Facebook spam / scriptuserreported.org

This Facebook spam has undergone some sort of failure during construction, revealing some of the secrets of how these messages are constructed. It leads to malware on scriptuserreported.org:

Date:      Thu, 21 Mar 2013 10:56:28 -0500
From:      Facebook [update+oi=MKW63Z@facebookmail.com]
Subject:      John Jenkins commented photo of you.

facebook
   
John Jenkins commented on {l5}.
reply to this email to comment on this photo.
see comment
this message was sent to {mailto_username}@{mailto_domain}. if you don't want to receive these emails from facebook in the future, please unsubscribe.

facebook, inc., attention: department 415, po box 1000{digit}, palo alto, ca 9{digit}3{digit}

The malicious payload is at [donotclick]scriptuserreported.org/close/keys-importance-mention.php hosted on 5.39.37.31 and there are no surprises that this is OVH in France.. but wait a minute because this is in a little suballocated block thusly:

inetnum:        5.39.37.24 - 5.39.37.31
netname:        n2p3DoHost
descr:          DoHost n2 p3
country:        FR
admin-c:        OTC2-RIPE
tech-c:         OTC2-RIPE
status:         ASSIGNED PA
mnt-by:         OVH-MNT
source:         RIPE # Filtered

Let's start with the server at 5.39.37.31 which is distributing the Blackhole Exploit Kit (report here). This server also hosts the following potentially malicious domains:
pesteringpricelinecom.net
resolveconsolidate.net
scriptuserreported.org
provingmoa.com

Go back a few IPs to 5.39.37.28 and there is are a couple of work-at-home scam sites:
workhomeheres01.com
workhomeheres02.com

There's also a work-at-home scam on 5.39.37.24:
makeworkhome12.pl

5.39.37.26 appears to be hosting a control panel for the Neutrino Exploit kit:
myadminspanels.info
supermyadminspanels.info

So you can pretty much assume that 5.39.37.24/29 is a sewer and you should block the lot. Who is n2p3DoHost? Well, I don't know.. but there's one more clue at 5.39.37.29 which is the domain rl-host.net. The WHOIS details for rl-host.net are anonymised, but on the day of registration were:

    Queste Julien
    Email:julien@queste.fr
    50 rue Arthur lamendin
    62330 isbergues
    France
    Tel: +33.649836105

Does M. Queste own this /29? If he does, then it looks like he has some very bad customers..

Minimum blocklist:
5.39.37.31
pesteringpricelinecom.net
resolveconsolidate.net
scriptuserreported.org
provingmoa.com

Recommended blocklist:
5.39.37.24/29
makeworkhome12.pl
myadminspanels.info
supermyadminspanels.info
workhomeheres01.com
workhomeheres02.com
rl-host.net
pesteringpricelinecom.net
resolveconsolidate.net
scriptuserreported.org
provingmoa.com

PPI scam: 0843 410 0078

Short version: 
If you're Googling this number to see who is ringing you, then the short answer is that it is a bunch of scammers trying to get you to make a PPI refund claim. If you end up speaking to a human, then you can either ask them to "remove and suppress" your number, alternatively you can just tell them to fuck off (as there's no real reason to be polite with them).

Long version:
Despite a massive fine handed out to some SMS spammers for pushing PPI and ambulance chasing spam, there are still others about.

One particularly common on is to be called with a recorded message about a PPI refund, and then being given the opportunity to press "5" to connect to an operator.

So, I got one of these today from 0843 410 0078, a number allocated to Jtec UK Ltd (although they are probably just the telecoms provider). It seems that this number block is stuffed full of telepests.

Now, this isn't just spam.. it's a scam. Firstly, I'm not eligible for any PPI refunds, but the scammers are encouraging you to make a fraudulent claim regardless. They're just interested in selling your lead on to the next level in this very seedy world of PPI refund claims.

My conversation with the lady scammer went something like this:

Me: So I'm due a PPI refund am I?

Scammer: Yes, our records indicate that you may be eligible for a refund.

