Sponsored by..

Showing posts with label Money Mule. Show all posts
Showing posts with label Money Mule. Show all posts

Tuesday 1 June 2010

Another spam using BonBon.net for replies

There have been a stack of fake job offers soliciting replies to a BonBon.net email address lately. These emails don't actually come from BonBon.net, but they are seeking a reply to a mailbox using that domain.

I was unfamiliar with this mail service, but a bit of research shows that it belongs to HotPOP who have been around since 1998 and have a pretty good anti-spam policy and seem to be a pretty decent bunch.. so my advice is that if you get a spam trying to get you to reply to BonBon.net then forward a copy to abuse -at - hotpop.com.

From: Emilio Richardson
Date: 1 June 2010 02:40
Subject: Vacancy
   
Req'd Education: High School
Citizenship or Work-Visa: YES
Base Pay: 72,000/year
Employee Type: Part-Time/Home-Based
Bonus: Yes

Description:

If you want to work in a strong developing team, in which you can feel like in your family, this  position is for you! Our company is looking for local customer service managers. You will have good career opportunities and will enjoy friendly working atmosphere of our team.

Requirements:
High School required. PC and Internet, MS Office or compatible. Must have strong writing and communication skills.

To Apply:
Forward your contact details back ONLY to our e-mail:  manager03ltd@BonBon.net

 and wait for response next 24h - 48h. Resume-containing only.
This really is just another Money Mule operation or similar, avoid at all costs.

Tuesday 25 May 2010

job4-us.com fake job offer

Run by the same crew as this scam, this fake job offer is a "money mule" operation laundering stolen funds, under the guise of payment processor for a car sales company. The entire job4-us.com domain is fake, any email purporting to be from that address are bogus.

Date: 25 May 2010 11:22
Subject: A car store is looking for remote employees. (US)

My name is Lisa and our company is looking to fulfill several part time positions in your region. We are one of the largest internet solutions resellers on the market and are looking to build strong support team in United States to provide the best Customer Care.

Title of the current position available is “Payment Processing Assistant” and we have seven openings.

An ideal applicant for this position must meet the following requirements:
* At least 22 years of age
* Resident of United States of America
* Very observant and able to focus on details
* Patient
* Trustworthy
* Practical
* Loves to learn
* Explains well in writing
* Handles deadlines
* Bank account
* Full internet access (at home or at work)

Benefits:
* 50% of the monthly cell phone bill is covered by the company
* Monthly salary starting at $2000(after a month evaluation period)
* 5% commission for every processed transfer
* Banking, Western Union and Money Gram fees is be covered by the company

If you are interested please reply to: Kaitlin@job4-us.com

As before, the site is hosted on 195.206.246.210 in Moldova, on the same server as europjob.com, with the same registrant details which are probably fake:

Registrant:
Maksim Rodkin
Email: roddsn@post.com
Organization: Private person
Address: Miichurinskij prospekt, d.10-2, kv. 144
City: Moskva
State: Moskovskaya
ZIP: 178234
Country: RU
Phone: +7.4956783214

Tuesday 18 May 2010

europjob.com fake job offer

This fake job offer comes with a Moldovan and Russian connection.

Date: 18 May 2010 20:52
Subject: good day!
   
International Real Estate Consulting Company seeking local representation


Countries of interest: Austria, Belgium, Bulgaria, Hungary ,Greece, Denmark, Ireland, Cyprus, Lithuania, France, Sweden
Luxembourg, Malta, Netherlands, Poland, Slovakia, Slovenia, Portugal, Romania, Finland, Czech, Estonia

Tasks of the representation to consist of liaison and intermediation in financial transactions.

Good and prolonged relations history with local financial institutions is strongly recommended
(references will be asked).

If you would like to be a regional manager in Europe send us your contact information: Full name:
Country:
City:
E-mail:
Telephone Number:

Our contacts: Denver@europjob.com
The europjob.com domain was registered just yesterday and is hosted on 195.206.246.210 at Starnet in Moldova. The WHOIS details show the infamous "Private Person" as a registrant with an email address frequently connected with scams.

Registrant:
    Maksim Rodkin
    Email: roddsn@post.com
    Organization: Private person
    Address: Miichurinskij prospekt, d.10-2, kv. 144
    City: Moskva
    State: Moskovskaya
    ZIP: 178234
    Country: RU
    Phone: +7.4956783214

It's not clear what the job is, probably money laundering or some other criminal back office service. Avoid.

Fake "NetTemps Inc" domains

These domains and IPs seem to be associated with this company masquerading as "Net Temps Inc" (there are legitimate companies with a very similar name though), you can see examples of the scam email being used here and here.

