Job scam quick guide: it's a scam if...

  • they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.
  • they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.
  • they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.
  • they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".
  • it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Wednesday, February 28, 2007

Crystal Consulting Inc.

This one is more than a week old already, and not from one of my more common spamtraps. I found it while doing a spot check. The sections of random text in a small size are an attempt to fool spam filters. It didn't work in my case: the message was correctly classified as spam. It's a money mule scam, and they have their own domain and website. No further comment at this time.

   Domain Name: CONSULT-CRYSTAL.COM <--scam
   Registrar: YESNIC CO. LTD.
   Whois Server: whois.yesnic.com
   Referral URL: http://www.yesnic.com
   Name Server: NS1.BUHADESUNYADER.COM
   Name Server: NS2.BUHADESUNYADER.COM
   Updated Date: 15-feb-2007
   Creation Date: 13-feb-2007 <-- new
   Expiration Date: 13-feb-2008

---------- Forwarded message ----------
From: Eula Sears <272geordie[@]mail.de>
Date: 18-Feb-2007 09:30
Subject: Big paycheck Job Offer
To: [redacted]

Good day!

Crystal Consulting Inc. , one of the fastest growing financial group in USA. With over six
years of specialized experience has openings for "Financial agent" place
Company was established in 2000 year, currently is based in USA and provides mergers and
acquisitions consultation and policy consulting for all clients across the entire range of
wealth management and financial services businesses worldwide.
delusion bondage aldrich bayberry antiphonal blvd approve cameron boisterous circumstantial avoid altern christoffel buddhist banister chose bizarre compactify bolometer cousin discordant anastomotic avocet atomic argonaut assent amble collapsible chorus bellini ana calcareous argive degenerate civil bourbaki cotyledon commiserate amplitude christie angelfish conqueror alicia chaparral cartographer codpiece barren citric

We are seeking individuals who are interested in building a profitable and rewarding
business with our help and support, while achieving a balanced lifestyle that offers both
personal and professional growth. This job, if approached correctly is an opportunity for
almost unlimited income potential, and very fast-growing career.

And the Job itself is not that hard one may think, on a contrary it as easy as
one-two-three, as we already have mentioned the "Financial agent" is indeed one of the
main part of the company work-chain, and the "Financial agent" will have responsibility
for receiving company funds and dividends and sending them to the company clients. The
Crystal Consultng Inc. is growing and we again need an
open-minded people with the ambition to become successful and richer indeed.

Requirements:
bulb classificatory champ concessionaire bosch bluet coaxial candidacy chirp crocodile beechwood ada blister blow accompaniment christie create admixture dapple amherst abo culture bullwhack deprecatory alight belfry cornelia creaky ascetic damp assort audacity book cousin catalytic bugle bessemer deus churchwoman antigone chlorate barium adept bistable close car caddy calico

The ideal candidate has prior experience and familiarity with financial services.
o You must have excellent organizational as well as customer service skills.
o Teamwork Skill is a "must".
o Bachelor Degree is an advantage.

To accept this business proposal, please, fill out the registration form offered in
our website: www.consult-crystal.com/careers.html


autistic autocratic bean collude colza diebold botch chert biggs acclimate abreact airman colon billfold bedspread comatose cancel convene board compile boolean charlottesville beta bantu aurora counterclockwise corey doldrum amalgam blast consolidate argillaceous directrices centaur chairwoman barbour cargill cannon accede deface assimilable conduit delia bp camouflage ass cyprian cajole
Andrew McCain
Human Resource Department
Crystal Consultng Inc.

www.consult-crystal.com
deft although catv bizarre cretinous budweiser chiang coexistent about aggressive atom allyl dilatory breed alvin arsenic dangle allied catbird asperity bookbind appian codfish baptism antic distribution descendant approximant admiration blurb cutler awl brinkmanship allied archbishop bootstrap burnout beatify alhambra betelgeuse caraway algol bezel celia doldrums ammeter dispersive bayport

GlobalTransfers Inc

Another obvious money mule scam. The only noteworthy thing about it was that it arrived at an address which doesn't get much of this stuff. The reference toDoubleClick is a smokescreen and not true. The "from" address is genuine in the sense that the message did come from an acrus9.cz designated mail host, but the body of the message requests replies to a "safe-mail.net" address.

---------- Forwarded message ----------
From: phbqjaovw@arcus9.cz <phbqjaovw@arcus9.cz>
Date: 28-Feb-2007 22:15
Subject: Job Alert From GlobalTransfers Inc
To: [redacted]

Hello
You have been contacted as a potential employee who has registered on one of DoubleClick Inc websites. To remove yourself from the mailing list please visit www.doubleclick.com.
My name is Albert Cooper , project coordinator and your direct supervisor at GlobalTransfers Inc. I will try to explain about our company and the entry level positions available in a nutshell.
GlobalTransfers Inc. currently offers a secure, fast, and inexpensive means to transfer funds and goods internationally . GlobalTransfers Inc. headquarters is located in Emil-Figge-Strasse 74 D-324, Dortmund, SE13 3PT,Germany.

There are 15-25 openings for a representative (depending on client activity) to assist in creation our virtual local presence for the back office functions. Person, who is accepted for this position, will perform these tasks:
Responsible for processing the applications
Process work requests necessary to maintain an effective payments transfer program;
Managing cash and balancing receipts;
Making collections;
Posting payments;
Making bank deposits;
Operating within prescribed budgets;
Consult with Senior Manager in developing payment schedules;
Coordinate the assignments;
Operate a computer and modern software to operate and maintain a computerized operations program;
Perform related duties and responsibilities as required.
You will be compensated for the time spent on each project at a $21.00 per hour rate. You will be paid every two weeks via corporate check! Also you will receive 3% commission from the transaction amount! You must have a bank account to receive wages from us. Dependant on your work results, you might be hired on a full time basis within 1-2 months. Please remember that no self respecting company will ask you for any upfront fees or any kind of payment to begin employment! Please note that while is no prior experience requirements, good communications skills and responsible personality is a plus!

If you are interested please email me Andrew Cooper at A.Cooper@safe-mail.net with 'Interested' in a subject line to receive further information.

Your information will be used only within GlobalTransfers Inc. Every employee, who satisfies our requirements, will be contacted by our manager via e-mail. Phone interviews will be mandatory before full time employment!

Sincerely,
Regional manager
Albert Cooper

GlobalTransfers Inc
Emil-Figge-Strasse 74 D-324
Dortmund
Germany

Customer service:
Fax: 49-331-934-9003

Kitto Foods Inc. UK

Cheque fraud money mule scam. The sender does not represent any company, and obviously isn't afraid to tell whopping great lies (see end of email). Note that a UK +4470 phone number is used, which can be redirected internationally. The source IP was 193.124.133.218, which is currently delegated to Russia.

---------- Forwarded message ----------
From: KITTO FOODS INC.UK <kittofoodsinc1[@]uk2.net>
Reply-to:
kittofoodsinc07@yahoo.co.uk
Date: 28-Feb-2007 13:21
Subject: NEW JOB ONLINE OFFER . UK !!
To: ideceive@gmail.com


FOODS INC.UK
45, SHERINGHAM DRIVE,
NOTTINGHAM TD2 3HW.
UNITED KINGDOM
FAX: +44 7005 9217 08


I am David Morgan, managing director of KITTO FOODS INC. UK. We Sells Vegemite, Kitto cheese,
Kitto Peanut Butter,Maxwell House coffee, Oreo cookies, Ritz biscuits, Captain's Table crackers,
Philadelphia cream cheese, and Toblerone chocolates. We have reached big sales volume in the
european market and we have now penetrated America, Canada and recently, Northern American markets.

I am searching for agents who can helpme establish a medium of getting to my customers in the
Canada,America,Europe and recently North America as well as making payments through you to me.
Please if you are interested in transacting business with me I will be glad.

HOW MUCH WILL YOU EARN?
I will give you 13% for everycompleted transaction. Your duty is to receive cheques sent to you
by my customers from any of these countries: Canada,America,Europe and recently North America. I
will increase your percentage as we proceed.

ADVANTAGES
You do not have to go out as you will work as an independent agent right from your home office.
Your job is absolutely legal and 100% risk free.You do not need any capital to start. The
AGENT that make efforts and work hard have a strong possibility of earning higher percentages.

