Wednesday, May 15, 2013
Labels:
spam
This one missed the spam filters. I'm posting this to benefit others because a family member asked if this was legit. Before we post the analysis, check out the email with formatting included:
Disclaimer: I am not responsible for any consequences if readers decide to visit the IP addresses or websites mentioned in this report.
Interestingly, there's just enough ambiguous language present to make it past the spam filters. Also, there are no links to any websites encouraging a click-through, so this isn't necessarily a phishing email. The errors in spelling and word usage are underlined above, which aside from the formatting, are clear indicators this is not a professional email.
Now let's check out the only potential source indicator, the email address. According to domaintools.com, northstaffing.com the website was re-registered May 11, 2013 but the specific details are "privacy protected". The nameservers point us to ns1.hostven11.ru and ns2.hostven11.ru. Russian nameservers, huh? That makes me feel safe and that the email is trustworthy. After all, I'm sure most Portuguese companies have their websites handled through Russian registrars.
Fake Email: Career Boost - Rent One Square Meter of Your Garage
---------- Forwarded message ----------Analysis
From: <manthonygarland@northstaffing.com>
Date:
Subject: New Career Boost – Apply Today
To: <spam recipient>
Cc: HAVE A GOOD DAY <spam recipient> !
Garland offers logistics services which are created in conjunction with clients to meet their needs.
Garland suggests solutions in how we provide our consumers\buyers logistics at either our premises or at those of our buyers.
We can diminish expenses for Warehousing | Personnel | Distribution by:
altering costs from fixed to variable.
contracting out gives motivation for quality.
makes our buyers to concentrate on core activities and sales amount.
scale effect.
lessening of administration prices.
Garland has invested heavily to render a upscale service.
It has created its own solution which allow customers receive more benefit throughout the logistics process.
GARLAND, Would like to offer You an opportunity to RENT only ONE square meter of Your garage
or home space to accomplish following logistics activities for our company:
Arrival of luggage
Stock entry
Stock control
Distribution If You are ready for transporting max 160 lbs - Please contact us as soon as possible
Tracking and tracing
Our company can offer You 145dollars payment for each week of 1 square meter rent.
If You are able to carry more space, please reply back immediately.
We have profitable premiums for beneficial employees.
In our stocks Garland can make the following operations:
Pick and Pack – Receiving, Checking, Separation, Labeling, Packing and Postage.
Warehousing – Checking, Packing and Storage.
Preparation of Orders – Labeling, Packing and Distribution.
Stock Control - Email notifications.
Statistics - Statistical information if demanded.
Garland, a Portuguese independent company has serious experience in the Logistics of Fashion, Literature, HiTech, Drilling Equipment & Tires.
Why not hear more about our entire assortment of services and contact us?
Reply back with Your resume immediately and we will rent even Your roof space!
Have a blessed day!
Disclaimer: I am not responsible for any consequences if readers decide to visit the IP addresses or websites mentioned in this report.
Interestingly, there's just enough ambiguous language present to make it past the spam filters. Also, there are no links to any websites encouraging a click-through, so this isn't necessarily a phishing email. The errors in spelling and word usage are underlined above, which aside from the formatting, are clear indicators this is not a professional email.
Now let's check out the only potential source indicator, the email address. According to domaintools.com, northstaffing.com the website was re-registered May 11, 2013 but the specific details are "privacy protected". The nameservers point us to ns1.hostven11.ru and ns2.hostven11.ru. Russian nameservers, huh? That makes me feel safe and that the email is trustworthy. After all, I'm sure most Portuguese companies have their websites handled through Russian registrars.
Next, I decided to do an nslookup on the domain, which gives me an IP address of 84.2.39.106. According to Blue Coat's Site Review, the IP is categorized as "Government/Legal". McAfee's Threat Intelligence reports the IP as "Unverified", but flags the IP as being geo-located in Hungary. There's a correlation for the .ru nameservers. If you send an HTTP request to the IP address by itself it's obvious it's a shared hosting server.
And finally, visiting northstaffing.com shows an empty directory as the index page.
Conclusion
This email is obviously fake, but it's interesting in that it's not what I expected, which is a malware delivery attempt. Instead, it appears to offer the promise of semi-legitimacy. The relative did not pursue things further, but I wonder what would've happened. A colleague told me that there was a news story a while back where someone rented out their garage in such a manner and ended up getting arrested for drug trafficking.
