Broadband Tech > Security > Scam and Phishbusters > Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

reply to garys_2k

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

quote:

---

..."Pending charge from "Atala Designs St Paul Park MN" for $11.85 on 22Dec07"...

---

..."I received a charge on my credit card from ATALA Designs for $10.65 12/12/2007. I reported it to my bank and the charge was removed and now I have to get a new card. On my account description of the charge it gave a 626 number which is Alhambra, CA but the info on my account said MN"....

---

reply to MGD
Still digging around the "Inowest" connection, so far unable to tell if they are a part of the operataion, or complicit. I cannot yet rule them out.

We have already established the firm connection, and continuation to the Devbill / digitalAge et all by way of the foreign laundering.

As stated, the version 4.5 templates funds from the hijacked cards were wired out of US banks to:

Beneficiary's Bank Name: EUROBANK PLC
Beneficiary's Bank SWIFT code: EUBKBGSF
Beneficiary's Bank Address: 43 Cherni Vrah Blvd.,
1407 Sofia, Bulgaria
Beneficiary Account: BG96PIRB91701745144579
Beneficiary Name: Inowest Enterprises Inc

We know that the fraudulent carded funds from several of the e-book sites are now wired out of US banks and routed to:

Beneficiary's bank name: ASIAUNIVERSALBANK
Beneficiary's Bank SWIFT code: ASUJK22
Bank address: 59, togolok moldo str., 720033,
BISKHEK, KYRGYZSTAN REPUBLIC
Beneficiary account: 1231128530000131
Beneficiary name: Inowest Enterprises
Beneficiary address: same as bank address

Asia Universal Bank is: »www.aub.kg/en .No coincidence that Asia Bank has several outlets in Russia, and branch offices in the Ukraine, Latvia, and Kazakhstan.

AUB does have a stated policy to counteract the laundering of illicitly-acquired funds:
»www.aub.kg/en/about/general/proiz Maybe a "heads up" is in order.

Inowest is now referenced in two webmaster forums that deal in PrOn affiliate referrals and sponsored site linking. In addition to the previous:

quote:

---

I'm getting wires but don't know which sponsors - please help!

------------------------------------------------------------

Hey

I've received a few unknown wires. Does anyone here know which sponsors they are? These are wires btw, no cheques.

Inowest Enterprises
Gioram
Kenny Media
Design Ironic

And if the owners of these sponsors see this post, can you please tell me in which country your company is based?

Thanks anyway
Maikel

---

reply to MGD
At the start, I reiterated that this syndicate has been in operation for years, and has constant access to card account data. You can journey back to seven years ago and see the "Beta", or maybe even Version 1.0 of this long running criminal operation. These reports are from 7 years ago, almost exactly to the day:

'Tis the season for credit-card heists

and:

'Egghead.com Gets Hacked

Besides, at that time, the obvious operational base was Russia, pay close attention to some of the common ingredients:

circa 2000:

quote:

---

"....MSNBC.com research has revealed that for at least the past six months, hundreds and perhaps thousands of consumers have found charges between $5 and $25 billed to their credit cards. The laundering efforts appear to involve a group Russian telecommunications and Internet companies. Since July, Net users have widely complained about charges from companies named Skiftelecom, Incomtel, Global Telecom, and Inetplat. It was not immediately clear if the Russian firms were participants or victims of the scheme.

After initial e-mail contact, Inetplat didn't respond to a request for an interview. None of the others immediately replied to e-mail.

There has been a fresh flurry of charges-at least 100-billed this week by Global Telecom and Inetplat, which appear from their Web site to be the same company......."

---

quote:

---

"....She said one of her fellow victims had received a reply from Inetplat earlier this year after complaining. In the e-mail, the company was said to reply: "Possible your credit card data was stolen by hackers and used to enter one of the sites of our clients. We refund you all the money charged from your card within one week. Please do not make chargeback within this week." .....

---

quote:

---

"....The pay system InetPlat allows services on the method to the payment through Internet of the credit maps VISA and Eurocard/Mastercard for vebmasterov of paid sites and developers of software. Relying on contemporary technologies we let us ensure reliability and safety of your electronic commerce. Hundreds of clients from the different countries of peace already are used InetPlat in their business".....

