(The quickest way to register)

Forum

  1. User picture
    • NotBuyingIt on Mon 30 Jan 2012
    • 03:20:59 PM UTC

    Mr Doug Tyrold Jr "Mystery Shopper"

    SingleHop and X10 Hosting have been remiss in not having taken down the scam running at msspausa.elementfx.com (WOT scorecard), in my opinion.

Comments:

  2. User picture
    • A440 on Thu 02 Feb 2012
    • 04:40:55 PM UTC

    RE: Mike Rupers "Mystery Shopper"

    I'm just now getting spam like this one that links back to directexpress.com:

    Received: from 211.48.62.162 (211.48.62.162)
    at KTMAIL with ESMTP Hanmir
    by ktmail2;Thu, 02 Feb 2012 00:45:35 +0900
    X-MsgID: 1328111135882212.0.ktmail2
    Message-ID: <1328111135882212.0.ktmail2@ktmail2>
    Received: from [75.145.1.241] ([75.145.1.241])
    by relay2.kornet.net ([211.48.62.162])
    with ESMTP id 2012020200:45:35:397494.800.94347
    for ;
    Thu, 02 Feb 2012 00:45:34 +0900 (KST)
    Received: from guaranty0 ([24.248.222.47]) by ppserver03.ppclub.local with Microsoft SMTPSVC(6.0.3790.3959);
    Wed, 1 Feb 2012 00:34:06 -0500
    X-RECEIVED-IP: 211.48.62.162
    From: "Direct Express"
    Subject: [SPAM] Mystrey Shopper Survey Assistant Position
    To: xxx[at]kornet.net
    MIME-Version: 1.0
    Reply-To: aaronthomasagency(at)hotmail.com
    Date: Wed, 1 Feb 2012 00:05:36 -0600
    Content-Type: text/plain
    Content-Transfer-Encoding: quoted-printable
    Return-Path: secretshopper(at)directexpress.com
    Y-Message-ID:
    X-OriginalArrivalTime: 01 Feb 2012 05:34:06.0500 (UTC) FILETIME=[1D6EE640:01CCE0A3]
    X-TERRACE-SPAMMARK: YES-__TRSYS_LV__3 (SR:-5.55)
    (SRN:spamrobot) -----------------

    Hello Sir/Ma,

    An earlier e-mail was sent to you on this matter without a reply, we h=
    ave a vacancy in our office for the post of a team player and a shoppe=
    r,if interested apply below;

    Details: Mystery-Shopper
    Salary: 400 USD Weekly
    Time: 1/2 Hrs Weekly
    Payment form: Check/Money-Orders
    If satisfied apply below:

    REQUIREMANTS NEEDED:
    Full Names:
    Full Contact Address: NOT A PO BOX
    City:
    State:
    Zip Code:
    Age:
    Home Phone:
    Cell Phone:
    Gender:
    Marital Status:
    Occupation:
    Nationality:
    Email address:

    Date__________ Signed____________________.

    Thanks for your anticipated action.And we look forward to hear back fr=
    om you.

    Very Respectfully,
    Human Resource
    Secret Shopper=AE
    Mike Rupers
    Direct Express
  3. User picture
    • g7w on Thu 02 Feb 2012
    • 05:57:33 PM UTC

    RE: Mr Doug Tyrold Jr "Mystery Shopper"

    http://www.419baiter.com/_scam_emails/09-02c/mr-david-sober-secret-shopper-job-scam.shtml

    IMO, I don't think directexpress.com has anything to do with this
    directexpress.com redirects to: ois.com
    and is based in Virginia - whois

    The originating IP is Korean: relay2.kornet.net

    The simple fact that the email did not bounce back proves they have a valid email address...

    ------- WOT Services Ltd. - gives us safety through Web of Trust. WOT Community - gives us security through unity. ∞

  4. User picture
    • A440 on Fri 03 Feb 2012
    • 06:23:06 AM UTC

    RE: relay2.kornet.net

    "g7w", thank you for your appraisal. I deleted my rating for directexpress and will direct my attention back to KRNIC, which seems to be a den of not-quite-right activities.
  5. User picture
    • NotBuyingIt on Tue 07 Feb 2012
    • 08:47:56 AM UTC

    RE: Mr Doug Tyrold Jr "Mystery Shopper"

    msspausa.mywebcommunity.org
  6. User picture
    • NotBuyingIt on Fri 10 Feb 2012
    • 03:54:46 PM UTC

    RE: Mr Doug Tyrold Jr "Mystery Shopper"

    msspa.eu.pn
  7. User picture
    • NotBuyingIt on Sat 11 Feb 2012
    • 06:11:01 PM UTC

    RE: Mr Doug Tyrold Jr "Mystery Shopper"

    The three suspicious sites which I listed in earlier posts appear to have been suspended.

    msspausa.elementfx.com : "The x10Hosting account you have requested has been suspended."
    msspausa.mywebcommunity.org : "The page you are looking for is either not existing or cannot be displayed! " (runhosting.com)
    msspa.eu.pn : "The page you are looking for is either not existing or cannot be displayed! " (runhosting.com)

    All three sites used a fraudulent HTML form which had a POST service that was provided by freedback.com. [Edit: Update: 12-February-2012] After having made several attempts to report the abuse, I received a reply that freedback has shut down the offending account.