Viking Finance Ltd

Summary

Another in a long line of "direct transfer" money mule scams [see sidebar for more information about money mule scams], Viking Finance appears to be a direct descendant of Athens Financial Group Ltd.

The Spam

As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.

Representative image

Names used as signature

• Ulrika Jaresund

Sender names encountered

Capitalisation may vary

• Viking Finance

Domain names involved

The following links have been encountered in spam, listed in order of encounter.

1. http://vikfn.biz/index.php?sect_id=6
2. http://vikfn.org/index.php?sect_id=6
3. http://vikfn.info/index.php?sect_id=6

The following domains are obviously related, but iDeceive has not yet received spam using these domains.

• vikfn.net
• viking-finance.net

The above is not an exhaustive list of involved domains -- merely the ones we know about. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted. Note the extreme similarity to Athens Financial Group Ltd, particularly in the text.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably fabricated and may point to innocent third parties.

vikfn.biz

Query at around 2006-12-04 13:57 UTC

Domain Name:                                 VIKFN.BIZ
Domain ID:                                   D15360278-BIZ
Sponsoring Registrar:                        CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID:                113
Registrant ID:                               CNEU-143599
Registrant Email:                            ewamorawska345@yahoo.com
Name Server:                                 NS1.MB2GB.COM
Name Server:                                 NS2.MB2GB.COM
Created by Registrar:                        CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar:                   CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date:                    Wed Nov 22 19:45:02 GMT 2006
Domain Expiration Date:                      Wed Nov 21 23:59:59 GMT 2007
Domain Last Updated Date:                    Fri Nov 24 22:37:59 GMT 2006

vikfn.org

Query at around 2006-12-07 15:57 UTC

Domain ID:D133471431-LROR
Domain Name:VIKFN.ORG
Created On:22-Nov-2006 18:39:19 UTC
Last Updated On:24-Nov-2006 22:36:17 UTC
Expiration Date:22-Nov-2007 18:39:19 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-170749
Registrant Email:davidstreet17@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.info

Query at around 2006-12-08 08:36 UTC

Domain ID:D15404697-LRMS
Domain Name:VIKFN.INFO
Created On:22-Nov-2006 19:14:10 UTC
Last Updated On:24-Nov-2006 22:37:24 UTC
Expiration Date:22-Nov-2007 19:14:10 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-231123
Registrant Email:paulacamastro@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.net

Query at around 2006-12-08 13:25 UTC

   Domain Name: VIKFN.NET
   Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
   Whois Server: whois.joker.com
   Referral URL: http://www.joker.com
   Name Server: NS1.MB2GB.COM
   Name Server: NS2.MB2GB.COM
   Updated Date: 24-Nov-2006
   Creation Date: 22-Nov-2006
   Expiration Date: 22-Nov-2007
email:        tamaragamble45@yahoo.com

viking-finance.net

Query at around 2006-12-14 15:55 UTC

   Domain Name: VIKING-FINANCE.NET
   Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
   Whois Server: whois.joker.com
   Referral URL: http://www.joker.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Updated Date: 23-Nov-2006
   Creation Date: 22-Nov-2006
   Expiration Date: 22-Nov-2007
email:        annamariamanodori@yahoo.com