Job offer spam: Processing payments (alpenantique.com)

Email Spam Filter:

Try it for free!

About spam / "419" / Blog
jwSpamSpy
Recent spam domains
Spam domain blacklist

Software
Links
joewein.de
joewein.net
Contact

Job offer spam: Processing payments (alpenantique.com)

"Alpenantique.com" and "Alpen-antique.com" are a fraud!
Both domains were registered by an international fraud ring and are/were hosted by Yahoo.com. They were set up to lure in job seekers to assist the gang at stealing money from bank accounts. Money transferred between bank accounts, even illegally, remains traceable. By getting an innocent third party to receive funds and forwarding via Western Union, the money trail is broken. The funds disappear without trace.

In at least two cases money was sent to accounts of job applicants, who were given instructions to wire it to a recipient in Berlin. The same recipient name was used in both cases. Luckily the fraud was detected before cash could be withdrawn from the account and the funds returned to the rightful owners. One of the people involved then received death threats from the scammers. We have notified Yahoo.com multiple times of boths scams, but it seems to take weeks before they take any action.

What you can do if you have been recruited:

Report the fraud to local police in your city.
Contact your bank and explain the situation.
Contact Yahoo!Website Services (domains-abuse@yahoo-inc.com) and ask them to cancel these domains.
Forward us a copy of all emails you have received from the scammers (as an attachment if possible, "Message / Forward as attachment" in Outlook Express).

The spam that started it

Maybe you've received this kind of spam before: Some company is looking for people who can receive payments from the company's customers. They will then have to wire those funds to the company, minus a percentage they receive for every payment forwarded.

The conditions seem good: You can work part time, need no prior experience. You just can't have a criminal record. This may sound quite attractive to people out of a job, but there's a catch.

Here is a typical example of one such spam (Alpen-Antique GmbH, alpenantique.com):

Received: from 200165185180.user.veloxzone.com.br ([200.165.185.180])
by vmx50.#######.net with esmtp (Exim 4.41)
id 1CMyqT-0001c5-1N
for ######@##########; Thu, 28 Oct 2004 03:12:54 +0200
Received: from unknown (HELO localhost) (127.0.0.1)
by localhost.inpemuf.com with SMTP; Thu, 28 Oct 2004 01:19:02 +0000
Received: from 201.42.189.181 (201.42.189.181[201.42.189.181])
by 200165185180.user.veloxzone.com.br (IMP) with HTTP
for <######@##########>; Thu, 28 Oct 2004 01:19:02 +0000
Message-ID: >6534421098926342@200165185180.user.veloxzone.com.br>
From: "Martin" <leambruc@dvercity.com>
To: "Isolde" <######@##########>
Subject: Alpen-Antique Recruitment (European Job Opportunities)
Date: Thu, 28 Oct 2004 01:19:02 +0000
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.2.2
X-Originating-IP: 201.42.189.181
X-MailScanner-SpamCheck: spam, SpamAssassin (score=7.965,
required 5, BAYES_50 0.00, HTML_10_20 0.25, HTML_MESSAGE 0.00,
MIME_HTML_ONLY 0.18, RCVD_IN_BL_SPAMCOP_NET 1.22,
RCVD_IN_SORBS_SPAM 2.00, RCVD_IN_XBL 3.08, RCVD_NUMERIC_HELO 1.25)
X-MailScanner-From: leambruc@dvercity.com

<HTML><html> <body> Dear Mr/Mrs, Alpen-Antique GmbH was founded in 1896 year and since that time our company successfully participated in antique items distribution all over the Central Europe. After opening our website our goods became subject of new customers interest from all over the world, especially from Great Britain, France and Spain. We started new campaign selling our goods on-line, but we faced new difficulties connected with payment delivery delays to our account, because of international wire transfers usual 5 business days delay. A decision was made to hire sales representatives capable to receiving payments from the same area where are the customers located. At this moment we run sales representatives hiring campaign and are glad to propose you this position. You are welcome to be our representative. Please visit our webpage <A href="http://www.alpenantique.com/partner.htm">www.alpenantique.com/partner.htm</A> describing all aspects of this opportunity and if youre interested - please send us an email to <A href="mailto:job@alpenantique.com">job@alpenantique.com</A> and you will be sent an application form. Sincere regards, Karl Schallmeiner Alpen-Antique GmbH </body> </html> </HTML>

This type of scam always involves criminal activity, such as plundering bank accounts, check fraud or fraud on eBay. In either case the "employee" is used to send money to criminals in another country, who don't leave a money trail to follow, because Western Union wire transfers are basically untraceable.