The moral of the story is never believe an email from someone you don't know!
Subscribe to:
Post Comments
(
Atom
)
Hello,
ReplyDeleteI received almost the same exact message and actually responded to someone named Anthony Marco - supposedly from a company named "Garland"
> On 5/13/2013 3:09 PM, hr_garland@careermailhost.in wrote:
> > HAVE A GOOD DAY Paul Stevens !
> > Garland renders logistics services which are created in cooperation with clients to serve their needs.
> >
> > Garland suggests decisions whereby we control our clients logistics at either our premises or at those of our buyers.
> >
> > We can curtail prices for Warehousing | Personnel | Distribution by:
> > altering costs from unchangeable to variable.
> > Outsourcing gives incentive for quality.
> > Enables our customers to focus on principal activities and sales revenue.
> > economies of mass production.
> > lessening of administration costs.
> >
> > Garland has invested heavily to manage a high-quality service.
> > It has created its own solution which allow customers receive more benefit throughout the logistics process.
> >
> >
> > GARLAND, Would like to propose You an opportunity to RENT only 1 m2 of Your garage
> > or home space to provide following logistics activities for our company:
> >
> > Arrival of goods
> > Stock entry
> > Stock disposal
> > Distribution If You can for transporting max 160 lbs - Please contact us as soon as possible
> > Tracking and tracing
> >
> > Our company is agree to offer You 145dollars paying per week of 1 square meter rent.
> > If You are able to carry more space, please reply back immediately.
> > We have beneficial premiums for profitable employees.
> >
> > In our storerooms Garland can fulfil the following activities:
> >
> > Pick and Pack – Receiving, Checking, Separation, Labeling, Packing and Postage.
> > Warehousing – Checking, Packing and Storage.
> > Preparation of Orders – Labeling, Packing and Distribution.
> > Stock Control - Email notifications.
> > Statistics - Statistical information as requested by clients.
> >
> > Garland, a Portuguese independent company has serious experience in the Logistics of Fashion, Literature, HiTech, Drilling Equipment & Tires.
> > Why not hear more about our complete line of services and contact us?
> > address us with Your resume as soon as possible and we will rent even Your roof space!
> > Have a blessed day!
>
>
>
Hi Paul,
ReplyDeleteThanks for the response!
This supports my assumption that the email is fake, if not proving it. I decided to take a peek at your example as well. Looking at the website careermailhost.in, from which the email is allegedly sent, again we have a hosting server which in this case was Unihost.com. The error page I received back displayed Cyrillic letters, providing additional support that this is originating out of Hungary or neighboring countries. Unfortunately Unihost.com was registered as a "Domains by Proxy" company, which accounts for 12 million other domains, so it appears our trail stopped cold there.
Glad to have another sample. It will help others who research it not be fooled.
Hello Matthew,
ReplyDeleteGuess what? After responding to the original offer and corresponding with this "Anthony Marco" a few times, I received a package today via Fedex delivery.
This package had my home address on it, but not my name. I couldn't resist my curiosity, so I took a careful peek inside without opening it all the way...
Inside the package is a brand-new, in its un-opened box, IPhone 5.
I have no idea what to do with it, as there is no paperwork that I can see.
I appear to be the victim of a "re-shipping" scam, and am now in possession of what's most likely, stolen property.
Any suggestions?
Thanks
Hi Paul,
ReplyDeleteIf I were in your position, I would inform the authorities. The FBI has a link for information on Internet Fraud (http://www.fbi.gov/scams-safety/fraud/internet_fraud). On the right-hand side near the bottom are five links on various ways to report Internet Fraud. You can try that avenue, or contact your local police cyber crime division (non-emergency line). Make sure you keep the original shipping container if it has the return address and any other potential evidence for the authorities.
Good luck!
This is very informative site and I will definitely tell my friends. I want to share my experience if anyone asks your email ID and you do not want to share personal email ID then you must need to make fake email ID but point is you can still receive all emails on your real ID. anonymous email address
ReplyDeleteInteresting post. I Have Been wondering about this issue, so thanks for posting. Pretty cool post.It 's really very nice and Useful post.Thanks Buy Fake IDs
ReplyDelete