The Purpose of this post is to ALERT you that the job you are about to apply for scamalert4or may have applied FOR or is CONSIDERING APPLYING FOR is FRAUDULENT. The identities of individuals or a business entity have been stolen along with fund from their bank accounts.

These job postings are an attempt to lure you into accepting wire transfers and cashing counterfeit checks into your bank accounts. You are being recruited to wire transfer these funds via WESTERN UNION or MONEYGRAM from your bank into a DOMESTIC BANK or OFFSHORE BANK ACCOUNT.

Essentially You Become A Money or Repackage Mule

  1. Money Mule Explained
  2. Understanding The Cyber Theft Ring
  3. Protecting Yourself Against Money Mule
  4. KrebsOnSecurity – Cyberheist
  5. Washingtonpost.com by Brian Krebs
  6. Interview With A Money Mule
  7. Bobbear.co.UK ~ Historical Money Mule Sites


Good day!

We considered your resume to be very attractive and we thought the vacant position in our company could be interesting for you.

Our firm specializes in consultation services in the matter of bookkeeping and business administration.
We cooperate with different countries and currently we have many clients in the US.
Due to this fact, we need to increase the number of our destination representatives’ regular staff.

You will be responsible for shipping goods from multiple shops through our company to different places.
Part-time and full-time employment are both currently important.
We offer a flat wage from $1000 up to $3,500 per month.

If you are interested in our offer, mail to us your answer on daryle@21thjob.com and we will send you an extensive information as soon as possible.

Attention! Accept applications only on this and next week.

Respectively submitted
Personnel department

Package Manager – belboltkytoa@dropmail.me

AOL Users bobkat731@sbcglobal.net
date: Sat, Sep 20, 2014 at 4:14 AM

Sep 20 (2 days ago)

to Postmaster, Administrator, AOL

Why is this message in Spam? It’s similar to messages that were detected by our spam filters.

Our company is happy to feature this new great vacancy of “Package Manager”.

This position is designed exclusively for caretakers. If you are able to be
home from 9am through 5pm, this job is offering you the best opportunity to
earn money.

You will have to work with parcels. You will have to receive parcels,
repack them and send them to the end addressee. This job is extremely
convenient and it is ideally suited for housewives, retirees and others who
either work from home or are at home during daytime hours.

There will be no heavy packages. Most packages contain toys and clothes.

You need no money to apply.. You will not have to spend any of your money
earning money with us. All work-related expenses are on us.

To work for our company you will have to have a Internet ready PC, a cell
phone and means to print necessary documents.

The amount of money you will be earning depends on the quantity of parcels
you will be processing.

During the probationary period our employees make up to $150/week.

Contact us now belboltkytoa@dropmail.me

P.S. To qualify, all you have to do is to be home from 9am to 5pm. You must
meet this condition or, this job is not for you.

American Restructuring

Loan Modification Scam

Posted: December 02, 2014

A Washington consumer reported an entity may be operating a loan modification scam under the name of American Restructuring. The consumer reported that he believed that he retained this entity to obtain a loan modification from the owner of his mortgage loan and authorized the lender to have all communications go directly through this entity American Restructuring. The consumer indicated that he received what appeared to be an approval letter for a trial loan modification from the entity American Restructuring which required six trial payments all of which were to be deposited directly into a bank account for American Restructuring.

After the consumer made his sixth and final payment, the entity American Restructuring discontinued communication with the consumer and shortly thereafter the consumer received notice of a forced sale from the lender for nonpayment of the mortgage. Subsequently, the consumer discovered none of his payments were ever paid to the lender and all correspondence from the lender went to American Restructuring, based on the consumer’s third party authorization.

The contact information for this entity provided by the consumer is:

American Restructuring
5348 Vegas Drive STE C
Las Vegas, NV 89108
Phone: (702) 490-9410
Email: americanrestructuring@lawyer.com

American Restructuring is not licensed to do conduct business in Washington State. The Washington State Department of Financial Institutions (DFI) strongly recommends that consumers deal only with those entities that are properly licensed to conduct business.

Verify Licenses

DFI strongly recommends that consumers deal only with those lenders that are properly licensed to conduct business. Consumers can determine whether lenders are properly licensed using the “Verify a License” feature on the DFI’s website at www.dfi.wa.gov/consumers/findcompany.htm.
Report Fraud
If you are suspicious of unlicensed activity by a payday lender please contact the DFI at 1-877-RING-DFI (746-4334), or online at www.dfi.wa.gov.

If you feel you have been the victim of a loan scam please contact the Federal Trade Commission at 1-877-FTC-HELP (382-4357), or online at http://www.ftc.gov or contact the Consumer Financial Protection Bureau (855) 411-CFPB (2372), or online at www.consumerfinance.gov.

