Rev2Share.com spam

Following one a day from this almost identical MySuperShares.com spam, this email also appears to be trying to game a "get rich quick" MLM scheme with fake signups.

From: Rev2Share.com <admin@rev2share.com>
Reply-To: admin@rev2share.com
Date: 29 October 2010 05:24
Subject: Welcome to Rev2Share.com!
   
Dear member,

Welcome to Rev2Share.com!
We are pleased that you have decided to join our fast growing community.

You can now login to your account at:
http://www.rev2share.com/login.php
Your Username: 0000_000
Your Password: 0000000

We hope you have a great time at Rev2Share.com.

Administrator
Rev2Share.com

It's not a Joe Job as such, the email originates from 174.122.225.73 which is the same server that Rev2Share.com is hosted on along with a bunch of shabby MLM sites. The domain was registered just days ago, the WHOIS details seem to be accurate:

Domain name: rev2share.com

Registrant Contact:
  
   Dustin Langley ()
  
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Administrative Contact:
  
   Dustin Langley (dustin.langley@gmail.com)
   +1.615347925
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Technical Contact:
  
   Dustin Langley (dustin.langley@gmail.com)
   +1.615347925
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Status: Locked

Name Servers:
   ns1.hostingmmt.com
   ns2.hostingmmt.com
  
Creation date: 25 Oct 2010 16:18:00
Expiration date: 25 Oct 2011 11:18:00



The physical address checks out, it would be highly unusual for a deliberate scammer to post their real address (even if most MLMs do turn out to be scams in the end). So it does appear that a third party is involved, using Rev2Share.com's own systems to generate fake signups, either to shut the site down or to game the system for personal profit.

It is probably no coincidence that both Rev2Share.com (hosted on 174.122.225.73) and MySuperShares.com (174.122.14.227) have an almost identical business model that claims to be selling advertising (only on their own sites) but in fact concentrates on getting signups to generate a download instead. When you see a very thin product offering like this with an emphasis on recruiting other people, then that it usually a bad sign.. best to avoid it altogether in my opinion.

MySuperShares.com spam

In my view, all MLM schemes are almost always scams.. and MySuperShares.com seems to be just another MLM scheme, this time selling "ads" that only seem to display on the MySuperShares.com site. But the real carrot is the promise of downlines if you sign someone else up.. in other words, a thin product offering with a concentration on signing up other members rather than selling a real product.

The scheme itself is based in Australia, and I am no expert in Australian law. So, let's assume that this type of MLM scheme is legal in Australia for now.

Still, this particular email seemed unusually brazen..

From: MySuperShares.com <webmaster@mysupershares.com>
Reply-To: webmaster@mysupershares.com
Date: 28 October 2010 13:30
Subject: MySuperShares.com Confirmation Email
   
Dear 4612_210 4080_759,

Thank you for creating your account with MySuperShares.com.

To activate your account, please click the link below:

http://www.mysupershares.com/confirm.php?username=0000_000&id=00000

Once you have completed this step, you will be able to
login to your account.

Kind regards

Eva Browne-Paterson & Jullieanne Matheson
MySuperShares.com

The originating IP is 174.122.14.226, MySuperShares.com is hosted on 174.122.14.227 (i.e. the next IP address), so it indicates that the mail is genuinely from MySuperShares.com. Let's look at the WHOIS details for that domain:


Registrant:
   EvieB.com
   1 Keswick Island Drive
   Keswick Island, Queensland 4740
   Australia

   Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
   Domain Name: MYSUPERSHARES.COM
      Created on: 13-Oct-10
      Expires on: 13-Oct-11
      Last Updated on: 13-Oct-10

   Administrative Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      EvieB.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      Australia
      411569782      Fax -- 749658019

   Technical Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      EvieB.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      Australia
      411569782      Fax -- 749658019

   Domain servers in listed order:
      NS1.MYFREESAFELIST.COM
      NS2.MYFREESAFELIST.COM


It's unusual for fraudsters to include their real contact details in the WHOIS, in fact everything checks out as being legitimate, it you check out the MLM business model.

There are a few possibilities:

1. The people running the site are really stupid and think that this is a good way to get signups (rather than getting your site nuked)
2. Someone is using MySuperShare.com's own system to perform a Joe Job with deliberately false signups.
3. Someone thinks that they can make money by gaming MySuperShare.com's system with fake signups.

My best bet is that it is the #2 or #3 option, because I really don't think that the site operators are so stupid as to try spamming like this. Does that mean that it is a legitimate programme? Well, put it this way.. do you really think that it is feasible to make money by selling nothing of value?

Update:it does appear that someone is targetting these MLM "get rich quick" sites as another site called Rev2Share.com has also been hit.

Evil network: Alex Gorbunov / GORBY-VPN-NET AS51303 (195.226.197.0/24)

A small but nasty netblock hosting ZeuS C&C servers and Phoenix exploit kit attacks, GORBY-VPN-NET (registered to an Alex Gorbunov) seems to have no legitimate sites at all. There aren't a lot of sites in this range (I see just 24) but there does seem to be quite a lot of malicious activity. I recommend that you block access to 195.226.197.0/24.

RIPE says:

inetnum:         195.226.197.0 - 195.226.197.255
netname:         GORBY-VPN-NET
descr:           Alexandr Gorbunov
remarks:         MyVPN service
country:         UA
org:             ORG-AG58-RIPE
admin-c:         AG10224-RIPE
tech-c:          AG10224-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          GORBY-MNT
mnt-routes:      GORBY-MNT
mnt-domains:     GORBY-MNT
source:          RIPE # Filtered

organisation:    ORG-AG58-RIPE
org-name:        Alexandr Anatolyevich Gorbunov
remarks:         MyVPN service
org-type:        OTHER
address:         Moskva, Yasniy proezd 14a, kv. 73
phone:           +79025392311
admin-c:         AAG76-RIPE
tech-c:          AAG76-RIPE
mnt-ref:         GORBY-MNT
abuse-mailbox:   gorby@land.ru
mnt-by:          GORBY-MNT
source:          RIPE # Filtered

person:          Alex Gorbunov
address:         Moskva, Yasniy proezd 14a, kv. 73
phone:           +79025392311
nic-hdl:         AG10224-RIPE
mnt-by:          GORBY-MNT
source:          RIPE # Filtered

% Information related to '195.226.197.0/24AS51303'

route:           195.226.197.0/24
descr:           GORBY-AS Route Object
origin:          AS51303
mnt-by:          GORBY-MNT
source:          RIPE # Filtered

Google says of AS51303:

Safe Browsing
Diagnostic page for AS51303

What happened when Google visited sites hosted on this network?

