Job scam quick guide: it's a scam if...

  • they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.
  • they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.
  • they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.
  • they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".
  • it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Friday, December 08, 2006

Impex Consult Financial Consulting Group

Summary

Another in a long line of "direct transfer" money mule scams [see sidebar for more information about money mule scams], Impex Consult appears to be a direct descendant of Athens Financial Group Ltd, because there is overlap in the nameservers used for the domain names.

The Spam

As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.

Representative image

spam text as image

Sender names encountered

Capitalisation and punctuation may vary

  • Impex Consult Financial Consulting Group
  • Impex Consult Financial
  • Impex Consult

Domain names involved

The following links have been encountered in spam, listed in order of encounter.

  1. http://icslt.net/
  2. http://icslt.com/
  3. http://icst.biz/
  4. http://icslt.cn/
  5. http://icslt.info/
  6. http://ixcslt.cn/
  7. http://im-consult.biz/
  8. http://impexconsult.net/
  9. http://impex-consult.biz/
  10. http://impexconsult.biz/
  11. http://imconsult.biz/
  12. http://imconsult.org/
  13. http://imcons.org/
  14. http://imcons.info/
  15. http://imcons.biz/
  16. http://impex-consult.org/
  17. http://imp-consult.com/
  18. http://imp-consult.net/
  19. http://impexconsult.org/
  20. http://im-consult.org/
  21. http://imp-consult.biz/
  22. http://consult-im.net/
  23. http://consult-imp.net/
  24. http://consult-im.biz/
  25. http://consult-imp.com/
  26. http://consult-im.org/

The above is not an exhaustive list of involved domains -- merely the ones we know about. Please post comments below if you are aware of other domains involved in this scam.

Website

Here is a snapshot of the website taken at around the time this blog entry was first posted.

scam website snapshot

Domain Information (for experts)

Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably fabricated and may point to innocent third parties.

icslt.net

Query at around 2006-12-07 16:59 UTC

   Domain Name: ICSLT.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Updated Date: 08-Nov-2006
Creation Date: 08-Nov-2006
Expiration Date: 08-Nov-2007
email: richardpowell65@yahoo.com

Query at around 2006-12-08 09:02 UTC

   Domain Name: ICSLT.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.FURI-CURI.COM
Name Server: NS2.FURI-CURI.COM
Updated Date: 08-Nov-2006
Creation Date: 08-Nov-2006
Expiration Date: 08-Nov-2007
email: michaelobertin@yahoo.com

icst.biz

Query at around 2006-12-08 10:49 UTC

Domain Name:                                 ICST.BIZ
Domain ID: D15141626-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-142850
Registrant Email: michaelpdobeck@yahoo.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Wed Nov 08 14:53:40 GMT 2006
Domain Expiration Date: Wed Nov 07 23:59:59 GMT 2007
Domain Last Updated Date: Wed Nov 08 15:07:15 GMT 2006

icslt.cn

Query at around 2006-12-10 13:04 UTC

Domain Name: icslt.cn
ROID: 20061108s10001s91624629-cn
Registrant Name: Nellie Lucas
Administrative Email: nellielucas62@yahoo.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.furi-curi.com
Name Server:ns1.furi-curi.com
Registration Date: 2006-11-08 21:08
Expiration Date: 2007-11-08 21:08

icslt.info

Query at around 2006-12-13 16:12 UTC

Domain ID:D15271113-LRMS
Domain Name:ICSLT.INFO
Created On:08-Nov-2006 14:10:32 UTC
Last Updated On:08-Nov-2006 14:21:30 UTC
Expiration Date:08-Nov-2007 14:10:32 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-229245
Registrant Name:Ashley Cates
Registrant Email:ashleycatesss@yahoo.com
Name Server:NS2.FURI-CURI.COM
Name Server:NS1.FURI-CURI.COM