Anyway our AGENTS never leave us.If you are willing to assist, I will want you to immediately
transcribe the required details on the AGENT form below to enable us proceed as some customer
are ready to start making payments.
Please, you have to be an honest and trusted person, as more payments will be made through you in
the course of this transaction.
Thank you very much for your anticipated co-operation. This is hoping we will have a good working
relationship. For more information and details contact me via my confidential email:
kittofoodsinc07@yahoo.co.uk

Your truly,
Mr.David Morgan.
MD/C.E.O
KITTO FOODS INC.

THIS FORM WILL BE FILLED AND RETURNED VIA EMAIL OR FAX BY THE INTENDING
AGENT FOR VERIFICATION AND APPROVAL.


Name:........................

Address:.....................

Telephone:...................

Mobile:......................

Fax:.........................

Date of Birth:......... Sex:........

Occupation:......................

Email:...........................

Marital Status:.................

I ............................hereby declare that the above information is true and binding on
me. If at any time it is discovered that I have given false information, I will CEASE to be a
AGENT of this company and will be regarded as a disclaimer.

Sincerely,

……………………………
Intending Agent Signature
Note:  I hope your word will be your bond AND you will not attempt to defraud this
company as your word will be used against you in the court of law !





Tuesday, February 27, 2007

Meta: Apology for lack of updates

Nothing new has been published here recently, thanks to a mail-to-blog gateway problem at Blogspot. I've been updating old scams as new data arrives, but not posting any new, minor ones, since the gateway just swallows them whole. Hopefully they'll get it fixed soon, and more regular updates will resume.

Troy Inc

Money mule recruiter.

   Domain Name: 1TROYGMBH.COM <-- scam!
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.UNLIMHOST.COM
   Name Server: NS2.UNLIMHOST.COM
   Updated Date: 26-feb-2007
   Creation Date: 26-feb-2007 <-- new!
   Expiration Date: 26-feb-2008

---------- Forwarded message ----------
From: radams[@]arkansasusa.com <radams[@]arkansasusa.com>
Reply-to:
support@1troygmbh.com
Date: 27-Feb-2007 11:03
Subject: Internet - Office = Home Work <<>>from 800 AUD Per Week. (from 1500 AUD for corporate stuff)
To: ideceive@gmail.com

Internet office - position in Australia! Work in Internet with good salary!

Company Troy Inc web address http://commonwealth.1troygmbh.com/jobs.html - job offer part - is seeking for responsible, literate and honest persons for the positions in transaction services to be financial manager in Internet office.

1. Be able to check your email several times a day

2. Be able to respond to emails immediately

3. Be able to work overtime if needed

4. Be responsible and hard working

5. Be able to open bank account for company needs (if needed)

6. Should have personal bank account for receive payments

You will be asked for punctuality, managerial abilities and responsibility. You will also receive detailed instructions for subsequent actions from our manager, with information how to

receive/transfer the money.

Please contact us by mail recruitment@1troygmbh.com

STAR ENERGY GROUP

Money mule scam; freemail contact address. Note that UK +4470 phone numbers can be redirected internationally.

---------- Forwarded message ----------
From: MR. ROLAND WESSEL <jillinerose[@]ilovejesus.net>
Reply-to:
rolandwessel742@yahoo.co.uk
Date: 27-Feb-2007 10:44
Subject: INDICATE YOUR INTEREST ON THIS JOB OFFER(MR. ROLAND WESSEL)
To: [redacted]



Dear Friend,

I am Roland Wessel president/founder of STAR ENERGY GROUP PLC, we are
OPEC members who deal on crude oil and raw material and export into the
Canada/America and Europe, Africa, Asia and South America.

We are searching for Representatives who can help us establish a medium
of getting to our Customers in Canada, America,Asia,Africa and Europe
as well as making payments through you to us.

Please if you are willing to assist, i will want you to furnish me with
your particulars, so as to enable me give you further details.

Please,you have to be an honest and trusted person, as more payments
will be made through you in the course of this transaction.And more so
you will be entitled to 10% of every payment that you are able to receive
for us from our customers.

Please contact us for more information via email
(seg_rolandwessel247@yahoo.co.uk ) with the below informations filled
out.

Full Names
Occupation
Company Name (If Any)
Marital Status
Age
Sex
Phone
Contact Address
Email
Country
Bank Name

We look forward in working with you.

Sincerely
Roland Wessel (Mr.)
Chief Executive Officer
Star Energy Group Plc
Tel :+ 44 701 112 1999
Tel :+ 44 701 114 0794
Fax :+ 44 870 490 0574

Star Energy Group Plc
5 Lower Belgrave Street London SW1W 0NR United Kingdom

Friday, February 16, 2007

First Trader Company

Nonspecific job offer -- probably yet another money mule job. I'll post further details if they're silly enough to reply to a request for further information from someone called "Deception Spotter".

---------- Forwarded message ----------
From: Louie Rich <jimaul@aol.com>
Date: 17-Feb-0007 09:21
Subject: Company seeks for employees
To: ideceive@gmail.com

Good day!

We are looking for the honest and responsible people to cooperate with our "First Trader Company" from your home.
There are different kinds of a part time job that we will offer you.

We are waiting for your resume at our contact email: firsttraderco@aol.com

Regards,
First Trader

Sure enough, here's their canned response to requests for further information. They assure us it's not advance fee fraud or a pyramid scam -- which is true, because it's a money mule scam ("payment processing").

Domain Name:                                 FIRSTTRADER.US <-- scam
Domain ID:                                   D11901464-US
Sponsoring Registrar:                        TUCOWS INC.
Registrant ID:                               TULG2LOVH3KWHERM
Registrant Email:                            firsttraderco@aol.com
Name Server:                                 NS2.HYPERMART.NET
Name Server:                                 NS1.HYPERMART.NET
Created by Registrar:                        TUCOWS INC.
Domain Registration Date:                    Tue Feb 13 20:31:35 GMT 2007 <-- new
Domain Expiration Date:                      Tue Feb 12 23:59:59 GMT 2008

---------- Forwarded message ----------
From: firsttraderco@aol.com < firsttraderco@aol.com>
Date: 17-Feb-2007 09:14
Subject: Re: Company seeks for employees
To: ideceive@gmail.com

Good day,
Thank you for your letter.
From the beginning we should inform you, that you will be absolutely secured with us. You don't need to pay for join, like most internet companies ask.
Be careful of scam! We will never ask you to send us your password or credit card number in an email.
If you will get an email from someone asking you for credit card number or password, please inform us immediately about it.
We give you a job and we Pay to You. We don't need your personal information for it.
We are glad to see you are interested in a job.
>From now we will work personaly with you and help you to do this job in the right way.
We will care about your security and comfort. You will get your 1st salary in 2 weeks after join and it will be your guaranted salary for every 2 weeks during next 2 years.
Our employers have a salary 1900$ twice a month + 5% commision from each well done job.
This is a good salary for the part time job, but in return we require a honesty and a responsibility from you.
You will do this job from your home just being in touch with us and getting instructions online.
This job is given to you for 2 years.
We give the job to everyone and we pay good money, so if you want to keep this job for a long time, you should do it very well.
Now you should visit our web site and learn what our company does and what job is for you.
You should contact us for instructions and for next steps by ICQ:466130076 or e-mail:job@firsttrader.us after your registration.
Best Regards,
FirstTrader CO
Administrator
 
-----------------------
 
 
-----Original Message-----
From: ideceive@gmail.com
To: firsttraderco@aol.com
Sent: Thu, 15 Feb 2007 5:39 PM
Subject: Re: Company seeks for employees

What sorts of positions are you offering?


Check out the new AOL . Most comprehensive set of free safety and security tools, free access to millions of high-quality videos from across the web, free AOL Mail and more.

European IT company

Summary: person with Yahoo freemail address pretending to represent unspecified European IT company seeks ignorant sucker to launder money on a short term basis.

---------- Forwarded message ----------
From: Mark Richardson <resume[@]hitech.5bytes.com>
Date: 16-Feb-2007 06:01
Subject: Careerbuilder Job Opportunity
To: Deception Spotter < ideceive@gmail.com>

European IT company is currently seeking highly qualified candidates
to be a regional representative for human/financial operations.

