Job scam quick guide: it's a scam if...

  • they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.
  • they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.
  • they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.
  • they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".
  • it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Monday, February 05, 2007

Radius Investments, LLC (impostors)

Summary

Money mule scam (see sidebar for more information). The scammers have simply copied a website belonging to a legitimate business, Radius Investments, LLC, and replaced one of the pages with their bogus "career" page. Like the Norden United scam, there are three job openings listed on the page, but the second and third are red herrings designed to make the money mule job look more attractive. If this scam evolves anything like the Norden scam, then we can expect to see this scam appear under a variety of domain names over time. The real "Radius Investments, LLC" are known to be associated (at this time) with the domain names "radiusinvestments.com" and "radiusgroup.com". Beware of impostors.

The Spam

The message is presented in a GIF image, accompanied by nonsense "filter buster" text coloured to be invisible against the background.

Representative image

Sender names encountered

Capitalisation and punctuation may vary.

  • Radius investments, LLC
  • Radius investments

Domain names involved

The following links have been encountered in spam, listed in order of encounter.

  1. http://radiusgr.org/career.php
  2. http://radiusgr.biz/career.php
  3. http://radiusgr.net/career.php
  4. http://radgroup.cn/career.php
  5. http://radigroup.cn/career.php
  6. http://radigr.org/career.php
  7. http://radigroup.org/career.php
  8. http://radigr.cn/career.php
  9. http://radgrp.biz/career.php
  10. http://radgrupll.cn/career.php
  11. http://radiddrp.cn/career.php
  12. http://radgrpp.cn/career.php
  13. http://radgrpp.be/career.php
  14. http://radiigrp.cn/career.php
  15. http://radgrpp.hk/career.php
  16. http://radgr.hk/career.php
  17. http://radiusgrp.hk/career.php
  18. http://radgrrp.hk/career.php
  19. http://radgrup.hk/career.php
  20. http://radgrp.hk/career.php

The above is not necessarily an exhaustive list of involved domains -- merely the ones we know about. The list is updated as new domains come to our attention. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted.

Since this "careers" page does not exist on the original website, the text has been plagiarised from other sources. Some of the text is reproduced here with comments to aid in understanding of the scammers' modus operandi.

Investing is a trillion dollar business. As the population ages and wealth grows, the demand for investing professionals will increase dramatically. This is great news for you if you are thinking of going in to investing. Jobs in investing involve helping individuals and business manage risk to protect themselves from catastrophic losses and to anticipate potential risk problems. Work in this area is not only personally rewarding, but can be financially rewarding as well. You could work in a variety of areas in investing including as an underwriter, a sales representative, an asset manager, a customer service representative or an actuary. A theme that is constantly emphasized by investing professionals is that the industry is ultimately about helping people when they need it the most. The stereotype of a slick, sleazy, fast-talking investing salesman is largely a figment of the past.

The exact original source of the above text is hard to pinpoint, since it has been widely plagiarised across the Internet, with the caveat that all instances of "investing" in the above text were originally "insurance". Take any key phrase, replace "investing" with "insurance" if needs be, and conduct a search to see how many times that paragraph has been copied.

At Radius Group Investment, you have the opportunity to learn, grow and make a difference. Work together with seasoned professionals to create ideas and solutions for a wide variety of commercial and residential properties and their tenants.

Our competitive advantage is a result of talented personnel. We continually search for highly motivated, multi-dimensional individuals, who seek opportunities for growth.

Opportunities abound whether you are interested in property management, asset management, architecture, development, lease administration, IT, commercial leasing, accounting or human resources. In addition to a rewarding work experience, our flexible work/life benefits are designed to meet the unique needs of today's ever-changing workforce.

Radius Group's employees enjoy competitive salaries, comprehensive benefits packages, matching 401(k), free parking, metro accessibility and the stability of a growing, diversified real estate company.

The above text is plagiarised from Washington Real Estate Investment Trust's employment page, with "Radius Group" substituted for the original name.

The responsibilities of the investment assistant consist of reception and sending cash assets and requires only the ability of counting the interest. The candidate doesn't need a special education of a financier. Of course, we welcome the presence of special education or experience of working in the financial field. On a position of our investment assistant, your direct responsibilities will be to deal with the financial means from our customers (these are the payments and prepayments for various services that clients order with us), which means the direct reception of the funds into your bank account, calculation of all the expenses and your interest, and transaction of the funds further to one of our regional branches, depending on the availability of the certain specialists or ordered securities in a particular regional office. In order to fasten the process of the delivery of the funds, you are supposed to transfer the money by means of Western Union or Money Gram systems (these systems give you a chance to have the funds available in any part of the world within the next 10-15 minutes after the money has been sent).

