Sponsored by..

Showing posts with label Job Offer Scams. Show all posts
Showing posts with label Job Offer Scams. Show all posts

Thursday 24 April 2014

"Atlanta Consulting" fake job offer, atlantaconsulting.net / atlantaconsulting.us / atlantaconsulting.co

This fake job offer comes from a bunch of scammers passing themselves off as "Atlanta Consulting" (not to be confused with several legitimate firms of similar names)

From:     Gertrude Holden [multivariate88@afes.com]
Date:     24 April 2014 14:16
Subject:     Vacancy

Good Day!

A new advanced vacant position is available!

I am a chief personnel officer of an Australian consulting company. We deal with non-typical business solutions. Also we introduce different outsourcing solutions. Presently we have many clients in Europe. To anticipate our cooperation with them, we need to find few regional managers.
We offer a part-time employment and opportunity to advance. Also we provide free elementary training. Initial salary is 2000 euro. If our offer is interesting to you, please send your answer on our e-mail:

info @ atlantaconsulting . net   (remove spaces before sending email)

specifying your country, city of residence, contact telephone number and desired time for call. Our managers work 24 hours for you!

Best regards!
The following domains are all part of the same scam:

The WHOIS details for the domains are undoubtedly fake and are certainly not Australian:

Administrative Contact ID:                   COCO-5041
Administrative Contact Name:                 John Carpenter
Administrative Contact Address1:             831 Ridgeview Dr
Administrative Contact City:                 Frankfort
Administrative Contact State/Province:       KY
Administrative Contact Postal Code:          40601
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.6064521498
Administrative Contact Email:                jjcarp9@gmail.com

There's a flashy website with no real substance..

The sites are hosted on (EDIS GmbH, US) and the email in this case originated from in Colombia.

The so-called job is going to be money laundering, or perhaps parcel reshipping (described in the video below) or some other scam which will involve you doing something illegal. Avoid.

Sunday 2 March 2014

seekcousa.com / seekconz.com fake job offer

This job offer from seekcousa.com or seekconz.com is bogus:

Date:      1 Mar 2014 15:53:11 +0700 [03:53:11 EST]
Subject:      Offer

We are offering a shipping manager assistant position.
We are offering a distant job.

The job routine will take 2-3 hours per day and requires absolutely no investment.
You will work with big shops, suppliers, factories all around the States.
The communication line will flow between you and your personal manager, you will receive orders via email and phone,
and our trained manager will be with you while every step to help you to work out first orders and answer any questions which may appear.
The starting salary is about ~2800 USD per month + bonuses.

You will receive first salary in 30 days after you will successfully complete your first task.
When the first working month will be over you will have a right to receive salary every 2 weeks.
The bonuses are calculated on the very last working day of each month,
and paying out during a first week of the next month.

We will accept applications this week only!
To proceed to the next step we should register you in HR system so we will need a small piece of your personal information.

Please fill in the fields:

We need your personal information to create HR file only,
it will stay secure on the separate server till the moment it will be deleted (which take place every 2 days),
and only HR people will have access to it.

Please send your answer to my secured email manager@seekcousa.com
 I will reply you personally as soon as possible.

From the job description, this appears to be some sort of parcel mule scam or other criminal activity. This video explains how a parcel reshipping scam works:

seekcousa.com is regsitered with Chinese registrar BIZCN, and the WHOIS details are fake:
Registrant Name: Ernest Dubose
Registrant Organization: Ernest D. Dubose
Registrant Street: 129 Oakridge Lane
Registrant City: Irving
Registrant State/Province: TX
Registrant Postal Code: 75038
Registrant Country: us
Registrant Phone: +1.4699959821
Registrant Phone Ext:
Registrant Fax: +1.4699959821
Registrant Fax Ext:
Registrant Email: info@seekcousa.com
Registry Admin ID:

seekconz.com is also registered with BIZCN, but with different fake details:
Registrant Name: Nickolas Gordon
Registrant Organization: Nickolas R. Gordon
Registrant Street: 4930 Clarence Court
Registrant City: Ontario
Registrant State/Province: CA
Registrant Postal Code: 91762
Registrant Country: us
Registrant Phone: 909-988-6071
Registrant Phone Ext:
Registrant Fax: 909-988-6333
Registrant Fax Ext:
Registrant Email: info@seekconz.com

There is no website associated with either of these domains, but there are mail records of mx.seekconz.com and mx.seekcousa.com pointing to (Worldstream, Netherlands). Nameservers involved in the fraud are ns1.friscolakesgc.net hosted on the same IP and ns2.friscolakesgc.net hosted on (AT&T, US).

