Ebook websites, fraud charges, Devbill/DigitalAge/Pluto in Spam, Scam and Phishbusters

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 29 Aug 2008 17:43:42 EDT

said by CCM :

Here is a site I have not seen mentioned. Aloha Guys Technologies. I had fraudulent charges on my CC. I have since cancelled the card and gotten a new one from my CC Company.

You missed it. Posted on 06-07-2008 by MGD

Ag-webtechnologies.com AKA Aloha Guys Technologies, LLC 208-209-5198
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 29 Aug 2008 17:36:01 EDT

anon : Here is a site I have not seen mentioned. Aloha Guys Technologies. I had fraudulent charges on my CC. I have since cancelled the card and gotten a new one from my CC Company.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 14:41:32 EDT

Doctor Olds : Money makes the less bright ones 100% blind it seems. :uhh: They can't be breaking the law because the money is just so good and they really don't have to work at anything but transferring the 90% overseas, I just hope they get caught soon to stop the monthly damages.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 14:35:36 EDT

anon : It's amazing that it's not easier to catch the mules.
I can also see why the mule scoffed at MGD.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 14:24:15 EDT

Doctor Olds :

said by Whip412 :

So are these mules actually getting paid for this and is it the 10% as promised or are the scammers scamming the mules also?

I guess they have to be making something to warrant 6/8 sites up and running.

Yes, the mules get their 10% take of the stolen credit card funds and I hope there is a special place in Hell for the mules that are running multiple sites. :mad:
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 13:45:05 EDT

anon : So are these mules actually getting paid for this and is it the 10% as promised or are the scammers scamming the mules also?

I guess they have to be making something to warrant 6/8 sites up and running.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 03:35:36 EDT

MGD :

said by TNTYCOON :

... Thank you MGD for all your hard work! I'm so glad I ran across this site, and happy that I'm "obsessive" about reviewing my bank account on a daily basis!!

Hi , and you are welcome. Yes, being "obsessive" is almost a requirement when it comes to reviewing your statements. It is also important to validate the small charge amounts. Any charge, no matter how trivial, that is confirmed as fradulent, mandates that the card be canceled and replaced, as the account data has been compromised. Alert victims who catch this fraud on the first go around, really help in getting the word out.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 27 Aug 2008 03:18:23 EDT

MGD :

said by garys_2k :

said by MGD :

Chalk a second fraud operation up to Mr. JORGE IVAN ALDAY of El Paso,TX.
...

That's why I have no sympathy for the mules. Sure, a few of them may have no idea what's going on, at least at first. But others have to know what the game really is when they keep at it despite constant chargebacks.

Yes, that is true, and there are some really off the spectrum examples of that. Mike Allison from Texas, of Mobileglobus.com »Re: [Credit Card Fraud] fraud: www.prophotosland.com & www.phot He was contacted and he said that he had 6 domains running. He was told verbally that he was fronting a card fraud laundering operation and was subsequently sent proof, and he refused to acknowledge it.

So far though, the number one spot on the chart goes to the Arizona mule of MCA and ULC fame. They total 8 domains between 09/2007 thru 05/2008, some of which I have yet to post. The "duped sticker" peeled off that one long ago.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 22 Aug 2008 21:50:11 EDT

TNTYCOON : woops.. I forgot to login ;)

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 22 Aug 2008 21:43:14 EDT

anon : I have also received an unauthorized transaction from Daye Traffic, LLC for $4.95. I called the bank, closed the card. I still have to wait for the charge to post to file a claim to get it refunded.

In the meantime, upon finding numerous complaints in several forums I have filed a complaint with my state attorney general, the Nebraska attorney general (where this company's phone number is originating from) and the Internet Crime Complaint website.

I will be back on the phone with my bank as soon as this hard hits my account to have it reversed.

In addition, I too have tried contacting this number and only receive a voicemail providing a mailbox #, no name or company name.

Thank you MGD for all your hard work! I'm so glad I ran across this site, and happy that I'm "obsessive" about reviewing my bank account on a daily basis!!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 22 Aug 2008 19:11:38 EDT

garys_2k :

said by MGD :

Chalk a second fraud operation up to Mr. JORGE IVAN ALDAY of El Paso,TX.
...

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 22 Aug 2008 01:37:27 EDT

MGD : mae_aa419 has located the first targeted recruiting record of the organized crime syndicate's ongoing UK operation. Based on the recent modus operandi of the US operation, it was suspected that they had also switched to targeted recruiting in the UK also.

The mass Jobs posting of the infobite campaign appears to have switched to stealth mode, apparently from the belief that this can be sustained for longer. However, if that scenario is correct, it leaves the fact that they created 16 cloned fraud Alfacor domains unexplained. In the mass posting infobite campaign domains would have been burned up and needed quick replacements.

In this copy of a targeted recruiting email, the criminals stated to the victim that they located the CV on the UK job site JOBSITE DOT UK »www.jobsite.co.uk/index.html

AlfaCorInc@calypso.burtonhosting.com

Subject: AlfaCor Inc: Motivated, ambitious people are wanted at AlfaCor Inc.

Hello,

We came to know your resume while searching at JOBSITE DOT UK.
After a consideration, we decided that your candidacy might be a good fit for one of the open positions we currently have listed in our company - position of Sale Representative.

At first, I would like to introduce our company to you.
Company AlfaCor Inc. was established back in 1989 in Tallinn, Estonia.
The main focus of our company lies in the following fields: IT field, Software development, advanced IT Technologies.
At the present moment, we are interested in expansion of our business to UK market.
In order to do so, we are seeking for Sales representatives in UK.

The products that we are promoting to a new market are the following:
- Software - Antivirus, Anti Spam program, Office applications
- Decisions to design - design ready, ready websites.

Every our product is exclusive and been thoroughly tested to meet worlds' standards before it can be introduced to a new market.
Mind you that extensive knowledge in IT field is not needed.
All the required information for work will be provided by our managers.
The information is very accessible and anybody, even people who are not involved in IT technology, would be able to understand the concept without any difficulties.

If you are not sure that you are capable of doing this type of work, all I'm asking you is to consider this opportunity and give it a shoot.
We, from our side, can guarantee to provide a fill support.
The main qualities we are looking for this position are the following: responsibility, skills for fixing task problems in a timely manner, motivation to outperform and grow every day.

The monthly salary is around 1,500-2,000GBP (with daily payouts).

Also, I would like to emphasize that this job can be considered as a part time position.
In this case, we would need to collaborate with you and work on your current schedule so that we can create a timetable which would benefit both sides.

Another note: this job doesn't require relocation to Estonia. All the work process will be organized through communication with our managers.

If you find this offer interesting, please fill out the application that you can find on our website :

>http://www.alfacorsoftware.biz/careers.php@p=27

Once we receive your application, one of our managers would reach you within 24 hours.

Sincerely,
HR Manager,
Ekaterina Lonn.
AlfaCor Inc. Estonia, 2008.

Ref:»homepage.ntlworld.com/farrago21/···70el.htm

Note that the path /careers.php@p=27 is identical to the previous Infobite links.

So far, the recovered AlfaCor Inc documents only list one UK merchant account provider PROTX.COM. We know from the previous massive UK fraud operation that the criminals also use SecPay.net.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 21 Aug 2008 04:54:56 EDT

MGD : Chalk a second fraud operation up to Mr. JORGE IVAN ALDAY of El Paso,TX. Jorge first came to light as the LLC owner for: SYNERGETIC-DESIGN.COM AKA SYNERGETIC EXPERTS LLC 915-986-9428 Posted: HERE and HERE

His second venture is:

synergeticgames.com AKA Synergetic Games LLC 915-613-5482

Snapped 2008-08-21 04:38:07

»synergeticgames.com

This time the contact us page only lists "El Paso, TX 79901"

[att=1]

Two examples of the fraud complaints from the blog:

quote:
Author: Chas
Comment:
I also just disputed a second charge from SYNERGETIC GAMES LLC for $4.95. (The first one was SYNERGETIC EXPERTS LLC, for $6.95, about three months ago).

The credit card has only been used at only one online vendor, Aircraft Spruce and Specialty, Inc., and it hasn't left my desk drawer since I got it.

The bank cheerfully credited my account both times, but after the second phony charge, I canceled it and got a new card.