In the case of the above email, there are several red flags:

Why is this job offer sent to a total stranger about whom the company knows nothing?
Why does a Central European company send its email from a computer in Brazil?
Why was the domain of this supposedly 108 year old company only registered 7 days before the spam was received?
Why is there no postal address, telephone number of fax number?
On its website Alpen-Antique GmbH lists a postal address in Vienna, Austria. The streat name ("Osten Blumen Strasse") does not exist and there is no 4-digit Zip code, as there is in all Austrian addresses.
The phone number listed is not from Vienna but from an existing Austrian business in Upper Austria, in a different federal state. It appears that the alpenantique.com website is based on much of the content of schallmeiner.at, the website of that business which has been online since at least December 2003. The major differences between the two sites are:
- schallmeiner.at is bilingual (German / English) whereas alpenantique.com is in English only
- alpenantique.com uses a different contact address
- alpenantique.com lists a bogus Vienna address in addition to the Upper Austria address.
- Neither site mentions the website address of the other site

The conclusion:

Alpen-Antique GmbH is a fraud!

The real Mr. Karl Schallmeiner living in Austria is not connected to the alpenantique.com-website. As an innocent victim he contacted Yahoo who host the fraudulent website to get it shut down, as this scam was damaging the reputation of his company. By 2004-11-15, more than two weeks later, Yahoo had taken no action against the website. Mr. Schallmeiner was getting phone calls from job seekers attracted by the scam.

Our investigations showed that the person who reads the replies addressed to job@alpenantique.com is not in Austria at all. Instead he/she uses bigpond.net.au, an Australian internet service provider to pick up his email. We have evidence suggesting he/she is actually someone living in in the state of Victoria, Australia (possibly a a New Zealander). The Australian connection is interesting, because there have been many "phishing" frauds affecting customers of banks in Australia-New Zealand. Also, the sequel to alpenantique.com, alpen-antique.com (see below) was specifically looking for job applicants in Australia.

People applying for jobs at "alpenantique.com" were told to fax their job application to fax number 18662078286 (+1 866 207-8286), a free dial number in North America.

The "Alpen-Antique GmbH" job scam is a reincarnation of a similar scheme, the "Plasma project" job scam. In fact, the job description text on the scam website even mentioned "Plasma Project, Inc." as the company name! Somebody obviously wasn't very careful when they recycled the HTML code from the earlier scam website. Not only do large passages of the job offers match word for word, the "Plasma Project, Inc." fraud also used a fake website ripped off from a legitimate company's website which whas not involved in the scam at all.

See the following article for more information about this type of scam:

Online job seeker says she was duped into scam (MSNBC, 2004-07-14)

Story of a fraud

On 2004-10-29 I contacted Mr. Schallmeiner, the owner of the website whose content was ripped off to create the spoof site for the scam and alerted him to the scam going on. Mr. Schallmeiner replied the next day and then tried to contact the nearest Yahoo office, based in Munich. He also filed a criminal case with the local police Austria.

I contacted the website of the police in Victoria, Australia and was told on 2004-11-01 to instead file a case with the local police in Yokohama, Japan who could investigate and then forward evidence to their Australian collegaues via Interpol. Neither the criminal nor the victims are Japanese and the website is in English. I frankly doubt I would get much action from the Japanese police on this case any time soon.

On 2004-11-05 Mr Schallmeiner contacted me again and reported that he could not contact anyone at Yahoo Germany and Yahoo in the US referred him back to Yahoo Germany. Therefore I contacted abuse@yahoo.com on Mr Schallmeiner's behalf on 2004-11-15. The fraudulent website was still active three weeks after it had been registered and more than two weeks after the initial spam. One week is probably all the criminals need to starting shifting money via this scam.

The reply from Yahoo Technical Support was a standard boilerplate response to people who forward spam that apears to be sent from a Yahoo email account. They told me my email was lacking full email headers for the reported email abuse, when in fact I had complained about domain abuse, not email abuse. The spam advertising the site they were hosting was sent from Brazil, after all.

After I sent another email pointing this out to them, Yahoo.com finally shut down the fraudulent site on 2004-11-17.

The same day I was contacted by a very scared gentleman in an EU country I will not mention here who had been tricked into becoming an associate. He was told to wire almost 10,000 euro by Western Union to a recipient in Berlin, Germany. The recipient name appears to be Estonian. However the person from whose hacked account the money was sent to the associate's account became aware of the illicit transaction and had it reversed by the bank before the associate could withdraw and forward the funds as instructed.

Had the money been wired to Berlin, then anybody with some form of ID for the (probably fake) name supplied to the associate could have gone to any Western Union agent anywhere in Berlin (there are 160 of these, including 157 branches of DEUTSCHE POSTBANK A.G.), picked up the cash and walked out into the street without any trail left behind for law enforcement to follow. That's what these job offers are about.

