Fake job domains 10/8/12

A bit of an oddity here - I noticed a marked uptick in people searching for very old fake job domains that had expired. It turns out that the scammers are back (probably the Lapatasker crew), and lazily they have just re-registered their old domains. Current ones doing that rounds that you should avoid are:

americafindjob.com
arbetase.com
career-depart.com
careerin-finance.com
espanajob.com
eurojobbnet.com
eurojobcouk.com
eurojobscouk.com
europ-consult.com
jobbankinusa.com
readycarts.com
top10jobbs.com
ukitcareer.com
usaitcareers.com

Fake jobs: euro@ultraups.com

The "Lapatasker" money mule recruiters have been fairly quiet for a while, but here is a new one:

From:  Barrmanager@pacbell.net maurogonzal22@gmail.com
Date: 28 January 2012 01:39
Subject: Parttime Job

Compliments

I am the personnel department manager and I am appealing to you in the name of the large-scale and first-rate partnership.

Our company is met in many departments, such as:
- property
- bank account operations
- transportation and logistics
- private enterprise service
- etc.

We need a person to fill the vacancy of a regional manager in Europe:
- salary 2.600 euro + bonus
- 2 - 3 working hours per day
- individual time-table


If our offer is interesting for you email us the required information:
e u r o @ u l t r a u p s . c o m (Please Delete Spaces In Email Address Before Mailing Us)
Full name:
Country:
City
E-mail:
Contact phone number:



Attention! We need just the people residing in EU.

Please, write your Telephone Number and our manager will contact with you and answer all your questions. 

The "jobs" offered are illegal activities such as money laundering, so signing up to them could land you in serious trouble with law enforcement and seriously out of pocket.

The domain was registered a while ago, probably with fake registrant details:
    Alexis Putt
    Email: alexisputt@yahoo.co.uk
    Organization: Alexis Putt
    Address: St Katharine's Way 12
    City: London
    State: London
    ZIP: E1W 1DD
    Country: GB
    Phone: +44.0113343341

If you have any more example emails, please consider sharing them in the comments.

Fake jobs: working-ca.com

Another fake job domain, working-ca.com seems to be part of this long-running scam. I hadn't spotted this one before, so thanks to our reader who sent it in. Note that this is not connected with the legitimate site WorkingCA.com . The jobs offered are actually illegal activities such as money laundering.

Hello, We have an excellent opportunity for an apprentice applicant to
join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay
at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for Canadians only,This is in
view of our not having a branch office presently in Canada,
also becouse of paypal and ebay policies wich is prohibit to work
directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good
typing skills.
If you fit the above description and meet the requirements, please apply
to this ad stating your location.

You will be processing orders from your computer. How much you earn is
up to you.
The average is in the region of CA$750- CA$1000 per week, depending on
whether you work full or part time.

Region: Canada only.

If you would like more information, please contact us stating where you
are located and our job reference number - 70570-868/4HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Weldon@working-ca.com

and

Hello, We have an excellent opportunity for an apprentice applicant to
join a rapidly expanding company.

An at home Key Account Manager Position is a great opportunity for stay
at home parents
or anyone who wants to work in the comfort of their own home.

This is a part time job / flexible hrs for Canadians only,This is in
view of our not having a branch office presently in Canada,
also becouse of paypal and ebay policies wich is prohibit to work
directly with residents of some countries.

Requirements: computer with Internet access, valid email address, good
typing skills.
If you fit the above description and meet the requirements, please apply
to this ad stating your location.

You will be processing orders from your computer. How much you earn is
up to you.
The average is in the region of CA$750- CA$1000 per week, depending on
whether you work full or part time.

Region: Canada only.

If you would like more information, please contact us stating where you
are located and our job reference number - 35097-781/2HR.
Please only SERIOUS applicants.

If you are interested, please reply to: Tristan@working-ca.com

The registrant details for the domain are probably fake, but here they are anyway:

Kevin Tesalo
    Email: kevintesalo@yahoo.fr
    Organization: Kevin Tesalo
    Address: 2 avenue des Beguines
    City: Cergy Saint Christophe
    State: Cergy Saint Christophe
    ZIP: 95811
    Country: FR
    Phone: +33.124335612 

Fake jobs: europcareers.net

One more fake job domain to avoid, europcareers.net follows on from the ones spotted yesterday and uses the fake (probably fake) registration address:

frederic benou
    Email: fredericabenou@yahoo.fr
    Organization: frederic benou
    Address: 23 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94112
    Country: FR
    Phone: +33.0148931456 

The emails may appear to come from yourself (here's why). The jobs offered are actually criminal activities such as money laundering. If you have any example emails, please consider sharing them in the Comments.

