Sponsored by..
Tuesday, 25 November 2008
Monday, 24 November 2008
"Ran-De-Vou Co." proofreading scam
Sometimes it is hard to see what the scam is with some of the job offers, except that undoubtedly it IS a scam. This job offer from the ficticious "Ran-De-Vou Co." offers a proofreading job which is kind of unusual at first glance.
Subject: Successful Positions Available
Dear Job Seeker,
We are glad to inform you about new vacancy opening in the area of proofreading at
Ran-De-Vou Co.
Part time job Description:
We provide you with business messages which require revision and your task is to
make necessary
corrections as an english speaking person, and e-mail them back to us.
Payment:
There is no fixed salary for this vacancy. We offer $5.00 per 1Kb of the text which
you revise (the workload is about 4-5 Kb a day).
The salary is paid once a month, and begins with the date of the first revision you
make.
(Example: by editing 5Kb of texts a day you earn $1000.00 a month)
Requirements:
-Applicant must be a US citizen
-Applicant must be of a legal age: 21+
-Applicant should be skilled in computer usage, and American English
Feel free to submit the application form which follows only to e-mail:
ran.devou.gr@gmail.com
__________
FULL NAME:
HOME ADDRESS:
CITY, STATE, ZIP CODE:
Phone number (home or cell, but SHOULD BE available any day time):
E-MAIL:
AGE:
OCCUPATION:
EDUCATION:
----------
You will receive a response from us in 24 hours.
If you have any questions please reply only at our e-mail: ran.devou.gr@gmail.com
Sincerely, Ran-De-Vou Co. Team
Unlike the usual money mule and parcel reshipping scam jobs, this really does seem to be asking for a proofreader. And given the poor quality of English seen in some of these scams, it is easy to understand why. In fact, there is a whole underground fake career network aimed at recruiting virtual office staff for these bogus outfits. Unfortunately for these "employees", they are usually the people that end up having to deal with the police when the scam gets busted.
Avoid.
Subject: Successful Positions Available
Dear Job Seeker,
We are glad to inform you about new vacancy opening in the area of proofreading at
Ran-De-Vou Co.
Part time job Description:
We provide you with business messages which require revision and your task is to
make necessary
corrections as an english speaking person, and e-mail them back to us.
Payment:
There is no fixed salary for this vacancy. We offer $5.00 per 1Kb of the text which
you revise (the workload is about 4-5 Kb a day).
The salary is paid once a month, and begins with the date of the first revision you
make.
(Example: by editing 5Kb of texts a day you earn $1000.00 a month)
Requirements:
-Applicant must be a US citizen
-Applicant must be of a legal age: 21+
-Applicant should be skilled in computer usage, and American English
Feel free to submit the application form which follows only to e-mail:
ran.devou.gr@gmail.com
__________
FULL NAME:
HOME ADDRESS:
CITY, STATE, ZIP CODE:
Phone number (home or cell, but SHOULD BE available any day time):
E-MAIL:
AGE:
OCCUPATION:
EDUCATION:
----------
You will receive a response from us in 24 hours.
If you have any questions please reply only at our e-mail: ran.devou.gr@gmail.com
Sincerely, Ran-De-Vou Co. Team
Unlike the usual money mule and parcel reshipping scam jobs, this really does seem to be asking for a proofreader. And given the poor quality of English seen in some of these scams, it is easy to understand why. In fact, there is a whole underground fake career network aimed at recruiting virtual office staff for these bogus outfits. Unfortunately for these "employees", they are usually the people that end up having to deal with the police when the scam gets busted.
Avoid.
Saturday, 22 November 2008
"Louvre Tec Products Ltd" job offer scam
LouvreTec is a wholly legitimate New Zealand company using the domains www.louvretec.co.nz, louvretec.net, louvretec.com and other similar names.
This fraudulent job offer is not from LouvreTec, but it looks like it is.
£5000 a week sounds good.. after all, that's over a quarter of a million quid a year. Yeah right..
One interesting thing with this spam is the bit at the bottom. The scammers realise that spam filters tend to remove junk like this, so they are asking you to check your junk messages for job offers. Not a good idea.
Originating IP address is 78.159.123.169, which claims to be in the UK and the message was sent to an email address stolen from a UK online retailer.
This fraudulent job offer is not from LouvreTec, but it looks like it is.
Subject: Work Online With USAlthough it appears to be "from" louvretec.co.nz, hitting "reply" comes up with a completely different email address of louvretecproductsltd.n.z@emailaccount.com. The scammers are hoping that no-one will notice this. (In case you are wondering why it is different, it's an annoying feature called the "reply to" address).
