Please go here to begin the process:

http://careermanagement.com.ua/

Also, the following perks are potentially available:

- Paid Time Off
- Health Benefits Package
- Higher than average salaries
- Tuition Reimbursement
- Extensive 401(k)program

Please take the time to follow the directions and complete the entire
application process.


Best Regards,

Rock Smith Management

careermanagement.com.ua is a Ukrainian domain, it is hosted on 85.121.39.3, which is a known black-hat host in Romania (Monyson Grup S.A), although as we said before this appears to be an Australian crew running the scam. The layout of the site echoes careerquickstaffing.com, a site that has already been suspended for spamming.

Scam: RockSmith Management / rocksmithmanagement.com

This scam has been around for a while, it's part of a nasty cluster of scam sites that have an Australian connection.

The spam comes from a fake address, delivered from an illegally compromised PC. In this example, the spam appears to come from mulattorcxf826@uncw.edu (which is fake) through a well-known spam server in China, 221.212.109.135. Of course, faking the sender address breaks the CAN SPAM act in the US (where the sender pretends to be), as does the lack of real contact details.

Date:      Sat, 3 Dec 2011 11:15:17 +0800
From:      "Ralph Nguyen" [mulattorcxf826@uncw.edu]
Subject:      Please Complete Your Job Application

Dear Applicant

Thank you for expressing your interest in open employment openings in your area.
We are happy to inform you that our placement specialists will be reviewing
available positions for you within the next hour.

Based on your profile, you may qualify for opportunities currently available with a monthly salary in the
$4000 to $8700 range.

To maximize your earnings potential, please complete our full application form first:

http://go.likejav.com/9bcf1f

In addition to a highly competitive base pay, applicants that qualify will also enjoy additional benefits such as:
* 2 wks. paid vacation time (per annum);
* Tuition allowance;
* 401(k)
* full benefits package
* generous retirement plan

To retain your priority placement, please complete your application at your earliest convenience.

We look forward to finding the right job for you.

Rockforce Management
Bringing the best candidates and the right jobs together.

The link forwards to rocksmithmanagement.com (but it could be any one of a variety of similarly named scam sites), as listed here. 


Of note is the phone number on the first screen - (240) 718-4632 is listed in a number of similar scam sites. I don't know if it is valid or not, it might even belong to a legitimate company. There is no point in ringing it in any case as the scam unfolrd..

The next page is more worrying as it harvests personal details such as your name, phone number and email address. Yes, that would be acceptable for a job site.. but these details are not used at all by this process, so presumably they will be used for spamming purposes.

Once you have signed away your personal details, you get to the "final step" which offers you the chance o check your credit report or view the jobs on offer. On the bottom of the page is a "Privacy Policy" and "Terms of Service" link.. except they aren't links at all, just underlined text. In fact, there is no privacy policy or identifying text anywhere on the site.


If you click on the prominent "Clicking Here" link, you get redirected through referer.us/moxiinternal.go2cloud.org/aff_c?offer_id=2&aff_id=1002&aff_sub=020 to a site called sixfigurekit.com run by an outfit called the "Six Figure Program". The BBB rates the Six Figure Programs as an F in Florida, an F in Illinois but bizarrely a B in New York. On balance it looks pretty poor.

Regardless of where or not the Six Figure Program is a legitimate business or not, it certainly isn't a credit check.. and in this case the spam victim has been duped into clicking the link in order to be exposed to this frankly ridiculous scheme.


So what happens if the victim clicks on the other link on the page? They simply get redirected to a page on indeed.com (branded "RockGrade Management" / rockgrademanagement.com) which returns exactly the same results as if the victim had gone directly to indeed.com in the first place.

But wait.. remember the name, phone number and email address you supplied? What happened to them? They're not needed for indeed.com, so it looks likely that the victim has just given themselves up for even more spam.


All the evidence that I have been able to find links this to a site called websitedesignbrisbane.org in Australia. You can complain about Australian companies at ACMA, although it is difficult to identify exactly which company runs that particular site, but it bills itself as "Jetstream Web Site Design + SEO", presumably of Brisbane.