Fake jobs: jobsearchoo.com, newstatejob.com and usanewjobgov.com

Three more domains being used to recruit money laundering jobs and other illegal activities:

jobsearchoo.com
newstatejob.com
usanewjobgov.com


The jobs form part of this long running scam.Email messages may appear to come from yourself (here's why). The domain is registered to the following (probably fake) address:

    frederic benou
    Email: fredericabenou@yahoo.fr
    Organization: frederic benou
    Address: 23 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94112
    Country: FR
    Phone: +33.0148931456 

If you have any examples of emails using these domains, then please consider sharing them in the Comments. Thanks!

Fake jobs: expoeurojob.com, newjobsineurope.com and thenewjobbs.com

Three new domains offering jobs which will actually turn out to be money laundering or reshipping stolen goods. This scam has been going on for years.

expoeurojob.com
newjobsineurope.com
thenewjobbs.com

The emails may appear to come "from" your own email address (here's why). The (probably fake) registrant details for this domain are:

    Francisco Getz
    Email: franciscogetz@yahoo.fr
    Organization: Francisco Getz
    Address: 43 rue Mazarine
    City: Paris
    State: Paris
    ZIP: 75002
    Country: FR
    Phone: +33.191282216

If you have any samples of spam using these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: jobbslists.com, jobbsearcher.com, gbjobb.com and greecejobb.com

Yet more fake job offers, following on from this long-running scam. This time the following domains are in use to solicit replies:

jobbslists.com
jobbsearcher.com
gbjobb.com
greecejobb.com

The spam emails adveritising these may appear to come from your own email account (here's why). The "jobs" on offer are actually illegal activities such as money laundering.

For the record, the registrant details for those domains (which are almost definitely fake) are:

    Lorian Kern
    Email: loorjaan@yahoo.dk
    Organization: Lorian Kern
    Address: Sonderskovvej 22
    City: Lystrup
    State: Lystrup
    ZIP: 8124
    Country: DK
    Phone: +45.83743412 

If you have any example emails, please consider sharing them in the Comments. Thanks!

mailukrsoft.com: job scammers in action

A post over at woozoo.nl caught my eye (in Nederlands, Google Translated to English) about the netherlandjobb.com scam. Robert Krom goes several steps further than I usually do with a good investigation into how the scammers try to rope people in.

Robert identifies mailukrsoft.com  as the next stage in the scam. To me, it looks like it is run by a different crew, but scammers tend to oursource activities to others these days. It appears that one group of scammers may be looking for money mules and then selling them on to others.

Fake jobs: jobbworld.com and yourjobb.com

Two new domains being used to recruit for fake jobs, which actually turn out to be illegal activities such as money laundering.

jobbworld.com
yourjobb.com

This is part of a long-running scam that has been going on for ages. One characteristic of the spam received is that it appears to come from your own email address (here's why).

If you have any examples of spam using these domains for reply addresses, please consider sharing them in the Comments.

Here is one sample:

Date: 24 October 2011 20:15
Subject: Deeltijdarbeid
   
Ik wil uw aandacht brengen en u te informeren dat Consulting Bedrijf beginnen  proces te inhuren en geven u een
grote kans om carrière te beginnen  nu met veel voordelen en de voordelen van dit werek.

Als u besloten om onderbreking in uw carrière te maken, of u op een moederschapsverlof bent,
onlangs gepensioneerde of gewoon op zoek naar enkele aanvullende tijdelijk baan, dit standpunt is enkel voor u gemaakt.

Werkende uuren: Flexibele tijdschema van van 1 tot 3 uur per dag. We garanderen ongeveer 20 uur een week bezetting.
Salaris en voordelen: begin salaris is variërend van 2000 tot 2500 euro per maand,
vermeerderd met extra commissie als u alle taken nauwkeurig vervullen.

Regio: Europese Unie.

Houd er rekening mee dat er geen betalingen of elke andere trucs om te gaan werken voor ons zijn.

Indien geïnteresseerd en wil u verzoeken een aanvraagformulier toepassen voor deze positie,
uw interview plannen en of gewoon meer informatie ontvangen over deze positie voordat u toepast,
kunt u antwoord op deze e-mail en stuur ons uw contact informatie.