There's a special place in h*ll for the people who perpetrate this kind of scam.

and

quote:
Author: Aa (Aaron)
Comment:
And it continues... I believe this makes 4 charges now on this card.
SYNERGETIC GAMES LLC 915-6135482 TX ($4.95)

Seems they altered their name a bit, and got a new phone number.

And yes I know I should cancel this card, but I'm leaving it open just to see how many times they try this.

Ref:»www.cjupin.com/2007/09/13/credit···rketcom/

A cloaked domain registration this time around:


Domain name: synergeticgames.com
 
Administrative Contact:
   Whois Privacy Protection Service, Inc.
   Whois Agent (dkmchrnd@whoisprivacyprotect.com)
   +1.4252740657
   Fax: +1.4256960234
   PMB 368, 14150 NE 20th St - F1
   C/O synergeticgames.com
   Bellevue, WA 98007
   US
.
Creation date: 04 Jun 2008 21:22:03

MGD

Infobite, ..... take two !!

Wed, 20 Aug 2008 05:30:42 EDT

MGD : First it was the fraud clones of effectivesoft.com »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto that were uncovered as the method used to recruit the cyber-mule for BestTech Solutions, Technologies and Design LLC AKA BST-DESIGN.COM, 660-616-4931

That was followed by mae_aa419 and the investigation at aa419.org which uncovered the syndicate's massive UK Infobite recruiting operation for the strawberry domains: »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Even though the publicity and active targeting led to the quick demise of Infobite, it was obvious that the UK division was not going to fade away. After all, it is the unfettered access to millions of card data accounts that drives this engine. Knowing that fact the aa419.org group kept their ears to the ground. Recently music man lifted the lid off the early stages of the UK Infobite replacement operation. mae_aa419 then uncovered an entire group of 21 derivative fraud sites under the "ALFACOR" monilker: »forum.aa419.org/viewtopic.php?t=26443 database entires: »db.aa419.org/fakebankslist.php?p···rchtype=

Once again, and for the third time, the ALFACOR group are a frauduelnt clone of another Eastern European Software developer called ScienceSoft Inc »scnsoft.com

[att=4]

ScienceSoft Inc scnsoft.com list an address in Belarus:

quote:
Contact Us
Headquarter

Mailing Address:
ScienceSoft Inc.
3rd Floor, 2 Bedy Str.,
Minsk, 220040, Belarus
Phone: +375 (17) 293 3736
+1 (619) 822 2935
Fax: +1 (617) 249 0477

[att=6]

The 16 fraudulent Alfacor clones:

[att=5]
»alfacorsoftware.com

All list an address in Estonia:

quote:
Contact Us
Headquarter

Mailing Address:
AlfaCor Inc.
3rd Floor, 23 Toompuiestee Str.,
Tallin, 10137, Estonia
Phone: +372 712 3373
+372 616 6732
Fax: +372 616 6732

[att=7]

The criminals forgot to remove the reference to "Infobite" from the reformulated "Alfacor" FAQ document in the careers section.

[att=1][att=2][att=3]

The 16 identical cloned sites cover a range of domain names:

alfacoronline.com
alfacoronline.org
alfacoronline.info
alfacoronline.biz
alfacoronline.net

alfacor-software.biz
alfacor-software.com
alfacor-software.net
alfacor-software.org

alfacorsoftware.info
alfacorsoftware.net
alfacorsoftware.org
alfacorsoftware.biz
alfacorsoftware.com

alfacorsoft.net
alfacorsoft.com
.
.
alfacoronline.com

Snapped 2008-08-20 00:45:19

»alfacoronline.com

alfacoronline.org

Snapped 2008-08-20 00:45:01

»alfacoronline.org

alfacoronline.info

Snapped 2008-08-20 00:44:38

»alfacoronline.info

alfacoronline.biz

Snapped 2008-08-20 00:44:20

»alfacoronline.biz

alfacoronline.net

Snapped 2008-08-20 00:44:03

»alfacoronline.net

alfacor-software.biz

Snapped 2008-08-20 00:43:45

»alfacor-software.biz

alfacor-software.com

Snapped 2008-08-20 00:43:27

»alfacor-software.com

alfacor-software.net

Snapped 2008-08-20 00:43:09

»alfacor-software.net

alfacor-software.org

Snapped 2008-08-20 00:42:49

»alfacor-software.org

alfacorsoftware.info

Snapped 2008-08-20 00:42:26

»alfacorsoftware.info

alfacorsoftware.net

Snapped 2008-08-20 00:42:04

»alfacorsoftware.net

alfacorsoftware.org

Snapped 2008-08-20 00:41:46

»alfacorsoftware.org

alfacorsoftware.biz

Snapped 2008-08-20 00:41:28

»alfacorsoftware.biz

alfacorsoftware.com

Snapped 2008-08-20 00:41:10

»alfacorsoftware.com

alfacorsoft.net

Snapped 2008-08-20 00:45:58

»alfacorsoft.net

alfacorsoft.com

Snapped 2008-08-20 00:45:40

»alfacorsoft.com

Though some UK cyber-mules have already been detected setting up LTD companies, this new group appears to have been uncovered at an early stage of operation. They have already altered their tactics to avoid detection, and do not appear to be spamming EU jobsites. They also are recruiting by quietly trolling multiple EU job sites and targeting posted CVs.

Some of the card billing sites currently in production for this Alfacor fraud operation are:

degpic.net Degrace Global Services Ltd AKA Design Creative Bureau

Snapped 2008-08-20 04:04:50

»degpic.net

Snapped 2008-08-20 04:04:34

»degpic.net/index.php?feedback=yes

[att=8]

EDIT= The flash design does not show up in the Siteshot image, added:

24graph.net AKA Euro Universal Ltd

[att=9]

Snapped 2008-08-20 04:04:18

»24graph.net/

Snapped 2008-08-20 04:04:03

»24graph.net/index.php?feedback=yes

unopic.net AKA O-bis Consulting Ltd

[att=10]

Snapped 2008-08-20 04:03:45

»unopic.net

Snapped 2008-08-20 04:03:29

»unopic.net/index.php?feedback=yes

Note the "Richard Nixon" and "Sharon Stone" c/o the Queen, domain registrations, courtesy of the ever helpful EST Domains:

quote:
Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217

Domain Name: UNOPIC.NET

Registrant:
Concrete Industries Ltd
Richard Nixon (pg@hightechmail.biz)
12 avenue, 22-41
Washington
District of Columbia,109882
US
Tel. +001.9843323329

Creation Date: 30-Jul-2008
Expiration Date: 30-Jul-2009

------------------------------

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: »www.estdomains.com

Domain Name: 24GRAPH.NET

Registrant:
Direct Access Inc
Sharon Stone (steve.parcell@ibm-london.com)
London, Bukingham Palace, 92-12
London
London,37238
GB
Tel. +004.4339293384

Creation Date: 30-Jul-2008
Expiration Date: 30-Jul-2009

Domain servers in listed order:
ns2.24graph.net
ns1.24graph.net

There are also great write ups on the "Alfacor" operation at: bobbear.co.uk »www.bobbear.co.uk/alfacoresoftware.html

and also on scamfraudalert.com »www.scamfraudalert.com/f19/alfac···m-14052/

As noted in both the aa419.org database and on bobbear, the alfacor group are all registered via EST DOMAINS, and hosted with the Moscow, Russia, provider Wahome Networks / wahome.ru / WAHOME-DEDIC. I believe there is a stragler website hosted on the Russian provider McColo.

Apparently this time around, the crime syndicate took preemptive action by seeding Google in advance with "alfacor" forum posts, in order to bury any future fraud alerts. »www.google.com/search?hl=en&q=al···e+Search

MGD
EDIT = ~~corrected alfacor total fraud domains from 16 to 21, added link to aa419 write up~~ Corrected and removed duplicate entries, the Total Alfacor fraud domains is 16.

Re: VALL-JRSX, VIN-DESIGN, E NAT, PARADISE WEB

Wed, 20 Aug 2008 02:09:43 EDT

MGD : Cyber-mule arrested and charged, ... sometimes it can take a while!.

As part of the expose on the VALL-JRSX, VIN-DESIGN, E NAT, PARADISE WEB, et all, American Express card fraud. That was the division centered around the Russian expatriate community in the Sacramento County, CA., and surrounding area. Back on January 16th 2008, I posted regarding how this specific modus-operandi of AE fraud could be tracked back several years.

