Sponsored by..

Showing posts with label Lapatasker. Show all posts
Showing posts with label Lapatasker. Show all posts

Monday, 1 November 2010

europa-consult.com job offer scam

Another scam email in a long-running series of fake job offers, this time using the domain europa-consult.com (not to be confused with any companies of a similar name).

for CV #19


EXPANDING COMPANY LOOKING FOR SALES SUPPORT/ADMINISTRATIVE ASSISTANT TO HELP US! FULL IN HOUSE PRODUCT TRAINING IS PROVIDED!

COMPETITIVE INDIVIDUALS.....START ASAP!

Who are we:
We are an international leading property investment and development company.
Our firm has recently acquired new clients and are continuing to expand to new locations across the US.
We are inlolved in a variety of activities that include construction, realty management, investment sector,
rental services etc. Right now we are working on more than 10 objects around the world, primarily in Europe, United Kingdom and North America.

Our Mission:
If you have an oustanding experience in sales and administration, we would welcome you immediately!
If you don't have a formal qualification but have gained skills and knowledge through experience - apply today!
We also equip new grads or candidates with no experience with the experience they need to build a successful business in the field of sales,
advertising, or marketing. Many high school grads or college & university students hear employers tell them they need more experience.

WE ARE LOOKING TO GIVE YOU THAT EXPERIENCE!

What you'll be doing: You will conduct comprehensive residential and/or small commercial property audits.

Other duties of the Administrative Assistant/Sales Support include, but are not limited to:
Incorporating effective priorities for the virtual office function
Administer day-to-day financial responsibilities for our clients
Reporting online daily
Preparing brief summary reports, and weekly financial reports

What's in it for you: - Excellent Pay (guaranteed Euro 725/weekly) - Great Opportunity
All compensation/salary is paid biweekly. Compensation involves uncapped earnings and bonuses.

If you are interested, please reply to : info@europa-consult.com with your latest CV.

Best regards,

Claire Haynes
Hiring Manager

The WHOIS details look very familiar:

Registrant:
    Aleksandr Lapatau
    Email: lapatasker@earthling.net
    Organization: Private person
    Address: Lenina, 34, 8
    City: Minsk
    State: Minskaya
    ZIP: 456123
    Country: BY
    Phone: +375.172427204 



Avoid.

Sunday, 24 October 2010

"america-newresume.com" scam

This scam has been around for a while, strangely it spells out "NB" in the full Latin of "Nota Bene". You don't see an awful lot of Latin in spam these days. Anyway, this is a fake job offer, most likely in money laundering or receiving stolen goods. Avoid

Re: CV 69


I’m addressing you on behalf of the HR department of a large company.

Our company takes an active part in the life of its subsidiaries, for example:
-property
- bank account operations
- transportation and logistics
- private enterprise service
- etc.

We have vacancies to be filled by Europe residents only:
- salary 2.600 euro + bonus
- underemployment
- flextime


If you are ready to work as a regional manager in Europe send us the below information: Dominick@america-newresume.com
First Name:
Last name:
Country of living:
City
E-mail:
Phone:



Nota bene! Only European residents are required !

Please provide us with your Personal data (Phone number and First and Last name) and our manager will contact to you to make a brief interview.

Friday, 22 October 2010

eu-ltk.com fake job offer

Another fake job offer (probably following on from this one), probably involving money laundering and other criminal support services.

Date: 22 October 2010 11:06
Subject: Civilities
   
This message was likely forged and did not originate from your account. Learn More
Greetings

I introduce a large multinational enterprise the co-worker of the HR department of which I am.

Our company takes an active part in the life of its subsidiaries, for example:
- real estate
- companies setting-up and winding-up
- bank accounts opening and maintenance
- logistics
- private undertaking services
- etc.