If you feel you have been the victim of a loan scam involving the Internet please contact the Internet Crime Complaint Center online at www.ic3.gov

Canadian Pharmacy Spam – phamostermo32.com

Buying Prescription Drugs Online Scam Alert 1
May Be Dangerous
Says Drug Enforcement Administration

DEA Logo - Buying Proscription Drugs

Click Here
National Association of Boards of Pharmacy (NABP)


“The Canadian Pharmacy, Canadian/European Pharmacy”, “Canadian Healthcare” and “US Drugstore” are brands of one of the most disgusting illegal online pharmacy group well organized CRIMINAL OPERATION of all times. “GREED” is the driving force behind this operation. Don’t let them fool you. They will never send you any genuine drugs. If they ever send anything at all, it may consist of literally anything from sugar to wall plaster, and they certainly don’t care that you will endanger your health by taking those dangerous counterfeit drugs.

Behind The Online Pharmacy

Today a shadowy, transnational network of illicit drug manufacturers, traders, doctors, Web site operators, spammers and criminals makes up the online pharmacy world.

Buying Medication Online Can Be Safe

There are many options out there when it comes to buying medication online. We have looked at websites after websites. Some sites feature offshore pharmacies that do not require a prior prescription. Others feature licensed pharmacies that do require a prescription from your doctor.
Before making a purchase that can effect your health, we strongly recommend that you consult your physician & DO NOT self-medicate. Ordering medication online can be a safe, money-saving experience. When done through licensed online pharmacies that require a prescription, you can be assured that the medication you get is exactly what you need to treat your ailments.

Also See ThreatChaos

Department of Justice – Ryan Haight Act


IP address:
Host name: phamostermo32.com
phamostermo32.com is from Moldova, Republic of(MD) in region Eastern Europe

TraceRoute to [phamostermo32.com]
Hop (ms) (ms) (ms) IP Address Host name
1 77 55 35 –
2 128 99 103 xe-5-3-0.edge3.dallas1.level3.net
3 53 45 95 peer-02-xe-0-0-0.palo.twtelecom.net
4 70 99 135 ae-3-3.ebr2.losangeles1.level3.net
5 130 326 89 ae-2-2.ebr2.sanjose1.level3.net
6 283 305 155 ae-82-82.csw3.sanjose1.level3.net
7 270 102 310 –
Trace complete

Retrieving DNS records for phamostermo32.com…
DNS servers

Answer records
phamostermo32.com SOA
server: NS1.NAMERICH.com
email: guoliang@chinaspringboard.cn
serial: 2010030500
refresh: 10800
retry: 7200
expire: 3600000
minimum ttl: 3600
phamostermo32.com A 3600s
phamostermo32.com A 3600s
phamostermo32.com NS NS1.NAMERICH.com 3600s
phamostermo32.com NS ns2.NAMERICH.com 3600s

Authority records

Additional records

Whois query for phamostermo32.com…
Query error: Timed out
Network IP address lookup:

Whois query for…

Results returned from whois.arin.net:

OrgName: RIPE Network Coordination Centre
Address: P.O. Box 10096
City: Amsterdam
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: –
NetHandle: NET-195-0-0-0-1
NetType: Allocated to RIPE NCC
NameServer: NS3.NIC.FR
NameServer: SNS-PB.ISC.ORG
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 1996-03-25
Updated: 2009-03-25

RTechName: RIPE NCC Hostmaster
RTechPhone: +31 20 535 4444
RTechEmail: search-ripe-ncc-not-arin@ripe.net

# ARIN WHOIS database, last updated 2010-03-08 20:00
# Enter ? for additional hints on searching ARIN’s WHOIS database.
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html

Results returned from whois.ripe.net:
% This is the RIPE Database query service.
% The objects are in RPSL format.
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to ‘ –’

inetnum: –
netname: Evpatur
descr: Evpatur LTD
country: MD
org: ORG-EL79-RIPE
admin-c: NK539-RIPE
tech-c: NK539-RIPE
mnt-lower: RIPE-NCC-END-MNT
mnt-routes: EVPATUR-MNT
mnt-domains: EVPATUR-MNT
changed: service@evpatour.md 20090804
source: RIPE

organisation: ORG-EL79-RIPE
org-name: Evpatur LTD
org-type: OTHER
address: Komsomolskaya 10a, 3200 Bendery, Moldova
admin-c: NK539-RIPE
tech-c: NK539-RIPE
e-mail: service@evpatour.md
mnt-ref: EVPATUR-MNT
changed: service@evpatour.md 20090804
source: RIPE

person: Nikolay Kravchuk
address: Komsomolskaya 10a, 3200 Bendery, Moldova
phone: +373-821-02184
nic-hdl: NK539-RIPE
changed: service@evpatour.md 20090804
source: RIPE

% Information related to ‘’

descr: route point
origin: AS49188
changed: service@evpatour.md 20091215
source: RIPE

1st Class Recruitment – www.1stclassrecruitment.org

The Purpose of this post is to ALERT you that the job you are about to apply for or may have applied FOR or is CONSIDERING APPLYING FOR is FRAUDULENT.