    Of the 23 site(s) we tested on this network over the past 90 days, none served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2010-10-27, and the last time suspicious content was found was on 2010-10-27.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 5 site(s) on this network, including, for example, semikemi.info/, surogatesm.info/, meinisp.info/, that appeared to function as intermediaries for the infection of 16 other site(s) including, for example, vlasti.net/, inmobiliaria-habitat.es/, inoxmarti.com/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 15 site(s), including, for example, semikemi.info/, terikmask.info/, qstrokes.info/, that infected 176 other site(s), including, for example, montealea.com/, ideal.es/, crosswordscrucigramas.com/.

You can see a list of domains and MyWOT reputations here [csv], the current list of domains that I can see is below:

Hello-larry.com
Reklamaservice.org
Solarisgrand.net
Bungalougrand.net
Lintuage.net
Miksint.net
Mistiriks.net
Limpop.net
Gitrometro.net
Gennuine.com
Mussiss.com
Meinisp.info
Leimdungl.info
Terikmask.info
Traveldens.info
Simanticwerd.info
Balacenewiq.info
Afishatop.com
Afishaintop.com
Inafishatop.com
Kinakoi.net
Salimko.com
Simrako.com
Sipolin.net

"Bikini Robot Army" spam

I've never listened to Bikini Robot Army (although for some reason I have heard of them), but this spam run I was at the wrong end of did tempt me to give them a listen, if only to hear what a spammer sounds like.. basically pretty derivative and dull but somewhat technically competent. In other words.. it sounds like the musical equivalent of spam.

This email originates from 216.92.1.93 spavertising bikinirobotarmy.com on 216.92.45.18 plus a defunct Facebook page, MySpace page and Twitter account. Frankly I'd give them a miss if they have to resort to unsolicited bulk email to drum up interest.

Slightly amusingly, their spam has this line in it: Bill Gates - "I gave Bikini Robot Army YOUR email address!” - I don't think he did.

From: robotarmy-bounces@bikinirobotarmy.com [mailto:robotarmy-bounces@bikinirobotarmy.com] On Behalf Of Bikini Robot Army
Sent: 25 October 2010 19:40
To: robotarmy@bikinirobotarmy.com
Subject: [Robotarmy] Bikini Robot Army wants YOU!

Bikini Robot Army wants YOU!

If you love the Rolling Stones, Beatles, Bowie and Beck - you will love... Bikini Robot Army.

From the mouth of David Bowie (Digivegas, 2010)
"Bikini Robot Army is a wild new band - I've never heard a song like that before"
[Joe Strummer's House]

Joe Strummer's House is the new hit by Bikini Robot Army taking the UK by storm;
you can hear it on BBC Radio One and BBC 6.

Bikini Robot Army continues to tear like a tornado through the US!

Come join us! We want YOU!
www.bikinirobotarmy.com
Available at iTunes, Amazon and all online stores.

Remember, Bikini Robot Army LOVES YOU!

Follow us for updates and special guests, radio interviews, live shows etc
Plus FREE music, FREE merchandise and regular updates.

facebook.com/bikinirobotarmy
twitter.com/bikinirobotarmy
myspace.com/bikinirobotarmy

Thanks,
www.bikinirobotarmy.com.
Available at iTunes, Amazon and all online stores.

Any questions, comments or rants, please email us at info@bikinirobotarmy.com.

If you would like to unsubscribe, please email info@bikinirobotarmy.com with Unsubscribe in the subject.
--------------------------------------------------------------------------------------------------------------

50cent - "I only listen to Bikini Robot Army”

George Bush - “B.R.A. I never go running without Bikini Robot Army in my iPod”

Madonna - “Bikini Robot Army saved my life”

Elton John - “Bikini Robot Army made me gay!”

Keith Richards - "Who the F*@K is Bikini Robot Army?”

Richard Pryor - "Bikini Robot Army killed me!”

Superman - "Kryptonite? I don’t think so!”

Bill Gates - "I gave Bikini Robot Army YOUR email address!”

Bill Murray - "Stop asking me about Ghostbusters 3, I wanna hear the new Bikini Robot Army album!”

"america-newresume.com" scam

This scam has been around for a while, strangely it spells out "NB" in the full Latin of "Nota Bene". You don't see an awful lot of Latin in spam these days. Anyway, this is a fake job offer, most likely in money laundering or receiving stolen goods. Avoid

Re: CV 69

I’m addressing you on behalf of the HR department of a large company.

Our company takes an active part in the life of its subsidiaries, for example:
-property
- bank account operations
- transportation and logistics
- private enterprise service
- etc.

We have vacancies to be filled by Europe residents only:
- salary 2.600 euro + bonus
- underemployment
- flextime


If you are ready to work as a regional manager in Europe send us the below information: Dominick@america-newresume.com
First Name:
Last name:
Country of living:
City
E-mail:
Phone:



Nota bene! Only European residents are required !

Please provide us with your Personal data (Phone number and First and Last name) and our manager will contact to you to make a brief interview.

sshopper.net "mystery shopper" scam

We've seen this scam before, but this type the mystery shopper scam uses a domain of sshopper.net to solicit replies. Avoid.

Re: MS/Secret Shopper [$700/week]

Thank you for your interest in the MS Shopper position.
Our company conducts surveys and evaluates other companies in order to help them achieve their performance goals.
We offer an integrated suite of business solutions that enables corporations to achieve tangible results in the marketplace.

We get hired by other companies and act like customers to find out how they are handling their services in relation to their customers.
MS Shopping is the most accurate and reliable tool a business can use to gather information regarding their actual customer service performance at the moment of truth.
This moment of truth is not when the staff is on their best behavior because the boss is around - it is when they interact with customers during their normal daily routines.

