Summary
This money mule scam (see sidebar for more information) appears to be a reincarnation of Bronsard Advantage under a new name. For a while now, we've seen related scams running in parallel: last month's major scam was Israeli Brokerage Services plus the minor Bronsard Advantage. This month we have Athens Financial Group Ltd, and now the minor Norden United Ltd.
The Spam
As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.
Representative image
Names used as signature
- Elsa Svitborg
Sender names encountered
Capitalisation may vary.
- Norden United LTD
- Norden United
Links encountered
Listed in order of encounter during November 2006.
- http://norden-industries.biz/html/jobs.php
- http://norden-united.biz/html/jobs.php
- http://norden-united.net/html/jobs.php
- http://uninord.biz/html/jobs.php
Encountered in December 2006.
- http://united-nord.com/html/jobs.php
- http://norden.hk/html/jobs.php
- http://norden-info.biz/html/jobs.php
- http://united-nord.biz/html/jobs.php
- http://norden-company.biz/html/manager.php
Encountered in January 2007.
- http://united-nord.info/html/jobs.php
- http://norden-info.net/html/jobs.php
- http://nord-ltd.info/html/manager.php
Active but not yet encountered in spam
If you discover other domain names being used as part of this scam, please notify us.
- norden-ltd.com
Also suspicious
These domains are suspiciously similar, but were not found to be actively hosting the scam website when tested. I expect that they will be so used at a later date (or were used, but taken offline).
- norden-united.info
- norden-ltd.biz
Website
Here is a snapshot of their website, taken at the time this blog entry was first posted.
The following text is from their description of the "manager" position, and clearly shows that the job involves forwarding money (a money mule job). The other positions are largely decoys, but all link to the same online job application page.
Manager of support to supervise operations concerning investments and securities
Responsibilities include: Reception of payments from Norden United LTD clients (individuals) with the personal bank account. Withdrawal of money from the account and further transfer through express payment systems* to our brokers in one of the countries, where the shares and securities are bought on behalf of Global Iceland Syndicate clients. All fees due for services from express payment systems* are charged to the company. Through this scheme we considerably reduce the time of payment, while our client receives securities immediately after you confirm the fact of acceptance of money with your account. It is definitely positive, that this work may give you additional revenue as a part-time job, because you don't have to spend all your working day for this assignment.
Requirements:
- 80 y.o. or younger;
- Bank account available (ability to open a new bank account);
- E-mail available;
- Several hours a day to spend for this job;
- PC confident user;
- Internet skills;
- Independence, responsibility, initiative Ability to learn and to achieve goals, extensive communication skills.
How to Start: To start the job of manager of support to supervise operations concerning investments and securities dealing with private persons, it is necessary to fill out the job application form in our site.
Wages: Wages of the Support Manager of Norden United LTD equal a certain % from the amount of each transfer made to his bank account (the sum is different in each case and calculates individually). Feel the privelege of this job when the wages are defined by the employee. The more transfers he processes, the bigger wages he gets.
* The transfer should be done by Western Union or Moneygram services to fasten the process. The salary you get is a certain percent of every transaction made to your account( average percent is 7 to 10 % dependable of the money amount).
Domain Information (for experts)
Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably false and may point to innocent third parties.
norden-united.biz
Query at around 2006-11-13 12:19 UTC.
Domain Name: NORDEN-UNITED.BIZ
Domain ID: D14843913-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Name Server: NS2.READY-HR.COM
Name Server: NS1.READY-HR.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Oct 13 01:33:00 GMT 2006
Domain Expiration Date: Fri Oct 12 23:59:59 GMT 2007
Domain Last Updated Date: Thu Nov 02 01:11:46 GMT 2006
norden-industries.biz
Query at around 2006-11-13 12:19 UTC.
Domain Name: NORDEN-INDUSTRIES.BIZ
Domain ID: D14843915-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Name Server: NS2.READY-HR.COM
Name Server: NS1.READY-HR.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Oct 13 01:33:12 GMT 2006
Domain Expiration Date: Fri Oct 12 23:59:59 GMT 2007
Domain Last Updated Date: Thu Nov 02 01:10:53 GMT 2006
norden-united.net
Query at around 2006-11-13 12:44 UTC.