Me: Oh yes? You have records?

Scammer: Yes.

Me: So then, please tell me what my name is.

Scammer: We don't have that information for data protection reasons. [Yeah, but you have my financial records and telephone number, so really you are lying, aren't you?]

At which point I got bored and suggested that the woman fucked off and never called me again, at which point she hung up. I really do recommend being rude to these people incidentally. If you can ruin their afternoon and make them feel shitty about themselves then it's a small victory, they are willing participants in the scam after all.

The problem is that the people working at lead generation at this level will NEVER reveal who they are, and by the time the PPI claim has gotten to someone higher up in the food chain then the lead has been laundered through several middlemen.

Registering with the TPS isn't always as effective as you might think. Mobile numbers seem to expire after a year and need renewing (don't forget, the TPS is run by marketers). If you are TPS registered and still get bombarded with PPI scam calls, then you can try filing an ICO complaint. Or you could try doing it this way. But please remember, if you can make the telepests upset for the whole afternoon then it might make them reconsider their bad career choices..

If you find out who these pests are, or come across any other numbers, please consider sharing them in the Comments. Thanks!

These other numbers appear to be related:
0843 410 2215
0843 410 2576
0843 410 4770
0843 410 0269 (claimed to be from a nonexistant company called "PPI Assistance")

This is the same scam, but may be a different outfit:
01277 509018

"Your Job Application is Pending" / rockingcreditoffer.com scam

We've seen a variant of this "Rock Force Management" scam a couple of times before (here and here).

Date:      Sun, 3 Jun 2012 21:04:25 +0200
From:      "Gracie Vega" [bog@cerex.com]
Subject:      Your Job Application is Pending

Hello Advantage


Thank you for submitting your information for potential employment opportunities.
We look forward to reviewing your application,
but can not do so until you complete our internal application.

Prior to begin able to be considered, you will first need you to formally apply.
Please go here to begin the process:

http://5url.net/e7D

Also, the following perks are potentially available:

- Paid Time Off
- Health Benefits Package
- Higher than average salaries
- Tuition Reimbursement
- Extensive 401(k)program

Please take the time to follow the directions and complete the entire application process.

---------- 

Then we get bounced through a series of redirectors:
5url.net/e7D  ->
xkteen.com.br/conlact.php?c=rockingcreditoffer&t=com?dejaryfi ->
rockingcreditoffer.com?dejaryfi

One characteristic of these scam pages is the number "(240) 718-4632" which is displayed on each one.

After filling in some basic details, the scam starts to become clear.

All job applicants on this site are now required to check their credit score online and submit them here in order to proceed.


The purpose of this verification is to prevent fraud and authenticate the profile of all our applicants. Please take note this is a verification process only and the result of your credit score will not in any way affect your job application. We just need to know that you are a real person.

There's a button labelled "Please click here to obtain your credit score (Authorized Credit Retrieval Agent)" which is this case leads to a 404 page, but before we have seen it going to a get-rich-quick scam page instead.

The problem is that by the time the scam becomes apparent, you have already furnished the scammers with your personally identifiable information which they will sell on to other scammers and spammers.

In this case the originating IP was 222.253.76.159 in Vietnam, the rockingcreditoffer.com scam site was hosted on 91.217.162.100 (Voejkova Nadezhda, a Russian firm hosting across the border in Ukraine). Give this one a wide berth..

24by7technohelp.com / 24by7onlinesolution.com scam

Technical support scammers call the wrong person in this video..

The website involved is 24by7technohelp.com (there is another site on the same server called 24by7onlinesolution.com doing the same thing). These sites are hosted on 208.91.199.77 (Confluence Networks, British Virgin Islands). I've had the Confluence Networks range of 208.91.196.0/22 blocked for some time with no ill effects..

More on this story here.

[Via]

Scamworld: 'Get rich quick' schemes mutate into an online monster

Here's a long and very detailed article from The Verge on how the current crop of get-rich-quick schemes on the Internet work. If it's a case of tl;dr then you can get a flavour of it from this video:

Scam: RockSmith Management / rocksmithmanagement.com

This scam has been around for a while, it's part of a nasty cluster of scam sites that have an Australian connection.