ixcslt.cn

Query at around 2006-12-21 14:37 UTC

Domain Name: ixcslt.cn
ROID: 20061220s10001s05471950-cn
Registrant Name: Dietrich Mundt
Administrative Email: wimue-tfk@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.furi-curi.com
Name Server:ns1.furi-curi.com
Registration Date: 2006-12-20 06:25
Expiration Date: 2007-12-20 06:25

im-consult.biz

Query at around 2006-12-21 14:41 UTC

Domain Name:                                 IM-CONSULT.BIZ
Domain ID: D15696367-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: 44946D208AC63138
Registrant Name: Michael Hamerlik
Registrant Email: michaelhamerlik@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 17:02:09 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 17:39:14 GMT 2006

impexconsult.net

Query at around 2006-12-22 12:41 UTC

   Domain Name: IMPEXCONSULT.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.FURI-CURI.COM
Name Server: NS2.FURI-CURI.COM
Updated Date: 20-dec-2006
Creation Date: 20-dec-2006
Expiration Date: 20-dec-2007
email: renejerez10@yahoo.com

impex-consult.biz

Query at around 2006-12-23 05:27 UTC

Domain Name:                                 IMPEX-CONSULT.BIZ
Domain ID: D15696699-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: 94CBA57C384E8164
Registrant Email: jamesnemiah@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 17:11:13 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 17:39:16 GMT 2006

impexconsult.biz

Query at around 2006-12-24 01:35 UTC

Domain Name:                                 IMPEXCONSULT.BIZ
Domain ID: D15695332-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: EFC8324F2E84F6CE
Registrant Email: nathanphillips@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 15:55:39 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 16:23:43 GMT 2006

imconsult.biz

Query at around 2007-01-07 07:44 UTC

Domain Name:                                 IMCONSULT.BIZ
Domain ID: D15840768-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: BB161ADE8447FC58
Registrant Email: margaretchatfield@yahoo.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Jan 03 11:53:03 GMT 2007
Domain Expiration Date: Fri Jan 02 23:59:59 GMT 2009
Domain Last Updated Date: Wed Jan 03 11:55:57 GMT 2007

imconsult.org

Query at around 2007-01-07 09:17 UTC

Domain ID:D136440363-LROR
Domain Name:IMCONSULT.ORG
Created On:03-Jan-2007 12:12:41 UTC
Last Updated On:03-Jan-2007 12:15:53 UTC
Expiration Date:03-Jan-2009 12:12:41 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:A152FEA89F129699
Registrant Email:carolyncampbell2@yahoo.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM

imcons.org

Query at around 2007-01-10 00:38 UTC

Domain ID:D136738065-LROR
Domain Name:IMCONS.ORG
Created On:07-Jan-2007 21:55:06 UTC
Last Updated On:07-Jan-2007 21:57:10 UTC
Expiration Date:07-Jan-2008 21:55:06 UTC
Sponsoring Registrar:Gandi SAS (R42-LROR)
Registrant ID:O-1077339-GANDI
Registrant Email:b998b80aa7a07631a8546d249d6da20c-1079128@owner.gandi.net
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM

imcons.info

Query at around 2007-01-10 00:41 UTC

Domain ID:D16039381-LRMS
Domain Name:IMCONS.INFO
Created On:07-Jan-2007 22:10:40 UTC
Last Updated On:07-Jan-2007 22:12:36 UTC
Expiration Date:07-Jan-2008 22:10:40 UTC
Sponsoring Registrar:Gandi Sarl (R191-LRMS)
Registrant ID:O-1077351-GANDI
Registrant Email:b04842a113b683d1266373839a35fa92-1079140@owner.gandi.net
Name Server:NS2.MC-ROYAL.COM
Name Server:NS1.MC-ROYAL.COM

