Summary
Money mule scam (see sidebar for more information). The scammers have simply copied a website belonging to a legitimate business, Radius Investments, LLC, and replaced one of the pages with their bogus "career" page. Like the Norden United scam, there are three job openings listed on the page, but the second and third are red herrings designed to make the money mule job look more attractive. If this scam evolves anything like the Norden scam, then we can expect to see this scam appear under a variety of domain names over time. The real "Radius Investments, LLC" are known to be associated (at this time) with the domain names "radiusinvestments.com" and "radiusgroup.com". Beware of impostors.
The Spam
The message is presented in a GIF image, accompanied by nonsense "filter buster" text coloured to be invisible against the background.
Representative image
Sender names encountered
Capitalisation and punctuation may vary.
- Radius investments, LLC
- Radius investments
Domain names involved
The following links have been encountered in spam, listed in order of encounter.
- http://radiusgr.org/career.php
- http://radiusgr.biz/career.php
- http://radiusgr.net/career.php
- http://radgroup.cn/career.php
- http://radigroup.cn/career.php
- http://radigr.org/career.php
- http://radigroup.org/career.php
- http://radigr.cn/career.php
- http://radgrp.biz/career.php
- http://radgrupll.cn/career.php
- http://radiddrp.cn/career.php
- http://radgrpp.cn/career.php
- http://radgrpp.be/career.php
- http://radiigrp.cn/career.php
- http://radgrpp.hk/career.php
- http://radgr.hk/career.php
- http://radiusgrp.hk/career.php
- http://radgrrp.hk/career.php
- http://radgrup.hk/career.php
- http://radgrp.hk/career.php
The above is not necessarily an exhaustive list of involved domains -- merely the ones we know about. The list is updated as new domains come to our attention. Please post comments below if you are aware of other domains involved in this scam.
Website
Here is a snapshot of the website taken at around the time this blog entry was first posted.
Since this "careers" page does not exist on the original website, the text has been plagiarised from other sources. Some of the text is reproduced here with comments to aid in understanding of the scammers' modus operandi.
Investing is a trillion dollar business. As the population ages and wealth grows, the demand for investing professionals will increase dramatically. This is great news for you if you are thinking of going in to investing. Jobs in investing involve helping individuals and business manage risk to protect themselves from catastrophic losses and to anticipate potential risk problems. Work in this area is not only personally rewarding, but can be financially rewarding as well. You could work in a variety of areas in investing including as an underwriter, a sales representative, an asset manager, a customer service representative or an actuary. A theme that is constantly emphasized by investing professionals is that the industry is ultimately about helping people when they need it the most. The stereotype of a slick, sleazy, fast-talking investing salesman is largely a figment of the past.
The exact original source of the above text is hard to pinpoint, since it has been widely plagiarised across the Internet, with the caveat that all instances of "investing" in the above text were originally "insurance". Take any key phrase, replace "investing" with "insurance" if needs be, and conduct a search to see how many times that paragraph has been copied.
At Radius Group Investment, you have the opportunity to learn, grow and make a difference. Work together with seasoned professionals to create ideas and solutions for a wide variety of commercial and residential properties and their tenants.
Our competitive advantage is a result of talented personnel. We continually search for highly motivated, multi-dimensional individuals, who seek opportunities for growth.
Opportunities abound whether you are interested in property management, asset management, architecture, development, lease administration, IT, commercial leasing, accounting or human resources. In addition to a rewarding work experience, our flexible work/life benefits are designed to meet the unique needs of today's ever-changing workforce.
Radius Group's employees enjoy competitive salaries, comprehensive benefits packages, matching 401(k), free parking, metro accessibility and the stability of a growing, diversified real estate company.
The above text is plagiarised from Washington Real Estate Investment Trust's employment page, with "Radius Group" substituted for the original name.
The responsibilities of the investment assistant consist of reception and sending cash assets and requires only the ability of counting the interest. The candidate doesn't need a special education of a financier. Of course, we welcome the presence of special education or experience of working in the financial field. On a position of our investment assistant, your direct responsibilities will be to deal with the financial means from our customers (these are the payments and prepayments for various services that clients order with us), which means the direct reception of the funds into your bank account, calculation of all the expenses and your interest, and transaction of the funds further to one of our regional branches, depending on the availability of the certain specialists or ordered securities in a particular regional office. In order to fasten the process of the delivery of the funds, you are supposed to transfer the money by means of Western Union or Money Gram systems (these systems give you a chance to have the funds available in any part of the world within the next 10-15 minutes after the money has been sent).