In het onderwerp van e-mail Geef uw persoonlijk identificatienummer voor deze positie IDNO: 04459

Als u geïnteresseerd bent, kunt u reageren op: Damion@yourjobb.com,bedank!

And another one that seems to drift between Dutch and Czech for a while..

Subject: Vacature
   
Ik wil uw aandacht brengen en u te informeren dat Consulting Bedrijf beginnen  proces te inhuren en geven u een
grote kans om carričre te beginnen  nu met veel voordelen en de voordelen van dit werek.

Als u besloten om onderbreking in uw carričre te maken, of u op een moederschapsverlof bent,
onlangs gepensioneerde of gewoon op zoek naar enkele aanvullende tijdelijk baan, dit standpunt is enkel voor u gemaakt.

Werkende uuren: Flexibele tijdschema van van 1 tot 3 uur per dag. We garanderen ongeveer 20 uur een week bezetting.
Salaris en voordelen: begin salaris is variërend van 2000 tot 2500 euro per maand,
vermeerderd met extra commissie als u alle taken nauwkeurig vervullen.

Regio: Europese Unie.

Houd er rekening mee dat er geen betalingen of elke andere trucs om te gaan werken voor ons zijn.

Indien geďnteresseerd en wil u verzoeken een aanvraagformulier toepassen voor deze positie,
uw interview plannen en of gewoon meer informatie ontvangen over deze positie voordat u toepast,
kunt u antwoord op deze e-mail en stuur ons uw contact informatie.

In het onderwerp van e-mail Geef uw persoonlijk identificatienummer voor deze positie IDNO: 64594

Als u geďnteresseerd bent, kunt u reageren op: Fidel@yourjobb.com,bedank!

Fake jobs: canada-newjob.com, netherlandjobb.com and newjobrecruit.com

Another bunch of domains being used to peddle fake jobs:

canada-newjob.com
netherlandjobb.com
newjobrecruit.com

These domains form part of this long running scam. You may find that the emails appear to come from your own email address (here's why).

The domain registrant details are no doubt fake:

    Adolf Nureng
    Email: adolfnureng@yahoo.dk
    Organization: Adolf Nureng
    Address: Spellingevej 3 Ro
    City: Gudhjem
    State: Gudhjem
    ZIP: 3703
    Country: DK
    Phone: +45.70225632

The jobs offered will actually be criminal activities such as money laundering. If you have any examples of emails using these domains, please consider sharing them in the Comments. Thanks!

Here is one example:

Date: 20 October 2011 13:17
Subject: Huidige vacature

Wij werven aan!

Wij bieden part-time of full-time posities in de EU.
Momenteel is onze team van specialisten is het ontwikkelen van vooruitstrevende en innovatieve
manier van samenwerking met onze klant dus breiden we ons netwerk van vertegenwoordigers in heel Europa.

Wij bieden volledig betaalde trainingen om u te begeleiden door uw werk, competitief salaris,
vrij werk schema en andere voordelen die uw samenwerking met ons zeer aangenaam.
Wilt u bij ons bedrijf te sluiten, moet u ervoor zorgen dat u houdt de Europese verblijf
en je bezit een sterk verlangen om te werken.

Als je eenmaal hebt besloten om ons aan te sluiten, gelieve ons dan uw contactgegevens
en wij nemen zo spoedig contact met u op om een interview te plannen.

Onze contactgegevens: Rolland@netherlandjobb.com

Hartelijk dank voor uw interesse!

In this case, the email originated from 178.172.136.117 in Belarus.

Fake jobs: it-jobsearch.com

Another fake job domain, it-jobsearch.com follows on directly from these two reported yesterday. The domain is registered to the same fake address in France as yesterday.

As usual, the email soliciting replies to this domain is trying to recruit people for money laundering. The email may appear to come from your own email address (here's why).

If you have example emails soliciting replies to this domain, please consider sharing them in the Comments. Thanks!

Fake jobs: new-jobaccess.com and simple-jobneed.com

Two new fake job domains, forming part of the long-running "Lapatasker" scam.

new-jobaccess.com
simple-jobneed.com

Emails from these domains may appear to be from your own email address (here's why). They are registered to a no-doubt fake registrant:

Luc Metteran
    Email: lucmetteran@yahoo.fr
    Organization: Luc Metteran
    Address: 6, avenue Kennedy
    City: Paris
    State: Paris
    ZIP: 17880
    Country: FR
    Phone: +33.0156402315 

The "jobs" on offer are illegal activities such as money laundering. If you have any examples of spam using these domains to solicit replies, please consider sharing them in the Comments. Thanks!