There are vacant positions of regional managers in Europe:
- salary 2.300 euro + bonus
- 2 - 3 working hours per day
- optimal timetable

If you are interested in this job, please, send us your contact information: Sam@eu-ltk.com
First Name:
Last name:
Country of living:
City
E-mail:
Phone:



We are looking for the people who have a right to work in Europe!

Please provide you name and contact information in order we can find you for further communication.

WHOIS details for the domain show the infamous info@JuliaNewYork76.com as the registrant.


Domain name: eu-ltk.com

Name servers:
    ns1.nameself.com
    ns2.nameself.com

Registrar: Regtime Ltd.
Creation date: 2010-10-19
Expiration date: 2011-10-19
Status: active

Registrant:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Administrative Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Technical Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Billing Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756 

Friday, 8 October 2010

position-nl.com fake job offer

A retread of this fake job offer, this time using the domains position-nl.com to solicit replies (there's also a position-gb.com and probably many other variants). Despite the claims, this job is most likely laundering stolen money and could lead to a criminal record.

Date: 8 October 2010 13:58
Subject: for CV #32
   
Building & Investment Company is pleased to offer you an excellent-paid
part-time vacancy for the position of Administrative Assistant(Representative).
You would work from the comfort of your home office or in our office, it would depend on your choice.

Our company is a large corporation that is building involved in a variety of activities
that include construction, realty management, investment sector, rental services etc.
Right now we are working on more than 10 objects around the world, primarily in Europe, United Kingdom and North America.
This is the ideal role for a highly organized and proactive administrator, looking to develop their career
with an established and successful company.
For the right candidate, there will be the opportunity to progress to Administrative Assistant(Representative).

Candidates for the job should possess excellent organizational skills as well as the ability to efficiently multi-task.
Ideal candidates have a strong focus on day-to-day operational excellence,
and a personal style that builds trust, and inspires loyalty.
Your duties will also include taking and entering orders,communicating with clients and partners, work with payments and information and creating mail shots.

Other duties of the Administrative Assistant(Representative) include, but are not limited to:
Incorporating effective priorities for the virtual office function
Administer day-to-day financial responsibilities for clients
Reporting online daily
Preparing brief summary reports, and weekly financial reports

To be considered for this position, you must have solid administration experience.
A good telephone manner is also essential.

Salary part-time: 5.000 euro/month plus bonuses.
Location: Holland

If you are interested, please reply to: natasha@position-nl.com with your latest CV.

Best regards,

Natasha Csereklye
Employment Manager
The domain was registered just today, the registration details are probably fake:

Domain name:             POSITION-NL.COM
Name Server:             ns3.nic.ru
Name Server:             ns4.nic.ru
Name Server:             ns8.nic.ru
Creation Date:           2010.10.08

Status:                  DELEGATED

Registrant ID:           OQKDBB9-RU
Registrant Name:         Fabio A Murgia
Registrant Organization: Fabio A Murgia
Registrant Street1:      Via Giovanni, 183
Registrant City:         Cardano
Registrant Postal Code:  21010
Registrant Country:      IT

Administrative, Technical Contact
Contact ID:              OQKDBB9-RU
Contact Name:            Fabio A Murgia
Contact Organization:    Fabio A Murgia
Contact Street1:         Via Giovanni, 183
Contact City:            Cardano
Contact Postal Code:     21010
Contact Country:         IT
Contact Phone:           +39 0 331 732700
Contact E-mail:          fabrinoz@europe.com

Registrar:               Regional Network Information Center, JSC dba RU-CENTER

A Netherlands company, with Italian contact details on the domain.. which is registered in Russia? I think not.

Update:  the domains uk-kbs.com and usa-kbs.com are also being used for the same fake job offer. Avoid

Friday, 24 September 2010

position-gb.com / position-west.com fake job offer

Part of a long series of fake job offers, this one uses the domains position-gb.com and position-west.com to solicit replies. In this case "bank account operations" is money laundering, "transportation and logistics" is most likely a parcel reshipping scam and "private enterprise service" could be one of a number of criminal activities. Avoid.

