Joe Wein
Fighting spam and scams
on the Internet

Home / Blog / About us
Online fraud

Email Spam Filter:
Try it for free!


Fraudulent Job offer:

Scam domain (created 2005-01-31)
The "ULTRACO S.A." job offer is part of a series of scams designed to trick third parties into assisting the criminal laundering of stolen money. It has many similarities to the and frauds. For example, the website is a copy of an existing legitimate website, with the addition of a job offer page. As in the "
Alpen Antique" scam the website is hosted by Yahoo, Inc.

See more information about this type of scam here:

Here is the message:

Dear Mr./Mrs.

We are writing you on behalf of ULTRACO S.A., well-known prestigious Swiss company which main field of operation lies in selling elite watches collections and jewelry series. We are glad to propose you interesting and highly paid job in financial sphere. At this moment we are in need of new regional financial agents whose work consists of collecting the payments from the customers from the same country and forwarding them to our companys main office. Due to our operating employees inability to handle the sales volume we decided to open additional vacancies in each European country as well as in the USA, Canada, Australia and New Zealand.
Regional financial managers are needed because we accept bank wire transfers only and as you know international wire transfer could take more than 3 or even 5 days, thus increasing term of delivery up to 5-8 days. Such long term of delivery adversely affects our sales volume that's why we provide our agent's account details to the customer who is in the same country. Bank transfer within the same country takes 1-2 days only. After we receive confirmation that the amount has been received we send purchased items to the customer immediately. These actions let us to diminish term of delivery to 3-4 days.
Please visit our webpage at to get to know our proposal in greater detail and if you are interested please send an email to and we will send you an Application Form back. If you have any questions don't hesitate to contact us at and we will reply you for sure. Thanks for reading our proposal.

Chief Executive Officer,
Jose Ansari,

The website is a rip-off of, a Swiss jewelers that has had a website since 1997. By contrast, the fraudulent domain "" was only registered a couple of days before the above spam was sent, using a postal address in the USA.

Reponse to a job application email: Compare the following portion of a reply to a job applicant for "" to a similar reply during the "" fraud: "" response:


We are glad that you are interested in our proposal. 
For beginning our collaboration we suggest you to sign 
"Digital contract". This process is quite simple - just 
fill in the following form and send it back to us. 
Within 1-2 business days we will contact you and inform 
of our reply. As usual we approve all the applications 
with the only exception if past-due loans or similar 
negative facts are disclosed during examining of your 
credit history which will be provided to us by a proper 
organization in your country. Usually we launch thorough 
verification procedure because you will be responsible 
for handling a good deal of money. Criminal records will 
be the reason for denial too. 
We engage ourselves to issue payments for your work 
(5% of each payment that has been sent to your account 
immediately after the payment is received) but only if 
the payment is successfully transferred according to our 
instructions within 12 hours since the payment is available 
on your account. If you fail to complete the specified 
operation your commission will be voided.
After the verification period (2 weeks since you have 
received the first transaction) we will send an official 
printed contract to your mailing address with our CEO’s 
signature. You position of financial manger will be 
specified in this document. The verification period is 
required for testing your abilities and disposition 
towards this work. Practice showed that it is possible 
to handle such money transferring tasks within few hours 
but sometimes candidates are not able to cope with a task 
successfully within specified deadline. Since this form is 
filled by you, it means that you engage to commit yourself 
to make proper transfers without any delay during the 12 
hours since the funds are available on your account. 
Mobile phone is also required so that you could be informed 
regarding the recent transfers efficiently.

Agent form.

1. Personal information:
Postal address:
Full name:
Age (or DOB):
Home phone number:
Cellular phone number:
Work expirience:
Current occupation:

2. Information required for making transactions:

Bank name:
Routing Number:
Account Number:
Account name:


Please try to be very attentive filling your bank account 
number, because all the payments will be sent to it in 
future and you are personally liable for its accuracy.
All the information provided to us will be used for our 
cooperation only and will not be ever disclosed to 3rd 
parties or companies with the exception of your account 
number (it will be sent to our customer’s for issuing 
payments to it). You can either open new account or use 
an existing one for receiving the payment. If you decide 
to open new account for your work, please let us know and 
we will wait for 10 banking days until new account is ready. 
Please send the filled form to our email: 
or via fax. If you prefer to send it by fax please send us 
printed form, hand-written applications won’t be accepted.

Sincerly yours,

Jose Ansari
Chief Executive Office

"" reponse:

For further cooperation we ask you to fill up the
following form. Your private information will not be
transmitted or sold to any companies, parties or
persons without your prior permission. This
registration form will be processed within a 4 days
and you'll be notified as soon as this process is
Please notice, that You are not in any way responsible
for our goods' quality and terms of its' delivery. As
soon as you have filled and sent us the form and was
notified about successful registration, you can
consider to be employed. It means that You're obliged
to proceed the transaction we'll make to your account
and make the appropriate payments within 24 hours
according to the instructions you'll be sent (with the
only exception of weekends and holidays).

Agent form.

ZIP (postal code):
First name:
Middle Name:
Last name:
Home phone number:
Cellular phone number:
Current occupation
Bank Name:

Please fill this form carefully as you're fully
responsible for the information you've submitted to
us. Payments will be made to the specified account
that's why all the information and account properties
should be provided correctly. You can use either you
existing account or open a new one. If you decide to
open a new account, please let us know and we'll be
able to wait for the new account information for 2
banking days.

As soon as the formed is filled please send it  to: .
Visit our website to get more detailed information
about our company
and this job opportunity at

Best regards,
Karl Schallmeiner,
Alpen-Antique GmbH

WHOIS details for

connected to [] ... 

Domain Name..........
  Creation Date........ 2005-01-31
  Registration Date.... 2005-01-31
  Expiry Date.......... 2006-01-31
  Organisation Name.... David Ortiz
  Organisation Address. 21673 mary dee ct.
  Organisation Address. 
  Organisation Address. Hayward
  Organisation Address. 94541
  Organisation Address. CA
  Organisation Address. UNITED STATES

Admin Name........... David Ortiz
  Admin Address........ 21673 mary dee ct.
  Admin Address........ 
  Admin Address........ Hayward
  Admin Address........ 94541
  Admin Address........ CA
  Admin Address........ UNITED STATES
  Admin Email..........
  Admin Phone.......... +1.5107543348
  Admin Fax............ 

Tech Name............ YahooDomains TechContact
  Tech Address......... 701 First Ave.
  Tech Address......... 
  Tech Address......... Sunnyvale
  Tech Address......... 94089
  Tech Address......... CA
  Tech Address......... UNITED STATES
  Tech Email...........
  Tech Phone........... +1.6198813096
  Tech Fax............. +1.6198813010
  Name Server..........
  Name Server..........

Anti-Spam Resources:
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (

Clueless virus filters spam innocent third parties
Challenge and Response spam filters: A selfish idea for selfish times spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information

Link exchange offer spam
Getting creative with spam
Link exchange spam:

Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)

"Joe job" against
Porn spam:
Porn spam:
Name servers used by spammers:
Rogue name servers:
Rogue name servers:
Rogue name servers:
Rogue name servers:

Browser hijacking:

Computer Viruses