LASER LADSForwarded from England:header manicured: Return-Path: <akuster@nicolastse.com> Received: from nicolastse.com (nicolastse-com.mr.outblaze.com [205.158.62.181]) From: "Pacification B. Beseeched" <akuster@nicolastse.com> X-Mailer: The Bat! (v2.00.3) Personal To: Kindly Contributor Subject: Re: Kindly Contributor, Sign me up! Dear friend, Nowadays vacancies: * Transaction Manager; Description: * We are looking for honest and smart people for this position. Requirements: * Adult people only (we cannot hire people who don't reach the adult age); * Resident of England; * Computer with e-mail; * 2-3 hours free time within the work day; Job description: Our company is interested in hiring citizens of your country for temporary work tied with receiving money transfers from our clients in your country through the banking system (usually an internal bank transfer, or bank transfer within the country) and further transfers of these funds to us through money transfers such as WESTERNUNION - more about this company at westernunion.com <http://www.westernunion.com> (choose your country on the main page for specific details). You will be paid according to accomplished work - 10% from the sum of each money transfer. On average transfer sums will range from 2000-2500 pound sterling. You will process at least 1-2 transfers a week. In order to start working you do not need any money, any previous work experience or special education. If you are interested and would like to get more details on this job offer - simply fill out the form below (if you couldn't send the inquiry from the form visit the following link <http://golyells.com/eml.html> ) Attentions! Space is limited, so hurry! PERSONAL INFORMATION: First Name Last Name Country Phone Analysis and Discussion: We fastened with laserlike intensity on the phrase transfers of these funds to us through money transfers such as WESTERNUNION. That is the nut. Everything else is window dressing. Read it again, in Scam-o-vision: Dear la la, la la la la la la la la la la la la la la la la la la la la la further transfers of these funds to us through money transfers such as WESTERNUNION la la la la la la la la la la la la la la la la la la la la la la la. What does this mean? It means your new mysterious 'employer' sends you a check. You take it to the local branch of your bank. Your bank holds it for some period of time. The check may in fact pass muster with the local branch. Meanwhile, trusting soul that you are, you do as your 'employer' urges: you send a money order back to him, in some amount less than or equal to the amount of the check. He may offer some twisted explanation about why this is necessary, but it just makes your head ache. Your money order is promptly cashed by the 'employer'. Then your bank's central clearinghouse finds the original check is a fake. The bank may dun you for the check. So run do not walk to the bank's fraud examiner and fill out a fraud 'affidavit'*. They may possibly be able to recover the funds in some cases, but in either case do not just passively accept the debt. Better yet, don't get in such a situation to begin with. *Scam-o-disclaimer: the above is not legal advice, it is a suggestion. For real legal advice, see real lawyers or solicitors. This disclaimer brought to you by the IP address [205.158.62.181] and the color green. In one variation of this routine, the checks may actually be real - the first few times. You eventually get a dud. We have heard of (probably rare) instances in which the check was real, but stolen or altered. So you get real money, and send part back to the crooks, not knowing it was stolen money. But back to the e-mail: www.arin.net tells us: Received: from nicolastse.com (nicolastse-com.mr.outblaze.com [205.158.62.181]) XO Communications XOXO-BLK-0 (NET-205-158-0-0-1) 205.158.0.0 - 205.158.255.255 Outblaze, Limited XOXO-205-158-62-0 (NET-205-158-62-0-1) 205.158.62.0 - 205.158.62.255 Means, XO Communications has been allocated the range 205.158.0.0 - 205.158.255.255, and in turn allocated the "62" subnet to Outblaze, another ISP. And "nicolastse" is a customer of Outblaze. Well, ho hum. And the web page? Now let's visit http://golyells.com/eml.html: The text on the web page is the same as in the e-mail. There's a form where you can fill in your contact information. Nothing really confidential is being asked - yet. It triggers a script in PHP: <form name="userform" method="post" action="http://208.56.186.211/eml.php"> Where is 208.56.186.211? "host 208.56.186.211 211.186.56.208.in-addr.arpa domain name pointer denisgibbon.com" denisgibbon.com produces an error page which redirects to: http://www.pplsa.com/associate_members.asp?id=drg "Welcome to our Pre-Paid Legal Services Website!" They also appear under http://www.pplsa.biz/. What about just looking at the web site by its IP address? http://208.56.186.211/index.php AVS Hosting, offering inexpensive domain name registration & hosting in Australia. This is all very nice, but the coffee pot's empty. Anyway it looks like the Lads copied someone's business site. We fill in the form back at the "Golyell" site and click away: "Dear friend, Bozo Clown ! Your inquiry has been