Were you recruited as an associate
by either alpenantique.com or alpen-antique.com?
If so, we would like to hear from you!

alpen-antique.com - The scam continues

On 2004-11-24 alpenantique.com resurfaced as alpen-antique.com, this time targeting job seekers (and hence bank accounts) in Australia. We reported it to Yahoo!Website Services the same day. We received an automated response the following day, saying they would investigate. Because nothing had happened and the site (and its email accounts) were still active on 2004-12-02, we filed another abuse report with Yahoo!Website Services. We received a response on 2004-12-04 and this time the site was down, ten days after the spam was reported. Ten days is probably enough time to pull off this job, from recruiting job seekers to wiring stolen money out of the country. On 2004-12-15 we checked again after we heard from a job seeker in the UK and the site was up again. Yahoo.com has allowed criminals to use their service for three weeks after we notified their abuse department of the fact. On 2004-12-17 we received a copy of another job offer spam from alpen-antique.com. The site was still up in early January. When we checked again on 2005-01-20 it had finally been taken down by Yahoo.

Job offer spam: "Alpen-Antique recruitment (Australian highly paid job)"

Received: from adsl-69-153-28-139.dsl.snantx.swbell.net ([69.153.28.139] 
helo=alpen.com)
	by ############### with smtp (Exim 4.43)
	id 1CWrZm-0003Bm-Op
	for ###############; Wed, 24 Nov 2004 08:28:31 +0100
Date: Wed, 24 Nov 2004 07:27:51 +0000
From: "Alpen-Antique recruitment (Australian job opportunities)" <info@alpen.com>
Subject: Alpen-Antique recruitment (Australian highly paid job)
To: "###########" <###########>
References: <4KG64CKAC164A32D@###########>
In-Reply-To: <4KG64CKAC164A32D@###########>
Message-ID: <7J8HDL495LL4BC7G@alpen.com>
Reply-To: "Alpen-Antique recruitment (Australian job opportunities)" <info@alpen.com>
Sender: "Alpen-Antique recruitment (Australian job opportunities)" <info@alpen.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_1IF42326GC74BFKALJ8L3K3_G"
X-MailScanner-SpamCheck: spam, SpamAssassin (score=6.725,
	required 5, BAYES_60 0.37, HDR_ORDER_TRIMRS 2.20, HTML_80_90 0.15,
	HTML_IMAGE_ONLY_04 3.30, HTML_MESSAGE 0.00,
	HTML_MIME_NO_HTML_TAG 0.14, HTML_SHORT_LENGTH 0.39,
	MIME_BOUND_NEXTPART 0.00, MIME_HTML_ONLY 0.18)

------=_NextPart_1IF42326GC74BFKALJ8L3K3_G
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<a href="http://alpen-antique.com/partner.htm"><img src="logo.gif"></a>
<br>


<A href="mailto:job@alpen-antique.com?subject=re"> job@alpen-antique.com</a>


------=_NextPart_1IF42326GC74BFKALJ8L3K3_G
Content-Type: image/gif; name="logo.gif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="logo.gif"
Content-ID:

Job offer spam: "Alpen-Antique is hiring!" (2004-12-17)

Received: from 211.220.54.208 (unknown [211.220.54.208])
by sack.dreamhost.com (Postfix) with ESMTP id 603DD13D8F3
for <x>; Thu, 16 Dec 2004 16:24:18 -0800 (PST)
Received: from unknown (HELO localhost) (127.0.0.1)
    by localhost.eplcuez.com with SMTP; Fri, 17 Dec 2004 00:32:52 +0000
Received: from 3.47.165.14 (3.47.165.14[3.47.165.14])
       by 211.220.54.208 (IMP) with HTTP
       for <x>; Fri, 17 Dec 2004 00:32:52 +0000
Message-ID: <5701________3572@211.220.54.208>
From: "Enoch" <awfouqbmnirihe@bowden.net>
To: "Thomas" <x>
Subject: Alpen-Antique is hiring!
Date: Fri, 17 Dec 2004 00:32:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.2.2
X-Originating-IP: 3.47.165.14

