Job Discussion Forums

[bobs]

Folks, I got the following posted on my own site last night... it is indeed a scam and has already duped a lot of money out of some people:

[soapdodger]

Er, what scam exactly would that be? Being Nigerian? I don't see any demands for money, bank details etc. Have you called him or mailed and got more details, if so they would obviously be useful as there doesn't seem to be anything suspect here. Yes, the English is laughable, but so is that of alot of posters here...doesn't make them scammers.

[bobs]

I assure you, it's 100% scam. I've seen the proof. Just trying to warn people. Take it or leave it. The title is 'Nigerian Scam' because

A) it originates from Nigeria

B) it's a scam

not for one reason or the other, but both.

If you don't believe me, feel free to apply

[spiral78]

Maybe it's more properly a 'lure.' The scam part likely comes later.

The other bit of fishiness I see, in addition to those already pointed out, is that the writer claims to be Polish, but the English used here is very unlikely to come from a native Slavic speaker. The patterns of error don't fit.

[bobs]

Correct deduction.

'Me is' etc. etc. - you would never get that in any case from a Pole who could use the phrase 'in need of'.

The scam does indeed come later - the 'Nigerian Immigration Authorities' start asking for money... blah blah. But whether the 'job ad' is a 'scam' or 'lure' is probably a tad academic.

I feel sorry for people who get conned out of money with these scams - in some ways it's easy to laugh at someone being greedy and really believing he can get $3000 a month, a car, blah blah for teaching three people. In other ways - the people who fall for this are gullible and probably vulnerable individuals.

http://www.eslteachersboard.com/cgi-bin/forum/index.pl?noframes;read=12245

http://en.wikipedia.org/wiki/Advance_fee_fraud

http://www.tesall.com/international/viewtopic.php?t=2749

http://forums.eslcafe.com/job/viewtopic.php?p=563878

I just find it incredibly hard to believe that people continue to fall for these things.

[guty]

The scam begins when he asks for you to forward some money to arrange your visa and flight.
Isn't it sad that the original scams from Nigeria offered hundreds of thousands of dollars for putting millions of dollars into your bank account, but in the EFl world, it seems $3,000 is enough.

[zeke0606]

I figured out a way to find out what country and what ISP these scams come from and also all the different email addresses they use to send out these scams to confuse you in writing to the ISP's to complain about illegal spam and harassment.
Another thing I found - one of these scammers actually told me they get OUR email addresses from these sites! I was told in the email that my address came from teachersboard. When I contacted that web site administration, guess what I got from them ----- that is right ----- hand wringing and whining about how they can't protect anything on their web site and and and and.............

Zeke

[jwbhomer]

[bobs]

I'd also be very interested in that - I got the scam job ad on my new site literally the day after I'd launched it to my own site users for testing - it turned out the scammer had been lurking on my main site, then got the newsletter announcing that the job site was now up, etc.

But the IP the ad was posted from came up as Chicago - I guess if they can fake their IP by bouncing it off a proxy, surely they do the same with their email? How can you work it back to where it came from?

Tracert didn't even work on the address the scammer posted his ad from. It stopped at "netcomng.com". I'm not a genius with these things.

A lot of sites are just really lax about who can get email addresses. It's understandable - for a big jobs board with a lot of traffic, they want to make things 'easy' for users - minimum of steps in order to get in touch. And with so many ads going up, a lot of them probably don't/can't possibly economically 'screen' them.

This one is ridiculous though - the same format has been used for ages, it seems. The same 'company' name. The same story. Even the title and the 'no quals, no experience' stipulation for a 3000 USD/month job was enough to know it was a scam without even looking at the ad itself. A simple 'spam filter' like is used on many blogs (wordpress has plugins) would surely be able to catch a good number of them? I have zilch jobs at the moment, so it was easy to spot the ad.

At the same time - it shouldn't be necessary. People should need a license to use the internet & they should go through tests to prove they're not going to send money by Western Union in order to get a job!

It gives me the idea of making a 'honeypot' site and a separate 'scam update' on a popular forum like eslcafe. All the same, there are people that just won't/don't want to believe something that is to good to be true isnt'.

Zeke - please share your method with me! PM?

[bobs]

Interesting - the first time I looked up the IP address location I got a wrong result (tip: always use www.dnsstuff.com ) It was a plain old Nigerian IP - not Chicago

Also interesting: netcomng scam in Google

Is it just a coincidence that this IP is associated with 'scam'?

I was wrong about them hiding their IPs then d'oh.

[bobs]

This part from the IP lookup says it all:

[zeke0606]

How to find real email addresses

When you get one of those �job offers� or �dear brother in the lord� scam emails do this to find all the needed information. Then take this data and contact the ISP and report it � 99% of the time that address is closed. I believe that the scammers have a couple dozen email addresses so it really doesn�t hurt them.
First, do not open that email! While it is in your in-box, right click on it. The window should open with a list of things � you want the last one �PROPERTIES� left click on that. The next window, named �Just in cast you were wondering� has two tabs � general and details. Open details. This is the INTERNET HEADER. You can read all the different forwarding email addresses here. And you will also find all the ISP�s here. I have found up to 4 different service providers � all forwarding the scammers mail.
Next, you need to copy ALL of this data on the internet header and send it to ALL the service providers listed and all the rest too. Many providers have the address: abuse@ and their company names. You will learn the correct addresses for all reporting of abuse as you go along.
We may not be able to stop the scammers, but enough pressure on the real job web sites to verify who is collecting our data from them just might tighten up their laxness about giving out our personal information.

I hope this helps. I get no more of these scam letters after a couple hunderd abuse emails to all the ISP's!

Zeke

[jonniboy]

[zeke0606]

jonniboy -

You are correct! However, if you send your abuse notice to the wrong address ------------ the ISP's will blow you off! You must find the correct address. And sometimes this is more difficult than finding the complete header to report the offender.

You may find that yahoo has many different extensions and if you don't send it to the correct extension --- it gets bounced back.

The spammers have the definate advantage over us!

That is why I ended my last post with ----------- lean of the job web site to find out who exactly is collecting the addresses of the teachers and why they are collecting them. Maybe a stronger requirement for schools to access our data.............

Zeke

[bobs]

I agree totally!

I was looking at my site stats for search keywords coming from Senegal and Nigeria (which is where I get almost all spam/scam users from). It was easy to see that 99% of them were looking for email addresses or people to contact.

Incidentally - it seems they might prefer Yahoo! email addresses. Use Gmail - I have not yet had a single scam mail with it.

Anyway - since it's clear that the traffic coming from these two countries is more harm than good (and now I've seen that it can do *real* harm), I simply blocked their IP ranges.

I have a gut feeling that it wouldn't hurt other sites to do the same, or at least create a screening system so that visitors from those countries have to go through a login stage to get to the site (they should be approved for an account). That would mean that if there are any legit employers there, they can still access.

It's not difficult either. It might not be 100% effective but at least it would complicate things slightly for the spammers. Especially if they didn't know they were being screened from the site, but instead got redirected to a fake page filled with scambaiter's 'resumes' That would really p* them off... anyone with me?