The spam comes from a fake address, delivered from an illegally compromised PC. In this example, the spam appears to come from mulattorcxf826@uncw.edu (which is fake) through a well-known spam server in China, 221.212.109.135. Of course, faking the sender address breaks the CAN SPAM act in the US (where the sender pretends to be), as does the lack of real contact details.

Date:      Sat, 3 Dec 2011 11:15:17 +0800
From:      "Ralph Nguyen" [mulattorcxf826@uncw.edu]
Subject:      Please Complete Your Job Application

Dear Applicant

Thank you for expressing your interest in open employment openings in your area.
We are happy to inform you that our placement specialists will be reviewing
available positions for you within the next hour.

Based on your profile, you may qualify for opportunities currently available with a monthly salary in the
$4000 to $8700 range.

To maximize your earnings potential, please complete our full application form first:

http://go.likejav.com/9bcf1f

In addition to a highly competitive base pay, applicants that qualify will also enjoy additional benefits such as:
* 2 wks. paid vacation time (per annum);
* Tuition allowance;
* 401(k)
* full benefits package
* generous retirement plan

To retain your priority placement, please complete your application at your earliest convenience.

We look forward to finding the right job for you.

Rockforce Management
Bringing the best candidates and the right jobs together.

The link forwards to rocksmithmanagement.com (but it could be any one of a variety of similarly named scam sites), as listed here. 


Of note is the phone number on the first screen - (240) 718-4632 is listed in a number of similar scam sites. I don't know if it is valid or not, it might even belong to a legitimate company. There is no point in ringing it in any case as the scam unfolrd..

The next page is more worrying as it harvests personal details such as your name, phone number and email address. Yes, that would be acceptable for a job site.. but these details are not used at all by this process, so presumably they will be used for spamming purposes.

Once you have signed away your personal details, you get to the "final step" which offers you the chance o check your credit report or view the jobs on offer. On the bottom of the page is a "Privacy Policy" and "Terms of Service" link.. except they aren't links at all, just underlined text. In fact, there is no privacy policy or identifying text anywhere on the site.


If you click on the prominent "Clicking Here" link, you get redirected through referer.us/moxiinternal.go2cloud.org/aff_c?offer_id=2&aff_id=1002&aff_sub=020 to a site called sixfigurekit.com run by an outfit called the "Six Figure Program". The BBB rates the Six Figure Programs as an F in Florida, an F in Illinois but bizarrely a B in New York. On balance it looks pretty poor.

Regardless of where or not the Six Figure Program is a legitimate business or not, it certainly isn't a credit check.. and in this case the spam victim has been duped into clicking the link in order to be exposed to this frankly ridiculous scheme.


So what happens if the victim clicks on the other link on the page? They simply get redirected to a page on indeed.com (branded "RockGrade Management" / rockgrademanagement.com) which returns exactly the same results as if the victim had gone directly to indeed.com in the first place.

But wait.. remember the name, phone number and email address you supplied? What happened to them? They're not needed for indeed.com, so it looks likely that the victim has just given themselves up for even more spam.


All the evidence that I have been able to find links this to a site called websitedesignbrisbane.org in Australia. You can complain about Australian companies at ACMA, although it is difficult to identify exactly which company runs that particular site, but it bills itself as "Jetstream Web Site Design + SEO", presumably of Brisbane.

Scam: "Conference on racism/human trafficking and child abuse 2011"

This fake conference is actually likely to be a form of advanced fee fraud:

From: Ms Regina Linus reginafedrick@yahoo.com
Reply-To: regina.linus200@globomail.com
Date: 5 October 2011 19:53
Subject: Conference on racism/human trafficking and child abuse 2011,,,,,,,,,,
   
Dear Colleagues,

You are cordially invited to participate in a Global Combined conference taking
place from (22ND-25th November 2011) in Atlanta-Georgia, United States of
America at the Hilton Atlanta Conference Center, and from (28th-30th
November2011) in Olympic Stadium Hall Dakar Senegal.