<HTML><html>
<body>
Dear Mr/Mrs,<BR>Alpen-Antique GmbH was founded in 1896 
year and since that time our company successfully participated in antique items 
distribution all over the Europe. After opening our website our goods became 
subject of new customers' interest from all over the world, especially from 
United Kingdom.<BR>We started new campaign selling our goods on-line, but we 
faced new difficulties connected with payment delivery delays to our account, 
because of international wire transfers usual 5 business days delay. A decision 
was made to hire sales representatives capable to receiving payments from the 
same area where are the customers located.<BR>At this moment we run sales 
representatives hiring campaign and are glad to propose you this position. 
Youe welcome to be our representative. Please visit our webpage <A 
href="http://www.alpen-antique.com/partner.htm">www.alpen-antique.com/partner.htm</A> 
describing all aspects of this opportunity and if you're interested - please 
send us an email to <A 
href="mailto:job@alpen-antique.com">job@alpen-antique.com</A>.<BR>Sincere 
regards,<BR>Karl Schallmeiner<BR>Alpen-Antique GmbH
</body>
</html></HTML>

Job application reply:

Greetings,

For further cooperation we ask you to fill up the following form. Your private information will not be transmitted or sold to any companies, parties or persons without your prior permission. This registration form will be processed within a 1-2 days and you’ll be notified as soon as this process is finished.

Please notice, that You are not in any way responsible for our goods’ quality and terms of its’ delivery. As soon as you have filled and sent us the form and was notified about successful registration, you can consider to be employed. It means that You’re obliged to proceed the transaction we’ll make to your account and make the appropriate payments within 24 hours according to the instructions you’ll be sent (with the only exception of weekends and holidays).

Agent form (Alpen-Antique GmbH).

1. Personal information:

Country/State:

City:

Postal address:

Full name:

Age (or DOB):

Home phone number:

Cellular phone number:

Email:

Education:

Work expirience:

Current occupation:

2. Information required for making transactions:

Bank name:

Sort Code:

Account:

Account name:

Please fill this form carefully as you’re fully responsible for the information you’ve submitted to us. Payments will be made to the specified account that’s why all the information and account properties should be provided correctly. You can use either you existing account or open a new one. If you decide to open a new account, please let us know and we’ll be able to wait for the new account information for 10 banking days.

As soon as the form is filled please send it to: job@alpen-antique.com or by fax. If you’re going to send it by fax, please fill it up digitally using your computer, hand written forms won’t be accepted.

Visit our website to get more detailed information about our company and this job opportunity at http://www.alpen-antique.com/partner.htm.

Best regards,

Karl Schallmeiner,

Alpen-Antique GmbH.

Here are the email headers:

Return-Path: <job@alpen-antique.com>
Received: from web208.biz.mail.re2.yahoo.com (web208.biz.mail.re2.yahoo.com
 [68.142.224.170])
	by smtpin06l.############## (Postfix) with SMTP id 6732A16C6CC
	for <emailaddress>; Mon, 20 Dec 2004 10:38:59 +0000 (GMT)
Received: from [68.108.28.188] by web208.biz.mail.re2.yahoo.com via HTTP;
 Mon, 20 Dec 2004 02:38:53 PST
Message-ID: <20041220103853.72373.qmail@web208.biz.mail.re2.yahoo.com>
Date: Mon, 20 Dec 2004 02:38:53 -0800 (PST)
From: Alpen-Antique GmbH <job@alpen-antique.com>
Subject: Application Form.
To: username <emailaddress>

As you can see, this email from the fake "Karl Schallmeiner" was sent from IP 68.108.28.188 (ip68-108-28-188.lv.lv.cox.net) which belongs to Cox, a US broadband provider:

     OrgName:    Cox Communications Inc. 
     OrgID:      CXA
     Address:    1400 Lake Hearn Drive
     City:       Atlanta
     StateProv:  GA
     PostalCode: 30319
     Country:    US
     
     NetRange:   68.108.0.0 - 68.108.127.255 
     CIDR:       68.108.0.0/17 
     NetName:    NETBLK-LV-RDC-68-108-0-0
     NetHandle:  NET-68-108-0-0-1
     Parent:     NET-68-96-0-0-1
     NetType:    Reassigned
     Comment:    
     RegDate:    2002-12-09
     Updated:    2003-02-07
     
     OrgAbuseHandle: IC146-ARIN
     OrgAbuseName:   Cox Communications, Inc 
     OrgAbusePhone:  +1-404-269-7626
     OrgAbuseEmail:  abuse@cox.net
     
     OrgTechHandle: WILLI-ARIN
     OrgTechName:   Williams, Matt 
     OrgTechPhone:  +1-404-269-7626
     OrgTechEmail:  matt.williams@cox.com

WHOIS record for alpenantique.com
We presume the contact information for the domain was fake.

connected to whois.enom.com [66.151.151.170:43] ... 