This is where you, the MS Shopper, come in.
You pose as an ordinary customer and provide feedback of both factual observations (ex...the floor was free of debris)
and your own opinions (ex...I felt that the temperature in the establishment was too cold).

MS Shoppers must remain anonymous. You must act as a regular customer and be careful not to do anything that would reveal you as a shopper.
An inexperienced shopper could tip off the staff to his/her identity by asking for the manager's name for no clear or appropriate reason.
If you are going to be bringing someone with you on the shop, make sure you educate them about the process as well.
Beware that even whispers can be overheard by employees. If anyone notices you are a shopper,
you can bet that word will quickly spread around the establishment and you will get some of the best customer service in town.

No company can afford to have a gap between the promise of quality and its actual delivery, that's why leading corporations look to us,
the nation's premiere MS shopping and customer experience measurement company.

In order for a business to effectively compete in today's economy, they must be prepared to meet the challenge of increasing sales by:
* Retaining existing customers
* Acquiring new customers
* Creating word-of-mouth advocacy
* Improving customer loyalty

Once we have a contract to do so, you would be directed to the company or outlet, and you would be given
the funds you need to do the job(either purchase merchandise or require services), after which you would write a detailed report of your experience.

Examples of details you would forward to us are:
1) How long does it take to get served.
2) Politeness of the attendant.
3) Customer service professionalism.
4) Sometimes you might be required to upset the attendant, to see how they deal with difficult clients.

Then we turn the information over to the company executives and they will carry out their own duties in improving their services.
Most companies employ our assistance when people complain about their services, or when they feel there is a need for them to improve upon their customer service.
Our company partners with you to implement proven MS shop auditing and surveying strategies that provide critical information about customer experiences.

You will be paid a commission of $100 for every duty you carry out, and bonus on your transportation allowance.
Your task will be to evaluate and comment on customer service in a wide variety of restaurants, retail stores, casinos,
shopping malls, banks and hotels in your area.

Qualities of a good MS Shopper:
* Is 21 years of age or older
* Loves to go shopping
* Is fair and objective
* Is ON TIME
* Is very observant and able to focus on details
* Is fairly intelligent
* Has patience
* Is detail oriented
* Is practical
* Types well
* Is trustworthy
* Explains well in writing
* Is discreet
* Loves to learn
* Handles deadlines
* Has full internet access (at home or at work)

MS Shopping is fun and exciting but also must be approached very seriously and is definitely not for everyone.

If you are interested in applying for consideration as a MS Shopper do send in your information: Guadalupe@sshopper.net
Full Name:
Address:
City:
State:
Zip Code:
Phone Number:
Age:
Occupation:

As soon as we receive your information we will add you to our database and we will look for locations in your area that needs to be evaluated.

The possition is only available for United States.

Thank you,
Guadalupe VEYTIA

"MR.BANKY MOON" scam

This one is from "MR.BANKY MOON" who is apparently the "UN SEC.GENERAL.", but for some reason he's using a free Gmail address and is sending this email from Argentina. And an ATM card loaded with seven million dollars? If your ATM withdrawal limit is $500 per day, then it will take you 14,000 days (or 38 years, 4 months and 9 days) to get it out of the cash machine..

From: UN AUDIT DEPT. <morriswilliams01@ciudad.com.ar>
Reply-To: atmswiftdeptm@gmail.com
Date: 23 October 2010 07:15
Subject: ATM-001 CODE
UNITED NATIONS NATIONAL AUDIT OFFICE
BUCKINGHAM PALACE ROAD, VICTORIA
LONDON SW1W 9SP,
UNITED KINGDOM.


Attn: Beneficiary
We sincerely apologize for sending you this sensitive information via e-mail instead of a certified mail, phone call or a  face-to-face conversation, it is due to the urgency and importance of the security information involved. In the quest to cushion the effect of the global financial crisis, American government through the Federal Bureau of Investigation (FBI) Washington  DC, United Nations and the Internet Crime Complaint Center (ic3) has signed an agreement with Nigeria & EFCC for an immediate release of all overdue funds presently logged in their treasury and ensure it is disbursed to the rightful beneficiaries in any part of the world. If you the beneficiary would adhere to this notification it will help stabilize the various economies of the world and reduce the effect of this depressing recession.
Prior to this agreement our team of security experts has swung into action for transparency and accountability of this periodic project. The Federal Bureau of Investigation (Global Intelligence, Cyber Division) saddled with the responsibility of monitoring activities going on over the internet have discovered your name in the list of unpaid beneficiaries and it might interest you to know that we have conducted a comprehensive investigation on this discovery as stipulated on our protocol of operation and have confirmed that the funds was endorsed in your favor and it is 100% genuine and hitch free from all facets. You have the lawful right to contact the appropriate authority to claim your payment without further delay.
Under the Joint Regulatory Commission,we have appointed a sole fiduciary member of CBN that will handle the transfer of your funds through ATM CARD Payment. This card centre will send you an ATM CARD which you will use to withdraw your money in any ATM Machine located in your designation/any part of the world, the maximum amount to withdraw is three thousand dollars per day. Contact the below card payment centre for more details.
Contact person: Dr.Wilfred Bruce
Email: atmswiftdeptm@gmail.com
Tel: +2347037250822
Also send the below information to the above address to enable them start processing your ATM CARD.
1. Your full name
2. Phone number & fax
3. Address where you want them to send the ATM CARD
4. Your Age & Current Occupation
5. Attach copy of your Identification.
This ATM CARD payment centre has been mandated to issue out USD7, 000,000.00 as part payment for your Contract/Inheritance/Lottery Winnings for this fiscal year 2010. Also for your information, you have to stop any further communication with any other person (s) / office (s) to avoid any hitches in receiving your payment. For oral discussion, call or email back as soon as you receive this important message for further direction and also update me with the developments from the above mentioned office.
Note that because of impostors,we hereby issued you our code of conduct which is (ATM-001) so you have to indicate this code when contacting the card centre by using it as your subject.
Thanks.

MR.BANKY MOON
UN SEC.GENERAL.

Just silly really..

eu-ltk.com fake job offer

Another fake job offer (probably following on from this one), probably involving money laundering and other criminal support services.

