Work at home spam?

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Re: Work at home spam?

Postby spamislame » Thu Mar 17, 2011 10:22 am

I get a "page not found" error for the url you provided.

Are you using IE to browse? If so: why?!

SiL
User avatar
spamislame
Site Admin
 
Posts: 5056
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby darius » Thu Mar 17, 2011 3:15 pm

Using IE? Acckkk NO!

I use firefox.

The only time I use ie is to check website compatability for some sites i design.


Todays work at home spam:

http://gynimude.110mb.com/gazilama.html

>> 9b-usiness-news.net

>>http://biz109news.com/

( all these are identical sites)
biz101news.com
biz102news.com
biz103news.com
biz104news.com
biz105news.com
biz106news.com
biz107news.com
biz108news.com
biz109news.com
biz110news.com

on this page
http://biz109news.com/order/payment97.php

at the bottom
"Copyright © 2010 HomeCashFlowSolution.com "



looking into the source code on the "secure page"

Is that a paypal account number?

<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="9075034">
<input onClick='SEP=false;' onSubmit='SEP=false;' OnMouseOver="src='assets/images/paypal_button_over.png'" OnMouseOut="src='assets/images/paypal_button.png'" type="image" src="assets/images/paypal_button.png" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby kabo0m » Thu Apr 14, 2011 6:58 pm

I got this one in email recently and was surprised that it didn't have the typical redirects that I have seen in previous fake news sites advertising work at home scams.

http://hugecheckes.com

[EDIT: SiL rendered that URL unlinkable.]
User avatar
kabo0m
Spam Reporter
 
Posts: 154
Joined: Sun Mar 21, 2010 4:36 pm

Re: Work at home spam?

Postby spamislame » Thu Apr 14, 2011 9:09 pm

kabo0m wrote:I got this one in email recently and was surprised that it didn't have the typical redirects that I have seen in previous fake news sites advertising work at home scams.

http://hugecheckes.com

Mmmmno, but they still link to a separate redirector:

On the landing page, all links go to:

http://hugecheckes.com/more.php

Which performs the following multiple redirects:

Code: Select all
http://hugecheckes.com/more.php
302 Redirect
http://bunnhopp.com/tracking202/redirect/lp.php?lpip=811&pci=
302 Redirect
http://bunnhopp.com/tracking202/redirect/lpc.php?lpip=811
Meta-Refresh
http://affiliate.gmtracker.com/rd/r.php?sid=101&pub=300124&c1=
302 Redirect
http://affiliate.gmtracker.com/rd/r.php?progid=18&pub=300124&c1=
302 Redirect
http://affiliate.hbytracker.com/rd/r.php?sid=37&pub=370006&c1=563570948&c2=300124
302 Redirect
http://join.autopilothomeprofits.com/?

That domain, affiliate.gmtracker.com, is part of GuruMedia.

You can report their spamming affiliates here:

abuse@gurumedia.com

Note that this address appears nowhere on their website. It only appears after you sign up to become an affiliate. (Really stupid.)

However: they do take action.

Report the spammer (Publisher id: 300124) and include the entire email + headers in your report. They'll take him down.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5056
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby kabo0m » Fri Apr 15, 2011 11:59 pm

Thanks yes I saw the links within the page itself. Thanks for the email to report to! Reporting it right now! :silthumb:

Okay that didn't work

Delivery to the following recipient failed permanently:

abuse@gurumedia.com

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.7.1 <abuse@gurumedia.com>: Recipient address rejected: Invalid recipient (state 14).


Also another exactly like it:

changeestoyou.com

Code: Select all
all links on page link to changeestoyou.com/more.php

same or similar redirects
hoppsnow.com/tracking202/static/landing.php?lpip=811
hoppsnow.com/tracking202/static/record.php?lpip=811
hoppsnow.com/tracking202/redirect/lpc.php?lpip=811
affiliate.gmtracker.com/rd/r.php?sid=101&pub=300124&c1=
affiliate.gmtracker.com/rd/r.php?pub=300124&c1=||&c2=foreignredir&c3=101&sid=144
join.autoprofitsites.com/?


Pop up js window asks if you are sure if you want to leave the page and brings you to tonightfreeonly.com/more.php

And another one:

dasterdfrees.com

Code: Select all
bunnhopp.com/tracking202/static/landing.php?lpip=811
bunnhopp.com/tracking202/redirect/lp.php?lpip=811&pci=
affiliate.gmtracker.com/rd/r.php?sid=101&pub=300124&c1=


Pop up js window > weareheree.com/more.php
which brings you to those those links as well
User avatar
kabo0m
Spam Reporter
 
Posts: 154
Joined: Sun Mar 21, 2010 4:36 pm

Re: Work at home spam?