imcons.biz

Query at around 2007-01-10 10:19 UTC

Domain Name:                                 IMCONS.BIZ
Domain ID: D15896055-BIZ
Sponsoring Registrar: GANDI SARL
Sponsoring Registrar IANA ID: 81
Registrant ID: O-1077336-GANDI
Registrant Email: ee551567e8231aefe0a649c80d6cc4fa-1079125@owner.gandi.net
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Created by Registrar: GANDI SARL
Last Updated by Registrar: GANDI SARL
Domain Registration Date: Sun Jan 07 21:39:51 GMT 2007
Domain Expiration Date: Sun Jan 06 23:59:59 GMT 2008
Domain Last Updated Date: Sun Jan 07 21:45:12 GMT 2007

impex-consult.org

Query at around 2007-01-15 20:13 UTC

Domain ID:D136738014-LROR
Domain Name:IMPEX-CONSULT.ORG
Created On:07-Jan-2007 21:50:54 UTC
Last Updated On:07-Jan-2007 22:03:50 UTC
Expiration Date:07-Jan-2009 21:50:54 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:12768FFE6F81FF7F
Registrant Email:robertowerssr88@yahoo.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM

imp-consult.com

Query at around 2007-01-15 20:36 UTC

   Domain Name: IMP-CONSULT.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Updated Date: 12-jan-2007
Creation Date: 12-jan-2007
Expiration Date: 12-jan-2008
Registrant:
Domain Discreet
ATTN: imp-consult.com
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Email: 164a8c1f0a1e6728011f30fa5658e23d@domaindiscreet.com

imp-consult.net

Query at around 2007-01-15 20:41 UTC

   Domain Name: IMP-CONSULT.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Updated Date: 12-jan-2007
Creation Date: 12-jan-2007
Expiration Date: 12-jan-2008
Registrant:
Domain Discreet
ATTN: imp-consult.net
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Email: 1656f9210a1e672a001304dafc828191@domaindiscreet.com

impexconsult.org

Query at around 2007-01-15 20:44 UTC

Domain ID:D136738160-LROR
Domain Name:IMPEXCONSULT.ORG
Created On:07-Jan-2007 22:03:06 UTC
Last Updated On:07-Jan-2007 22:36:54 UTC
Expiration Date:07-Jan-2009 22:03:06 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:C9A798A71E5D4173
Registrant Email:jasmineprovidence@mail.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM

im-consult.org

Query at around 2007-01-24 18:46 UTC

Domain ID:D137869565-LROR
Domain Name:IM-CONSULT.ORG
Created On:21-Jan-2007 10:44:01 UTC
Last Updated On:24-Jan-2007 09:03:59 UTC
Expiration Date:21-Jan-2008 10:44:01 UTC
Sponsoring Registrar:Register.com Inc. (R71-LROR)
Registrant ID:7529641415d9e460
Registrant Name:Domain Discreet
Name Server:NS1.BU-BOW.COM
Name Server:NS2.BU-BOW.COM

imp-consult.biz

Query at around 2007-01-24 19:15 UTC

Domain Name:                                 IMP-CONSULT.BIZ
Domain ID: D16082251-BIZ
Sponsoring Registrar: REGISTER.COM
Sponsoring Registrar IANA ID: 9
Registrant ID: 3801454535015505
Registrant Name: Domain Discreet
Name Server: NS1.BU-BOW.COM
Name Server: NS2.BU-BOW.COM
Created by Registrar: REGISTER.COM
Last Updated by Registrar: REGISTER.COM
Domain Registration Date: Sun Jan 21 11:03:36 GMT 2007
Domain Expiration Date: Sun Jan 20 23:59:59 GMT 2008
Domain Last Updated Date: Wed Jan 24 08:56:50 GMT 2007

consult-im.net

Query at around 2007-01-31 17:38 UTC

   Domain Name: CONSULT-IM.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008
Registrant:
Domain Discreet

consult-imp.net

Query at around 2007-02-01 03:09 UTC

   Domain Name: CONSULT-IMP.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008
Registrant:
Domain Discreet