82.243.193.235- Proxad, France
nettms.eu
nextspend.biz

95.64.133.205 - MultyKabelnie Seti Balashihi, Russia
nettms.net
nettps.net
eddpiii.com.pl

74.63.228.139 - Limestone Networks, Texas
ns1.loopcool.net
ns1.seerdanee.com

87.117.245.9 - JSHosts, UK
lokiou.eu
ns1.globalistory.net
ns1.hourscanine.com
ns1.limeteablack.net
ns1.skcstaff.com
ns1.skcstaffing.com
ns1.socialworc.net

204.12.229.89 - Hosting Ventures LLC, USA [Mostly suspended, some now deleted]
mx.nettempsin.co.uk
mx.nettms.net
ns1.availname.net
ns1.disksilver.net
ns1.girlfrendsboy.com
ns1.nodefront.net
ns1.pdsproperties.net
ns1.sorbauto.com
ns1.whiskybrend.net
availname.net
ddeasaeq.vc
edfa4.com.vc
edfa7.com.vc
efasqca.com.pl
ewasza.co.uk
ewasze.co.uk
ewasze.me.uk
ewaszi.co.uk
ewaszu.co.uk
girlfrendsboy.com
iurseda.com.vc
nodefront.net
pdsproperties.net
sorbauto.com
whiskybrend.net

79.170.40.4 - Heart Internet, UK
netpts.org
nettes.org


77.25.179.23 - Vodafone, Germany
ns2.loopcool.net
ns2.rakusolutions.com

Fast Flux (IP varies)
nettempsin.co.uk

Registered but no website
hourscanine.com
juverds.info
skcstaffing.com

Suspended / On hold
nttempinc.com
santroperz.net
assewya.co.uk
limeteablack.net
skcstaff.com

Monday 17 May 2010

Nettms.net / Nettps.net "NetTemps Inc" scam

This fraudulent job offer solicits replies to an email address of cv@nettms.net  and it pretends to be from "NetTemps Inc". There is a legitimate firm in the US of a similar name, but this job offer is not from them.

Subject: part-time job in Europe
Date: Mon, 17 May 2010 16:05:37 +0100

Looking for a job? My name is Juliette Barnes, I am a recruiting manager of NetTemps Inc, a recruiting agency for direct-hire, contract, and freelance professionals within various professions.  
      
Today I would like introduce some part-time and virtual office vacancies in the spheres of Advertising, Education, Engineering, Finance, Health care, Information technology, Media, Real estate and Transportation.  
    
If you are interested to learn more about the jobs offered, please get back to me, providing your name and contact number. 
    
We are eager to help you find a better job and improve your career!
      
If you have questions, please do not hesitate to e-mail me on:  
      
c v @ n e t t m s . n e t      [please delete spaces in the email address before sending it to us]  
 
Yours sincerely,   
Juliette Barnes 
NetTemps Inc  
It's the same scam as this one, but in this case the back-end servers are different.. the mailed replies go to 204.12.229.89 [Hosting Ventures LLC, US] with a web site hosted at 95.64.133.205 in Russia along with another similar domain of Nettps.net.

Anyway, this job offer is probably laundering stolen money or some other criminal activity and should be avoided at all costs.

Friday 14 May 2010

"Delivery LCI" job scam

This is a fraudulent job offer, which appears to be a reshipping scam and possibly some other "back office" functions for organised criminals. The is no company registered in the UK called Delivery LCI or LCI Delivery.

From: Timmy Bliss
Date: 14 May 2010 01:49
Subject: Job opening

Hello,

I'm Mary, writing on behalf of Delivery LCI about your job
search, would like to invite you to learn more about the job
opportunity that we are offering right now for people like you.
First of all you need no prior experience, but we will provide all
necessary training when you will join us.

Now let's take a look at what Delivery LCI offers you:


Shipping Regional Manager

 Requirements:
 - Resident of the United States;
 - Fluent English;
 - Basic knowledge of Microsoft Word and Microsoft Excel;
 - Home Computer with e-mail account and ability to check your e-mail
 box at least twice a day
 - Adults only accepted (we cannot hire underage people)


 Job description:

 - Receive correspondence from our company and its clients at his/her
 residential address;
 - Report to our manager (every candidate will be included in a
 manager's lists)
 - Forward received items according to instructions of our manager
 - Fill in the forms and papers as indicated in our manager's
 instructions (you will receive an e-mail with instructions for each
box).
 - Ship packages out


 Personal qualities:
- honesty
- decency
- sociability
- ability to work in team


 Salary
 - 30$ per package processed for trial period 1 month
 - 50$ per package processed \ by the end of trial period\
 - The salary is credited to your account once a month


 If you are interested in our position, reply back to us
 with your short resume at:

 KathrynKnowlton@BonBon.net

Thank you for reading.

