The Best Check Cashing Scam Yet

So I just got another check cashing scam. The subject was "Make $225 And More Every Day" and instead of text, they used a graphic. Inside the e-mail, they repeated the "Make $225 And More Every Day" plus a link to their scam site at fallseagull.com. A check into the registration on fallseagull.com shows that the domain was created a week ago on February 29th, but unlike the dumbasses at Marinellsoft who used a Russian address to register their domain, these crooks were a little smarter, using a domain ownership proxy service from Moniker.com to hide their address.

Before you go thinking Moniker is shady, almost all domain registrars, including GoDaddy and Network Solutions, offer a "private registration" service where they or a subsidiary register the domain for you, but in their name, so your personal or business information doesn't have to be part of the domain registration record. In some cases this is a very legitimate thing. In most cases, it isn't, but it's a way for the registrars to make more money.

So, while they didn't have the red flag of being in Russia, they did have the red flags of the domain being barely a week old and being set up so the real owner is kept secret.

Here's the graphic.

Following that, they had this text...

To unsubscribe please go here
or send mail to:
19800 MacArthur Blvd., Ste. 300,
Irvine, CA 92612

To no longer receive Advertisements from us Click here to unsubscribe, or write: List Administrator 110 W. 9th St #311 Wilmington, DE 19801

That's one of the problems with crooks. They have no thought for quality control. They didn't think that conflicting unsubscription instructions might be a dead giveaway that they were full of crap. They also didn't bother to copy edit their graphic. The plural of guru is not "guru's". There's no apostrophe needed.

The two addresses they provide... Normally such addresses are bull. They're real, but pulled from a directory and the scammer has no actual presence there. The one in Newport Beach is an office building with a temporary office suite rentals service. The one in Wilmington is a UPS store with wi-fi service. Now I know legitimate businesses that use temporary office suite rentals and UPS stores, so those aren't red flags in and of themselves. But when you combine their anonymizing power with the anonymous domain registration, it's just another red flag. Do you really want to do business with someone who is hiding their identity from you?

I didn't click on their link for two reasons. They may be trying to use the site to infect people with spyware and viruses. I didn't want them to get encouraged to do more scam spamming by getting a click through on their bogus ad.

Once again... no legitimate business needs average joes to cash checks for it. Nobody's going to give you something for nothing. If it seems to be too good to be true, investigate it until it screams before you even consider saying yes.

Best of luck to you all.

This entry was posted on Friday, March 7th, 2008 at 9:41 pm and is filed under Job Hunting, Technology & Life.You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.