Applicant that are interested and want to represent his/her country should
Contact the conference secretariat via Email :{ csecretaryoffice@aol.com }
{giyf.newoffice@globomail.com } for more details and Information.

Endeavor to inform them that you were invited to participate by (Ms. Regina
Linus). Note that the Organizing Committee is responsible for the air
tickets, visas and lodging accommodation in USA only.

Sincerely Yours,
Ms. Regina Linus.
(regina.linus200@globomail.com)

Of course, there will be "problems" with the Senegal leg which will require a fee payment in advance, and the Atlanta part of the conference will never materialise. If you actually are involved in stopping racism, human trafficking and child abuse then consider just what scumbags these scammers are.

Mail is routed via 41.207.177.16 in Togo from an ADSL subscriber in Dakar (Senegal). Two sample originating IPs are 41.82.79.108 and 41.82.64.163.


Avoid.

lastest-skype-updates.com spam

Here's a spam with a twist.

From: Skype.com skype@[spammer's email redacted for legal reasons]
Reply-To: newsletter@skype-systems.com
Date: 29 September 2011 07:23
Subject: New Updates Have Been Released For Skype ! Download Now‏

This is to notify that new updates have been released for Skype.

http://www.lastest-skype-updates.com/

Following are major new features :

* Up to 5-way group video call.
* Redesigned calling experience.
* Improved video snapshots gallery.
* Improved browser plugins performance on some websites.
* Reduced false positives on browser plugin phone number recognition.
* New presence icons.
* Improved handling of calling attempts made when the user has run out of credit.
* Improved access to sharing functionality

To download the latest version , go to :

http://www.lastest-skype-updates.com/

Start downloading the update right now and let us know what you think
about it.

Talk soon,

The people at Skype

The email has been sent to an address harvested from the Epsilon data breach. That's not surprising.. what is surprising is that it has been sent through a UK company that specialises in selling mailing lists and sending bulk commercial email. Perhaps dealing in stolen data is an honest mistake, but perhaps the ICO would like to make that determination.

DNS resolution for this site seems to flip between 87.106.104.178 [1&1, UK] and 122.224.4.108 [Ninbo Lanzhong Network Ltd, China]. Of these, the Chinese address is the most interesting with the follow slimeware domains hosted:

2011-skype-software-download.com
2011-skype-software-download.net
2011-skype-software-download.org
2011-skype-software-update.net
2011-skype-software-upgrade.com
2011-skype-software-upgrade.net
2011-skype-software-upgrade.org
adobe-acrobat-reader11.com
adobe-acrobat-reader11.net
adobe-acrobat-reader11.org
adobe-acrobat11-download.com
adobe-acrobat11-upgrade.com
adobe-pdf-reader11.com
adobe-pdf-reader11.net
adobe-pdf-reader11.org
adobe-reader11-download.com
adobe-reader11-upgrade.com
adobemailer.org
official-2011-skype-download.com
official-2011-skype-update.com
official-2011-skype-upgrade.com
official-skype-download.com
official-skype-software.com
official-skype-update.com
skype-software-downloads.com
skype-software-downloads.net
skype-software-downloads.org
skypemailer.com

If you live in the UK and have the technical expertise to identify the owner of the sending IP address, please consider filing a complaint with the ICO to make sure that they understand the issue.

Fake "internationalservicecheck.com" email

International Service Check (internationalservicecheck.com) is a legitimate mystery shopping company based in Germany. This email claims to come from International Service Check, but does not and it will be some sort of mystery shopping scam instead.

