I'm pleased to say that the Netherlands is still taking Nigerian organised crime seriously, even if the UK has decided to slack off. As reported in The Register (among other places), police in Amsterdam last weekend arrested 111 people of West African nationality (primarily Nigerian). They are suspected of running lottery scams.
A few days ago, I received a short blast of identical spams (other than the "from" address, which was totally different for each instance) promoting dubious vacancies at a "company" called SunFx. For detail, see the SunFX Online Inc scam report at my Suckers Wanted blog. This particular instance of the spam stood out because it's mangled: it blends an OEM Software scam with the job scam. I suspect that this is either the same scammer running more than one scam, or at least the same spammer, possibly sending spam on behalf of more than one dodgy client.
---------- Forwarded message ----------
From: James Nelson <[redacted]>
Date: 09-Jun-2007 19:45
Subject: Re: Hi
To: [redacted]
OEM Soft Store 80% Discounts
We are glad to present You this online software store with maximum lowest prices on the Internet. You won\'t find software anywhere else on the Internet with prices lower than here. All the programs we have here for sale and available for Download Only.
http://www.best-soft-download.hk/
--------------------------------------------------------------------------------
MS Windows Vista Business Edition at ......ONLY $49.95
MS Office 2007 Professional .......................ONLY $49.95
ADOBE Creative Suite 3 Design Premium ..ONLY $37.95
SystemWorks Premier 2007 Edt .................ONLY $19.95
And many more...
--------------------------------------------------------------------------------
Come and check out by yourself
http://www.best-soft-download.hk/
SunFx Online Inc. customer service department is currently offering employment for 10 Australia residents and 15 United States residents in order to provide it's new branch with qualified personnel.
The private client support desk is responsible for following up client enquiries, helping the clients to understand how SunFx Online can save them money on foreign currency transactions, and developing new business through referrals.
If you're a customer service fanatic, and enjoy working in a challenging and rewarding environment, please see below for our current list of opportunities.
Position: Customer service officer.
Salary: Your starting salary will be $2300 - $4500, which will be paid to you in accordance with our standard payroll procedures.
In addition, you will be eligible for monthly and annual bonuses.
Relevant Work Experience: Will be an advantage.
Location: Australia / United States.
Education Level: College degree will be an advantage.
Insurance: 1 month after you begin work, you will be covered under our group health insurance policy, unless you advise us that you do not desire such coverage.
Information regarding our health insurance, as well as other group benefit plans, is enclosed
Keywords: Telecommuting, flexiplace.
Should you have any questions regarding this letter, our offer of employment or anything else, please write me an e-mail.
We are excited to have you join our organization and look forward to working with you.
Please forward your full resume, contact information and questions to HR dept. e-mail: sunfxcareers@ssl-mail.com
You will be contacted within 1 to 4 business days.
Best regards,
James Nelson
Employment Manager
SunFx Online Inc.
sunfxcareers@ssl-mail.com
This scam is funny. I don't know what the exact details are -- it looks like advance fee fraud, but I'm not going to bother digging up details. However, here are a few suspicious points.
Speaking of domain registration...
Domain Name: SHIP4LOVE.COM <-- scam Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: NS1.SLAVHOST.COM Name Server: NS2.SLAVHOST.COM Updated Date: 10-apr-2007 Creation Date: 10-apr-2007 <-- recent Expiration Date: 10-apr-2008
That's about all the effort I'm going to waste on this scam. Here's the original spam text for reference, though.
---------- Forwarded message ---------- From: [redacted] Date: 01-Jun-2007 16:17 Subject: ship4love To: [redacted] Hello, If you do not want to loose your money and to talk to girls who does not even exist there is new wonderful opportunity to meet Russian girls in person and to spend 7 days on cruise with them. On the 25 of July a beautiful ship " St. Valentine " will sail from Sochi (Russia) and will go around the Black Sea. There will be 50 Russian beauties who want to meet a foreigner in order to make a family and they are ready to leave Russia. These girls are disappointed in Russian men and they will be happy to find the man abroad. All their pictures are placed on the website. On the ship will be created such an atmosphere that will help to start romantic relations. There will be invited only 30 foreign men on that cruise. And you can be one of them! If you are interested, go in a site: ship4love.com ship4love.com Best regards.
Right... the link in this spam took me to a page full of porn video links, not a form for submitting a resume. Thankfully, I'm cautious enough to use a text-only browser when checking out such things, so I may have been spared an unwanted anatomy lesson. I also tried without the numeric extension on the end of the URL, and that took me to a page containing Javascript which did nothing, but looked a lot like Javascript I have seen on sites which try to exploit security weaknesses in web browsers.
All in all, if you managed to find this page before clicking on any links, I highly recommend that you don't. If you clicked already, and you run Windows, you may want to scan your computer for the latest malware. It's also entirely likely that the number at the end of the URL is a unique tracking ID, and the spammer is creating a list of suckers who are silly enough to click on links in spam, which is always a bad idea (unless you're some kind of idiot who writes a blog about spam).
---------- Forwarded message ----------
From: Cleo <gerr[@]shapel.bir.ru>
Date: 13-May-2007 12:27
Subject: _The best time to join the team of CharityHope. Contact us by sending your resume.
To: undisclosed-recipients
Our Charitable Center, established in year 2000 by a team of highly qualified professionals who feel privileged to help world and people in their sorrow. We are working to help people donate money for realization our social and charity programs, called up to help growing generation to get education, for providing of charity projects, directed on formation of favorable social and informational area around children. We are working on developing of new children centers for their education, we are taking active part in support and adaptation of homeless children.
Our organization is pleased to inform you that there are available vacancies for a Donation Manager Position.
your resume - http://81.29.241.160/in.php?21352828
Our team is really happy to invite you to our company!
Here's an interesting spam I found while sifting through the usual job scam spams. At first glance, this appears to be a standard job scam, but on closer inspection it lacks key ingredients. For example, it expresses as strict requirements that the applicant be registered with the SEC.
This is perhaps a clue to what they're really doing here: trying to find registered stock brokers. My guess is that this is the first stage of a "spear phishing" attack: anyone who contacts them claiming to be a stockbroker will be sent some documents in return, such as Microsoft Word documents. These are actually Trojan horse documents, crafted in such a way that they will attempt to install other software on the stockbroker's computer. The attackers probably want to gain access to stock trading systems so that they can buy and sell stock to manipulate the price for their own gain, or some similar scam.
---------- Forwarded message ----------
From: [redacted] <[redacted]@hotmail.com>
Date: 10-May-2007 09:58
Subject: Good job offer from careerbuilder
To: [redacted]@gmail.com
Cc: [three more gmail.com addresses redacted]
All original material of whatever nature appearing in this blog under the authorship of "Spotter" (abbr. of "Deception Spotter") is dedicated to the Public Domain. Note that portions of a work enclosed in "blockquote" tags are, in general, quotations to which this dedication can not apply. (Rationale)