consult-im.biz

Query at around 2007-02-01 11:01 UTC

Domain Name:                                 CONSULT-IM.BIZ
Domain ID: D16243115-BIZ
Sponsoring Registrar: REGISTER.COM
Sponsoring Registrar IANA ID: 9
Registrant ID: 3999838F90DF4450
Registrant Name: Domain Discreet
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Created by Registrar: REGISTER.COM
Last Updated by Registrar: REGISTER.COM
Domain Registration Date: Wed Jan 31 16:24:54 GMT 2007
Domain Expiration Date: Wed Jan 30 23:59:59 GMT 2008
Domain Last Updated Date: Wed Jan 31 16:26:45 GMT 2007

consult-imp.com

Query at around 2007-02-01 14:07 UTC

   Domain Name: CONSULT-IMP.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008

consult-im.org

Query at around 2007-02-02 18:19 UTC

Domain ID:D138652407-LROR
Domain Name:CONSULT-IM.ORG
Created On:31-Jan-2007 15:37:36 UTC
Last Updated On:31-Jan-2007 15:43:42 UTC
Expiration Date:31-Jan-2008 15:37:36 UTC
Sponsoring Registrar:Register.com Inc. (R71-LROR)
Registrant ID:4223172cdbc7a082
Registrant Name:Domain Discreet
Name Server:NS1.TRANSFER-BK.COM
Name Server:NS2.TRANSFER-BK.COM

39 comments:

Anonymous said...

Mark3399@gmx.net

thats was the sender of the one I got...

Anonymous said...

On 12 Dec 2006 my sender was Mccain7379@gmx.net

Spotter said...

Don't bother supplying sender addresses: they are forged, and probably come from the same list that was used as recipient addresses. I am interested in website addresses if they aren't already listed here, however.

Anonymous said...

I would so love to see a group of people try and hack that page (specifically the "Quick Site Access" thing...)

Would be interesting to see what they have back there ;-)

Unknown said...

This is what I got for (icslt.net) from an email sent on 12/19/06

Using 0 day old cached answer (or, you can get fresh results).
Hiding E-mail address (you can get results with the E-mail address).

domain: icslt.net
owner: Richard Powell
email: ***************@yahoo.com
address: 8000 E 23rd Street
city: Kansas City
state: --
postal-code: 64129
country: US
phone: +816.5100899
admin-c: CNET-623142 ***************@yahoo.com
tech-c: CNET-623142 ***************@yahoo.com
billing-c: CNET-623142 ***************@yahoo.com
nserver: ns2.furi-curi.com
nserver: ns1.furi-curi.com
status: lock
created: 2006-11-08 14:30:51 UTC
modified: 2006-11-08 14:44:22 UTC
expires: 2007-11-08 14:30:51 UTC

contact-hdl: CNET-623142
person: Richard Powell
email: ***************@yahoo.com
address: 8000 E 23rd Street
city: Kansas City
state: --
postal-code: 64129
country: US
phone: +816.5100899

source: joker.com live whois service
query-time: 0.019781
db-updated: 2006-12-18 23:52:46
NOTE: By submitting a WHOIS query, you agree to abide by the following
NOTE: terms of use: You agree that you may use this data only for lawful
NOTE: purposes and that under no circumstances will you use this data to:
NOTE: (1) allow, enable, or otherwise support the transmission of mass
NOTE: unsolicited, commercial advertising or solicitations via direct mail,
NOTE: e-mail, telephone, or facsimile; or (2) enable high volume, automated,
NOTE: electronic processes that apply to Joker.com (or its computer systems).
NOTE: The compilation, repackaging, dissemination or other use of this data
NOTE: is expressly prohibited without the prior written consent of Joker.com.

Spotter said...

Please bear in mind that most of the contact details in the WHOIS record are likely to be false, and may be true contact details for some innocent, uninvolved party. The email addresses, on the other hand, are probably true, since that is the way in which the scammers communicate with the domain name registrar.