Please notice that you receive 10% of the sum for every payment made with your assistance. You immediately deduct your commission out of the received sum, and we pay all the expenses concerned with sending money from the sum that is liable to be sent.
You can fulfill our tasks along with your direct work, because they require only 1-2 hours of free time a day, 2-3 times a week, also you can plan your schedule with us in advance. You only have to warn us at least a week earlier about the day when you don't have any possibility to fulfill our tasks, and this day you won't receive payments.
The above text is written specifically for this page, rather than copied, but it shows all the usual hallmarks of a money mule scam. Note in particular the receipt of funds, deducting a percentage, and forwarding the balance via Western Union or Money Gram. Note also the broken English, suggesting that the author is not a native speaker. In particular, the phrase "to fasten the process of the delivery" is distinctively associated with this kind of scam.
Domain Information (for experts)
Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and not misleading fabrications.
radiusgr.org
Query at around 2007-02-05 04:08 UTC
Domain ID:D137742178-LROR
Domain Name:RADIUSGR.ORG
Created On:19-Jan-2007 23:52:01 UTC
Last Updated On:04-Feb-2007 15:23:34 UTC
Expiration Date:19-Jan-2008 23:52:01 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-175635
Registrant Email:brad2602@hotmail.com
Name Server:NS1.JP-NANI.COM
Name Server:NS2.JP-NANI.COM
radiusgr.biz
Query at around 2007-02-05 04:22 UTC
Domain Name: RADIUSGR.BIZ
Domain ID: D16068645-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-145738
Registrant Email: ibp95412@hotmail.com
Name Server: NS1.JP-NANI.COM
Name Server: NS2.JP-NANI.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Jan 19 23:41:27 GMT 2007
Domain Expiration Date: Fri Jan 18 23:59:59 GMT 2008
Domain Last Updated Date: Sun Feb 04 15:22:08 GMT 2007
radiusgr.net
Query at around 2007-02-08 03:46 UTC
Domain Name: RADIUSGR.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.JP-NANI.COM
Name Server: NS2.JP-NANI.COM
Updated Date: 04-feb-2007
Creation Date: 19-jan-2007
Expiration Date: 19-jan-2008
radgroup.cn
Query at around 2007-02-17 21:26 UTC
Domain Name: radgroup.cn
ROID: 20070120s10001s11669634-cn
Administrative Email: beaehrmann@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.big-bun.com
Name Server:ns2.big-bun.com
Registration Date: 2007-01-20 09:22
Expiration Date: 2008-01-20 09:22
radigroup.cn
Query at around 2007-02-21 14:34 UTC
Domain Name: radigroup.cn
ROID: 20070120s10001s11671759-cn
Administrative Email: walendialinda@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.non-st.com
Name Server:ns2.non-st.com
Registration Date: 2007-01-20 10:00
Expiration Date: 2008-01-20 10:00
radigr.org
Query at around 2007-02-22 17:04 UTC
Domain ID:D139801671-LROR
Domain Name:RADIGR.ORG
Created On:16-Feb-2007 22:05:50 UTC
Last Updated On:19-Feb-2007 13:27:38 UTC
Expiration Date:16-Feb-2008 22:05:50 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-178462
Registrant Email:balesdlloyd@hotmail.com
Name Server:NS1.NON-ST.COM
Name Server:NS2.NON-ST.COM
radigroup.org
Query at around 2007-02-23 17:43 UTC
Domain ID:D137744307-LROR
Domain Name:RADIGROUP.ORG
Created On:20-Jan-2007 02:06:51 UTC
Last Updated On:16-Feb-2007 09:33:05 UTC
Expiration Date:20-Jan-2008 02:06:51 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-175643
Registrant Email:racheltatton-brown@hotmail.com
Name Server:NS1.BIG-BUN.COM
Name Server:NS2.BIG-BUN.COM
radigr.cn
Query at around 2007-02-26 14:32 UTC
Domain Name: radigr.cn
ROID: 20070217s10001s21580434-cn
