Random Mumblings

Just so I know what to look out for, I started marking the subject lines of emails that are responses to Craigslist ads, so I can figure out which fake ads are the ones soliciting responses. Usually with the legit responses, the person replying will quote your original email so you can figure out which email it was that they’re responding to. With the fake ones, the only hint is by the subject line, which gets pretty vague when a lot of people use the same titles for their job postings. Now I know to look out for this:

Front Desk (Receptionist)
Date: 2011-09-25, 3:40PM EDT
Reply to: job-4aakt-2616878676@craigslist.org [Errors when replying to ads?]
Description: Answering phones and proactively greeting, engaging both visitors and phone clients. Maintain and update the company website with images, graphics and content as provided.

• Answer and professionally administer all incoming calls.
• Ensures phone calls are answered within third ring
• Greet guests in a professional, friendly, hospitable manner
• Handling Front Desk.
• Provides backup support for Inside Sales as needed

Compensation: $14/hr.
Principals only. Recruiters, please don’t contact this job poster.
Please, no phone calls about this job!
Please do not contact job poster about other services, products or commercial interests.

It seemed a little too good to be true, $14/hr for that seems a bit much. I figured why not, what’s the worst that could happen? Here’s the reply I recieved.

domain of hrjean@sheensofttech.info) smtp.mail=hrjean@sheensofttech.info
Received: from [69.162.107.66] (helo=polaris.cogwire.net)
by mail01.pacifichost.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.76)
(envelope-from hrjean@sheensofttech.info)
id 1R8Bb0-0000v5-QM
for kenny.wells@gmail.com; Mon, 26 Sep 2011 06:51:55 -0700
Received: from [46.23.73.228]
by polaris.cogwire.net with esmtpa (Exim 4.69)
(envelope-from hrjean@sheensofttech.info)
id 1R8AaN-001f5W-00
Date: Mon, 26 Sep 2011 05:22:39 -0700
From: HR Jean hrjean@sheensofttech.info
Reply-to: “hrjean@sheensofttech.info” hrjean@sheensofttech.info
To: “Kenny Wells”
Message-ID: 168601056.20110926052239@sheensofttech.info
Subject: Re: 2Front Desk (Receptionist)
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 69.162.107.66
Authentication-Results: pacifichost.com; auth=pass () smtp.auth=69.162.107.66
X-SpamExperts-Outgoing-Class: ham
X-SpamExperts-Outgoing-Evidence: Combined (0.10)
X-Recommended-Action: accept Hello,

Thank you for emailing us in regards to the available job opening. Good news, we would like to setup an interview with you! Please login through Facebook to access our corporate website and learn more job details including hours, salary, and more information about our company http://sheensofttech.info?id=1bdc95c889

We look forward to setting up an interview with you next week!

Best Regards,
Jean Myer
HR Department

---

Once again, the tell tale sign of a scam, the HR Department. Who is this an HR rep for? Why do I have to login through Facebook to access their coprorate website? Why do I need to look their for job details or salary when they were already posted in the Craigslist posting?

Another sign that this is a scam is the .info website. I don’t know of a single .info website that is legitimate, so I treat any link I get with .info in it as a possible scam. Plus the domain name just looks stupid. Plus, if they have their own domain name, why do I have to sign in through Facebook?

Oh wait, it’s because when I click on that link, it redirects to a different page that looks exactly like the Facebook login page but isn’t! When you “log in” it takes you to realtor.com

Now what do we have here against Jean?

1. Signed HR Department with no mention of the company she represents
2. .Info domain
3. Have to sign in through Facebook even though they have their own domain
4. Domain redirects to a fake Facebook page (www.faceetwook.com)

Well, here goes nothing.

---

Hello Jean, how are you today? Unfortunately I am unable to log in through Facebook as Mark is still pissed at me and won’t let me on Facebook. You’d think after seven years he’d get over it. I told him that Facebook would never get off the ground and that if it got famous I wouldn’t use it, because he’s a douchebag. Well what do you know, it got famous and he won’t let me login. Well screw him! I don’t need Facebook anyway now that Google+ is out of beta.