Date: 24 September 2010 12:56
Subject: Re: CV 62

Greetings

I am a manager of the HR department of a large multinational company.

Our enterprise is connected with a great number of various activities, like:
-property
- bank account operations
- transportation and logistics
- private enterprise service
- etc.

We need employees in Europe:
- salary 2.500 euro + bonus
- 1 - 2 working hours per day

- free timetable


If our offer is interesting for you email us the required information: Chandra@position-gb.com
Name:
Surname:
City:
E-mail:
Telephone Number:



Note! We are searching Europeans only!

Friday, 3 September 2010

nl-position.com fake job offer

In what appears to be an update of this fake job offer, there is now a spam run soliciting replies to nl-position.com for "representatives" who will most likely be handling stolen money and goods.

Date: 3 September 2010 06:30
Subject: Welcoming speech

Dear Sir/Madam!

The Company would like to offer you extra opportunity to get part-time position.
Today we open offices in some countries of Europe and need "Representatives".

Responsibilities:
- Work with clients and partners
- Collecting information
- Paper work
- Online monitoring

Principle of work:
- Home office position

Salary:
- 60.000 euro per year + bonuses for transactions

Minimal requirments:
- Location: Holland
- Age: +23
- Secondary education
- Responsibility

Wait for your applications to the following address: cv@nl-position.com

Do not hesitate to contact us and know more.
Look forward to your applications!

Best wishes!

Don Tennant
Manager of HR department


The nl-position.com was registered just three days ago to a no doubt fake address:

Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756 

The name servers are ns1.nameself.com and ns2.nameself.com, both based in Russia and commonly used by scammers. Unusually the JuliaNewYork76.com domain is also fake. Both domains have their mail handled by Google.

These other domains also seem to belong to the same crew, any "job offer" from them can safely be regarded as bogus:

ca-position.com
es-position.net
europ-position.com
gb-new-position.com
ms-positions.com
nl-position.com
east-europ.com
inc-europ.com
it-europ.net
north-europ.com
pt-europ.com
uk-europ.com
trabajo-europ.com
west-europ.com

Tuesday, 24 August 2010

north-europ.com job offer scam

This is a fraudulent job offer originating from an IP address in Vietnam, with a ridiculous salary for doing next to nothing:

Hello message

We are in a hurry to offer you position in the building Company.
In few words our Company provides huge circle of building services like
building, landscaping, interior and exterior design of premises, houses etc.

We offer you:
- career growth
- flexible working day
- minimal requirements to become the part of our team

Job description:
- type of work: part time position
- the place to work: your home office
- territory of work: you area(city)
- salary: 60.000 euro per year + percents of transactions
- principle of work: work with clients/partners getting tasks online

If you are interested please respond with the C.V. or minimal contact data to the e-mail: Allison@north-europ.com


Attention!
We are interested in cooperation to the people who live in Europe.
north-europ.com uses Google to handle its mail and doesn't have a website. The WHOIS details have a very familiar email address of lapatasker@earthling.net.

    Aleksandr Lapatau
    Email: lapatasker@earthling.net
    Organization: Private person
    Address: Lenina, 34, 8
    City: Minsk
    State: Minskaya
    ZIP: 456123
    Country: BY
    Phone: +375.172427204

Infrastructure is in various locations around Russia. Avoid.

Thursday, 29 July 2010

"eurjobs.org" fake job offer

There are a lot of these going on at the moment, this is another fake job offer trying to rope unsuspecting applicants into doing something illegal.

Date: 29 July 2010 08:23
Subject: Representatives Wanted
   
Civilities


I am a manager of the HR department of a large multinational company. Our company covers a wide range of businesses:
- supporting business in Europe and other countries
– bank accounts opening and maintenance
– private undertaking services
– etc.