From: "Louvre Tec Products Ltd" Job@louvretec.co.nz
You could make 5,000 pounds online in a week without delaying your present job...
Hit REPLY for more details..
NOTICE: IF YOU ARE SERIOUS TO GET EMPLOYED ONLINE, YOU MUST REGULARLY CHECK YOUR JUNK OR/ BULK OR/ SPAM FOLDERS IN OTHER NOT TO LOSE SOME OF OUR MESSAGES.
£5000 a week sounds good.. after all, that's over a quarter of a million quid a year. Yeah right..
One interesting thing with this spam is the bit at the bottom. The scammers realise that spam filters tend to remove junk like this, so they are asking you to check your junk messages for job offers. Not a good idea.
Originating IP address is 78.159.123.169, which claims to be in the UK and the message was sent to an email address stolen from a UK online retailer.
Wednesday, 19 November 2008
ISC: Large quantity SQL Injection mitigation
The ISC have given some good guidance on SQL injection mitigation, in case your server has been hit by Asprox or something similar. It's complicated stuff, and if you don't understand it, then it is definitely worth hiring a professional to fix your database.
Tuesday, 18 November 2008
Microsoft Morro: free anti-virus software for consumers
This might be a good deal for cash-strapped consumers, but a bad deal for other anti-virus companies.
Anyway, "Microsoft Morro" is the name given to this idea of giving away free anti-virus software to consumers. I will say that Microsoft's malware scanning technology is actually pretty darned good, but having a security monoculture is not a good idea.
I think perhaps McAfee, Symantec and some other AV vendors might be lawyering up on this one..
Anyway, "Microsoft Morro" is the name given to this idea of giving away free anti-virus software to consumers. I will say that Microsoft's malware scanning technology is actually pretty darned good, but having a security monoculture is not a good idea.
I think perhaps McAfee, Symantec and some other AV vendors might be lawyering up on this one..
Friday, 14 November 2008
McColo dead - spam 69% down
If there was any doubt the McColo was behind a vast majority of the world spam, then I think the figures speak for themselves. We're seeing a 69% drop in spam volumes day-on-day (although we still only have one day's worth of post-McCole data). It will be interesting to see how long this takes to recover back to "normal" levels of awfulness.
Thursday, 13 November 2008
Estdomains and McColo sentenced to death
After some hesitation, ICANN have finally decided to terminate Estdomains, who most people in the security industry regarded as a rogue registrar with unhealthy connections to organised crime.
Another piece of good news is that McColo has been knocked offline - it turns out that they were hosting a number of command and control servers for botnets plus a load of other unpleasant stuff. Spam levels have dropped by a massive two-thirds as a result. Nice work.. and a big thanks to all those involved!
Monday, 10 November 2008
"DOMAIN LISTINGS CENTER" spam
For some reason, I am seeing a big upswing in Canadian spam at the moment. This one is a very misleading offer entitled "ANNUAL WEBSITE SEARCH ENGINE SUBMISSION" for a domain that I have parked and have never used. It is only when you get near the bottom that the message carries a disclaimer "Note that THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amounts stated unless you accept this offer".
DOMAIN LISTINGS CENTER
8171 Yonge St. Suite# 149
Thornhill, ON L3T 2C6
Canada
--------------------------------------------------------------------------------
NOTICE
--------------------------------------------------------------------------------
(Please make necessary changes)
ATT: name
address
,
WWW.domain.com
DESCRIPTION OF SERVICES:
Premium Package
ANNUAL WEBSITE SEARCH ENGINE SUBMISSION
FROM DECEMBER 1,2008 THRU DECEMBER 1,2018
OR
FROM DECEMBER 1,2008 THRU DECEMBER 1,2013
TOTAL
$295.00
$185.00
SUBSCRIPTION INCLUDES:
Custom keyword research
Optimized title and meta tags
Submission to 900 search engines and directories
safe follow-up re-submissions every 3 months
Helpful professional support
THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amount(s) stated unless you accept this offer.
--------------------------------------------------------------------------------
Domain Name
WWW.domain.com Amount
Requested Reply
November 10th,2008
THIS NOTICE IS A SOLICITATION AND A RECEIPT OF PAYMENT WILL CONFIRM YOUR ANNUAL SUBMISSION
*100% SATISFACTION IS GUARANTEED OR YOUR MONEY BACK
Please select the number of years you would like to signup for
[ ] 10 Years .......... $295 (Best Value, Most Recommended!)