Anonymous said...

Received an email on 21st Dec 2006 from Erma.Henson3958@norika-fujiwara.com

http://impexconsult.biz/e/

Was directed to the above website.

Anonymous said...

I received 2 of these today. I knew something was up when I noticed the email was coming from a place called 'punkass.com'. If anyone is collecting these or can advise where I should send them, let me know.

Anonymous said...

http://impexconsult.biz/e/

This was sent to me, from
Impex Consult [Helton8780@sesmail.com]

Anonymous said...

From the 'properties":
HreF=http://impexconsult.net

Anonymous said...

Penny.Phipps@freeproblem.com
Fran.Lim9871@atlanta.com
Buchanan619@kinki-kids.com
Bryan628@mail.com
babncboubhayxk@purinmail.com

^ there's more to the emails. seriously, with the @whatevers.com : seriously looks fake. they've asked me for money! dude! what kind of place ask for money to get a job? -.- ridiculous. i seriously want to see someone hack into their site and see what they really have.

Anonymous said...

I been getting these non stop. In the past 5 days I have received about 40 emails. Luckily gmail automatically sorts them into spam, but it is still annoying.

oldtymer said...

I ALWAYS answer this type of nonsense with false information and make the sender follow a dead-end trail. If 10,000 people did the same to every spam/rip off that they received then I think we could drive some of these bastards out of business. Use a hotmail or yahoo account to send them a return E-Mail because you are likely to be put on a mailing list. I completely filled up my yahoo.com account and every new message just gets returned to sender.

Anonymous said...

I got this also & at first thought it was real. Murray371@pacbell.net was the sender.

Spotter said...

The sender addresses are false and may belong to an unrelated third party. They are basically made up or taken from a list at random. These guys want you to reply via their website, not via the original email.

Anonymous said...

I got one from here: http://im-consult.biz/e/

Spotter said...

Those of you who are using Gmail and would like a filter rule to delete this stuff (rather than have it appear in your spam folder) see this post.

Also, note that today marks my first sighting of the domain "imconsult.biz", which is not only the first new name they've used in several weeks, but also uses a new domin for nameservers: MC-ROYAL.COM, created 21-dec-2006.

Anonymous said...

I have ben getting these emails for months now and just bin them but the most recent ones came from Julius.Copeland222@sesmail.com and ljsgfl@kellychen.com

Anonymous said...

I like them.. There is a nice hidden story running through them if you highlight the text at the bottom.

Anonymous said...

i have recieved several of these. i did not know it was fraulent, opened the mail and i think a few of them had a website to go to, and when i clicked on it it came saying that there was no site found. what i am wondering is if there is a way for them to hack into your email accounts and get information that way? i know that ebay scams, when you put in the website, that is how they can hack into ebay accounts.

Spotter said...

If you are using Microsoft Windows, particularly if you are also using Internet Explorer, then visiting any potentially hostile website is a high risk business. So far as I'm aware, the Impex scammers have so far settled for telling lies on their website, rather than actively trying to compromise your computer with it, but it's still a bad risk.

Anonymous said...

don't these lazy, unproductive, innane, immoral, buttheads have anything better to do? why don't they get a real job, make real, honest money and live a happy life. someone needs to speak to them about God and how much they apparently need Him in their sorry lives. thanks everyone for your posts! and thank you for this great site! very helpful.

Anonymous said...

recently had a relative that posted a truck for sale on the e-bay. Person e-mailed them direct offered $10,000 for truck and asked if relative's bank could cash a chashier's check as soon as received. The reason being additional funds would be added to the $10,000 to cover the cost of shipping the truck to Africa. Requested the relative to cash cashier's check, obtain money order for the difference received and sent to a third party (shipper). Relative would not remove truck from e-bay and check was never received luckly as it was lost by UPS during the holidays.

Gunkie said...