Please notice that you receive 10% of the sum for every payment made with your assistance. You immediately deduct your commission out of the received sum, and we pay all the expenses concerned with sending money from the sum that is liable to be sent.

You can fulfill our tasks along with your direct work, because they require only 1-2 hours of free time a day, 2-3 times a week, also you can plan your schedule with us in advance. You only have to warn us at least a week earlier about the day when you don't have any possibility to fulfill our tasks, and this day you won't receive payments.

The above text is written specifically for this page, rather than copied, but it shows all the usual hallmarks of a money mule scam. Note in particular the receipt of funds, deducting a percentage, and forwarding the balance via Western Union or Money Gram. Note also the broken English, suggesting that the author is not a native speaker. In particular, the phrase "to fasten the process of the delivery" is distinctively associated with this kind of scam.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and not misleading fabrications.

radiusgr.org

Query at around 2007-02-05 04:08 UTC

Domain ID:D137742178-LROR
Domain Name:RADIUSGR.ORG
Created On:19-Jan-2007 23:52:01 UTC
Last Updated On:04-Feb-2007 15:23:34 UTC
Expiration Date:19-Jan-2008 23:52:01 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-175635
Registrant Email:brad2602@hotmail.com
Name Server:NS1.JP-NANI.COM
Name Server:NS2.JP-NANI.COM

radiusgr.biz

Query at around 2007-02-05 04:22 UTC

Domain Name:                                 RADIUSGR.BIZ
Domain ID: D16068645-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-145738
Registrant Email: ibp95412@hotmail.com
Name Server: NS1.JP-NANI.COM
Name Server: NS2.JP-NANI.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Jan 19 23:41:27 GMT 2007
Domain Expiration Date: Fri Jan 18 23:59:59 GMT 2008
Domain Last Updated Date: Sun Feb 04 15:22:08 GMT 2007

radiusgr.net

Query at around 2007-02-08 03:46 UTC

   Domain Name: RADIUSGR.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.JP-NANI.COM
Name Server: NS2.JP-NANI.COM
Updated Date: 04-feb-2007
Creation Date: 19-jan-2007
Expiration Date: 19-jan-2008

radgroup.cn

Query at around 2007-02-17 21:26 UTC

Domain Name: radgroup.cn
ROID: 20070120s10001s11669634-cn
Administrative Email: beaehrmann@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.big-bun.com
Name Server:ns2.big-bun.com
Registration Date: 2007-01-20 09:22
Expiration Date: 2008-01-20 09:22

radigroup.cn

Query at around 2007-02-21 14:34 UTC

Domain Name: radigroup.cn
ROID: 20070120s10001s11671759-cn
Administrative Email: walendialinda@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.non-st.com
Name Server:ns2.non-st.com
Registration Date: 2007-01-20 10:00
Expiration Date: 2008-01-20 10:00

radigr.org

Query at around 2007-02-22 17:04 UTC

Domain ID:D139801671-LROR
Domain Name:RADIGR.ORG
Created On:16-Feb-2007 22:05:50 UTC
Last Updated On:19-Feb-2007 13:27:38 UTC
Expiration Date:16-Feb-2008 22:05:50 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-178462
Registrant Email:balesdlloyd@hotmail.com
Name Server:NS1.NON-ST.COM
Name Server:NS2.NON-ST.COM

radigroup.org

Query at around 2007-02-23 17:43 UTC

Domain ID:D137744307-LROR
Domain Name:RADIGROUP.ORG
Created On:20-Jan-2007 02:06:51 UTC
Last Updated On:16-Feb-2007 09:33:05 UTC
Expiration Date:20-Jan-2008 02:06:51 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-175643
Registrant Email:racheltatton-brown@hotmail.com
Name Server:NS1.BIG-BUN.COM
Name Server:NS2.BIG-BUN.COM

radigr.cn

Query at around 2007-02-26 14:32 UTC

Domain Name: radigr.cn
ROID: 20070217s10001s21580434-cn
Administrative Email: selmaaugustin@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.non-st.com
Name Server:ns1.non-st.com
Registration Date: 2007-02-17 05:57
Expiration Date: 2008-02-17 05:57