There are vacant positions of regional managers in Europe:
- salary 2.400 dollars + bonus
- 1-2 working hours per day
- flextime


If our offer is interesting for you send us the below information on our e-mail address:
h r @ e u r j o b s . o r g [please delete spaces before sending]
Full name:
Country:
E-mail:
Mobile phone-number:



Attention! We need European residents only.

Please provide you name and contact information in order we can find you for further communication.

The domain is currently not resolving, and is registered to a fake address in the WHOIS details. Perhaps of some interest are the two nameservers for the domain:

ns1.usaportall.com [89.238.165.212 - M247 Ltd, Manchester, UK]
ns2.usaportall.com [191.184.23.131 - Apparently invalid IP allocated to LACNIC]

The no doubt fake registrant details are:
      Kacie Cheverton
      105 FOREST DR
      CATONSVILLE, MD 21228
      US
      Phone: +1.4105668199
      Email: roller@consultant.com

Anyway, beware of unsolicited job offers from people you don't know and can't verify, unless you like prison food.

Wednesday, 28 July 2010

"west-epec.com" fake job offer

This is some sort of money laundering or parcel reshipping scam. The domains west-epec.com was registered just yesterday but it appears not to be resolving properly.


Date: 28 July 2010 13:36
Subject: vacancy #876

I am writing to you in the name of the corporation the Human Resources department of which I represent.

Our enterprise has a lot of different lines of business.
-real property
-business support
-company dissolution
-private firm service
-etc

There is a vacancy of a Regional manager in Europe:
-compansation package 2.300 euro +bonus
-taskwork

- 'open-leave' schedule


If you have an intention to cooperate with our company, please send your contact information on our e-mail: Darla@west-epec.com
First Name:
Country of living
City
mail address:
Contact telephone number

Remark! Applicants with the permission to work in Europe!

Please let us know you contact information.
Our manager will contact you to provide answers for the questions you are interested at and invite you for brief interview.

The WHOIS details are probably fake, but consistent with a large number of other fake job websites.

    Aleksandr Lapatau
    Email: lapatasker@earthling.net
    Organization: Private person
    Address: Lenina, 34, 8
    City: Minsk
    State: Minskaya
    ZIP: 456123
    Country: BY
    Phone: +375.172427204 

A Google search for that email address shows lots of similar sites. Avoid.

Sunday, 11 July 2010

hiring-westunion.com scam email

This scam email is recruiting people for money laundering and other criminal activities using the fraudulent domain hiring-westunion.com:

From: Molly Leary
Date: 11 July 2010 01:23
subject: Open Positions

Greetings


I’m addressing you on behalf of the HR department of a large company. Our company covers a wide range of businesses:
- real estate
– accounts opening
– undertaking services
– etc.

We need a person to fill the vacancy of a regional manager in Europe:
- salary 2.400 euro + bonus
- 2–3 working hours per day
- flexible work time


If you are ready to work as a regional manager in Europe send us the below information on email:
c v @ h i r i n g - w e s t u n i o n . c o m [please delete spaces before sending]
Full name:
Country:
E-mail:
Mobile phone-number:



Note! We are searching Europeans only!

Please, write your name and Telephone Number so that our manager could contact you and conduct an interview. 
This domain attempts to pass itself off as the legitimate Western Union company, it was registered a few days ago to what appears to be a real address but is almost definitely fake too:

Domain name: hiring-westunion.com

Registrant Contact:
   PBsoft, inc
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Administrative Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Technical Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

Billing Contact:
   Harry Bishop Harry.PBishop@yahoo.com
   818372-9865 fax: 818372-9865
   2850 Luna Pl
   Granada Hills CA 91344-1644
   us

DNS:
ns1.pegas-dns.org
ns2.pegas-dns.org

Created: 2010-06-22
Expires: 2011-06-22

The registrar is the scammer's favourite, BIZCN.com of China. The web server and mail is hosted on 178.162.135.108 on PegasHosting Network in the Ukraine. Email originated from 201.246.77.170, an ADSL subscriber in Chile.