I documented a 2005 AE card fraud operation under LEXBAY LIMITED ROSEVILLE CA which was set up by a cyber-mule named ALEX BERNIK »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

I missed this several months later, in May of 2008:

05/15/2008

DEFENDANT INDICTED IN CHARGE CARD, MONEY LAUNDERING AND REAL ESTATE SCHEMES SACRAMENTO, Calif.

United States Attorney McGregor W. Scott announced that a federal grand jury returned an indictment today charging ALEXSANDR BERNIK, 29, of the Sacramento area, with wire fraud, money laundering, and making false statements to federally insured banks to obtain real estate loans.

BERNIK was previously arrested on April 30, 2008, on a criminal complaint filed in connection with this investigation and was ordered detained as a flight risk. The case is the product of an extensive investigation conducted by the United States Secret Service and the Internal Revenue Service-Criminal Investigation Division. According to Assistant United States Attorney Courtney J. Linn, who is prosecuting the case, the indictment charges that from October 2005 through November 2006, BERNIK engaged in a scheme to defraud American Express and its customers. He used the fictitious business name Lexbay Limited to open a bank account and establish a merchant relationship with American Express. Between August 2006 and November 2006, he fraudulently charged American Express customers for products or services that the customers did not order. During this time period, a bank account he controlled in the name of Lexbay Limited received approximately $177,000 from American Express. Some of those funds were then withdrawn in transactions designed in part to avoid transaction reporting requirements under state and federal law.

The indictment further charges that in late 2005, BERNIK applied for and obtained loans from federally insured lenders secured by residential real property in the Sacramento area. In connection with those loans, the indictment charges that BERNIK knowingly made false statements overstating his income and knowingly submitted false bank statements to influence the banks to loan him money.

The maximum penalties for wire fraud is 20 years in prison, and a fine of up to $250,000. The maximum penalty for money laundering is 20 years in prison and a fine of up to $500,000. The maximum penalty for making false statements to a federally insured lender is 30 years in prison and a fine of not more than $1,000,000.

The actual sentence, however, will be determined at the discretion of the court after consideration of the Federal Sentencing Guidelines, which take into account a number of variables and any applicable statutory sentencing factors. The charges are only allegations and the defendant is presumed innocent until and unless proven guilty beyond a reasonable doubt.

Ref: »www.usdoj.gov/usao/cae/press_rel···ease.pdf

There was also an article in the local CBS news website: »cbs13.com/local/defrauding.custo···077.html

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 19 Aug 2008 21:57:36 EDT

MGD : Additional details on the Planera, et all, recruiting operations. The recruit group sites are used to appear as an independent employment referral for the software division. This is one of many hits from trolling Careerbuilders.com:

Introduction:

From: Anneliese Aitken

anneliese.aitken@thecareerplanet.com

Subject: Job Offer

My name is Anneliese, HR of TheCareerPlanet.com I have viewed your resume on the CareerBuilder.com and I think that one of our clients may be interesting in your person for the Assistant Director position in small business. Actually there is nothing complicated and you will need 1-2 weeks to become proficient in this work.

Also this is a part-time home based position, so it is possible to combine it with your direct work. The minimal income is $12.000\year

If you wish to get the description, please e-mail me back at anneliese.aitken@thecareerplanet.com

Sincerely yours,

Anneliese Aitken
>http://www.thecareerplanet.com

In order to dupe potential cyber-mules, the crime syndicate first hits on the potential victim acting as an employment agency:

Follow up:

From: Anneliese Aitken

anneliese.aitken@thecareerplanet.com

Subject: Job Offer

Our partner Planera Project working in Internet design and Internet business field wants to to develop US market, and for this purpose they need an associated business unit in US.
You can visit their Web-site on:

>http://www.planeraproject.com/

At this moment there are two offers:

They seeking for a partners in US (Affiliate Director) or for a person who will implement the managing of business accounts of established Company (Assistant Director)

There are attached description for both positions.

The duties are same at most, but Affiliate Director is paid $500 as a flat-payment right after business account is started. Furthermore, the rate of interest of Affiliate Director will increase as far as business is growing.

I understand your anxiety about legitimacy of this offer, because I know about heaps Internet scammers, so I want to note: there is no fees or charges from your side.

You sign Agreement with Planera Project. It is the lawful document and the Company bears the responsibility.

Please familiarize with descriptions and feel free for asking.

We really appreciate your business and thank you for cooperation.

Sincerely yours,

Anneliese Aitken
>http://www.thecareerplanet.com/

Assistant Director

[att=1]

Affiliate Director

[att=2]

Slick !, they direct that the business account be opened at Bank Of America, knowing that they are an affiliate of authorize.net / Cybersource.

Instructions:

From: Anneliese Aitken

anneliese.aitken@thecareerplanet.com

Subject: Business account

You can learn detailed information about account on the Web-site.

>http://www.bankofamerica.com/

When you open bank account, please, provide me with this information:

Bank address :

Bank City/Town :

Bank Postal Code :

ACH (Direct Deposit/Automatic Payment) Routing #:

Wire Transfer ABA Routing #:

Account Number: (business bank account #):

When the account is opened please provide me with login and password of this account.

This is needed to check the account functioning. This account is only needed for getting up-to-date financial information,

so, if you have any doubts, you can set up a limited-access account. with no options for performing transactions.

There is also another option easy-to-use:

you can just set up daily e-mail bank statement reports to my e-mail. In most banks you can set it up from web-access. When I receive the first statement, I will redirect it to your personal manager.

After this steps all preparatories is done. Your personal manager will contact you and the general work is started.

Sincerely yours,

Anneliese Aitken

www.TheCareerPlanet.com

The crime syndicate picks the name of the LLC, a deliberate totally unrelated name to the website. The criminals complete the LLC application process themselves using the online services of 101incorporate.com »www.101incorporate.com/index1.htm and they pay for it. I assume they must use a prepaid card for payment, as 101incorporate.com only accepts cards. Using a hijacked card for this part would be pointless since it could end up in revocation later. They also use Business Filings International, Inc. aka Business Filings Inc. »www.bizfilings.com as the listed registered agent, all set up from 101incorporate.com.

Embedded code in some emails indicate that the originating pc is set to Russian Cyrillic.

The contractor agreement still contains the name Kreateeve Solutions Inc, a predecessor of Planera.

From: Anneliese Aitken

anneliese.aitken@thecareerplanet.com

Subject: Job Offer

There is attached Agreement.

Please, read it carefully, fill, sign, scan and e-mail me or send by fax to 1-484-970-6467.

This number is redirected to me.

Please, attach the scan of your ID for address verification.

You need to fill the line on the first page

"... by and between Planera Project Solutions Inc. and..."

and on the last page you need to state your full name,?

address and phone number. I understand that I have this info from your resume, but such are the regulations.

Don't forget to affix your signature.

The process of LLC registration may take much time (1-2 month). I will inform you as soon as it is ready. If you will change your decision, and want to try the Affiliate Director position, inform me.

Sincerely yours,

Anneliese Aitken

>http://www.thecareerplanet.com/

Agreement:

[att=3][att=4][att=5][att=6]

This further demonstrates a new self managed level of setting up the fictitious companies. Using these methods now allows the criminals to widen the pool of potential cyber-mules. It removes most of the complexity of the set up, and only requires that the cyber-mule be able to show up at a bank, documents in hand, and apply for a business account. As has always been the case they turn over the log in credentials from both the merchant account and the online bank account to the organized crime syndicate. After the set up, the only function the cyber-mules need to perform is to wire the hijacked funds to foreign countries weekly, and fax copies of the growing charge back reports and bank statements to the syndicate.

As you peel back the layers of this "windows theme download" division, it will yield direct connections that tie it in to all the other webtemplate, Ebooks and the Globus / Photo divisions.

Take thecareerplanet.com for example, let's have a look at the domain registration:


Registrar: ENOM, INC.
.
Domain name: thecareerplanet.com
.
Registrant Contact:
   THECAREERPLANET.COM
   Basil Lynch 
   
   16781 S.W. 36 Court
   Miramar, FL 33027
   US
.
Administrative Contact:
   THECAREERPLANET.COM
   Basil Lynch (zilkom@gmail.com)
   +1.6109563936
   Fax: +1.5555555555
   16781 S.W. 36 Court
   Miramar, FL 33027
   US
.
Status: Locked
.
Name Servers:
   ns10.ixwebhosting.com
   ns9.ixwebhosting.com
.   
Creation date: 31 Jan 2008 19:01:19
Expiration date: 31 Jan 2009 19:01:19

That's a significant registration because the organized crime syndicate registered THECAREERPLANET.COM to the cyber-mule from wiseegoods.com AKA WISEEGOODS.COM LLC 954-603-7710 See: »Re: [Credit Card Fraud] fraud: www.prophotosland.com & www.phot and »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto.