radgrp.biz

Query at around 2007-02-26 21:48 UTC

Domain Name:                                 RADGRP.BIZ
Domain ID: D16473806-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-147160
Registrant Email: jzwiekopf@hotmail.com
Name Server: NS1.NON-ST.COM
Name Server: NS2.NON-ST.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Fri Feb 16 22:16:39 GMT 2007
Domain Expiration Date: Fri Feb 15 23:59:59 GMT 2008
Domain Last Updated Date: Mon Feb 26 11:00:58 GMT 2007

radgrupll.cn

Query at around 2007-03-01 06:20 UTC

Domain Name: radgrupll.cn
ROID: 20070228s10001s25622689-cn
Administrative Email: blurdge1@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.non-st.com
Name Server:ns2.non-st.com
Registration Date: 2007-02-28 03:55
Expiration Date: 2008-02-29 03:55

radiddrp.cn

Query at around 2007-03-02 00:06 UTC

Domain Name: radiddrp.cn
ROID: 20070301s10001s25943492-cn
Administrative Email: freycarsten@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.hthead.com
Name Server:ns1.hthead.com
Registration Date: 2007-03-01 01:52
Expiration Date: 2008-03-01 01:52

radgrpp.cn

Query at around 2007-03-02 13:02 UTC

Domain Name: radgrpp.cn
ROID: 20070301s10001s25944036-cn
Administrative Email: austincoxhill@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns1.hthead.com
Name Server:ns2.hthead.com
Registration Date: 2007-03-01 01:59
Expiration Date: 2008-03-01 01:59

radgrpp.be

Query at around 2007-03-04 04:01 UTC

Domain:      radgrpp
Status: REGISTERED
Registered: Thu Mar 1 2007

Agent:
Name: Gandi Sas
Website: http://www.gandi.net

Nameservers:
ns1.hthead.com
ns2.hthead.com

radiigrp.cn

Query at around 2007-03-04 04:03 UTC

Domain Name: radiigrp.cn
ROID: 20070301s10001s25945648-cn
Administrative Email: jiraknorri@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.hthead.com
Name Server:ns1.hthead.com
Registration Date: 2007-03-01 02:18
Expiration Date: 2008-03-01 02:18

radgrpp.hk

Query at around 2007-03-04 04:17 UTC

Domain Name: RADGRPP.HK
Email: karen_ebbs2003@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822244T
Name Servers Information:

NS1.HTHEAD.COM
NS2.HTHEAD.COM

radgr.hk

Query at around 2007-03-06 02:42 UTC

Domain Name: RADGR.HK
Email: blurdge1@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822250T
Name Servers Information:

NS1.HTHEAD.COM
NS2.HTHEAD.COM

radiusgrp.hk

Query at around 2007-03-06 14:12 UTC

Domain Name: RADIUSGRP.HK
Email: fredi-gansen@hotmail.com
Domain Name Commencement Date: 2007-03-01
Expiry Date: 2008-03-01
Name of Registrar: HKDNR
Account Name: HK1822196T
Name Servers Information:

NS1.GET-MM.COM
NS2.GET-MM.COM

radgrrp.hk

Query at around 2007-03-07 13:51 UTC

Domain Name: RADGRRP.HK
Email: selmaaugustin@hotmail.com
Domain Name Commencement Date: 2007-03-07
Expiry Date: 2008-03-07
Name of Registrar: HKDNR
Account Name: HK1824466T
Name Servers Information:

NS1.CODE-GO.COM
NS2.CODE-GO.COM

radgrup.hk

Query at around 2007-03-09 01:41 UTC

Domain Name: RADGRUP.HK
Email: balesdlloyd@hotmail.com
Domain Name Commencement Date: 2007-03-07
Expiry Date: 2008-03-07
Name of Registrar: HKDNR
Account Name: HK1824463T
Name Servers Information:

NS1.CODE-GO.COM
NS2.CODE-GO.COM

radgrp.hk

Query at around 2007-03-17 12:34 UTC

Domain Name: RADGRP.HK
Email: bilatmsle@hotmail.com
Domain Name Commencement Date: 2007-03-02
Expiry Date: 2008-03-02
Name of Registrar: HKDNR
Account Name: HK1822253T
Name Servers Information:

NS1.YEOYANG.COM
NS2.YEOYANG.COM

29 comments:

Anonymous said...