This is not a real job, anything that they offer is likely to be some sort of criminal activity such as money laundering, parcel reshipping and other fraudulent back office functions.

Update 19/7/10: the spam is being sent out again, now hosted on 79.119.213.2 in Romania along with  Westunionhiring.com - if you get this, send an abuse complain to the host at abuse -at- rcs-rds.ro

Wednesday, 30 June 2010

netmps.com scam job offer

Another scam email from a fake company calling itself NetTemps Inc (there are several legitimate companies with similar names though). The job itself is likely to be money laundering or some other illegal activity.

Date: Wed, 30 Jun 2010 14:28:47 -0300
From: "Crowell1924"
Subject: hiring

Looking for a job? My name is Juliette Barnes, I am a recruiting manager of NetTemps Inc, a recruiting agency for direct-hire, contract, and freelance professionals within various professions.                          
      
Today I would like introduce some part-time and virtual office vacancies in the spheres of Advertising, Education, Engineering, Finance, Health care, Information technology, Media, Real estate and Transportation.                   
        
If you are interested to learn more about the jobs offered, please get back to me, providing your name and contact number.                    
                           
We are eager to help you find a better job and improve your career!    
            
If you have questions, please do not hesitate to e-mail me on:   
               
e u r o p e @ n e t m p s . c o m      [please delete spaces in the email address before sending it to us]                           
                           
Yours sincerely,                            
Juliette Barnes  
NetTemps Inc    
WHOIS details are the usual rubbish:

Registrant Name: Maria Varshavskaya
Registrant Organization: NA
Registrant Street1: ul. Elninskaya d.14 k.1 kv.10
Registrant Street2:
Registrant City: Moskva
Registrant State/Province: Moskva
Registrant Postal Code: 121615
Registrant Country: RU
Registrant Phone: 7.4959219347
Registrant Phone Ext.:
Registrant FAX: 7.4959219347
Registrant Email: rabid@fastermail.ru
Admin Name: Maria Varshavskaya
Admin Organization: NA
Admin Street1: ul. Elninskaya d.14 k.1 kv.10
Admin Street2:
Admin City: Moskva
Admin State/Province: Moskva
Admin Postal Code: 121615
Admin Country: RU
Admin Phone: 7.4959219347
Admin Phone Ext.:
Admin FAX: 7.4959219347
Admin Email: rabid@fastermail.ru
Billing Name: Maria Varshavskaya
Billing Organization: NA
Billing Street1: ul. Elninskaya d.14 k.1 kv.10
Billing Street2:
Billing City: Moskva
Billing State/Province: Moskva
Billing Postal Code: 121615
Billing Country: RU
Billing Phone: 7.4959219347
Billing Phone Ext.:
Billing FAX: 7.4959219347
Billing Email: rabid@fastermail.ru
Tech Name: Maria Varshavskaya
Tech Organization: NA
Tech Street1: ul. Elninskaya d.14 k.1 kv.10
Tech Street2:
Tech City: Moskva
Tech State/Province: Moskva
Tech Postal Code: 121615
Tech Country: RU
Tech Phone: 7.4959219347
Tech Phone Ext.:
Tech FAX: 7.4959219347
Tech Email: rabid@fastermail.ru
Name Servers:
ns1.loopcool.net
ns1.growthire.com


Plus a few related evil domains to avoid

  • loopcool.net
  • netmps.com
  • netpts.org
  • nettempsin.co.uk
  • nettes.org
  • nettms.eu
  • nettms.net
  • nettps.net
  • growthire.com
You can read more on this particular bogus job offer here, here and here.

Tuesday, 25 May 2010

job4-us.com fake job offer

Run by the same crew as this scam, this fake job offer is a "money mule" operation laundering stolen funds, under the guise of payment processor for a car sales company. The entire job4-us.com domain is fake, any email purporting to be from that address are bogus.