Administrative Email: selmaaugustin@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.non-st.com
Name Server:ns1.non-st.com
Registration Date: 2007-02-17 05:57
Expiration Date: 2008-02-17 05:57
radgrp.biz
Query at around 2007-02-26 21:48 UTC
Domain Name: RADGRP.BIZ
Domain ID: D16473806-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-147160
Registrant Email: jzwiekopf@hotmail.com
Name Server: NS1.NON-ST.COM
Name Server: NS2.NON-ST.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Feb 16 22:16:39 GMT 2007
Domain Expiration Date: Fri Feb 15 23:59:59 GMT 2008
Domain Last Updated Date: Mon Feb 26 11:00:58 GMT 2007
radgrupll.cn
Query at around 2007-03-01 06:20 UTC
Domain Name: radgrupll.cn
ROID: 20070228s10001s25622689-cn
Administrative Email: blurdge1@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.non-st.com
Name Server:ns2.non-st.com
Registration Date: 2007-02-28 03:55
Expiration Date: 2008-02-29 03:55
radiddrp.cn
Query at around 2007-03-02 00:06 UTC
Domain Name: radiddrp.cn
ROID: 20070301s10001s25943492-cn
Administrative Email: freycarsten@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.hthead.com
Name Server:ns1.hthead.com
Registration Date: 2007-03-01 01:52
Expiration Date: 2008-03-01 01:52
radgrpp.cn
Query at around 2007-03-02 13:02 UTC
Domain Name: radgrpp.cn
ROID: 20070301s10001s25944036-cn
Administrative Email: austincoxhill@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.hthead.com
Name Server:ns2.hthead.com
Registration Date: 2007-03-01 01:59
Expiration Date: 2008-03-01 01:59
radgrpp.be
Query at around 2007-03-04 04:01 UTC
Domain: radgrpp
Status: REGISTERED
Registered: Thu Mar 1 2007
Agent:
Name: Gandi Sas
Website: http://www.gandi.net
Nameservers:
ns1.hthead.com
ns2.hthead.com
radiigrp.cn
Query at around 2007-03-04 04:03 UTC
Domain Name: radiigrp.cn
ROID: 20070301s10001s25945648-cn
Administrative Email: jiraknorri@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.hthead.com
Name Server:ns1.hthead.com
Registration Date: 2007-03-01 02:18
Expiration Date: 2008-03-01 02:18
radgrpp.hk
Query at around 2007-03-04 04:17 UTC
Domain Name: RADGRPP.HK
Email: karen_ebbs2003@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822244T
Name Servers Information:
NS1.HTHEAD.COM
NS2.HTHEAD.COM
radgr.hk
Query at around 2007-03-06 02:42 UTC
Domain Name: RADGR.HK
Email: blurdge1@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822250T
Name Servers Information:
NS1.HTHEAD.COM
NS2.HTHEAD.COM
radiusgrp.hk
Query at around 2007-03-06 14:12 UTC
Domain Name: RADIUSGRP.HK
Email: fredi-gansen@hotmail.com
Domain Name Commencement Date: 2007-03-01
Expiry Date: 2008-03-01
Name of Registrar: HKDNR
Account Name: HK1822196T
Name Servers Information:
NS1.GET-MM.COM
NS2.GET-MM.COM
radgrrp.hk
Query at around 2007-03-07 13:51 UTC
Domain Name: RADGRRP.HK
Email: selmaaugustin@hotmail.com
Domain Name Commencement Date: 2007-03-07
Expiry Date: 2008-03-07
Name of Registrar: HKDNR
Account Name: HK1824466T
Name Servers Information:
NS1.CODE-GO.COM
NS2.CODE-GO.COM
radgrup.hk
Query at around 2007-03-09 01:41 UTC
Domain Name: RADGRUP.HK
Email: balesdlloyd@hotmail.com
Domain Name Commencement Date: 2007-03-07
Expiry Date: 2008-03-07
Name of Registrar: HKDNR
Account Name: HK1824463T
Name Servers Information:
NS1.CODE-GO.COM
NS2.CODE-GO.COM
radgrp.hk
Query at around 2007-03-17 12:34 UTC
Domain Name: RADGRP.HK
Email: bilatmsle@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822253T
Name Servers Information:
NS1.YEOYANG.COM
NS2.YEOYANG.COM
29 comments:
RADGR.BIZ is another of their domains I've gotten spams on. Unlike most phishers and scammers, this has been registered longer than most I encounter as I recall it was 1/20/07 when locked in.