+44.20 3286 9579 

Despite there being no company of this name in the UK, there are two probably related websites of deliverylci.com and lcidelivery.com. At the moment, only deliverylci.com is running, registered to a fake address in the US:


Registrant:
    Dennis  Oneal
    Email: support@deliverylci.com
    Organization: Delivery LCI 
    Address: 1938 Woodland Terrace
    City: Orangevale
    State: CA
    ZIP: 95662
    Country: US
    Phone: +1.9169879747 
    Fax: +1.9169879747

but claiming to be based in the UK from their website:

Your calls are received by the phone: +44.20 3286 9579

E-mail: lcidelivery@lcidelivery.com

Our Office:

5 NORTH STREET, HAILSHAM, EAST SUSSEX, BN27 1DQ, United Kingdom
5 North Street, Hailsham does exist and is the office of a firm of accountants, there are many companies registered at this address. The telephone number is a London one though, not one for Hailsham.

Digging further shows that the deliverylci.com website is hosted at  89.248.162.136 [Ecatel, Netherlands]. The following sites are hosted on the same server:

  • Dealcomltd.com
  • Deliverylci.com
  • Idealogisticservices.com
  • Todaylogisticservices.com
89.248.162.136 is also a nameserver for other domains:

  • ns1.taxreturnsworld.com
  • ns1.worldtaxreturns.com
  • ns2.itadvancedservices.com   
  • s1.oilhost.eu
The domain taxreturnsworld.com was recently mentioned by Brian Krebs as being part of a particularly sophisticated job scam. So, it seems likely that all these domains and so-called companies are bogus and should be avoided.

Saturday 1 May 2010

Scam: "The big prospects for intelligent people from England and other regions"

Another money mule scam dressed up as a job offer from an estate agents. The estate agent pitch seems popular at the moment, having come up recently here and here.

From: Heather Crum
Date: 1 May 2010 01:31
Subject: The big prospects for intelligent people from England and other regions

I am HR manager in international real estate agency.

Your electronic address is taken from base of people who are searching for the job. We have the job offer for you. If it is an error and you aren’t searching for the job or you aren’t interested in additional earnings, please ignore this message. We apologize for spent time.

If you are interested in this offer, you need to address to e-mail: Schiavone.Basso@HotPOP.com

The basic direction of our company: The search of clients and partners. Sale, resale and rent of the elite real estate and the industrial areas.

Required qualities for the post:

Practical knowledge of the program “Microsoft Office Word”.
Ability to communicate, intelligence.
Experience in commercial activity is welcomed.
The knowledge of the Italian language and of other languages is welcomed.

The minimum salary is 2000 euro. Frequently the monthly income exceeds 10.000 euro. It all depends on intelligence of the Agent and on his desire and ability to work to his full extent.

For the additional information can refer to the electronic address which is specified above.
Yours faithfully, on behalf of all employees “Europe Real Estate”.

Wednesday 21 April 2010

nettempsin.co.uk / NetTemps Inc scam

There are probably plenty of legitimate companies with names like "NetTemps Inc", but this money mule scam email soliciting replies to nettempsin.co.uk is not from one of them.

From: "Polly Richardson"
Subject: representatives wanted

Looking for a job? My name is Juliette Barnes, I am a recruiting manager of NetTemps Inc, a recruiting agency for direct-hire, contract, and freelance professionals within various professions.

Today I would like introduce some part-time and virtual office vacancies in the spheres of Advertising, Education, Engineering, Finance, Health care, Information technology, Media, Real estate and Transportation.

If you are interested to learn more about the jobs offered, please get back to me, providing your name and contact number.

We are eager to help you find a better job and improve your career!

If you have questions, please do not hesitate to e-mail me on:

c v @ n e t t e m p s i n . c o . u k [please delete spaces in the email address before sending it to us]

Yours sincerely,
Juliette Barnes
NetTemps Inc


==================================

Unusually, the mail server that deals with replies is multihomed:
  • 79.125.134.191 [ADSL subscriber, Macedonia]
  • 91.41.145.247 [Deutsche Telekom dial-up subscriber, Germany]
  • 83.132.68.62 [TVCABO cable modem, Portugal]
  • 87.116.150.117 [Broadband customer, Serbia]
  • 186.137.3.195 [Cablevision customer, Argentina]
Nameservers are ns1.santroperz.net (domain suspended by registrar for fraud) and ns1.seerdanee.com hosted on 204.12.237.52 at WholeSale Internet, Inc. in Kansas City.

