?

Log in

No account? Create an account
[PUBLIC] Spam Befuddlement - The Cover Story
October 2013
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
 
Mon, Sep. 1st, 2008 10:00 am
[PUBLIC] Spam Befuddlement

So today in my Inbox when I awoke was an email:

Date: Mon, 1 Sep 2008 13:25:45 +0100
From: "Sustainable Development Scheme" <jobrecruitment@unsds.org>
Sender: unjobs.103@gmail.com
Attachment: filename=UNSDS_JOBS.pdf

POSITIONS OPEN FOR RECRUITMENT.


Its not unusual for me to get more or less cold-call emails regarding job offers, but this didn't seem to be an official UN communication. Whatever else you think of them, the UN is certainly professional in its paperwork's appearance. So I checked out the attached PDF (after a right proper virus scan -- you can never be too careful with complex document formats these days.) It was a long document -- 31 pages, with the UN seal on the header of the first page, claiming to be issued from the UN Sustainable Development Scheme (it takes little effort to discover no such organization or program exists, or appears to have ever existed. The closest is the Division of Sustainable Development, DSD, but they are based off a un.org subdomain.) To my surprise, though, the document doesn't ask for an "application fee" or "suggested donation" or anything similar -- I can only assume those come down the pike after you've responded to the address they tell you to.

The Sender label on the email showed it came from a GMail address, pretty much laying to rest any niggling concerns that we may be dealing with the Real Deal here. So I tried hitting www.unsds.org, to see what was there. Unsurprisingly, there's no webserver running on that domain. So I did a WhoIs on the domain.

Domain ID:D153228542-LROR
Domain Name:UNSDS.ORG
Created On:06-Jul-2008 09:38:27 UTC
Expiration Date:06-Jul-2009 09:38:27 UTC
Sponsoring Registrar:Advanced Internet Technologies, Inc. (AIT) (R232-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:AITOrgORG13621
Registrant Name:Stephanie . Migliore
Registrant Street1:132 Heald Street
Registrant Street2:
Registrant Street3:
Registrant City:Carteret
Registrant State/Province:NJ
Registrant Postal Code:07008
Registrant Country:US
Registrant Phone:+1.5075735264
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:rsmith5243@gmail.com 


That's gnads of steel or real incompetence right there. Even I don't publish my address and home phone number on my WhoIs listings. Of course, it entirely possible the data is bad in this case, but given the level of technical knowledge shown in other places of this "Scheme", I suspect the address is as right as rain. Checking the public listings, there is indeed a Stephanie Migliore at 132 Heald Street, Carteret, NJ, although the phone number is different (unsurprising -- 507 is in Minnesota.) There's also the question of who rsmith5243@gmail.com is, but I suspect he or she is the owner of the 507 number.

So what do I do? I suppose I could ignore the whole thing, let it drop. I could also place a phone call to Stephanie Migliore or the mysterious Registrant Phone number, and ask what exactly they thought they were doing. I could bundle up all my research and a copy of the original email and send it on to UN Legal, whom I'm sure would be very interested to know that somebody is impersonating them. The first would be the easiest, on the other hand, its Labor Day and I have nothing to do...

Tags: , , ,
Current Location: Worcester, MA
Current Mood: pissed off unamused

6CommentReplyShare

cykotek
cykotek
John
Mon, Sep. 1st, 2008 09:23 pm (UTC)

I've been known to be a blistering asshole, so I'd do all 3. Even better, call the two individuals at about 2am this morning, and claim to be in Eastern Europe.


ReplyThread
phoenix1701
phoenix1701
Brian
Mon, Sep. 1st, 2008 11:02 pm (UTC)

One thing to be careful of here... it's hard to say without seeing the rest of the mail headers, but it's totally possible that the person who sent the mail just came up with "unsds.org" on the fly, without checking to see whether it was actually registered. So the person who actually owns the domain might have absolutely no clue what's going on -- if the domain were "evilspammers.net," I'd say there might be a connection there, but "unsds" is a pretty generic acronym. Since that's the only connection between the email and the domain name, I'd say your best bet is not to contact the registrant of that domain at all (or, if you do, frame it as "someone is using your domain name for nefarious purposes"). Telling the UN, however, sounds like lots of fun. :)


ReplyThread
phoenix1701
phoenix1701
Brian
Mon, Sep. 1st, 2008 11:08 pm (UTC)

Edit to add: obviously the connection becomes a bit more meaningful if the only means of responding to the offer is to reply to the message, but I confess I didn't read the PDF. :)


ReplyThread Parent

(Anonymous)
Tue, Sep. 2nd, 2008 05:17 am (UTC)
I got the same thing in Japan

Hi all

I got this same message in Japan. I am the career counselor here and sure glad I checked for authenticity before sending out, and SURE glad someone could confirm my suspiciouns. But wow, what a lot of trouble them went to to make such an elaborate document. I got burned on something very similar about 2 months ago. Another bogus UN organization about UN Labour Programme I think. Turned out to be totally spam.

I wish people could get a life out there.


Gretchen, in Japan


ReplyThread

(Anonymous)
Fri, Dec. 31st, 2010 03:04 am (UTC)

Best article, lots of intersting things to digest. Very informative


ReplyThread

(Anonymous)
Mon, Jan. 17th, 2011 06:45 am (UTC)
painter 11

Good entry. I appreciate you for posting it. Keep up the fine blogging.


ReplyThread