[ ] 5 Years .......... $185
[ ] 2 Years .......... $99
[ ] 1 Years .......... $75
If you have other domains you may list them below (please send a separate check for each domain and write your domain name on the memo section of the check)
Other domain(s) __________________ , __________________ , __________________
Total $ _______
________________________________
Signature
________________________________
Date
Payment by Check or Money Order
Print and mail a copy of this order form along with a check or money order to the address listed below:
Domain Listings Center
8171 Yonge St. Suite# 149
Thornhill, ON L3T 2C6
Canada
Please do not forget to include a copy of this order form along with your payment!
www.domain.com
--------------------------------------------------------------------------------
By accepting this offer, you agree not to hold DLC liable for any part. Note that THIS IS NOT A BILL. This is a solicitation.
You are under no obligation to pay the amounts stated unless you accept this offer. The information in this letter contains confidential and/or legally privileged information from the notification processing department of the Domain Listing Services Inc.
This information is intended only for the use of the individual(s) named above. If you do not wish to receive further updates from DLC send an email to dolistscent3272@operamail.com to unsubscribe.
If you are not the intended recipient, you are hereby notified that disclosure, copying, distribution or the taking of any action in reliance on the contents for this letter is strictly prohibited.
* 100% satisfaction guaranteed, you may request a refund within 30 days if your are not satisfied with our services.
Originating IP is 72.51.46.77. File it in the trash where it belongs.
Saturday, 8 November 2008
SGP / melsongroup.net scam job offer
This is a generic sort of money mule scam email, of interest because it has the domain name melsongroup.net registered to handle the email. This seems to be one of a series hosted on Yahoo! There are lots of companies called SGP, none of them is involved in this.
Subject: Join the team of winners!
SGP is an integrated financial group. We offer to our clients a
full range of financial services.
Our clients have all the possibilities to find solutions to all
financial problems of financial market - from bank services and
insurance to assets management and complex operations on stock
markets, from simple consumer goods to complex programs of financial
management of large corporations, institutional and private investors.
SGP - is a large participant of the financial market, leader in many
segments. However leadership is not a goal for us, but a way to realize
the mission of the company - providing for long-term increase in income
of our clients and shareholders.
Considering our development we need reliable and ambitious young people
on a position of Transfer Manager.
The duties of the Manager include processing of money transfers arriving
to his accounts from our clients. After all the required procedures of
executing documents of transactions you have to transfer the money to
accounts specified by our operators. All you need is free time (3 or
more hours a day), skills of team working and reliability. The wage at
the initial stage will be 5000$ of the total month turnover.
Requirements:
- Higher education;
- Age - 21 and more;
- Confident PC user (Microsoft Office), mail programs and Internet
- Foreign language (English is preferred)
We offer:
- Constant training
- Possibility of career and self-development
- Probation period and work in a dynamic and friendly atmosphere and team
- Competitive wage
- Bonuses according to job results
If you have become interested in this position please send your CV to
jacinthe@melsongroup.net.
Subject: Join the team of winners!
SGP is an integrated financial group. We offer to our clients a
full range of financial services.
Our clients have all the possibilities to find solutions to all
financial problems of financial market - from bank services and
insurance to assets management and complex operations on stock
markets, from simple consumer goods to complex programs of financial
management of large corporations, institutional and private investors.
SGP - is a large participant of the financial market, leader in many
segments. However leadership is not a goal for us, but a way to realize
the mission of the company - providing for long-term increase in income
of our clients and shareholders.
Considering our development we need reliable and ambitious young people
on a position of Transfer Manager.
The duties of the Manager include processing of money transfers arriving
to his accounts from our clients. After all the required procedures of
executing documents of transactions you have to transfer the money to
accounts specified by our operators. All you need is free time (3 or
more hours a day), skills of team working and reliability. The wage at
the initial stage will be 5000$ of the total month turnover.
Requirements:
- Higher education;
- Age - 21 and more;
- Confident PC user (Microsoft Office), mail programs and Internet
- Foreign language (English is preferred)
We offer:
- Constant training
- Possibility of career and self-development
- Probation period and work in a dynamic and friendly atmosphere and team
- Competitive wage
- Bonuses according to job results
If you have become interested in this position please send your CV to
jacinthe@melsongroup.net.
Thursday, 6 November 2008
"JavaRealm Software" job offer scam
JavaRealm Software (javarealm.com) is a wholly legitimate software development company from the Ukraine. This fraudulent job offer uses the "JavaRealm" name and the name "Sergey Skugarev" which does appear to be similar to an employee of JavaRealm who is not involved in this scam.
Subject: looking for employees
Hello Sir/Madam.
I Sergey Skugarev, Director of JavaRealm Software specializes in innovative IT solutions and complex software projects development.