Date: 22 October 2010 11:06
Subject: Civilities
   
This message was likely forged and did not originate from your account. Learn More
Greetings

I introduce a large multinational enterprise the co-worker of the HR department of which I am.

Our company takes an active part in the life of its subsidiaries, for example:
- real estate
- companies setting-up and winding-up
- bank accounts opening and maintenance
- logistics
- private undertaking services
- etc.

There are vacant positions of regional managers in Europe:
- salary 2.300 euro + bonus
- 2 - 3 working hours per day
- optimal timetable

If you are interested in this job, please, send us your contact information: Sam@eu-ltk.com
First Name:
Last name:
Country of living:
City
E-mail:
Phone:



We are looking for the people who have a right to work in Europe!

Please provide you name and contact information in order we can find you for further communication.

WHOIS details for the domain show the infamous info@JuliaNewYork76.com as the registrant.


Domain name: eu-ltk.com

Name servers:
    ns1.nameself.com
    ns2.nameself.com

Registrar: Regtime Ltd.
Creation date: 2010-10-19
Expiration date: 2011-10-19
Status: active

Registrant:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Administrative Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Technical Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756
Billing Contact:
    Julia Morgan
    Email: info@JuliaNewYork76.com
    Organization: MDS LTD
    Address: 201 Varick Street
    City: New York
    State: NY
    ZIP: 10014
    Country: US
    Phone: +1.8668402756 

Evil network: DG Holding SIA / ALTNET-LV AS41390 (195.3.144.0/22)

DG Holding SIA / ALTNET-LV is another evil network, and it's no surprise to see that it is in Latvia. The 195.3.144.0/22 hosts sites involved in hacking, malware distribution, MLM scams, fake goods and porn plus a number of ZeuS C&C servers.

There are a small number of legitimate customers in this block, but they most cater for Latvian users only.. if you are outside of Latvia, then very little will be lost by blocking this entire /22 (195.3.144.0 - 195.3.147.255).

There's a listing of domains, IPs and MyWOT ratings here [csv] if you want to probe more deeply and avoid blocking the handul of legitimate sites.. otherwise, I would recommend blocking the lot.

Evil network: MD-ISP-MONITORING, AS25129 (89.187.32.0/19)

AS25129 (89.187.32.0/19) features a lot of refugees from another evil network, Najada. There's nothing of value in this netblock, sites seem to feature illegal software, fake anti-virus, criminal support infrastructure, fake pharma sites and phishing.

The IP range is allocated to:

inetnum:         89.187.52.0 - 89.187.55.255
netname:         MD-ISP-MONITORING
remarks:         INFRA-AW
descr:           Hi-speed users
country:         MD
admin-c:         ABA3-RIPE
tech-c:          ABA3-RIPE
status:          ASSIGNED PA
mnt-by:          MONITORING-MNT
source:          RIPE # Filtered

person:          Alexander Basunov
address:         R&D Centre "Monitoring"
address:         Komsomolskaya 2a
address:         3200 Bendery
address:         Moldova
e-mail:          hostmaster@bendery.md
mnt-by:          MONITORING-MNT
nic-hdl:         ABA3-RIPE
phone:           +37377786335
source:          RIPE # Filtered

% Information related to '89.187.32.0/19AS25129'

route:           89.187.32.0/19
descr:           R&DC Monitoring, PA
origin:          AS25129
mnt-by:          MONITORING-MNT
source:          RIPE # Filtered

The myWOT reputation of these sites is very bad [CSV], my recommendation is that you block 89.187.52.0 - 89.187.55.255 (89.187.32.0/19) or alternatively null route the sites below.