---

quote:

---

".....4 more greatly I will say, they do not work from similar lazhey EVEN nelegal'shchiki! -))) An example, there was this office as inetplat.com (recently its name it was mentioned in connection with the scandal "Russians they robbed 3 million Americans"), so they they attempted to interest in its service of russkoyazychnykh nelegal'shchikov. And those sent them. This office awaits analogous. However, however, there lie in the first proposal on the site, in the first word: THE "RELIABLE method to obtain payment into the Internet"; -))"....

---

Getting to the core issue, where/how they get the card data, ought to be front and center to the entire Mastercard/Visa/Amex industry. Seven years? Clearly the source data has been the most consistently reliable part of the scheme -- more certain than the systems for processing the charges.

It could likely be a small group of moles placed in key positions in the business. They could skim the data onto floppies/CDRs/USB drives, whatever and export it at their leisure. They could plant the malware onto the providers' servers that uploads files.

Or, maybe they can do the latter remotely -- given the number of vulnerabilities in web facing servers out there. As for the high rejection rate, that could be a key clue.

Clearly we need a much more robust method of verifying credit card transactions where the card isn't physically present. I suspect this syndicate targets the U.S. because our procedures are easier to defraud.

reply to MGD
MGD, the job you are doing is amazing!

I could become one of those cyber mules! But now they have no chance. They've hired me and I've almost set up the merchant account already. That's a big luck I've found everything out on this stage, they haven't had a chance to charge anybody through me yet!

Well, anyway.. I think I've got some interesting things that were not mentioned above and could help to trace those bastards, but I'm not sure if I should post them right here. Please e-mail me at chstpublic[at]gmail.com

reply to MGD
Updating, rooted some more out.

Another template clone:

infinitysonstemplates.com 404-474-2550 Infinity & Sons, LLC
.
That is the current phone number listed here: »infinitysonstemplates.com/help.php Charges have also shown up on statements under that name listing another number: 404-645-1736 see: »800notes.com/Phone.aspx/1-404-645-1736

quote:

---

New Jersey State
Corporate and Business
Information Reporting

Business Entity Name

NET CONNEX, INC.

Filing Number
0100708464

Code DP

---

Maybe we should start an MGD anti-scammer fund. I think that this would be an excellent idea, given MGD's value so far in shining the light on the dark corners of the Internet financial world.
--
HCN: Because you deserve a rest!

Proud member of the Free Omelas Liberation Front.

Thanks, I was just making fun, .... and to be fair to NJ, they are not alone, several states now charge to look up data.

However, I am still set on you winning that lotto.

MGD

reply to MGD
Got a charge of $10.25 on my credit card statement from December from this Acala/Atala outfit. Its interesting because I had to close out my account at end of November due to other fraud charges (2 out of Utah and 3 that, from reading weblogs of others victimized. seem to be out of St. Kitts). This Atala charge showed up on my new account but on calling credit card company was a carryover from the previous account with the other fraud charges on it. The phone number that showed up for Atala (but apparently, per credit card person, was Acala) is (626) 310-0668. I do with these credit card companies would do something more substantive regards fraudulent charges, instead of just closing down the affected account and then issuing a new account (and, in this instance, carrying yet another fraudulent charge over to new account). I can understand that it might be cost-prohibitive for them to pursue one-time small charges, but its pretty evident that all 3 fraud entities I have referenced have victimized thousands of people, collectively, to the tune of 'who knows' how much in the way of collective fraud dollars.

reply to MGD
great info ... will look out for these types of charges

reply to MGD
I just found this and thought it might be linked up to this scam

article could be found on: »www.scamclub.com/blog/2006_11_01···ive.html

Company: Finbridge Private Equity Ltd.
Moscow, Russian Federation
URL: »finbridge-pe.com/en/career

The following is an email scam I received from three different email addresses:

I am writing to inquire if you might be interested in part-time employment with our company.