RADGR.BIZ is another of their domains I've gotten spams on. Unlike most phishers and scammers, this has been registered longer than most I encounter as I recall it was 1/20/07 when locked in.

Your ally at the London Antiphishing Society, near Arkansas Nuclear One.

Anonymous said...

"Raidus Investments" appears to be the new and improved "Impex Consulting."

I was receiving the "Impex Consulting" spam, but that has now stopped and "Raidus Investments" spam is now being received with the same regularity.

The emails are also originating from the same "zombie" IPs that were being used by the "Impex" emails.

If you have Gmail, you can avoid seeing these and possibly help stop them by doing something relatively simple.

Set up a filter to automatically delete "Raidus Investment" emails and automatically forward them to spam@uce.gov at the same time.

It would be best if people actually forwarded the emails to spam@uce.gov with the headers as well, but the automatic forwarding might help some since some of us are already forwarding header information.

Anonymous said...

http://radiusgr.org/career.php
http://radiusgr.biz/career.php
http://radiusgr.net/career.php

suspended on 15.02.07

Experts

Anonymous said...

Impex Consult: 23.01.07 suspended

http://imconsult.biz/e/
http://www.imconsult.biz
http://consult-imp.net/e/
http://im-consult.org/


The following sites will be suspended soon:

http://consult-im.biz/e/
http://www.consult-im.biz/e/
http://consult-im.net/e/
http://consult-im.biz/e/
http://consult-im.org/e/
http://consult-imp.com/e/

Experts

Spotter said...

New domain active: radgroup.cn

Anonymous said...

http://www.radgroup.cn/
DONE!
Experts

Anonymous said...

http://radigroup.org/career.php
Edit: suspended on 19.02.07
Experts

Anonymous said...

http://www.radgroup.cn/ suspended: 20.02.07

Experts

Anonymous said...

The following sites have been suspended: 20.02.07

http://consult-im.biz/e/
http://www.consult-im.biz/e/
http://consult-im.net/e/
http://consult-im.biz/e/
http://consult-im.org/e/
http://consult-imp.com/e/

Experts

Spotter said...

New domain active: radigroup.cn

Spam received at confidential spamtrap address: policy forbids header disclosure.

Anonymous said...

I'm not sure if you have been notified about this address, but I just received spam from the same company but from http://radgr.org/career.php

Spotter said...

New domain active: radigr.org

Spam received at confidential spamtrap address: policy forbids header disclosure.

Spotter said...

The domain "radigroup.org" has come to my attention through a spamtrap address which I obviously don't give enough attention: the spam arrived nearly a week ago, and the domain seems to be defunct already.

Spotter said...

New domain active: radigr.cn

Spam received at confidential spamtrap address: policy forbids header disclosure.

Spotter said...

New domain active: radgrp.biz

Spotter said...

New domain active: radgrupll.cn

The same second-level name will probably be registered in other top-level domains, but I haven't found evidence of it yet (in .com, .net, .org, or .biz).

Spotter said...

They're still going: radiddrp.cn has just appeared

Spotter said...

New domain active: radgrpp.cn

Ronald said...

http://radigrrp.cn/contact.php

Here is the latest one being used

Spotter said...

Latest additions: radgrpp.be, radiigrp.cn, and radgrpp.hk

Spotter said...

New domain active: radgr.hk

Spotter said...

New domain active: radiusgrp.hk

Spotter said...

New domain active: radgrrp.hk

Spotter said...

New domain active: radgrup.hk

Ronald said...

http://radiusgrp.hk/career.php

Yet another one.

Spotter said...

radiusgrp.hk is already listed at #17 in my list, but yes, it is still active at this time.

Spotter said...

New domain active: radgrp.hk

Anonymous said...

Is Radius Resources associated with this ? - their street address is 95 South Street, NY, which appears to be under the Brooklyn Bridge ?

Anonymous said...

Received an email from HR Manager, Aegis Capital Group(?) for the post of Account Manager..their email ID was Malcolm.Jaramillo558 @freeproblem.com (freeproblem?) ..their site name is Aegis Capitall(hk) regd in the name of Brianna Pettigrew at HKDNR - HK1872760T; Server names - NS1.Yeoyang.com & NS2Yeoyang.com.
M/s Aegis Capital (the real one) has commented in their "legal field" on this scam ....but most people dont check this field..so it does little good to those who have recd these emails and are looking for verification.