Registration Service Provided By: Jaguar Technologies LLC
Contact: sales@jaguarpc.com
Visit: 
	
Domain name: alpenantique.com

Registrant Contact:
   no
   Dennis Surette (perhamarchi@yahoo.com)
   +1.2033599278
   Fax: +1.
   870 Stafford Rd
   Storrs, CT 06268
   US

Administrative Contact:
   no
   Dennis Surette (perhamarchi@yahoo.com)
   +1.2033599278
   Fax: +1.
   870 Stafford Rd
   Storrs, CT 06268
   US

Technical Contact:
   no
   Dennis Surette (perhamarchi@yahoo.com)
   +1.2033599278
   Fax: +1.
   870 Stafford Rd
   Storrs, CT 06268
   US

Billing Contact:
   no
   Dennis Surette (perhamarchi@yahoo.com)
   +1.2033599278
   Fax: +1.
   870 Stafford Rd
   Storrs, CT 06268
   US

Status: Locked

Name Servers:
   yns1.yahoo.com
   yns2.yahoo.com
   
Creation date: 21 Oct 2004 10:46:13
Expiration date: 21 Oct 2009 10:46:13

WHOIS info for alpen-antique.com

Request: alpen-antique.com
connected to whois.crsnic.net [198.41.3.54:43] ... 
connected to whois.enom.com [66.151.151.170:43] ... 

Registration Service Provided By: Jaguar Technologies LLC
Contact: sales@jaguarpc.com
Visit: 
	
Domain name: alpen-antique.com

Registrant Contact:
   Alpen Antique Gmbh
   Kelly Cosmas (byung5577@yahoo.com)
   +1.4088300649
   Fax: +1.
   159 Charles Street
   Sunnyvale, Ca 94086
   US

Administrative Contact:
   Alpen Antique Gmbh
   Kelly Cosmas (byung5577@yahoo.com)
   +1.4088300649
   Fax: +1.
   159 Charles Street
   Sunnyvale, Ca 94086
   US

Technical Contact:
   Alpen Antique Gmbh
   Kelly Cosmas (byung5577@yahoo.com)
   +1.4088300649
   Fax: +1.
   159 Charles Street
   Sunnyvale, Ca 94086
   US

Billing Contact:
   Alpen Antique Gmbh
   Kelly Cosmas (byung5577@yahoo.com)
   +1.4088300649
   Fax: +1.
   159 Charles Street
   Sunnyvale, Ca 94086
   US

Status: Locked

Name Servers:
   yns1.yahoo.com
   yns2.yahoo.com
   
Creation date: 20 Nov 2004 17:23:25
Expiration date: 20 Nov 2005 17:23:25

Information about the earlier "Plasma Project" job scam
(Found on the spamwatch.codefish.net.au site, which no longer exists)

Exact Link: http://www.plasmaproject.com/plasmajob.htm
Email's Originating Network: Multiple
Danger Level: Medium

Description

Looks like the recruitment drive just keeps on going and as per usual there's a job scam from a Plasma TV company. Just wouldn't be the same without one would it? This email was reported to us last night as well as being posted in the forum. It's a simple HTML email that reads:

Subject: Business offer

Attention
This is not a SPAM message your email address was provided by 3rd party.s
website www.jobs-in-europe.net in response to our request, because you or
some other person subscribed to .job offers. in marketing/sales relating
business using this email.ecw

Hello
Plasma Project is one of the leading companies selling plasma TV-sets
on-line and currently we plan to expand our marketing outlets and find new
customers from new countries.
As a result of our decision we have opened new positions of financial
managers and have got a special proposal for you, it is a unique
possibility to earn some money at home. You can work as financial manager
and you are not required be skilled in this type of sales/marketing
business. The only and critical requirements for you are honesty and
responsibility.

Actually you will be our representative and a middleman between us and our
customers from your country. Because of our company.s anti-fraud policy,
we accept bank transfers only, but a lot of our customers are dissatisfied
with the term of delivery. International transfers usually take up to 3-5
days. We have found a solution for solving this problem. A lot of well
known and respected companies use similar solutions to expedite the
process of payment. We have established a spread network of agents in all
the countries, so that our customers could make the payments to our
agent.s account which is from the same country. This type of payment
diminishes the term of delivery twice helping us to become even more
popular all over the world.

Agents work consists of receiving payment from customers and making
further payments to our main office or to one of our regional affiliate
departments, depending on the customer.s location. Agent.s commission is
5% from each transaction sent to appropriate account. All transfer and
further money transfer related charges are also covered and paid by our
company.

What are our major benefits?
1. You.re not required to be experienced in some special field of knowledge.
2. You can start working and earning within a week after you.ve submitted
an agent form to us.
3. You.re not required to prepay something, or pay something beforehand at
all.
4. You won't have to spend a lot of time with this business. It may take
just several hours per week, but it will be well paid.

