Phish of the Day: eNom

A correspondent forwarded me this phish which is unusual in that it has an unusual target: customers of the registrar eNom. These phishers are looking to hijack other people's domain names for nefarious purposes. Note that the links in the message below do NOT go to eNom. The phisher seems to have a pile of domains in the form "comN2.biz" which he is using to support these phishing sites. So far, I have found com62.biz, com72.biz, com82.biz, and com92.biz. All were registered to someone using the email address alexeyvas@safe-mail.net at around  Mon Oct 27 00:45 GMT 2008. All use nameservers in the domain XWHLWWW.COM, which was created on 10-Oct-2008.

I recommend against clicking on any of the following links, since they go to a known hostile site at the time of posting.

---------- Forwarded message ----------

Dear user,

On Tue, 28 Oct 2008 XX:XX:XX -0500 we received a third party complaint of invalid domain contact information in the Whois database for this domain Whenever we receive a complaint, we are required by ICANN regulations to initiate an investigation as to whether the contact data displaying in the Whois database is valid data or not. If we find that there is invalid or missing data, we contact both the registrant and the account holder and inform them to update the information.

The contact information for the domain which displayed in the Whois database was indeed invalid. On Tue, 28 Oct 2008 XX:XX:XX -0500 we sent a notice to you at the admin/tech contact email address and the account email address informing you of invalid data in breach of the domain registration agreement and advising you to update the information or risk cancellation of the domain. The contact information was not updated within the specified period of time and we canceled the domain. The domain has subsequently been purchased by another party. You will need to contact them for any further inquiries regarding the domain.

PLEASE VERIFY YOUR CONTACT INFORMATION - http://www.enom.com

If you find any invalid contact information for this domain, please respond to this email with evidence of the specific contact information you have found to be invalid on the Whois record for the domain name. Examples would be a bounced email or returned postal mail. If you have a bounced email, please attach or forward with your reply or in the case of returned postal mail, scan the returned letter and attach to your email reply or please send it to:

Attn: Domain Services 14455 N Hayden Rd Suite 219 Scottsdale, AZ 85260


LINK TO CHANGE INFORMATION - http://www.enom.com


Thank you,
Domain Services

[IncidentID:XXXXX]

Info: Freelance Home Writers

I've been asked a few times about whether "Freelance Home Writers" is a scam. My forte is outright fraud and crime rather than "dodgy business", so I'd first like to emphasise that this isn't (as far as I can tell) a front for organised crime.

Having said that, I still wouldn't trust them with a penny of my money. Why's that, you ask? Well, in addition to the informed opinion of an independent party, I note that "Freelance Home Writers" employs a tactic in common use by scammers who want to avoid the ill effects of a bad reputation: the progressive registration of multiple domain names. The image attached to this post is a snapshot of one of several identical "Freelance Home Writers" websites operating under different domain names that have been registered at different times. For example, "freelancehomewriters.com" was registered on 21-Feb-2007, whereas "freelance-home-writers.com" was registered on 29-Aug-2007, and "freelancehomewriters.biz" (which was misconfigured and causing a browser error when I tested it today) was registered on 29-Jan-2008. All of the above were registered using the "WhoisGuard" anonymisation service, so we have no idea who is actually behind this service, or where they are based. Would you trust an anonymous company with no address?

Bear in mind that these guys are selling a product, not offering jobs. They want you to pay to join. Are you going to trust them with your credit card details? Will you have any recourse if their "product" turns out to be worthless? Will you even be able to navigate away from their damn home page without being blocked by pop-up ads? Can you believe their claim on their FAQ page that they have "been online for nearly 6 years now" when the earliest domain name registration is dated 2007?

So, in answer to the question, "is Freelance Home Writers legit or a scam?" my answer is, "I really can't say, but there's plenty of evidence that they can't be trusted!" When you're handing over your credit card information to someone in exchange for a promise of goods or services, trustworthiness is what counts, isn't it? "Scam or legit" frames the question the wrong way: "trustworthy or not" is, I think, a better way to look at it. As fas as I'm concerned, "Freelance Home Writers" operates in a manner that shouts, "I can't be trusted!"

Advance Fee Fraud: Royale Financing Company

A correspondent tells me that he has applied for a loan through "Royale Financing Company" at www.royalefinancing.com. This is an advance fee fraud scam: they want you to send them fees up-front via Western Union before they will send you the loan. Sadly, the loan and the whole company are both a big lie: this is just a bunch of fraudsters conning people into sending them money. They will gladly take your money and keep it -- you'll never see a cent back.

