Joe Wein
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:
jwSpamSpy
Try it for free!

Google
 

Fraudulent Job offer: jcexport.biz

Scam domain jcexport.biz (created 2004-11-29)
The "JC EXPORT" job offer is part of a series of scams designed to trick third parties into assisting the criminal laundering of stolen money. It has many similarities to the alpenantiqe.com and a-i-c-d.org frauds.

See more about this type of scam here:

Here is the message:
Hello Michael,

Unfortunately all the mail assistant position vacancies are filled by now, but we are now looking for a few people in USA for long term home based part time Monetary Asistant
position which would require higher level of responsibility but will also be more rewarding (at least $450 weekly),
and I thought that you and/or anybody who you know or your friends know who needs a good part time job and who fits
these requirements might be interested in taking this position -

- Resident of the USA (from any state)
- Is at least 21 years old
- Very responsible and dependable
- Have computer with internet at home or at work
- Have 1 hour free during the business hours

if you are interested in the position then please let me know, if this is somebodyelse who is interested in the position then that person needs to apply on our website at http://www.jcexport.biz/employment.html


Below is a description of the position:

The necessity of having this position for our company comes from the fact that we are a Europe-based (Holland) an have the major part of a profit coming from the other
countries's market, and in order to lower our high taxes here in Europe (every company is required
to pay it's taxes only in the country where it is registered and based), we, like many
other import-export companies use special marketing system the bottom line of which is
to divide the whole coming money stream into numerous smaller money streams; and in order to do this we need many bank accounts which those smaller money streams would go through and people who would control them. This is a pure marketing, it doesn't break any law of any country in any way.


You would need to:

- have one or more bank account(s) in any major US bank(s) (small country banks are not good), can be newly opened or not

- report everyday bank activity related to the company (although of course I would be notifying you in advance every time any money transaction occurs)

- 2 to 4 times a week to do money transfers following the instruction I would be giving you


The bottom line is:

- some company's money will be going to your account(s) every 1-2 days and you will be responsible for transfering it to the company

- the monthly total amount going through one account would be $20.000 - $25.000

- company will be covering all possible bank's fees

- the salary for this position per one bank account you can provide the company with is $450 in cash weekly paid every week by direct deposit starting the day when the account's first bank transaction occurs

- you can work with up to 3 accounts




Thank you.

David

Project Manager
JC EXPORT

NL-4670 AA Dinteloord
Markwegzuid 2a
NL-4794 SN Heijningen
Tel.: +31 - 167 - 523910
Fax: +31 - 167 - 523218

Here are the message headers:

Received: from [200.162.115.199] (helo=200.162.115.199)
	by #####.##########.### with smtp (Exim 4.43)
	id 1CZxwd-0006MN-Jx; Thu, 02 Dec 2004 21:52:56 +0100
Message-ID: <0645435799.6ZTLBH7ud@antronomia.com>
Received: from 92.180.30.80 by t947-d57.x4.antronomia.com with DAV;
	Thu, 02 Dec 2004 15:39:12 -0600
Reply-To: "JC EXPORT, Jayson Rollins" <Angel@nctta.org>
From: "JC EXPORT, Jayson Rollins" <Angel@nctta.org>
To: <recipientemailaddr>
Subject: Re: your ad
Date: Thu, 02 Dec 2004 19:43:12 -0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="--2121040298303784"

Notes:

  • Why is the "From" address not the email address of the company?
  • Why is this job offer from a Dutch company sent from Brazil?
  • Why is the mail addressed to "Michael" when that wasn't the recipient's name?
  • The website of "jcexport.biz" is a complete copy of "anaexport.com", another website existing since August 2003. Go ahead and compare the two. Also take a look at orchidbeautiful.com (odd name, isn't it?), which looks very similar and may be a precursor to jcexport, as it's WHOIS address also doesn't match the claimed business address:
  • Domain jcexport.biz was only registered 4 days ago (2004-11-29). That's a bit recent for a seven year old company.
  • While this claims to be a Dutch company, the registration details from the WHOIS record uses an address in the US. It is probably phony.

jcexport.biz is a fraud!