Agents. vacancies are limited.
Don.t loose your chance.
Send us a message to job@PlasmaProject.com and we will send you our agent
form back. If you have any additional questions - don.t hesitate to
contact us at info@PlasmaProject.com and we.ll try to help you for sure.

Thanks for your attention and taking your time reading our proposal.
www.plasmaproject.com/plasmajob.htm

Sincerely yours,
Thomas Bradshaw,
Plasma Project company.

So it's the standard mule recruitment drive. For those who haven't seen one before the aim is that the "company" hires you to make these supposed bank transfers for them. What you are actually used for is to transfer money from exploited bank accounts offshore for the. Essentially laundering the cash for them.

What happens is you get hired by them. The scammers then withdraw a lot of cash (usually a couple of thousand) from another bank account usually with the same bank as you and transfer it to your account. The account money was transferred from was in fact an exploited bank account that phishers have gained access to via either keylogging trojans or tradational phishing emails.

Once you have the money in your account you are usually then asked to withdraw it in cash and wire it via a method such as Western Union to another country. Minus your "wage" of course. Once the money is traced you, the mule, will not be allowed to keep the "wages" you accumalted through this "job". If you suspect you are currently a mule in this scam contact your bank and the police directly. They will understand the situation and help you out. Far better than potentially being charged with fraud when the money is traced.

In this particular case the linked "job" offer at:

http://www.plasmaproject.com/plasmajob.htm

Is a rather lenghty page that says:

Get a job with Plasma Project, Inc!
Plasma Project, Inc. is one of the leading companies selling plasma devices in America, and currently we strive for expanding our retail markets to brand new countries in the Europe, Asia, Australia and Oceania. As a result of our decision we have opened some new positions of financial managers and have got a special proposal for you, it is a unique possibility to earn some money at home. You can work as financial manager and you are not required be skilled in this type of sales/marketing business. The only and critical requirements for you are honesty and responsibility. Actually you will be our representative and a middleman between us and our customers from your country. Because of our company’s anti-fraud policy, we accept bank transfers only, but a lot of our customers are dissatisfied with the term of delivery. International transfers usually take up to 3-5 days. We have found a solution for solving this problem. A lot of well known and respected companies use similar solutions to expedite the process of payment. We have established a spread network of agents in all the countries, so that our customers could make the payments to our agent’s account which is from the same country. This type of payment diminishes the term of delivery twice helping us to become even more popular all over the world.

Agent’s work consists of receiving payment from customers and making further payments to our main office or to one of our regional affiliate departments, depending on the customer’s location. Agent’s commission is 5% from each transaction sent to appropriate account. All transfer and further money transfer related charges are also covered and paid by our company.
What are our major benefits?

1. You’re not required to be experienced in some special field of knowledge.
2. You can start working and earning within a week after you’ve submitted an agent form to us.
3. You’re not required to prepay something, or pay something beforehand at all.
4. You won’t have to spend a lot of time with this business. It may take just several hours per week, but it will be well paid.

How can I get a job?

1. Send us an email to job@plasmaproject.com and we’ll send you agent from.
2. Fill up that form and send it back to us to job@plasmaproject.com or by fax.
3. Your form will be processed within a week by our managers (we will verify your background information, criminal, financial reports, credit history calling to the appropriate institution from your country).
4. You’ll receive a confirmation message with positive or negative reply (we reserve rights to decline you candidature without any explanations). In case of positive reply you should also get detailed further instructions.
5. After a week of evaluation period we’ll send you all the required information about your job, some additional information about our company and our goods.

Career possibilities:

If you succeed to get a job at Plasma Project, Inc. you should know that we plan to open an official affiliate office in your country. It completely depends on the sales rates, but even if sales are not enough to match limits of official affiliate office, you’ll be able to work as a financial manger, depending on you desire and ability to work with us. You’ll find all the information about our products and company in the documents we’ll send you, including presentations and seminar records. Thus you’ll get a change to increase your commission % finding new customers, because we’ll pay you 7.5% per each sale to the customer you find.

What are our payment methods?

As a financial manager you’ll be able to get 5% commission per each payment you received to your account. Your commission is counted of the total amount of transaction (including shipping and delivery costs). For example if we sell a TV-set for 3000USD and the delivery charges are 300USD, you should receive 3300USD payment (converted to your local currency with current exchange rates), it means that your commission is 165 USD. The rest of sum you should send following our instruction we’ll send you after payment was sent to your account. All other transfer charges are fully covered by our company.

Should I pay any taxes from my commission?