Domain Name: NORDEN-UNITED.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.READY-HR.COM
Name Server: NS2.READY-HR.COM
Updated Date: 01-Nov-2006
Creation Date: 16-Oct-2006
Expiration Date: 16-Oct-2007
norden-united.info
Query at around 2006-11-13 12:44 UTC.
Domain ID:D15010902-LRMS
Domain Name:NORDEN-UNITED.INFO
Created On:13-Oct-2006 01:58:21 UTC
Last Updated On:13-Oct-2006 01:58:27 UTC
Expiration Date:13-Oct-2007 01:58:21 UTC
Sponsoring Registrar:MIT (R141-LRMS)
Name Server:YNS1.YAHOO.COM
Name Server:YNS2.YAHOO.COM
uninord.biz
Query at around 2006-11-19 13:14 UTC.
Domain Name: UNINORD.BIZ
Domain ID: D14865122-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Name Server: NS2.LLOOAADD.COM
Name Server: NS1.LLOOAADD.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Sun Oct 15 20:27:59 GMT 2006
Domain Expiration Date: Sun Oct 14 23:59:59 GMT 2007
Domain Last Updated Date: Wed Nov 15 19:26:49 GMT 2006
united-nord.com
Query at around 2006-12-14 01:07 UTC
Domain Name: UNITED-NORD.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS2.LLOOAADD.COM
Name Server: NS1.LLOOAADD.COM
Updated Date: 12-Dec-2006
Creation Date: 11-Dec-2006
Expiration Date: 11-Dec-2007
norden.hk
Query at around 2006-12-15 07:02 UTC
Domain Name: NORDEN.HK
Email: norden@Safe-mail.net
Domain Name Commencement Date: 2006-10-18
Expiry Date: 2007-10-19
Name Servers Information:
NS1.LLOOAADD.COM
NS2.LLOOAADD.COM
norden-info.biz
Query at around 2006-12-17 15:49 UTC
Domain Name: NORDEN-INFO.BIZ
Domain ID: D15589127-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant Email: mcclychrs@yahoo.com
Name Server: NS2.LLOOAADD.COM
Name Server: NS1.LLOOAADD.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Mon Dec 11 23:02:07 GMT 2006
Domain Expiration Date: Mon Dec 10 23:59:59 GMT 2007
Domain Last Updated Date: Mon Dec 11 23:21:36 GMT 2006
united-nord.biz
Query at around 2006-12-26 01:06 UTC
Domain Name: UNITED-NORD.BIZ
Domain ID: D15700439-BIZ
Sponsoring Registrar: GANDI SARL
Sponsoring Registrar IANA ID: 81
Registrant ID: O-1072438-GANDI
Registrant Name: Jay Bodney
Registrant Email: babcb97d4fb20f0f2bb4b947db7fa0fe-1074227@owner.gandi.net
Name Server: NS1.EXP-WOW.COM
Name Server: NS2.EXP-WOW.COM
Created by Registrar: GANDI SARL
Last Updated by Registrar: GANDI SARL
Domain Registration Date: Wed Dec 20 22:52:54 GMT 2006
Domain Expiration Date: Wed Dec 19 23:59:59 GMT 2007
Domain Last Updated Date: Wed Dec 20 23:05:14 GMT 2006
united-nord.info
Query at around 2007-01-07 09:10 UTC
Domain ID:D15645955-LRMS
Domain Name:UNITED-NORD.INFO
Created On:12-Dec-2006 00:13:07 UTC
Last Updated On:20-Dec-2006 22:27:31 UTC
Expiration Date:12-Dec-2007 00:13:07 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-233710
Registrant Email:gabi_maillet@yahoo.com
Name Server:NS1.EXP-WOW.COM
Name Server:NS2.EXP-WOW.COM
norden-info.net
Query at around 2007-01-11 05:51 UTC
Domain Name: NORDEN-INFO.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.EXP-WOW.COM
Name Server: NS2.EXP-WOW.COM
Updated Date: 07-jan-2007
Creation Date: 11-dec-2006
Expiration Date: 11-dec-2007
email: mcclychrs@yahoo.com
norden-company.biz
Query at around 2007-01-15 02:38 UTC
Domain Name: NORDEN-COMPANY.BIZ
Domain ID: D15717760-BIZ
Sponsoring Registrar: GANDI SARL
Sponsoring Registrar IANA ID: 81
Registrant Email: 417bc297f84610c5d136decaae453d43-1074642@owner.gandi.net
Name Server: NS1.EXP-WOW.COM
Name Server: NS2.EXP-WOW.COM
Created by Registrar: GANDI SARL
Last Updated by Registrar: GANDI SARL
Domain Registration Date: Fri Dec 22 05:18:28 GMT 2006
Domain Expiration Date: Fri Dec 21 23:59:59 GMT 2007
Domain Last Updated Date: Wed Dec 27 20:42:51 GMT 2006