Date: 25 May 2010 11:22
Subject: A car store is looking for remote employees. (US)

My name is Lisa and our company is looking to fulfill several part time positions in your region. We are one of the largest internet solutions resellers on the market and are looking to build strong support team in United States to provide the best Customer Care.

Title of the current position available is “Payment Processing Assistant” and we have seven openings.

An ideal applicant for this position must meet the following requirements:
* At least 22 years of age
* Resident of United States of America
* Very observant and able to focus on details
* Patient
* Trustworthy
* Practical
* Loves to learn
* Explains well in writing
* Handles deadlines
* Bank account
* Full internet access (at home or at work)

Benefits:
* 50% of the monthly cell phone bill is covered by the company
* Monthly salary starting at $2000(after a month evaluation period)
* 5% commission for every processed transfer
* Banking, Western Union and Money Gram fees is be covered by the company

If you are interested please reply to: Kaitlin@job4-us.com

As before, the site is hosted on 195.206.246.210 in Moldova, on the same server as europjob.com, with the same registrant details which are probably fake:

Registrant:
Maksim Rodkin
Email: roddsn@post.com
Organization: Private person
Address: Miichurinskij prospekt, d.10-2, kv. 144
City: Moskva
State: Moskovskaya
ZIP: 178234
Country: RU
Phone: +7.4956783214

Tuesday, 18 May 2010

europjob.com fake job offer

This fake job offer comes with a Moldovan and Russian connection.

Date: 18 May 2010 20:52
Subject: good day!
   
International Real Estate Consulting Company seeking local representation


Countries of interest: Austria, Belgium, Bulgaria, Hungary ,Greece, Denmark, Ireland, Cyprus, Lithuania, France, Sweden
Luxembourg, Malta, Netherlands, Poland, Slovakia, Slovenia, Portugal, Romania, Finland, Czech, Estonia

Tasks of the representation to consist of liaison and intermediation in financial transactions.

Good and prolonged relations history with local financial institutions is strongly recommended
(references will be asked).

If you would like to be a regional manager in Europe send us your contact information: Full name:
Country:
City:
E-mail:
Telephone Number:

Our contacts: Denver@europjob.com
The europjob.com domain was registered just yesterday and is hosted on 195.206.246.210 at Starnet in Moldova. The WHOIS details show the infamous "Private Person" as a registrant with an email address frequently connected with scams.

Registrant:
    Maksim Rodkin
    Email: roddsn@post.com
    Organization: Private person
    Address: Miichurinskij prospekt, d.10-2, kv. 144
    City: Moskva
    State: Moskovskaya
    ZIP: 178234
    Country: RU
    Phone: +7.4956783214

It's not clear what the job is, probably money laundering or some other criminal back office service. Avoid.

Saturday, 17 April 2010

euvacant.com job offer scam

This is some sort of money mule operation, euvacant.com has the domain registered with hidden details though a registrat in China, the website and mail server are hosted at 178.162.135.100 which is Pegashosting Network in the Ukraine.

Subject: part-time employment in Europe
From: "Katheryn.Parra"
Date: Sat, April 17, 2010 7:38 am

Hi,
West Union Group is searching for a European representative in order to satisfy the
requests of our well respected costumer. To be welcome to our team you need to be a
communicative person and to possess the skills in proper customer care.
We provide you with:
- Flexible schedule
- Good salary
- We pay-off all taxes for you
- Insurance
To obtain more information, please fill up the form below and send it to:

r e p l y 9 @ e u v a c a n t . c o m [please delete spaces in the email
address before sending it to us]

First Name:
Last Name:
Country:
E-Mail:
Contact Number:
Best time to contact you:
Attached resume is preferable

Our operators will contact you and will assist all your questions.

Position available for European citizens only!

Best Regards HR Management of West Union Group

In this case the originating IP was 190.22.247.165 in Chile. Avoid.

Note that the return email address varies, another example used "c v 2 @ e u v a c a n t . c o m" but in all cases the domain seems to be the same.