Registration Service Provided By:
NameCheap.com
.
Domain name: wiseegoods.com.
.
Registrant Contact:
   WiseEGoods.com LLC   
   Basil Lynch (thewisemanster@gmail.com)   
   +1.6109563936   
   Fax: +1.5555555555   
   16781 S.W. 36 Court   
   Miramar, FL 33027   US.
.
Status: Locked
.
Name Servers:   
   ns1.secureserver.net   
   ns2.secureserver.net
.
Creation date: 15 Jan 2007 07:56:35
Expiration date: 15 Jan 2009 07:56:35

.
If you look through the 5 pages of victim reports of the wiseegoods.com LLC fraud charges: »800notes.com/Phone.aspx/1-954-603-7710 you will find cross charging reports from all the other groups:

For example:

quote:
D Lee - 23 Mar 2008
I had suspicious charges from this company as well and have handled it through my bank. I also had charges from Xyron Inc and Interactive Designs who I had never heard of. My friend had the same thing happening with weird online companies. The only thing we had in common is that we are military families and had recently purchased something from RangerJoes.com When we did so, they were out of stock, so I told them I'd get my product elsewhere. I think this is where my card number was compromised. To be clear, I think it was an individual at the company or a virus uploaded to their network, not the actual company, but I have made this known to my bank. I was curious if any of you have recently made any such online purchaes. You can reply on here or e-mail me at Redacted@yahoo.com Thanks

------------------------------------------------

Cindy - 6 Jun 2008
I too have shopped at Ranger Joe's. I had the charge from WISEE GOODS LLC just yesterday and have had one from Interactive Designs. I contacted Interactive Designs and they credited my account back. I emailed the Florida Attorney General as suggested by the comment a few blocks up and am going to my bank today to dispute the charge and cancel my debit card

The rangerJoes 3 year customer card database hijack, which ended up being used exclusively on a dozen or or more of the sites.

Interactive Designs was the second set up of the Washington state cyber-mule Arthur Chandler. His first operation was ccdtemplates.com - 206-319-8144 AKA Crystal Clear Designs, LLC »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

The second round Interactive Designs, LLC AKA interactiveconsults.com 206-319-7126 was a duplicate of ccdtemplates.com
.

Snapped 2008-08-19 21:35:59

»interactiveconsults.com

Snapped 2008-08-19 21:42:34

»interactiveconsults.com/help.php


Domain name: interactiveconsults.com
.
Registrant Contact:
   CCD LLC
   Arthur Chandler 
   
   13626 8th Ave S
   Burien, WA 98168
   US
.
Administrative Contact:
   CCD LLC
   Arthur Chandler (arthur_chandler00@yahoo.com)
   +1.7203851302
   Fax: +1.7203851302
   13626 8th Ave S
   Burien, WA 98168
   US
.
Name Servers:
   ns1.hostdone.com
   ns2.hostdone.com
.  
Creation date: 26 Sep 2007 18:50:48
Expiration date: 26 Sep 2008 18:50:48

.
Lots f fraud charge reports:»www.google.com/search?hl=en&q=20···e+Search

Wiseegoods victim fraud charges showing rotations from Wiseegoods to the Globus Photo group:

quote:
cav_1lt - 17 Jun 2008
On 5-30-2008 I had a charge of $4.95 from WISEE GOODS LLC. We never made this charge. I called the listed number and found it disconnected. I have also had charges from Xyron Inc and Monrovia Inc last month. I am military and have made several orders through Ranger Joe's on-line and over the phone. I think it is interesting the common link with them.

------------------------------------------------

Jen - 3 Apr 2008
I just rec'd a charge in the amount of $4.95 from Wisee Goods LLC. I do a lot of on line shopping for my company. I have never used RangerJoes. I did get another fraudulent charge from STOCK IMAGE PLANET COM. Darn them.

I will call Ranger Joe's and complain that this is too coincidental to be just that.

------------------------------------------------

Kevin - 4 Apr 2008
I just got a charge from WISEE GOODS LLC for $2.95 and about a week ago another charge from STOCK IMAGE PLANET COM for $8.95. I have no idea where these came from...about to call my bank now.

------------------------------------------------

Nelson in Missouri - 13 Apr 2008
I also got hit by WISEE GOODS LLC for $4.95 also PHOTOS PARADISE in Tn. every one check your cc statements. It might be possible that it is your cc company that is compromised

------------------------------------------------

metoo - 27 Feb 2008
I got it too. Third time I have received an EXACTLY $4.95 unauthorized charge on my card (each time a different company). I am going to change my credit card number. This is ridiculous. My bank always credits the $4.95, but who is doing this???? The bank don't seem to care, probably because it is such a small amount. But what happens when they charge $495.00 instead of $4.95???? A*sholes!
Caller: Wisee Goods LLC, FL.

------------------------------------------------

XmasDVD.com - 5 Apr 2008
I reported my $4.95 Wisee Goods, LLC charge to Det Adcock and called my Bank. I was also charged $8.95 from ProPhotos.com - reported them both. My bank credited my account and I cancelled my cards(s) and got new numbers issued.

------------------------------------------------

This new "Windows Themes" division, of which there are many more, the insidious cyber-mule recruiting operation using the employment referral tactics, and the software group of fictitious companies of Planera et all, are parked right at the front door of this organized criminal operation.

As has been shown before in previous recruiting documents, as well as those above, the criminals require the cyber-mules to submit photo identity documents. In theory, the criminals do not need these for the operation to function. However, by design, what they have accumulated over the years is a significantly large collection of identity documents, including picture IDs, available for nefarious purposes. I know that they submit them in order to validate domain registrations that are being flagged as fraudulently registered.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 15 Aug 2008 13:37:43 EDT

MGD : Here is another batch of connected fraud recruiting sites, thanks to a tip from moike

GLOBAL RECRUIT Phone: +46-08-559 24 673 GLOBAL-RECRUIT.ORG Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Snapped 2008-08-15 13:24:54

»global-recruit.org/

and:

WORLDRECRUIT Phone: +46-08-559 24 673 WORLDRECRUIT.INFO Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Snapped 2008-08-15 13:24:38

»worldrecruit.info

and:

CONNECT-HR Phone: +46-08-559 24 673 CONNECT-HR.ORG Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Snapped 2008-08-15 13:24:22

»connect-hr.org

and:

RED EAGLE Phone: +46-08-559 24 673 RED-EAGLE-RECRUIT.COM Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Site is suspended, Google's text cache from 26 May 2008:

Snapped 2008-08-15 13:24:06

»64.233.169.104/search?q=cache:re···&strip=1

The red-eagle-recruit.com domain was registered using the same bogus name as the card laundering fraud site: allforyounow.com aka ALL for you NOW 203-404-4852
See earlier posting:


Registrant:
 red-eagle-recruit.com
 8007 E Coronado Rd
 Scottsdale, AZ 85257
 US
.
 Domain name: RED-EAGLE-RECRUIT.COM
.
 Administrative Contact:
    Orr, Richard  redeaglebill@gmail.com
    8007 E Coronado Rd
    Scottsdale, AZ 85257
    US
    +1.4809409229
Record created on 23-Apr-2008.

A recent Yahoo Answers thread, a potential cyber-mule asking:

quote:
Business phone and address verification in Sweden?

I was given some business phone numbers and addresses but before I deal with them I would like to make sure they're legitimate.
...
..

»answers.yahoo.com/question/index···4AA7q2Pu

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 15 Aug 2008 04:58:45 EDT

MGD : A cyber-mule from the above group was tracked down, alerted, and debriefed. One of the confirmed FRAUD recruiting websites that was used to recruit cyber-mules for this division is Planera Project PLANERAPROJECT.COM +46-031 799 59 48

[att=1]

Contact info for Sweden below a US city shot:

Snapped 2008-08-15 04:31:15

»planeraproject.com/contact.php

Their Services:

Snapped 2008-08-15 04:30:48

»planeraproject.com/services.php

Their Portfolio, lists legit sites they fraudulenty claim that they designed:

Snapped 2008-08-15 04:30:31

»planeraproject.com/portfolio.php

As has been posted multiple times before, Sweden is again used as a bogus location for this fake "custom website and development business".