My company based in Ukraine. We've earned ourselves a reputation of a reliable and trustworthy partner working successfully with a number of West European companies and providing them with reliable software development services in financial and media sectors. Unfortunately we are currently facing some difficulties with receiving payments for our services. It usually takes us 10-30 days to receive a payment and clearing from your country and such delays are harmful to our business. We do not have so much time to accept every wire transfer.
That's why we are currently looking for partners in your country to help us accept and process these payments faster. If you are looking for a chance to make an additional profit you can become our representative in your country. As our representative you will receive 8% of every deal we conduct. Your job will be accepting funds in the form of wire transfers and forwarding them to us. It is not a full-time job, but rather a very convenient and fast way to receive additional income. We also consider opening an office in your country in the nearest future and you will then have certain privileges should you decide to apply for a full-time job. Please if you are interested in transacting business with us we will be very glad.
Please contact me for more information via email: javarealm.jobinfo@gmail.com
and send us the following information about yourself:
1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age
Please respond and we will provide you with additional details on how you can become our representative. Joining us and starting business today will cost you nothing and you will be able to earn a bit of extra money fast and easy. Should you have any questions, please feel free to contact us with all your questions.
Thank you,
Sergey Skugarev ,
JavaRealm Software
This is a straightforward money mule scam. We have seen this type of scam targeting Ukranian companies before, here and here. Avoid this one at all costs.
Subject: looking for employees
Hello Sir/Madam.
I Sergey Skugarev, Director of JavaRealm Software specializes in innovative IT solutions and complex software projects development.
My company based in Ukraine. We've earned ourselves a reputation of a reliable and trustworthy partner working successfully with a number of West European companies and providing them with reliable software development services in financial and media sectors. Unfortunately we are currently facing some difficulties with receiving payments for our services. It usually takes us 10-30 days to receive a payment and clearing from your country and such delays are harmful to our business. We do not have so much time to accept every wire transfer.
That's why we are currently looking for partners in your country to help us accept and process these payments faster. If you are looking for a chance to make an additional profit you can become our representative in your country. As our representative you will receive 8% of every deal we conduct. Your job will be accepting funds in the form of wire transfers and forwarding them to us. It is not a full-time job, but rather a very convenient and fast way to receive additional income. We also consider opening an office in your country in the nearest future and you will then have certain privileges should you decide to apply for a full-time job. Please if you are interested in transacting business with us we will be very glad.
Please contact me for more information via email: javarealm.jobinfo@gmail.com
and send us the following information about yourself:
1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age
Please respond and we will provide you with additional details on how you can become our representative. Joining us and starting business today will cost you nothing and you will be able to earn a bit of extra money fast and easy. Should you have any questions, please feel free to contact us with all your questions.
Thank you,
Sergey Skugarev ,
JavaRealm Software
This is a straightforward money mule scam. We have seen this type of scam targeting Ukranian companies before, here and here. Avoid this one at all costs.
Stupid but sophisticated "Lloyds TSB" phish
Spammers are generally pretty stupid. This particular phish looks pretty normal to being with:Customer Service department
Lloyds TSB Bank
September 26th, 2008
To all business and personal customers
We would like to inform you about recent change in Lloyds TSB terms and conditions of banking services. Lloyds TSB has updated terms and conditions for both business and personal customers. Each customer should read and accept current terms and conditions.
Failure to accept new terms and conditions may lead to blocking of current services. Such as loans, credit cards, online banking, savings accounts, bill payments. Take a moment to read through new terms and conditions. There are two convenient ways to request updated terms and conditions. You can request them by mail or use online banking to confirm the new terms of service. Please follow the link below to review and confirm updated terms and conditions.
www.lloydstsb.com/terms
Thank you for banking with the most trusted UK bank,
Lloyds TSB Customer Service Team
We know that this is a phish because a) it was sent to a harvested address and b) Lloyds TSB don't send out emails like this. So a typical next step would be to check the source code to find where the phishing site is.
So the only hypertext link in the document is to http://www.lloydstsb.com which is the real Lloyds TSB bank. A closer look shows an attempted image load from http://lloydstlb.com/images/logo_lloydstsb.gif which is the phishing site hosted on a botnet. The domain is registered to BIZCN.COM who seem to have taken over this sort of business from Estdomains.The fake site looks pretty convincing.. even if no-one will click through to it.
The login screen looks authentic too.
The next step looks exactly like the genuine login. The "memorable information" prompt asks for 3 letters from a longer passphrase, specifically letters 1, 3 and 5.
But guess what, when you enter the information it tells you that you did it incorrectly and asks for letters 2, 4 and 6 instead. So now they have letters 1-6.