Postby kabo0m » Mon Apr 25, 2011 5:14 pm

I reported again using this form that an invite only security forum I am apart of pointed me to.

http://www.gurumedia.biz/contacts/

No response back from them but at least it went through this time
User avatar
kabo0m
Spam Reporter
 
Posts: 154
Joined: Sun Mar 21, 2010 4:36 pm

Re: Work at home spam?

Postby Red Dwarf » Mon Feb 02, 2015 3:56 pm

A recent rash (Feb 2015) of work at home scams, registered on China's BIZCN.
Registrant details are fake (no such phone, no such address)

    24tradeplus.com
    comjakepro.net
    fromnhomejob.com
    fromthehomejob.com
    linkjobbest.com
    workandtrades.com

My own e-mail address was used as To and From
spammer wrote:Alright, I'll keep this short and sweet.
1. I sent you this before.
2. You haven't watched it.
3. You should, it's URGENT

Watch this in the next 15 minutes
I need to know if you want the access or I should give it to someone else right away.
Seriously!.. You should be watching this already

This insane video describes step by step how to get TONNS of cash!
It's Free, and it's foolproof.


Registrant details have fake address, fake phone, or both as shown:
    24tradeplus.com Mary Butler 2146 North Bend River Road, Harold, KY, 41635, us +1.6067919562 address
    comjakepro.net Pedro Roberts 4116 Jadewood Drive, Chicago, IL, 60605, us +1.2242184969 both
    fromnhomejob.com Willie Tutor 3440 Farnum Road, New York, NY, 10007, us +1.2123064466 address
    fromthehomejob.com Howard Garcia 4311 Ferry Street, Chattanooga, AL, 37421, us +1.2566708957 both
    linkjobbest.com Lindsay Martinez 4850 Cambridge Court, Fort Smith, AR, 72901, us +1.4797821326 both
    workandtrades.com Rory Carver 2252 Philli Lane, Lenapah, OK, 74042, us +1.9184686300 both

Host IP addresses are in Turkey
* 178.211.46.108
* 178.20.227.50

You can use the above info to file a complaint with ICANN at https://forms.icann.org/en/resources/compliance/complaints/whois/inaccuracy-form

Or you can email a complaint directly to the registrar, BIZCN at support@cnobin.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am

Re: Work at home spam?

Postby Red Dwarf » Wed Apr 08, 2015 6:16 am

Spam received today. Sent to the wrong guy :-)
spammer wrote:
<BODY bgColor=3D#ffffff>
You can make good money!<br><br>

<a href=3D"httP://worknhomes.com"><b>Please visit our site =



ICANN wrote:Thank you for submitting a Whois Inaccuracy complaint concerning the domain name worknhomes.com. ICANN has reviewed and closed your complaint because:

- Based on the current Whois data, the domain was suspended when the complaint was received by ICANN, or the registrar demonstrated that it took reasonable steps to investigate the Whois inaccuracy claim by suspending, deleting, cancelling or otherwise deactivating the domain name.


Registrar: BIZCN.COM, INC.
Status: clientHold
Creation Date: 2015-04-05

PS its IP address 31.210.105.11 was hosting these, all suspended by BIZCN

    alwayscareer.com
    careerandcash.com
    digitalstrade.com
    myplanearns.com
    webmoneytrade.com
    worknhomes.com
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am

Re: Work at home spam?

Postby Red Dwarf » Sat May 02, 2015 7:51 pm

URL in spam: com-5sa.net

Redirection path
http://com-5sa.net
>> 302 Redirect
http://com-cst.net/?a=352677&c=job
>>302 Redirect
http://712-finance-report.com-cst.net/nnrq/single-mom-makes-money-without-working/

COM-CST.NET is also used in the Caralluma scam

[EDIT June 1 - com-cst.net suspended]
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10448
Joined: Tue Jun 27, 2006 2:01 am

Re: Work at home spam?

Postby NotBuyingIt » Sat May 02, 2015 10:36 pm

Red Dwarf wrote:URL in spam: com-5sa.net

Redirection path
http://com-5sa.net
>> 302 Redirect
http://com-cst.net/?a=352677&c=job
>>302 Redirect
....
I notice a nominal variation: com-5sa.net redirects to com-j1o.net, which is apparently another alias for com-cst.net

Both com-j1o.net and com-cst.net currently have A records to the following IP addresses
91.191.147.117
91.191.147.118
95.129.41.71
95.129.41.84

[EDIT June 1 - com-cst.net suspended]
NotBuyingIt
Spammer Killing Machine
 
Posts: 609
Joined: Sun Jun 13, 2010 5:22 pm

Previous

Return to Fight Spammers

Who is online

Users browsing this forum: Ahrefs and 1 guest

cron