nord-ltd.info
Query at around 2007-01-15 20:16 UTC
Domain ID:D15812081-LRMS
Domain Name:NORD-LTD.INFO
Created On:22-Dec-2006 11:49:21 UTC
Last Updated On:13-Jan-2007 12:45:21 UTC
Expiration Date:22-Dec-2007 11:49:21 UTC
Sponsoring Registrar:Gandi Sarl (R191-LRMS)
Registrant ID:O-1072996-GANDI
Registrant Email:db0010ca5f0efc53e7b175995359206d-1074785@owner.gandi.net
Name Server:NS1.EXP-WOW.COM
Name Server:NS2.EXP-WOW.COM
45 comments:
norden.hk and norden-ltd.com are also being used.
Norden SPAM has started appearing in Mailboxes now, I had one today, Monday 4th December.
Confirmed spam emails, one dated Dec 05, 2006.
received it today...
the sender was : Norden United, ltd" tytrpyflu@free.fr
Received one today, sender was
zndatwrrux@gmx.net.
Dec 11
Rose
Is there anything I can do about these e-mails please?
One of the most effective ways to stop spam is to get a new email address. Sign up for a GMail (GoogleMail) address, for example. Not only does it have excellent spam filtering, but the simple fact that the address is new keeps most of the spam out -- for a while, at least.
If a new email address is too inconvenient, then the only other option is to improve the anti-spam measures on your existing address.
I received the same mail today with a senders deatils as follows:
Norden United, LTD [ssvqkqlwx@smapxsmap.net]
BTW I have received several hundred of every one of the scam mails you mention in relation to this one, are they all linked? Whilst I am happy to post details on this blog is anybody actually doing anything with the info?
The scams are almost certainly linked, given the overlap between them. They are the product of one gang, or maybe two. Not that this information helps us much.
I'm not really interested in the sender email addresses, since these are invariably false for this particular scam: if you sent mail to the sender addresses, you'd either get an "invalid address" bounce message or contact an uninvolved person. What I am interested in (for this scam) is the domain names they use. If you see one that isn't already reported here (on in one of the other comments), then please add it.
As to what anyone is doing with the info: some people search for it, and are informed that the job offer is a scam. Beyond that, it maintains a good historical record of the scam. I'm afraid it's too much to hope that we might actually neutralise the scammers at this point in time. It's possible to complain about individual domain names and get them shut down, but not rapidly enough to make it worthwhile in my opinion.
Hello, I have just, today 17/12/06, had an email from this company in my spam mail folder.
It is from Norden United, ltd
And this is the email address it is supposed to come from!!!
cvgpebljl@walla.com
Also it is very interesting as you can't copy and paste the letter. The spammers are using another technique which makes that impossible at the moment.
Below is what you get if you try to copy and paste!!
He eyed it, then pulled it a bit closer to the jamb. do carbon a week after she brought those oogy sundaes?
His limp would have been deeper and more pronounced if he had been walking on his own foot instead of a custom-made prosthesis. But " He bent to his notes again. Oh what a long night this was going to be. ""Well. Where? Then he worked his way over to the wall, pushing the shards of broken bottle out of his way with the sides of his hands as he went. ("Virginia") Sandpiper's letter said, were all genuine, not reproductions and while Paul could not tell for sure, he guessed that it was the truth. compote
Hi Got this, along with other similar scams.