Tuesday, 6 April 2010

reycorporacion.com - bogus job offer

A slightly unusual twist to bogus job offers, this one solicits replies to reycorporacion.com which appears to be a legitimate company, but it looks like the mail has somehow been compromised.

Subject: Position Opening

Speech of welcome

I am a representative of the HR department of a large international company. Our company has been working in different fields, such as:
- real estate companies setting-up and winding-up bank accounts opening and maintenance logistics private undertaking services etc.


We are making a regional managers team in Europe now:
- salary 2.600 euro + bonus
- part-time employment
- flexible work time

If our offer is interesting for you send us the below information on our e-mail address: marta.urzola@reycorporacion.com
Name:Surname:Country:E-mail:Mobile phone-number:

Note! We are searching Europeans only!

Please, write you
Nothing in the registration details, IP address or MX records looks particularly suspect, so it is likely that the reycorporacion.com server has been compromised in some way. In any case, avoid this job offer as it will be some sort of Money Mule operation. If you get one of these, then I recommend alerting the web host abuse-server -at- strato.de to the problem.

Friday, 14 August 2009

dia-company.net scam

Another job scam from Michell.Gregory2009@yahoo.com. It's not clear exactly what "job" they are offering, but it will definitely be a scam and probably be illegal.

Subject: Job Search Results on Monster.com

Greetings,

Our Company is ready to offer full and part time work in your region. We are among top managing companies in North America and Europe.

If you are interested in career growth and good salary, send your resume ONLY to the Company?s email address: hd@dia-company.net

Reply only via corporate email, so please just use this one for further contact and
correspondence: hd@dia-company.net

With best regards,
HD department
DIAGROUP

The domain registration details are:

Domain name: dia-company.net

Registrant Contact:
NA
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Administrative Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Technical Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

Billing Contact:
Gregory Michell Michell.Gregory2009@yahoo.com
+1.3023892438 fax: +1.3023892438
5215/2 SW 152 Court
Beaverton NA 97011
us

DNS:
ns1.freedns.ws
ns2.freedns.ws

Created: 2009-06-25
Expires: 2010-06-25
That email address is well-known.

The site is hosted on 121.12.127.241 in China, it is probably safe to assume that every other site is similarly some sort of scam or malware site and should be avoided.

  • 00freewebhost.cn
  • Anilyclickux.com
  • Anilydclick.com
  • Anilymclicks.com
  • Armor1.info
  • Armor2.info
  • Autohitssite.com
  • Bote-abfertigung.com
  • Ckinter.cn
  • Ckinter.ru
  • Compy.info
  • Dia-company.net
  • Earntoclicklr.com
  • Festgroup.net
  • Googleautohits.com
  • Googledolis.com
  • Googledues.com
  • Googleehits.com
  • Googleipad.com
  • Googleledal.com
  • Googlepayclicks.com
  • Googlepayhits.com
  • Googlepaylr.com
  • Googlesrx.com
  • Ilos-group.com
  • Ilos-group.net
  • Inzo-group.com
  • Inzogroup.net
  • Inzo-group.net
  • Jethitclicks.com
  • Makemogoogle.com
  • Mavr-best.com
  • Medikmenty.com
  • Mybotnet.org
  • Perenils.cn
  • Prex-group.com
  • Prex-group.net
  • Resogroup.net
  • Smallclicks.net
  • Spyware-file.info
  • Spywarehome.info
  • Spywarepc.info
  • Spyware-systems.info
  • Taxvac.com
  • Thjgoogle.com
  • Tincash.cn
  • Varnagroup.net
  • Vicogroup.net
  • Viphack.ru
  • Vsehorosho.info
  • Zentin.net.cn

Wednesday, 20 May 2009

mig-design.com fraudulent job offer

A straightforward pitch for what is probably a money mule operation.