In any case, this is just a Money Mule scam and it should be avoided.

Tuesday 20 April 2010

martin-argiento.eu / Martin Argiento scam

A slight remix of this money mule scam from last month, but with a slightly different name.

Subject: The Italian company is looking for reliable partners
From: "Cindy Jeffers"
Date: Tue, April 20, 2010 6:03 pm

Dear Mr\Ms
My name is Martin Argiento. I am the manager in international real estate agency Europe Real Estate.

At present, we increase the number of part-time employees on the territory of England and other regions. In this connection, we carry on hiring new employees for the post of the regional real estate Agent.

Activity of the agent:
The search of the clients, advertising of the company.
Purchase \sale of the elite real estate.
Talks.
The monitoring of the market in several region.

Required qualities for the post:
Practical knowledge of the program Microsoft Office Word.
Ability to communicate, intelligence.
Experience in commercial activity is welcomed.
The knowledge of the Italian language and of other languages is welcomed.

The minimum salary is 2000 euro. Frequently the monthly income exceeds 10.000 euro.
It all depends on intelligence of the Agent and on his desire and ability to work to his full extent.

For the additional information refer to the electronic address:
realestate@martin-argiento.eu

Yours faithfully, on behalf of all employees Europe Real Estate.

Mail is directed to 85.112.126.89 in Russia [colocat.ru] but there is also a website hosted at 188.130.250.248 in Latvia [Fastmedia].

There's a whole bunch of badness on the same server in Russia, all of which should probably be avoided:

  • agency-sunsea.com
  • allinwondernews.com
  • apolcentral.com
  • apolonline.com
  • argiento.com
  • argiento.eu
  • argiento.net
  • beastdat.com
  • beinorder.com
  • bgrealty.org
  • bm-holding.com
  • cannibalcannibalistic.com
  • catcherscatherine.com
  • cemeterycentaurus.com
  • cephaliccerebrum.com
  • cesspoolchainsaw.com
  • chelseacinderblock.com
  • clubdatingckoo.com
  • coleldatingcom.com
  • comdatinghorse.com
  • comecloserit.com
  • confessionconducting.com
  • corporectomycorpus.com
  • crowpathcuernos.com
  • cunthuntcraniotomy.com
  • dacelie.com
  • datdos.com
  • datingfooool.com
  • datinggogocolelc.com
  • datingord.com
  • datingsermon.com
  • datingswot.com
  • datomg.com
  • datyandel.com
  • decapitationcattle.com
  • forurelax.com
  • freedom-dating.com
  • gaterk.com
  • goforitdear.com
  • gogodatinghorn.com
  • gskcorp.com
  • handshakesharvest.com
  • hatebeakhereafter.com
  • hereufame.com
  • hornydatingyou.com
  • ise-sl.com
  • itmakesuhappier.com
  • josetxe-financiero.com
  • klaipedetis.com
  • lovesexdatings.com
  • mail.swpost.net
  • martin-argiento.eu
  • myapol.com
  • negligentcondemned.com
  • new-crash.com
  • olsen-rossi.com
  • oppsmyhotty.com
  • orddating.com
  • prime-techno.net
  • pro-job24.com
  • qgraphicinstalls.com
  • rdnets.com
  • reallyforu.com
  • shekelsta.com
  • shufersalta.com
  • swpost.net
  • umap-btl.com
  • uwillhappy.com
  • youthesuperman.com
  • znakomilka.com

Saturday 17 April 2010

euvacant.com job offer scam

This is some sort of money mule operation, euvacant.com has the domain registered with hidden details though a registrat in China, the website and mail server are hosted at 178.162.135.100 which is Pegashosting Network in the Ukraine.

Subject: part-time employment in Europe
From: "Katheryn.Parra"
Date: Sat, April 17, 2010 7:38 am

Hi,
West Union Group is searching for a European representative in order to satisfy the
requests of our well respected costumer. To be welcome to our team you need to be a
communicative person and to possess the skills in proper customer care.
We provide you with:
- Flexible schedule
- Good salary
- We pay-off all taxes for you
- Insurance
To obtain more information, please fill up the form below and send it to:

r e p l y 9 @ e u v a c a n t . c o m [please delete spaces in the email
address before sending it to us]

First Name:
Last Name:
Country:
E-Mail:
Contact Number:
Best time to contact you:
Attached resume is preferable

Our operators will contact you and will assist all your questions.