Anonymousstats.com
Storageprotectorx.com
Hostlogarea.in
Blogblogfirst.in
Bestblogbest.in
High-blogicio.eu
High-blogster.eu
High-picicio.eu
Hostspacebest.in
Mega-blogster.eu
Mega-picicio.eu
Mega-picster.eu
Turbo-blogster.eu
Turbo-imagicio.eu
A-lot-of-appz.com
Activation-codes.net
Activationcrack.net
Any-filez.net
Check-4-apps.org
Crack-file.net
Crack-serial-numbers.net
Crack-usa.com
Crackandcrack.com
Crackcrack.net
Crackcrackcrack.net
Crackdelivery.net
Crackdownload.net
Crackkeys.net
Crackorginal.net
Crackpatch.net
Crackpatchkeygen.net
Crackprokeygen.net
Crackrapidshare.net
Cracks-explorer.net
Crackserialcode.net
Crackserialcodes.net
Crackserialkey.net
Crackserialkeygens.net
Crackserialkeys.net
Crackserialnumber.net
Crackserialnumbers.net
Crackshare.net
Cracktrial.net
Crackwin.net
Dlfeed.com
Downloadcracks.net
Fastcrack.net
Fileserialkey.net
Free-serial.net
Freecrackdownload.net
Freekeygencrack.net
Freeserialkey.net
Fullcrackserial.net
Fullkeygen.net
Fullserialcrack.net
Fullserialnumber.net
Fullserialnumbers.net
Getserial.net
Hosthosthost.net
Key-code.net
Keygen-crack.net
Keygen-serial.net
Keygenc.net
Keygencrackpatch.net
Keygenerators.net
Keygenforserial.net
Keygenkeygen.net
Keygenned.com
Keygenpatch.net
Keygens-for-soft.org
Keygenserialcrack.net
Keygenserialnumber.net
Keygenserials.net
Keygensite.net
Keygentrial.net
Keygenwin.net
Keyproduct.net
Killtrial.net
Licensekeygen.net
Maximumwarez.com
Microposters.org
Newserialcracks.net
Numberserial.net
Orginalcrack.net
Patchcrack.net
Registrationcode.net
Registrationkey.net
Registrationkeys.net
Seialkeymaker.net
Serial-codes.net
Serial-crack.net
Serial-key-generator.net
Serial-keygen.net
Serial-keygens.net
Serial-keys.net
Serial-number-crack.net
Serial-numbers-crack.net
Serialcodesfor.net
Serialcrackcodes.net
Serialcrackkeygen.net
Serialkeycodes.net
Serialkeycrack.net
Serialkeygencracks.net
Serialkeygenerator.net
Serialkeygenpro.net
Serialkeygens.net
Serialkeynumber.net
Serialkeynumbers.net
Serialnumbercode.net
Serialnumbercrack.net
Serialnumberfor.net
Serialnumberkeygen.net
Serialnumberscrack.net
Serialpost.net
Serialserial.net
Shared-fro-you.com
Shared-news.net
Soft-dont-stop.org
Softwareserialnumber.net
Softwareserialnumbers.net
Superpagehost.in
Thecrackserial.net
Trusted-warez.com
Vipcrack.net
Warezpad.net
Wincracks.net
Bestwebspace.in
Besthostfree.in
Gigimon.net
Beribegi.com
Beribegi1.com
Googlemaps5.com
Hostnetblog.in
Judatrafic.com
Trafficforalz.com
Trafficforalz.org
Blogareaweb.in
Hostfreearea.in
Firstblogbest.in
Bloghomelog.in
Netnetblog.in
Bestspacelog.in
Firstblogspace.in
Brendonlfile.org
Coderstrin.org
Codesfreling.org
Cripesload.org
Daungradeoffs.org
Falenslaodins.org
Flaasnesfile.org
Fre-lan-fileess.org
Freecodonlaans.org
Frefrefiless.org
Friilasopn.org
Frilandfile.org
Grandisfreshdown.org
Hostsuperarea.in
Internalsfile.org
Jebaunfols.org
Kachaenfailisi.org
Linefirtsfilee.org
Loadslinecod.org
Med-on-downl.org
Media-delison.org
Media-l-file.org
Medlinefils.org
Ogrisfile.org
Oldinfilefree.org
Onl-for-fils.org
Orange-flis.org
Organisupload.org
Qaredline.org
Qwerfileorg.org
Sigruiqwe.org
Skachfiles.org
Traedenopenres.org
Vades-loadec.org
Valdec-lains.org
Youfileoke.org
Allingspl.com
Superbestfirst.in
Allingtramp.com
Freespacehost.in
Statflus4.com
Webhosthost.in
Leninvgorkax.net
Storereturn.cc
Firstclassresults.cc
Fb-cdn1.com
Installs.tv
Msdefender2011.com
Creativetmx.com
Updatetechno.com
Zverolab.com
Mynewpass.com
Downloadcheapsoft.com
Trafficforalz.net
Z0g7yail0.com
Ebayinvoice.com
Ebayitemhosting.com
Paypal-moneypak-processing.com
Backstab.biz
Cardzone.cc
D-9.cc
Ebayitemhosting.net
Megavendor.biz
Check-crypt.com
Check-domain.cn
Samclubclearance.com
Sams-clearance.com
Samsclubcl.com
Samsclubsales.com
Start-domain.cn
Free-image-uploads.com
Human-nature.org
Imagesshack.net
The-imageshack.com
Gsm-seacher-v10.ru
Blackosogs.com
Riverchick.com
Gabstreamj.com
Ecurrencynews.org
Ancoraimages.com
Mmsbonus.com
Everydayer.com
Celebrition.com
Celebritylabor.com
Getimpressed.com
Goldouncemedia.com
Hollywoodmajestic.com
Lincolnfinserv.com
Mcknightportugal.org
Metacaffe.info
Misteriks.net
Nanosolutionssoft.com
Peksone.net
Peree.ru
Tv-onlines.net
Tv-world-online.net
Vaulttech13.cn
Webarh.com
Vk-base.org
Vksledi.ru
Aniroti.com
Aniroti.net
Pharmpills.net
Mediashares.org
Video-shares.com
Video-shares.net
Videoall.net

Attorney scam: Oak Spring Canola Farms

This is a type of scam email that I haven't seen before, in this case targetting lawyers.. especially dumb ones (and I certainly have seen a lot of those before).

From: Thomas Shepherd <oakspringcanolafarms@hotmail.com>
Date: 20 October 2010 02:40
Subject: Representation
   
Counsel,

The management of Oak Spring Canola Farms seek the urgent attention of your law firm in regards to a breach of sale contract. I seek your urgent intervention in this matter because of its urgency, please advise me if this is your area of law practice so i can bring you into the loop. Expect your urgent responds at your earliest time.

Yours Sincerely,

Thomas Shepherd

I don't even know what a Canola Farm is, but the IP address that this originates from is 74.210.20.6 in Canada which is blacklisted for spamming out another scam (via surriel.com)

From: "Bowen Culbert" <culbert.cosmetics@gmail.com>
Subject: JOB OFFER
Date: Mon, 4 Oct 2010 22:09:02 -0400

  CULBERT COSMETICS COMPANY
                      Culbert Cosmetics Company
                        5 Sheddingdean Business Centre
                         Burgess Hill, SussexRH15 8QY =20
                          United Kingdom  =20
                      Phone:  1273906031
Dear Sir/Madam,

I am Mr. Bowen Culbert. I represent Culbert Cosmetics Company based here in United Kingdom. We need company representatives in Europe, America, and Canada. So If you are interested in this business transaction, forward to us your contact information so we can furnish you with the job description. Please if you are interested to work with us in good faith and honesty, get back to us by filling the information below:

Full Names..................
Full Address................
City........................
State.......................
Postal Code.................
Country.....................
sex.........................
Age.........................
Home Phone..................
Cell Phone..................
Fax.........................
Occupation..................
Company Name................

Very Respectfully,

Bowen Culbert
Managing Director
Culbert Cosmetics Company
5 Sheddingdean Business Centre
Burgess Hill, SussexRH15 8QY
United Kingdom 
culbert.cosmetics@gmail.com
Phone:  1273906031

"Culbert Cosmetics Company" is more obviously a scam, so clearly "Oak Spring Canola Farms" is too.

It turns out that scammin lawyers can be quite lucrative, but they do tend to follow established patterns. There's a pretty good repository of attorney email scams, some of which are quite hard to tell apart from genuine client enquiries.

xshopperjob.com mystery shopper scam

A mystery shopper scam to avoid, from a domain registered in Russia.

Date: 16 October 2010 15:48
Subject: Re: MS Shopper [$800/week]

Thank you for your interest in the MS Shopper position.
Our company conducts surveys and evaluates other companies in order to help them achieve their performance goals.
We offer an integrated suite of business solutions that enables corporations to achieve tangible results in the marketplace.