accepted, one of our managers will contact you as soon as possible !" But who runs this web page? At the bottom is a copyright notice for an advertising company in Baton Rouge, Louisiana (USA) Fax: +44-20-7504-8693 (UK!) Well what's on the main page of http://golyells.com? Goodness! A completely different look and feel - all red, and it's a British laser company, with a phone number quite different from the fax number above. Huh? Brains moving slowly, coffee machine hasn't finished dripping into the communal pot. Why is a laser company hosting a scam page? Crooked employee? But why don't they have their own domain name? Well, duh, of course the British company have their own domain name, and maybe don't know their web site was copied. Enter a Kindly Contributor from Sweden. "I looked into this laser company and I seriously doubt that they have anything to do with the site your English contributor found... The domain golyells.com is registered to this guy: (he lists an Anglo-sounding name with a Yahoo e-mail account that sounds unrelated to the name, in Texas) The laser company has a real website (identical to the golyells.com one) at www.allteclasers.co.uk, registered on their company name. It seems that somebody, for some obscure reason, lifted the entire Alltec site and copied it to golyells.com... Maybe we will see a devious laser scam in the near future? Laser Lads? ;-) It's getting weirder and weirder out there, folks. Just remember: la la la la la la la la la la la la WESTERNUNION la la la la la la la la la la la la la la. And if you take the last cup of coffee, start a new pot! So we wake up a little and start pulling more job scams out of the ScamBase. CAREERBUILDER IN THE HEADLIGHTSFrom the USA:They send us the fake money using wire transactions. We send them real money using Western Union? I don't THINK so. Getting clever, these guys. From: "Perryse" <infoundetected@currencyexchangecorp.com> Date: Fri, Jan-7-2005 11:34 AM Subject: Careerbuilder job application We are looking for business partners in the USA. We are the Internet Currency-Exchange Company. We are in the partnership with such payment like (PayPal systems, WebMoney, E-gold, Evocash etc.). Our office locates in Denver. Most of our transactions are made in the territory of the USA. Our partners prefer to pay us using wire transactions through regular banks. The bank system in Europe is not effective as the bank system in the West. This is the main reason we <font color = white>fanaticismhecklelanesrapturousZionist/font> are choosing the US partners with bank accounts for our money transactions. They are fast, reliable and easy. As soon as you receive the money from us, you will leave for your self 5-10% from the each amount of money you will receive. The rest of the money you send to us using Western Union. You can easily make from $500 to $5000 per month. <font color = white>forgingthievesOsbornsuggestcreases/font> Details You can view: <a href = "http://www.currency-exchangegroup.com"> here or just copy and past ""http://www.currency-exchangegroup.com" in Your browser. Contact with our stuffmanager (Anne Hart) :
The random text labeled "font color="white"" (which would not be visible in your mail reader) looks like something to get past spam filters. The red colored text is the Lads trying to be dramatic, not us. Wait, don't touch your checkbook! Because there's more - JOIN THE EXCITING WORLD OF WEB DESIGNRecently rcvd an email from WortexWebStudios.com for a job.They got my email etc from a job site (CareerBuilder). From: "Frank DeLano" <frank@wortexwebstudios.com> Subject: CareerBuilder.com: Sr Account Manager Position --------------------------------- Hello, We saw and reviewed your resume on CareerBuilder and we think that you are qualifying for a position with our company as an Account Manager. If you need further information please contact us at frank@wortexwebstudios.com and we will send you our terms and conditions for this job. If you agree and comply with them we can start right away. Base salary per year will be between $85,000 - $95,000 with posibility of raising. Look forward to hear from you. Frank DeLano General Manager Wortex Studios www.wortexwebstudios.com I responded that I was interested and a couple days later rcvd the following (I'm including the "advanced" header): Subject : terms and conditions Attachment : terms_conditions.doc (0.04 MB) Received: from miami.micfo.com ([66.98.182.22]) Received: from 68.62.15.84 ([68.62.15.84]) (SquirrelMail authenticated user frank@wortexwebstudios.com); by www.wortexwebstudios.com with HTTP; Thu, 3 Mar 2005 00:34:29 -0600 (CST) X-AntiAbuse: Primary Hostname - miami.micfo.com X-AntiAbuse: Original Domain - hotmail.com X-AntiAbuse: Sender Address Domain - wortexwebstudios.com Return-Path: frank@wortexwebstudios.com XXX, Find attached our terms and conditions.If you agree and comply with them let me know and we can start right away. We are looking for a self motivated person eager to provide the best for the company. Even if you dont accept this job we will appreciate if we will get an answer from you so we can continue our seeking for the right person to do this job. [Uh oh. That seems right out of a 