Position available for European citizens only!

Best Regards HR Management of West Union Group

In this case the originating IP was 190.22.247.165 in Chile. Avoid.

Note that the return email address varies, another example used "c v 2 @ e u v a c a n t . c o m" but in all cases the domain seems to be the same.

Tuesday 6 April 2010

reycorporacion.com - bogus job offer

A slightly unusual twist to bogus job offers, this one solicits replies to reycorporacion.com which appears to be a legitimate company, but it looks like the mail has somehow been compromised.

Subject: Position Opening

Speech of welcome

I am a representative of the HR department of a large international company. Our company has been working in different fields, such as:
- real estate companies setting-up and winding-up bank accounts opening and maintenance logistics private undertaking services etc.


We are making a regional managers team in Europe now:
- salary 2.600 euro + bonus
- part-time employment
- flexible work time

If our offer is interesting for you send us the below information on our e-mail address: marta.urzola@reycorporacion.com
Name:Surname:Country:E-mail:Mobile phone-number:

Note! We are searching Europeans only!

Please, write you
Nothing in the registration details, IP address or MX records looks particularly suspect, so it is likely that the reycorporacion.com server has been compromised in some way. In any case, avoid this job offer as it will be some sort of Money Mule operation. If you get one of these, then I recommend alerting the web host abuse-server -at- strato.de to the problem.

Wednesday 17 March 2010

argiento.eu / Piccini Real Estate Company scam

This is a money mule scam, email originating from a hacked PC in Brazil, site hosted on 188.130.250.248 in Latvia which is a well-known bad IP address.

Note that there are several reliable real estate companies with "Piccini" in the name, this scam is not related to any of these companies. Avoid.

From: "Kathryn Crum"
Subject: The Italian company is looking for partners in England
Date: Wed, March 17, 2010 2:15 pm


Dear
My name is Martin Argiento. I am working in the international real estate agency Piccini Real Estate. Our company is registered in Italy.

Currently we are taking on the employees to hold a post of regional agents. We have a vacancy which you could fill.

Your electronic address, is taken from a database of the company which is engaged in employment. If it is an error, or if you do not have time, or you are not interested in this offer, we ask you to ignore the message. We apologize for the wasted time.

The vacancy description:
The salary from 2000 Euros.
Non fixed working ours.
The guaranteed prospect.

Requirements:
Practical knowledge of the program Microsoft Office Word.
Having skills in Microsoft Office Excel.
Ability to communicate, intelligence, responsibility.
Ability to come to an understanding with people and to carry on negotiations.
Experience in commercial activity is welcomed.

If you are interested in cooperation, please send mail on the electronic address: m@argiento.eu


On behalf of employees of Piccini Real Estate company.

Thursday 4 March 2010

"west-es-company.com" scam job offer

This is another money mule email, soliciting replies to west-es-company.com which is hosted at 193.104.94.57 in the Russian Federation along with a whole bunch of other badness.



Subject: hello!
From: "Ronald"
Date: Thu, March 4, 2010 11:10 am

Hello,

My name is Ronald and our company currently has several positions it needs to fill in your region.

We are a well known company with offices throughout Europe, Asia and North America.

Our current turnover is over 130 million annually and we are still seeking for expansion.

I have 12 vacancies of Financial Assistant that need to be fulfilled immediately.

Major operational duties are prompt receiving and processing customerÂ’s payments for their further transfer according to the specified method. Detailed work scheme will be provided upon request.

I am looking for self-motivated individuals with strong work ethics and ability to schedule work hours effectively.

Requirements:

* Expert skills in managing payments and transfers between our company and clients
* Knowledge of basic payment systems
* Bank account (personal or business)
* Advanced PC and Internet skills
* Minimum 24 y.o.

Benefits:

*Salary plus commissions
*Full reimbursement of banking and Western Union fees.

NOTE: This vacancy is valid for American residents ONLY.

Contacts: Ronald@west-es-company.com





Avoid this one at all costs.

Wednesday 17 February 2010

Money mule operation morphs

This fraudulent job offer (i.e. for a money mule laundering stolen funds) originates from 109.169.243.117 and points to a server on 193.104.94.57, both in the Russian Federation. This is the same server as this scam although the domain names have changed.

Subject: Vacancy ID053 USA
Date: Wed, February 17, 2010 2:12 am

Dear job seekers!

Apply for the job. We recommend this position.

Job Description:

We are looking for people who can control the payment of our customers from your state / region.

The responsibilities of work included compiling monthly reports on the overall turnover of funds, sending documents on each transfer.