Fake jobs: working-ca.com

Another fake job domain, working-ca.com seems to be part of this long-running scam. I hadn't spotted this one before, so thanks to our reader who sent it in. Note that this is not connected with the legitimate site WorkingCA.com . The jobs offered are actually illegal activities such as money laundering.

Hello, We have an excellent opportunity for an apprentice applicant to
join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay
at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for Canadians only,This is in
view of our not having a branch office presently in Canada,
also becouse of paypal and ebay policies wich is prohibit to work
directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good
typing skills.
If you fit the above description and meet the requirements, please apply
to this ad stating your location.

You will be processing orders from your computer. How much you earn is
up to you.
The average is in the region of CA$750- CA$1000 per week, depending on
whether you work full or part time.

Region: Canada only.

If you would like more information, please contact us stating where you
are located and our job reference number - 70570-868/4HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Weldon@working-ca.com

and

Hello, We have an excellent opportunity for an apprentice applicant to
join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay
at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for Canadians only,This is in
view of our not having a branch office presently in Canada,
also becouse of paypal and ebay policies wich is prohibit to work
directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good
typing skills.
If you fit the above description and meet the requirements, please apply
to this ad stating your location.

You will be processing orders from your computer. How much you earn is
up to you.
The average is in the region of CA$750- CA$1000 per week, depending on
whether you work full or part time.

Region: Canada only.

If you would like more information, please contact us stating where you
are located and our job reference number - 35097-781/2HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Tristan@working-ca.com

The registrant details for the domain are probably fake, but here they are anyway:

Kevin Tesalo
    Email: kevintesalo@yahoo.fr
    Organization: Kevin Tesalo
    Address: 2 avenue des Beguines
    City: Cergy Saint Christophe
    State: Cergy Saint Christophe
    ZIP: 95811
    Country: FR
    Phone: +33.124335612 

Fake jobs: jobinhollandart.com and europjobs.eu

Here are two new domains promoting fake jobs: jobinhollandart.com and europjobs.eu

This series of emails seems to be different from this one, but the pitch is still the same - the bad guys are trying to recruit people for money laundering activities and other criminal acts.

Date: 24 November 2011 06:27
Subject: Virtuele Manager vacature
  
Ons bedrijf is een snel groeiende internationale adviesbureau dat de diensten tot 46 landen verleent..
We hebben succesvol geweest voor een lange periode van werk in nauwe samenwerking met een aantal
organisaties voor onderzoek en investeringen over heel Europa.
We hebben vele boeiende projecten in de financiële diensten, financiële steun,
die eisen dat WUG bedrijf is voortdurend groeien en ontwikkelen..

Dankzij de uitbreiding van onze zaken ons bedrijf is op zoek naar een individu om de positie
van regionalefinanciële vertegenwoordiger te vullen.
Wij stellen voor werken in een internationale omgeving met een vriendelijk team
van hoog gekwalificeerde professionals en leren van de leider in deze opwindende industrie..

Belangrijke verantwoordelijkheden:
- Handhaving van de database op de website met behulp van onze speciale software
- Het opstellen van de verslagen
- Omgaan met bestaande en nieuwe komen klanten
- Werken met Internet en E-mail

Wij hebben vereist:
- Hoger onderwijs
- Klant minded-responsieve/vermogen/wens om te dienen van klanten
- Technische kennis - goed Windows begrip
- Proactief - zoeken naar oplossingen
- Een goede beheersing van het Engels (verplicht)

Wij waarborgen:
- Volledig betaald opleiding
- Competitief loon 2300 Euro per maand
- Mogelijkheid voor promotie
- Een sociaal pakket (verzekering, enz.)
- Speciaal ontworpen bonussysteem

Stuur uw gedetailleerde cv's in het Engels voor onze overweging op onze e-mail
met vermelding van de Financieel Vertegenwoordiger functie.
Succesvolle kandidaten zullen worden gecontacteerd met betrekking tot de tijd voor het interview..

Amie@jobinhollandart.com

jobinhollandart.com shares back-end infrastructure with europjobs.eu and a domain called israelcallingcard.net. You can assume that  europjobs.eu will also be used for fraudulent activities.

The MX records point to 68.68.20.166, (Bluemile Inc, Ohio). Nameservers are on 173.213.79.90 (Ionix, Nevada) and 170.19.177.33 (Cooper Neff, Pennsylvania).

