Job Scam: Mr.Wankeng Zhang

Mr. Wankeng Zhang? Quite a name. Anyhow this is a nondescript troll for money laundering mules. It was received from 65.54.249.100 (omc3-s26.bay6.hotmail.com) on Thu, 27 Oct 2005 03:11:06 -0000. The mail claims some sort of association with "cmiec.com", but there's no substantiating evidence for this claim, and good cause to disbelieve it -- after all, we already know that the sender is a blatant liar. Message text follows.

Dear Sir/Madam,

I am Mr.Wankeng Zhang,we are a group of business men
who deal on
importand export raw materials  into the
canada,america AND europe.We
are searching for representatives who can  help us
establish a  medium
of getting to our costumers in the canada, america AND
europe as well as
making payments
through  you to us. Please if you are interested in
transacting
business with us we will be very glad. Please contact
me for more information via zhang_com@myway.com
Subject to your satisfaction you will be given the
opportunity  to
negotiateyour mode of which we will pay for your
services as our
representative in canada,america  and europe.
Regards.
Vice President
(CMIEC)
www.cmiec.com
Mr. Zhang.

Job Scam: Italy Representative Group

This is a fairly straightforward "money laundering disguised as payment processing" job scam. It targets USA residents, whereas most of the spam I get targets Australians, but is unremarkable in all other aspects. The job offer presents itself as being from "Italy Representative Group", and they offer an address in Rome to back up this identity. There may be a business of that name at that address for all I know, but I'll wager pounds to pence that these spammers have nothing whatsoever to do with it. Don't touch unsolicited money-handling jobs with a barge-pole -- you'll wind up being the fall guy for a bunch of thieves.

The spam originated at 85.237.182.182 on Mon, 24 Oct 2005 23:58:33 -0000. Body text follows for reference.

Good day sir/madam,

We inform you about new vacancies in our company.

Do you want to start a successful carrier right now without any entrance fees, without buying goods or involving other people? Do you want to start a successful career in financial sphere without economical education or special experience? Do you want to work at home? If it is so, this suggestion is for you!
Our company is ready to offer you the chance. At this moment we are enlarging our staff and you have a chance to become a member of our team and get additional earnings spending 2 - 3 hours per week. But it isn.t all. We can send you a long term contract if you prove us your reliability.

Our company.s name is IRG "Italy Representative Group". Our company is new and fast developing in the USA commercial holding. We work with clients and companies from all over the world and now we are looking for talents in the USA. Our firm is founded in 1993 and our head office is located in Viale Praco de Medici 37 00148 Roma, Italy.

You can earn up to 5000 USD per month, taking into the account the fact that you will work at home, have a flexible working schedule, simple and small amount of work.You will receive 7 % from the sum of payment for this service (you just take this sum out of the total amount of money you get).

To qualify, you MUST:

1. Be at least 21.
2. Check your email several times a day (each hour
if possible).
3. You need to respond immediately to emails.
4. Be responsible, hard working and communicable.
5. Be able to answer phone calls.

If you are interested in our suggestion please e-mail to our manager
Laurie Fantauzzi <alluringjob@mail.com>

Regards,
"Italy Representative Group"

Phish of the Day: egold2gold.com

Most instances of phishing fraudulently represent themselves as some legitimate business or other. Here's a case where the phisher would have me believe that someone has sent me money out of the blue, and all I need to do in order to collect is sign up at a payment processing thing I've never heard of before called "egold2gold.com". But I'm a sceptical so-and-so, and I don't believe a word of it -- especially given the following evidence.

The original phish message directs me to a "sign up" page at egold2gold.com. There's nothing too sinister-looking here (although I admit not checking it for malicious payload -- I haven't been that diligent in a while). All I need to do is provide a username, a password, and an email address. I provide some fairly arbitrary data for all the above, including a "mailinator" email address, to see what turns up. What turns up is a confirmation request. "Click on the link to continue," it requests. Unless you're silly enough to use the same username and password that you use for something else, all the phisher has at this point in time is a known-good email address -- expect the spam rate on that address to go up.

