Viking Finance Ltd

Summary

Another in a long line of "direct transfer" money mule scams [see sidebar for more information about money mule scams], Viking Finance appears to be a direct descendant of Athens Financial Group Ltd.

The Spam

As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.

Representative image

Names used as signature

• Ulrika Jaresund

Sender names encountered

Capitalisation may vary

• Viking Finance

Domain names involved

The following links have been encountered in spam, listed in order of encounter.

1. http://vikfn.biz/index.php?sect_id=6
2. http://vikfn.org/index.php?sect_id=6
3. http://vikfn.info/index.php?sect_id=6

The following domains are obviously related, but iDeceive has not yet received spam using these domains.

• vikfn.net
• viking-finance.net

The above is not an exhaustive list of involved domains -- merely the ones we know about. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted. Note the extreme similarity to Athens Financial Group Ltd, particularly in the text.

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably fabricated and may point to innocent third parties.

vikfn.biz

Query at around 2006-12-04 13:57 UTC

Domain Name:                                 VIKFN.BIZ
Domain ID:                                   D15360278-BIZ
Sponsoring Registrar:                        CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID:                113
Registrant ID:                               CNEU-143599
Registrant Email:                            ewamorawska345@yahoo.com
Name Server:                                 NS1.MB2GB.COM
Name Server:                                 NS2.MB2GB.COM
Created by Registrar:                        CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar:                   CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date:                    Wed Nov 22 19:45:02 GMT 2006
Domain Expiration Date:                      Wed Nov 21 23:59:59 GMT 2007
Domain Last Updated Date:                    Fri Nov 24 22:37:59 GMT 2006

vikfn.org

Query at around 2006-12-07 15:57 UTC

Domain ID:D133471431-LROR
Domain Name:VIKFN.ORG
Created On:22-Nov-2006 18:39:19 UTC
Last Updated On:24-Nov-2006 22:36:17 UTC
Expiration Date:22-Nov-2007 18:39:19 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R25-LROR)
Registrant ID:CORG-170749
Registrant Email:davidstreet17@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.info

Query at around 2006-12-08 08:36 UTC

Domain ID:D15404697-LRMS
Domain Name:VIKFN.INFO
Created On:22-Nov-2006 19:14:10 UTC
Last Updated On:24-Nov-2006 22:37:24 UTC
Expiration Date:22-Nov-2007 19:14:10 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-231123
Registrant Email:paulacamastro@yahoo.com
Name Server:NS1.MB2GB.COM
Name Server:NS2.MB2GB.COM

vikfn.net

Query at around 2006-12-08 13:25 UTC

   Domain Name: VIKFN.NET
   Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
   Whois Server: whois.joker.com
   Referral URL: http://www.joker.com
   Name Server: NS1.MB2GB.COM
   Name Server: NS2.MB2GB.COM
   Updated Date: 24-Nov-2006
   Creation Date: 22-Nov-2006
   Expiration Date: 22-Nov-2007
email:        tamaragamble45@yahoo.com

viking-finance.net

Query at around 2006-12-14 15:55 UTC

   Domain Name: VIKING-FINANCE.NET
   Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
   Whois Server: whois.joker.com
   Referral URL: http://www.joker.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Updated Date: 23-Nov-2006
   Creation Date: 22-Nov-2006
   Expiration Date: 22-Nov-2007
email:        annamariamanodori@yahoo.com

Fwd: Work And Resides In Canada...Omni Mont Royals, Groups Of Hotels, 2007 Job Programs.

This is probably advance fee fraud rather than a mule job. I've seen cruise ship and hotel job scams before with that particular bent.

---------- Forwarded message ----------
From: Mrs.Rose.C.Ggrand <managressomnihotels@yahoo.ca>
Date: 03-Dec-2006 05:49
Subject: Work And Resides In Canada...Omni  Mont Royals,Groups Of Hotels,2007 Job Programs.
To: ideceive@gmail.com

