Info: 419s and Lottery Scams Galore

Last month I considered the drop in the number of 419s and Lottery Scams arriving. Apparently it was a seasonal dip, rather than a trend: this month those crazy Nigerians and their brothers-in-scams have been making up for lost time. The month of November, 2006, is the worst month on record here at iDeceive for 419s and Lottery Scams by a long margin -- doubling the quantity over the worst previous month. I'm having a hard time keeping up with the inflow at the moment.

Info: Job Scammers go .mobi

Dubious congratulations are in order for the new ".mobi" top-level domain name: they're now officially being used by job scammers. The Athens Financial Group job scam now includes the "afgl.mobi" domain as part of the scam. This top-level domain is intended for websites which are optimised for mobile devices, but our pet scammers are just using it as yet another name in their efforts to be a moving target: the website behind the name is the same old same old.

Spam: bennicetravelandtours@yahoo.com

Sometimes a spam comes along that defies classification. This is one of them. No doubt I could get a clearer idea of what's going on here if I interacted with the sender, but life is too short for detail like that when there are so many scams to report.

This has "Nigerian Modus Operandi" written all over it: it was sent through a webmail system using drop-boxes at Yahoo! and Netscape for replies, and the originating webmail system reports the originating IP address as 62.56.140.83 which WHOIS in turn reports as Nigerian. So what's the scam? Well, the traditional Nigerian speciality is "advance fee fraud", so presumably that's it. Still, I haven't seen it done on this pretext before. If anyone has more detail on the scam, please post it.

Date: Tue, 21 Nov 2006 00:06:30 +0100 (GMT+01:00)
From: BENNICE  TRAVEL AND TOURS <bennicetravels@virgilio.it>
Reply-To: universaleinc@netscape.net
Subject: Bennice  World  Tours

 Hello  
Bennice U.K Travel and Tours  offers  a  wide  range  of  
services.
Do you  intend  to  get Visa  to any part  of  the  world?
We 
operate  a  travel  agency  that has  a  difference,
service delivery 
and  customer satisfaction is our Goal.
We Facilitate in procurement of 
Canadian Visa,[Students  and Working Visa.]
U.S  Visa  [Tourists,
Working  and  Students]
United Kingdom.
Schengen.
Japan  [Business and 
Tourists]
South America-Brazil,Venezuela Mexico  and Argentina.
Australia  and  New  Zealand.[Students]
South East  Asia-China ,
Malaysia ,Singapore and Thailand[ Working and tourists]
We  also  
specialize in procuring  Visas  and  other  travelling   document  for  
nurses  and
other  professionals in Nigeria.
There  are  limitless  
opportunities for Nigerian Nurses to work abroad.
We  have  ongoing  
application  within  France and  Spain.
The  visa  is  processed  
within  nine  days  to  two weeks.
Call  me  on   +44 70 40 11 2703
Our  Prices  are  relatively  cheap  and  you  have  value  for  money 
spent.
Regards
Edwin Oken
Email bennicetravelandtours@yahoo.com

Info: New Extremes in Image Spam

It's common for spammers to place their message in a graphic image instead of plain text. They do this as a means to avoid spam filters. After all, if a computer can't read what the image says, then it's hard to tell whether it's just a picture attachment, or an image with a load of spammy text in it. We do have some ability to extract text from an image -- a process called "optical character recognition" (OCR) -- but it's not terribly reliable, and is made worse by bad images. Consequently, many spammers -- especially the stock-touting "pump and dump" spammers -- corrupt their images to make them harder for computers to read.

This particular spammer has taken the practice of image corruption to new extremes. The background contains various blotches of colour, and the lines of text are all slightly off kilter. I hope that nobody takes stock purchasing advice from a message that looks like it's abusing psychoactive drugs like this.

Job Scam: Norden United Ltd

If past experience is anything to go by, we can expect quite a few job offers from Norden United Ltd this month. They will look suspiciously similar to all the other job offers I've reported here recently, and all be illegal money mule jobs. The first of these arrived a couple of days ago, and I would have reported it sooner, but I had a backlog of work to clear.

Job Scam: Athens Financial Group Ltd

It looks for all the world like the same old phishing/jobscam gang that did Israeli Brokerage Services and goodness knows how many other scams reported here, but the new name of the month is "Athens Financial Group Ltd". Go take a peek if you want the details, but it really is the same old scam with a new name.