Address:
Finlandsgatan 16 SE-164 74 KISTA Sweden
Phone: +46-031 799 59 48
Email: sales@planeraproject.com

Some of the text from the fraud site for archive purposes:

quote:
Planera Project is a one-stop web design and graphic design service located in Stockholm, Sweden. We've been providing small to mid-sized companies in Stockholm with website and graphic design since 2001. Welcome to our labs!

Regardless of your Internet requirements, whether online marketing, hosting, web development, print graphics or support, Planera Project is the company to trust. Offering innovative products and services, Planera Project helps increase revenue while at the same time assures customer communication is enhanced. Our wide array of online Internet related services greatly enables our clients to increase market exposure

In what has become a fiercely competitive business arena, Planera Project provides a host of services that facilitate a company's activities, ensuring your business stays ahead of the Internet game. With a strong, stable technological background as well as advanced knowledge of the Internet, we are in the unique position to empower both smaller and larger organizations. Whether your need is for web site design, web site development, hosting services, print graphics or web site promotional activities, Planera Project offers the best choices and the most cost effective approaches for your business endeavors.

Recently uncovered is another massive recruiting campaign, where victims who have resumes posted on careerbuilders.com and monster.com are now being aggressively targeted by the organized crime syndicate. They also targeting regional job sites, and they have been found in cities such as Atlanta, Georgia.

More than a dozen fraudulent cyber-mule recruiting sites have been uncovered, all directly tied to this organized criminal operation, many are still active. This clearly qualifies as an epidemic.

It is now incumbent on both national and regional job sites to post clear warnings to individuals who submit resumes alerting them to this massive fraud campaign. Some of the recent cyber-mules are clearly not internet savvy, nor do they understand what constitutes a legitimate business in cyberspace. Furthermore, some of the heinous tactics used by the crime syndicate involve the use of a third party referral, as if the site where the victim has their resume posted is contacting them on behalf of the fraudulent job website. This is an additional attempt to add legitimacy to the job offer and make it appear that they have been vetted or approved by the original location. More on that later, first lets run down both the active and defunct fraud recruiting sites:

GLOBAL DESIGNERS Phone: +46-46-288 52 67 GLOBALDESIGNERS.ORG
Frejgatan 13 11479 Stockholm Sweden

[att=2]

Same fake portfolio list as the above PlaneraPlanet planeraproject.com:

Snapped 2008-08-15 04:30:13

»globaldesigners.org/portfolio.php

I00% FRAUDULENT:

[Insert Name] is a one-stop web design and graphic design service located in Stockholm, Sweden. We've been providing small to mid-sized companies in Stockholm with website and graphic design since 2001. Welcome to our creative resource and make the Internet work for you!

quote:
GLOBAL DESIGNERS AND YOU - A PERFECT FIT!
If you are an ambitious, high-energy person who enjoys a fast-paced team environment laced with challenges and opportunities, you've come to the right place. Read on to discover how to pursue employment opportunities with us. Global Designers offers great jobs, great pay, great benefits and a great place to work!

WE WANT YOU TO BE PART OF OUR TEAM
Email us at: info@globaldesigners.org or just complete the form at Contact page.

Our customer service will provide you with details regarding the position of Affiliate Company Director.

Of course they all will have fraudulent testimonials to add legitimacy and convince potential cyber-mules.

quote:
• With over 25 years experience in graphic design, Global Designers's team of talented designers are ready to serve your design needs with stunning graphics and websites. We also aspire to provide a high customer service ethic. Call us today and let us help you define the look of your business •
• Martin Muller, CEO

Another fraudulent recruiting clone:

GLOBAL DESIGN Phone: +46-46-288 52 67 GLOBALDESIGN.COM
Frejgatan 13 11479 Stockholm Sweden

Snapped 2008-08-15 04:29:56

»globalindesign.com

and:

UNIQUE DESIGN SOLUTIONS Phone: +46-46-288 52 67 UNIQUEDESIGNSOLUTIONS.ORG
Frejgatan 13 11479 Stockholm Sweden

Snapped 2008-08-15 04:29:38

»uniquedesignsolutions.org/

and:

UNIQUE DESIGN SOLUTIONS Phone: +46-46-288 52 67 WEB-D-SIGNERS.COM
Frejgatan 13 11479 Stockholm Sweden

Snapped 2008-08-15 04:29:21

»www.web-d-signers.com

and:

WEB DESIGN ART Phone: +46-46-288 52 67 WEB-DSIGN-ART.NET
Frejgatan 13 11479 Stockholm Sweden

Snapped 2008-08-15 04:29:21

»www.web-d-signers.com

and:

TOTAL iSTUDIO Phone: +46-46-288 52 67 TOTALISTUDIOONE.ORG
Frejgatan 13 11479 Stockholm Sweden

Snapped 2008-08-15 04:29:00

»totalistudioone.org/

Another genre of the fraud recruiting sites that is directly connected to this crime syndicate is:

RECRUIT ZONE recruitzone.org

[att=3]

Phone: +46-08-559 24 673
E-mail: info@recruitzone.org
Address: Vastra Vattugrand 3c. 115 21 Stockholm Sweden

quote:
WELCOME TO RECRUIT ZONE WEB SITE

RECRUIT ZONE, the candidate research company,
delivers the most comprehensive and actionable
candidate information in the marketplace today.
RECRUIT ZONE provides adaptable and scalable
pipeline support for recruiters, agencies and
growth-minded corporations.

WE DELIVER STAFF: use EXCELLENT OFFERS to meet your resource needs
In today's fast-paced and complex world of staffing, there are plenty of companies, solutions and technologies competing for your attention. How do you quickly cut through the clutter to find the one resource that cuts straight to the chase – matching the best talent with the most appropriate opportunities? You look for the one staffing service provider that has the experience, resources, know-how and drive to deliver maximum results.
» THAT'S EXCELLENT OFFERS!
» THE TOTALLY RISK FREE
E-RECRUITMENT SERVICE

Online candidate attraction solutions that deliver targeted applicants for your vacancies.

The "services"

Snapped 2008-08-15 04:28:42

»recruitzone.org/service.php

They even claim affiliation with Monster.com and careerbuilders.com and use their logos:

Snapped 2008-08-15 04:28:20

»recruitzone.org/boards.php

Close up:

[att=4]

A clone of Recruit Zone:

EXCELLENT OFFERS Phone: +46-08-559 24 673 EXCLLENTOFFERS.ORG
Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Snapped 2008-08-15 04:28:03

»www.excllentoffers.org/index.php

and:

THE CAREER PLANET Phone: +46-08-559 24 673 THECAREERPLANET.COM
Vastra Vattugrand 3c. 115 21 Stockholm Sweden

Snapped 2008-08-15 04:27:45

»www.thecareerplanet.com/

A 03/14/08 posting from a potential cyber-mule asking if the resume response is legit:

I was wondering if anyone has heard of the this company or currently works for them?

said by I was wondering if anyone has heard of the this company or currently works for them? :

I represent recruiting company TheCareerPlanet.com (»www.thecareerplanet.com).

I have found your resume on CareerBuilder.com
and we considered that one of our positions may be interesting for you,
according to you skills and background.

We have a vacancy for position of Assistant Director.
This is part-time in-home position requiring 1-2 hour a day.

The minimum salary on this position is $1100/month.

If you are interested, I'll provide you with all details
and we'll consider you as a candidate.

if you are not interested, anyway please let me know
and we will try to find something for you.

Best regards, Hanna Berit

TheCareerPlanet.com
Vastra Vattugrand 3c . 115 21 Stockholm Sweden

ref:»www.workplacelikehome.com/forum/···p=858349

Additional fraud recruiting sites now 404, that are directly connected:

STAFFDRIVE staffdrive.com

Google's cache of a 31 Jan 2008 shot:

Snapped 2008-08-15 04:27:28

»64.233.169.104/search?hl=en&q=ca···e+Search

KreatEEve +46-46-288 52 67 kreateeve.com

Google's cache of a 31 Jan 2008 shot:

Snapped 2008-08-15 04:27:11

»64.233.169.104/search?hl=en&q=ca···e.com%2F

Web Site Masters design studio recruitersolutions.org

Site disabled, no Google cache,

Cyber-mule posting:

Annelie
May 8, 2008 @ 10:02 am

Wow!! This is the one I received from Recruitersolutions.org. I went far with them. I started the LLC and Opened up an account. Please, if there are anyone that went that far, please let me know what step you took to resolve your company registration and bank account.
This is really bad!!!