      FROM OMNI MONT ROYALS, GROUPS OF HOTELS/CRUISE SHIP
Omni Mont Royals Groups of Hotels, in collaboration with cruise ship Montreal headquarters in Canada,
I Ms Rose Grand Christiana, the personal manageress, of Omni hotels, Montreal Canada, on behalf of the management and staff of Omni hotels, wish to inform all the general public, who might be interested in working and residing in Canada, through our job programs. For the yeart2007
General information to all that will be eager to get this international job opportunity,
Note: please everyone is aware, that due to world problems happening now,
that Canada does not allows illegal immigrants, for your information.
The executive management, and board of hotel directors, has negotiated with the Canadian government/immigration department, Montréal.
Everything, ticketing, visa, and accommodations, provided free of charge,
all applicants must know before applying for any post, in this hotel
That his/he, must be valid for six months, documents must be processed as a person or group of friends coming into Canada as Tourist through Omni hotels,
This is to make sure that we all, do not fall a victims of law, *1230* Law of the Canadian immigration law, concerning illegal immigrants.
We will assist you, to process your entire peripatetic entry permit, through immigration bureau Montreal Canada.
We do need both sex, male and female(able bodied) from any part of the world. Who wish to come here as tourists, into Canada, we will send to you, a special omni hotel letter of
invitations that will help you process, contact us through our office .address: managressomnihotels@yahoo.ca < http://ca.f906.mail.yahoo.com/ym/Compose?To=managressomnihotels@yahoo.ca> Orhoteldecanadian2000@yahoo.com <mailto: Orhoteldecanadian2000@yahoo.com>       ,We shall bear every responsibilities involved i.e. paying for your ticket, arranging for your visas,
               YOUR OBLIGATIONS TO US
A monthly deduction of 10% from your salary for 2years
Strict compliance with work place rules and regulation
You shall not abscond from your duty post
Observing the rule of punctuality
And eschewing all forms of terrorism.
Successful candidates will be issued a letter of employment and employment visa through the service of an appointed attorney working with the immigration department here in Canada. The screening process commences on getting their CVs and any successful candidates will be short listed .The application process is two to three weeks ,successful applicants will have their details forwarded to the Canadian Embassy in their country of Domicile, for issuance of their Visa .l will require your oversea address to send all related documents for visa procurement.
There shall also be an induction training for successful candidates to get them give them orientation about the hotel industry.
Looking forward to hear from you

THANKS FOR YOUR UNDERSTANDING
Ms.Rose Grand Christiana
                Manageress

A.H.A. International Company

This is a very unsophisticated money mule scam. The sender uses an "aim.com" freemail address, and makes no real effort to look convincing.

---------- Forwarded message ----------
From: Dr Liu Quin <liuquin5@aim.com>
Date: 02-Dec-2006 05:29
Subject: RELIABLE REPRESENTATIVE NEEDED"
To: ideceive@gmail.com

Dear Sir/madam,
We hereby introduce A.H.A INTERNATIONAL COMPANY LTD,an international
export/import company who deal on Pharmaceuticals & Medical
Products,Rubber and Plastic Products,Electrical Products Light
Industrial
Products,Hardware,Metals and Mineral Products,Textile and Garments,Auto
Parts &
Accessories and export into the Canada/America and Europe.
We are searching for agents who can help us establish a medium of
getting to our customers in the Canada/America and other nearby
countries as
well as making payments through you to us. You do not have to leave
your present job for this one because this job offer will be on a part
time basis as it comes once in a while. Please if you are interested in
transacting business with us we will be glad.
Please contact us for more information, Subject to your satisfaction
you will be given the opportunity to negotiate your mode of which we
will
pay for your services as our representative in Canada/America and
Europe. Please if you are interested forward to us your informations
below

(1)Your full names:
(2) Contact address:
(3) Tele/cell numbers:
(4) Occupation:
(5) Age:
(6)Sex:
{7}Company Name{If Any}:
{8}Nationality:

Thanks In advance.
Dr.Liu Quin
Managing Director.
A.H.A INTERNATIONAL COMPANY LTD.
Sha Tin, New Territories
Hong Kong

Royal Crown Ltd (royalcrownantiques.com)

This isn't the first time we've seen a scam under the name of "Royal Crown".

   Domain Name: ROYALCROWNANTIQUES.COM <-- scam domain
   Registrar: YESNIC CO. LTD.
   Whois Server: whois.yesnic.com
   Referral URL: http://www.yesnic.com
   Name Server: NS2.DOCLOGS.BIZ
   Name Server: NS1.DOCLOGS.BIZ
   Updated Date: 21-Nov-2006
   Creation Date: 21-Nov-2006 <-- recently created
   Expiration Date: 21-Nov-2007 <-- minimum duration


---------- Forwarded message ----------
From: Quinn Bass <[159ashbey]@[investonline.biz]>
Date: 01-Dec-2006 06:01
Subject: The Greates tSummer JOB Opporunity
To: ideceive@gmail.com



Are you a responsible person and looking for a part time job very well-paid?

We are a Family Company specialized in various operations with
antiques and antique jewelry; we are "Royal Crown ltd" ,  and we are looking for honest and responsible people to join us.


Do not miss this opportunity  - we are exactly what you're looking for!
You will earn more than $2500 per month, spending only 3-4 hours of your time - it is real with us!



We do not make sales gimmick that requires you to pay setup fees or sign
up to a mailing list, we do not want you to invest money. This job will requires you only limited amounts of your time.