Responsibilities:
- File correspondence and other records.
- Answer telephone calls and provide appropriate information to callers.
- Make copies of correspondence or other printed matters.
- Operate delivered correspondence, finance papers, etc.
- Other duties as required.

Requirements:
- We do not work with persons under 21;
- Minimal knowledge and experience about main bank services;
- A computer with access to the Internet, email, MS Word or Excel;
- Honest and responsible person;
- US RESIDENTS ONLY (no exceptions)

This is a part-time job, it will take 10-15 hours a week;
therefore you can do it without quitting your main job.

NO PAYMENTS OUT OF YOUR POCKET.
Incomes of $ 40000-6000 a year + bonus
Simply drop us an email to interwebls@yahoo.com
PLEASE DON'T REPLY TO THIS MAIL, USE THE MAIL IN ABOVE LINE INSTEAD
We'll get back to you fast
Hope to hear from you soon.

Thursday, February 15, 2007

Eastline Delivery Service

Summary

I'm calling this one "Eastline Delivery Service" because that text is used in the banner image on one of the websites, although neither of the instances I've seen so far use that name as their ostensible identity. There was an "Eastline Delivery Service" scam reported last year, but, sad to say, I was not included in that spam run -- or I just missed it. Ultimately, this is just further money mule recruiting, although it may be that they recruit general reshippers as well.

The Spam

The spam advertising the site is provided in both plain text and HTML. The HTML includes a lot of external references to graphics. Most sensible email clients block external graphics by default these days, as spammers sometimes use it as a means of detecting who views their mail. There seems to be no such explicit tracking in this instance, but I am reporting only the plain text version as a matter of convenience.

Representative text

   [spacer.gif]
Online Auction-Dealers Ltd. offers expert services related to putting out
for bidding at international e-auctions (eBay, Yahoo!, etc) on behalf of
vendors from all over the world. Being a high-reputed dealer we guarantee,
on the one hand, complete compliance of goods with their description at the
auction and on the other hand, prompt and timely payment.

Online Auction-Dealers Ltd. also supports the Seller with Financial
Representative's services in the Buyer's country, therefore accelerating and
facilitating payment process through mutually acceptable payment methods.
Online Auction-Dealers Ltd has opened Administrative Coordinator vacancies
in Australia.
* Education: Sales, customer operations, basic math skills, certifying
presentations and public performance skills (preferable).
* Basic knowledge and skills:
+ Ability to negotiate with customer and financial representatives;
+ Generating and holding presentations, public performance skills;
+ Generating commercial offers and business documentation skills;
+ MS Office (Excel, Word, Power Point) and Internet advanced skills;
* Personal characteristics:
+ Initiative;
+ Ability to work independently and communicate with co-workers and
customers;
* Responsibilities: The position entails the communication and
coordination of activities of workers engaged in one or more projects.
Administrative Coordinator may perform work of a similar type and level
as that of subordinates. Administrative Coordinator provides liaison
with clients and reports to senior management..
* Wage Details: $52k AUD plus bonuses

Working Hours: 9:00am-5:00pm (1 hr for lunch).

Costs and Fees: There are no upfront costs.

If you are interested in this vacancy and you feel, that your qualifications
correspond to our requirements, please click [1]HERE to fill in an
application form.
Thank you for your interest to this job.
Sincerely,
Online Auction-Dealers Ltd.
[spacer.gif]
2007 (C) Online Auction-Dealers Ltd.
All rights reserved. [spacer.gif]
New York, NY 10308, 56 Whitman Ave.
Phone: +1 (646) 219-6976
Fax: +1 (646) 219-6982

References

1. http://www.auctiondealer.biz/index.php?page=reg

Website

Here is a snapshot of http://www.abb-ds.net/ taken at around the time this blog entry was first posted. Note that the top banner/header is one large JPG image, and none of the things that look like links or form elements in that region are active. The website code attempts to load a Shockwave Flash application there, if available (which it isn't on my system).

The other instance of this site that I have seen at the time of posting is http://www.auctiondealer.biz/, and no header image was loading on that site, leaving the region blank white. The two columns below the banner, rather than the banner itself, are the key identifying features of this scam.

The websites are hosted behind a botnet providing proxy service.

Domain Information (for experts)

The following domains have been verified as hosting this scam. Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and not misleading fabrications.

abb-ds.net

   Domain Name: ABB-DS.NET
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.FIND-MB.COM
Name Server: NS2.FIND-MB.COM
Updated Date: 24-jan-2007
Creation Date: 24-jan-2007
Expiration Date: 24-jan-2009
Registrant Contact:
-
sohee lim (soheelim@usa.com)

auctiondealer.biz

Domain Name:                                 AUCTIONDEALER.BIZ
Domain ID: D16425790-BIZ
Sponsoring Registrar: THE REGISTRY AT INFO AVENUE
Sponsoring Registrar IANA ID: 123
Registrant ID: DI_5586272
Registrant Email: williamcampana@yahoo.com
Name Server: NS1.US-COLUMS.COM
Name Server: NS2.US-COLUMS.COM
Created by Registrar: THE REGISTRY AT INFO AVENUE
Last Updated by Registrar: THE REGISTRY AT INFO AVENUE
Domain Registration Date: Tue Feb 13 18:37:42 GMT 2007
Domain Expiration Date: Tue Feb 12 23:59:59 GMT 2008
Domain Last Updated Date: Tue Feb 13 18:39:39 GMT 2007

HERTZ DEVELOPMENT

Another money mule job scam. The domain name has been freshly registered for the scam.

   Domain Name: HERTZDEVELOPMENT.COM <-- scammers
   Registrar: REGISTER.COM, INC.
   Whois Server: whois.register.com
   Referral URL: http://www.register.com
   Name Server: NS1.BOL-MT.COM
   Name Server: NS2.BOL-MT.COM
   Updated Date: 13-feb-2007
   Creation Date: 13-feb-2007 <-- new
   Expiration Date: 13-feb-2008

---------- Forwarded message ----------
From: Mike Hayman <Becky[@]nisr.com>
Date: 14-Feb-2007 22:59
Subject: Australian Representative Required
To: [redacted]


Hello.
My name is Mike Hayman, I represent HERTZ DEVELOPMENT company located in Europe (offices in Finland and Latvia).
Our company is seekeing for a representatives in Australia for full-time and part-time jobs. This is not spam and we will not ask any money from you..
Your minimal income will be 4000 AUD a month in average and you will be paid DAILY.
No relocation required, job duties include mail and payments processing, standart office duties and everyday reporting.
All candidates have to be 18+ years old, authorized to work in Australia, with minimal computer knowlege. Both part-time (2-3 days a week) and full time (5 days a week) positions available.
Please, e-mail back to support@hertzdevelopment.com if you are interested and I will send you company requirements.
Mike Hayman
HERTZ DEVELOPMENT

Wednesday, February 14, 2007

Jyuben Woodwork Co. (impostors)

Ordinary money mule scam with nothing but a tall story and a Yahoo! address to back it up.

---------- Forwarded message ----------
From: FROM JYU BEN < jyu_benwood_works@yahoo.com.cn>
Reply-to: jyu_benwood_works@yahoo.com.cn
Date: 14-Feb-2007 08:37
Subject: BECOME OUR PAYMENT AGENT IN YOUR LOCATION
To: ideceive@gmail.com


Jyuben Woodwork Co.,Ltd.
Singsing Rd.,Heng Tang
128 Industrial Park Tong Xia,
Dongguan, Kwangtung, China
Tel: 86-769-7722116

Dear Sir/Madam,



I am Mr.JYU BEN,managinig director of JYU BEN WOODWORK CO,LTD
taiwan/china. We are a trading company that is into the import and export of goods
like funature,industrial, and office equipment, we export these
funature equipments to U.S,Canada and Europe.
Owing to the large amount of clients that we have in the U.S.A,we are
having difficulty in reaching all of them, therefore we decided to
employ representatives in all the states of america to help us get to our
clients. As our representative, you shall serve as a link between us
and our clients and you will also be responsible for the collection of payments
on our behalf.and here is our website if you wish to view.

:billiard.sportsnet.com.tw

Note: that you shall have a 10% commission for every payment that you
collect on our behalf.
Please if you are interested, I need you to supply the following details

1,FULL NAMES

2,CONTACT ADDRESS

3,PHONE/FAX NUMBER

4,COUNTRY OF RESIDENCE

5,OCCUPATION

Subject to your response, we shall have our company's attorney draft
out an agreement to seal up this contract.us at jyu_ben1990@yahoo.com.cn


Regards,

JYU BEN

Tuesday, February 13, 2007

Etansfer Inc.