From: INTERNATIONAL SERVICE CHECK / Multisearch GmbH <shopping@internationalservicecheck.com>Subject: Application for New Mystery Shoppers.
Date: 12 Sep 2011 17:10:21 -0500
Reply-To: adele.green@aol.com

We have a mystery shopping assignment in your area and we would like you to participate"

INTERNATIONAL SERVICE CHECK / Multisearch GmbH is accepting applications for qualified individuals to become mystery shoppers. Its fun and rewarding,
and you choose when and where you want to shop. You are never obligated to accept an assignment.
There is no charge to become a shopper and you do not need previous experience. After you sign up, you will have
access to training materials via e-mail, fax or postal mail.

ABOUT US

INTERNATIONAL SERVICE CHECK / Multisearch GmbH is the premier mystery shopping company; serving clients across America with over 500,000
shoppers available and ready to help businesses better serve their customers. Continual investment in the latest internet and
communication technologies coupled with over 16 years of know-how means working with INTERNATIONAL SERVICE CHECK / Multisearch GmbH is a satisfying and
rewarding experience.

Secret shopping as been seen on ABC NEWS, NBC NEWS, L.A.TIMES.
Mystery Shopping provides an insight into what happens when hard won prospective buyers are in contact with your sales and
customer service teams. INTERNATIONAL SERVICE CHECK / Multisearch GmbH’s range of Mystery Shopping services cover every aspect of the customer experience –
on-site and face-to-face, on the telephone and electronically, through your website.

We conduct evaluations by personal visits and/or by E-mail. "Mystery Shoppers" are independent contractors that conduct
"shops", complete online evaluation forms and get paid "per assignment".
We consider our shoppers part of our extended team. Most of our staff, including management, still Mystery Shop
and are aware of the challenges and rewards. We negotiate the best possible compensation for our
shoppers and will not accept business that is unfair to our team. If we wouldn't accept the shop, we don't expect you to.

Stores and organizations such as The Gap, Wal-Mart, Pizza Hut, and Bank. One amongst many others pay for Secret Shoppers to
shop in their establishments and report their experiences. On top of being paid for shopping you are also allowed to keep
purchases for free. INTERNATIONAL SERVICE CHECK / Multisearch GmbH NEVER charge fees to the shopper. Training, tips for improvement, and shopping
opportunities are provided free to registered shoppers. Mystery shoppers are either paid a pre-arranged fee for a particular shop, a
reimbursement for a purchase or a combination of both.

We boast super fast payouts and expect high quality reporting in return to keep our clients satisfied.

We hold a strong belief in the fact that nothing is more important than the customers perceptions and this can
only be realized using "real consumers" (YOU) to perform evaluations. The same cannot be said for using
industry insiders or people from within the company, as their opinions are naturally subjective and biased. The
only opinions that count are ones of real consumers since they are the ones making purchases.

You will be required to interact with the shop clerk.

The assignment will pay $150 per assignment

If you feel you are a good candidate, then fill out the application form below
to this email (adele.green@aol.com) and we will get back to you shortly with the assignment:

PERSONAL INFORMATION:

Full Name :
Street Address:
City:
State:
Zip Code:
Cell Phone Number:
Home Phone Number:
Age:
Current Occupation:
Email Address:

AVAILABILITY:

Days/Hours Available

Monday.............................................
Tuesday.............................................
Wednesday.............................................
Thursday.............................................
Friday.............................................
Saturday.............................................

Hours Available: from _______ to ______

We await your urgent response.

Sincerely yours,
Adele Green.
© 2011 INTERNATIONAL SERVICE CHECK / Multisearch GmbH   All Rights Reserved.

If you accept this job offer, then you will not be dealing with International Service Check.

The email originates from a server at 70.32.113.152 which belongs to Fivecube Pte in Singapore (the server is physically in California), although most likely this is either a compromised server or a customer. An examination of the mail headers indicate that it may originate from 69.92.92.47, a Cable One subscriber in Seminole, Oklahoma. The Reply-To address is adele.green@aol.com althought this is probably fake, so do not assume that it really is someone of that name behind it.

dpolg-bundespolizei.org is not DPolG or the Bundespolizei

DPolG is a staff a association of the German Federal Police (Bundespolizei). So you might expect that dpolg-bundespolizei.org is something to do with the DPolG.. especially when the www.dpolg-bundespolizei.org resolves to 77.87.229.14, which is the same IP address as bundespolizei.de which is the German Federal Police.