We can dig a little deeper on those nameserver records, they have fake WHOIS details as well:
Registrant Name: ROSEMARY CARPIO
Registrant Organization:
Registrant Street: 701 Collins Ave, Apt 4B
Registrant City: MIAMI BEACH
Registrant State/Province: FL
Registrant Postal Code: 33139-6203
Registrant Country: US
Registrant Phone: +1.7868777722
Registrant Phone Ext.:
Registrant Fax:
Registrant Fax Ext.:
Registrant Email: haveacupoft@gmx.us
Registry Admin ID:

These fake details also appear on a domain airnavrace.net which is used as a namserver domain for the following domains and uses the following IPs:
quarter.su (IDD Information Services, US) (Alibaba, China)

.su domains are usually bad news, and I suspect that quarter.su is up to no good. The WHOIS details for this domain don't give much detail..

domain: QUARTER.SU
nserver: ns1.aim-darts.net.
nserver: ns1.airnavrace.net.
person: Private Person
e-mail: bartels@xrbox.com
registrar: R01-REG-FID
created: 2013.12.09
paid-till: 2014.12.09
free-date: 2015.01.11
source: TCI

That domain is multihomed on a bunch of IPs: (Radore Veri Merkezi Hizmetleri, Turkey) (TCE, Iran) (William Allard / AT&T, US) (Time Warner Cable, US) (KRNIC, Korea) (Dmitry Davydenko , Kazakhstan) (Global Village Telecom, Brazil) (C&A Connect SRL, Romania)

This, it turns out is the tip of a very large iceberg of malicious domains and IPs which I will cover in the next post.

Monday 27 January 2014

"Carnival Cruise Line Australia" fake job offer

This fake job offer does NOT come from Carnival Cruise lines:

From:     Mrs Vivian Mrs Vivian carnjob80@wp.pl
Date:     27 January 2014 09:59
Subject:     JOB ID: AU/CCL/AMPM/359/14-00
Signed by:     wp.pl

Carnival Cruise Line Australia
15 Mount Street North Sydney
NSW 2060, Australia
Tel (2) 8424 88000

JOB ID: AU/CCL/AMPM/359/14-00

What is your idea of a great career? Is it a job that allows you to travel to beautiful destinations on a spectacular floating resort, being part of a multi-cultural team with co-workers from more than 120 different nationalities? Or is it a job that allows you to earn great money while you learn, grow and fulfill your dreams and career ambitions?
It’s Carnival Cruise Line policy not to discriminate against any employee or applicant for employment because of RACE, COLOR, RELIGION, SEX, NATIONAL ORIGIN, AGE, DISABILITY, MARITAL OR VETERAN STATUS.
Employment Type:               Full-Time/Part-Time
Salary:                                  USD $45,000/ USD $125,000 per annual
Preferred Language of Resume/Application: English
Type of work:            Permanent / Temporary
Status:                        All Vacancies
Job Location:              Australia
Contract Period:          6 Months, 1 Year, 2 Years and 3 Years
Visa Type:                  Three Years working permit

The management will secure a visa/working permit for any qualified applicant. VISA FEE, ACCOMMODATION & FLIGHT TICKET will be paid by the company
We have more than 320 different positions available, interested applicants should forward their RESUME/CV or application letter to Mrs Vivian Oshea via email on (carnivalcareer@globomail.comso we can forward the list of positions available and our employment application form
Note: Applicants from AMERICA, EUROPE, ASIAN, CARIBBEAN and AFRICA can apply for these vacancies.

Carnival Cruise Line Australia

Despite the appearance of Carnival's actual web sites in the email, the reply address is NOT a genuine Carnival address and is instead a free email account. The email actually originates from in Poland.

The basic idea behind this scam is to offer a job and then charge the applicant for some sort of processing fees or police check or come up with some other reason why the applicant needs to pay money. Once the money has been taken (and perhaps even the victim's passport or other personal documents stolen) then the job offer will evaporate.

More information on this type of scam can be found here and here.

Saturday 25 January 2014

"MVL Company" fake job offer

This job offer is a fake, and in reality probably involves money laundering or handling stolen goods:

From: Downard Bergstrom [downardkrjbergstrom@outlook.com]
Subject: Longmore
Date: Fri, 24 Jan 2014 18:52:49 +0000

Today our Company, MVL Company, is in need of sales representatives in United Kingdom.

Our Company deals with designer goods and branded items. We've been providing our customers with exclusive products for more than five years, and we believe that the applicant for the position must have great communication skills, motivation, desire to earn money and will to go up the ladder. All charges related to this opening are covered by the Company. Your main duties include administrative support on orders and correspondence, controlling purchase orders and expense reports.