Obvious money mule scam with particularly poor English. Note that it's "Etansfer Inc", not "Etransfer Inc". The website looks impressive to the untrained eye, but very familiar to anyone who has studied money mule scams for a while. The site content has been recycled hundreds of times under different names.

Domain Name:                                 ETANSFER-INC.BIZ <-- scammers
Domain ID:                                   D16395828-BIZ
Sponsoring Registrar:                        THE REGISTRY AT INFO AVENUE
Sponsoring Registrar IANA ID:                123
Registrant ID:                               DI_5569666
Registrant Email:                            davidkleinbn@yahoo.com
Name Server:                                 NS1.TIME-AM.COM
Name Server:                                 NS2.TIME-AM.COM
Created by Registrar:                        THE REGISTRY AT INFO AVENUE
Last Updated by Registrar:                   THE REGISTRY AT INFO AVENUE
Domain Registration Date:                    Sun Feb 11 21:09:09 GMT 2007 <-- new
Domain Expiration Date:                      Sun Feb 10 23:59:59 GMT 2008
Domain Last Updated Date:                    Sun Feb 11 21:13:51 GMT 2007

---------- Forwarded message ----------
From: Света Wagner <jrekxgh[@]mail.ru>
Date: 13-Feb-2007 22:04
Subject: .You have been invited to a Job from   Careerbuilder.com
To:

Etansfer Inc. invite residents of the various countries to cooperation.
Our clients need to accept payments from the various countries. Therefore we creating a network of regional agents which functions are reception of money and further transferring money to accounts of our company. We give you 8 % from the sum of translation. We guarantee worthy payment of your work.
If you want to earn from $200 to $800 per week and work Only 2-3 hours then this job for you !
This job requires punctuality, good organizational skills and proficiency with Microsoft windows and office programs to maintain inventory and fill nessesary forms:   http://www.etansfer-inc.biz/job/

This job is ideal for: housewives , students, older persons, people with restrictions. No money needed to start. This is a business requiring only limited amount of your time.
Requirements:
1. A computer with access to the Internet, e-mail
2. We don't work with persons under 18
3. 1-3 hours free during the week
4. Check your e-mail several times a day (each hour is perfect)
5. Reply to e-mails immediately
6. Bank or PayPal account to receive payments
7. Be responsible, hard working and communicable
We offer competitive compensation, including commission and expense reimbursement.
If you would like to get more information about this position and join our team please fill in the online application form: http://www.etansfer-inc.biz/job/jobs.htm

Thank You
http://www.etansfer-inc.biz/job/

Check out the all-new Yahoo! Mail beta - Fire up a more powerful email and get things done faster.

WBC INCORPORATED (fake)

The use of UK 070 phone numbers and yahoo.co.uk addresses are highly suggestive of Nigerian modus operandi, so I'm guessing that this job involves cashing fraudulent cheques.

---------- Forwarded message ----------
From: WBC INCORPORATED <talexander04[@]adelphia.net>
Reply-to: wbc_incorporated110@yahoo.co.uk
Date: 13-Feb-2007 13:48
Subject: REQUEST FOR COMPANY REPRESENTATIVE
To:

W.B.C INCORPORATED
UNION HOUSE,
ISLES OF MAN, 7M9 1DF,
BRITISH ISLE,
UNITED KINGDOM.
OUR REF: WBC/2028/E262/05,
DATE: 13-02-20007.

I am Mr. Klaus Mueller,CEO and
Owner of WBC Company based in the UK.
WBC is a pan-European distributor
specializing in semiconductors,
providing customers with products
and technical support for 16 leading
manufacturers. Established in 1998
with headquarters in Poing, near
Munich, WBC combines the strength
and services of a technical consultant
with basic distribution services.
Being a General Merchantile Company
we are searching for representatives
who can help us establish a medium of
getting to our customers in the Canada/America,
and some part of Europe as well as
making payments through you to us.
You do not have to leave your present
job for this one because this job offer
will be on a part time basis as it comes
once in a while and remuneration is on
a percentage basis of 10% of the tota
l amount you receive from my customers
at any time on my behalf.
The reason why i seek assistance is
hat American and some parts of Europe
check takes a long time to clear in the UK.
thereby holding business down for me and
my associates.I already have customers
who are ready to remit cash to my agents
now thus my contacting you.If you are
interested in transacting business with
us,do consult  me with  the following
informations via
email:wbc_incorporated110@yahoo.co.uk
(1)Your full names:
(2)Contact address:
(3)Country:
(4)Home/office phone:
(5)Occupation:
(6)Age:
(7)sex:
Very respectfully,
Klaus Mueller
C.E.O,WBC Inc.
Tel: +44 (0) 702-112-7452

Monday, February 12, 2007

Garrison Escrow

Wow, these guys are offering top dollar for suckers willing to be money mules. I guess you can offer insanely high rates when you're planning to pay with forged cheques.

---------- Forwarded message ----------
From: Vacancy Offer <offerjob[@]froutopia.com>
Date: 12-Feb-2007 12:36
Subject: Best job offer 2007
To: Deception Spotter < ideceive@gmail.com>

"Garrison Escrow" company searching for hard working person.

Age 21 and older,

Vacancy: finance administrator (male and female) , salary: 2200-2400 USD per week.

Period: 3 years and more.
Demands: hard working person, education - any basic.
Location: USA, Europe. You will work in you city, no trips, no relocation.
To get more details, send your CV and info according this email: garrisonsescrow@aol.com

--------------------------------------------------------------------------------
Regards Gerald L. Garrison,
head coordinator
.

International Charitable Foundation "Trust"

This is a pretty weird scam. The site to which this links pretends to provide aid for USA military personnel. They probably want you to be a money mule, like most of the other scams out there. Whatever the case, the broken english, strangeness, and recently-registered domain name all point to this being a Nigerian or Eastern European scam.

   Domain Name: SOLUCPROJET.COM <-- weird name, that
   Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
   Whois Server: whois.itsyourdomain.com
   Referral URL: http://www.itsyourdomain.com
   Name Server: NS1.KIFERTOK.COM
   Name Server: NS2.KOLIWASER.COM
   Updated Date: 09-feb-2007
   Creation Date: 09-feb-2007 <-- and yet they clam to have been around since 1992
   Expiration Date: 09-feb-2008

---------- Forwarded message ----------
From: Ed Kaufman <kelvin[@]u2club.com>
Date: 12-Feb-2007 05:27
Subject: Work.USA $3900
To: [redacted]@gmail.com

JOB OPPORTUNITIES

http://solucprojet.com/fund/join.html

The international company searches for workers in USA.
Now we have  vacancies in all states.
You will earn 3500-4500$ per month.

IF YOU WOULD LIKE TO START or get more info Please fill the FORM:

http://solucprojet.com/fund/join.html

MORE ABOUT JOB.

JOB REQUIREMENTS:
-No specific business experience is required for this business.
-You should be aged between 18 and 67.Male or female.
-Available for all USA residents.

Our proposal  oriented to  the USA RESIDENTS.

- You DON'T need to handle any products!No MLM,no Sales.
- DOES NOT Require investment.
- You will earn 3500-4500$ per month.

TO START or get more info Please fill the FORM:

http://solucprojet.com/fund/join.html

BBS Incorporated

Summary

Vague job offer sent via spam; the associated website makes it clear that the job is a money mule scam. There are probably many entities called "BBS Incorporated", but this particular scam just seems to have adopted the name arbitrarily, rather than impersonating anyone. The modus operandi strongly suggests that this is a reincarnation of the ITS Financial Corp scam: key phrases include "hope this message finds you in a great spirit" in the spam, and substantial overlap in the website text. The key difference in modus operandi is the use of image-as-text in this spam, although not all spams received to date are using this technique.

The Spam

The message is presented in a GIF image, accompanied by what appears to be garbled snatches of the Bible to confuse spam-detecting filters. The image is a hyperlink to a website.

Representative image

Links encountered

The following links have been encountered in spam, listed in order of encounter.