But something is very wrong with this domain.Let's start with the WHOIS details:

Domain ID:D163178250-LROR
Domain Name:DPOLG-BUNDESPOLIZEI.ORG
Created On:30-Aug-2011 11:02:35 UTC
Last Updated On:30-Aug-2011 11:02:35 UTC
Expiration Date:30-Aug-2012 11:02:35 UTC
Sponsoring Registrar:Regtime Ltd. (R1602-LROR)
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:CO1014850-RT
Registrant Name:ALex Potolot
Registrant Organization:ALex Potolot
Registrant Street1:49-12 Shepherd Street
Registrant Street2:
Registrant Street3:
Registrant City:London
Registrant State/Province:London
Registrant Postal Code:W12 7HF
Registrant Country:GB
Registrant Phone:+44.2073290240
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:apotolot@yahoo.com

It's kind of odd that a German police domain should be registered to a person in the UK using a free email address. But what is odder is that the address does not exist. Although there is a Shepherd Street in London, the postcode is not W12 7HF, that's the postcode for Stanlake Road in Hammersmith. Shepherd Street's postcode begins W1J 7Jx in any case, and there's no number 49 on that road (it is approximately the location of the Park Lane Mews Hotel).

Let's check the nameservers:

Name Server:NS1.NAMESELF.COM
Name Server:NS2.NAMESELF.COM

Nameself.com is DNS service for Russian registrar WebNames.ru. (aka Regtime Ltd) who are also the domain registrar. Why would the German police use a Russian registrar?

The next clue is in the MX handlers - these are the servers that handle mail for dpolg-bundespolizei.org:

  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 20 ALT1.ASPMX.L.GOOGLE.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 20 ALT2.ASPMX.L.GOOGLE.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 30 ASPMX2.GOOGLEMAIL.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 30 ASPMX3.GOOGLEMAIL.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 30 ASPMX4.GOOGLEMAIL.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 30 ASPMX5.GOOGLEMAIL.COM
  dpolg-bundespolizei.org MX (Mail Exchanger) Priority: 10 ASPMX.L.GOOGLE.COM

So, the domain is using Google for mail handling. DPolG use their own mailservers, not Google.

Something is definitely amiss here, and it wouldn't be the first time that the Bundespolizei name was used for malicious purposes as there has been a recent rash of malware using it. On balance, a domain with a fake UK address registered via a Russian registrar and using Google for mail handling is unlikely to be legitimate. Avoid.

Fake job domains 30/7/11

Six new fake job domains today to avoid:

allnew-careers.com
argentina-hire.com
career-lists.com
career4your.com
world-career.com
your-careers.com

The recent approach has been to spam out emails that appear to be "from" the recipient. Sometimes the emails are poorly translated into Spanish, Portuguese or Greek.

The "jobs" on offer are illegal activities such as money laundering and form part of this very long running scam that has been going on for at least two years.

The domain registrant details are fake:

Alexey Kernel
    Email: johnkernel26@yahoo.co.uk
    Organization: Alexey Kernel
    Address: Kreshchatyk Street 34
    City: Kiev
    State: Kiev
    ZIP: 01090
    Country: UA
    Phone: +38.00442794512 

Mail for these domains is being routed through mx.yandex.ru in Russia.

These job offers are completely bogus and could land you in serious trouble with the police. If you have an example email using one of these domains, please consider sharing it in the Comments. Thanks!

"Iranian" Advanced Fee Fraud

Claiming to come from Iran, but actually originating from 115.249.131.254 in India, this allegedly Iranian scam is just a new twist on the Nigerian 419 scams that we are all familiar with.. in other words, this is an advanced fee fraud.

From: Ghohestani Hananehsadat Seyedhemed 115.249.131.254@webmail.sphpl.com
Reply-To: iranianhananehsadat@gawab.com
Date: 29 July 2011 07:55
Subject: FROM IRAN.....
   
