Job scam quick guide: it's a scam if...

  • they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.
  • they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.
  • they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.
  • they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".
  • it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Monday, December 04, 2006

Viking Finance Ltd

Summary

Another in a long line of "direct transfer" money mule scams [see sidebar for more information about money mule scams], Viking Finance appears to be a direct descendant of Athens Financial Group Ltd.

The Spam

As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.

Representative image

scam email image

Names used as signature

  • Ulrika Jaresund

Sender names encountered

Capitalisation may vary

  • Viking Finance

Domain names involved

The following links have been encountered in spam, listed in order of encounter.

  1. http://vikfn.biz/index.php?sect_id=6
  2. http://vikfn.org/index.php?sect_id=6
  3. http://vikfn.info/index.php?sect_id=6

The following domains are obviously related, but iDeceive has not yet received spam using these domains.

  • vikfn.net
  • viking-finance.net

The above is not an exhaustive list of involved domains -- merely the ones we know about. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted. Note the extreme similarity to Athens Financial Group Ltd, particularly in the text.

scam website snapshot

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably fabricated and may point to innocent third parties.

vikfn.biz

Query at around 2006-12-04 13:57 UTC

Domain Name:                                 VIKFN.BIZ
Domain ID: D15360278-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-143599
Registrant Email: ewamorawska345@yahoo.com
Name Server: NS1.MB2GB.COM
Name Server: NS2.MB2GB.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Wed Nov 22 19:45:02 GMT 2006
Domain Expiration Date: Wed Nov 21 23:59:59 GMT 2007
Domain Last Updated Date: Fri Nov 24 22:37:59 GMT 2006

vikfn.org

Query at around 2006-12-07 15:57 UTC

Domain ID:D133471431-LROR
Domain Name:VIKFN.ORG
Created On:22-Nov-2006 18:39:19 UTC
Last Updated On:24-Nov-2006 22:36:17 UTC
Expiration Date:22-Nov-2007 18:39:19 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-170749
Registrant Email:davidstreet17@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.info

Query at around 2006-12-08 08:36 UTC

Domain ID:D15404697-LRMS
Domain Name:VIKFN.INFO
Created On:22-Nov-2006 19:14:10 UTC
Last Updated On:24-Nov-2006 22:37:24 UTC
Expiration Date:22-Nov-2007 19:14:10 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-231123
Registrant Email:paulacamastro@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.net

Query at around 2006-12-08 13:25 UTC

   Domain Name: VIKFN.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.MB2GB.COM
Name Server: NS2.MB2GB.COM
Updated Date: 24-Nov-2006
Creation Date: 22-Nov-2006
Expiration Date: 22-Nov-2007
email: tamaragamble45@yahoo.com

viking-finance.net

Query at around 2006-12-14 15:55 UTC

   Domain Name: VIKING-FINANCE.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Updated Date: 23-Nov-2006
Creation Date: 22-Nov-2006
Expiration Date: 22-Nov-2007
email: annamariamanodori@yahoo.com

8 comments:

Unknown said...

Guess the Greek identity wasn't plausible, so now they're Norse...

Looks like this is 504 (for now!)

Unknown said...

Another clone of the same site: http://www.viking-finance.net

Spotter said...

That one is quite interesting: it's directly hosted at Yahoo! rather than hidden behind a botnet. It could be the "master site" for which all the others are fronts.

viking-finance.net has address 68.142.212.137
viking-finance.net has address 68.142.212.138
viking-finance.net has address 68.142.212.139
viking-finance.net has address 68.142.212.140
viking-finance.net has address 68.142.212.141
viking-finance.net has address 68.142.212.117

Those are all Yahoo! servers.

Anonymous said...

Viking Financial ltd resurfaced as vikgfn.com

Chased them off Eastlink (Halifax N.S,Canada) Shaw (Richmond, B.C,, Canada) and maybe even Comcast. Persistant buggers.

Anonymous said...

Etansfer and Latratrade.com are the brothers of this type of business that I recieved an e-mail from and currently etansfer has a job posting on the Careerbuilder.com website. They say in the job posting that they are looking for payment processors.

Anonymous said...

New one:

Andersonruffet Art Studio:

Ad in Chronicle Herald Newspaper.

Halifax N.S. Canada

Some one to process payments and fwd to assign dest.

Anonymous said...

I got this in my inbox today... seems pretty similar or maybe a name change

Welcome to the WPP Group!
We are very glad that you wish to join our team, will be delighted to have you work with us
The position of "Representative" provides support filling the transactions of our customers.
We deal exclusively with private clients,- that have special requirements for high speed of receiving funds for their business .
This way we can offer a new kind of financial and banking service to our clients - and we
would like you to work as an "Representative".(part-time job 2-3 hours a day except holidays)
At first your work would be very basic, yet meticulous -you will make transfers for our clients to suit their needs. Our managers will assist you during the trial period and explain everything you will need to know. We offer an extremely competitive graduated salary: for the first month you will receive up to $3500 AUD for your work the next month your salary will be increased if you do your work accurately and on time. Now you are only one step away from successful career.

If you meet all requirements - don't hesitate to get more information on this great position called "Fund Operator".
Reply to: brilliant.deal@gmail.com with subject "Interested" " Job Offer" to receive full information on this great position. Limited time offer, don't wait! And Good luck.

Thank you in advance,
Jennifer Mellea HR Manager.
WPP Finance.Ltd

Spotter said...

It's the same kind of scam as WPP, on which I do have a dedicated entry.