  1. http://www.ryecklunkd.com/index.html
  2. http://www.bbs-application.net/
  3. http://bbilagoday.net/index.html

The above is not necessarily an exhaustive list of involved domains -- merely the ones we know about. The list is updated as new domains come to our attention. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted.

The following is an excerpt from the website which clearly identifies the job as a money mule scam. (See the links in the left margin of this page for more information about money mule scams.)

Junior Financial Manager vacancy description

We are looking for HONEST and reliable people for this position.

Requirements:

  • AUSTRALIA RESIDENTS ONLY (no exceptions)
  • reliable Internet/e-mail access (must be able to check e-mail 2-3 times a day)
  • checking/savings bank account
  • 2-3 hours of free time a week (mainly in non-business hours) for communications
  • Adults only (21+)

Persons who are accepted for this position will follow these instructions:

  • Receive the funds from either our company or our partners to his/her designated bank account approved by our manager;
  • Withdraw the funds, keeping specified money transaction fee as a commission for your services (usually between $150 to $500, no less than $150 per transfer);
  • Send the rest of the money to our company and/or our partners via the specified transaction operator.
  • Report transaction details back to the manager.

Our preferred money transfer methods are personal/corporate checks, money orders and wire transfers.

Job description

We will send you the funds through one of our money transfer methods from our company and/or our partners directly to you.

Your part of the job is to ensure the clearing of funds, re-sending the money (less your commission) to us/our customers via one of chosen money transfer agencies. This should be done on the same or the next day when the funds are available for transfer (usually 2 business days).

Necessary transaction details will be sent to you via e-mail. You will have it as soon as you confirm availability of the funds. We will start with one transaction to gain the trust for both parties, after the first transfer is done you should express how many transfers you're able to handle every business day. If you're willing to try our program, fill out the form below with your personal information. Every completed form will be reviewed and our manager will contact you in 24 hours.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and not misleading fabrications.

ryecklunkd.com

Query at around 2007-02-12 21:56 UTC

   Domain Name: RYECKLUNKD.COM
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Updated Date: 12-feb-2007
Creation Date: 08-feb-2007
Expiration Date: 08-feb-2008
Admin Email.......... usnoninterd86@yahoo.com

bbs-application.net

Query at around 2007-02-15 02:47 UTC

   Domain Name: BBS-APPLICATION.NET
Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU
Whois Server: whois.nic.ru
Referral URL: http://www.nic.ru
Name Server: NS1.COMRUS.NET
Name Server: NS2.COMRUS.NET
Updated Date: 13-feb-2007
Creation Date: 13-feb-2007
Expiration Date: 13-feb-2008

bbilagoday.net

Query at around 2007-02-17 21:22 UTC

   Domain Name: BBILAGODAY.NET
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Updated Date: 08-feb-2007
Creation Date: 08-feb-2007
Expiration Date: 08-feb-2008
Admin Email.......... cgsquallhzj@yahoo.com

Saturday, February 10, 2007

Easy Bidding Company

Looks like we have a "reshipper" scam for a change. Instead of forwarding stolen money, you forward stolen (or fraudulently obtained) goods. Mind you, they mention money too, so perhaps there's some money mule work also.

   Domain Name: EASY-DING.COM <-- scam
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Status: clientTransferProhibited
   Updated Date: 29-jan-2007
   Creation Date: 29-jan-2007 <-- recent
   Expiration Date: 29-jan-2008

---------- Forwarded message ----------
From: Viktoria Romanova <viktoria.romanova[@]myfunnymail.com>
Date: 10-Feb-2007 07:42
Subject: Work at home: around $1000-$5000 / Monthly income!
To: [redacted]

Our new vacancies -  Correspondence manager/regional agent / Money manager.

 

Easy Bidding Company is looking for new candidates for the regional shipping manager position.

 

With our help practically any person can get absolutely any goods from any country.

Benefits of working with us: free working schedule - usually no more than 1-2 hours daily!

 

As a part-time employee, you'll have access to the following benefits:

 

 You can be sure that working with us is perspective for your career. The average salary will

be around $1000-$5000 / Monthly.others benefits, which you can find on our web site     !

 

- No special experience is required for this position!!

 

- We hire all over the USA except Alaska and Hawaii .

 

- We are looking for honest people for this position.

 

More information about this position and our company you can find on our web site at:

http://easy-ding.com/index-3.html

 

With best regards, Viktoria Romanova,

Project manager, Easy Bidding Company

Friday, February 09, 2007

Red Heart

This is a money mule scam dressed up as a charity. More copies of the spam arrived even as I was investigating it. The story is the usual: receive money one way; forward it (minus your cut) another way. The money you receive is not "donations" as they claim, but fraudulently transferred. Forwarding such money is participating in a crime. Much of the website text is ripped off from World Children's Fund.

   Domain Name: RHEART.NET
   Registrar: ONLINENIC, INC.
   Whois Server: whois.OnlineNIC.com
   Referral URL: http://www.OnlineNIC.com
   Name Server: NS1.SAUDIA-DNS.ORG
   Name Server: NS2.SAUDIA-DNS.ORG
   Updated Date: 07-feb-2007
   Creation Date: 22-sep-2006
   Expiration Date: 22-sep-2007

---------- Forwarded message ----------
From: [various]@mail.ru <[various]@mail.ru>
Date: 10-Feb-2007 10:13
Subject: You can help while working
To: [redacted]


Hello,
Every day dozens of disabled appear in the world, they need our help from the day they are born.

How can you help?
You can join our company and work as a freelancer!

We are searching for people wishing to help disabled children, concerned with their fate and ready to work 2-3 hours a day and earn some money as well.
The main task is to receive donations in your region, and transfer them to rehabilitation regions for disabled.
You can register online for this vacancy here: http://www.rheart.net/careers.php

Thank you for your time.
Manager of Red Heart,
Michael Griffin

BHP Billiton Plc (impostors)

If you really want a job with BHP Billiton, see http://jobs.bhpbilliton.com/ -- but you'll find that they don't have any jobs matching this description. You'll also find that they don't use laposte.net email addresses, and don't use UK +44 70 phone numbers. Further, if you express an interest in this job, you won't wind up working for BHP Billiton, you'll just wind up being some crook's money mule for a little while.

---------- Forwarded message ----------
From: BHP Billiton Plc <bhpbillitonplc@laposte.net>
Reply-to: bhbbillitonplc1@laposte.net
Date: 09-Feb-2007 15:55
Subject: Agent Needed...
To: ideceive@gmail.com

BHP Billiton Plc
Office Address:
Neathouse Place
Victoria, London
SW1V 1BH
United Kingdom

Tel: +44 70 3183-5067
Fax: +44 87 0471-3587

Dear Sir/Madam,

I am Mrs. Karen Wood Company Secretary of BHP Billiton, Formed from a merger between BHP and Billiton, BHP Billiton is one of the world's largest diversified resources companies. Operating in major commodity businesses, including Aluminium, Base Metals, Carbon Steel Materials, Diamond and specialty products, Energy coal, petroleum, stainless steel materials, we import and export raw materials into canada,america and europe.

Owing to the large amount of clients that we have in the U.S.A, we are having difficulty in reaching all of them,therefore we decided to employ representatives in all the states of america, Canada and Europe , to help us get to our clients. As our representative,you shall serve as a link between us and our clients and you will also be responsible for the collection of payments on our behalf.

Note that you shall have a 10% commision for every payment that you collect on our behalf.

Please if you are interested,I need you to supply the following details

1,FULL NAMES

2,CONTACT ADDRESS

3,PHONE/FAX NUMBER

4,COUNTRY OF RESIDENCE

5,OCCUPATION

Subject to your response,we shall have our company's attorney draft out an agreement to seal up this
contract.

Regards,

Karen Wood
Company Secretary

James Allen

What idiot makes up these names? A Ms James Allen and her husband Mr Berry Johnson? These folks bear a remarkable similarity to the just-as-ludicrously-named Mr Larry Potterss, right down to having exactly the same number of pets. This is actually a Nigerian trying to con people into banking forged cheques. The originating IP address was 196.1.190.8 , currently allocated to Nigerian Telecommunications Ltd.