This is a similar scam to the "Plasma project, Inc.", "Alpen-Antique GmbH", Lionder.org and "AIC" job scams.

As we recently found out, the objective of the "Alpen-Antique GmbH" fraud was to trick people into making money stolen from hacked bank accounts untraceable by receiving it in their own account, withdrawing it in cash and then forwarding it via Western Union. Most likely, "JC Export" will steal money from hacked US bank accounts in the near future and is looking for people to unwittingly assist them. Quite possibly organized crime from Eastern Europe is behind this scam: Lionder.org posed as a Lithuanian company, "Alpen-Antique GmbH" supplied an Estonian name for the wire transfer recipient and "AIC" claims to run billboards in Russia.

As with the "Plasma project, Inc." and "Alpen-Antique GmbH" scams, the fraudulent website is based on the site of a legitimate company. In these scams the fraudulent website keeps getting recycled under new names. We expect jcexport.biz to resurface under a new name.

Compare the original:

Founded in Bakersfield, California in 1997, ANA Export Company has rapidly become one of the leading wholesale suppliers of premium orchids, fresh fruits, and organic pomegranate concentrate throughout North America and Asia. Today, ANA has a worldwide team of growers, packers, shippers, and employees committed to consistently providing the highest quality products at the most competitive prices.
http://www.anaexport.com/wst_page2.html

with this rip-off:

Founded in Deventer, Holland in 1997, JC Export Company has rapidly become one of the leading wholesale suppliers of premium orchids, fresh fruits, and organic pomegranate concentrate throughout Europe and Asia. Today, JC has a worldwide team of growers, packers, shippers, and employees committed to consistently providing the highest quality products at the most competitive prices.
(http://www.jcexport.biz/wst_page2.html)

ANA Export Company
Is ANA Export Company a legitimate original company whose website was ripped off or is it a previous incarnation of the fraud? We would like to know. When we called ANA Export Company's phone number, we only got recorded message, no live switchboard. An email we sent to their main email address bounced because the mailbox was full. The online order page of the site says "SOLD OUT" for all items listed (see http://www.anaexport.com/wst_page4.html). A phone directory lookup for "ANA EXport Company" in Bakersfield, CA found no matches. There are however a number of links to the site at horticultural sites. Archive.org holds some copies of their site from September and November 2003 and another one from 2004-02-08, but no changes after that.

Orchidbeautiful.com / Umina Brothers Inc.
Umina Brothers Inc. is a real produce business. The "Produce" link at Orchidbeautiful.com leads to the Umina.com website, all other links lead to Orchidbeautiful.com. Probably Orchidbeautiful.com was built using bits of the genuine Umina.com website.

Just like our customers, we at ANA have high standards. All of our products are cultivated, shipped, and distributed in order to ensure maximum quality and freshness.
http://www.anaexport.com/wst_page2.html

Just like our customers, we at Umina Bros. have high standards. All of our products are cultivated, shipped, and distributed in order to ensure maximum quality and freshness.
http://www.orchidbeautiful.com/about%20umina.htm

Just like our customers, we at AU have high standards. All of our products are cultivated, shipped, and distribute in order to ensure maximum quality and providing superior product at a competitive price delivered promptly at your door.
http://www.auinternational.com/managementvisions.htm

Network of sending IP address 200.162.115.199:

     inetnum:     200.162.115.192/27
     aut-num:     AS15180
     abuse-c:     GMC9
     owner:       Galvani Indústria, Comércio e Serviços Ltda
     ownerid:     000.546.997/0001-80
     responsible: Juliano Sanches
     address:     Av. Prof.Benedicto Montenegro, 1300, Betel
     address:     13140-000 - Paulinia - SP
     phone:       (019) 3884-3900 [3993]
     owner-c:     GIS85
     tech-c:      GIS85
     created:     20031028
     changed:     20031028
     inetnum-up:  200.162.0/17
     