You shouldn’t pay anything from those transactions we’ll send to your account. Plasma Project, Inc. covers all the possible taxes, fees and charges, because we are the final distributors. Plasma Project, Inc. is an official and legitimate company making all the required financial reports and book-keeping related paperwork. When you receive the payment you’re not required to mention your 5% commission anywhere. We check all the legislation details of the countries we operate in, avoiding all possible misunderstandings. Please keep all the bills and checks confirming that you send us the money.

Currently following vacancies are available:

Europe:
United Kingdom – 3 positions
Belgium – 2 positions
Germany – 1 position
Switzerland – 1 position
Italy - 3 position
Greece - 2 position
Cyprus - 1 position

North and South America:
Canada – 2 position
Venezuela – 1 position

Asia:
Sri-Lanka – 2 positions
Nepal -2 positions
Hong-Kong – 2 positions

Australia and Oceania:
Australia – 2 positions
New Zealand – 2 positions
Philippines – 1 position

We use services of job agencies and sometimes they send our proposals not only to those countries we are looking for, if your country is not in the list, but you’re interested in our proposal, please send us a message to job@plasmaproject.com and will reply you for sure. We are really sorry if this message caused your any inconveniences. If you do not wish to receive any sales/marketing job offers, please contact the agency, specifying your email, to me removed from the subscribers’ list. Thanks again for the attention and taking time reading our proposal.

Respectfully yours,
Greg John Whittle,
Chief Executive Officer,
Plasma Project, Inc.

So there you can see the scam in motion. As you can tell the money you could make from this "job" is way to good to be true and as the old saying goes that because it is. As we stated before you will not be allowed to keep the money you accrue from this "job" once the banks trace the stolen cash.

This "Plasma Project" website is in fact a direct rip off of a real Plasma TV website located in the UK called Plasma Point. Please note this site does not have anything to do with the scam.

Likewise the site jobs-in-europe.net appears to be a legitimate European job site once again not part of the scam in any way.

The fake site is currently be hosted by a US hosting server is is very ublikely to know they are hosting a fake job site. Hopefully they will be informed soon and take the site down.

WHOIS details for "plasmaproject.com" (created 2004-08-21):

Request: plasmaproject.com
connected to whois.enom.com [66.151.151.170:43] ... 

Registration Service Provided By: Jaguar Technologies LLC
Contact: sales@jaguarpc.com
Visit: 
	
Domain name: plasmaproject.com

Registrant Contact:
   gfsdfg
   August Schultz (august45366@yahoo.com)
   +1.5084728493
   Fax: +1.
   PO Box 612
   Wrangell, AK 99929
   US

Administrative Contact:
   gfsdfg
   August Schultz (august45366@yahoo.com)
   +1.5084728493
   Fax: +1.
   PO Box 612
   Wrangell, AK 99929
   US

Technical Contact:
   gfsdfg
   August Schultz (august45366@yahoo.com)
   +1.5084728493
   Fax: +1.
   PO Box 612
   Wrangell, AK 99929
   US

Billing Contact:
   gfsdfg
   August Schultz (august45366@yahoo.com)
   +1.5084728493
   Fax: +1.
   PO Box 612
   Wrangell, AK 99929
   US

Status: Locked

Name Servers:
   NS1.WEST-DATACENTER.NET
   NS2.WEST-DATACENTER.NET
   
Creation date: 29 Aug 2004 13:02:12
Expiration date: 29 Aug 2006 13:02:12

Linkus LTD Barnaul / 24hourpills.org

This scam in April 2005 is a re-run of the "Plasma Project" fraud in September 2004 which it mentions by mistake.

If you have exchanged emails with this fake "company", contact us. Warn your bank that stolen funds may arrive in your bank account. Do not withdraw any funds that may arrive in your account. Do not make any Western Union transfers to the criminals. Report this case to the police where you live.

Get a job with Linkus LTD Barnaul.
Linkus LTD, is one of the leading companies selling medicine tea in all 
over the world, and currently we strive for expanding our retail markets to 
brand new countries in the Europe, Asia, Australia and Oceania. As a result 
of our decision we have opened some new positions of financial managers and 
have got a special proposal for you, it is a unique possibility to earn some 
money at home. You can work as financial manager and you are not required be 
skilled in this type of sales/marketing business. The only and critical 
requirements for you are honesty and responsibility. Actually you will be 
our representative and a middleman between us and our customers from your 
country. Because of our company's anti-fraud policy, we accept bank 
transfers only, but a lot of our customers are dissatisfied with the term of 
delivery. International transfers usually take up to 3-5 days. We have found 
a solution for solving this problem. A lot of well known and respected 
companies use similar solutions to expedite the process of payment. We have 
established a spread network of agents in all the countries, so that our 
customers could make the payments to our agent's account which is from the 
same country. This type of payment diminishes the term of delivery twice 
helping us to become even more popular all over the world.