Part-time job salary constitutes 460GBP a week.
Full-time job is up to 750GBP per week .
Plus we have bonus system for the best workers!

To apply for the vacancy or to get more details about it, please email us directly back to this email.

Hope to hear from you soon!
Best regards,
Downard Bergstrom
The spam is somewhat unusual in that it addresses me by my surname, indicating that the email data might have been stolen from a data breach (Adobe perhaps). The email originates from a freee Microsoft Outlook.com account and gives no clues as to its real origins. A look at Companies House Webcheck confirms that there is no company of this exact name, although there are several innocent companies with similar names.


Thursday 19 December 2013

"FSA needed - 1800 GBP/month" fake job offer

This job offer is a fake..

Date:     19 December 2013 14:43
Subject:      FSA needed - 1800 GBP/month

Having seen your CV that we gained from a staffing agency, we'd like to offer you a job.

We are a small independent company located in United Kingdom. The main field of our business is IT outsourcing services, including the search of clients for potential employees and matching the most ideal candidate for each company's request.

We are happy to extend this opportunity to you. This position does not require any special experience and agents are hired on part-time basis for 1 month probationary period. During which the applicants receive online training and support.

Salary during the training period will amount up to GBP 1,500 and you will be entitled to a commission of 8% on all of your operations. You will be eligible to participate in our benefit program.

Requirements: internet, phone and e-mail availability, ability to work 2-3 hours a day Monday through Friday, PC user skills.

Candidates should send their electronic application to newcareer93@gmail.com.

To expedite the communication process, please fill in the required information below:

Forename: _____________________
Country of residence:______________________
Contact phone:________________________
Preferred call time:_____________________

Thank You,

Emma Wilkinson

The email comes from an IP address in Arizona rather than the UK. It's unclear what the so-called job is, but it is likely to be money laundering or some other criminal activity. Avoid.

Tuesday 17 December 2013

Video: Parcel Reshipping Scams, Parcel Mules and Fake Job Offers

A brief presentation on how parcel reshipping scams work, and the role of parcel mules and fake job offers.

Wednesday 4 December 2013

"british-googleapps.com" (and other googleapps.com domains) job scam

This following spam email is attempting to recruit money mules:

From:     arwildcbrender@victimdomain.com
to:     arwildcbrender@victimdomain.com
date:     4 December 2013 07:49
subject:     Employment you've been searching!

Hello, We have an excellent opportunity for an apprentice applicant to join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for European citizens only,This is in view of our not having a branch office presently in Europe,
also becouse of paypal and ebay policies wich is prohibit to work directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good typing skills.
If you fit the above description and meet the requirements, please apply to this ad stating your location.

You will be processing orders from your computer. How much you earn is up to you.
The average is in the region of 750-1000 GBP per week, depending on whether you work full or part time.

Region: United Kingdom only.

If you would like more information, please contact us stating where you are located and our job reference number - 42701-759/3HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Gene@british-googleapps.com
Sample subjects include:
Employment you've been searching!
Career opportunity inside
Job ad - see details! Sent through Search engine

Other "reply-to" addresses spotted:

british-googleapps.com is registered with completely fake details and uses a mail server on (Comcast Business, US) to process mail. There are several other similar domain names being used for the same scam:


In addition to those, all these following IPs and domains are in use by the scammers either now or recently. All the domains are registered through scam-friendly Chinese registrar BIZCN to ficticious registrants.








Wednesday 13 November 2013

"Rodrigo Sawyer and Associates" fake job offer

This laughable primitive fake job offer is recruiting for money mules, package reshipping or some other scam.

From:     RSA-CAREER! [anthonykather1@gmail.com]
Reply-To:     anthonykather1@gmail.com
Date:     12 November 2013 20:43
Subject:     please read

  We Have a PT/job. we pay $250 per job and we want you to participate.
Your job is only to act as a regular customer and conduct normal business, Customer service is valuable.

If interested,send the information below after which we would send you an application form

   1. FuII N4ME :
   2. FullAdress :
   3. Stte | Cty :
   4. CodZ!p :
   5. Phones :
   6.Alternate E-mail:
   7. O.c.c.u.p.a.t.i.o.n :

Your response would be greatly appreciated.

Rodrigo sawyer and associates.
Originating IP is pro1042.server4you.de []. Avoid.