We offer you confidentially as you conduct a search to meet your career goals and we can help you to understand and communicate what makes you stand out in a crowd.

My role is to find the best candidates to meet the needs of my clients. You could be just the person I'm looking for.

Job Requirements:

As a Finance Manager, you are responsible for all aspects of operation, including customer relations, team management, financial management and team recognition/retention.

You must:
- be 23 years of age or older
- be resident of United States of America
- have a bank account
- must have full internet access (at home or at work)

Minimum qualifications include:
- Well developed analytical, communication, and interpersonal skills
- Strong operational background and knowledge
- Exceptional people skills
- Problem solving skills
- Top notch communication and writing skills
- A drive to be the best

Benefits:
- Monthly salary starting at $2000(after a month evaluation period)
- 5% commission for every task you complete
- Banking and Western Union fees covered by the company

If you are interested in applying for this position please send your resume
Cara@new-job-position.com

Robtex reports a number of dodgy domains and mail servers on that domain, all of which should be considered fraudulent.

  • 7-job-net.com
  • company-euro.com
  • euro-shopping.net
  • gold-es-net.com
  • goldes-it.com
  • good-nets.com
  • it-financess.com
  • job-for-yours.com
  • mail.7-job-net.com
  • mail.company-euro.com
  • mail.gold-es-net.com
  • mail.goldes-it.com
  • mail.job-for-yours.com
  • mail.online-web-net.com
  • mail.people-and-job.net
  • mail.web-euro-it.com
  • mail.webpages-it.com
  • mail.wesst-netts.com
  • online-web-net.com
  • people-and-job.net
  • web-euro-it.com
  • webcompany-es.net
  • webcompany-euro.net
  • webfiless.com
  • webpages-it.com
  • wesst-es.net
  • wesst-netts.com

donotemail@wearespammers.com |

Thursday 11 February 2010

"7-job-net.com" Money Mule Operation

This is a straightforward money mule (i.e. money laundering) operation with a twist:

Subject: from International Consulting Company
From: "Arnulfo Salas"
Date: Thu, February 11, 2010 9:24 am

Hello

Our company(Outsourse Solution) is proud to announce you that we now have positions
available(part time)

A candidate for the Payments Processing Position must meet the following
requirements:

* Is 23 years of age or older
* Is resident of United States of America
* Is fair and objective
* Is detail oriented
* Is very observant and able to focus on details
* Is fairly intelligent
* Has patience
* Is trustworthy
* Is practical
* Types well
* Loves to learn
* Explains well in writing
* Is discreet
* Handles deadlines
* Has bank account
* Has full internet access (at home or at work)

Benefits:
* Monthly salary starting at $2000(after a month evaluation period)
* 5% commission for every task you complete
* Banking and Western Union fees covered by the company

If you are interested in becoming a Payments Processor for our company
you can request more information at Arnulfo@7-job-net.com

Thank you,
Outsourse Solution Inc.
Usually we see spam like this soliciting replies to throwaway free email addresses. In this case, 7-job-net.com is a domain that has been registered specifically for this scam, on 14th January 2010.

Registrant details show the infamous "Private person" moniker.

Aleksandr Lapatau
Email: lapatasker@earthling.net
Organization: Private person
Address: Lenina, 34, 8
City: Minsk
State: Minskaya
ZIP: 456123
Country: BY
Phone: +375.172427204

The email address is connected with at least one other scam.

Of interest is the fact that the domain is hosted on 193.104.94.57 in Russia along with the following sites:
  • Westitnet.net
  • Company-euro.com
  • Euro-company.net
  • Euro-shopping.net
  • Euro-webs.net
  • Good-nets.com
  • It-best-eur.net
  • It-financess.com
  • It-netx.com
  • Net-euros.com
All these sites have bogus looking registration details and are best avoided.

Friday 15 January 2010

"Croft Pole Distributors Limited" bogus job offer

Croft Pole Distributors Ltd (www.croftpoles.co.nz) are a wholly legitimate business based in Whangarei, New Zealand. This is a fake offer that falsely used Croft Pole's name in order to recruit into a money mule scam.

Subject: Online Job Offer
From: "Croft Pole Distributors Limited" <croftpole.update@gmail.com>
Date: Fri, January 15, 2010 10:52 am

Dear Sir/Ma,

Croft Timber Company Limited is a family owned business that began in 1905 and is still in Croft family hands today.

CTC moved more towards the specialised production of timber poles approximately 20 years ago and now trades locally as Croft Pole Distributors Limited with pole supply outlets in both Northland, Rodney and Auckland.