Blah blah blah..
But what's this at the bottom? Yup, more characters from the memorable phrase are needed..
Finally, a confirmation:
So, like many modern phishing sites the actually web site is very credible looking, even the domain name looks reasonable if you only glance at it. Fortunately for the intended victims, the idiots have messed up the spam and.. this time at least.. nobody will get this far.
Wednesday, 5 November 2008
"App LLC Group." scam
Another ridiculously worded scam job offer, essentially identical to this one.
Originating IP is 95.57.7.182 in Kazakhstan. That country has featured in these fake job offers before (here and here).
Subject: How for short time to earn $1200 in a week? Read!"Sucky sucky long time five dollar" to you too.
HELLO EVERYONE!Woot!
Please take your time and read about this genuine offer, job position.Make money1400 AUD? You said $1200 a moment ago. Are we talking US$ or AU$? At least I know it's "Genuine" because you said so twice. Shame about the really bad English, all the Danish people I know speak English very well.
spending only few hours a day, if you are located in Australia! This position either
can replace your current job, or can be as an extra income for you. Denmark
successful company - Apple Sales Group brought this opportunity for you.
Advertisement itself is brought to you via Google ads (Paid advertisement, assigning
e-mail business account). The most convenient and smart position for anybody who has
couple hours a day, Monday-Friday. You will be able to make 1400+ AUD a week! It's
either - you do want to participate in this, or - you do not, that's what makes it a
genuine offer and worth reading and finding out more. If you meet requirements - do
not hesitate to receive full information:
*You are 18+ y/oDidn't you just say Australia? These are different countries, you know.
*You are Reliable and Enthusiastic person.
*You Have 2-3 Hours a Day of Your Spare/Free Time, Monday-Friday(Saturday).
*You Are Located in United Kingdom/Ireland.
*You Have Access to Internet 2-3 Hours A Day, Monday-Friday(Saturday).
Reference:"I can't believe I was so stupid" - "State Penitentiary newsletter", quote by hapless money mule victim.
"The Most Creative Opportunity of The Month" - "Two Time" Magazine, quote by Angela
Roer.
"Consider This Opportunity" - "Behind The Truth" Magazine, quote by Marcus Stowee.
To receive full information reply only to e-mail: apple.swed404@gmail.comApple.Swed404? Sweden? I thought you said you were based in Denmark? App LLC? That wasn't the company name you gave earlier.
with subject "More Information" and one of our representatives will assist you
shortly.
Thank you for your interest and Good Luck!
Best Regards,
App LLC Group.
Originating IP is 95.57.7.182 in Kazakhstan. That country has featured in these fake job offers before (here and here).
Tuesday, 4 November 2008
"Recovery KEYS for your account" trojan
Another day, another ZIP-in-EXE trojan with a lot of spaces in it.Subject: Recovery KEYS for your account
Good afternoon, [victim]
There are the keys to recover your personal account. In order to use them later,
please, preserve them in a sure place.
Sincerely, Dick Riddle
Attachment: the_Keys.zip
The ZIP files contains an EXE that looks like a Word document, The_Keys.doc[88 spaces].exe. Worryingly, VirusTotal detects nothing at all. The trojan is cleary related to this one and this one.
Monday, 3 November 2008
"Colorado Business Bank - Network Security and Monitoring"
These banks get more obscure all the time, but still carry the same sort of malicious payload.
Subject: Colorado Business Bank - Network Security and Monitoring
From: "Colorado Business Bank Account Service" alert@cobizbank.com
COLORADO BUSINESS BANK NOTICE:
Colorado Business Bank has registered our secure Web sites with VeriSign and use VeriSign Server IDs.
VeriSign Server IDs enable you to verify the authenticity of our secure Web site and to communicate with our Web site securely via SSL (Secure Sockets Layer) encryption.
Proceed to customer service department>>
Sincerely, Everett Torres.
Copyright - Colorado Business Bank, a part of COBIZ BANK.
VirusTotal detections are the usual mixed bag. Most detections seem to be generic (e.g. W32/Packed_FSG.D, TR/Crypt.FSPM.Gen, Trojan.Win32.Packed.gen, TrojanDownloader:Win32/Suceret.gen!A)
Friday, 31 October 2008
Dating scams and 79.135.168.*
We've seen this type of dating scam several times before. No good will come of engaging "Chantel" in conversations as she doesn't really exist. It will be some fat sweaty Russian bloke probably.