The WHOIS records for all these domains are probably fake:

jobinhollandart.com
   Diane R. Coleman
   Diane Coleman DianeRColeman@aol.com
   +1.3612298028 fax: +1.3612298028
   1327 Boone Street
   Corpus Christi TX 78476
   us

israelcallingcard.net
      Neva Kilpatrick
      5636 GUILFORD AVE
      INDIANAPOLIS, IN 46220
      US
      Phone: +1.3178112099
      Email: ironeggman@yahoo.com

europjobs.eu
Name    Sarka Sirotkova
Organisation   
Language    English
Address   
Email  

Fake jobs: europcareers.net

One more fake job domain to avoid, europcareers.net follows on from the ones spotted yesterday and uses the fake (probably fake) registration address:

frederic benou
    Email: fredericabenou@yahoo.fr
    Organization: frederic benou
    Address: 23 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94112
    Country: FR
    Phone: +33.0148931456 

The emails may appear to come from yourself (here's why). The jobs offered are actually criminal activities such as money laundering. If you have any example emails, please consider sharing them in the Comments.

Fake jobs: jobsearchoo.com, newstatejob.com and usanewjobgov.com

Three more domains being used to recruit money laundering jobs and other illegal activities:

jobsearchoo.com
newstatejob.com
usanewjobgov.com


The jobs form part of this long running scam.Email messages may appear to come from yourself (here's why). The domain is registered to the following (probably fake) address:

    frederic benou
    Email: fredericabenou@yahoo.fr
    Organization: frederic benou
    Address: 23 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94112
    Country: FR
    Phone: +33.0148931456 

If you have any examples of emails using these domains, then please consider sharing them in the Comments. Thanks!

Fake jobs: expoeurojob.com, newjobsineurope.com and thenewjobbs.com

Three new domains offering jobs which will actually turn out to be money laundering or reshipping stolen goods. This scam has been going on for years.

expoeurojob.com
newjobsineurope.com
thenewjobbs.com

The emails may appear to come "from" your own email address (here's why). The (probably fake) registrant details for this domain are:

    Francisco Getz
    Email: franciscogetz@yahoo.fr
    Organization: Francisco Getz
    Address: 43 rue Mazarine
    City: Paris
    State: Paris
    ZIP: 75002
    Country: FR
    Phone: +33.191282216

If you have any samples of spam using these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: jobbslists.com, jobbsearcher.com, gbjobb.com and greecejobb.com

Yet more fake job offers, following on from this long-running scam. This time the following domains are in use to solicit replies:

jobbslists.com
jobbsearcher.com
gbjobb.com
greecejobb.com

The spam emails adveritising these may appear to come from your own email account (here's why). The "jobs" on offer are actually illegal activities such as money laundering.

For the record, the registrant details for those domains (which are almost definitely fake) are:

    Lorian Kern
    Email: loorjaan@yahoo.dk
    Organization: Lorian Kern
    Address: Sonderskovvej 22
    City: Lystrup
    State: Lystrup
    ZIP: 8124
    Country: DK
    Phone: +45.83743412 

If you have any example emails, please consider sharing them in the Comments. Thanks!

Scam sites on 84.22.161.169

84.22.161.169 (IOMART Ltd, UK) seems to have some problems with scam sites, such as the one mentioned in this post. I haven't had time to check the whole range, but most of the sites they host are legitimate, these however appear to be bogus.

mailukrsoft.com

    Rogers, Sid  via@viagrasuperpills.com
    March St 43
    San Antonio, Tx 7820 1
    US
    +1.2103354574

mailopal.com

    Weis, Albert  albert.weiso@yahoo.com
    56 Dashington Avenue
    New York State, West  Stay Ville 1179 6
    US
    +1.016312918436

ukraiansoftware.com

    Mitch, Ray  vpx@vpxlpillstore.com
    Po Box 434
    Grand Prairie, Tx 7505 0
    US
    +1.5743436654

ukrdevonline.net

    SMITH, THOMAS  akky@buyaccutane.us
    14664 State Hwy B
    Marshfield, Mo 6570 6
    US
    +1.4177377167