FinBridge Private Equity Ltd. (FinBridge) based in Moscow, Russia is looking for energetic and committed individuals to fill the part-time receivables clerk positions in the United States. As a receivables clerk, you will be in charge of processing and facilitating investment funds transfers initiated by our US clients under the supervision of the regional receivables manager. A perfect candidate should be a strong communicator who is also comfortable with numbers and ideally has some previous book-keeping experience. College education or any administrative professional background is a plus.

No relocation is required from a successful candidate. This opening is a great opportunity for those looking for a reasonable trade-off between working hours and compensation, such as senior citizens or self-employed individuals.

FinBridge is an emerging markets fund of funds manager headquartered in Moscow, Russia. FinBridge is the general partner of the Russia Growth Fund. The Russia Growth Fund is the first region-specific closed-end fund of private equity funds to target Russia and the Commonwealth of Independent States (former Soviet Union). FinBridge is dedicated to providing investors reduced emerging market risk through broad portfolio, manager, and market segment diversification. To learn more about our company, please visit us online at finbridge-pe.com

The receivables clerk position is commission-based, and it will typically take up to 6 hours per week to fulfill your duties. You should be able to perform your duties during regular business hours.
Your core responsibility will be to receive the investment funds from our US clients into your designated bank account, reconcile the payments with your supervisor if required and transfer specified funds into our managed investment accounts. You will be in charge of contacting your bank in order to obtain transfer status information, confirmations and account activity reports, as well as handling daily communications with your bank. You will be receiving a 2% commission from the gross amount of each transfer that is remitted into your designated account (for instance, if $10,000 is credited into your account, you will be retaining a commission of $200). Your commission is available immediately, so there is no need to wait for the payroll check in the end of the month.

From the tax aspect, you will be paying your income tax, either as an individual or as a business entity, calculated as a percentage of the
commissions received for fulfilling your duties. It should be
understood that it is your sole responsibility to report your incomes to the IRS. Being a foreign legal entity, Finbridge is not subject to the US tax regulation.

You will be receiving the investment funds exclusively from our US clients via secure electronic Wire transfer used by major US banks for funds and securities settlement. This means that no funds will be deposited into your account unless the transaction is reviewed and confirmed both by the remitting and recipient banks. Thus, there is no operational risk on your end. You will never be required to cash a check, make a remittance before the funds are cleared into your account or engage in any other financially risky activity.

In order to qualify for the position, you must be a permanent US resident aged 21 and above. It is recommended that you set up a separate bank account for the receivables service (a list of preferred banks is available); however, you may also use an existing account.
Since most communication with your supervisor will be via
email/fax/phone, you should have access to these facilities and be available for communication in regular business hours. It should also be underlined that business owners utilizing business bank accounts will be subject to higher receivables turnover, and thus, higher commissions.

You can apply for the position or online at:
»finbridge-pe.com/en/career Please note that only candidates
under serious consideration will be contacted. Please use the
following vacancy code: FBUSA88.

You can also contact the HR Department by visiting us online at:

reply to Acala or Atala

reply to stae2

I was hit for 4.95 by the MYNETCONNEX awhile back. I didn't notice it because of the Holiday rush. This is the only location I could find that mentioned MYNETCONNEX in a Google search, thank you for the information.
I am also now seeing a pending charge to my card for "SITE SERVICES" which is wonderfully non-descript. I know this pending charge is fraudulent as I have been living off Christmas cash for awhile now. I guess I am going to the bank tomorrow to get a new card.

The pending charge came through and now I have a phone number. The complete detail for the transaction is "SITE SERVICES 8885909662". The transaction amount was for 9.15 in my case.

I googled the ph# and found this »800notes.com/Phone.aspx/1-888-590-9662 The person posting here reported a transaction of 9.10 and reported it as fraud. The post was from yesterday as was my charge so maybe this is a new front.

Thanks again for the information.

reply to MGD
After the Site Services transaction posted it showed a phone number. The complete description from my bank is "SITE SERVICES 8885909662". The charge was for 9.15.