Fake jobs: all-cajobs.com, all-ukjobs.com and alleur-positions.com

Here we go again.. three new domains that form part of this long-running scam.

all-cajobs.coma
all-ukjobs.com
alleur-positions.com

The "jobs" offered are actually illegal activities such as money laundering. You may note that the email appears to come from yourself (here's why).

The domains are registered to a no-doubt fake registrant:

    Hose Sanches
    Email: hosesancges@yahoo.com
    Organization: Hose Sanches
    Address: Campo Grande, 83 1749-812
    City: Lisboa
    State: Lisboa
    ZIP: 1749-812
    Country: PT
    Phone: +35.1217982140

If you have any examples of emails soliciting replies to these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: firstjob-market.com, tech-newposition.com and ukjob-market.com

Three new fake job domains today, apparently forming part of this long running scam.

firstjob-market.com
tech-newposition.com
ukjob-market.com

Emails send soliciting replies to these domains may appear to come from your own email address (here's why). The so-called jobs being offered are actually criminal activities such as money laundering.

The no-doubt-fake registrant details are:

    Lucia Geleca
    Email: lucpolema@yahoo.fr
    Organization: Lucia Geleca
    Address: 12 rue des Camelias
    City: Alfortville
    State: Alfortville
    ZIP: 94141
    Country: FR
    Phone: +33.0148934367

Although the address is genuine, it almost definitely bogus.

If you have any examples of spam emails "from" these domains, please consider sharing them in the Comments. Thanks!

Fake jobs: hire-position.com and work-position.net

Two new fake job domains with a twist, possibly the same scammers who are behind this long-running spam/scam campaign.

hire-position.com
work-position.net

Domains were registered just yesterday via a Russian registrar to an address in Spain which is most likely fake:

    Ivan Gonsalez
    Email: ivan4gonzalez@yahoo.es
    Organization: Ivan Gonsalez
    Address: P. de Extremadura 151
    City: Madrid
    State: Madrid
    ZIP: 28011
    Country: ES
    Phone: +34.914641145 

This rabbit hole goes a bit deeper than usual, because the ivan4gonzalez@yahoo.es email address has been used before, for the domain girsland.ru

domain: GIRSLAND.RU

nserver: ns1.strategy-recruiting.org.

nserver: ns2.strategy-recruiting.org.

state: REGISTERED, DELEGATED, UNVERIFIED

person: Private Person

e-mail: ivan4gonzalez@yahoo.es

registrar: REGTIME-REG-RIPN

created: 2011.07.26

paid-till: 2012.07.26

source: TCI

Girsland.ru has a reputation for being spammy and it looks like a typical romance scam site. As with hire-position.com and work-position.net, it's odd that a Spanish address is being used for domains that are either Russian TLD or are being registered through a Russian registrar.

Girsland.ru is hosted on 173.234.8.215 at Ubiquity Server Solutions Atlanta, although it looks like the IP block might be rented out to a company called Nobis Technology Group LLC in Arizona.There are some nasty things going on in that IP neighbourhood according to SiteVet.

What else can we find on 173.234.8.215? It turns out that there's a rich vein of nastiness here.

actionfg.com - "Action Financial. All of your financial services in one place."
Chinese registrar, fake WHOIS details. Fake check scam. [1] [2]

Michael L. Walter

Michael Walter MichaelLWalter@teleworm.com

314-849-7082 fax: 314-849-7011

2523 Ash Avenue

Saint Louis MO 63126

us

NS: ns1.wapcco.net and ns2.wapcco.net

adena-job.com.
Chinese registrar, fake WHOIS details. Fake job offers. [3]

Name: Ana Bates

Organization: Ana N. Bates

Address: 789 Pinchelone Street

City: Herndon

Province/state: VA

Country: us

Postal Code: 22090

Email: AnaNBates@ymail.com

NS: ns1.needafishingboat.net and ns2.needafishingboat.net

adenafinance.com - "Adena Finance. All of your financial services in one place."
Chinese registrar, fake WHOIS details.