---------- Forwarded message ----------
From: james allen < james33162@hotmail.com>
Date: 09-Feb-2007 02:43
Subject: EMPLOYMENT
To:

OFFICE
34 Parliament Street,
York, YO18SG,UK
Phone: +447011136857
Email: daisyjohnsonsartworld@yahoo.com

Good day
My name is Ms James Allen, I am an artist with my husband Berry
Johnson,We own D & J ART WORLD in London,Zealand(United Kingdom)I live
in London United Kingdom, with my two kids, four cats, one dog and the
love of my life my husband Mr Berry Johnson. It is definitely a full
house, I have been doing artwork since I was a small child That gives
me about 23 years of experience I majored in art in high school and
took a few college art courses Most of my work is done in either pencil
or art brush mixed with color pencils.

I have recently added designing and creating artwork on the computer,
I have been selling my art for the last 3 years and have had my work
featured on trading cards, prints and in magazines, I have sold in
galleries and to private collectors from all around the world. I am
always facing serious difficulties when it comes to selling my art
works to Americans, they are always offering to pay with money order or
casher's cheque, which is difficult for me to cash here in London
United Kingdom.

I am looking for a representative in the United States Of America who
will be working for me as a per time worker and i will be willing to
pay 10% for every transaction, which wouldn't affect your present state
of work, someone who would help me receive payments from my customers
in the states, I mean someone that is responsible and reliable, because
the cost of coming to the state and getting payments is very expensive,
I am working on setting up a branch in the state, so for now i need a
representative in the United States Of America who will be handling the
payment aspect for our company.

These payments are in money order or casher's cheque and they would
come to you in your name if you are willing to assist as a
representative, so all you need do is cash the money order deduct your
percentage and western union Charges then wire the rest back.

But the problem i have is trust, i have made arrangement with the FBI
in Washington,that if anybody gets away with my money they will
definately get hold with the person,and the person will go to JAIL for
LOOTING my funds , you are to receive the money order or casher's
cheque payment which will be sent to you by the Fedex or UPS from my
business partners, which would come in form of a order or casher's
cheque then you are to take it to your bank account to enable you cash
it and send the money cashed for the Money Order or casher's cheque to
me via Western Union money transfer or Money Gram.

NOTE: All charges of the Western Union money transfer or Money Gram
will be deducted from the money, so you are rest assured that you
wouldn't spend a dime out of your personal money.
If you are interested, please get back to me as soon as possible via
email.

Thanks for your assistant and God bless,

James Allen.
Director of D & J ART WORLD,
London, United Kingdom.

_________________________________________________________________
Valentine's Day -- Shop for gifts that spell L-O-V-E at MSN Shopping

Thursday, February 08, 2007

Conex Inc

Summary

A money mule recruitment scam, primarily going by the name "Conex Inc", operating under a variety of domain names. Job offers sent via spam. Notable in that many of the domain names in use are several months old, which although relatively new in the overall scheme of things, is still relatively old as far as scam domain names are concerned. I'm unsure as to exactly why the domain names are "aged" in this way. There are probably hundreds of legitimate businesses called "Conex", but this one isn't impersonating any that I can find, specifically.

The Spam

The spam is a non-specific "work at home" job offer. The message is plain text, and does not link to any website. Sample text follows.

Date: Tue, 6 Feb 2007 14:21:16 -0200
From: Karen Lemley <[redacted]>
To: [redacted]
Subject: Home Work

Hello,
It's Karen Lemley from Conex Inc. Conex Inc. is a financial service company looking for people to work at home or to join it with part-time position.

To be honest, everyone would love to work at home, if only they have choice. Who wants to get up early at 6am, prepare for the kids and husband, send the kids, clean up the mess, rush to work as early as 7:30am and come home at 7:00pm, then continue the house chores and the same routine everyday?

Well, no one right? But we are all greed about a better future and easy income, and that's how we fall in their pits.

I tell you my story/ Before I joined the company and made a brilliant career I was once at a very desperate stage of life, jobless for few months after being retrenched, struggling financial difficulties (loans, repayments, credit card debts...) and naturally end up arguing with spouse because of our favorite issue "money". While browsing for vacancies at the newspaper and internet, I’ve found "work at home" opportunities with Conex Inc.

Now two years passed after working part-time I’ve joined full-time position. I’ve become a good specialist in financial services, HR management, Internet sales etc. But the main thing I’ve improved the life of myself and family. Besides now I’m working in office I remember those times when I’ve started my home-work career with Conex.

Join us now and you will see that you success story starts now and you will remember this moment for the rest of your life.

Please send your messages of interest to: job@financialmate.com
--
Best wishes,
Karen Lemley, HR manager
Conex Inc.

P.S.
Just in case if this email reached you by mistake, we're sorry for possible inconveniences it caused, feel free to send an email to unsub @financialmate.com or just ignore this email.

I sent off an enquiry, and received the following response, making the "money mule" nature of the job much clearer.

From: Conex Inc. <info@corporatefinances.org>
To: [redacted]
Sent: Wednesday, 7 February, 2007 8:24:46 PM
Subject: Position Description

Hello [redacted],

Conex Inc. is a company built by experienced professionals, each from a different field of the financial sector. We formed the company with the foresight of having all aspects of financial management, from debt problems and mortgage issues to insurance services, under the one roof. This enables a suitable solution to be found for almost every individual circumstance rather than making the clients needs fit what other companies can offer.

We pride ourselves in having the ability to help each person as an individual, with friendly and experienced staff that genuinely wants to listen to your needs and find the right solution for you.

Our mission to become a premium financial support provider began in 2005. We pioneered innovative and alternative insurance and financial support our clients all other the world due to alternative view on payment methods. At the beginning of 2005 owe developed an absolute loyalty program, which helps to support our customers in any moment, in any place on Earth and in any situation. The service is a separate service pack provided by the Conex Inc., and it is an addition to the existing propositions. By the contents the program can be classified as a short-term credit system rendered to our customers to minimize losses because of happening of the insured accident, but it is implemented before direct insurance payments are done. Thus our customer, signed up to receive this service, gets first line support worldwide in any situations. Furthermore, the loyalty program includes a remote financial support for our clients in cases when they urgently need a considerable amount of cash to conduct an urgent medical treatment and if our client became a criminal victim and was totally cleaned up - all his cash money and credit cards were stolen.

Conex Inc. is actively supports clients all over the world. That is why we use new Internet services like virtual currency in our business to provide fast transactions from our partners and to our dealers. But as paying by Internet currency is not a convenient way for all our clients so we decided to involve additional Payment Managers for our payment process support program. The main goal of using Payment Managers is to make all the transactions fast, convenient and to give our clients the opportunity to receive payments in their countries with the most convenient way without any additional taxation or fees. To provide the effective support for fast payments from our clients we decided to conduct a limited admission of Payment Managers of the Conex Inc.. We intend to create an effective limited group (6-8 persons) of managers in the countries of Europe, USA, Australia and Asia.

The responsibilities of a Payment Manger will include a series of functions to assist the company's supervisor in manager's area in forwarding funds directly to our client without using the company's account; the money will be forwarded to the manager's bank account from supervisor. After receiving the funds following our instructions the Payment Managers must transfer funds to client using the fast money transfer systems (like instant bank transfers, e-currencies transfers or even Western Union or Money Gram in some cases).

Such scheme seems to be rather strange or difficult, but the fact that transaction lasts for 3-5 days as usual bank transaction. Using such scheme takes only 1-2 days so the client gets the funds and support faster. The other distinctive feature of this system is that it helps Conex Inc. to avoid taxation in the UK and to save up to 20% of profit.

All banking activities will be conducted by Payment Managers. His/her basic responsibilities will include ensuring of all banking activities. Specifically: to receive and efficiently distribute funds (using bank account operated by Manager) from regional supervisor of the Conex Inc. among our clients by means of the fast money transfer systems and Internet currency.

For this part-time position we need communicative, dynamic, honest and respectable people interested in additional earnings and who are ready to learn quickly, to follow the instructions and to show own initiative too. We do not require any special education but its presence is appreciated as well as the work experience. We highly appreciate and find very important an ability to follow our instructions and conditions.

The successful applicant must:
- be capable to work;
- be older than 21;
- have an opportunity to give not less than 2 hours a day to this work;
- be able to use PC, have an access to PC and Internet during the day.

The compensation of the Payment Manager work consists of salary and bonus fees. Conex Inc. guaranties, that if you are accepted for this position you will receive salary amounts to $2000 for the first 2 month with the company. For the 3-rd month Payment Manager will receive $3500. After 90 days of activity every successful Manager will be offered to sign a contract for future part and full-time cooperation (the condition is effective after only 90 days of cooperation with Conex Inc. without any serious rebukes).

