SMS Spam: "URGENT! If you took out a Bank Loan prior to 2007.."

This SMS spam is probably from the same bunch of scumbags who brought you this long-running ambulance chasing spam.

URGENT! If you took out a Bank Loan prior to 2007 then you are almost certainly entitled to £2300 in compensation. To claim text 'YES'. Free to apply.

In this case the SMS came from +447591233963, but the spammers vary these all the time to avoid getting blocked.(Update 28/9 they are now using +447968780878 and +447968766208. Update 30/9 and now +44798044443)

Since they don't honour TPS opt-outs, then they are probably not to be trusted.. whoever they are.

If you get one of these, forward the message to 7226 ("SPAM") on T-Mobile, O2 or Orange.. If you are a Vodafone customer, forward it to 87726 ("VSPAM"), on Three the number is 37726 ("3SPAM") Your carrier should be able to block the spammer's number and with enough evidence may be able to take action against them.

If you see any other telephone numbers for this, please consider letting us known through a Comment.

Fake jobs: usa-jobslist.com

Another addition to this long running scam, usa-jobslist.com is freshly registered and will be used to attempt to recruit people for money laundering and other illegal activities. Avoid.

Fake jobs: gb-offerlist.com, high-webtraffic.com and traffic-dc.com

More fake job offers.. or at least more fake something from the crew behind the "Lapatasker" series of dodgy domains:

gb-offerlist.com
high-webtraffic.com
traffic-dc.com

The shift in domain names might mean a shift in tactics, but be assured that any solicitation you get from these email addresses will be a scam.

Fake jobs: europe-joblist.com

Another fake "Lapatasker" job offer domain, europe-joblist.com was registered just yesterday to "Aleksej Iliin".

The standard pitch is for a job that actually involves money laundering or some other criminal activity. Avoid.

94.244.80.7 / bookpolo.com / booksolo.com / bookgusa.com injection attacks

The crew responsible for the LizaMoon and Worid-Of-Books.com are back with a new set of injection attacks, this time hosted on 94.244.80.7 in Lithuania.

The following domains are currently in use:
bookaros.com
bookarra.com
bookavio.com
bookdolo.com
bookfula.com
bookgusa.com
bookmonn.com
bookmono.com
bookmylo.com
booknunu.com
bookpolo.com
booksgou.com
booksoco.com
booksolo.com
booktuba.com
bookvila.com
bookvivi.com
bookvoxy.com
bookzoul.com
bookzula.com

Registrant details are familiar and fake:

JamesNorthone
   James Northone jamesnorthone@hotmailbox.com
   +1.5168222749 fax: +1.5168222749
   128 Lynn Court
   Plainview NY 1180

us

Injection attacks seem to be either trying to insert an anchor with the word "book" pointing to one of the bad sites, presumably as a "Worid of Books"-type SEO campaign, or alternatively they are using the ur.php approach the LizaMoon used.

The whole 94.244.64.0/18 block looks toxic and is worth blocking. I'll post more details on that when I get the time.

Fake jobs: allconsult-eu.com, es-joblist.com and us-joblist.com

Another bunch of fake "Lapatasker" job offers, part of a long-running series. Jobs offered will including such illegal activities as money laundering and receiving stolen goods, so worth avoiding.

allconsult-eu.com
es-joblist.com
us-joblist.com

Contact details on the domain are probably fake ("Aleksej Iliin" again):

    Aleksej Iliin
    Email: abolan@mail.org
    Organization: Private person
    Address: Okruzhnaya ul. d.5 kv.4
    City: Moskva
    State: Moskovskaya obl.
    ZIP: 183124
    Country: RU
    Phone: +7.4959424617
    Fax: +7.4959424617

All domains were registered on 5th June.

Liver Transplant spam

A weird one here.. somebody offering bits of their liver for sale. Of course it could be a scam, but it might even be genuine (which is perhaps more disconcerting). Originating IP address is 95.167.110.9 in Russia.

From: Alex alexsilpo@yahoo.com
Date: 30 May 2011 10:37
subject: Liver transplant.
   