Subject: hi from chantelThis is hosted on 79.135.168.36 which has been fingered before for fraud. Allegedly, the netblock is registered to an outfit in the Lebanon:
hello, I am pretty russian girl, bored tonight.
would you like to chat with me and see my pics?
if so then email me at echantel39@officialsup.com
inetnum: 79.135.168.0 - 79.135.168.255But just a few IP addresses away is another netblock that we have seen before in Turkey. The whole netblock is a complete sewer and is listed on the Spamhaus DROP List. There are 2000+ domains in this /24 block, but just for brevity I will list the ones on this server - avoid them all.
netname: LB-NET
descr: Lebanon private dedicated service
country: LB
admin-c: MHB1111-RIPE
tech-c: MHB1111-RIPE
remarks: abuse mailbox: moh.b@lubnannetworks.biz
status: ASSIGNED PA "status:" definitions
mnt-by: SISTEM-NET-MNT
source: RIPE # Filtered
person: Mohamed Baga
address: Basha Garden bldg, 5th floor LB
address: Jisr El Bacha Main Road
address: Beirut - Lebanon
e-mail: moh.b@lubnannetworks.biz
remarks: abuse mailbox: moh.b@lubnannetworks.biz
phone: +961 1 512341
nic-hdl: MHB1111-RIPE
source: RIPE # Filtered
% Information related to '79.135.160.0/19AS44097'
route: 79.135.160.0/19
descr: Sistemnet Telecom
origin: AS44097
mnt-by: Sistem-Net-MNT
- Abgol.com
- Amnocx.com
- Bestsup.com
- Cahla.com
- Cardrealc.com
- Centralrd.com
- Direktmal.com
- Equipyard.com
- Escitatop.com
- Eupoc.com
- Ezshl.com
- Firstlam.com
- Flasheon.com
- Flhnation.com
- Flhplanet.com
- Flhsupplies.com
- Freeldp.info
- Gbizc.info
- Gbladx.info
- Gblhome.info
- Gblwizard.info
- Golbalhobby.com
- Goldenttamil.com
- Goldirecto.com
- Goldpug.info
- Golguia.com
- Golmundo.com
- Golottoclub.com
- Golsitio.com
- Goltierra.com
- Gosfordw.com
- Hlgag.com
- Hollandlopflags.com
- Hyperlam.com
- Jenniferlop.com
- Jflyik.com
- Ldphome.info
- Ldpwizard.info
- Lgbidxx.info
- Lopguide.com
- Meinmal.com
- Miniplushlop.com
- Modhl.com
- Morerd.com
- Moresup.com
- Nitgbx.info
- Officialflh.com
- Officialgbl.info
- Officialldp.info
- Officialshl.com
- Officialsup.com
- Oldpee.info
- Onlineflh.com
- Onlineshl.com
- Onlinesup.com
- Pacanimal.com
- Planetflh.com
- Planetsup.com
- Rdplanet.com
- Revaloplast.com
- Shemalglobal.com
- Shlcentral.com
- Shlnation.com
- Shlsupplies.com
- Shlwizard.com
- Solidgoldent.com
- Soundevelop.com
- Superldp.info
- Superlop.com
- Supplanet.com
- Supwizard.com
- Tapthelop.com
- Theloppet.com
- Upflyp.com
- Uplea.com
- Virtualldp.info
- Virtualsup.com
- Virtuellmal.com
- Wildevelop.com
- Wildpin.info
- Worldpivot.info
- Worldplayservices.info
- Yourldp.info
- Yourlopmen.com
- Yourloprabbit.com
Thursday, 30 October 2008
"Apollo Business Services" / scam job offer
Spammers are stupid. This job offer scam combines two different offers, both of which are fraudulent. Part one is for "Apollo Business Services". Check out the very strange disclaimer on the bottom.
Subject: job offer for you. thanks
From: "Worldmarkettusew" worldmarkettusew@gmail.com
Apollo Business Services part-time opportunity (40/hr)
Dear ,
Apollo Business Services company was established in 2004 by an international team
of financial and marketing experts. We specialize in delivering positive business
results through solving currency exchange problem as well as online payments and
transactions, their tools being innovative solutions, high performance and e-commerce
optimization techniques.
We offer a "work at home" part-time position "Regional Manager". This includes
processing payments between our partners' clients and our company, ensure all personal
data relating to customers is maintained, accurate and kept discreet, identifying
opportunities to improve service delivery.
Position Type: Permanent.
Working hours: 9:00AM - 1:00PM weekdays. Variable overtime is also required.
Occupation Type: part-time (1-5 hours a day occupation).
Salary: $40 per hour.
Professional qualities and skills:
* Scrupulous and diligent;
* Computer literate;
* Good organizational and administrative skills;
* Payment procedures prior experience would be an asset;
* Ability to work independently.