But anyway, is there any way I can get to your corporate website that doesn’t involve Facebook? I really appreciate you choosing me to interview and I don’t want to miss my chance. I really need this job and this seems like it would be a great opportunity. Do you have any suggestions?

Normally when I respond to a scam, it has been from applying to a job on Craigslist. This time I decided to go through my spam folder on my email account. It was filled mostly with what you would expect, ads for penis pills, breast enlargements, and Nigerian prince scams. I decided to go with the one that might actually get me a response. Note, no animals were hurt in the creation of this response.

---

Received: by mailserver.tainam.com with Internet Mail Service (5.5.2657.72)
id TK835HP2; Thu, 22 Sep 2011 16:38:24 +0800
Received: from User (ip-254-0-168-192.rev.dyxnet.com [192.168.0.254]) by mailserver.tainam.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72)
id TK835HPC; Thu, 22 Sep 2011 16:38:18 +0800
From: THE PRESIDENCY info@thepresidency-nig.com
Reply-To: secretary.fmf@thepresidency-nig.com
To:
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Subject: YOUR OUTSTANDING PAYMENT
Date: Thu, 22 Sep 2011 01:39:48 -0700
MIME-Version: 1.0
Content-Type: text/plain;
charset=”Windows-1251″
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

RE:PAYMENT RELEASE ORDER FROM THE PRESIDENCY

My name is Dr. Dukas Osmond. I’m the personal secretary to the new Minister of Finance, I’m directed to contact you by the Minister to urgently confirm from you if actually you know one Mrs. Emily Dawson who claims to be your business associate/ partner in Nigeria.

Furthermore the said Mrs. Emily Dawson is told us that you are dead and she will like to change all the Information’s that you gave to us as our bonfire beneficiary. This development is coming now that the Ministry want to offset all outstanding payments to all our legal foreign beneficiaries’ around the world and your payment file was included.

This are the information forwarded to my desks by Mrs. Emily Dawson of CANADA to re-route your payment into a new bank account number as stated (VACAP Credit Union, 1700 Robin Hood Road, Richmond, CA 23720. Account Number 492453201. Routing Number 85226456, Of Mrs. Dawson. The Sum of $2.5 Million US Dollars (Two Million Five Hundred Thousand US Dollars)

As you may know, the total amount in your favor is a total sum of $2.5 Million Dollars.

We need to confirm from you urgently before the royal mail courier delivers to you and if it’s really true that you are dead and if we did not hear from you it automatically means that you are actually dead and the information passed to us by Mrs. Emily Dawson is correct

IT IS ALSO VERY IMPORTANT FOR YOU TO KNOW THAT YOU SHOULD FILL,SCAN AND SIGN THE ATTACHED FORM AND SEND IT BACK TO THIS OFFICE ASAP.

THANK YOU FOR YOUR ANTICIPATED COOPERATION. GOOD LUCK!

YOURS TRUELY,

Dr.Dukas Osmond
SECRETARY FMF

---

Hello Dr. Osmond. Sorry that it’s taken a few days for me to get back to you, but I’m very much alive. Mrs. Emily Dawson used to be a colleague of mine, but far from business associate or business partner. In fact, we were not equals, as it seems that she made it seem, and I apologize for that. You see, she was my fluffer. Not business partner, not business associate. Her sole job was to make sure my penis was hard.

The only reason I can think of for her to make such malicious accusations as to my death is because she is upset that I fired her. No, it wasn’t because she was bad at jerking. Quite the contrary, she was amazing. He had hands of silk and the mouth of an angel. If it weren’t for her actions, I would have never fired her, and she was due a large raise in the coming months (oooh, pun sort of intended). You see, she liked to make jokes about under-aged boys.

Now I don’t mind the occasional joke or two, but it seemed she may have had intimate knowledge about sexual relations with 16 year old boys (which is illegal in the US, as she is an adult). She kept saying that I should shave my balls smooth to look like a young boy, or that she wishes I was younger so it would be dirtier. I mean, it was kind of hot the way she said it, but it made me a little uneasy. So I did what any hard working American business man would do, I hired a private investigator.

So this guy, let’s call him Solid Snake, followed her around for a few weeks. Now I know what you’re probably thinking, he followed her all around and found her hanging out at juke joints, High Schools, and the occasional roller rink. Quite the contrary. In fact, she didn’t go near any of those places, because well, juke joints and roller rinks don’t exist, and she wasn’t near any high schools.