Within the last ten years CTC has grown considerably with investments in a new and larger site, plant modernisation/expansion and the introduction of equipment such as the Bezner Rounding Machine, Fogarty Kiln, Automatic Stacker, Machine stress grader and edge tester, planer and dry-mill department as well as the constant replacement and upgrading of existing plant and machinery.

The mill site is on about thirty acres of land with rail facilities adjacent and is approximately 25 minutes from the deep water port of Marsden Point. The plant ispresently capable of processing around 2,500-3,000 m3 per month.

We are committed to customer service and our aim is to remain flexible to meet the ever changing market needs with product and service unparalleled in the timber pole industry to date..

Most of our customers from Australia, Canada,United States & United Kingdom pay through various terms of payment which some are not negotiable here in New Zealand. This brings our quest to employ a credible and trustworthy fellow as our representative to coordinate our payments. This would not affect your present job but add more to your income.

Being our representative and assisting us in processing the payments from our clients should earn you a commission of 10% of every payment you coordinate.

Once we makes a sale we deliver the product to a customer (usually through UPS).The customer receives and check the products. After this has been done, the customer has to pay for the products. About 90 percent of our customers prefer to pay through Bank Wire Transfers or certified cheque. We have decided to open this new job position for solving this problem.

Your tasks are;

1. Receive payment from Customers through your Bank Accounts

2. Deduct 10% which will be your percentage/pay on Payments processed

3. Forward balance after deduction of percentage/pay to any of the offices you will be contacted to send payment to. (Payment is to forwarded by Local transfers (Western Union only). A local Money transfer takes barely hours, so it will give us a possibility to get customers payment almost immediately.

For example you have got �50,000.00

You take your income: �5,000.00


You will be able to operate with larger orders and you will be able to earn more.

Our payments will be sent into your Bank account that you provided, deduct your 10%(Salary) and forward the balance to the company via Western Union only.

We understand it is an unusual and incredible job position. This job takes only 3-7 hours per week.

You Will have a lot of free time doing another job, you will get good income and regular job. But this job is very challenging and you should understand it. We are looking only for the worker who satisfies our requirements and will be an earnest assistant, We are glad to offer this job position to you. If you feel that you are serious about this and be an earnest worker, All we will need for recording you to our database is below:

Full Name:-
Address:-
Age:-
Your Phone Number(s):-


Chris Moyle
Branch Manager
Croft Pole Distributors Limited
www.croftpoles.co.nz
The reply-to address is croftpole.update@gmail.com rather than croftpoles.co.nz, originating IP is 213.132.197.149 in the Netherlands, which hosts three porn sites but has probably been compromised. It is nothing at all to do with Croft Poles.

Of course, this 10% fee is a "too good to be true" scam which could well wind up with you going to prison, so it should be avoided at all costs.

Friday 24 April 2009

"IBC Group" fake job offer

There are lots of wholly legitimate firms called "IBC Group" or something similar. This one claims to be an "international business consultancy".. and yet they are using a free Google Mail address rather than a corporate one. It is just another money mule scam, although the 5% fee they are offering is surprisingly low (of course, this is stolen money so all you will end up with is a jail sentence).

Subject: Business
Date: Fri, April 24, 2009 12:29 pm

Dear SMALL BUSINESS OWNER
We are being a private international business consultancy (IBC GROUP) striving hard to perform the best to achieve optimal results in gaining efficiency of our client’s ventures. In this global economy crash time we turn to alternative solutions for our clients from Eastern Europe who are obliged to pay off US or Western Europe originated transfer taxes, which at times may be as much as 35%.
Therefore, we are raising up this appeal to those small business owners who have both desire and possibility to stand up as our partners and who may use their business accounts to operate internal transactions for their further remittance to our clients . As being held on a larger scale, your personal benefit will be 5% off every payment posted to your account (or company’s). It may become a considerable upgrade for you and your company.
If this comes up your alley, please, come back for details by: Katherin.Mills@gmail.com

with the following:
First Name:
Last Name:
Country:
State:
City:
Phone (Landline):
Phone (CELL):
Email:

Thank you in advance,
IBC GROUP.


Originating IP is 88.242.82.65 in Turkey.

Tuesday 21 April 2009

"August Insurance USA" scam

Another fraudulent job offer, this time originating from 190.43.155.148 in Peru. It doesn't really matter what the exact fraud is, this could well be a "back office" operation. But it's a scam nonetheless. Avoid.

Subject: Good vacancy August Insurance USA.
Date: Tue, April 21, 2009 12:07 am
Priority: High

College degree but not enough experience?