Hello.
I found your e-mail adress on medical site of transplant and liver problems.
My name is Alex, I am 31 years european man, I never drank alcohol and did not smoke cigarettes, my blood is O+ and I have a good health. If you need liver transplant I am ready to give part of my liver, but I want to receive a big compensation for that...

If you do not need liver transplant, but you know somebody who need it, please send my message to this person or keep it just in case.

alexsilpo@yahoo.com
alexsilpo@hotmail.com
alexsilpoeu@yandex.ua


Alex

P.S. If I was mistaken, I am sorry, I will not disturb you any more.

Fake jobs: 1new-position.com, gb-hire.net, gb-jbprogramm.com, online-vacancy.net and us-vacancy.net

Another installment of this long-running job scam, the following domains are newly registered (2 days ago) and are most likely to be used to recruit people for money laundering and other criminal activities. Avoid.

1new-position.com
gb-hire.net
gb-jbprogramm.com
online-vacancy.net
us-vacancy.net

Domains are registered to the "Aleksej Iliin" persona that we have seen many times before.

gb-offers.com bogusjob offers

Another domain offering bogus jobs in money laundering or other illegal activities is gb-offers.com, part of the long running "Lapatasker" series of scams. As with other recent domains, this too is registered to the (probably fake) "Aleksej Iliin" person.

Avoid.

Fake jobs: au-position.org and europjob.org

Two new(ish) fake job domains in the "Lapatasker" series, au-position.org and europjob.org are being used to recruit money mules etc etc.

As usual, avoid.

Scam: "Your money has been recovered"

Originating from a government-owned IP address in China (218.26.2.42), this slightly puzzling advanced fee fraud is deliberately vague about where this $7.6m comes from.. of course, there are no millions stashed away in Hong Kong, but instead you can expect that there will be a LOT of expensive and unexpected fees to pay instead.

From: Mark Edwin admin@ssing.ru
Reply-To: intldeptreconcom@consultant.com
Date: 18 May 2011 01:50
Subject: Your money has been recovered (5/18/2011)

International Debt Recovery and Reconciliation Hong Kong
6/F,Trade Service Center  ,388 Kwun Road
Kowloon, Hong Kong


Tel: 852-3015-1834  Fax: 852-3015-1834

Dear  Beneficiary

                                                                        Re Payment instruction
This is international debt recovery and reconciliation office Hong Kong, our mandate is to settle all outstanding debt owe to contractors and individuals all over the world, thus this debt must have been originated from awarded contracts, inheritance and sweepstakes lottery, If you fall into this category of contractors, individual or lottery winners we advise that you contact this office immediately.We presently recover your $7.6 Million United States Dollars

The directive came in line with the agreement reached in New York U.S.A with the International Moneytary Fund -IMF, World Bank London and Paris Club on creditors and overseas credit Commission for immediate settlements of all Intercontinental debts owed to you by various countries.

1.      Date of Approval: 22-11-2010
2.      Revised Remittance: Not endorsed.
3.      Fund Endorsement payment code No AG-000087GXY-2F-PASS 2001-2010
4.      Date of issue 19-01-2011
5.      Bank Effect payment of beneficiary fund
6.      International  payment: Certifнcate Code No:Not Endorsed

On receipt of your a responds to this fax/email message, please contact our north America payment clearing center bellow.

George Donald
Foreign Affair Officer
Email:
Tel: 1-226-556-3307
Fax: 1-866 964 3856.

However, I will advise that   update this office on a regular bases


Best regards,

 MARK EDWIN
Regional Coordinator
International Credit Commission Hong Kong

New Blogger logo

Google unveiled a new Blogger logo today to reflect their two day outage (another triumph for cloud computing).

Fake jobs: first-weboffer.com, weboffers-tech.com, weboffers-tech.com and wug-tech.com

Another batch of domains offering non-existent jobs, part of the long-running "Lapatasker" series. The jobs will include money laundering and other criminal activity.. so probably best acoided.

As with other recent domains, these are registered to a probably fictitious person called Aleksej Iliin, the domains were registered on 10th May.

first-weboffer.com
weboffers-tech.com
weboffers-tech.com
wug-tech.com

Pinball Corporation RIP?