Now, what he found was more disturbing than anything you would imagine. Solid Snake was hanging out near her house when one day a kitten wandered into her back yard. It was mewing up a storm. It was the most adorable little thing you’ve ever seen, just so cute and small. Apparently this got on Emily’s nerves. So she goes outside, sees the kitten looking up at her with it’s cute little adorable eyes and she punts it through the uprights (American Football metaphor, she kicked it really high)! My god, she could put an NFL (National Football League) punter to shame (which is funny, because punters don’t normally kick field goals, so start ignoring my metaphors).

I couldn’t believe it. This talented women, with the mouth of an angel and hands as smooth as silk, kicked a kitten as hard as she could. This just would not stand. I almost wished she was having sex with high school kids, that at least wasn’t mean and she was doing these kids a favor, she was fucking hot. This just would not stand. So I did what anyone in my position would have done, I fired her right after my morning blow job. Well, not right after. I didn’t want her to bite my unit off in retribution. I waited until after my pants were back on and after she had gargled. After all, I do have some class.

She was upset. I think she was more upset with the fact that I had a Private Investigator watching her than kicking the kitten, which is sad. This kitten was just so darn cute and it never did anything bad to her. I hope it pooped all the way across her yard as it flew across it. Nevertheless, I fired her. She left extremely angry, but to calm her down, I offered to pay her for the rest of the month, that was on August 4th.

Now she’s there in Nigeria trying to get my two point five million United States dollars from me? Not on my watch! As evident by this email, I am very much alive and would like you to stop the transfer of the money. That bitch is not to touch my money, you hear me?

I thank you for the heads up, Dr. Osmond. Tell the Minister that I am very thankful for the heads up and that you deserve a raise. Can you also tell him I’m still down for that trip to Euro Disney six weeks from now. If he is unable to go, just have him give me a call, he should have my number.

This one is sort of a repeat of a previous email I had received. It doesn’t mean that I shouldn’t reply. These are probably the worst kind of scams, since they clone legitimate sites in hopes that people will see that the they are “real” and will be more likely to fall prey to them. While it’s not that bad for myself, others may not know the signs of a fake and might be lured in by their trap. That’s mostly why I make these posts, letting off some steam by yelling at people who waste my time is just an amusing side effect. Oh, I’ve also decided to include most of the header information for the emails sent to me.

---

Return-Path: jenny@pokerspots.org
Received: from pok.pokerspots.org ([96.125.170.212])
by mx.google.com with ESMTPS id e2si3847819yba.8.2011.09.13.09.45.15
(version=TLSv1/SSLv3 cipher=OTHER);
Tue, 13 Sep 2011 09:45:15 -0700 (PDT)
eceived-SPF: pass (google.com: domain of jenny@pokerspots.org designates 96.125.170.212 as permitted sender) client-ip=96.125.170.212;
DomainKey-Status: good
Authentication-Results: mx.google.com; spf=pass (google.com: domain of jenny@pokerspots.org designates 96.125.170.212 as permitted sender) smtp.mail=jenny@pokerspots.org; domainkeys=pass header.From=jenny@pokerspots.org
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=pokerspots.org;
h=Received:Date:From:To:Message-ID:In-reply-to:References:Subject:MIME-Version:Content-Type;
b=dpbHaoHYm+2rIu3Ee4biWL78BswFveP9rPIeJdmImnE6vamsfZllvA7Yi4/lIyRqQ9cONCejpAzTzptlatXNSP2jR9fTQs3fMWmjU96W6Tg6i65OIy8zz1u6oVDb1zBh;
Received: from rrcs-208-125-15-161.nyc.biz.rr.com ([208.125.15.161]:49825 helo=Eddie)
by pok.pokerspots.org with esmtpa (Exim 4.69)
(envelope-from jenny@pokerspots.org)
id 1R3VOf-0004CL-K8

Date: Tue, 13 Sep 2011 10:37:16 -0400
From: Jenny Parnell jenny@pokerspots.org
To: “Kenny Wells”
Subject: Re: Receptionist (Akron)
MIME-Version: 1.0
Content-Type: text/html
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – pok.pokerspots.org
X-AntiAbuse: Original Domain – gmail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – pokerspots.org

I would like to take this moment to thank you for your response to our Craigslist job posting, as well as inform you that, after reading through your resume, we are interested in discussing this job opportunity with you in person. As of this moment, we have narrowed the field down to 3 potential candidates, yourself being one of them.