Dear Annelie,

Thank you for your answer, I’m glad that our offer is interesting for
you.

I want to give you more information about this job.

Our Swedish partner, Web Site Masters design studio, looking for
candidate for the position of Assistant Director. And we should to
find the candidate for this position use their requirements.

Web Site Masters provides their customers with wide variety of design
services for many years and has a great experience in this sphere.
Recently, the management of the company has decided to develop US
market, and for this purpose they need an associated business unit in
US. This decision is also motivated by having difficulties for
European companies with the ability to sell products and services for
US customers as well as intention to avoid heavy domestic taxes (as
you could know, Swedish taxation is probably one the heaviest in the
Europe). So they are going now to file an LLC in US. They will apply
to the company specializing in company formation in US. After the LLC
is formed, they will need a Assistant Director, who is to represent
this associated company in US. Maybe it sounds too complicated, but
actually the duties are quite easy.

Web Site Masters is planning to create a Web-store for US company to
sell their original products online. They are provide this products
with online marketing, hosting, web development, print graphics or
support. To accept payments online, it will be necessary to have a
merchant account. Unfortunately it is impossible for European company,
which has a merchant account in European bank, to accept payments
online from US customers (basically, it is possible, but with a lot of
limitations that make it impossible). So the Assistant Director, as a
company representative, will need to arrange a merchant account in US.
Web Site Masters will provide him with all necessary information and
instructions. It is expected that the US business unit Web Site
Masters is applying for will have a business bank account, but to the
moment, they are not sure yet, so maybe Assistant Director will also
need to arrange a business bank account for the associated company.

The primary Assistant Director’s duties are:

- Register LLC.
- Open business bank account and merchant account for LLC.
- Business bank account and Merchant account maintaining and
monitoring;
- Handling business correspondence and transmitting it to Web Site
Masters by fax or by mail (all expenses are reimbursed).
- Being in touch with Web Site Masters’s representative by e-mail and
follow his/her instructions.

This job will take 1-2 hours a day max to handle all of these duties.

The Assistant Director will get a commission, 5% on net profit of the
associated company’s Web-store.

Please let me know about your decision about this applying to this
position and feel free to ask any questions you have.

Best regards,
Bill Broussard.

RecruitSolutions.org

Ref:»fightidentitytheft.com/blog/-2-2···of-2007/

If you scroll down the above link for fightidentitytheft.org you will see several postings
from the fraud recruiting sites mixed in with the 419 posts.

This submit listing AtlantaJobsOnline.com shows that the criminals are targeting regional jobsites throughout the US as well:

July 6, 2008 @ 8:31 am

Here is another scam email from Recruit Solutions.

************************************

I represent recruiting company RecruitSolutions.org (»www.RecruitSolutions.org).

I have found your resume on AtlantaJobsOnline.com
and we considered that one of our positions may be interesting for you,
according to you skills and background.

We have a vacancy for position of Assistant Director.
This is part-time in-home position requiring 1-2 hour a day.

The minimum salary on this position is $1100/month.

If you are interested, I’ll provide you with all details
and we’ll consider you as a candidate.

if you are not interested, anyway please let me know
and we will try to find something for you.

Best regards, Karla Anders

RecruitSolutions.org
Vastra Vattugrand 3c . 115 21 Stockholm Sweden

.
The criminals are also responding to forum complaints with shill posts:

quote:
Ellis Rowe
March 17, 2008 @ 12:57 pm

I don’t know why you think Planera Progect is scam - I work with them already 14 months and I have never had any problems with them. Anybody can prove me that it’s scam?

And that was no duped cyber-mule

quote:
Ellis Rowe
March 22, 2008 @ 12:28 am

I’m know, there are a lot of different scammers in internet and sometimes it’s very hard to distinguish the truth from lie. But how can you discredit company if you didn’t work with them? First mind is not always right!

Rosa, what proof you want? I was in their main office in Sweden in April, 2007 and had a personal meeting with John Swanchen (president of Planera Project). So, now I’m sure in my work.

Jude, they are people like you and me and they can make mistakes because they are people! And Jude, it seems you don’t know how to use spell check too, may be you are a scammer too?

The address (their "main office") is an anonymous mail forwarding service !!
.

This organized crime syndicate is in the midst of a massive sophisticated campaign to recruit cyber-mules. The engine that drives this, is their embedded access to back end financial systems, which provides them with a unending supply of global card data. They are driven to destroy peoples lives in order to convert this data to cash and launder it out of the country. Although the US is the largest market for them, it is not unique to here. We have already shown a pattern of a long term program of the same operation occurring in the UK.

Any individual who has a resume posted online, or is actively reviewing job postings needs to be aware of this campaign.

There are some simple criteria that one should remember, and be vigilant about.

There is no legitimate business opportunity that involves any of the following:

• Registering an LLC or DBA in your name on behalf of a foreign business. The answer is always NO. One should not even consider doing this for a business opportunity where you meet the company face to face, never mind being recruited to do it over the internet, where your only communication is via email, or a few Skype calls.

• Never apply for a merchant and/or business bank account in your name on behalf of any foreign business, or domestic one for that matter. Ditto for an Employer Tax id number from the IRS.

• The above are red flags that you are becoming involved with international organized fraud. Those ingredients are synonymous with criminal conspiracy and fraud.

Bear in mind that these criminals are the lowest form of sub human species. In order to convert this hijacked financial data into cash, they are prepared to destroy your life in the process. First let's look at the financial liability. In most cases when you open a commercial and merchant billing account for a new business under an LLC, the bank will require you to sign a personal guarantee of liability. Every single card transaction that the criminals run through the account is fraudulent. The criminals will run up to $35,000 to $40,000 per month of fraudulent charges through the account. When the fraud finally collapses, you as intended will be the fall guy, both financially and criminally. The bank / merchant processor will come after you for ALL the loses. Conceivably when you add in the charge back fees etc, that could make the total twice the original billing amount. I have heard horror stories from past cyber-mules that were shut down, some were done early.

A 74 year old retired man in California, originally looking for part time work to supplement his Social Security. Now, almost 9 months afterwards, any personal assets that he had at the bank have been seized. He is being hounded legally for well over $100,000 above and beyond the seizures. For the first time in his life, at his age, he is filing bankruptcy. It is difficult to have a conversation with him. Who knows what the IRS may want from him also. That is only half the problem a potential cyber-mule may face. If there is even a hint of knowledge of the fraud, or reasonable grounds to believe that there should have been, then you can face very serious criminal felony charges as well. Even if there is not reasonable grounds, you can still face criminal charges, just look at the earlier posting on the Detroit case, that was from this same syndicate's operation.

There is no need to try and establish if an employment offer that involves any kind of LLC or DBA/FBN formation and merchant bank account is legitimate. The answer is easy, there are no legitimate circumstances, the answer is always NO. Do not try to analyze the offer, that means you're considering it, ...you have already gone too far.

I will ask mae_aa419 and the folks at »aa419.org to lists these fraud recruiting sites in their distributed data base, and to try and close these down, in an effort to inhibit the mule recruiting. There needs to be ample alert notices of this fraud recruiting campaign posted on both Monster.com, Careerbuilders.com and many of the regional jobsites.

No doubt the inventory of prepared sites are so that the criminals can quickly roll them into action as soon as negative publicity flags an active one. They will quickly replace all of these as well.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 14 Aug 2008 23:50:32 EDT

MGD :

said by music man :

@MGD

Great work fella!!

You may want to add the following to your list. Same format as all the rest from our eastern European "friends"

»sadi-q-themes.biz
»themobileclub.org
»allthebestforyou.biz
»www.sparecap.org

Thanks for the heads up music man

sadi-q-themes.biz, themobileclub.org, allthebestforyou.biz, sparecap.org are part of the same group that includes yourplproject.org 424-785-1586 and allforyounow.com aka ALL for you NOW 203-404-4852.