I just added all of those listed domains to my access file on the mail server and pointed them to 'REJECT'.

Thanks for posting the known domains! I think I was getting around 30 of those/day.

Anonymous said...

I have received sbout 50 emails over the past 3 days from these guys. I went to their website and looked at their contact information this morning to try and get in touch with them. They have a whole list of email addresses going to their seperate departments. I emailed every single one of those email addresses and got back a failure notice letter for ALL of them. This is bullshit. How do I stop this?!?!

Spotter said...

You can pre-emptively delete Impex spam if you are a Gmail user: instructions here. If you aren't a Gmail user, well, it depends on what tools your email service provider offers you to filter your messages. These guys deliver their spam from malware-infected PCs and use random sender addresses, so it's not possible to block it by sender identity or IP address, since they vary too much.

Anonymous said...

I'm convinced that they are getting personal info (i.e. email adresses, names, etc.) through careerbuilder.com. Everytime I've used the service I have a huge jump in spam. Impex is the worst of the worst.

Anonymous said...

Here's a new address:
http://www.impex-consult.com/e/

I hope this helps.

Spotter said...

New nameserver usage: bu-bow.com.

Query at around 2007-01-24 18:50 UTC

Domain Name: BU-BOW.COM
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.BU-BOW.COM
Name Server: NS2.BU-BOW.COM
Updated Date: 24-jan-2007
Creation Date: 21-dec-2006
Expiration Date: 21-dec-2008

ns1.bu-bow.com has address 203.174.83.208
ns2.bu-bow.com has address 69.9.21.211

ns2 does not respond, and may be a red herring, but ns1 responds to queries.

Unknown said...

I get 20 spam emails from this company daily and I can't get rid of them! I'm SO annoyed. Is there anywhere I can take my address away from so I don't get their spam? If I could find the person responsible for this, I'd seriously smack the shit out of them!

Anonymous said...

I get about 30 of these a day and thought I would check it out and google led me here. This is where mine came from..hope this is what you need and it helps get rid of these people:

http://consult-im.net/e/

Anonymous said...

In regards to this "Impex" stuff, theArin search that I did yielded 3 locations for these emails, Falls Church, Va, Washington, DC, and Amsterdam, Netherlands. This is the CIA via a company known as Hunter Douglas (based in the Neterlands) doing this.

Anonymous said...

Hi,

I’m from Canada and also got this SPAM.

If you go to their website [http://www.impex-consult.com/e/index.php?p=p4] for contact info, you’ll get this:

==============
Address:
Midtown area at 226 West 50 St.,
New York, New York 10019,
United States
Tel.: 212-459-1010
==============

Well the “226 West 50 St., New York, New York 10019” info is the Three Stars Amsterdam Court Hotel and the “212-459-1010” info shows up as "Mei Cheung (212) 459-1010 75 W End Ave, New York, NY 10023" (result not confirmed).

LOL

Anonymous said...

Spam received 2-2-7 from:
Impex Consult [Rosemary.Gallagher@computermail.net]

directing to:
http://consult-im.org/e/

Unknown said...

It seems they are in the process of again changing their 'name'.

First they were Norden... then Impex... and now Radius Group/Radius Investments.

SSDD.

It's happened in the past two days.

Anonymous said...

Got an email from radsg.biz...reported it to the real radiusinvestments.com..legitimate real estate company being spoofed

westie girl said...

i got this email too

definitely a scam

kathryn
http://www.scamemail.co.uk

Anonymous said...

http://homejobmanualreport.com/ is another one. I checked it out on whois and it goes back to ECOM INC.
You asked for other names, so here you are.
Thanks for the posts in this blog.

BJ
Colorado, USA

Spotter said...

Ugh. That's another one of those zillions of "work at home mom makes thousands!" junk ads, complete with fake flash-based news article that starts playing video as soon as you navigate to the page. If your post included an actual link, I'd delete it.