Bonus fee constitutes 5% of each payment processing operation. The manager's bonus should be taken from the sum before resending the funds. All the other expenses like transaction fees are also paid from the rest of the company's sum of money. For example, if $2000 were sent to your bank account your percentage fee would be $100. The remaining amount of $1900 should be sent to our representative or directly to the seller according to our instructions. If money transferring costs $50 you will need to take this $50 from $1900. So at the end the final amount we should receive will be $1850. So you will be able to get additional $500 - 1500 as a fee per month.

The main condition Payment Manager must obey consists in that every received funds must be redirected to company's dealer in 6 hours after the funds are available in manager's bank account. If a manager delays the payment more than for 6 hours without a substantial reason he/she is deprived of his/her commission for the payment. In case of the 24 hours delay Conex Inc. breaks any business relations with the manager and contacts the manager's local authorities. There won't be any transactions on holidays or week-ends.

The Payment Manager's salary will be sent during the first week of the new month to the manager's bank account. Also the usage of this financial scheme affords to avoid additional taxation of our managers as well as our company.

If you are interested in our proposition please send us an e-mail to job@corporatefinances.org which will contain your short personal information and you will be sent the application form:

1. Full name
2. Your country and city/town.
3. Your age and occupation

In case you have now or will have any questions (after reading the information letter) please feel free to e-mail us support@corporatefinances.org and we will be happy to answer any questions.

Please keep in mind that we can receive up to 100 e-mails a day and it takes time to answer each and every one. Please allow anywhere from 1 to 2 business days for an answer.

Successful applicants should be familiar with such payments systems like 'E-Gold' (www.e-gold.com), 'Moneybookers' (www.moneybookers.com), 'Western Union' (www.westernunion.com) and 'Money Gram' (www.moneygram.com). All the additional information about those systems can be found on their web-sites.

Usually we do not deny any candidatures without serious reasons. Just try I can assure you that you have good chances to become our employee within several business days.
---
Best regards,
Ling Xue
Sales Deptartment Supervisor
info@corporatefinances.org
Conex Inc.,
13 Dixon Street
Glasgow, G1 4AL (St. Enoch)
Scotland
Phone/Fax: 44-141-626-1510

Domain names involved

The following domain names have been used as contact addresses in this scam, and I believe the domains to be under the control of the scammers (whether they registered them or not).

  • financialmate.com
  • corporatefinances.org

The above is not necessarily an exhaustive list of involved domains -- merely the ones we know about. The list is updated as new domains come to our attention. Please post comments below if you are aware of other domains involved in this scam.

Website

The website isn't mentioned in the spam, and seems to exist only to satisfy the curious that there is some substance to the company. The substance, however, is an illusion: the website is merely a rip-off of the site belonging to Chambers Moore Ltd. The following is a snapshot of the website at www.corporatefinances.org taken at around the time this article was posted.

Note also that world-wide-helper.com is also conducting a similar rip-off under the name of "Debt Chamber, Inc". Compare the registration details of world-wide-helper.com to financialmate.com below, noting similarities.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and accurate.

financialmate.com

Query at around 2007-02-08 06:06 UTC

   Domain Name: FINANCIALMATE.COM
Registrar: EASYDNS TECHNOLOGIES, INC.
Whois Server: whois.easydns.com
Referral URL: http://www.easydns.com
Name Server: NS.EZ-WEB-HOSTING.COM
Name Server: NS1.EZ-WEB-HOSTING.COM
Name Server: NS1.LUNARSERVERS.COM
Name Server: NS2.LUNARSERVERS.COM
Updated Date: 17-jan-2007
Creation Date: 13-jun-2006
Expiration Date: 13-jun-2007
Administrative Contact: alberthartheimer@verizonmail.com

corporatefinances.org

Query at around 2007-02-08 06:08 UTC

Domain ID:D131375558-LROR
Domain Name:CORPORATEFINANCES.ORG
Created On:23-Oct-2006 14:47:11 UTC
Last Updated On:17-Jan-2007 20:50:08 UTC
Expiration Date:23-Oct-2007 14:47:11 UTC
Sponsoring Registrar:Schlund+Partner AG (R73-LROR)
Registrant ID:SPAG-35283970
Registrant Email:alfitz@mailpuppy.com
Name Server:NS1.BLUEDOMINO.COM
Name Server:NS2.BLUEDOMINO.COM
Name Server:NS1.LUNARSERVERS.COM
Name Server:NS2.LUNARSERVERS.COM

world-wide-helper.com

Query at around 2007-02-08 06:19 UTC

   Domain Name: WORLD-WIDE-HELPER.COM
Registrar: ALL WEST COMMUNICATIONS, INC. D/B/A AW REGISTRY
Whois Server: whois.awregistry.net
Referral URL: http://www.awregistry.net
Name Server: NS.EZ-WEB-HOSTING.COM
Name Server: NS1.BLUEDOMINO.COM
Name Server: NS1.EZ-WEB-HOSTING.COM
Name Server: NS2.BLUEDOMINO.COM
Updated Date: 03-nov-2006
Creation Date: 14-jun-2006
Expiration Date: 14-jun-2007
Registrant: kentelliott@verizonmail.com

Latra Trade

My "resume" on Careerbuilder specifically says it's there to attract scam spam, and sure enough, a scammer has obliged. This is hot off the press: a Google search for "Latra Trade" just turned up no hits whatsoever. This is, of course, a money mule scam: they want you to be an "exchange manager" (which is their term for "money mule"). Note the signature line, by the way: Michael Giordano is the "Stuff Manager" of Latra Trade, Inc. Hilarious.

   Domain Name: LATRATRADE.COM <-- scam
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Updated Date: 07-feb-2007
   Creation Date: 07-feb-2007 <-- they don't come much fresher than that
   Expiration Date: 07-feb-2008

---------- Forwarded message ----------
From: Latra Trade Careers Center <careers@latratrade.com>
Date: 08-Feb-2007 04:32
Subject: Your resume on Careerbuilder.com: Customer Service, USD 2,800.00 + 5% / Month
To: ideceive@gmail.com

Good Day!
My name is Michael Giordano and I work for a company called Latra Trade, Inc. I found your resume on careerbuilder.com because we are searching for reliable professionals.

Latra Trade, Inc. is looking for punctuality, honesty and attentiveness peoples for our new role.
Our company's work is based on four main principles which our management considers as our development purpose: Stability, Promptitude, Efficiency and Readiness to realize any volume of operations.

Responsibilities and benefits from Latra Trade, Inc.:

- Based $2,800.00 /Month + 5% from each transaction
- Based $38,000.00 /Year + benefits from company
- Daily, Weekly or Monthly payment for job
- Work day 2-4 hours free during the day
- Weekends and holidays off
- No special education needed

More information about open vacancies you can find on our web site at http://www.latratrade.com/us/vacancies/
* If you are interesting, please fill Job Application Form on the same page.

With best regards, Michael Giordano,
Stuff Manager, Latra Trade, Inc.

Wednesday, February 07, 2007

August Insurance

Summary

Money mule scam (see sidebar for more information on "money mules"). The exact origins of the name "August Insurance" and the website they use are a little murky: it seems to be a copy of an insurance website called "Augustis" (based at augustis.net, registered on 2004-06-24), but this is currently offline and the domain itself may have been compromised. This spam seems to have replaced the Impex Consult spam from the last couple of months in the sense that Impex has stopped, and August is now arriving with the same overpowering frequency. The spam is not image-based, but plain text.

The Spam

In a marked change from most of the high-volume money mule scams seen here in the last year, the spam is a simple plain text message rather than an image. This appears to be a change in tactics on the part of the spammers, and so far it is working very well (against Gmail's filtering, at least). Previous spams have typically encoded the message in an image to prevent filtering on the message text, but have also made the image a hyperlink to the recruiter's website, and that hyperlink makes the spam a sitting duck for filtering. The August spam refrains from linking to any websites, but rather provides email contact addresses in various domains.

Representative text

No doubt we will see some variety in this text as the spammers sustain an effort to keep out of spam filters. The text given here represents one of the earliest spams received under the identity of "August Insurance", and details the "money mule" duties quite well -- aside from the fact that they lie about the legality of the work.