I will follow up with a detailed post on how the cyber-mules are being recruited. It appears once again that the criminals are instructing the cyber-mules to apply for the LLC via LegalZoom.com. That is a one stop shop where you can also apply for the EIN taxpayer ID from the IRS. In addition, NRAI National Registered Agents can then be used as a proxy LLC organizer. This will cloak the cyber-mules identity, much like a domain by proxy. Of course all of this is designed to make uncovering the cyber-mules, and closing down the operation more difficult. With this group, the crime syndicate also specifies the name of the LLC to be used. The name of the LLC will be totally unrelated to the website domain name, and as in the Globus / Photo / Mobile division, the LLC name will not be listed anywhere on the website. The only contact on the website will be the phone number.

Very smart indeed, but maybe not smart enough.

In order for this obfuscated set up to pass the merchant account vetting process, they will leave some credible connection. So far, the connections are that the area code of the contact number will match to the state where the LLC was registered. In addition, the domains have bogus registrations, they are fraudulent. The names used are not the people who registered the domains. However, to add credibility to the merchant application process the criminals will pick a random name and address that is within the same city or locale where the cyber-mule lives. Some of the registrants have been contacted, and confirmed that they did not register the domains. They have also checked their cards /bank accounts and so far do not appear to have been charged for the set up. it is possible, I presume, that the criminals could use an unrelated PayPal account to pay for the registration.

In the next post I will document the recruitment methods used for this operation.

SADI-Q-THEMES.BIZ 434-336-4079

Snapped 2008-08-14 23:39:29

»sadi-q-themes.biz


Domain Name:                                 SADI-Q-THEMES.BIZ
Domain ID:                                   D25870847-BIZ
Sponsoring Registrar:                        ENOM, INC.
Sponsoring Registrar IANA ID:                48
Domain Status:                               clientTransferProhibited
Registrant ID:                               68F4ABDA4EC
Registrant Name:                             ANNA  GODFREY
Registrant Address1:                         16540 Cedar Run Drive
Registrant City:                             Orlando
Registrant State/Province:                   FL
Registrant Postal Code:                      32838
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.3256543365
Registrant Email:                            kymail23@gmail.com
Name Server:                                 NS1.HOSTM.NET
Name Server:                                 NS2.HOSTM.NET
Name Server:                                 NS3.HOSTM.NET
Created by Registrar:                        ENOM, INC.
Domain Registration Date:                    Tue Jul 01 19:23:52 GMT 2008

.
.

THEMOBILECLUB.ORG 231-225-0410

Snapped 2008-08-14 23:49:11

»www.themobileclub.org/


Domain ID:D153477975-LROR
Domain Name:THEMOBILECLUB.ORG
Created On:29-Jul-2008 19:07:09 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:de9081f97df
Registrant Name:Dian  Murray
Registrant Organization:themobileclub
Registrant Street1:5803 Bonnerton Rd
Registrant Street2:
Registrant Street3:
Registrant City:Edward
Registrant State/Province:NC
Registrant Postal Code:27821
Registrant Country:US
Registrant Phone:+1.2523225436
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:aluna864@gmail.com
Name Server:DNS1.REGISTRAR-SERVERS.COM
Name Server:DNS2.REGISTRAR-SERVERS.COM
Name Server:DNS3.REGISTRAR-SERVERS.COM

.
.

ALLTHEBESTFORYOU.BIZ 904-425-1621

Snapped 2008-08-14 23:39:11

»allthebestforyou.biz


Domain Name:                                 ALLTHEBESTFORYOU.BIZ
Domain ID:                                   D24827737-BIZ
Sponsoring Registrar:                        ENOM, INC.
Sponsoring Registrar IANA ID:                48
Domain Status:                               clientTransferProhibited
Registrant ID:                               A32DA259FBB
Registrant Name:                             Aaron  Small
Registrant Organization:                     -
Registrant Address1:                         140 Claudia Dr
Registrant City:                             Jacksonville
Registrant State/Province:                   FL
Registrant Postal Code:                      32218
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.9044251621
Registrant Email:                            AaronSma33@gmail.com
Name Server:                                 NS1.HOSTM.NET
Name Server:                                 NS2.HOSTM.NET
Name Server:                                 NS3.HOSTM.NET
Created by Registrar:                        ENOM, INC.
Domain Registration Date:                    Mon May 05 21:40:38 GMT 2008

.
.

SPARECAP.ORG 208-629-8051

Snapped 2008-08-14 23:38:54

»www.sparecap.org


Domain ID:D152175941-LROR
Domain Name:SPARECAP.ORG
Created On:28-Mar-2008 18:41:07 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:4abcdd5a8f3
Registrant Name:Carmen  Mercado
Registrant Organization:Mecosta
Registrant Street1:14345 90th Ave
Registrant Street2:
Registrant Street3:
Registrant City:Mecosta
Registrant State/Province:MI
Registrant Postal Code:49332
Registrant Country:US
Registrant Phone:+1.2319726108
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:snelson071@gmail.com
Name Server:NS.DNSPROTECT.COM
Name Server:NS2.DNSPROTECT.COM

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 12 Aug 2008 15:43:56 EDT

music man : @MGD

Great work fella!!

You may want to add the following to your list. Same format as all the rest from our eastern European "friends"

»sadi-q-themes.biz
»themobileclub.org
»allthebestforyou.biz
»www.sparecap.org

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 10 Aug 2008 21:46:10 EDT

MGD : DAYETRAFFIC.COM AKA Daye Traffic LLC 402-408-6643

I just purchased a copy of the actual LLC filings for Daye Traffic LLC from Nebraska.gov. Sometimes the filings contain the applicant's signature along with their phone number. However, as you can see below that was not the case here:

[att=1][att=2][att=3]

It appears that Mr Kevin Daye used a broker service, as the organizer is listed as a Marsha Siha, a name that shows up on multiple cross state filings.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 08 Aug 2008 03:21:19 EDT

MGD :

said by Justice :

:mad:Daye Traffic, LLC # 402-408-6643 just posted ANOTHER fraudulent charge to my bank account for $4.95. The first one was on 4/25/08. I'm disputing it with my bank, but I also filed a complaint with consumer affairs once I saw the number of complaints related to this fake firm......

Also, please file a complaint at IC3 The Internet Crime Complaint Center all victims of this fraud should file a report at IC3.

DAYETRAFFIC.COM AKA Daye Traffic LLC 402-408-6643 »www.dayetraffic.com started processing fraud charges in April, and is currently one of the most prolific fraud charging set ups. DAYETRAFFIC.COM along with SYNERGETIC-DESIGN.COM AKA SYNERGETIC EXPERTS LLC 915-986-9428 account for a considerable amount of referrals to this thread.

I have tried repeatedly to reach the DAYETRAFFIC cyber-mule:

Kevin Daye
Job title: Owner
Company: Daye Traffic
11808 Golden Blvd
Bellevue, NE 68123-1369
phone number unavailable

11808 Golden Blvd is an apartment complex. I also contacted a previous address for 46 year old Kevin Daye.

KEVIN L DAYE
4002 25TH AVE
OMAHA, NE 68111

I was told by a former family member that they did not have a number for him, or any way to contact him in Bellevue, NE.

said by Justice :

......
New debit cards don't work, so you have to keep an eye on your account until this guy is caught.

I am not sure what you mean by that. While there are some cases that I am aware of where victims ultimately ended up with another fresh fraud charge on a replacement card. That is not to be confused with rollover charges, where a fraud charge was submitted against the old card number within 30 or so days of it being replaced, and the bank transferred that charge to the new card. That is different, and does not mean that the criminals had the new number.

Reporting and insisting that these charges are processed as "fraudulent", along with replacing your card as soon as it is hit the first time, is SOP for this fraud.

For anyone that has multiple charges, I am interested in the line item details of each charge, including the date. also if you get hit on more than one card.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 07 Aug 2008 11:31:09 EDT

MGD :

said by nwrickert :

Sheesh! Their robots.txt file is just plain strange:

That is probably error text being generated for any request where there is a missing file. I got the same response with a random file name (actually "nhyd2gIo.txt").

Yes, I do not see a robots file eithet, also Google has pages cachedon both sites.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 07 Aug 2008 11:23:20 EDT

MGD :

said by jswanson :

MGD and anyone else interested,

Another site to add to the list:

www.yourplproject.org

See thread from 800notes:

»800notes.com/Phone.aspx/1-424-785-1586
...

Thanks, that was new to me:

Snapped 2008-08-07 11:17:03

»yourplproject.org

Snapped 2008-08-07 11:16:45

»yourplproject.org/contacts.php

yourplproject.org 424-785-1586 Your 800notes.com link shows complaints of the fraud charges begin in mid July.