         My name is Ghohestani Hananehsadat Seyedhemed; I was born in Mashad, Iran on 05th March 1991 to Mr and Mrs G. Seyedhemed, who dead in the January 2011 plane crash in Iran that killed more than 80 people including my Father, Mother and younger brother Ali.
http://www.ndtv.com/video/player/news/nearly-80-killed-in-iran-plane-crash/186668

 My father was a retired nuclear scientist and has worked in different project in Iran and outside Iran but lately there was a spate of serial killings of Iranian nuclear scientist and my father knew about it and was making arrangement for our trip and relocation to a foreign country and me and my brother was issued international passport on 15th July 2010 in preparation for our relocation and my father also made a deposit in a foreign bank amounting to $24,500,000USD(Twenty Four Million Five Hundred United States Dollars) for the settling in another country.

 Since my father died i have been trying to get the funds because i have the deposit documents and contact of his Lawyer who i have spoken with just after my fathers death but as a single lady in Iran you just cannot do anything on your own, you are not allowed to travel out of Iran and moreover with no access to telephone or constant internet. My father’s family took all that my father had here in Iran and forced me into marrying my father’s Friend when i disagreed initially they beat me and said as a single girl i cannot stay alone so i had no choice than to marry him. My life is really miserable because i am not allowed to go out, have visitors or use the phone.I have lost my pride as a woman. Luckily for me, my husband has a daughter my age and she allows me use her computer when she is around actually not knowing what i do here.

 Please i am contacting you in the Name of Almighty Allah who i serve and who my family serve to help me in getting these funds. All you need to do is stand as my family member and be next of Kin because the Lawyer told me then to suggest anybody who can stand as the next of kin and he will prepare necessary document but i cannot bring anyone from my father’s family since all they want is to claim my father’s property.

 I will send you the deposit certificate and the Lawyers contact so that you can make urgent contact with him. I will also send you my ID or passport for Identification if you need that. You may wonder why i am contacting you, a complete stranger but i trust you more than my father’s brothers who has done no good but harm to me and i know that you will not disappoint me too because i have gone through nights of prayers just to locate a reliable person who can help me out of this problem.

 I will need you to reply me with your details as follows to (iranianhananehsadat@gawab.com)

Name.................................
Address.............................
Phone number........................
Age.................................
Sex.................................
Occupation..........................
Email:..............................


 As soon as the money is transferred to you. We shall share the total amount 60% for me and 30% for you and 10% for any expenses incurred during this transaction. I want to use my share to get out of Iran and invest in a foreign Country. I hope to hear from you as soon as possible and may Allah bless you and your family.


Respectfully,
Ghohestani Hananehsadat Seyedhemed

Avoid.

Fake jobs: chile-hh.com, cl-joblists.com, pt-joblist.com and spain-joblist.com

Four new fake job domains today, targeting victims in South America, Spain and Portugal.

chile-hh.com
cl-joblists.com
pt-joblist.com
spain-joblist.com

These domains were all registered in the past few days. The standard email approach seems to be "from" the victim, and they are often badly translated into Portuguese and Spanish.

The "jobs" on offer are not jobs at all, they usually involve money laundering and other criminal activities. They form part of this very long running scam that has been going on for years.

Three of the four domains have a new (fake) registrant that we haven't seen before:

Alexey Kernel
    Email: johnkernel26@yahoo.co.uk
    Organization: Alexey Kernel
    Address: Kreshchatyk Street 34
    City: Kiev
    State: Kiev
    ZIP: 01090
    Country: UA
    Phone: +38.00442794512 

If you have an example email, please consider sharing it in the comments.

Fake jobs: trabajo-lista.com

A single fake domain today, trabajo-lista.com uses the same approach as yesterday's domains, again targeting Spanish language speakers with money laundering jobs and other illegal activities.

Emails will most likely appear to be "from" yourself. This particular scam has been going on now for several years.

If you have a sample, please consider sharing it in the Comments. Thanks!