Wednesday 16 October 2013

"Atlantics Post LLC" fake job offer

A bit of Money Mule recruiting that isn't really trying very hard..
Date:      Wed, 16 Oct 2013 14:54:34 -0300 [13:54:34 EDT]
From:      Atlantics Post [misstates7@compufort.com]
Subject:      Career with Atlantics Post LLC

Atlantics Post LLC is now hiring for a Shipping Clerk. If You are young, enthusiastic person. Looking for a great job opportunity with a stable in come this job is for you.

Receive packages at workplace (out of home possition);
Transfer the packages to our business partners nationwide;
Keeping accurate records of operations and report them

- Thorough knowledge of quality improvement techniques and experience with process and service delivery improvement.
- Strong ability to analyze, organize and simplify complex processes and data.
- Exceptional attention to detail.
- Considerable experience with data reporting systems.
- Leisure business experience an asset.
- Flexible, adaptable to change, and resourceful in the face of shifting priorities and demands.

If you have any questions, you can call our toll-free number 866-652-8106.
If you are interested in this opportunity, please submit your resume by e-mail JoyDugganagg@yahoo.com or fax (904-212-0897).

Originating IP is in Argentina. Avoid.

Monday 24 June 2013

DanielMcClintic@hotmail.com fake job offer

Another staggeringly crude money mule recruitment spam, like this one. Unless you like prison food I would advise you to leave this fake offer alone.

Date:      Mon, 24 Jun 2013 22:56:39 +0900 [09:56:39 EDT]
From:      Delmar Roark
Subject:      Work in the finance department

We invite you to work in the home assistant offer.

This job takes 2-3 hours a week and requires absolutely no investment.
The essence of this work for incoming client requests in your city.
The starting income is about ~2000 Euro per month + bonuses.

You get paid your money every 2 weeks and your bonuses after finish each task!

We promis work for every person. But we accept applications this week only!
Therefore, you should send email a request right now.
And you will start earning money, starting from next week.

Please write in the request:
Your name:
Your Contact number:
Your email address:
City of residence:

Please send the request to my email DanielMcClintic@hotmail.com, and
I will contact you personally as quickly as possible.

Delmar Roark 
Originating IP is in Korea.

Saturday 22 June 2013

julia.sailor@hotmail.com fake job offer

These guys aren't really trying. The email address is julia.sailor@hotmail.com but the email is signed Claudine Nash and appears to be "from" brooksd@kormanlederer.com originating from an IP address in Brazil. The so-called "job" is going to be money laundering or some such, avoid.

Date:      Sat, 22 Jun 2013 20:47:56 -0300 [19:47:56 EDT]
From:      Claudine Nash [brooksd@kormanlederer.com]
Subject:      Regional administrotor

We offer you to work in the remote assistant offer.

This job takes 2-3 hours during the week and requires absolutely no investment.
The essence of this work for entering client requests in your city.
The starting wages is about ~2000 Euro per month + bonuses.

You get paid your money every 2 weeks and your bonuses after fulfilling each task!

We guarantee work for every man. But we accept applications this week only!
Accordingly, you should send email a request right now.
And you will start earning money, starting from next week.

Please write in the request:
Your name:
Your Contact number:
Your email address:
City of residence:

Please send the registration form to my email julia.sailor@hotmail.com, and
I will response you individually at an early date.

Claudine Nash 

Thursday 28 February 2013

usanewwork.com fake job offer

This fake job offer will be some illegal activity such as money laundering or reshipping stolen goods:

Date:      Thu, 28 Feb 2013 14:57:55 -0600
From:      andrzej.wojnarowski@[victimdomain]
Subject:      There is a vacancy of a Regional manager in USA:

If you have excellent administrative skills, working knowledge of Microsoft Office,
a keen eye for detail, well-versed in the use of social networking sites such as Twitter and Facebook,
are organized, present yourself well and are a team player with the ability to work independently,
are reliable and punctual and can understand and execute instructions are determined to work hard and succeed - we need you.

If you are interested in this job, please, send us your contact information:
Full name:

Please email us for details: Paulette@usanewwork.com
In this case the email originated from, a Mega Cable customer in Guadalajara, Mexico. The domain is registered to an address that does not exist (there is no Pratt Avenue in Tukwila):

   Sarah Shepard info@usanewwork.com
   360-860-3630 fax: 360-860-3321
   4478 Pratt Avenue
   Tukwila WA 98168

The domain was only registered two days ago on 28/2/13.

The nameservers ns1.stageportal.net and ns2.stageportal.net are shared by several other domains offering similar fake jobs:


IP addresses involved are: (OVH, France) (Big Brain Host, US) (Microglobe LLC, US)

This job offer is best avoided unless you like prison food.

For the record, these are the other registrant details.


