Wednesday, May 15, 2013

Fake Email: Career Boost - Rent One Square Meter of Your Garage


This one missed the spam filters. I'm posting this to benefit others because a family member asked if this was legit.  Before we post the analysis, check out the email with formatting included:
---------- Forwarded message ----------
From: <manthonygarland@northstaffing.com>
Date: 
Subject: New Career Boost – Apply Today
To: <spam recipient>
Cc:  HAVE A GOOD DAY <spam recipient> !
Garland offers logistics services which are created in conjunction with clients to meet their needs.

Garland suggests solutions in how we provide our consumers\buyers logistics at either our premises or at those of our buyers.

We can diminish expenses for Warehousing | Personnel | Distribution by:
    altering costs from fixed to variable.
    contracting out gives motivation for quality.
    makes our buyers to concentrate on core activities and sales amount.
    scale effect.
    lessening of administration prices.

Garland has invested heavily to render a upscale service.
It has created its own solution which allow customers receive more benefit throughout the logistics process.


GARLAND, Would like to offer You an opportunity to RENT only ONE square meter of Your garage
or home space to accomplish following logistics activities for our company:

    Arrival of luggage
    Stock entry
    Stock control
    Distribution If You are ready for transporting max 160 lbs - Please contact us as soon as possible
    Tracking and tracing

Our company can offer You 145dollars payment for each week of 1 square meter rent.
If You are able to carry more space, please reply back immediately.
We have profitable premiums for beneficial employees.

In our stocks Garland can make the following operations:

    Pick and Pack – Receiving, Checking, Separation, Labeling, Packing and Postage.
    Warehousing – Checking, Packing and Storage.
    Preparation of Orders – Labeling, Packing and Distribution.
    Stock Control - Email notifications.
    Statistics - Statistical information if demanded.

Garland, a Portuguese independent company has serious experience in the Logistics of Fashion, Literature, HiTech, Drilling Equipment & Tires.
Why not hear more about our entire assortment of services and contact us?
Reply back with Your resume immediately and we will rent even Your roof space!
Have a blessed day!
Analysis

Disclaimer:  I am not responsible for any consequences if readers decide to visit the IP addresses or websites mentioned in this report.

Interestingly, there's just enough ambiguous language present to make it past the spam filters.  Also, there are no links to any websites encouraging a click-through, so this isn't necessarily a phishing email.  The errors in spelling and word usage are underlined above, which aside from the formatting, are clear indicators this is not a professional email.


Now let's check out the only potential source indicator, the email address.  According to domaintools.com, northstaffing.com the website was re-registered May 11, 2013 but the specific details are "privacy protected".  The nameservers point us to ns1.hostven11.ru and ns2.hostven11.ru.  Russian nameservers, huh?  That makes me feel safe and that the email is trustworthy.  After all, I'm sure most Portuguese companies have their websites handled through Russian registrars.


Next, I decided to do an nslookup on the domain, which gives me an IP address of 84.2.39.106.  According to Blue Coat's Site Review, the IP is categorized as "Government/Legal".  McAfee's Threat Intelligence reports the IP as "Unverified", but flags the IP as being geo-located in Hungary.  There's a correlation for the .ru nameservers.  If you send an HTTP request to the IP address by itself it's obvious it's a shared hosting server.

And finally, visiting northstaffing.com shows an empty directory as the index page.

Conclusion

This email is obviously fake, but it's interesting in that it's not what I expected, which is a malware delivery attempt.  Instead, it appears to offer the promise of semi-legitimacy.  The relative did not pursue things further, but I wonder what would've happened.  A colleague told me that there was a news story a while back where someone rented out their garage in such a manner and ended up getting arrested for drug trafficking.

The moral of the story is never believe an email from someone you don't know!