Advance Fee Fraud: Godwin Mahama

It's only ever so slightly presumptuous of me to label this one "advance fee fraud". The full spam text is posted at The 419 Files for your reference, and you'll note that there is none of the usual "I require your assistance in relocating millions of dollars" nonsense. No indeed -- this is an entirely different kettle of fish. Well, entirely different except for the fact that it's just as fishy.

In this case, a certain so-called Mr Godwin Mahama tells us he's "a licenced government contractor, sourcing/commission agent registered with the government of Ghana", and that "many foreign firms have gotten several contracts through my company's effort and lobbying." Great. Presumably if I contact him at his suspiciously unprofessional Yahoo! freemail address (godwin_mahama2006@yahoo.com), and tell him I'm in the fertiliser business (only a slight stretch, really), he'll respond by telling me that he thinks he can get the government to contract me -- if I'm willing to pay for his services as a lobbyist.

As an Internet Fertiliser expert, I call "bullshit" on this one.

There may or may not be a real "Mr Godwin Mahama" in Ghana who may or may not be some sort of consultant, but there's no reason to think that the identity is real based on the information given.

Info: Israeli Brokerage Services shift tactics AGAIN

You just can't keep a determined spammer down, can you? In their on-going efforts to steal your money, the Israeli Brokerage scammers have not only started using yet another domain name, but they've given up their cherished tactic of putting all their text in graphic images. Well, I don't expect that they've given up on graphics, strictly speaking, but they've diversified into plain text. Anyhow, here's the text (including the new Hong Kong based web address), since it's a simple copy and paste job.

Hello! I am Tal Alkobi, manager of a Human Recourses department and I work in Israeli Brokerage services Ltd This letter is aimed at attracting Your attention to a vacant post of financial manager for cooperation with private individuals. But first I would like to tell You about the company. Israeli Brokerage services Ltd was established in 1994 to render assistance to our clients in selling, buying, privatization, arranging deals and brokering at stock exchange. We can put into practice any operation that our client wishes. To reach it, we possess a large choice of investment instruments. Owing to the high professional standard of our specialist, we attract a lot of clients so our company is the leading company of this kind in Europe. And we continue to grow! And now we want to offer You the next: - to join our work collective - to become one of high qualified specialists - to get a prestigious part time job - to raise more IT IS NOT NECESSARY FOR YOU TO HAVE ANY HIGHER OR PROFESSIONAL EDUCATION to get this job. The only requests are: - You must have several free hours a day - have a bank account or a possibility to open a new one - have a computer YOUR MAIN TASK CONSIST IN ensuring us the possibility to provide the best service for our clients in short terms. YOUR DUTIES will be the next: - to receive payments for the ordered securities from our clients to Your bank account - to withdraw the funds and to transfer it further to our brokers in other countries You should use Western Union or money Gram services for these transfers. Your PAY amounts 9% commission out of every deposit that You receive on Your bank account. If you are interested, please visit our site: http://ibsl.hk We are waiting for You! I beg Your pardon if You received this letter by mistake. In that case I ask You to be so gentle to delete it. Yours faithfully Tal Alkobi

Info: Israeli Brokerage Services scammers change tactics

One of the ways to block spam fairly reliably is to block on the basis of the links contained in the spam. In reaction to this, apparently, the Israeli Brokerage Services scammers have mostly stopped linking the images in their spam to their websites. Instead, they have been opting for shorter domain names and instructing the recipient to type the address by hand, as shown in the sample spam image here. Because the text appears in a GIF image, the recipient can't even copy and paste the address.

As an aside, if their primary motivation here is to dodge spam filters, it's not working very well. There are a lot other characteristics of their spams which identify them as such.

Info: Are Nigerians changing their tack?

I've noticed a downward shift in the number of 419 scams arriving. My 419 archives show fifty-something 419 scams per month in the months of June, July, and August, but then a 50% drop in September, and projections for the remainder of October are looking similarly low. At the same time, I noticed that a recent job scam had a very Nigerian feel to it (despite pretending to come from China). On investigation, I note that the modus operandi is very typical of the Nigerians (using a webmail system), and the sending system reports that the originating IP address was 80.88.141.71, which is allocated to Nigeria (delegated from "Emperion", Denmark, to Nnamdi Nwokoro of Benin City, Edo state, Nigeria, according to WHOIS data).