Pinball Corporation is a company that bought the remnants of Zango, a company that had a reputation for pushing slimeware. Last year I pointed out a case where Pinball Corp were clearly not keeping an eye on the actions of their affiliates, and other people have been critical of them too.

Well, there's potentially some good news.. because according to the Washington State Corporations Division, Pinball Corp became inactive on the 2nd May 2011.

PINBALL CORP.

UBI Number	602918125
Category	REG
Profit/Nonprofit	Profit
Active/Inactive	Inactive
State Of Incorporation	DE
WA Filing Date	09/02/2010
Expiration Date	09/30/2011
Inactive Date	05/02/2011
Registered Agent Information
Agent Name	BUSINESS FILINGS INCORPORATED
Address	1801 WEST BAY DR NW STE 206
City	OLYMPIA
State	WA
ZIP	98502
Special Address Information
Address
City
State
Zip

Governing Persons

Title	Name	Address
President,Treasurer	Scott, Joel	One Market Plaza Spear Tower Fl 19 SAN FRANCISCO, CA
Secretary	Siefer, Serena	One Market Plaza Spear Tower Fl 19 SAN FRANCISCO, CA
Director	Chandratillake, Suranga	3600 136th Pl SE BELLEVUE, WA
Director	Service, Matthew	3600 136th Pl SE BELLEVUE, WA

Of note is that although the corporation appears to be inactive, the website at pinballcorp.com is still running and with no notice about the change of company status. Where Pinball Corp's affiliates stand is unknown, but given the deceptive business practices of a number of them, then I don't think too many people will be shedding a tear.

But why has the company apparently become inactive? It turns out that Pinball Corp is a wholly owned subsiduary of a UK firm called Blinkx plc, and the "inactive" date coincides almost exactly with Burst Media (for $30m). Perhaps Blinkx decided that Pinball Corp was no longer something that they wanted to have in their expanded portfolio?

SMS Spam: £3750 for an accident you haven't had

There seems to be a huge number of these spam SMS messages doing the rounds recently:

Free Msg; Our records indicate you may be entitled to £3750 for the accident you had. To apply free reply CLAIM to this message. To opt out text STOP.

These message come through if you are registered on TPS or not. There is no identification as to who is sending them, and the number changes regularly (I have seen +447955957379, +447591260334, +447542067695, +44758137217, +447403811563, +447826688283, +447517528462). Sometimes the spam starts FREEMSG. Always the value seems to be £3750. It doesn't matter if you have had an accident or not.

If you are a Vodafone, O2 and Orange customer you can report the SMS spam to your provider: for Orange and O2 forward the message to 7726 (it spells SPAM) or on Vodafone is is 87726 (VSPAM). I have not been able to confirm, but T-Mobile and 3 may also accept forwarded messages to 7726 as well. The carriers should be able to block the spammers if they get enough reports, and take legal action where necessary.

Update: 3's spam reporting number is 37726 (3SPAM). Thanks for the tip, Richard!

Replying STOP is probably not a good idea - the spammers may well use it to confirm that the mobile number is active. And replying CLAIM is probably an even worse idea since they are a bunch of low-life spammers who probably cannot be trusted.

Fake "Lapatasker" job domains, 8/5/11

Another set of domains offering fake jobs via spam, the latest in this long running saga. The domains were registered on 6th May.


first-euro.com
it-hire.com
newgreen-europe.com
newgreen-tech.com
usa-worldoffer.com
world-hire.net

The probably fake registrant details still use the "Aleksej Iliin" alias that we have seen previously.

Jobs offered will most likely include the usual mix of money laundering and other fraudulent activities. Avoid.