Your ally at the London Antiphishing Society, near Arkansas Nuclear One.
"Raidus Investments" appears to be the new and improved "Impex Consulting."
I was receiving the "Impex Consulting" spam, but that has now stopped and "Raidus Investments" spam is now being received with the same regularity.
The emails are also originating from the same "zombie" IPs that were being used by the "Impex" emails.
If you have Gmail, you can avoid seeing these and possibly help stop them by doing something relatively simple.
Set up a filter to automatically delete "Raidus Investment" emails and automatically forward them to spam@uce.gov at the same time.
It would be best if people actually forwarded the emails to spam@uce.gov with the headers as well, but the automatic forwarding might help some since some of us are already forwarding header information.
http://radiusgr.org/career.php
http://radiusgr.biz/career.php
http://radiusgr.net/career.php
suspended on 15.02.07
Experts
Impex Consult: 23.01.07 suspended
http://imconsult.biz/e/
http://www.imconsult.biz
http://consult-imp.net/e/
http://im-consult.org/
The following sites will be suspended soon:
http://consult-im.biz/e/
http://www.consult-im.biz/e/
http://consult-im.net/e/
http://consult-im.biz/e/
http://consult-im.org/e/
http://consult-imp.com/e/
Experts
New domain active: radgroup.cn
http://www.radgroup.cn/
DONE!
Experts
http://radigroup.org/career.php
Edit: suspended on 19.02.07
Experts
http://www.radgroup.cn/ suspended: 20.02.07
Experts
The following sites have been suspended: 20.02.07
http://consult-im.biz/e/
http://www.consult-im.biz/e/
http://consult-im.net/e/
http://consult-im.biz/e/
http://consult-im.org/e/
http://consult-imp.com/e/
Experts
New domain active: radigroup.cn
Spam received at confidential spamtrap address: policy forbids header disclosure.
I'm not sure if you have been notified about this address, but I just received spam from the same company but from http://radgr.org/career.php
New domain active: radigr.org
Spam received at confidential spamtrap address: policy forbids header disclosure.
The domain "radigroup.org" has come to my attention through a spamtrap address which I obviously don't give enough attention: the spam arrived nearly a week ago, and the domain seems to be defunct already.
New domain active: radigr.cn
Spam received at confidential spamtrap address: policy forbids header disclosure.
New domain active: radgrp.biz
New domain active: radgrupll.cn
The same second-level name will probably be registered in other top-level domains, but I haven't found evidence of it yet (in .com, .net, .org, or .biz).
They're still going: radiddrp.cn has just appeared
New domain active: radgrpp.cn
http://radigrrp.cn/contact.php
Here is the latest one being used
Latest additions: radgrpp.be, radiigrp.cn, and radgrpp.hk
New domain active: radgr.hk
New domain active: radiusgrp.hk
New domain active: radgrrp.hk
New domain active: radgrup.hk
http://radiusgrp.hk/career.php
Yet another one.
radiusgrp.hk is already listed at #17 in my list, but yes, it is still active at this time.
New domain active: radgrp.hk
Is Radius Resources associated with this ? - their street address is 95 South Street, NY, which appears to be under the Brooklyn Bridge ?
Received an email from HR Manager, Aegis Capital Group(?) for the post of Account Manager..their email ID was Malcolm.Jaramillo558 @freeproblem.com (freeproblem?) ..their site name is Aegis Capitall(hk) regd in the name of Brianna Pettigrew at HKDNR - HK1872760T; Server names - NS1.Yeoyang.com & NS2Yeoyang.com.
M/s Aegis Capital (the real one) has commented in their "legal field" on this scam ....but most people dont check this field..so it does little good to those who have recd these emails and are looking for verification.
Post a Comment