419 letter.] We will email you the contract you have to print complete sing and fax it back to us if you will join our team. You can find more information about our company at www.wortexwebstudios.com Frank DeLano General Manager WORTEX Studios www.wortexwebstudios.com CONFIDENTIAL COMMUNICATION This e-mail message and any attachments are intended only for the use of the addressee named above and may contain information that is privileged and confidential. If you are not the intended recipient, any dissemination, distribution, or copying is strictly prohibited. If you received this e-mail message in error, please immediately notify the sender by replying to this e-mail message and DELETE the e-mail message from your system. Thank you Attachment : terms_conditions.doc (0.04 MB) <<<<< Here's the attachment, which BTW I had a lot of trouble opening:>>>>> Hello, First of all you should know that we are in a complete hurry right now. Time is money and we don't afford to loose time right now. We are a team based in Spain who work over the internet for securing the websites, e-commerce implementations, cart implementations, securing merchants websites and their clients, SSL communications, Java, C, C++, PHP, SQL, HTML programming, With 7 years of working experience on the Internet, we have developed a very refined project execution methodology, which keeps improving as we go along. ... [blah blah ,it looks like they copied a blurb from some other site - it looks rather convincing, if crammed.] Pause for some analysis: OK Scam-o-readers - Design and programming firms do subcontract, generally to people they know. They might work with remote partners on non-crucial elements after a relationship is established. But core functions? To an American? When you could hire a Spaniard, or capable Europeans further east who probably charge even less! And why can't a design studio compose more readable e-mail? This seems cribbed from a real design studio. But read on! Our problem occurred when we had to receive the payment for what we've made, for our work. We cannot receive the payment in a timely manner due to high delay with Spain based banks, check clearance and other form of payment. Oh, starting to look familiar. Also if we will receive the payment directly in our country we have to pay like 38% from the total amount on taxes and incomes. As long as we need the money real fast and we need to lower a bit those taxes we have agreed and come with a solution. Our clients could pay us where we want with checks or they can do direct bank wire transfers/bank deposits as they said is much safer and faster working directly with their bank. We need someone who can receive the money through these methods of payment or bank wire payments and send us the money with Western Union as if we will receive amounts lower thank $3,000 with Western Union we will get off the taxes and incomes, even if the transaction fees are bigger with Western Union. Our future employer will be hired based on a percentage of sales or on a fixed amount each month. We propose 15% from our sales for any checks you receive or bank wire transfers (received in a new bank account that you will have to open it of course on our expenses). All what you have to do is to receive the money and send it to us with a faster service each time when you will receive them. Note that your salary percentage will raise if you will get a good feedback with us. We are thinking to open new offices for US area, and our future employee will get a manager position if he will provide a fast and good communication with us. All Western Union fees will be supported by us. If you are ready to proceed please let us know. Daily status of transactions are required also (these can be provided at the end of the day or anytime a payment comes) Gee it looks like a plain old 419 scam disguised as a scam to avoid taxes :) We prefer to work with Wells Fargo Bank and Bank of America (NOT a former Fleet Branch) as a lot of customers have accounts on these two banks and this will facilitate our transfers and also they will be made faster. We need you to open an account on one of these two banks of your choice and send us the information so we can provide them to our customers. Better for us is to open accounts on both banks as it will be much easier and faster. If you can open accounts on both banks your share will be 20% from all payments we will receive. All fees for opening this account will be supported by us when the first payment will hit your account. Your 15% or 20% (depending of your choice if you can open one account or two accounts) will be taken immediately after a payment will be cleared. PLEASE NOTE: We will NOT use one of your existing accounts. WE need you to open new account(s) (depending of your choice of percentage). WE WONT need any of your private information, such as SSN, Existing Bank Account Number, Mother Maiden Name or anything. WE do not want you to believe that this is a trick in order to get your personal banking information or credit card information. We are just trying to get along and extend our services and this is why we need someone who can take care of this thing! Also our goal is to