You can cut and paste BUT as it's not a text file you have to right click and copy the image.
Does anyone still fall for these obvious scams?
Just found an advert for Norden United Ltd on medicalworkers dot com
Yeah just got one as well from sender rogixxjptfiend@kichimail.com>.
These people need to be stopped.
I received one today and the link is norden-info.net/html/jobs.php
united-nord.info is also being used
http://www.norden-ltd.com/apply.php is also being used
Just got one today
Now operating under http://norden-info.net
sender was : norden united
Darn - just when I thought I was onto financial freedom. :)
Here are some interesting items from the e-mail header:
X-Originating-IP: [84.100.37.102]
Return-Path: yjynylm@kinki-kids.com
from=kinki-kids.com; domainkeys=neutral (no sig)
Received: from 84.100.37.102 (HELO 102.37.100-84.rev.gaoland.net) (84.100.37.102)
Received: from grungecafe.com [36.28.114.189]
by staryoskol.com with SMTP id CK35WBJ87P
X-Authentication-Warning: FAG77-conversation6.ZIZ301e.david.esthost.com (unknown [110.220.33.24]): ze953bryn set sender to wdagvgbmzzjptf@kellychen.com using -z
From: "Norden United" yjynylm@kinki-kids.com
received several today in my junk mail box in yahoo....
How is it that these emails get to me when it's not even my email address in the "To" field? My email address has 11 characters but only the first 6 match, the rest don't.
The "From:" and "To:" address in an email don't have to bear any relationship to the reality of actual delivery. Spammers use this "feature" all the time to confuse matters.
http://norden.hk/html/jobs.php is being used as of 10 minutes ago... I'll givethem credit, it's better done than the nigeria scams... they might get a few people from it...
I'm sending this off to Phone Busters here in Canada. They deal with things like this up here.
Got one today 12/25/06 from zmwwjgkvic@grungecafe.com - Norden United, LTD
I receive 4 so far from different companies, norden united is the one, from elsa svitbirg, I replyed saying fuck you and your scam, they never replyed,my friend said I need more info, they bombarded with email with info, trying to get him to send him mailing address and so on.
http://norden.hk/ received today in Australia. I would love to know who cares at a political / police level, enough to stop these people.
"Norden United ltd" email address: xpfebavsc@freeserve.co.uk under the Elsa Svitborg. also had this url attached:
http://united-nord.info/html/jobs.php
Got one today,If you copy the letter
and then paste into Word, just a few lines appear, however if you "select all" and change the font colour (they must use white) I got this
let"" up to you. ""I never saw him again,»she said. Black stars rocketed through Geoffrey's head. I just meant that a lien isn't much compared to what they could do if you got seriously in arrears. He crawled through the door, expecting her hand to settle around his ankle again at any moment, but that did not happen. adjudicate
Vacancy from international financial company. :Sun, 31 Dec 2006 20:00:18 -0800...
Standard Header|Hide Pane
"Norden United, LTD" rhrimdq@tenchiclub.com
"Norden United, LTD" rhrimdq@tenchiclub.com...
AddSunday, 31 December, 2006 11:00:21 PM
To:
Cc:
billiard.gif (14KB)
i received this today please note the new e mail address being used in there e mails
and surprise surprise it takes you to there little scam site do thay rely think they can get web savvie people to do this the only ones that will unfortentley get hit with this is the not so savie i know the FBI and New Scotland yard are working on these scamers it is simerler to one run about 6 months ago out of Nigeria but that one was run through yahoo messenger and i believe msn as well so they are moving up a notch we will see
I have gotten several of these emails.. Here is the first one I got, this is what I get when I copy and paste.
I hope this helps...