Bear in mind that the name "Royale Financing Company" is made up. Scammers make up new names regularly because people like me report the old ones as scams. Don't judge the operation by its name: judge it by what they do. If they want you to send them money to apply for a loan, just assume they're scammers and steer clear of them.

Here are the current registration details for royalefinancing.com, for what they're worth.

   Domain Name: ROYALEFINANCING.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.DOMAINCITYSERVERS.COM
   Name Server: NS2.DOMAINCITYSERVERS.COM
   Updated Date: 01-may-2008
   Creation Date: 01-may-2008
   Expiration Date: 01-may-2009

Alert: Beware Barbara Moratek of the Ivete Foundation

Sunbelt Blog is reporting a strange synergy between what appears to be a Nigerian scam variant and malware pushers. They report that there is spam circulating which claims to be from one "Barbara Moratek" of the "Ivete Foundation". The spam itself is relatively innocuous -- it may be a lead-up to some kind of advance fee fraud or cheque forgery scam, but that's all. If you do a Google search for those names, however, you'll get a lot of hits on sites which contain malware in the form of fake audio/video codecs.

Is this conspiracy, or coincidence? It's hard to say, but it's a new development either way, so far as I'm aware.

Scam: Gadgets Ltd UK

I haven't checked whether there is a real company operating under this name, but I haven't seen a scam as blatant as this in a while. Nothing subtle here, just send money via Western Union in return for a false promise that you'll receive goods. If anyone has dealt with this clown, please tell us where he wanted the Western Union transfer sent. With a gmail address and a UK +4470 "forward anywhere" number, he could be anywhere in the world, but following the money is always interesting.

---------- Forwarded message ----------
From: Gadgets Ltd UK <gadgets.lmtduk@gmail.com>
Reply-to: gadgets.lmtduk@yahoo.com
Date: 6 Dec 2007
Subject: APPLE iPhone/Sony PS3(60GB)for $600 USD FREE SHIPPING
To:

APPLE iPhone/Sony PS3(60GB)for $600 USD FREE SHIPPING


We are offering The Revolutionary APPLE iPhone 8GB and Sony PS3(60GB) =
$600 USD FREE SHIPPING


SAMPLE PRODUCTS PRICE LIST

Video Games
Playstation 3 ........$300
Nintendo Wii......... $200
Sony PSP......... ....$140
Xbox 360 Platinum.... $140
Xbox 360 Premium..... $120

Apple ipod Nano 4gb....$100
Apple ipod Nano 80gb...$250

GSM PHONES
Nokia 8800 sirocco....$350
Motorola V3i D&G......$250
Nokia N95......... ...$320
Nokia N93......... ...$260
Nokia N93i ...........$280
Nokia N70 ............$160
Nokia N72 ............$175
Nokia N73 ............$250
Nokia N80 ............$200
Nokia N90 ............$200
Nokia N91 ............$200

Sony Ericsson
Sony Ericsson W800i....$200
Sony Ericsson W810i....$225
Sony Ericsson W900i....$250
Sony Ericsson K510i....$105
Sony Ericsson W800i....$150
Sony Ericsson k750i....$165
Sony Ericsson M600.....$302
Sony Ericsson k700.....$100
Sony Ericsson W600.....$156
Sony Ericsson w850.....$230

PDA
Palm Treo 650........$170
Palm Treo 700w.......$250
Palm Treo 750........$240
QTEK 9000 ...........$300
QTEK S110 ...........$250
HTC P3300 ...........$300
HTC P3600 ...........$350
Dell Axim X51V.......$350
i-mate Jam ..........$400
i-mate K-Jam ........$420

All GSM Phones,Brand New,Tri- Band, Simfree ,Unlock and open to all GSM
Networks

world wide with 1 yr warranty and Video Games are also Brand new
with Complete Accessories plus Int'l Warranty .

Our Very Flexible Terms of Trade
Prices are in US Dollars
Payment:  Western Union Money Transfer
Delivery :FedEx Express 2-3 days after payment
Warranty : 1 Year Int'l warranty with 90 days return policy with full
refund option.

Thank you and looking forward to your order CONFIRMATION soon.

NOTE : FEEL FREE TO CALL OR REQUEST MORE INFO

John Philips
GADGETS LIMITED (UK) LTD
Registered No. 05881519
THE OLD STABLES, ARUNDEL ROAD,
POLING,ARUNDEL,WEST SUSSEX,BN18 9QA
UNITED KINGDOM
TEL : +447031917966, +447031917369