Eric M. Dillinger

Eric Dillinger EricMDillinger@gmail.com

+1.5305125808 fax: +1.5305125808

1467 Hill Croft Farm Road

Sacramento CA 95814

us

NS: ns1.needafishingboat.net and ns2.needafishingboat.net

arrowfg.com - "Arrow Financial Group"
Chinese registrar, fake WHOIS details. Money mule scam [4] [5]

William K. Breen

William Breen WilliamKBreen@teleworm.com

606-542-3946 fax: 606-542-3922

62 Meadowcrest Lane

Flat Lick KY 40982

us

NS: ns1.careerhiring-solutions.org and ns2.careerhiring-solutions.org

freeblogpro.org - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution. [6] [7]

Registrant ID:TOD-42629838

Registrant Name:Gertrude Mcmillan

Registrant Organization:Gertrude D. Mcmillan

Registrant Street1:250 Reynolds Alley

Registrant Street2:

Registrant Street3:

Registrant City:Long Beach

Registrant State/Province:CA

Registrant Postal Code:90808

Registrant Country:US

Registrant Phone:+1.5623772946

Registrant Phone Ext.:

Registrant FAX:+1.5623772946

Registrant FAX Ext.:

Registrant Email:GertrudeDMcmillan@gmail.com

NS: NS1.SLOWSTATUS.NET and NS2.SLOWSTATUS.NET

krokodilius8.com
Chinese registrar, fake WHOIS details. Malware distribution. [8]

Richard J. Aguilar

Richard Aguilar RichardJAguilar@gmail.com

+1.2523933705 fax: +1.2523933705

3458 Green Acres Road

Swansboro NC 28584

us

NS: ns1.barcellons.com and ns2.barcellons.com

rdm-gool.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Probably malware distribution.

Lincoln P. Miller

Lincoln Miller LincolnPMiller@gmail.com

+1.4156774378 fax: +1.4156774378

813 Boring Lane

San Francisco CA 94108

us

NS: ns1.slowstatus.net and ns2.slowstatus.net

recruitarrowfg.com
Chinese registrar, fake WHOIS details. Fake job offers [9] [10]

Name: Fletcher Leach

Organization: Fletcher C. Leach

Address: 180 Deer Ridge Drive

City: Millburn

Province/state: NJ

Country: us

Postal Code: 07041

Email: FletcherCLeach@aol.com

NS: ns1.careerhiring-solutions.org and ns2.careerhiring-solutions.org

superblogonline.org - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [11] [12]

Registrant ID:TOD-42637428

Registrant Name:Ernest Thomas

Registrant Organization:Ernest R. Thomas

Registrant Street1:228 Riverside Drive

Registrant Street2:

Registrant Street3:

Registrant City:Athens

Registrant State/Province:GA

Registrant Postal Code:30606

Registrant Country:US

Registrant Phone:+1.7068186834

Registrant Phone Ext.:

Registrant FAX:+1.7068186834

Registrant FAX Ext.:

Registrant Email:ErnestRThomas@aol.com

NS: NS1.SLOWSTATUS.NET and NS2.SLOWSTATUS.NET

thebloggin.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [13] [14]

Justin R. Martinez

Justin Martinez JustinRMartinez@aol.com

+1.3235224026 fax: +1.3235224026

2898 Evergreen Lane

Pomona CA 91766

us

NS: ns1.slowstatus.net and ns2.slowstatus.net

yourtraveldiary.net - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [15]

Name: Paula Huerta

Organization: Paula A. Huerta

Address: 3993 Payne Street

City: Hillsville

Province/state: VA

Country: us

Postal Code: 24343

Email: PaulaAHuerta@gmail.com

NS: ns1.slowstatus.net and ns2.slowstatus.net

Querying the namesevers reveals some more domains that look worth blocking as well. In total, blocking the following related domains will probably be a very good thing to do.

actionfg.com
adenafinance.com
adena-job.com
admnxm.com
adxreport.com
arrowfg.com
barcellons.com
betononasos228.net
careerhiring-solutions.org
club-bork.com
computer-giga.net
com-watch-id2181222ooo.info
dramchinatea.net
estatediary.com
findepotdirect.com
finwizonline.com
forfreeblog.net
freebloghub.com
freeblogpro.org
freetrialmail.com
friendsadirect.com
fun-bork.com
generalcreate.net
girsland.ru
hire-position.com
hostfrontpage.com
krokodilius8.com
latinitjobs.com
needafishingboat.net
obellisk.com
ouroldfriends.com
rdm-gool.net
recruitarrowfg.com
slowstatus.net
superblogonline.org
thebloggin.net
trialreg.com
wapcco.net
workasite.com
work-position.net
yourtraveldiary.net

Fake jobs: totaljob-us.com

Another fake job offer, part of this long-running series of spam/scam emails.