      7538 TRADE ST.
      SAN DIEGO, CA 92121
      Phone: +1.8585668488
      Email: wondermitch@hotmail.com


   Michael B. Jackson
   Michael Jackson info@arbeitsagentura.com
   909-542-7178 fax: 909-542-7311
   3832 Gordon Street
   Pomona CA 91766


   John L. Irizarry
   John Irizarry info@stepstonede.com
   858-450-8875 fax: 858-450-8811
   4808 Hamill Avenue
   San Diego CA 92123


   Connie J. Grooms
   Connie Grooms info@europswork.com
   626-448-5229 fax: 626-448-5211
   2815 Woodstock Drive
   El Monte CA 91731


   Mamie W. Murray
   Mamie Murray info@euroconsaltinn.com
   920-245-0475 fax: 920-245-0411
   3390 Rockford Mountain Lane
   West Allis WI 53227


   Regina P. Clay
   Regina Clay info@europsconsult.com
   212-241-1581 fax: 212-241-1211
   408 Bell Street
   New York NY 10029

Wednesday 6 February 2013

inukjob.com fake job offer (also ineurojob.com and hollandsjob.com)

This fake job offer from inukjob.com involves illegal money laundering, and it also seems that the scammers want to use your identity for "correspondence" which normally means things like reshipping stolen goods and identity theft.

From: Victim
To: Victim
Date: 6 February 2013 09:16
Subject: Looking for remote assistants, paid $ 100 per hour helping other people

Good afternoon!

Is it possible for you to spare a few hours a week to the new occupation, which would increase your wages in 2-3 times, without investing a penny?  While you are looking for the trick in this offer, hundreds of your compatriots have already been reaping the benefits of working with us.
This is not a financial pyramid or marketing of any kind. It's about doing simple assignments, not exceed the limits of morals or ethics.

Your gender, age, employment do not matter - the main factors are your diligence and conscientiousness.
Lots of our employees began with a part-time employment and combined with other jobs, but two weeks later,
most of them devoted themselves to our job.

We are in all respects ready to remove all your doubts and help you to understand all details.
Position is called the "Regional Manager".

Functional duties:
- to represent the interests of foreign companies in the region (For example:  providing your address for correspondence.)
- to take control of transactions between the company and the client in your area.

For more information, please, email us attaching your CV, the country and city of residence.
It will considerably increase your chances for employment. Email: Kelsey@inukjob.com

Best Regards,
PR Manager
I've seen another variant with a reply address of Delores@inukjob.com. In all these cases, the email appears to come from the victim (here's why). Let's dig a little deeper into the domain. It turns out that it is registered by scam-friendly Chinese registrar BIZCN.COM.

The WHOIS details are fake:

   Tara Zwilling info@inukjob.com
   315-362-4562 fax: 315-362-4511
   3201 Oak Street
   Syracuse NY 13221

There is no number 3201 Oak Street in Syracuse, New York (see for yourself) and the Zip code is incorrect, it should be 13203 and not 13221.

There's no web site, mail is handled by a server at (Exetel, Germany).  The following mailservers can be found at that IP:


You can assume that all these domains are fraudulent. If we dig a little deeper at the namesevers ns1.ariparts.net (also on and ns2.ariparts.net (, Level 3, US), then we can also find the following very dodgy domains:


All these domains have fake or hidden registration details and can assume to be part of a scam. Avoid.

Update: Another version, 

Date:     7 February 2013 16:53
Subject:     You can earn an additional $ 200 per day helping your communi

I would like to take this time to welcome you to our hiring process
and give you a brief synopsis of the position's benefits and requirements.

If you are taking a career break, are on a maternity leave,
recently retired or simply looking for some part-time job, this position is for you.

Occupation: Flexible schedule 2 to 8 hours per day. We can guarantee a minimum 20 hrs/week occupation
Salary: Starting salary is 2000 GBP per month plus commission, paid every month.
Business hours: 9:00 AM to 5:00 PM, MON-FRI, 9:00 AM to 1:00 PM SAT or part time (UK time).

Region: United Kingdom.

Please note that there are no startup fees or deposits to start working for us.

To request an application form, schedule your interview and receive more information about this position
please reply to Rene@inukjob.com with your personal identification number for this position IDNO: 6376

Wednesday 23 January 2013

H Seal and Company fake job offer

H Seal is a real, legitimate firm. This email is not from H Seal, but a criminal organisation wanting to recruit people for money laundering and other unlawful activities. Originating IP is (Intermedia, US)  and the Reply-To address is john_jackson1976@yahoo.com.ph which indicates someone in the Philppines.