open the US Offices as soon as possible, as this will be our main priority in the future, opening new offices will give us more prospective and bigger projects with a lot of hosting companies based in USA. When we will be able to open them (within 4 months) you will be in charge of everything for US Area, starting from hiring peoples, taking care that the all projects for our clients will be completed in a timely manner, and so on. JOB RESPONSABILITES: taking care of payments as soon as they hit and clear your account is the primary responsibility you need to have regarding this job. This means that every time a payment hits your account and gets cleared with your bank you have to redraw funds and send them to us as soon as possible, because of the time difference we need you to do it as soon as they get cleared communication is one of our main goals, so what we need from you is to check your email more often than usual when we announce you that a payment has been confirmed as we will send further instructions to you as soon as they hit your account, also provide a phone number where you can always be reached so we can hit base in case of any urgent matters we have to solve regarding payments providing good communication and harmony with future employee's as soon as US offices will be opened (as stated within 4 months after we will start this thing) as our main goal is to work together as a team and solve all our problems as a team because in this way everything will work out. We are thinking to hire between 10-20 employees, this will be one of your important tasks as soon as offices will be opened there. Trying to find better ideas for the best of the Company, this will help us maintain good relationship between us and our customers and also new ideas are always appreciated from a self motivated eager to grow incomes of the Company JOB OPORTUNITIES: working with our company can be done from home too if you have an internet connection until new offices will be opened over there learning new techniques was always a challenge for us and we hope that will be for you too. Our specialists will be able to teach you everything they know if you have time and patience as soon as they offices will be opened there. Two of our best specialists will be sent in order to provide new skills to the future employees our company will have and also to maintain our productivity line in shape. This will not affect your Manager Position for US Area, will just help you learn something new. If you accept all terms and conditions and you are ready to start up please let us know immediately and we will send you via e-mail the contract you have to print complete sign and fax it back to us. Also if you cannot complete these tasks let us know so we can find someone else. TAXES: You will not be liable for any taxes in the United States. You will be transferring the money received from our creditors out of the country and therefore will not be liable for capital gains taxes. You will only be liable for your normal income tax on the commission received. Accounts should be opened as personal checking accounts as our customers are making online bank transfers via the online banking system that Bank Of America and Wells Fargo Offers. SALARY: An estimated salary should be between $75,000 - $95,000/year with possibility of raising it to $120,000/year as we have a high sales volume and this will facilitate our job in order to receive payments. Your share will be taken every time a payment hits your account. We will support Western Union fees and Bank opening fees from our share. If you need further information about what we do, Company information or anything else please visit our website at: www.wortexwebstudios.com Thank You Frank DeLano General Manager WORTEX WEB STUDIOS Madrid, Spain Someone spent a lot of time writing that. I have pulled up their site - look legit although when I do a search for Wortex, nothing comes up. They have a number of testimonials on their site, which seem to be legit companies (a search will bring them up). I could not find a phone number for them = strange. (They give a toll free fax#) ! If the salary was lower, it would be more believeable. Who are they copying? So many web sites using the word "wortex". Is there a Frank DeLano out there whose content's been ripped off? Or is Frank DeLano a made-up name? Does anyone else think identity theft is a big problem nowadays? Well, let's move on. VACANCE SUISSEJust when we thought this page was wrapped up and put to bed - comes this from a Kindly Contributor in France. We have no header for this, but suspect the sender was, if in Switzerland, not actually Swiss."Moi j'ai pas des lettres de Jérusalem ou du scam africain : c'est de la "vacance suisse" : Ca fait plus classe de faire du biz avec des suisses... je vous recommande de cliquer sur le lien, y'en a bon parler petit suisse sur le site qui explique la proposition de vacance ! (copie d'un mail du 11/03) :" (So this has been around for a while) "Cher lecteur, Nous vous écrivons de la part de /Antiquitaeten-Schwaighofer GmbH . /une companie très bien connue fondée en Suisse dont le champ principal de l'opération est le marché européen