     nic-hdl-br:  GIS85
     person:      Galvani Industria, Comercio e Servicos
     e-mail:      jsanches@GALVANI.IND.BR
     address:     Av.Prof.Benedicto Montenegro, 1300, Betel
     address:     13140-000 - Paulinia - SP
     phone:       (019) 3884-9300 [9397]
     created:     20001120
     changed:     20020514
     
     nic-hdl-br:  GMC9
     person:      Gustavo Mendes de Carvalho
     e-mail:      gcarvalho@DIVEO.NET.BR
     address:     Rua Tenente Negrao, 166, 1. andar
     address:     04530-030 - Sao Paulo - SP
     phone:       (11) 30482500 [2561]
     created:     19981005
     changed:     20040329
     
     remarks:     Security issues should also be addressed to
     remarks:     nbso@nic.br, http://www.nbso.nic.br/
     remarks:     Mail abuse issues should also be addressed to
     remarks:     mail-abuse@nic.br
      
     % whois.registro.br accepts only direct match queries.
     % Types of queries are: domains (.BR), BR POCs, CIDR blocks,
     % IP and AS numbers.

WHOIS record for jcexport.biz

     Domain Name:                                 JCEXPORT.BIZ
     Domain ID:                                   D8323371-BIZ
     Sponsoring Registrar:                        NETWORK SOLUTIONS INC.
     Sponsoring Registrar IANA ID:                2
     Domain Status:                               clientTransferProhibited
     Registrant ID:                               38752551
     Registrant Name:                             Milton Lopez
     Registrant Address1:                         277 Summer Street
     Registrant City:                             PASSAIC
     Registrant State/Province:                   NJ
     Registrant Postal Code:                      07055
     Registrant Country:                          United States
     Registrant Country Code:                     US
     Registrant Phone Number:                     +1.9732499954
     Registrant Email:                            dhoffman_jcexport@yahoo.com
     Administrative Contact ID:                   38752551
     Administrative Contact Name:                 Milton Lopez
     Administrative Contact Address1:             277 Summer Street
     Administrative Contact City:                 PASSAIC
     Administrative Contact State/Province:       NJ
     Administrative Contact Postal Code:          07055
     Administrative Contact Country:              United States
     Administrative Contact Country Code:         US
     Administrative Contact Phone Number:         +1.9732499954
     Administrative Contact Email:                dhoffman_jcexport@yahoo.com
     Billing Contact ID:                          450287
     Billing Contact Name:                        Invoice Processing System
     Billing Contact Organization:                Invoice Processing System
     Billing Contact Address1:                    3250 West Commercial Blvd #200
     Billing Contact City:                        Ft. Lauderdale
     Billing Contact State/Province:              FL
     Billing Contact Postal Code:                 33309
     Billing Contact Country:                     United States
     Billing Contact Country Code:                US
     Billing Contact Email:                       netsolnotify@affinity.com
     Technical Contact ID:                        5362153
     Technical Contact Name:                      ValueWeb
     Technical Contact Organization:              ValueWeb
     Technical Contact Address1:                  3250 west commercial Blvd.
     Technical Contact Address2:                  **
     Technical Contact City:                      Ft Lauderdale
     Technical Contact State/Province:            FL
     Technical Contact Postal Code:               33309
     Technical Contact Country:                   United States
     Technical Contact Country Code:              US
     Technical Contact Phone Number:              +1.9543348000
     Technical Contact Facsimile Number:          +1.9543348001
     Technical Contact Email:                     hostmaster@VALUEWEB.NET
     Name Server:                                 DNS1.VALUEWEB.COM
     Name Server:                                 DNS2.VALUEWEB.COM
     Name Server:                                 DNS3.VALUEWEB.COM
     Created by Registrar:                        NETWORK SOLUTIONS INC.
     Last Updated by Registrar:                   NETWORK SOLUTIONS INC.
     Domain Registration Date:                    Mon Nov 29 21:01:11 GMT 2004
     Domain Expiration Date:                      Tue Nov 28 23:59:59 GMT 2006
     Domain Last Updated Date:                    Mon Nov 29 21:01:19 GMT 2004


jtexport.biz - the sequel

The "jcexport.biz" scam appears to have been revived using a new domain, "jtexport.biz". We came across the following spam on an list archive dating from January 2005. This spam uses exactly the same subject line as the earlier "jcexport.biz" job offer scam:

From: David Hoffman <hr@jtexport.biz>
Subject: Re: your ad

We received the following report about it (early February 2005):

I just wanted to write and thank you and update you
about a money laundering scam I found out about on
your website.  I saw a job advertised on a website
looking for people to doing mailing for a company
called JT Export.  I applied and was 'accepted' for
the job.  They told me that they would send me
envelopes and postage and all I had to do was print
out a letter they emailed me and send it out to
everyone on the mailing list they also sent me.  They
said they would deposit $250 in my account every week
and asked for my bank account information.  I was
suspicious from the start, but they had a website that
looked legitimate.  Well, it got more suspicious when
they claimed they mailed me 500 envelopes and other
supplies that never arrived.  When I emailed them
about this, they did not reply.  Then today I went to
check their website again, it was gone!  By searching
on the internet, I managed to find your webpage -
www.joewein.de/sw/fraud-jcexport-biz.htm 
which described this company that I was dealing with
exactly - except they changed from JC Export to JT
Export.  

We doubt this will be the last scam following this scheme.

WHOIS details for jtexport.biz

Request: jtexport.biz

Domain Name:                                 JTEXPORT.BIZ
Domain ID:                                   D8493739-BIZ
Sponsoring Registrar:                        TLDS INC.
Sponsoring Registrar IANA ID:                320
Domain Status:                               clientTransferProhibited
Registrant ID:                               5581430-SRSPLUS
Registrant Name:                             David Tsai
Registrant Organization:                     TsaiCo
Registrant Address1:                         330 San Miguel
Registrant City:                             Arcadia
Registrant State/Province:                   CA
Registrant Postal Code:                      91007
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.5218518834
Registrant Email:                            admin@web2mail.com
Administrative Contact ID:                   5581431-SRSPLUS
Administrative Contact Name:                 David Tsai
Administrative Contact Organization:         TsaiCo
Administrative Contact Address1:             330 San Miguel
Administrative Contact City:                 Arcadia
Administrative Contact State/Province:       CA
Administrative Contact Postal Code:          91007
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.5218518834
Administrative Contact Email:                admin@web2mail.com
Billing Contact ID:                          5581431-SRSPLUS
Billing Contact Name:                        David Tsai
Billing Contact Organization:                TsaiCo
Billing Contact Address1:                    330 San Miguel
Billing Contact City:                        Arcadia
Billing Contact State/Province:              CA
Billing Contact Postal Code:                 91007
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.5218518834
Billing Contact Email:                       admin@web2mail.com
Technical Contact ID:                        5581432-SRSPLUS
Technical Contact Name:                      David Tsai
Technical Contact Organization:              TsaiCo
Technical Contact Address1:                  330 San Miguel
Technical Contact City:                      Arcadia
Technical Contact State/Province:            CA
Technical Contact Postal Code:               91007
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +1.5218518834
Technical Contact Email:                     admin@web2mail.com
Name Server:                                 NS1.VHOSTED.BIZ
Name Server:                                 NS2.VHOSTED.BIZ
Created by Registrar:                        TLDS INC.
Last Updated by Registrar:                   TLDS INC.
Domain Registration Date:                    Fri Dec 17 02:45:21 GMT 2004
Domain Expiration Date:                      Fri Dec 16 23:59:59 GMT 2005
Domain Last Updated Date:                    Fri Dec 17 03:06:04 GMT 2004


The scam continues: jtexport.org (created 2004-12-27)
This was basically a re-run of jtexport.biz but using a slightly different domain that had been registered 10 days later. This one uses an address in Kazakhstan, Central Asia, a former soviet republic.

Here is an email from the criminals:

Dear friend,

Thank you for your interest in the Mail Assistant position in our 
company.
Please find more info regarding the position below.

