workingmoneys.com scam

Another "money making" scam.... from the same people that brought you this one

Various Message Headers:

Subject: 100% FREE Subject: 65in 30 minutes! Don't belive me? I'll tell how! Subject: Best job for You Subject: Copy + Paste = $13,000 a month Subject: Dreaming about your own car? Get 800in 14 days! Subject: Ex-cleaner gets 430every hour! Subject: Have you seen this yet? Subject: I heard you liked easy extra money? Not everyone is going to win Subject: Income from $10000 monthly! Looking for partners! Subject: Need flat refreshing but salary is problem for you? Aditional Subject: Need money but without of credit? Income 430weekly! Subject: Need money for good holiday? Earn 300every day! Subject: Need money? It's time to make big money! Subject: Overnight millionaire... Subject: Start earning 500daily and your life will change! Subject: You can buy new car after 2.5 months! Income from 3200$!

Message Body:

I don't know any other way to make easy and simple commissions like this. Go ahead and you will see what I mean: www.workingmoneys.com

Whois information for the domain:

Domain name: workingmoneys.com Registry Domain ID: 1894237454_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.bizcn.com Registrar URL: http://www.bizcn.com Updated Date: 2015-01-05T19:25:41Z Creation Date: 2015-01-05T19:25:40Z Registrar Registration Expiration Date: 2016-01-05T19:25:40Z Registrar: Bizcn.com,Inc. Registrar IANA ID: 471 Registrar Abuse Contact Email: abuse@bizcn.com Registrar Abuse Contact Phone: +86.5922577888 Reseller: Cnobin Technology HK Limited Domain Status: clientDeleteProhibited Domain Status: clientTransferProhibited Registry Registrant ID: Registrant Name: Brad Gladney Registrant Organization: Brad I. Gladney Registrant Street: 4003 Kidd Avenue Registrant City: Juneau Registrant State/Province: AK Registrant Postal Code: 99801 Registrant Country: us Registrant Phone: +1.9077800213 Registrant Phone Ext: Registrant Fax: +1.9077800213

Here's the website you get... lovely...

Think I'll stay away from this one...

Cheers,

Steve
Sanesecurity.com

May we have a little talk? dating scam

"May we have a little talk?" -  another dating scam just started a spam run... pretty much the same forum types links as reported on the blog earlier.

Message Headers:

From: "Rosetta" {mohammedbestmileug@telefonica.net} Subject: May we have a little talk? Date: Mon, 05 Jan 2015 13:30:44 +0200

Example Message Body, with slight variations on the Name...

Dear Sir! You have got 50 invitations to have possible Chat tonight. Please, check Fanny's message here: [ Open in browser ] Best wishes, personal manager Rosetta

The above message links to various websites that run a forum... and point to a direct post:

http://www.theoddfellowslounge.com/forums/showthread.php?7408-I-live-in-Moscow&p=37994

An example forum post:

Hi everyone! My name is Elena, I live in Moscow (Russia) and have a dream like many other girls – I want to find my love and live a wonderful life together! This is not the only my interest, but for now it has become a priority.

Interestingly, when I looked a one forum post... it showed people are looking at the scams,
let's hope they aren't actually falling for them:

988 people clicked on one link, in one version of email in the space of 3 hours

Cheers,

Steve
Sanesecurity.com

workmoneys.com scam

Another "money making" scam.... workmoneys.com

Various Message Headers:

Subject: 100% FREE Subject: Best job for You Subject: Copy + Paste = $13,000 a month Subject: Have you seen this yet?

Message Body:

You can be earning commissions like that by the end of today with this: Follow instructions on next page: www.workmoneys.com

Whois information for the domain:

Domain name: workmoneys.com Registry Domain ID: 1893952897_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.bizcn.com Registrar URL: http://www.bizcn.com Updated Date: 2015-01-03T19:45:49Z Creation Date: 2015-01-03T19:45:50Z Registrar Registration Expiration Date: 2016-01-03T19:45:50Z Registrar: Bizcn.com,Inc. Registrar IANA ID: 471 Registrar Abuse Contact Email: abuse@bizcn.com Registrar Abuse Contact Phone: +86.5922577888 Reseller: Cnobin Technology HK Limited Domain Status: clientDeleteProhibited Domain Status: clientTransferProhibited Registry Registrant ID: Registrant Name: Audrey Chambers Registrant Organization: Audrey P. Chambers Registrant Street: 15 Rollins Road Registrant City: Chapman Registrant State/Province: NE Registrant Postal Code: 68827 Registrant Country: us Registrant Phone: +1.3089869256 Registrant Phone Ext:

Here's the website you get... lovely...

Think I'll stay away from this one...

Cheers,

Steve
Sanesecurity.com

Voice Message - Voice redirected message - offroadshop.sk/dropbox/invoice1 - malware going nowhere

Bit odd this one...

Message Headers:

From: "Message Admin" {admin@dropibox.com} Subject: Voice Message

Note the dropibox.com domain... not to become confused with dropbox.com 


Message Body:

Voice redirected message http://offroadshop.sk/dropbox/invoice1 Sent: Mon, 5 Jan 2015 08:47:01 +0000

The above link however is the same link they've been using for a while now and it's been removed:

Not Found The requested URL /dropbox/invoice1 was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

So, it's still being spammed out... but going nowhere :)

Cheers,

Steve
Sanesecurity.com

Elena 25y.o, new message for you dating scam

Elena 25y.o, new message for you, another dating scam just started pretty much the same forum types
links as reported on the blog earlier.

Message Headers:

From: "Elena" {bsfdRagbkzy@ridsa.com.ar} Subject: Elena 25y.o, new message for you Date: Sun, 04 Jan 2015 15:39:57 -0300

Message Body:

Happy New Year to You!!! My best wishes to you! I am Elena, 25 y.o, I am looking for man to have a strong family. And you? I am on-line now, let's chat? my profile and new photos are here.

The above message links to various websites that run a forum... and point to a direct post:

http://punbb.surl-php5.test.web.informer.com/viewtopic.php?pid=105814#p105814

An example forum post:

Hi everyone! My name is Elena, I live in Moscow (Russia) and have a dream like many other girls – I want to find my love and live a wonderful life together! This is not the only my interest, but for now it has become a priority.

Cheers,

Steve
Sanesecurity.com