We get hired by other companies and act like customers to find out how they are handling their services in relation to their customers.
MS Shopping is the most accurate and reliable tool a business can use to gather information regarding their actual customer service performance at the moment of truth.
This moment of truth is not when the staff is on their best behavior because the boss is around - it is when they interact with customers during their normal daily routines.

This is where you, the MS Shopper, come in.
You pose as an ordinary customer and provide feedback of both factual observations (ex...the floor was free of debris)
and your own opinions (ex...I felt that the temperature in the establishment was too cold).

MS Shoppers must remain anonymous. You must act as a regular customer and be careful not to do anything that would reveal you as a shopper.
An inexperienced shopper could tip off the staff to his/her identity by asking for the manager's name for no clear or appropriate reason.
If you are going to be bringing someone with you on the shop, make sure you educate them about the process as well.
Beware that even whispers can be overheard by employees. If anyone notices you are a shopper,
you can bet that word will quickly spread around the establishment and you will get some of the best customer service in town.

No company can afford to have a gap between the promise of quality and its actual delivery, that's why leading corporations look to us,
the nation's premiere MS shopping and customer experience measurement company.

In order for a business to effectively compete in today's economy, they must be prepared to meet the challenge of increasing sales by:
* Retaining existing customers
* Acquiring new customers
* Creating word-of-mouth advocacy
* Improving customer loyalty

Once we have a contract to do so, you would be directed to the company or outlet, and you would be given
the funds you need to do the job(either purchase merchandise or require services), after which you would write a detailed report of your experience.

Examples of details you would forward to us are:
1) How long does it take to get served.
2) Politeness of the attendant.
3) Customer service professionalism.
4) Sometimes you might be required to upset the attendant, to see how they deal with difficult clients.

Then we turn the information over to the company executives and they will carry out their own duties in improving their services.
Most companies employ our assistance when people complain about their services, or when they feel there is a need for them to improve upon their customer service.
Our company partners with you to implement proven MS shop auditing and surveying strategies that provide critical information about customer experiences.

You will be paid a commission of $100 for every duty you carry out, and bonus on your transportation allowance.
Your task will be to evaluate and comment on customer service in a wide variety of restaurants, retail stores, casinos,
shopping malls, banks and hotels in your area.

Qualities of a good MS Shopper:
* Is 21 years of age or older
* Loves to go shopping
* Is fair and objective
* Is ON TIME
* Is very observant and able to focus on details
* Is fairly intelligent
* Has patience
* Is detail oriented
* Is practical
* Types well
* Is trustworthy
* Explains well in writing
* Is discreet
* Loves to learn
* Handles deadlines
* Has full internet access (at home or at work)

MS Shopping is fun and exciting but also must be approached very seriously and is definitely not for everyone.

If you are interested in applying for consideration as a MS Shopper do send in your information: Domiciano@xshopperjob.com
Full Name:
Address:
City:
State:
Zip Code:
Phone Number:
Age:
Occupation:

As soon as we receive your information we will add you to our database and we will look for locations in your area that needs to be evaluated.

The possition is only available for United States.

Thank you,
Domiciano MECHOSO

The domain name is registered in Russia, contact details could well be fake:

Domain Name: XSHOPPERJOB.COM

Registrant:
    Beatles Steel
    Alexey Zhukov        (oloperz@usa.com)
    Novopeschanaya 56 8
    Moscow
    Moscow,145672
    RU
    Tel. +7.4999433354

Creation Date: 15-Oct-2010 
Expiration Date: 15-Oct-2011

Domain servers in listed order:
    ns2.reg.ru
    ns1.reg.ru

Administrative Contact:
    Beatles Steel
    Alexey Zhukov        (oloperz@usa.com)
    Novopeschanaya 56 8
    Moscow
    Moscow,145672
    RU
    Tel. +7.4999433354

Technical Contact:
    Beatles Steel
    Alexey Zhukov        (oloperz@usa.com)
    Novopeschanaya 56 8
    Moscow
    Moscow,145672
    RU
    Tel. +7.4999433354

Billing Contact:
    Beatles Steel
    Alexey Zhukov        (oloperz@usa.com)
    Novopeschanaya 56 8
    Moscow
    Moscow,145672
    RU
    Tel. +7.4999433354


All mail is handled by mx.yandex.ru in Russia, so this does look like a Russian operation. No surprises there.The email address is fairly well known for fraudulent activity too. Avoid.

nttemps.net / ntmps.net / ntmps.com recruitment scam

Net-Temps, Inc is a real company, these emails do not come from Net-Temps, Inc and follow on from a series of fraudulent emails pretending to be from this company. This time around the scammers appear to be using the domains nttemps.net and ntmps.net (update: they are also using ntmps.com)

These so-called jobs are usually money mule (money laundering) operations or some other criminal "back office" activity which should be avoided at all costs.

Date: 15 October 2010 16:48
Subject: Hiring (part-time)

Looking for a job? My name is Juliette Barnes, I am a recruiting manager of NetTemps Inc, a recruiting agency for direct-hire, contract, and freelance professionals within various professions.                          

Today I would like introduce some part-time and virtual office vacancies in the spheres of Advertising, Education, Engineering, Finance, Health care, Information technology, Media, Real estate and Transportation.                                       

If you are interested to learn more about the jobs offered, please get back to me, providing your name and contact number.                        

We are eager to help you find a better job and improve your career!         
If you have questions, please do not hesitate to e-mail me on:

e u r o p e @ n t m p s . n e t      [please delete spaces in the email address before sending it to us]    

Yours sincerely,                             
Juliette Barnes                     
NetTemps Inc                                 
======================================

Mail for these two domains is handled by 67.222.149.107 [BlueSquare Data, UK], nameservers are ns1.dollar-canada.com and ns1.nevoconsulting.net both hosted on 67.23.235.236 [HostDime, Orlando] which are also used by the domains lovestorybook.net and xpharmx.com.

Evil network: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

This summary is not available. Please click here to view the post.