Of course, if you actually want to claim any of this money that's allegedly been sent to you, you need to fill in a whole swag of stuff -- all the usual bank details, credit card details, drivers licence number -- all the stuff that a craftly little phisher wants so that he can impersonate you for financial gain.

One other thing to note -- the facade isn't terribly convincing. I also signed up with my "ideceive" gmail account because that's the one I have to use to claim my money, you see. But it wouldn't let me sign up, because it only allows one sign-up per source IP address. This is obviously to prevent disgruntled spam-recipients from flooding it with bogus data -- I've seen it happen. But I was able to sign up with the same "username" and a different password from a completely different source IP address! That's no way to handle your accounts!

My conclusion: egold2gold.com is a phishing operation, pure and simple. It's a facade of a respectable payment system with a bunch of nasty crooks lurking behind it. It will probably vanish in the near future and spring up elsewhere under a different name. If you want to risk poking around in this hive of scum and villainy, you can try logging in to http://egold2gold.com/ as "zig" with password "bomb". It may work if nobody else has signed up with that username since I did -- and if they haven't made a run for it yet.

The spam in question originated at 70.84.130.228 on Mon, 24 Oct 2005 02:52:29 -0000. The message was as follows.

Hello,

This is not SPAM, this is an e-mail from egold2gold.com containing a notification of money paid to you...

A egold2gold.com user has just successfully sent you money!  Please look at the below details for information on this transaction.

Sender: payments
Sender's E-Mail: payments@egold2gold.com
Amount Received: 200.00
Sender's Comments: Money Transfer To ideceive@gmail.com

In order to claim this money, you must signup for an account with egold2gold.com  To do so, navigate to the below URL.

http://egold2gold.com?a=signup&semail=ideceive@gmail.com

The e-mail address you signup with must be the one you are receiving this e-mail at.  You should claim this money quickly, if you don't, the sender may cancel the transaction.

Thank you for your time,

egold2gold.com Services Team
http://www.egold2gold.com/
"The New Online Universal Payment System!"

Phish of the Day: St George Bank

This was received at the address which attracts the vast majority of my "scams targeted at Australians" junk, and it's fairly and squarely targeted at Australians. The body text is as follows.

Your Bill Payment from your Access Cheque Account to OPTUS LONG DISTANCE - 
OPTUS 1684 0032 dated 22/10/2005 for $953.44 was successfully processed. 

For more information regarding bill payments or transfers, 
please refer to your Past Internet Banking Payments/Transfers page, 
or contact the St.George Bank Internet Banking Help Desk. 


St.George Bank
http://www.stgeorgebank.org/traffic


Card/Access Number: 4239530000568075
Security Number: 1426
Internet Password: G5q71HRg

"St George Bank" and "Optus" are, as far as I'm aware, well-known entities in Australia. That's how phishing works, of course. I've never seen a genuine St George Bank payment processing notification, but I doubt that this one looks very authentic. I'm also pleased to report that the URL referenced in the spam is now 404, although it may have been active earlier.

The domain name "stgeorgebank.org" was registered on 20-Oct-2005 11:37:09 -0000. The spam itself originated at 83.176.34.230 (d83-176-34-230.cust.tele2.ch) on Sat, 22 Oct 2005 15:24:30 -0000.

Meta: Stock Spam Gets Its Own Blog

My primary aim with 419s, lottery scams, and stock spam is just to make people aware it's happening -- that they aren't privileged recipients of fortuitous information, but rather just another recipient of scatter-shot scamming. To this end, my sub-blogs on 419s and lottery scams have been working well, saving me time while maximising search opportunities. I've now followed suit with Stock Spam, so I won't be reporting any more of that here.

Given that I'm pretty much tired of phishing scams, that leaves me to report Job Scams here, plus whatever else comes up that's new.