Fake jobs: chile-hh.com, cv-trabalho.com, espana-hh.com and worldjoblists.com

These domains are being used to advertise fake jobs and appear to be targeting Spanish and Portuguese speakers. They form part of this long-running series of domains associated with fake job offers.

chile-hh.com
cv-trabalho.com
espana-hh.com
worldjoblists.com

The jobs being offered are typically money laundering (lavado de dinero / lavagem de dinheiro) which are highly illegal. It is possible that some other jobs offered may be "back office" functions, including translation into local languages.

The domains are very new, registered in the past two days to:

Ricardo Lopez
    Email: ricardolip2@yahoo.com
    Organization: Ricardo Lopez
    Address: ul. Liivalaia 34-10
    City: Tallin
    State: Tallin
    ZIP: 15040
    Country: EE
    Phone: +3.726317190 

If you have any examples of mail using these domains, please consider sharing them in the Comments section. Thanks.

Fake jobs: eur-exlusive.com

Another addition to this series of fake job offers is the domain eur-exlusive.com.

Assuming that this follows the standard pattern of dozens of other domains, then these will be too-good-to-be-true job offers that appear to have been emailed "from" yourself. The jobs on offer will actually be money laundering or some other criminal activity.

The domain was registered on 23th July, to a fake registrant "Ricardo Lopez", allegedly from Estonia. Avoid at all costs.

If you have a sample, please consider sharing it in the Comments.

Fake jobs: world-chilecv.com

Just a single fake job domain today, world-chilecv.com is an addition to this long-running series of so-called job offers which actually turn out to be money laundering or some other criminal activity.

The domain in question was registered just yesterday to the no-doubt fake reigstrant:

Ricardo Lopez
    Email: ricardolip2@yahoo.com
    Organization: Ricardo Lopez
    Address: ul. Liivalaia 34-10
    City: Tallin
    State: Tallin
    ZIP: 15040
    Country: EE
    Phone: +3.726317190 

This domain was registered only yesterday. Avoid.

Fake jobs: eur-cvlist.com, gr-hire.com and world-cvlist.com

Three new fake jobs domains following this pattern, offering bogus jobs which will actually turn out to be money laundering or some other criminal activity.

eur-cvlist.com
gr-hire.com
world-cvlist.com

One characteristic of recent emails is that they appear to come "from" the recipient, as the spammers have forged the "from" field (which is very easy to do).

The registrant details for the domain are no doubt fake:

    Ricardo Lopez
    Email: ricardolip2@yahoo.com
    Organization: Ricardo Lopez
    Address: ul. Liivalaia 34-10
    City: Tallin
    State: Tallin
    ZIP: 15040
    Country: EE
    Phone: +3.726317190 

The domains were registered two days ago on 15th July. If you have samples of spam using these domains, please consider sharing them in the comments.

Fake jobs: cl-exlusive.com, europ-exlusive.com, totalworld-job.com, uk-cvlists.com and uk-exlusive.com

Five new domains offering fake jobs (actually money laundering and other illegal activities), forming part of this long running series of scams.

cl-exlusive.com
europ-exlusive.com
totalworld-job.com
uk-cvlists.com
uk-exlusive.com

The domains were created yesterday, registered to a no-doubt fake registrant:

Registrant:
    Luca Drue
    Email: lucadrue@yahoo.fr
    Organization: Luca Drue
    Address: 27, BERESTYANSKAYA STR
    City: Minsk
    State: Minsk
    ZIP: BY-220123
    Country: BY
    Phone: +37.5172749317
    Fax: +37.5172749311

If you have a sample email soliciting replies to one of these domains, please consider sharing it in the comments.

Fake jobs: job-britain.com and job4america.com

Two new fake job domains that form part of this long-running series, job-britain.com and job4america.com are pushing fake job offers which will actually be illegal activities like money laundering.

These domains were registered just yesterday to a fake registrant called "Leonid Pravduk". Avoid.

If you have samples of the spam emails using these domains, please consider sharing them in the comments.