Please REPLY to this e-mail to receive further information and application forms.
Yours sincerely,
Robert Hughley,
HR Manager,
Apollo Business Services
You are receiving this employment opportunity email because you uploaded your resume on CareerBuilder. This email is used for hiring process only to prevent the company from spam messages.
If your employment status has changed or you no longer wish to receive these emails, you can update your privacy and communication preferences from your resume by logging onto CareerBuilder.com:
http://www.careerbuilder.com/jobseeker/emails/emailsubcenter.aspx
Or you can Block this employer from viewing your resume and sending you candidate emails.
This email was sent from Account ID ATXNC91MZIFSAQTSAC7 and by this logged in User U48VA7D999LFKCKNSYZ
DISCLAIMER
The content of this email has been reviewed and approved by CareerBuilder. This email is intended for the use of the individual address named above and may contain information that is confidential, privileged or unsuitable for overly sensitive persons with low self-esteem, no sense of humour or irrational religious beliefs. If you are not the intended recipient, any dissemination, distribution or copying of this email is not authorised and constitutes an irritating social faux pas.
Bizarrely, attached to this spam are five other attachments trying to punt a different scam:
Dear sir or madam,
My name is Jackie Simons, I am an Advertising Manager at SocMart (www.socmart.com.ua).
The company’s principal activity is investment in residential property of developing
countries.
Our chief objective is to attract foreign investors to the affobadle housing market
of Belorussia,
Russia, Ukraine, Kazakhstan and etc. The housing prices are often high in these
countries and tend to
continuously increase, whereas the quality of the property remains rather low. As
far as we are eager to change the
situation, our company is now focused on attaraction of potential foreign investors
to the available property market
of the former CIS countries. Our three-year experience in the property investment
market has revealed an excessive number
of people willing to invest their funds into developing countries’ residential
property. However, we came across a problem
concerned with bureaucracy, as banking systems of the former CIS countries are
still undeveloped for prompt and effective
international bank transfer service. Lack of proper relations between Western and
Eastern banking systems dealing with
international bank transfer service does not allow us to process promptly our
foreign customers’ investments
(investments are to be on hold during 1-2 months). The fact that property prices are
continuously flactuating has made
it clear that efficiency in investment processing is our priority. Considering the
above we had to recourse to “investment managers”
to accelerate investment processing to the maximum extend. In case you got
interested with our proposal do not hesitate to contact us by e-mail:
worldmarkettusel@gmail.com
SocMart is a wholly legitimate Ukranian firm dealing in real estate who are NOT responsible for this spam. Whichever version of this you get, avoid it like the plague.
Added: the following email addresses are being use for this, and probably others:
worldmarkettusef@gmail.com
worldmarkettuse@gmail.com
worldmarkettusel@gmail.com
worldmarkettusew@gmail.com
worldmarkettusey@gmail.com
"Auction Sales Online" job scam
It isn't always clear what the scam is with these fake job offers, but it seems that fraudsters need to recruit a large number of patsies to run their operation. In fact, there is quite a large bogus career network going on here, with "employees" trades between various underground enterprises.
Subject: Working Part Time
Auction Sales Online is currently hiring for work at home positions,
in the United Kingdom, part-time and full-time available. The positions
focus on providing administrative assistance in online sales.
Auction Sales Online provides business support, retail distribution,
franchise operations, direct sales, and a variety of auction as well
as accounting and billing services.
Salary:
Part-time: 1,100GBP/month plus commission
Full-time: 2,200GBP/month plus commission
Professional Qualities:
- Customer focused decision maker
- Demonstrates a high level of personal accountability
- Thinks about the team first over personal agendas
- Excellent communication skills
Basic Requirements:
- Internet Access
- Microsoft Office
- Basic Accounting skills
If you are interested in this position please send us an email to
Tracy.Miller@aso-careers.com expressing your interest and we will
forward you the detailed job description and the agreement.
Best regards,
ASO Team
This particular job scam references the domain aso-careers.com which has been registered for this purpose. The WHOIS records are almost definitely fake, registered through BIZCN.COM, INC.:
Mail is handled by 12.192.82.225 which we have seen twice before. The Silent Noise blog fingers that as part of the Asprox network. Asprox involvement is hardly news - it's an impressively large underground organisation (presumably with it's own underground lair).. although it is quite possible that Asprox facilities are being used on behalf of a client.
Anyway, avoid unsolicited job offers, and always ask for some real, verifiable contact details. In the UK you can check details at Companies House. For US companies, the state Division of Corporations should have company details, or you can perhaps check at the BBB.