ukrsoft.org

Registrant ID:tu1tWtvki2quecE9
Registrant Name:raymond russ
Registrant Organization:raymond russ
Registrant Street1:229 west 78 street
Registrant Street2:
Registrant Street3:
Registrant City:new york
Registrant State/Province:newyork
Registrant Postal Code:10024-6646
Registrant Country:US
Registrant Phone:+1.2125953001
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:raymondruss@yahoo.com

ukrsoftmail.com

    Smith, David  david.smith791@yahoo.com
    1845 east northgate drive
    Irdi ange, Texas 75062- 47 36
    US
    +1.019277214101

westmailwug.com

    morrison, dennis  morrison.wug78@yahoo.com
    575
    texas, texas fghhy2
    US
    +1.9723479881

westunionhome.com

    Walters, Hank  doggerellhlog@gmail.com
    Railway Circle 55
    Hannibal, Mo 6340 1
    US
    +1.5734564433

westunionweb.com

    Jacks, Michael  griswoldmopar@gmail.com
    Forest Ave 65
    Oak Park, Illinois  6030 1
    US
    +1.7085561232

taurus-analityc.com

    De Gaetano, Richard  xsponger@gmail.com
    1001 Lincoln Avenue
    Lockport, Newyork 14094
    US
    +44.017164336832

taurus-mac.com

    Vanko, Ken  eudociafrequk@gmail.com
    16st 65 Ap 44
    San Diego, Ca 9210 1
    US
    +1.4342268876

mailukrsoft.com: job scammers in action

A post over at woozoo.nl caught my eye (in Nederlands, Google Translated to English) about the netherlandjobb.com scam. Robert Krom goes several steps further than I usually do with a good investigation into how the scammers try to rope people in.

Robert identifies mailukrsoft.com  as the next stage in the scam. To me, it looks like it is run by a different crew, but scammers tend to oursource activities to others these days. It appears that one group of scammers may be looking for money mules and then selling them on to others.

Fake jobs: jobbworld.com and yourjobb.com

Two new domains being used to recruit for fake jobs, which actually turn out to be illegal activities such as money laundering.

jobbworld.com
yourjobb.com

This is part of a long-running scam that has been going on for ages. One characteristic of the spam received is that it appears to come from your own email address (here's why).

If you have any examples of spam using these domains for reply addresses, please consider sharing them in the Comments.

Here is one sample:

Date: 24 October 2011 20:15
Subject: Deeltijdarbeid
   
Ik wil uw aandacht brengen en u te informeren dat Consulting Bedrijf beginnen  proces te inhuren en geven u een
grote kans om carrière te beginnen  nu met veel voordelen en de voordelen van dit werek.

Als u besloten om onderbreking in uw carrière te maken, of u op een moederschapsverlof bent,
onlangs gepensioneerde of gewoon op zoek naar enkele aanvullende tijdelijk baan, dit standpunt is enkel voor u gemaakt.

Werkende uuren: Flexibele tijdschema van van 1 tot 3 uur per dag. We garanderen ongeveer 20 uur een week bezetting.
Salaris en voordelen: begin salaris is variërend van 2000 tot 2500 euro per maand,
vermeerderd met extra commissie als u alle taken nauwkeurig vervullen.

Regio: Europese Unie.

Houd er rekening mee dat er geen betalingen of elke andere trucs om te gaan werken voor ons zijn.

Indien geïnteresseerd en wil u verzoeken een aanvraagformulier toepassen voor deze positie,
uw interview plannen en of gewoon meer informatie ontvangen over deze positie voordat u toepast,
kunt u antwoord op deze e-mail en stuur ons uw contact informatie.

In het onderwerp van e-mail Geef uw persoonlijk identificatienummer voor deze positie IDNO: 04459

Als u geïnteresseerd bent, kunt u reageren op: Damion@yourjobb.com,bedank!

And another one that seems to drift between Dutch and Czech for a while..

Subject: Vacature
   
Ik wil uw aandacht brengen en u te informeren dat Consulting Bedrijf beginnen  proces te inhuren en geven u een
grote kans om carričre te beginnen  nu met veel voordelen en de voordelen van dit werek.