From:     H. Seal & Company Ltd [jonjack7745@yahoo.com.ph]
Reply-To:     john_jackson1976@yahoo.com.ph
Date:     23 January 2013 12:38
Subject:     Would you like to work online from Home/Temporarily.


Would you like to work online from Home/Temporarily.
We are glad to offer you a job position without paying for application.

 Our Company H. Seal & Company Ltd are into Insurance, Buying and Selling cars, Incidents and Accidents Insurance. with numerous customers home and abroad. We need a representative in the Asia, Japan, china, Europe, South Africa, USA, CA, and Australia. who will be in charge of all our payment from clients/customers in Asia, Europe, Canada, and Usa

Your tasks are:

 1. Receive payment from our Customers through mail: (DHL, FEDEX, UPS OR OTHER FORM OF DELEIEVERY)
 2. Cash it at your Bank
 3. Deduct 10% which will be your percentage/pay on Payment processed
 4. Forward balance after deduction of percentage/pay to any of the offices
 you will be contacted to send payment to.
 Payment is to be forwarded either by Money Gram or Western Union Money
 Transfer. A local Money transfer takes barely hours, so it will give us a possibility to get customer payment almost  immediately.

 Kindly provide us with the requested details below if you are interested.

 Full Name
 Full Address
 Bank Name

 Zip Code:

present or prev job:
Can you Check email at least twice Daily?

 You are to respond to this offer by clicking reply to this message and filling the required information where necessary.

 We await your urgent response.Thank you for your help. We look forward to working with you.
 John Jackson

Friday 18 January 2013

"A.R.T. Logistics" fake job offer

There may be various genuine companies in the world with a name similar to "A.R.T. Logistics Industrial & Trading Ltd", but this job offer does not come from a genuine company. Instead it is trying to recruit people for money laundering ("money mule") jobs and parcel reshipping scams (a way of laundering stolen goods). Note that the scammers aren't even consistent in the way they name the company.

Reply-To:     artlogisticsltd@yahoo.com.ph
Date:     18 January 2013 07:49

Export & Import Agent‚ Service Company.
46/F Tower 1, Metroplaza 223 Hing Fong Road,
Kwai Chung New Territories, Hong Kong.

A.R.T. Logistics mainly provides services to customers in Russia, Kazakhstan and Hong Kong. We provide: - Air freight - Sea freight (FCL & LCL to EU, Russia, Kazakhstan & Central Asia) - Rail freight - Road Freight (FTL & LTL to any place in Russia, Kazakhstan and Central Asia) Our company has worked in Russia, Kazakhstan & Central Asia since 2005 and has wide experience of transport such as airfreight, container and rail.

We are presently shifting our base to North America and we have collective customers in the United State & Canada but We find it difficult establishing payments modalities with this customers and we don't intend loosing our customers. We are searching for a front line representative as intermediary by establishing a medium of getting payments from this customers in Canada & America by making payments through you to us. Do contact us for more information at this e-mail:(artlogis@e-mail.ua).

Subject to your satisfaction with the front line representative offer, you will be made our foreign payment receiving officer in your region and you will deduct 10% of every transactions made through you for your services as our Financial Representative.

Yasar Feng Xu
N.B Reply to: artlogisticsltd@yahoo.com.ph

In this case, the spam originates from [mail.zsmirotice.cz]. Avoid!

Tuesday 4 December 2012

"ARK Bureau" (arkbureau.com) fake job offer

The ARK Architecture Bureau is a genuine company. This fake job offer is not from ARK Bureau, but is some sort of illegal activity such as money laundering.

Update: I didn't look closely enough at the site, I discovered that arkbureau.com is also fake, as is this email. See more below. This is still trying to recruit people for money laundering though.

From: Odette Holcomb [mailto:nbnian@esonchem.co.kr]
Sent: 03 December 2012 12:32
Subject: Help wanted.

POSITION: Customer Assistant

ARK Bureau has served hundreds of clients in the United Kingdom, Poland, France and Germany since 1998.

The firm was created by Lorinda Rogers, a young architect of Canadian origin. From its inception, ARK Bureau.s vision for design and construction was based on system approach, incorporating both building and landscape design. That philosophy has always meant the highest quality for our clients. That.s probably why ARK Bureau enjoys a strong loyalty from the past customers.

Now we have open vacancy in the U.S.: Customer Assistant

- Process payments from customers;
- Filing invoices, statements and associated documents;
- Meet and exceed performance and time management goals;
- Other duties as required.

- High communication skills;
- Strong problem solving and planning skills;
- Experienced computer & internet user.