Subject: Looking for a job? More info here
From: "Shirley Schafer" boss@adabillur.com

Greetings,

If you are still looking for a well-paid part time job (2-4 hours a day) with possible full-time promotion opportunities at one of top-echelon Management Companies, please e-mail your resume/CV or a short description of your former activities.

Use ONLY corporative e-mail address below for all further correspondence:
office@mig-design.com

Necessary information concerning working and cooperation opportunities, financial benefits and advantages is sent by your request.

Yours faithfully,
Recruiting Office,
MIG Management and Design

Let's look at mig-design.com.. actually, don't - it's never a good idea to poke at spamvertised sites unless you know what you are doing. There's not much to see apart from a snazzy logo saying "MIG International Design Group".

The logo has clearly been professionally designed. But it also appears to have been stolen from this site although amusingly the spammers have corrected the obvious spelling error.

Let's check out the WHOIS details:

Name : Michell
Organization : Michell
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
Country :
Postal Code : 85230
Phone Number : 86--56343365
Fax : 86--56343365
Email : Michell.Gregory2009@yahoo.com


A quick Google search for that email address shows several hits.. indeed, it has been used before for the luxgroupnz.com scam.

The IP address of the site is 61.150.91.136 in China and usually in these circumstances it is safe to assume that ALL sites on the same server are suspect:

  • Bsi-investment.com
  • Bsibanksingapore.com
  • Ckinter.cn
  • Ckinter.ru
  • Freeadulttube.com.cn
  • Importfinanceinc.com
  • Intdgroup.com
  • Lloydsinsurer.com
  • Luxgroupww.com
  • Majordesigngroup.net
  • Medikmenty.com
  • Mens-health.com.cn
  • Mig-design.com
  • Mig-disign.com
  • Teentube.com.cn
  • Vsehorosho.info
  • W-trabajo.com
  • Wploy-empleo.com
  • Wtrabajo.com
In this case the email originates from 117.197.0.23 in India.

A flashy logo does not mean that it's a legitimate site. In this case the spammers have just ripped off someone else's identity. Avoid.

Saturday, 4 April 2009

luxgroupnz.com / LuxGroup scam

There are lots of legitimate ocmpanies with the name LuxGroup or Lux Group or something similar. This particular fake "LuxGroup" uses the domain luxgroupnz.com to push some sort of fraudulent job offer, probably a money mule or some other criminal activity.

Subject: A better career with LuxGroup

Good Day,

Major International Company is ready to offer you part(1-2 hours a day) and full time(5-8 hours per day) job in the USA. If you are interested, get back to us by email and send your resume or a short description of your former activities. Excellent career growth perspectives and merited salary.

For more info about terms, conditions and financial remuneration, get back ONLY to our corporative email address below: advjob@luxgroupnz.com

With regards,
Lux Group, Hiring Department
The luxgroupnz.com domain was registered on April 1st 2009 through XIN NET TECHNOLOGY CORPORATION to:

Name : Michell
Organization : Michell
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
Country :
Postal Code : 85230
Phone Number : 86--56343365
Fax : 86--56343365
Email : Michell.Gregory2009@yahoo.com

Site is hosted on 222.73.37.250, name services are proved by NS1.CHOSTSERVICE.COM and NS2.CHOSTSERVICE.COM. Other domains hosted on that server are:

  • A-finance.net
  • A-finance.org
  • Aiminfo.info
  • Careertrip.cn
  • Danunafig.ru
  • Dessgif.com
  • Hot-jobster.cn
  • I-love-pets.ru
  • Icm-mail.biz
  • Icm-network.net
  • Isearchword.info
  • Itellu.info
  • Itellu.ru
  • Lastyp.ru
  • Mountain-travel.ru
  • Mycotteges.ru
  • Oceananswers.info
  • Oceanofsearches.info
  • Pinigeliai.com
  • Temp-biz.cn
  • U-search.info
  • Yadrenamat.ru
  • Yaponamat.ru
Some of these other domains have also been used for fraudulent offers.

If you get one of these ignore it.