Als u besloten om onderbreking in uw carričre te maken, of u op een moederschapsverlof bent,
onlangs gepensioneerde of gewoon op zoek naar enkele aanvullende tijdelijk baan, dit standpunt is enkel voor u gemaakt.

Werkende uuren: Flexibele tijdschema van van 1 tot 3 uur per dag. We garanderen ongeveer 20 uur een week bezetting.
Salaris en voordelen: begin salaris is variërend van 2000 tot 2500 euro per maand,
vermeerderd met extra commissie als u alle taken nauwkeurig vervullen.

Regio: Europese Unie.

Houd er rekening mee dat er geen betalingen of elke andere trucs om te gaan werken voor ons zijn.

Indien geďnteresseerd en wil u verzoeken een aanvraagformulier toepassen voor deze positie,
uw interview plannen en of gewoon meer informatie ontvangen over deze positie voordat u toepast,
kunt u antwoord op deze e-mail en stuur ons uw contact informatie.

In het onderwerp van e-mail Geef uw persoonlijk identificatienummer voor deze positie IDNO: 64594

Als u geďnteresseerd bent, kunt u reageren op: Fidel@yourjobb.com,bedank!

Fake jobs: canada-newjob.com, netherlandjobb.com and newjobrecruit.com

Another bunch of domains being used to peddle fake jobs:

canada-newjob.com
netherlandjobb.com
newjobrecruit.com

These domains form part of this long running scam. You may find that the emails appear to come from your own email address (here's why).

The domain registrant details are no doubt fake:

    Adolf Nureng
    Email: adolfnureng@yahoo.dk
    Organization: Adolf Nureng
    Address: Spellingevej 3 Ro
    City: Gudhjem
    State: Gudhjem
    ZIP: 3703
    Country: DK
    Phone: +45.70225632

The jobs offered will actually be criminal activities such as money laundering. If you have any examples of emails using these domains, please consider sharing them in the Comments. Thanks!

Here is one example:

Date: 20 October 2011 13:17
Subject: Huidige vacature

Wij werven aan!

Wij bieden part-time of full-time posities in de EU.
Momenteel is onze team van specialisten is het ontwikkelen van vooruitstrevende en innovatieve
manier van samenwerking met onze klant dus breiden we ons netwerk van vertegenwoordigers in heel Europa.

Wij bieden volledig betaalde trainingen om u te begeleiden door uw werk, competitief salaris,
vrij werk schema en andere voordelen die uw samenwerking met ons zeer aangenaam.
Wilt u bij ons bedrijf te sluiten, moet u ervoor zorgen dat u houdt de Europese verblijf
en je bezit een sterk verlangen om te werken.

Als je eenmaal hebt besloten om ons aan te sluiten, gelieve ons dan uw contactgegevens
en wij nemen zo spoedig contact met u op om een interview te plannen.

Onze contactgegevens: Rolland@netherlandjobb.com

Hartelijk dank voor uw interesse!

In this case, the email originated from 178.172.136.117 in Belarus.

Fake jobs: it-jobsearch.com

Another fake job domain, it-jobsearch.com follows on directly from these two reported yesterday. The domain is registered to the same fake address in France as yesterday.

As usual, the email soliciting replies to this domain is trying to recruit people for money laundering. The email may appear to come from your own email address (here's why).

If you have example emails soliciting replies to this domain, please consider sharing them in the Comments. Thanks!

Fake jobs: new-jobaccess.com and simple-jobneed.com

Two new fake job domains, forming part of the long-running "Lapatasker" scam.

new-jobaccess.com
simple-jobneed.com

Emails from these domains may appear to be from your own email address (here's why). They are registered to a no-doubt fake registrant:

Luc Metteran
    Email: lucmetteran@yahoo.fr
    Organization: Luc Metteran
    Address: 6, avenue Kennedy
    City: Paris
    State: Paris
    ZIP: 17880
    Country: FR
    Phone: +33.0156402315 

The "jobs" on offer are illegal activities such as money laundering. If you have any examples of spam using these domains to solicit replies, please consider sharing them in the Comments. Thanks!

Fake jobs: all-cajobs.com, all-ukjobs.com and alleur-positions.com

Here we go again.. three new domains that form part of this long-running scam.

all-cajobs.coma
all-ukjobs.com
alleur-positions.com

The "jobs" offered are actually illegal activities such as money laundering. You may note that the email appears to come from yourself (here's why).