I would like to congratulate you in making it to the next step of our hiring process. As part of our company’s policy, and to protect our company from liabilities and potential issues, the next step of the hiring process includes getting your credit score checked. Please be aware, that a poor score in no way disqualifies you from the position, but simply helps us to get a better understanding of you, and what we can expect from you as an employee.

So we have arranged a FREE service at www.creditreport.com for you to obtain your score. Once you have completed this process, please email me the confirmation # ASAP, so we can move forward. Do NOT include your SSN or any private information in any emails. Please perform this step as soon as you can, as we would like to fill the position soon. Once we receive confirmation that you have completed this step, myself or Mr. Levy, our office manager, will get back to you to set up the face to face interview.

Again, thank you for your interest, and I hope to hear from you soon.

Jenny Parnell
VP of Operations
PokerSpots.org
www.pokerspots.org

---

Once again, they use HTML to obfuscate a link for a credit report. I’d have to talk with someone who actually works in an HR department or a hiring department, but i’m fairly certain an employer needs your signature to run a credit check, not have you do it online. Also, why would you want your potential employee to run the credit check? What’s stopping me from handing over a fake credit report to you, showing that I have awesome credit. On top of that, what part of this job would require the check? Nothing is explained about this job. I’m sure the Craigslist ad was equally as vague.

Never, EVER, submit to an online credit check unless you’re going directly through one of the three credit reporting bureaus. So to avoid further stalling, here is my response.

---

Hello Jenny! I’m so sorry that it took me so long to get back to you. I need you to look at the following link:

http://www.rootmytoaster.org/2011/08/21/kenny-responds-to-scams-pt-4

Do you notice anything familiar in that email? Well, you should, because it’s the same email that you just sent me. It’s on the internet for people to search to see that you’re not offering anything substantial. Your script is old, and it inspires no confidence. But seriously, obfuscated link for your phishing expedition is the easiest tell in the book (see what I did there, poker reference!) for a scam. Plus, for a credit check to be ran, you need my physical signature to run it.

Yea, those were the obvious problems with your email. Then you decide to create a fake website to make you look legitimate. As with the previous scam that I’ve exposed, you copied another website in hopes that no one will notice. Apparently there were a few things you didn’t notice while copying the website.

1) The domain name of the site you copied is in the banner on the top of the website. If you’re going to run a scam by cloning a website, you don’t want any links back to the original website, it ruins the tangibility of the new site.

2) The copyright of the website also references the website you cloned. I can understand the banner at the top, it’s a picture. Photoshop is expensive, and most Operating systems don’t come with an image manipulation program to alter pictures. Oh wait, Windows has MSPaint, and I’m pretty sure MacOS and Linux both come with their own image manipulation programs. If not, GIMP is free. ‘

3) The website in question hasn’t been updated in over two years. That’s just a quick glance though, somewhere deeper in the site might reveal other updates in the past two years, but this leads to a fourth point…

4) Your domain record is newer than the last update. I don’t mean that the domain was renewed. I mean that the domain was created recently. As in a few days before you emailed me, recently. I can understand being targeted by an internet upstart, but you’re passing yourself off as a business that’s been around for a while with a domain record that is still in diapers. While I’m on the subject of your domain record…

5) Your registration information is blocked out for unknown reasons. Well, technically it’s not unknown, you want people to work to give you copyright infringement notices. I don’t care what whois guard claims, there is absolutely no reason to block your whois information. I receive 0 spam from my whois information. I have only ever received one piece of snail mail in regards to my domain registration.

Now I’m not really expecting a response from you, as I rarely receive responses from scammers (the only exception was most likely autogenerated). It would be nice to hear an explanation from you as to why you took your actions, but that’s really a pipe dream.

Kenny
Admin
www.rootmytoaster.org