From: Spam Victim
Sent: 21 September 2011 20:18
To: Spam Victim
Subject: Current Vacancy

Urgente!

Solicitamos personal de cofianza para trabajo a largo plazo en la seccion financiera.

Estudiantes, amas de casa etc...

tambien pueden conseguir trabajo en la empresa, el trabajo no toma mucho tiempo, requiere de mucha responsabilidad.

No es marqueting! Ni nada parecido.

Trabajamos con mas de 10 paises del mundo para hacer nuestras transferencias.

La empresa se dedica a hacer transferencias de dinero local y internacional.

Sus datos personales favor enviar al correo electronico: Ana@totaljob-us.com

Deje su telefono movil para que nuestro operador se contacte con usted.

En espera de sus curriculums,  Ana Sykes

The email appears to come "from" the spam victim (here's why). The domain was registered just yesterday to an "Alexey Kernel" at a fake address in the Ukraine.

Some other "reply to" addresses are:
Casandro@totaljob-us.com
Gad@totaljob-us.com
Prospero@totaljob-us.com
Martirio@totaljob-us.com
Guy@totaljob-us.com
Melvis@totaljob-us.com
Muneca@totaljob-us.com

Subjects include "Current Vacancy", "Job Offer - Flexible Hours", "Get a New Job Today", "Current Open Position", "Administrative Assistant Vacancy" and "Employment Opportunity". Oddly, the subject is in English even though the body of the message is in Spanish.

The jobs offered will be money laundering and other illegal activities. If you have any samples that are different, please consider sharing them in the Comments. Thanks!

Fake jobs: careers-consult.com, europe-career.com and usa-newcareer.com

Three new domains used to adveritise bogus jobs (which will actually be money laundering or other criminal activities)

careers-consult.com
europe-career.com
usa-newcareer.com

The approach is the same as the domains registered two days ago, and indeed this has been going on for several years. The spam may appear to come from your own email address (here's why).

If you have any sample emails using this domain to solicit replies, please consider sharing them in the Comments. Thanks!

Fake jobs: ca-jobcareer.com, uk-jobcareer.com and usa-jobcareer.com

Three new domains offering fake jobs, targeting US, UK and Canadian victims:

ca-jobcareer.com
uk-jobcareer.com
usa-jobcareer.com

The "jobs" on offer are typically money laundering and other illegal activities, and form part of this long running scam. The emails may appear to have been sent from your own account (here's why).

The domains were registered two days ago to "Alexey Kernel" in Kiev, although this is probably a fake name and address.

If you have samples of spam emails using these domains, please consider sharing them in the comments. Thanks!

Fake jobs: allworld-career.com, greece-newcareer.com, new-joboffers.com and worldjob-career.com

Four new domains offering a variety of fake and illegal jobs, part of a very long running series of scam emails.

allworld-career.com
greece-newcareer.com
new-joboffers.com
worldjob-career.com

These fake domains have been set up to solicit replies to bogus job offers, including money laundering and other illegal activities. The emails may appear to have been sent from your own account, but this is a simple forgery and does not mean that your email account has been compromised.

The registrant details are no doubt fake:

    Alexey Kernel
    Email: johnkernel26@yahoo.co.uk
    Organization: Alexey Kernel
    Address: Kreshchatyk Street 34
    City: Kiev
    State: Kiev
    ZIP: 01090
    Country: UA
    Phone: +38.00442794512 

All these domains have been registered in the past couple of days.

If you have a sample spam with one of these in, please consider sharing it in the Comments. Thanks!

Fake jobs: usa-newcareers.com

usa-newcareers.com is another domain being used for offer fake jobs (usually criminal activities such as money laundering). Is is part of this long running scam and is essentially just a variant of us-newcareer.com registered a few days ago. The domain was registered yesterday to a presumably fake registrant.

One feature of these scam emails is that they appear to come from yourself, this is just a simple forgery and it does not mean that your mail account has been compromised. If you have any examples of spam using this domain, please consider sharing it in the comments.