[Updated] Evil network: Donstroy Ltd AS29557 (194.8.250.0/23)

UPDATE:  this IP range is now used by a completely different organisation, and malicious activity no longer exists and the block is safe to use. However, the post will remain up for research purposes.

Another network worth blocking, Donstroy Ltd appears to be a Latvia entity hosting in Moldova, closely affiliate with Sagade Ltd who are one of the most scummy networks around at the moment.

The WHOIS details show a tell-tale link to Sagade in the email address:

inetnum:         194.8.250.0 - 194.8.251.255
netname:         Donstroy-1
descr:           Donstroy Ltd.
country:         LV
org:             ORG-DL107-RIPE
admin-c:         JS1050
tech-c:          JS1050
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          MNT-DONSTROY
mnt-routes:      MNT-DONSTROY
mnt-domains:     MNT-DONSTROY
source:          RIPE # Filtered

organisation:    ORG-DL107-RIPE
org-name:        Donstroy Ltd.
org-type:        OTHER
address:         Kalinina 19, 6, Bendery, Moldova
e-mail:          sagade95@gmail.com
mnt-ref:         MNT-DONSTROY
mnt-by:          MNT-DONSTROY
source:          RIPE # Filtered

person:          Juris Sahurovs
address:         Rezekne Darzu iela 21
phone:           +37120034981
nic-hdl:         JS1050
e-mail:          sagade95@gmail.com
source:          RIPE # Filtered

% Information related to '194.8.250.0/23AS29557'

route:           194.8.250.0/23
descr:           donstroy-route-1
origin:          AS29557
mnt-by:          MNT-DONSTROY
source:          RIPE # Filtered

Google's Safe Browsing diagnostics are not good:

Safe Browsing
Diagnostic page for AS29557 (ASNOVIFORUM)

What happened when Google visited sites hosted on this network?

    Of the 42 site(s) we tested on this network over the past 90 days, 2 site(s), including, for example, fastprosearch.com/, twilightsex.cz.cc/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2010-10-10, and the last time suspicious content was found was on 2010-10-10.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 10 site(s) on this network, including, for example, manoso.cz.cc/, noaos1.cz.cc/, sunporno.cz.cc/, that appeared to function as intermediaries for the infection of 31 other site(s) including, for example, business-standard.com/, ddl-blog.org/, onlyteensx.net/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 22 site(s), including, for example, 194.8.251.0/, prostodomen.in/, globalvalidator.cz.cc/, that infected 215 other site(s), including, for example, business-standard.com/, renisyqaqir.freehostking.com/, hetivilesum.freehostking.com/.

A search against MyWOT reputations reveals a concentration of very bad sites (report here), the best thing to do is to block all traffic to 194.8.250.0 - 194.8.251.255 (194.8.250.0/23) and/or the domains listed below:

Girlongirllibido.info
Homeownersinsuranceratings.com
Testertestfree.org
Vmhostingboxx.org
Dscodec.com
Fastprosearch.com
Ttyur.com
Vlopw.com
Bmlsk.com
Bumzc.com
Fjoty.com
Fruuf.com
Hjoty.com
Nwsplt.com
Palcaug.com
Potyur.com
Uoptyr.com
Uprtx.com
Medicpillsana.com
Medicpillsbba.com
Medicpillsbia.com
Medicpillsbta.com
Medicpillscaa.com
Medicpillscea.com
Medicpillscha.com
Medicpillscia.com
Medicpillscka.com
Medicshopnas.net
Medicshopnds.net
Medicshopnks.net
Medicshopnts.net
Medicshopoes.net
Asemedic.net
Astmedic.net
Encmedic.net
Enmedic.net
Frmedic.net
Hismedic.net
Icmedic.net
Intmedic.net
Krmedic.net
Letmedic.net
Medicci.net
Medicdi.net
Medicfr.net
Medicha.net
Mediclg.net
Medicni.net
Medicnr.net
Medicpo.net
Medicpu.net
Medicri.net
Ajeslovshord.com
Akvodhhead.com
Alsodhesedhoujhd.com
Aniarioli.com
Askpressjame.com
Bejokohafder.com
Blackmodhersdep.com
Bodhlearkfil.com
Busyplakdovk.com
Cutyacttin.com
Deheverbejak.com
Dhadhaveopek.com
Dheyherevhole.com
Dovkbackbord.com
Fallanlot.com
Gavilaugddiri.com
Hadakcourse.com
Hojharedokd.com
Kameuspoukd.com
Losdsodemoss.com
Lovioinwdoli.com
Medpillsna1.com
Medpillsna2.com
Medpillsna3.com
Medpillsna4.com
Medpillsna5.com
Medpillsni1.com
Medpillsni2.com
Medpillsni3.com
Medpillsni4.com
Medpillsni5.com
Minanwaut.com
Offobjecdfamoly.com
Okchfudboy.com
Oslakdexampleas.com
Pajeukdolmaok.com
Posekipbrokj.com
Pukdraokclass.com
Redovksay.com
Resdlaujhmoss.com
Savsdadeschul.com
Sduigancdangi.com
Sliicrymuli.com
Stooddandwi.com
Suchjrikoh.com
Travilfuriwdin.com
Addsecovdtook.com
Aoutdonttdrii.com
Assiafull.com
Commoklakjuajemeak.com
Dalkplakdaor.com
Deachhodkear.com
Dhadledad.com
Dhohdhokjearly.com
Dhokjbroujhdmusd.com
Dojcourseleark.com
Domesdopdhousakd.com
Dopmedic.net
Dovardhohdhoh.com
Efimedic.net
Enemedic.net
Feetdoldakayvst.com
Femedic.net
Hamedic.net
Joldiplosd.com
Kodocedoldappear.com
Launflymost.com
Lederbojdhad.com
Letdourwere.com
Lodledellmek.com
Medshopcu1.com
Medshopcu2.com
Medshopcu3.com
Medshopcu4.com
Medshopcu5.com
Medshopde1.com
Medshopde2.com
Medshopde3.com
Medshopde4.com
Medshopde5.com
Muchplakdokly.com
Okcevhekvadch.com
Oldbesdjrik.com
Passourdu.com
Pocdurejudcold.com
Rockdomeacd.com
Rockroundsung.com
Sicondkniwgo.com
Slovkevvell.com
Soldmarkacte.com
Strovkuproad.com
Ukmedicineel.com
Ukmedicineho.com
Ukmedicineit.com
Vadchdeachmokd.com
Vekdhadjrov.com
Vhadreachmusoc.com
Vholevucemay.com
Vokdercarryjod.com
Vordeachsdud.com
Ydeamavturv.com
Advsecsmart.com
Digitall-soft.com
Extrafullprotection.com
Mypc-repair.com
Payforsec.com
Secsmartsuper.com
Smartsecadv.com
Smartsecsuper.com
Smartsecurityadvisor.com
Smartsupersecurity.com
Stable-soft.com
Supersecadvizor.com
Supersecurepay.com
Supersmartantivirus.com
Supersmartsec.com
Bbnhs.com
Bumzec.com
Ddleb.com
Drutp.com
Gasdda.com
Gradtz.com
Hewraq.com
Hgptd.com
Htresq.com
Krclear.com
Nadwq.com
Nmkop.com
Utrvc.com
Vbnrte.info
Kobqq.com
Jgtee.com
Jyiop.com
Mptim.com
Nhytx.com
Ptyre.com
Woptr.com
Yopte.com
Ypuii.com
Checkingassociateeditor.com
Bestcheckingconnect.com
Checking-associate-editor.com
Checking-associate.com
Checkingassociatemembership.com
Checkingconnectdata.com
Checkingconnectnow.com
Checkingconnectshop.com
Cogus.net
Gromz.net
Mochos.net
Zorter.net
Movies-celeb.info
Onlymoviesporn.info
Porn-video-4u.info
Pornyardmovies.info
Videostreamporn.info
Moviesfreestar.info
Nanocloudcontroller.com
Iliked.org
Yougoodvideo.net
Shloesandrooneys.com
1200kb.net
Banfieldsbest.com
Btp-tags.com
Doit-4-u.com
In-ta.net
Media-share.org
Mwcdirect.com
Pixel-pie.com
Planetsoldat.com
Sainser.com
Wnizip.com
Dsfungssdfg.com
Sbgfdfsggf.com
Sportstickets.tv
Sufdngsg.com
Missing-codecs.com
Missing-codecs.net
Missing-codecs.org
Vidscentral.net
Consp.net
Thestability.com
Traffcity.com
Polytech-electronics.net
Blackmaven.in
Blueace.in
Whiteace.in
Whiteoso.in
Whitewizard.in
Globalcloudbackup.com