The domains are registered to a no-doubt fake registrant:

    Hose Sanches
    Email: hosesancges@yahoo.com
    Organization: Hose Sanches
    Address: Campo Grande, 83 1749-812
    City: Lisboa
    State: Lisboa
    ZIP: 1749-812
    Country: PT
    Phone: +35.1217982140

If you have any examples of emails soliciting replies to these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: firstjob-market.com, tech-newposition.com and ukjob-market.com

Three new fake job domains today, apparently forming part of this long running scam.

firstjob-market.com
tech-newposition.com
ukjob-market.com

Emails send soliciting replies to these domains may appear to come from your own email address (here's why). The so-called jobs being offered are actually criminal activities such as money laundering.

The no-doubt-fake registrant details are:

    Lucia Geleca
    Email: lucpolema@yahoo.fr
    Organization: Lucia Geleca
    Address: 12 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94141
    Country: FR
    Phone: +33.0148934367

Although the address is genuine, it almost definitely bogus.

If you have any examples of spam emails "from" these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: hire-position.com and work-position.net

Two new fake job domains with a twist, possibly the same scammers who are behind this long-running spam/scam campaign.

hire-position.com
work-position.net

Domains were registered just yesterday via a Russian registrar to an address in Spain which is most likely fake:

    Ivan Gonsalez
    Email: ivan4gonzalez@yahoo.es
    Organization: Ivan Gonsalez
    Address: P. de Extremadura 151
    City: Madrid
    State: Madrid
    ZIP: 28011
    Country: ES
    Phone: +34.914641145 

This rabbit hole goes a bit deeper than usual, because the ivan4gonzalez@yahoo.es email address has been used before, for the domain girsland.ru

domain: GIRSLAND.RU

nserver: ns1.strategy-recruiting.org.

nserver: ns2.strategy-recruiting.org.

state: REGISTERED, DELEGATED, UNVERIFIED

person: Private Person

e-mail: ivan4gonzalez@yahoo.es

registrar: REGTIME-REG-RIPN

created: 2011.07.26

paid-till: 2012.07.26

source: TCI

Girsland.ru has a reputation for being spammy and it looks like a typical romance scam site. As with hire-position.com and work-position.net, it's odd that a Spanish address is being used for domains that are either Russian TLD or are being registered through a Russian registrar.

Girsland.ru is hosted on 173.234.8.215 at Ubiquity Server Solutions Atlanta, although it looks like the IP block might be rented out to a company called Nobis Technology Group LLC in Arizona.There are some nasty things going on in that IP neighbourhood according to SiteVet.

What else can we find on 173.234.8.215? It turns out that there's a rich vein of nastiness here.

actionfg.com - "Action Financial. All of your financial services in one place."
Chinese registrar, fake WHOIS details. Fake check scam. [1] [2]

Michael L. Walter

Michael Walter MichaelLWalter@teleworm.com

314-849-7082 fax: 314-849-7011

2523 Ash Avenue

Saint Louis MO 63126

us

NS: ns1.wapcco.net and ns2.wapcco.net

adena-job.com.
Chinese registrar, fake WHOIS details. Fake job offers. [3]

Name: Ana Bates

Organization: Ana N. Bates

Address: 789 Pinchelone Street

City: Herndon

Province/state: VA

Country: us

Postal Code: 22090

Email: AnaNBates@ymail.com

NS: ns1.needafishingboat.net and ns2.needafishingboat.net

adenafinance.com - "Adena Finance. All of your financial services in one place."
Chinese registrar, fake WHOIS details.