Position requirements:
Only dependable and responsible people need to apply.
- computer connected to the internet
- any standart printer
- USA resident
- Adult people only
- 2 hours a day to contribute

Job description:
Person who will be accepted for this job will follow these 
instructions:
1. Receive the correspondence for our company to his/her USA 
residential address;
2. Report to our manager by email(every candidate will be included in 
manager's lists).
3. Fill the forms and papers if it is needed.
4. Sort the documents in the way it is needed.
5. Stuff the envelopes if it is nedeed.
5. Ship it out. (All the postages are prepaid by the company)
(you will be receiving an e-mail with detailed instruction for every 
peace of mail)

There would be only envelopes with documents only, NO packages.
There would be 60-80 envelopes received by you every week.

You would be expected to work about 2 hours a day.

All postages ARE prepaid by the company, NONE of the money would come 
from your pocket.

You would be paid every week on Monday in the exact amount of $250 by 
direct deposit to your bank account.

If you are still interested in the position please fill out the form on 
our website at http://www.jtexport.org/employment.html
Our manager will contact you soon with a confirmation letter if 
approved.

We are an export company based in Holland. More info about the company 
at our website (under repair till Jan 14th but you can still fill out 
the app.)

Thank you,

Michael Edenets

Project manager
JT Export

NL-4670 AA Dinteloord
Markwegzuid 2a
Heijningen
(31167)523910

WHOIS details for jtexport.org

Domain ID:D105485440-LROR
Domain Name:JTEXPORT.ORG
Created On:27-Dec-2004 05:28:28 UTC
Last Updated On:28-Jan-2005 12:49:14 UTC
Expiration Date:27-Dec-2005 05:28:28 UTC
Sponsoring Registrar:OnlineNIC Inc. (R64-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:ONLC-1491521-4
Registrant Name:Dmitriy  Davydenko
Registrant Organization:Dmitriy  Davydenko
Registrant Street1:mik-on 6-4-39
Registrant Street2:mik-on 6-4-39
Registrant Street3:
Registrant City:Karaganda
Registrant State/Province:KZ
Registrant Postal Code:470032
Registrant Country:KZ
Registrant Phone:+7.3003770611
Registrant Phone Ext.:1111
Registrant FAX:+7.3003770611
Registrant FAX Ext.:
Registrant Email:dweb@dweb.ru
Admin ID:ONLC-1491521-1
Admin Name:Dmitriy  Davydenko
Admin Organization:Dmitriy  Davydenko
Admin Street1:mik-on 6-4-39
Admin Street2:mik-on 6-4-39
Admin Street3:
Admin City:Karaganda
Admin State/Province:KZ
Admin Postal Code:470032
Admin Country:KZ
Admin Phone:+7.3003770611
Admin Phone Ext.:1111
Admin FAX:+7.3003770611
Admin FAX Ext.:
Admin Email:dweb@dweb.ru
Tech ID:ONLC-1491521-2
Tech Name:Dmitriy  Davydenko
Tech Organization:Dmitriy  Davydenko
Tech Street1:mik-on 6-4-39
Tech Street2:mik-on 6-4-39
Tech Street3:
Tech City:Karaganda
Tech State/Province:KZ
Tech Postal Code:470032
Tech Country:KZ
Tech Phone:+7.3003770611
Tech Phone Ext.:1111
Tech FAX:+7.3003770611
Tech FAX Ext.:
Tech Email:dweb@dweb.ru
Name Server:NS1.MASTERHOST.RU
Name Server:NS2.DNS-DIY.COM
Name Server:NS1.DNS-DIY.COM
Name Server:NS1.DJEMBO.COM
Name Server:


Anti-Spam Resources:
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)

Clueless virus filters spam innocent third parties
Challenge and Response spam filters: A selfish idea for selfish times

ShareYourExperiences.com spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information

Link exchange offer spam
Getting creative with spam
Link exchange spam: allcarpictures.com

Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)

"Joe job" against joewein.de
Porn spam: watchsound.com
Porn spam: hotsalza.com
Name servers used by spammers: joker.com
Rogue name servers: mediadreamland.com
Rogue name servers: airmaramba.biz
Rogue name servers: bonafidecash.com
Rogue name servers: maileasy.biz

Browser hijacking: heretofind.com

Computer Viruses