Job Scam: Global Austrian Syndicate (gas-ltd.biz)

This is yet another money laundering job offer, with all the obvious red flags: offer arrives by spam, requires no experience, involves money transfer using Western Union or Money Gram, and so on.

The style of this scam is a close match to that of the Swiss Invest scam that's been arriving regularly in my inbox for nearly a month. Closer investigation shows that the DNS records for "gas-tld.biz" and "swiss-invest.cn" are almost identical. At the time of writing, they both resolve to the following addresses: 24.41.42.238 (user-0c2iane.cable.earthlink.net), 24.43.27.76 (CPE000a73995cf3-CM000a73995cf2.cpe.net.cable.rogers.com), 64.135.101.176 (address in space allocated to BroadbandONE, Inc.), 69.248.123.80 (c-69-248-123-80.hsd1.nj.comcast.net), and 70.101.24.127 (70-101-24-127.dsl2-plymouth.roc.ny.frontiernet.net). These all appear to be end-user PCs on broadband networks, which almost certainly means that they are compromised and being used by these criminals without the knowledge of the actual owners. There are other tricks involved with the DNS, but they're a bit technically obscure, so I won't bore you with details here.

For the benefit of searchers, some of the key phrases in this spam include the name "Francois Veillon", who claims to be "the manager of a Human Resources department of Global Austrian Syndicate (GAS)". Other than that, it's mostly boilerplate job scam stuff.