Message:
Good day!
We considered your resume to be very attractive and we thought the vacant position in our company could be interesting for you.
We cooperate with different countries and currently we have many clients in the world.
Part-time and full-time employment are both currently important.
We offer a flat wage from $1500 up to $5000 per month.
The job offers a good salary so, interested candidates please registration on the our site: www DOT thinkedmoney DOT com
Attention! Accept applications only on this and next week.
Respectively submitted
Personnel department
The domain name details:
Or... maybe not.
Domain Name: THINKEDMONEY.COM Registrar: BIZCN.COM, INC. Whois Server: whois.bizcn.com Referral URL: http://www.bizcn.com Name Server: NS1.AGERMAINVA.NET Name Server: NS2.AGERMAINVA.NET Updated Date: 29-dec-2014 Creation Date: 29-dec-2014Registrant Name: Madeline Goode Organization: Madeline T. Goode Street: 4824 Pheasant Ridge Road City: Philadelphia State/Province: PA Postal Code: 19126 Country: us Phone: +1.2155496172 Phone Ext: Fax: +1.2155496172 Fax Ext: Email: info@thinkedmoney.com
Cheers,
Steve
Sanesecurity.com
3 comments:
How do I stop this from being sent to my email? They are using a mask so that it appears as if I am the sender, so I can't add to spam. I've changed passwords, deleted myself from my contacts and white lists... I'm getting three or four of these a day... HELP!
Hi Ben,
Depends on what email client you are using... if it's Outlook/Thunderbird you can setup a message rule or mark as junk. Google mail also have message filters too... https://support.google.com/mail/answer/6579?hl=en
Cheers,
Steve
Yes - have received hundreds of these 'Scam emails' in relation to Job Scams in the past week - around four domains - moneyproff.com, thinkedmoney.com, clickmoneys.com & binarysmoney.com.
The secret to knocking out this spammer seems to lie in getting in bowling the ns1.agermainva.net IP with upline service providers.
DNS lookups suggest IP #'s 192.249.78.42 & 50.2.193.124
& those service providers behind them.
My files suggest a similar if not the same scammer has done this sort of thing with a similar MO around the same time in both 2012 & 2013 years & this is the third year running they have tried this
Post a Comment