We'll pay you during the first week of employment.

We do not require any experience or special skills . You will work as an
independent contractor from your home.


If you are interested, please feel free to request further information
and the general provisions.



Write us right now, we will answer you at soonest.
Please reply on this mail: employee@royalcrownantiques.com

ITS Financial Corp

Both the "from" and "to" addresses have been radacted, because I believe them to be taken from the list of spammed addresses, rather than belonging to the spammer. Although it's not entirely obvious from the email itself, this is a money mule scam. The website makes this clear, so I've included text from the site below the email.

   Domain Name: RECIVERAC34D.COM <-- scam domain
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS2.YAHOO.COM
   Name Server: YNS1.YAHOO.COM
   Updated Date: 03-Nov-2006
   Creation Date: 03-Nov-2006 <-- created less than a month ago
   Expiration Date: 03-Nov-2007 <-- minimum registration

Also associated with the following domain, but the website was unavailable due to DNS error.

   Domain Name: ONLINET45.COM
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS2.YAHOO.COM
   Name Server: YNS1.YAHOO.COM
   Updated Date: 24-Nov-2006
   Creation Date: 03-Nov-2006
   Expiration Date: 03-Nov-2007


---------- Forwarded message ----------
From: [redacted]
Date: 01-Dec-2006 13:14
Subject: business opportunity lead
To: [redacted]


Hey there
I hope this message finds you in a great spirit.
For a start I'd like to welcome you on this opportunity because our firm just came about your contact and your brief profile through an email listing affiliated with HotJobs and I would be highly interested in giving you a work at home job in which you can earnextra income of close to AUD3000 monthly.
This work doesn't affect your present job and this is a very limited offer in which I would really require your immediate response. I will be hoping to hear from you soon, since this is  a job that will enable you to work part-time.
You will also be given the opportunity of being a part of our future and winning team in which you'll be highly appreciated.
Please fill out our application form, no fees asked, just your basic contact details:
http://www.reciverac34d.com
We will get back to you ASAP.
Have a nice day


---------- Extracted from http://www.reciverac34d.com/ ----------

Please read the text below carefully as there are some information about ITS Financial Corp and your career opportunity with us.

Common information
-----------------------------

ITS Financial Corp is a young and growing multinational company. We have more than 10 departments worldwide (USA, Southern Africa, Eastern and Western Europe and Mexico). The head office is located in Melbourne, Australia. Our company is engaged in mail and money management and collecting payments worldwide. We're providing check/wire clearing service for customers throughout the EU and Asia who for some reasons need to receive payments from the people abroad. Reasons for this include, but not limited to:

 - telecommute work
 - affiliate programs
 - sponsorship
 - travellers assistance

The purpose of the job is to expedite funds clearing, since clearing of foreign checks/wires overseas can take up to 3 months. Therefore we're establishing an agent service in order to process the funds in the country of origin, hiring a contract staff to work with transfers.

Junior Financial Manager vacancy description
--------------------------------------------

We are looking for HONEST and reliable people for this position.

Requirements:

 - AUSTRALIA/NEW ZEALAND RESIDENTS ONLY (no exceptions)
 - reliable Internet/e-mail access (must be able to check e-mail 2-3 times a day)
 - checking/savings bank account
 - 2-3 hours of free time a week (mainly in non-business hours) for communications
 - Adults only (21+)

Persons who are accepted for this position will follow these instructions:

 - Receive the funds from either our company or our partners to his/her designated bank account approved by our manager;
 - Withdraw the funds, keeping specified money transaction fee as a commission for your services (usually between $150 to $500, no less than $150 per transfer);
 - Send the rest of the money to our company and/or our partners via the specified transaction operator.
 - Report transaction details back to the manager.

Our preferred money transfer methods are personal/corporate checks, money orders and wire transfers.

Job description
------------------

We will send you the funds through one of our money transfer methods from our company and/or our partners directly to you.

Your part of the job is to ensure the clearing of funds, re-sending the money (less your commission) to us/our customers via one of chosen money transfer agencies.
This should be done on the same or the next day when the funds are available for transfer (usually 2 business days).

Necessary transaction details will be sent to you via e-mail. You will have it as soon as you confirm availability of the funds. We will start with one transaction to gain the trust for both parties, after the first transfer is done you should express how many transfers you're able to handle every business day.
If you're willing to try our program, fill out the form below with your personal information. Every completed form will be reviewed and our manager will contact you in 24 hours.

Getting started
------------------

We will need you to provide some basic personal information to get started.
Please click on "I AM READY" link below to fill the form.
You might want to specify any questions you have.
Thank you for reading this document. Good luck.