des antiquités. Nous sommes ravis de vous proposer de visiter notre website où nos proposions sont décrites plus en details. Vous avez l'opportunité de recevoir un travail perspectif et intéressant dans la sphère financière. *On vient de lancer un nouveau programme parce que nous avons besoin des managers financiers régionaux dont le travail est celui de transférer les fonds reçus de nos clients et suppliers. *On ne vous demande pas d'avoir quelque connaissance en plus ou être expérimenté dans ce business, et cette occupation peut donner un revenu en plus pour vous et votre famille parce que ça ne demandera pas plus que peu d'heures pen dant la semaine. *On ne vous demande pas aucune cotisation pour commencer et aucune cotisation n'est pas du tout demandée. *Vous pouvez demander ça en envoyant tout simplement un e-mail à *vacancy@Antiquitaeten-Schwaighofer.com *et **on **vous enverra un formulaire de demande. Après ça remplissez tout simplement ce formulaire et envoyez-le à nous. Vous devez recevoir notre réponse pendant peu de jours de business et si on vous approuve, le travail peut être commencé immédiatement après ça. Merci d'avoir lu notre proposition. Nous espérons que vous êtes intéressé et désirer commencer la coopération avec nous. Vous pouvez recevoir plus d'information sur notre * http://Antiqui taeten-Schwaighofer.com/vacancies.htm *. *Meilleurs voeux, Antiquitaeten-Schwaighofer GmbH" Which means (more or less): Dear reader, we write you on behalf of Antiquitaeten-Schwaighofer GmbH, a company very well known founded in Switzerland whose principal field of operation is the European market in antiques. We are delighted to propose that you visit our website where our proposals are described in more details. You have the opportunity to receive a financial prospectus. We are starting a new program because we need regional financial managers whose work will be to transfer funds received from our clients and suppliers. *We do not require that you have any knowledge or experience of this business, and the job can bring you more revenue for you and your family because it requires no more than a few hours dur ing a week. *No start-up costs are required of you to begin, and there are no costs at all. *You can ask for this by simply sending an e-mail to *vacancy@Antiquitaeten-Schwaighofer.com *and **we'll send **you a form. After you simply fill out this form and send it to us. You should receive our response within several business days and if we approve of you, the work can be begun immediately after that. Thank you for having read our proposal. We hope that you are interested and to wish to begin the cooperation with us. You can receive more information on our * http://Antiqui taeten-Schwaighofer.com/vacancies.htm. * Best wishes, Antiquitaeten-Schwaighofer GmbH Analysis and Discussion: Their web site looks like the draft of a web site. If focuses very little on antiques and almost entirely on transferring funds. Weird. Antique brokers and art brokers make their living buffering sellers from buyers. If you have a collection of valuable objects, you may not wish the world to know you are selling off part of it, or where the rest might be found. You might have similar concerns as a buyer. Say you have a collection of 19th century English landscape painters. You want or need to sell a few paintings. You call in an art broker, someone with a deep knowledge of this genre. The broker will suggest a price, and locate a buyer, taking a commission. Or you might go to an auctioneer such as Sotheby's. Or perhaps someone like this (apparently Swiss) dealer. Let them deal with the mechanics. Anyway, certainly in Switzerland (!) you needn't e-mail strangers in other countries to ask for their help in receiving money. The French contains spelling mistakes, and in places it seems like they simply left out terms or used machine translation. The other pages switch without explanation to English. With more spelling mistakes. It looks like they ripped off much of this from a real antiques dealer but haven't finished customizing it. A little homework: "host antiquitaeten-schwaighofer.com" antiquitaeten-schwaighofer.com has address 68.142.234.40 (and a number of others in that subnet) Reverse lookup: host 68.142.234.40 40.234.142.68.in-addr.arpa domain name pointer p3w6.geo.re2.yahoo.com Hosting through Yahoo? Not that there's anything wrong with Yahoo, they have a nice service for a small business. Still... This domain name show up as a 'throwaway' domain name on Joe Wein's SpamSpy list: http://www.joewein.de/sw/bl-log-2005-02-10.htm (interesting site) Whose site are they copying? It turns out there is a Schwaighofer in the antiques business, but in Austria. His site (http://www.antiquitaeten-schwaighofer.at/), says this: "WARNING! Dear honored customers, our website became the goal of a criminal attack. ... Our website was faked and misused under "http://www.antiquitaeten-schwaighofer.com" for criminal purposes ... A charge at the federal police in Salzburg, Austria, is processed. Pay attention to the TopLevel- Domain!" They know about all this. To recap, the Lads are copying the web sites of legitimate businesses, and using them to scam