To apply please: arkbureaumanager@nokiamail.com
An alternative version uses the email address of arkbureau_manager@nokiamail.com. The two samples that I have seen have originating IP addresses of (Comcast, US) and (NCNET, Russia).

You should give this fake company a wide berth unless you want to end up in serious trouble with law enforcement.

Update: I had originally assumed from the amateurish spam email that arkbureau.com belonged to a genuine company. However, a search of UK company records shows no such company, the domain was only registered a month ago to an address which is actually consistent with the one on the site:

Domain Name: ARKBUREAU.COM     
    Allen Hart        (arkbureau@aol.com)
    108 Broadwick Street
    London,W1F 8MT
    Tel. +44.448715283620    
 Creation Date: 16-Nov-2012 
 Expiration Date: 16-Nov-2013 

Their site is full of stock images (like the one below) which can be found in many other places, most of which appear to be in the US (where they don't have an office).

Fundamentally, the whole thing is a fake. A good-looking fake, but a fake nonetheless.

These contact details are presumably also bogus:
Int'l Customer Care: +1 646 583 0506

Our head office is located in London, UK:

108 Broadwick Street, London, W1F 8MT, UK
Phone: +44(0) 20 3290 1280
Fax: +44(0) 871 528 3620
Email: info@arkbureau.com

Since 2010 we also run a branch in Warsaw, Poland:

Pl. Pilsudskiego 3, 00-078 Warszawa, Poland
Phone: +48 22 208 4722
E-mail: info@arkbureau.com 
Well, a quick Google of "108 Broadwick Street" indicates that it probably doesn't exist. If we get down on the ground with Google Streetview we can see that Broadwick Street only goes up to number 76 which is a bank of cash machines. Also, the quoted postcode of W1F 8MT is wrong, that belongs to somewhere which is quite a walk from Broadwick Street.

Emails to info@arkbureau.com bounce, there is no such user configured on the server.

arkbureau.com itself is hosted on (HostNOC, US). There are several other sites on the same server that look dedicated to either fraud or fake pharma. I would recommend that all of these sites are avoided:


Wednesday 10 October 2012

union-trans.com employment scam

This fake job offer is for a "forwarding agent". What is a forwarding agent? Well, basically it's a parcel reshipping scam where goods bought with stolen credit cards are sent to the "agent's" home address, and then the "agent" forwards to stolen goods on to Eastern Europe or China or whatever. Of course, when the police catch on it's the "agent" who is in deep, deep trouble.

From:     alex Ford@un-trans.info
Reply-To:     alex@union-trans.com.cn
Date:     8 October 2012 14:46
Subject:     forwarder agent 2012-10-10 15:02:33


It is glad to write to you with keen hope to open a business relationship with you.

union-trans (china) International Freight Co,. Ltd is always provide the best service and good price for Import and Export both of ocean and air freight.
These services include: FCL Import and Export, LCL Consolidation, Break-Bulk; Air Freight Import and Export, Sea-Land Transportation; as well as arranging booking, clearance, inspection,loading and evanning, storage, consultation, insurance, etc, forwarding supported services.Our business has extended all over the globe, including in Middle East, Red Sea, India, Europe, and East, Africa, Central and South America, Australia and Southeast Asia etc.
For more information,Please review to our website as below:

We are looking forwarder to you reply!

Best regards

union-trans (china) International Freight Co,. Ltd
addr:Room 18B-2,East China Sea Dawn Building,Zhongshan Road 455, Ningbo Jiangdong area,Ningbo,China
directort manager:Alex Huang
Mbl:+86-0-13957424347 +86-0-15306636688
Msn:alex_huang58@hotmail.com   Email:alex@union-trans.com.cn
There appear to be several scam domains in this same email.

union-trans.com is hosted on (Simcentric, Hong Kong). The WHOIS details are:

Admin Name........... huang yijiang
  Admin Address........ Ningbo
  Admin Address........
  Admin Address........ Ningbo
  Admin Address........ 200000
  Admin Address........ ZJ
  Admin Address........ CN
  Admin Email.......... sunpt@qq.com
  Admin Phone.......... +86.13957424347
  Admin Fax............ +86.13957424347

un-trans.info is parked on, and is registered to another owner:

Registrant ID:CR117221338
Registrant Name:yijiang huang
Registrant Organization:
Registrant Street1:baizhangdongli 168
Registrant Street2:
Registrant Street3:
Registrant City:ningbo
Registrant State/Province:zhejiang
Registrant Postal Code:315100
Registrant Country:CN
Registrant Phone:+86.057481088611
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:hyjbbs@163.com

union-trans.com.cn seems to be just a mail handler:
Domain Name: union-trans.com.cn
ROID: 20120401s10011s18721153-cn
Domain Status: ok
Registrant ID: ctr4rtfs2aq58an
Registrant: 宁波瀚联国际货运代理有限公司
Registrant Contact Email: hyjbbs@163.com
Sponsoring Registrar: 北京新网互联科技有限公司
Name Server: ns1.dns.com.cn
Name Server: ns2.dns.com.cn
Registration Date: 2012-04-01 12:05:06
Expiration Date: 2019-04-01 12:05:06
DNSSEC: unsigned

uni-transglobal.info is an intermediary mail system using an expired domain name:
Registrant ID:CR75845753
Registrant Name:yijiang huang
Registrant Organization:
Registrant Street1:baizhangdongli 168
Registrant Street2:
Registrant Street3:
Registrant City:ningbo
Registrant State/Province:zhejiang
Registrant Postal Code:315100
Registrant Country:CN
Registrant Phone:+57.481088611
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:hyjbbs@163.com

Originating IP is (Zhejiang Telecom, Ningbo, China).

The subscribe/unsubscribe links in the email also reference these addresses: hyjbbs@gmail.com
and cncxrdy001@gmail.com

Generally speaking, unsolicited job offers from out-of-the-way places are bad news and should be avoided..

Friday 10 August 2012

Fake job domains 10/8/12

A bit of an oddity here - I noticed a marked uptick in people searching for very old fake job domains that had expired. It turns out that the scammers are back (probably the Lapatasker crew), and lazily they have just re-registered their old domains. Current ones doing that rounds that you should avoid are:


Tuesday 3 July 2012

Fake jobs: careerin-finance.com

This email is trying to recruit people for money laundering ("money mule") operations and other similar illegal activities:

From: [victim]
Date: 2 July 2012 20:48:51 GMT+01:00
To: [victim]
Subject: Recruitment in the large company
We have an excellent opportunity for an apprentice applicant to join a rapidly expanding company.

An at home Key Account Manager Position (Ref: 58020-095/1HR) is a great opportunity for stay at home parents or anyone who wants to work in the comfort of their own home.

This is a genuine offer and not to be confused with scams!
The successful candidate must have the ability to handle calls efficiently whilst maintaining the highest levels of customer service and being courteous.
Applicants must have an excellent telephone manner, have a friendly approach, excellent communication skills and be computer literate.
You must have the ability to type and talk at the same time to customers,
as you will be taking customer details over the phone and inputting data onto company database.

Requirements: computer with Internet access, valid email address, good typing skills.
If you fit the above description and meet the requirements, please apply to this ad stating your location.

You will be processing orders from your computer. How much you earn is up to you.
The average is in the region of US$600- US$750.00 per week, depending on whether you work full or part time.

If you would like more information, please contact us stating where you are located and our job reference number - 58020-095/1HR.
Please only SERIOUS applicants.

Our contacts: Olin@careerin-finance.com

Thank You!

The email may appear to come from the recipient (see "why am I sending myself spam?". The domain careerin-finance.com was registered on 2nd July 2012 and solicits replies via a server at (Prometeus, Italy).

Registrant details for the domain are no doubt fake:
   Helen R. Espinoza
   Helen Espinoza info@careerin-finance.com
   413-845-0684 fax: 413-845-0331
   3093 Trouser Leg Road
   Springfield MA 01103

The domain is registered through scam-friendly Chinese registrar BIZCN.COM, Inc.

Nameservers are:
ns1.readycarts.com (
ns2.readycarts.com (

The is registered to Barnes and Noble in the US. Is there a compromised server here? It's hard to be certain.

The following IPs and domains all seem to be connected:

Friday 15 June 2012

rzmanagement.ru / "Rock Zone Management" fake job offer

Another fake job offer in this long running scam:

Date:      Fri, 15 Jun 2012 23:17:59 +0900
Subject:      Job Application Pending

Hello xxxxxxxxx

Thank you for submitting your information for potential employment opportunities.
We look forward to reviewing your application,
but can not do so until you complete our internal application.

Prior to begin able to be considered, you will first need you to formally apply.
Please go here to begin the process:


Also, the following perks are potentially available:

- Paid Time Off
- Health Benefits Package
- Higher than average salaries
- Tuition Reimbursement
- Extensive 401(k)program

Please take the time to follow the directions and complete the entire application process.

There is no job on offer, the idea of the spam is to get you to sign up for a credit check and some get-rich-quick schemes.

rzmanagement.ru is hosted on (Voejkova Nadezhda, Ukraine) which hosts several other scam sites. You might want to consider blocking access to if these are bothering you.