Agent's work consists of receiving payment from customers and making further 
payments to our main office or to one of our regional affiliate departments, 
depending on the customer's location. Agent's commission is 5% from each 
transaction sent to appropriate account. All transfer and further money 
transfer related charges are also covered and paid by our company.
What are our major benefits?

1. You're not required to be experienced in some special field of knowledge.
2. You can start working and earning within a week after you've submitted an 
agent form to us.
3. You're not required to prepay something, or pay something beforehand at 
all.
4. You won't have to spend a lot of time with this business. It may take 
just several hours per week, but it will be well paid.

How can I get a job?

1. Send us an email to job@24hourpills.org and we'll send you agent from.
2. Fill up that form and send it back to us to job@24hourpills.org or by 
fax.
3. Your form will be processed within a week by our managers (we will verify 
your background information, criminal, financial reports, credit history 
calling to the appropriate institution from your country).
4. You'll receive a confirmation message with positive or negative reply (we 
reserve rights to decline you candidature without any explanations). In case 
of positive reply you should also get detailed further instructions.
5. After a week of evaluation period we'll send you all the required 
information about your job, some additional information about our company 
and our goods.

Career possibilities:

If you succeed to get a job at Linkus LTD, you should know that we plan to 
open an official affiliate office in your country. It completely depends on 
the sales rates, but even if sales are not enough to match limits of 
official affiliate office, you'll be able to work as a financial manger, 
depending on you desire and ability to work with us. You'll find all the 
information about our products and company in the documents we'll send you, 
including presentations and seminar records. Thus you'll get a change to 
increase your commission % finding new customers, because we'll pay you 7.5% 
per each sale to the customer you find.

What are our payment methods?

As a financial manager you'll be able to get 5% commission per each payment 
you received to your account. Your commission is counted of the total amount 
of transaction (including shipping and delivery costs). For example if we 
sell medicine tea or healthy drinks for 3000USD and the delivery charges are 
300USD, you should receive 3300USD payment (converted to your local currency 
with current exchange rates), it means that your commission is 165 USD. The 
rest of sum you should send following our instruction we'll send you after 
payment was sent to your account. All other transfer charges are fully 
covered by our company.

Should I pay any taxes from my commission?

You shouldn't pay anything from those transactions we'll send to your 
account. Plasma Project, Inc. covers all the possible taxes, fees and 
charges, because we are the final distributors. Plasma Project, Inc. is an 
official and legitimate company making all the required financial reports 
and book-keeping related paperwork. When you receive the payment you're not 
required to mention your 5% commission anywhere. We check all the 
legislation details of the countries we operate in, avoiding all possible 
misunderstandings. Please keep all the bills and checks confirming that you 
send us the money.

Currently following vacancies are available:

Europe:
United Kingdom 10 positions
Belgium 2 positions
Germany 5 position
France - 5 position
Switzerland 5 position
Italy - 3 position
Greece - 2 position


North and South America:
Canada 4 position


Asia:
Sri-Lanka 2 positions
Nepal -2 positions
Hong-Kong 2 positions
Singapur - 4 positions
Malazia - 4 pisitions
Arab Emirates - 5 positions

Australia and Oceania:
Australia 4 positions
New Zealand 3 positions
Philippines 5 position
Arab Emirates - 5 positions

We use services of job agencies and sometimes they send our proposals not 
only to those countries we are looking for, if your country is not in the 
list, but you're interested in our proposal, please send us a message to 
job@24hourpills.org and will reply you for sure. We are really sorry if this 
message caused your any inconveniences. If you do not wish to receive any 
sales/marketing job offers, please contact the agency, specifying your 
email, to me removed from the subscribers' list.

Thanks again for the attention and taking time reading our proposal.
http://www.24hourpills.org/vacancies.htm

Respectfully yours,
Brian Whittle,
Chief Executive Officer,
Linkus LTD Barnaul.

Anti-Spam Resources:
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)

Clueless virus filters spam innocent third parties
Challenge and Response spam filters: A selfish idea for selfish times

ShareYourExperiences.com spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information

Link exchange offer spam
Getting creative with spam
Link exchange spam: allcarpictures.com

Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)

"Joe job" against joewein.de
Porn spam: watchsound.com
Porn spam: hotsalza.com
Name servers used by spammers: joker.com
Rogue name servers: mediadreamland.com
Rogue name servers: airmaramba.biz
Rogue name servers: bonafidecash.com
Rogue name servers: maileasy.biz

Browser hijacking: heretofind.com

Computer Viruses