people. But you knew that. That's all for now, folks! write when you get work! OUR BUSINESS WAS INEVITABLY RUINEDWe didn't think we'd add any more, but this might become an ongoing thing. No fake business web site mentioned here, but what kind of web design firm wouldn't have a web site?They apparently got my resume off of career builder. From: "Logan Ryan" <admin@webpro-services.net> Subject: CareerBuilder.com: PROweb : The Offer Your resume was reviewed and accepted. Please read this email to the end; here is some information about our company and about your future work. Company has been known in the Internet technologies market for almost 4 years. We are engaged in web-design and all other aspects related to this sphere: scripts writing, making banners, logos, sites patterns, development of web applications and technical support. Our company is registered and located in Australia . We also have some offices in south - east Europe. Staff of the following offices consists of groups of grade A web - designers and programmers. For the first two years we basically worked only with clients from Australia, Japan and New Zealand. Later gradually we managed to penetrate the world market in this sphere thanks to professionals in the Internet technologies, computer graphics and programming who work for us and are capable to execute complex corporate orders and to facilitate the exclusive projects. We boast to have clients in other countries. By May, 2004 75 % of all our orders were from clients in the USA and Europe. After the penetration into the world market our turnover increased several times, but at the same time we unfortunately faced certain problems. Popular online - payment systems, such as PayPal (www.paypal.com) and similar ones, BidPay (www.auctionpayments.com), AmericanExpress payment systems (www.americanexpress.com) and other electronic methods of payment are not supported in some countries where payment systems and other electronic methods of payment are not supported our offices opened.. We had a problem with reception of payments from clients since we could not support even the basic and most popular ways of payment. Even when a client made a money transfer with a bank, we could get it from another country only 10-15 days after and therefore our business was inevitably ruined. [This is such a bunch of crap, but you knew that.] Additionally several factors were against our business. It is not a secret that for the last years the role of online banking has soared up, and many clients would prefer to make money transfers not leaving their house. Therefore bank details of a decent financial institution in a civilized country were necessary for a successful company of our level with good reputation, which was looking forward to find an opportunity to use popular online payment methods which were not available to a citizen We had to find a radically new approach to this problem. The decision to find a financial representative in the USA was made to solve a lot of problems due to payment methods. You, as the citizen the USA can help us with these questions. The working scheme is as follows. After you give us all necessary bank details you will receive payments from our clients. After the reception of a bank or electronic transfer/cheque you will send us the money by Western Union (www.westernunion.com). This method is very convenient for us. [Oh yeah.] You will receive 8 % from the sum of payment for this service (you just take this sum out of the total amount of money you get). Thus you can earn up to 2500 USD per month, taking into the account the fact that you will work at home, have a flexible working schedule, simple and small amount of work (no more than 8 hours per week). You will pay all transfer commissions only from our money. You bear the responsibility for safety of our money only against us. We also keep an eye on money origin and on customer's honesty to provide legality and safety of our business. Please send us following information for further steps to employ you I. Fill in the form (if this information is specified in your resume, then please send it once again for confirmation): Full name and surname: The address : City: State/ province: Post code: Contact phone number: E-mail: II. As we are going to entrust to you sufficient sums of money, we'll need some details to check and update the information. Please, send us by e-mail or by fax a copy of your driver's license (or other basic document). [Don't ever do this - unless it's Topo Gigio's license issued in the state of Upper Slobovia. The Lads use copies of official documents as raw material to scam others.] After we get this information, our Project Manager will contact you and give further instructions related to this work and will inform about the date to start the work. Our company is registered in 2001 and fully legal. Here is our information. Our Postal Address Is: Financial Services Centre PO Box 231 Civic Square ACT AUSTRALIA 2608 Our Bank Details are: Account Name: Proweb-services Account Number 10010887 BSB 064008 Swift; CTBAAU2S Regards, PROweb services la la la la la la la la la la la la WESTERNUNION la la la la la la la la la la la la la la. |