I googled the ph# and found »800notes.com/Phone.aspx/1-888-590-9662 It seems at least one other person has seen this. They were charged 9.10.

Thanks again for the great information.

reply to MGD
These additional fraud sites were found while auditing various servers that are hosting the crime syndicate's websites. Now it is apparent that several of the cybermules are recruited to front multiple sites and corresponding corporations.

The Chicago, Illinois individual named Allen Ilic who fronts a website and LLC listed in a previous post, named ilicsolutions.com AKA Alen Ilic, Inc 312-235-6926 is also fronting:

ilicmaster.com AKA Website Master, Inc. 312-698-7897

Registration Service Provided By: NameCheap.com
	
Domain name: ilicmaster.com »ilicmaster.com

[ilicmaster.com IP 66.152.162.119]

Registrant Contact:
   WSM Inc
   alen ilic (alen_ilic05@yahoo.com)
   +1.7572991858
   Fax: +1.7572991858
   4950 N Marine Dr #807
   Chicago, IL 60640
   US

 ns1.hostdone.com
 ns2.hostdone.com

Creation date: 04 Dec 2007 22:45:47
Expiration date: 04 Dec 2008 22:45:47

 Entity Name  WEBSITE MASTER INC.
 File Number 66361985
 Status GOODSTANDING
 Entity Type CORPORATION
 Type of Corp DOMESTIC BCA
 Incorporation Date (Domestic)  12/04/2007
 State  ILLINOIS
 Agent Name ALEN ILIC  Agent Change Date 12/04/2007
 Agent Street Address 4950 N MARINE DR APT 807
 Agent City CHICAGO
 Agent Zip 60640  Duration Date PERPETUAL
 Annual Report Filing Date 00/00/0000  

Registration Service Provided By: NameCheap.com

Domain name: 123gettemplates.com »123gettemplates.com

[123gettemplates.com IP 66.152.162.116]

Registrant Contact:
   TTS
   Edward Murphy ()
   +1.2707787541
   Fax: +1.5555555555
   1060 Park Row North
   Atlanta, GA 30312
   US

Name Servers:
   ns1.hostdone.com
   ns2.hostdone.com

Creation date: 13 Jul 2007 19:25:07
Expiration date: 13 Jul 2008 19:25:07

Business Name History

---------------------------------------
Name Name Type
123GETITDONE, INC  Current Name
THE CHATZ FOUNDATION, INC.  PRIOR NAME

---------------------------------------
Profit Corporation - Domestic - Information

Control No.: K824503
Status: Active/Owes Current Year AR

Entity Creation Date: 6/26/1998

Jurisdiction: GA
Principal Office Address: PO BOX 311291
ATLANTA GA 31131-1291
Last Annual Registration Filed Date: 9/12/2007 11:25:40 AM
Last Annual Registration Filed: 2007

---------------------------------------

Registered Agent

Agent Name: Murphy, Edward
Office Address: 1270 CAROLINE ST STE D120-381
Atlanta GA 30307
Agent County: Fulton

---------------------------------------
Officers

Title: CEO
Name: EDWARD MURPHY
Address: 1270 CAROLINE ST STE D120-381
Atlanta GA 30307

---------------------------------------

Domain Name: HOTTEMPLATESITES.COM
   Registrar: ENOM, INC.

Registrant Contact:
   ADs LLC
   William Vanover (kevinbarnes@vpm.net)
   +1.5023717468
   Fax: +1.5555555555
   620 Q St. N.W
   Washington, DC 20001
   US

Name Servers:
   ns3.jaguarpc.net
   ns4.jaguarpc.net

Creation date: 28 Apr 2007 13:57:15
Expiration date: 28 Apr 2008 13:57:15

Organization   LLC
Organization Name:  HOT SITES LLC
State:  DC
Status:  ACTIVE
Initial Date of Registration:  6/22/2007
File No.:  L34129
Organization Type:
DOMESTIC LIMITED LIABILITY COMPANY

 Registered Agent
KEVIN PURNELL BARNES
 4905 NASH STREET, APT. 303, NE
Washington, DC 20019