From: August Insurance <mailer@aug-insure.net>
Date: 07-Feb-2007 03:31
Subject: August Insurance - Good home work
To: [redacted]

Hello, how are you?

I would like to ask you a question:

Do you need some extra income?

Working part-time you can earn from 200 $ to 500$ per week (for the first, 'test' month)

New opportunities for you - today!

August Insurance Inc. invites you to cooperate.

To begin with, 4 simple questions:

1. Are you responsible and accurate?
2. Are you from 18 till 60 year old?
3. Are you Resident of UK, USA, Australia or Europe?
4. Have you free time (2-4 hours weekly)?

If you answered "YES" four times, this is your chance: no financial risk!

Testimonials:

"Superb product!!! Finally an online profit making guide that really
works. I can't believe how easy it is to make money on the Internet!
The information and easy to follow steps still amaze me. Thanks!"
-Joshua Eikenfield-

No charge for introduction! No investment required!

Contact us, your job is waiting for you!
We will be glad to send you more information,

For immediate and confidential consideration, please e-mail your resume
to apply@augustinsurance.net

Please don't forget to add the following important information about
you (field marked with asterix are not obligatory, other fields must be filled):

ATTENTION! ONLY APPLICATIONS FROM USA PLEASE! NO OTHER COUNTRIES WILL BE CONSIDERED!

1. Your full name:
2. Your country:
3. Your full address:
4. Your mobile contact phone:
5. Your fixed/home contact phone:
6. Your work contact phone or fax (*):
7. Your contact email(s):
8. Are you ready to sign a contract with our company? (must be 'Yes')
9. Are you ready to accept money transfers to your bank account or
credit card ? (must be 'Yes')

If you received this email by mistake and do not want to receive future
notice from us please send a message to this address: remove@augustinsurance.net

In case your question is not answered in the FAQ section (below),
please contact our support department at: apply@augustinsurance.net

Frequently Asked Questions:

Q1: What do you need me for?
A: We are glad to inform you that our way of making the transactions
using fast money transaction systems like Western Union or Money Gram
helps us to avoid any taxation of our funds managers. Simply saying, all
the taxes to your local authorities have been already paid before the
funds are available on your bank account. Also you do not need to mark
those profits in your tax bills. However, if you prefer to pay taxes by
yourself, you can do it (ask our support for additional information).
But please notice that payments marked as 'commercial' are smaller and
they take more time and effort to be processed. That's why we always
recommend to announce these transfers as personal, like to your friend or
family member.

Q2: Why is it recommended to announce these payments as 'personal'?

A: If you prefer to pay the taxes by yourself, you can do it (ask our
support for additional information). But please notice that payments
marked as 'commercial' are smaller and they take more time and efforts to
be processed. That's why we always recommend to announce these
transfers as personal, like to your friend or family member.

Q3: Why do you need me? Why don't you perform the transfers by yourself
and keep the commission?

Generally speaking about the job, we have established this scheme of
payments because it is faster than direct bank wires. Our client will
make a payment to your bank account. You will have to visit your bank and
to cash out that money. After that, within 12 hours you will have to go
to a Western Union or a Money Gram office and to give them the money in
cash for making the fast money transaction. We will give you the
receiver's information for every transaction.
Don't you think that taking money from your own bank account in cash or
using Western Union transaction are illegal things?
Such transaction scheme helps us to make payments go faster and both
you and we can make money faster too.
If we tried to perform it by ourselves, imagine how expensive it would
be - hundreds of offices (tables, chairs, computers, phones, fax
machines and other stuff). Our scheme helps us to minimize the costs and it
allows us to pay high commission to our managers.

Q4: How many transfers a day/week/month shall I process?

A: It depends on the quantity of the orders. It may be from one
transfer a week to several transfers a day. We shall notify you about the
number of the transfers beforehand, as well as about the transfers sent to
you.

Q5: What else can I do for your company?

A: Accurate work is enough.

Q6: Can I recommend you to my friends?

A: Yes, of course.

Q7: In what currency should I receive the money? In what currency
should it be sent? Is it necessary to exchange the currency?

A: You should send the money in the same currency that you have
received. You don't need to exchange the currency.

Q8: Who pays for sending the money? Isn't it too expensive to use
WesternUnion or MoneyGram? Is it subtracted from my commission?

A: The costs for the money transfers are paid by our company.
Absolutely nothing is subtracted from your commission; you get exactly the
agreed sum .

Q09: I want to get your company's contract with a seal and CEO's
signature.

A: Sure, our support is ready to send it to you after your first
request.

Q10: Is it legal?

A: Yes, our business is absolutely legal. It is already our second year
in the market.

Q11: I don't have higher education in the financial sphere, is it
important?

A: No, you needn't have higher education.

Q12: Do you work only in the USA?

A: No, we also work with Australia, UK, Europe .

Q13: Please give me an example of the job process
A:
1. A Customer from your country finds a Company in London, UK (for
example) and wants to buy smth.
2. The Company asks us for a manager in your country and we find you.
3. We give the Customer your bank details to send you the payment.
4. The Customer sends the payment to you and notifies us.
5. We inform the Company that the payment is made.
6. The Company gives us the name and surname of its representative who
must receive the money. For example: Name Surname in London, GB.
7. We send you an email like this: A money transfer has been sent to
you. Its amount is XXXX USD. You should send it to Name Surname in
London, UK.
8. You cash out the money and send it to Name Surname in London, UK.
9. You send the transfer receipt to us.
10. We give the receipt to the Company and they receive the money.

Q14: Do you have any certificate or license?
A: Yes, we have all required documents and we are ready to provide it
to you
when you fill the first form.



With best regards,
August Insurance Inc

Sender names encountered

Capitalisation and punctuation may vary, but these names make good targets for filtering if the spam is annoying you. The sender addresses can also be used, since the spammers seem to be using their own domain names in the sender address for a change, but bear in mind that new domains are likely to be registered on an on-going basis.

  • August Insurance
  • August Insure
  • Aug Insure
  • Augusts Insurance

Domain names involved

The following domain names have been used in reply-to addresses in this scam, and are believed to have been registered specifically for the purposes of this scam.

  1. aug-insure.net
  2. augustinsurance.net
  3. aug-inc.biz
  4. aug-inc.net
  5. eu-insure.com

The above is not necessarily an exhaustive list of involved domains -- merely the ones we know about. The list is updated as new domains come to our attention. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website at www.augustinsurance.net taken on 2007-02-08. Since the scammers are primarily soliciting responses via email, the site serves primarily to make it look like there is an actual business behind the name, although the "Augustis" branding should cause the sceptical to raise an eyebrow.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. Registrant details are included only to the extent that I believe they are relevant and not misleading fabrications.

aug-insure.net

   Domain Name: AUG-INSURE.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.NEW-ACC.COM
Name Server: NS2.NEW-ACC.COM
Updated Date: 05-feb-2007
Creation Date: 29-jan-2007
Expiration Date: 29-jan-2008

augustinsurance.net

   Domain Name: AUGUSTINSURANCE.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.NEW-ACC.COM
Name Server: NS2.NEW-ACC.COM
Updated Date: 05-feb-2007
Creation Date: 29-jan-2007
Expiration Date: 29-jan-2008

aug-inc.biz

Query at around 2007-02-08 03:22 UTC

Domain Name:                                 AUG-INC.BIZ
Domain ID: D16303391-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Name Server: NS1.NEW-ACC.COM
Name Server: NS2.NEW-ACC.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Mon Feb 05 10:53:30 GMT 2007
Domain Expiration Date: Mon Feb 04 23:59:59 GMT 2008
Domain Last Updated Date: Mon Feb 05 11:00:15 GMT 2007

aug-inc.net

Query at around 2007-02-08 03:23 UTC

   Domain Name: AUG-INC.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.NEW-ACC.COM
Name Server: NS2.NEW-ACC.COM
Updated Date: 05-feb-2007
Creation Date: 05-feb-2007
Expiration Date: 05-feb-2008

eu-insure.com

Query at around 2007-02-24 06:58 UTC

   Domain Name: EU-INSURE.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.SAUDIA-DNS.ORG
Name Server: NS2.SAUDIA-DNS.ORG
Updated Date: 19-feb-2007
Creation Date: 19-feb-2007
Expiration Date: 19-feb-2008