Fake jobs: new-wughire.com and 1st-consult.com

Two more fake domains being used in the "Lapatasker" series of bogus job offers, registered on 3rd May 2011:

new-wughire.com
1st-consult.com

The (probably fake) WHOIS details point to a familiar alias:

    Aleksej Iliin
    Email: abolan@mail.org
    Organization: Private person
    Address: Okruzhnaya ul. d.5 kv.4
    City: Moskva
    State: Moskovskaya obl.
    ZIP: 183124
    Country: RU
    Phone: +7.4959424617
    Fax: +7.4959424617

Fake jobs: wug-newhire.com and wug-consulting.net

Two more fake "Lapatasker" domains, registered on 27/4/11 but otherwise the same as these.

wug-consulting.net
wug-newhire.com

These will no doubt be used to push money laundering "jobs" and the like, avoid.

infernomag.com / gtracking.org nastiness

Some sort of .htaccess hack is going on, redirecting users to infernomag.com and then on to a malicious site that looks like it's downloading a Zbot variant. It only seems to work with Internet Explorer, and only when the page is accessed from a search engine (like Google). infernomag.com is hosted on 85.17.132.194 (Leaseweb) which is the same server as gtracking.org which alters the .htaccess file as described here.

infernomag.com then redirects users to one of at least two Leaseweb-hosted servers at 85.17.19.201 and 85.17.19.203 (possibly others). These servers have a number of domains on them that appear to belong to legitimate domains registered at GoDaddy by (mostly) UK users - it is likely that their domain control panels have been compromised. Examples are:

actually2.weddingphotographersurrey.net
amount9.gwdempseyjr.com
are5.gwdempseyjr.com
background1.photographbcn.com
brought0.gwdempseyjr.com
captain5.photographbcn.com
captain6.gwdempseyjr.com
charge7.photographbcn.com
signal6.photographbcn.com
completely8.gwdempseyjr.com
congress1.airduct-ventcleaning-mn.com
hard9.photographbcn.com
leading1.airduct-ventcleaning-mn.com
party4.gwdempseyjr.com
providence5.gwdempseyjr.com
safe1.gwdempseyjr.com
she1.weddingphotographerkent.net
tax6.weddingphotographersurrey.net
theory7.weddingphotographerkent.net
am1.theimperialsuspects.com
area6.bettyjaneware.com
belief7.theimperialsuspects.com
contact2.theimperialsuspects.com
cultural5.boneki.com
direct2.theimperialsuspects.com
enemy2.theimperialsuspects.com
baby3.trycue.com
liberal6.trycue.com
most0.ladyofvirtuestore.com
professional0.ladyofvirtuestore.com

Two domains on those servers that do not fit the pattern are:
gfaster.net
fortreecom.net

The WHOIS details are probably fake, for infernomag.com and gtracking.org they are:

   Felix Maurer
   sherman66@ymail.com
   Waldowstr. 61
   Gschwend   Gschwend
   74417   DE
   +49 98466101

fortreecom.net uses the same email address but a different name:

    Bernd Austerlit        (sherman66@ymail.com)
    Alt Reinickendorf 94
    Ziemetshausen
    Bayern,86471
    DE
    Tel. +82.84991251

Detection rates are rubbish. AntiVir detects the payload as TR/Dropper.Gen, BitDefender as Gen:Variant.Zbot.34, Ikarus as Trojan.Win32.Pirminay and Sophos as Mal/Ponmocup-A. Other products do not seem to detect anything at all.

Blocking those IPs of 85.17.132.194, 85.17.19.201 and 85.17.19.203 is safer than trying to block the domains. Blocking the whole /24s instead would probably cause very little inconvenience.

Fake "Lapatasker" job domains 28/4/11

This particular scam has been around for a couple of years and is so common now that I've christened this group of scam domains "Lapatasker" after the email address used in some of the older WHOIS details.


New domains for this scam (all registered on 26/4/11) are:

1job-europ.com
consult-europ.com
middle-consult.com
westconsult-eu.com

The (probably fake) contact details on the domains are:

    Vilechka Pelka
    Email: rewerta12@yahoo.com
    Organization: Nord Atlantic.
    Address: 15 Av Albert Ier 143
    City: Braine l'Alleud
    State: Braine l'Alleud
    ZIP: 1420
    Country: BE
    Phone: +3.3223874153
    Fax: +3.3223874152

As ever, avoid.