These job postings are an attempt to lure you into cashing counterfeit checks and have you wire funds via Western Union or MoneyGram. Essentially You Become A Money or RePackage Mule.

The identity of an individual or entity have been stolen along with fund from their bank accounts. You are being recruited to wire transfer  these funds either by WESTERN UNION, MONEYGRAM, into your  bank, a DOMESTIC BANK or FOREIGN BANK ACCOUNT

  1. Understanding The Cyber Theft Ring
  2. Money Mule Explained
  3. Protecting Yourself Against Money Mule
  4. Washingtonpost.com by Brian Kerbs
  5. Interview With A Money Mule
  6. Bobbear.co.UK ~  Historical Money Mule Sites

Dear ScamFraudAlert,

My name is Linda Caradonna, I am the Manager of First Class Recruitment, a leading recruiting agency for home based jobs. I email you with regard to the job seeking information you have posted. I have reviewed your resume and you seem to be an appropriate candidate for the position which is currently open within one of the companies we perform our recruiting campaigns

Could you please confirm that you are still interested in employment? If
you are, please, let me know and I will get back to you with more information on the position.

Linda Caradonna
First Class Recruitment

Address lookup

canonical name www.1stclassrecruitment.org.

Domain Whois record

Queried whois.publicinterestregistry.net with “1stclassrecruitment.org”…
Domain ID:D156963983-LROR
Created On:26-Aug-2009 20:06:37 UTC
Last Updated On:26-Oct-2009 03:53:43 UTC
Expiration Date:26-Aug-2010 20:06:37 UTC

Sponsoring Registrar:Melbourne IT, Ltd (R52-LROR)

Registrant ID:C125130853280358
Registrant Name:Andrea Anderson
Registrant Organization:Private Registration US
Registrant Street1:PO Box 61359
Registrant City:Sunnyvale
Registrant State/Province:CA
Registrant Postal Code:94088
Registrant Country:US
Registrant Phone:+1.5105952002
Registrant Email:contact@myprivateregistration.com

Admin ID:C125130853280355
Admin Name:PrivateRegContact Admin
Admin Organization:Private Reg US
Admin Street1:PO Box 61359
Admin City:Sunnyvale
Admin State/Province:CA
Admin Postal Code:94088
Admin Country:US
Admin Phone:+1.5105952002
Admin Email:contact@myprivateregistration.com

Tech ID:C125130853280357
Tech Name:PrivateRegContact TECH
Tech Organization:Private Reg US
Tech Street1:PO Box 61359
Tech City:Sunnyvale
Tech State/Province:CA
Tech Postal Code:94088
Tech Country:US
Tech Phone:+1.4089162124

Tech Email:contact@myprivateregistration.com


Network Whois record

Queried whois.arin.net with “!NET-205-178-145-0-1″…
OrgName: Network Solutions, LLC
OrgID: NSL-37
Address: 13861 Sunrise Valley Drive
Address: Suite 300
City: Herndon
StateProv: VA
PostalCode: 20171
Country: US

NetRange: –
NetName: NSLLC01
NetHandle: NET-205-178-145-0-1
Parent: NET-205-178-128-0-1
NetType: Reassigned
Comment: Please use the NOC contact for 24/7 emergencies andcopy the abuse contact on phishing and abuse issues
RegDate: 2006-05-19
Updated: 2009-05-15

RNOCHandle: NOC2042-ARIN
RNOCPhone: +1-703-668-4900
RNOCEmail: noc@networksolutions.com

RAbuseHandle: ABUSE2239-ARIN
RAbuseName: Abuse
RAbusePhone: +1-703-668-4665
RAbuseEmail: abuse@networksolutions.com

OrgTechHandle: NOC2042-ARIN
OrgTechName: NOC
OrgTechPhone: +1-703-668-4900
OrgTechEmail: noc@networksolutions.com

# ARIN WHOIS database, last updated 2010-01-27 20:00

DNS records

name class type data time to live
http://www.1stclassrecruitment.org IN A 7200s (02:00:00)
1stclassrecruitment.org IN SOA
server: ns15.worldnic.com
email: namehost.worldnic.com
serial: 110011414
refresh: 10800
retry: 3600
expire: 604800
minimum ttl: 3600
7200s (02:00:00)
1stclassrecruitment.org IN NS ns16.worldnic.com 7200s (02:00:00)
1stclassrecruitment.org IN A 7200s (02:00:00)
1stclassrecruitment.org IN NS ns15.worldnic.com 7200s (02:00:00)
1stclassrecruitment.org IN MX
preference: 10
exchange: inbound.1stclassrecruitment.org.netsolmail.net
7200s (02:00:00) IN PTR vux.bos.netsolhost.com 500s (00:08:20)

— end —