position-nl.com fake job offer

A retread of this fake job offer, this time using the domains position-nl.com to solicit replies (there's also a position-gb.com and probably many other variants). Despite the claims, this job is most likely laundering stolen money and could lead to a criminal record.

Date: 8 October 2010 13:58
Subject: for CV #32
   
Building & Investment Company is pleased to offer you an excellent-paid
part-time vacancy for the position of Administrative Assistant(Representative).
You would work from the comfort of your home office or in our office, it would depend on your choice.

Our company is a large corporation that is building involved in a variety of activities
that include construction, realty management, investment sector, rental services etc.
Right now we are working on more than 10 objects around the world, primarily in Europe, United Kingdom and North America.
This is the ideal role for a highly organized and proactive administrator, looking to develop their career
with an established and successful company.
For the right candidate, there will be the opportunity to progress to Administrative Assistant(Representative).

Candidates for the job should possess excellent organizational skills as well as the ability to efficiently multi-task.
Ideal candidates have a strong focus on day-to-day operational excellence,
and a personal style that builds trust, and inspires loyalty.
Your duties will also include taking and entering orders,communicating with clients and partners, work with payments and information and creating mail shots.

Other duties of the Administrative Assistant(Representative) include, but are not limited to:
Incorporating effective priorities for the virtual office function
Administer day-to-day financial responsibilities for clients
Reporting online daily
Preparing brief summary reports, and weekly financial reports

To be considered for this position, you must have solid administration experience.
A good telephone manner is also essential.

Salary part-time: 5.000 euro/month plus bonuses.
Location: Holland

If you are interested, please reply to: natasha@position-nl.com with your latest CV.

Best regards,

Natasha Csereklye
Employment Manager

The domain was registered just today, the registration details are probably fake:

Domain name:             POSITION-NL.COM
Name Server:             ns3.nic.ru
Name Server:             ns4.nic.ru
Name Server:             ns8.nic.ru
Creation Date:           2010.10.08

Status:                  DELEGATED

Registrant ID:           OQKDBB9-RU
Registrant Name:         Fabio A Murgia
Registrant Organization: Fabio A Murgia
Registrant Street1:      Via Giovanni, 183
Registrant City:         Cardano
Registrant Postal Code:  21010
Registrant Country:      IT

Administrative, Technical Contact
Contact ID:              OQKDBB9-RU
Contact Name:            Fabio A Murgia
Contact Organization:    Fabio A Murgia
Contact Street1:         Via Giovanni, 183
Contact City:            Cardano
Contact Postal Code:     21010
Contact Country:         IT
Contact Phone:           +39 0 331 732700
Contact E-mail:          fabrinoz@europe.com

Registrar:               Regional Network Information Center, JSC dba RU-CENTER

A Netherlands company, with Italian contact details on the domain.. which is registered in Russia? I think not.

Update:  the domains uk-kbs.com and usa-kbs.com are also being used for the same fake job offer. Avoid

F35 Fighters.. going cheap!

The F35 is an advanced US built fighter that the UK may or may not buy to put on aircraft carriers that it may or may not build. These things cost £70 million a pop and given the current budget constraints, it looks likely that some or all of the order will be cut.

Fear not.. there's a way of getting F35's cheaper than the list price.. simply Google 'em and you'll get an ad saying:

F 35 Fighters Cheap
Best Value for F 35 Fighters.
Find NexTag Sellers' Lowest Price!
www.NexTag.co.uk

Problem solved! Simply go to a shopping comparison site. Apart from the fact that NexTag don't have such things in their inventories (they do have a scale model though.. whoo!). Indeed, NexTag does run an awful lot of crappy ads for products that they don't have.. so why does Google tolerate them? And how much do you have to pay to advertise a £70m aircraft anyway?