"Norden United ltd" xmjnagxwbqt at aol dot com
View Contact Details Add Mobile Alert
To: Orion520000 orion520000@yahoo.com
Subject: Vacancy from international financial company. :Fri, 22 Dec 2006 11:19:27 -0800
Date: Fri, 22 Dec 2006 13:17:27 -0600
So what was the truth? absorptive addison "Annie, how in God's name could I get upstairs?
the panicky voice screamed just the as the cop opened the door of his cruiser and stepped out, adjusting his Smokey Bear hat as he did so. She did it because I told her no and she had to accept that. She hadn't gone into the shed; she was going down cellar. She seemed pleased. The third was that Annie Wilkes was dangerously crazy. Followed by a child of three who had fallen down a well, sustained grievous head injuries, and been brought to Riverview in a coma. After all, it was her single hesitant suggestion about the bee-sting which had shaped the book and given it its urgency when Paul had firmly believed he could never feel urgent about Misery again. alphabetic
I have found what I think is a new scam that I thought everyone should know about..This is what happened when I tried to copy and paste;
From: Impex Consult Financial Consulting Group Wilkes.Tania@altern.org
Subject: earn with us! [Sat, 30 Dec 2006 02:56:23 -0800]
"I put down traps. amigo corpuscular ""The first time to get medication.
Again she bent over to check whatever it was she had at the foot of the bed; again he heard a faint dull clunk/clank, wood thumping against some metallic object, and then she turned back, brushing absently at her hair again. I said, "Dear God, Paul Sheldon may be dead when I get back. She'll be driving six white HORSES, driving six white HORSES. "Here's your book, Annie,»he panted, and his hand closed on more paper. Yes! Geoffrey's look did more than stun her, and again she heard the dim thunder of black thoughts somewhere back in her head. Paul knew that even an exhaustive analysis would turn up precious few traces of blood — his car had spent most of the spring with snowmelt running through it at flood-speed. contravention
Does any one know how too teel the scams from the real thing?? or are they all scams?? If you have any information please feel free tpo email me: orladylinda1@yahoo.com
Thanks
You should suspect any unsolicited job offer that you receive via email of being a scam. Scammers need a lot of victims like this, so there are a lot of vacancies for suckers.
I got one too from "Norden United ltd" Best Job Offer – Don't Miss Your Chance! :Thu, 04 Jan 2007 18:30:00 -0800, and it's not even my email adress complett, under the name of Elsa Svitborg, tha same shit !
Recived email from:
"Norden United LTD" ulnozxwdzurk@purinmail.com
was ssent to another email than mine and still made it to my Bulk mail.
Hi! I have received scams like this a couple of times. In addition I received one last night I don't know but the content seems suspicious. Came from a company called Impex Consult Financial Consulting Group. They are looking for transactions Specialist and the task look similiar to the ones described at the Norden United.
O yeah by the way their url is http://imcons.info/e/index.php?p=p3
Sender info of today's version (Jan 14/07) is ezwsptxfkyskb@freeproblem.com
received spam email as described with gif and hyperlink to norton-industries.info
Norden United [qbfahxmihtpein@kellychen.com]
received email today. Also went to the website out of curiosity. What I am wondering is what actually happens when some one applies for a job? What is the scam other than annoying people with stupid emails? How do they make money?
Got one today 19/01/2007 from fgvbjfpi@computermail.net
URL http://norden.hk/html/manager.php
I've been getting several of these per day for a while now.
I've also got a scam from Norden United, domain name norden.hk, Sunday, January 28,2007.
The most astonishing thing to me is that the extremely poor English, as well as the absurdity of an Icelandic government employee soliciting staff on behalf of a European company via a Hong Kong website, seems not to deter at least a few people from believing this might be legitimate. These people aren't even aiming to be plausible, when a small payment to a copywriter could actually improve their success rate enormously.
I think a useful browser mod would be to have prominently displayed the country name of the TLD, and also the domain registration date from a WHOIS lookup - conspicuously highlighted if relatively new. That doesn't sound like too difficult a technical challenge.
Similarly, mail readers should be able to easily spot invisible text (e.g. white on white) and alert the user to its presence and possible significance.
This kind of approach is needed because the technically savvy and naturally sceptical already have the tools to spot these scams, but people new to the web or casual, non-technical users will not - until it's too late.
I received this scam on 4/17/07. The from address was @chicofamily3.ni and the reply address was norden@yahoo.se. They are using the name Norden Textiles Limited. So sad, So sad...
Post a Comment