Eric M. Dillinger

Eric Dillinger EricMDillinger@gmail.com

+1.5305125808 fax: +1.5305125808

1467 Hill Croft Farm Road

Sacramento CA 95814

us

NS: ns1.needafishingboat.net and ns2.needafishingboat.net

arrowfg.com - "Arrow Financial Group"
Chinese registrar, fake WHOIS details. Money mule scam [4] [5]

William K. Breen

William Breen WilliamKBreen@teleworm.com

606-542-3946 fax: 606-542-3922

62 Meadowcrest Lane

Flat Lick KY 40982

us

NS: ns1.careerhiring-solutions.org and ns2.careerhiring-solutions.org

freeblogpro.org - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution. [6] [7]

Registrant ID:TOD-42629838

Registrant Name:Gertrude Mcmillan

Registrant Organization:Gertrude D. Mcmillan

Registrant Street1:250 Reynolds Alley

Registrant Street2:

Registrant Street3:

Registrant City:Long Beach

Registrant State/Province:CA

Registrant Postal Code:90808

Registrant Country:US

Registrant Phone:+1.5623772946

Registrant Phone Ext.:

Registrant FAX:+1.5623772946

Registrant FAX Ext.:

Registrant Email:GertrudeDMcmillan@gmail.com

NS: NS1.SLOWSTATUS.NET and NS2.SLOWSTATUS.NET

krokodilius8.com
Chinese registrar, fake WHOIS details. Malware distribution. [8]

Richard J. Aguilar

Richard Aguilar RichardJAguilar@gmail.com

+1.2523933705 fax: +1.2523933705

3458 Green Acres Road

Swansboro NC 28584

us

NS: ns1.barcellons.com and ns2.barcellons.com

rdm-gool.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Probably malware distribution.

Lincoln P. Miller

Lincoln Miller LincolnPMiller@gmail.com

+1.4156774378 fax: +1.4156774378

813 Boring Lane

San Francisco CA 94108

us

NS: ns1.slowstatus.net and ns2.slowstatus.net

recruitarrowfg.com
Chinese registrar, fake WHOIS details. Fake job offers [9] [10]

Name: Fletcher Leach

Organization: Fletcher C. Leach

Address: 180 Deer Ridge Drive

City: Millburn

Province/state: NJ

Country: us

Postal Code: 07041

Email: FletcherCLeach@aol.com

NS: ns1.careerhiring-solutions.org and ns2.careerhiring-solutions.org

superblogonline.org - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [11] [12]

Registrant ID:TOD-42637428

Registrant Name:Ernest Thomas

Registrant Organization:Ernest R. Thomas

Registrant Street1:228 Riverside Drive

Registrant Street2:

Registrant Street3:

Registrant City:Athens

Registrant State/Province:GA

Registrant Postal Code:30606

Registrant Country:US

Registrant Phone:+1.7068186834

Registrant Phone Ext.:

Registrant FAX:+1.7068186834

Registrant FAX Ext.:

Registrant Email:ErnestRThomas@aol.com

NS: NS1.SLOWSTATUS.NET and NS2.SLOWSTATUS.NET

thebloggin.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [13] [14]

Justin R. Martinez

Justin Martinez JustinRMartinez@aol.com

+1.3235224026 fax: +1.3235224026

2898 Evergreen Lane

Pomona CA 91766

us

NS: ns1.slowstatus.net and ns2.slowstatus.net

yourtraveldiary.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [15]

Name: Paula Huerta

Organization: Paula A. Huerta

Address: 3993 Payne Street

City: Hillsville

Province/state: VA

Country: us

Postal Code: 24343

Email: PaulaAHuerta@gmail.com

NS: ns1.slowstatus.net and ns2.slowstatus.net

Querying the namesevers reveals some more domains that look worth blocking as well. In total, blocking the following related domains will probably be a very good thing to do.

actionfg.com
adenafinance.com
adena-job.com
admnxm.com
adxreport.com
arrowfg.com
barcellons.com
betononasos228.net
careerhiring-solutions.org
club-bork.com
computer-giga.net
com-watch-id2181222ooo.info
dramchinatea.net
estatediary.com
findepotdirect.com
finwizonline.com
forfreeblog.net
freebloghub.com
freeblogpro.org
freetrialmail.com
friendsadirect.com
fun-bork.com
generalcreate.net
girsland.ru
hire-position.com
hostfrontpage.com
krokodilius8.com
latinitjobs.com
needafishingboat.net
obellisk.com
ouroldfriends.com
rdm-gool.net
recruitarrowfg.com
slowstatus.net
superblogonline.org
thebloggin.net
trialreg.com
wapcco.net
workasite.com
work-position.net
yourtraveldiary.net