Job Scam: Adams Green, Inc. (adamsgreen.org)

From the scumbags who brought you Global Austrian Syndicate (twice) and Swiss Invest before it, it is iDeceive's dubious honour to present "Adams Green, Inc." The scam is the same: only the names have been changed to victimise the innocent. We have the same text-as-image spam, with the same layout, using the same modus operandi. This time the domain is "adamsgreen.org", the contact calls himself "Andrew Thomson", and "there are 5 openings for a representative to assist in creation our virtual local presence for the back office functions."

According to "whois" records, the domain "adamsgreen.org" was registered for one year on 21-Jun-2006. The nameservers for the domain are currently 72.232.71.90 (network space of Layered Technologies, Inc. -- they're popular with these spammers), and 154.37.3.12 (network space of Performance Systems International). Both these providers have prominent abuse-reporting addresses, and I'll notify them immediately.

At the time of investigation, "adamsgreen.org" resolves to the following addresses (and reverse name lookups): 74.131.72.24 (DHCP-74-131-72-24.insightbb.com), 69.62.158.34 (34.158-62-69.ftth.swbr.surewest.net), 69.203.157.76 (cpe-69-203-157-76.si.res.rr.com), 71.56.93.164 (c-71-56-93-164.hsd1.ga.comcast.net), and 71.57.30.8 (no rDNS; whois says Comcast Cable Communications Holdings, Inc ILLINOIS). Once again, these all look like ISP broadband customer addresses, thus suggesting the use of compromised PCs in private homes and businesses. Also, the time-to-live value on the DNS records is set to thirty minutes, so the addresses can be updated fairly rapidly if needs be.

The spammers have screwed up this message, however: the HTML links to http://www.adamsgreen.org/index-2.html, but the sub-domain "www.adamsgreen.org" doesn't exist! They were supposed to leave off the "www" part. I'm sure they'll rectify their error in the near future when they figure out why it's not working.