Subject: Working Part Time
Auction Sales Online is currently hiring for work at home positions,
in the United Kingdom, part-time and full-time available. The positions
focus on providing administrative assistance in online sales.
Auction Sales Online provides business support, retail distribution,
franchise operations, direct sales, and a variety of auction as well
as accounting and billing services.
Salary:
Part-time: 1,100GBP/month plus commission
Full-time: 2,200GBP/month plus commission
Professional Qualities:
- Customer focused decision maker
- Demonstrates a high level of personal accountability
- Thinks about the team first over personal agendas
- Excellent communication skills
Basic Requirements:
- Internet Access
- Microsoft Office
- Basic Accounting skills
If you are interested in this position please send us an email to
Tracy.Miller@aso-careers.com expressing your interest and we will
forward you the detailed job description and the agreement.
Best regards,
ASO Team
This particular job scam references the domain aso-careers.com which has been registered for this purpose. The WHOIS records are almost definitely fake, registered through BIZCN.COM, INC.:
Domain name: aso-careers.comfloodinger.com is a new one, but the registration details are hidden. ns1.floodinger.com is 67.202.88.243 in the US and 21.214.23.151 which apparently belongs to the Department of Defense (!).
Registrant Contact:
Sam Lloyd
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us
Administrative Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us
Technical Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us
Billing Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us
DNS:
ns1.floodinger.com
ns2.floodinger.com
Created: 2008-10-27
Expires: 2009-10-27
Mail is handled by 12.192.82.225 which we have seen twice before. The Silent Noise blog fingers that as part of the Asprox network. Asprox involvement is hardly news - it's an impressively large underground organisation (presumably with it's own underground lair).. although it is quite possible that Asprox facilities are being used on behalf of a client.
Anyway, avoid unsolicited job offers, and always ask for some real, verifiable contact details. In the UK you can check details at Companies House. For US companies, the state Division of Corporations should have company details, or you can perhaps check at the BBB.
Estdomains is not dead yet
Thanks to Sandi for bringing the not-so-good-news that Estdomains is not quite dead yet. For a moment it looked like ICANN had grown some cojones, but perhaps not.
Estdomains termination was based on the fact the their President, Vladimir Tsastsin, has been convicted of fraud in Estonia. However, Estdomains are attempting to wriggle out of this by saying that Tsastsin didn't do it and he resigned as president some time ago. Bearing in mind that an Estonia court said he DID do it (although he is appealing, but that could take for ever) and that the only proof offered by Estdomains that he resigned looks a bit unconvincing, then the whole excuse looks rather thin.
Of course, the reason why Estdomains should be terminated is their long-running association with organised crime, as documented here and here. Add to that the fact that the company deliberately conceals its identity by using a Delaware corporation as a front (when obviously "Est" is for Estonia), and it is clear that they should have been terminated a long, long time ago.
Wednesday, 29 October 2008
Persimmon Homes / Marks & Spencers Vouchers Hoax
There is currently a hoax email circulating similar to the following:
You can also check out Dynamoo's Email Etiquette page for some advice on what is appropriate to forward and what isn't.
Thought this might be useful with Christmas coming upAs it happens, the domain name persimmonshomes.com is incorrect, it would be persimmonhomes.com. But no matter, Persimmon categorically deny that is is anything to do with them:
Marks & Spencer, in conjunction with Persimmon Homes, are giving away free vouchers. Marks & Spencer's are trying word-of-mouth advertising to introduce its products and the reward you receive for advertising for them is free non-refundable vouchers to be used in any M & S store.
To receive your free vouchers by e-mail all you have to do is send this e-mail out to 8 people (for £100 of free vouchers) or 20 people (for £500 of free vouchers). Within 2 weeks you will receive an e-mail with your vouchers attached. They will contact you through your e-mail address.
NB. Please mark a copy to:
Andy.curran@persimmonshomes.com
"Hoax E-mail"It turns out that this hoax has been doing the rounds since 2007. There's also an interesting thread about it here.
A hoax e-mail is being circulated offering a promotion of free Marks and Spencer vouchers for forwarding the e-mail to colleagues and friends.
Neither Marks and Spencer or Persimmon Homes have made any such promotional offer.
Please delete the hoax e-mail and notify the people to whom you have sent it that it is a hoax.
You can also check out Dynamoo's Email Etiquette page for some advice on what is appropriate to forward and what isn't.
Estdomains is dead
Good riddance to bad rubbish - Estdomains has be de-accredited by ICANN, although it took long enough. If you're a registrar who wants to take on some of the most toxic domain names in the business, then ICANN invites you to apply for them.
More details here. Thanks to Spyware Sucks for the heads-up.
Subscribe to:
Posts (Atom)