Responsible for managing the day to day operations of various facilities to ensure the operations,
maintenance, and vendor management standards of the contract are met in a cost effective, safe and efficient manner.

Requirements
Candidates must possess the following:

- Effective interpersonal skills & communication skills
- Demonstrated leadership and team building abilities
- Self-confidence, flexibility and a positive attitude
- U.S. work authorization

Selected individuals will be trained to enhance leadership and networking skills in
preparation for an executive role within our company.

Compensation based solely on personal performance. For immediate consideration
please contact.

All positions will be filled immediately due to our recent expansion.

You may email your resume in Word to: CHmayHooper@gmail.com
Needless to say, don't send 'em anything. And if you have agreed to "work" for them, demand some verifiable proof that they exist.

Saturday 4 April 2009

luxgroupnz.com / LuxGroup scam

There are lots of legitimate ocmpanies with the name LuxGroup or Lux Group or something similar. This particular fake "LuxGroup" uses the domain luxgroupnz.com to push some sort of fraudulent job offer, probably a money mule or some other criminal activity.

Subject: A better career with LuxGroup

Good Day,

Major International Company is ready to offer you part(1-2 hours a day) and full time(5-8 hours per day) job in the USA. If you are interested, get back to us by email and send your resume or a short description of your former activities. Excellent career growth perspectives and merited salary.

For more info about terms, conditions and financial remuneration, get back ONLY to our corporative email address below: advjob@luxgroupnz.com

With regards,
Lux Group, Hiring Department
The luxgroupnz.com domain was registered on April 1st 2009 through XIN NET TECHNOLOGY CORPORATION to:

Name : Michell
Organization : Michell
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
Country :
Postal Code : 85230
Phone Number : 86--56343365
Fax : 86--56343365
Email : Michell.Gregory2009@yahoo.com

Site is hosted on 222.73.37.250, name services are proved by NS1.CHOSTSERVICE.COM and NS2.CHOSTSERVICE.COM. Other domains hosted on that server are:

  • A-finance.net
  • A-finance.org
  • Aiminfo.info
  • Careertrip.cn
  • Danunafig.ru
  • Dessgif.com
  • Hot-jobster.cn
  • I-love-pets.ru
  • Icm-mail.biz
  • Icm-network.net
  • Isearchword.info
  • Itellu.info
  • Itellu.ru
  • Lastyp.ru
  • Mountain-travel.ru
  • Mycotteges.ru
  • Oceananswers.info
  • Oceanofsearches.info
  • Pinigeliai.com
  • Temp-biz.cn
  • U-search.info
  • Yadrenamat.ru
  • Yaponamat.ru
Some of these other domains have also been used for fraudulent offers.

If you get one of these ignore it.

Friday 20 February 2009

Point Focus LLC: "The offer you can not say no to!"

"The offer you can not say no to!" Really. I betcha I can. My notes are in bold.


Subject: The offer you can not say no to! ["No": just did, did you see that?]

Point Focus LLC is now expanding!

To deal with the international payments processings we are now looking for people willing to facilitate establishing of our all-round-the-globe business connections and assist saving considerably by tax disbursing reduction. This position of the Financial Assistant involves accepting payments from our Australian, UK and US ( rarer Spanish) clients to your account and resending to our partners.

You are getting paid right by the moment you cash the payment. It's the commission in amount equal to 4% out the sum posted on your account. This very amount you're deducting before sending anything out. So, estimated roughly, you can make up to 2000$ extra monthly.
[A straight money mule operation then, laundering stolen money. 4% for basically doing nothing. Except you will never actually get to keep the 4% when the police catch up with you]

Plus, you get:

- flexi-time (usually 2-3 hours a day)
- Saturdays & Sundays off [woo!]

Requirements:

- Have to be aged 21 or above
- No criminal record [don't worry, you will soon get a criminal record if you participate in this scheme]
- Regular Internet access
- Ability to accept payments using your bank account [for the transfer of stolen money, which will be nice and traceable for the cops]
- Ability to resend the money through Western Union [which is NOT traceable, and is therefore money laundering]


If feel qualified, please, attach the following info to start up with:
[information that we should have known if we were offering you a job]
- Fist Name:
- Last Name:
- Age:
- Sex:
- Country
- State, City, Zip
- Phone number (home and cell)
- Valid email address

NOTE!!!! the email address you use to contact us for the first time is: IBCGroup0@gmail.com , in the subject field put "interested".
[odd that the email address doesn't match the one you sent from]

Please, use only mentioned email address, otherwise we'll fail to receive your response.
Originating IP is 92.84.13.66 in Romania. Just say "no".