Perhaps the Nigerians have discovered that it's more profitable for them to engage in job scams rather than advance fee fraud? Unlike the Russians and other Eastern Europeans (who tend to run job scams in conjunction with phishing), I get the impression that the Nigerians prefer forgery, and target the USA. According to an article at Snopes, there is a lot of fraud involving forged cheques and money orders: individuals are persuaded to accept these and wire back 90% of the face value via Western Union (or some similar arrangement). Due to banking regulations in the US, the proceeds of the cheque become available before the cheque is fully verified. The recipient gets a rude shock later when the bank denies the cheque and reverses the deposit.

Phone Scam: Perfect Soul Mate

This is the same kind of premium-rate SMS scam I documented a couple of months ago under the title of "Your 1 True Love". It seems like a harmless bit of fun, but you're actually signing up for a truckload of useless-but-outrageously-expensive SMS messages. The sting can be found in their terms and conditions, which I quote here in full for reference.

Introduction

Your access to this service is conditional upon your acceptance of all terms of use laid out herein. You must read the following terms and conditions carefully before taking advantage of any services offered on this service. You may view all or parts of this service using an Internet web browser or mobile phone only if you agree not to reproduce, transmit (broadcast) or adapt any part of the content of this service without the permission from FunSpring.

Delivery

All SMS services provided by FunSpring are charged on a per-SMS basis irrespective of: • the message reaching the recipient. The message may not reach the recipient if his/her phone is switched off, out of range or not compatible with the content of the message. In this case, the message will attempt to be delivered for seven days • situations where a service is being denied to the user due to user's incorrect procedure and/or user ban and with the exception of where a requested product was not available.

Partnership

By signing up with or accessing any of FunSpring services, you form a partnership with FunSpring whereby you give permission to accept any type of promotional or otherwise content from FunSpring and third parties affiliated with FunSpring at any time. This includes material sent via SMS, E-Mail or any other means of communication utilized by FunSpring and any of its affiliates.

The Site and HOROSCOPE Service

By clicking the "ENTER" button you will be sent a free soul mate prediction and will start a subscription to the HOROSCOPE service. You will be sent up to 15 horoscopes each month priced at $5/sms. You may stop this subscription service at any time by sending a text message with STOP, to short code 19999008. Your phone must be Internet-enabled and have text messaging capability. You must be the owner of this device and either be at least sixteen years older or have the permission of your parent or guardian. Standard text messaging rates apply. For support please contact 1300767306 during business hours.

In particular here, I draw your attention to the last two paragraphs. One states that you are liable to receive 15 horoscopes per month at a rate of $5 per horoscope (i.e. they have the right to drain your phone account at a rate of $75 per month), and the other states that they can share your phone number or email address with whomsoever they please for whatever reason they please (presumably to advertise crap at you).

The domain name in question is "perfectsoulmate.net" which is registered through a privacy proxy service for obvious reasons. It came to my attention through a Google ad, as it did last time, rather than spam. Advertisers pay per click on their ads: you should make your own decision as to whether you want to click through any such ad you find, but I strongly advise against giving them any personal information if you do visit their site.

Job Scam: Israeli Brokerage Services Ltd

The "Israeli Brokerage Services Ltd" money mule job scam is a continuation of others we've seen here previously, and also related to the "Bronsard Advantage" one reported a here recently. I mention it here specifically because the spammers are now trying a new tactic: leaving out the hyperlink to their website. In the most recent instance of this spam, the instructions are, "to take a visit to our web site please enter in address line in your Internet browser." The URL in question is http://ibsl.org. At a guess, their motive is to avoid spam filters, and it worked to some degree. This particular spam was tagged as "suspected spam" by one filter, then forwarded to a Gmail account which correctly classified it as spam.

Note that because the spam text is presented in a GIF image, the recipient really does have to type the address by hand -- a kind of CAPTCHA, really.

Job Scam: Bronsard Advantage Co

First sighting: "Bronsard Advantage Co" money mule job scam. This has the same modus operandi and basic pattern as many other job scams reported here. For details of the operation follow the above link; this blog entry serves only as an announcement of first sighting.