IP 64.22.100.80
Domain ID:D152177171-LROR
Domain Name:YOURPLPROJECT.ORG
Created On:28-Mar-2008 20:53:10 UTC
Last Updated On:28-May-2008 03:51:18 UTC
Expiration Date:28-Mar-2009 20:53:10 UTC
Sponsoring Registrar:Melbourne IT, Ltd. 
dba Internet Names Worldwide (R52-LROR)
Status:OK
Registrant ID:D120672992325589
Registrant Name:Jerry Wilson
Registrant Organization:Jerry Wilson
Registrant Street1:14345 90th Ave
Registrant Street2:
Registrant Street3:
Registrant City:Mecosta
Registrant State/Province:MI
Registrant Postal Code:49332
Registrant Country:US
Registrant Phone:+1.4247851586
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:jerrywilson89@yahoo.com
Admin ID:D120672992325586
Tech Name:YahooDomains TechContact
Tech Email:domain.tech@YAHOO-INC.COM
Name Server:NS.EZ-WEB-HOSTING.COM
Name Server:NS1.EZ-WEB-HOSTING.COM

Thanks to mae_aa419 for locating a sister site, identical Easteren European female accent on the voice mail. Identical contact us page. Typical contact support@ message.

allforyounow.com aka ALL for you NOW 203-404-4852

Snapped 2008-08-07 11:22:18

»allforyounow.com

Snapped 2008-08-07 11:16:27

»allforyounow.com/contacts.php

So far, I am unable to locate reports of fraud, however it is realitevly new:


Whois Record
Registrant:
   Richard Orr
   8007 E Coronado Rd
   Scottsdale, Arizona 85257
   United States
 
   Domain Name: ALLFORYOUNOW.COM
      Created on: 09-Apr-08
      Expires on: 09-Apr-09
      Last Updated on: 09-Apr-08
 
   Administrative Contact:
      Orr, Richard  gdrtdssse1965@gmail.com
      8007 E Coronado Rd
      Scottsdale, Arizona 85257
      United States
      (239) 243-9831      Fax -- 
.
   Domain servers in listed order:
      NS51.DOMAINCONTROL.COM
      NS52.DOMAINCONTROL.COM

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 06 Aug 2008 13:01:35 EDT

anon : :mad:Daye Traffic, LLC # 402-408-6643 just posted ANOTHER fraudulent charge to my bank account for $4.95. The first one was on 4/25/08. I'm disputing it with my bank, but I also filed a complaint with consumer affairs once I saw the number of complaints related to this fake firm. New debit cards don't work, so you have to keep an eye on your account until this guy is caught.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 04 Aug 2008 22:44:28 EDT

nwrickert :

Sheesh! Their robots.txt file is just plain strange:

That is probably error text being generated for any request where there is a missing file. I got the same response with a random file name (actually "nhyd2gIo.txt").
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.1

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 04 Aug 2008 21:52:12 EDT

garys_2k :

said by jswanson :

MGD and anyone else interested,

Another site to add to the list:

www.yourplproject.org

See thread from 800notes:

»800notes.com/Phone.aspx/1-424-785-1586

Amazing... they sell windows mobile themes... yeah, that is something everyone wants a subscription to...

And can anyone guess the charge amount? $4.94, how original.

Sheesh! Their robots.txt file is just plain strange:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <head><style>a:link{font:8pt/11pt verdana; color:red}a:visited{font:8pt/11pt verdana; color:#4e4e4e}</style><meta HTTP-EQUIV="Content-Type" Content="text-html; charset=Windows-1252"><title>HTTP 404 Not Found</title></head><script>  function Homepage(){ // in real bits, urls get returned to our script like this:// res://shdocvw.dll/http_404.htm#http://www.DocURL.com/bar.htm      //For testing use     //DocURL = "res://shdocvw.dll/http_404.htm#https://www.microsoft.com/bar.htm"    DocURL=document.location.href;     //this is where the http or https will be, as found by searching for :// but skipping the res://    protocolIndex=DocURL.indexOf("://", 4);     //this finds the ending slash for the domain server     serverIndex=DocURL.indexOf("/", protocolIndex + 3);     //for the href, we need a valid URL to the domain. We search for the # symbol to find the begining     //of the true URL, and add 1 to skip it - this is the BeginURL value. We use serverIndex as the end marker.    //urlresult=DocURL.substring(protocolIndex - 4,serverIndex);    BeginURL=DocURL.indexOf("#",1) + 1;    urlresult=DocURL.substring(BeginURL, serverIndex);    if (protocolIndex - BeginURL > 7)        urlresult=""     //for display, we need to skip after http://, and go to the next slash    displayresult=DocURL.substring(protocolIndex + 3, serverIndex);     var aElement = document.createElement("A");    aElement.innerText = displayresult;    aElement.href = urlresult;     homepageContainer.appendChild(aElement);} function doSearch(){    saOC.NavigateToDefaultSearch();} function initPage() {    document.body.insertAdjacentHTML("afterBegin","");    Homepage();} </script> <body bgcolor="white" onload="initPage()"> <table width="400" cellpadding="3" cellspacing="5">   <tr>    <td id="tableProps" valign="top" align="left"></td>    <td id="tableProps2" align="left" valign="middle" width="360"><h1 id="errortype"    style="COLOR: black; FONT: 13pt/15pt verdana"><span id="errorText">The page cannot be found</span></h1>    </td>  </tr>  <tr>    <td id="tablePropsWidth" width="400" colspan="2"><font    style="COLOR: black; FONT: 8pt/11pt verdana">The page you are looking for might have been    removed, had its name changed, or is temporarily unavailable.</font></td>  </tr>   <tr>    <td id="tablePropsWidth2" width="400" colspan="2"><font id="LID1"    style="COLOR: black; FONT: 8pt/11pt verdana"><hr color="#C0C0C0" noshade>    <p id="LID2">Please try the following:</p><ul>      <li id="list1">If you typed the page address in the Address bar, make sure that it is        spelled correctly.<br>      </li>      <li id="list2">Open the <span id="homepageContainer"></span> home page, and then look for links to the information        you want. </li>      <li id="list3">Click the <a href="javascript:history.back(1)"> Back</a> button to try another link. </li>          <li ID="list4">Click <a href="javascript:doSearch()"> Search</a> to look for information on the Internet. </li> </ul>    <p><br>    </p>    <h2 id="ietext" style="font:8pt/11pt verdana; color:black">HTTP 404 - File not found<br>    Internet Explorer <BR>    </h2>    </font></td>   </tr> </table></body></html>

Comes up as a 404 with Internet Explorer type text, even in Firefox. I can't see any exclude text for the actual robots to find, either. Maybe a work in progress...

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 04 Aug 2008 21:36:57 EDT

jswanson : MGD and anyone else interested,

Another site to add to the list:

www.yourplproject.org

See thread from 800notes:

»800notes.com/Phone.aspx/1-424-785-1586

Amazing... they sell windows mobile themes... yeah, that is something everyone wants a subscription to...

And can anyone guess the charge amount? $4.94, how original.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 02 Aug 2008 18:41:54 EDT

Zenith : Amazing work!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 02 Aug 2008 15:44:01 EDT

MGD : The crime syndicate's obsfucation toolbox is not just limited to the above tactics, in fact they are pervasive. They have always monitored the net for feedback and routinely attempt to deflect atention or otherwise interfere with reports of their operations.

More recently 800notes.com has become a virtual early warning sign for many of the syndicates fraud charging entities. This is primarily due to the fact that a required phone number is listed on the victim's line item charge, and is usually one of the keys that they will search under. That makes sites like 800notes.com a collection point of the criminal's fraud victims.

Since 800notes.com covers a wide range of consumer complaints, the site Admins may not have been aware of the significance of this recent notice that they posted on June 30th:

800NOTES

Credit Card Thieves Trying to Hide Their Trails

30 Jun 2008

We have recently discovered that many phone numbers, reported to be connected with unauthorized charges, are being targeted by spammers, who come to the website and make unrelated postings to the discussion threads.

At first it didn’t make any sense, we would see a thread where almost every user was reporting something completely different than all the others. Some said that the number belongs to a collection agency, some claimed that a telemarketer calls from it, others reported that the number belongs to a newspaper subscription service.

After a while a pattern emerged, all o f these threads had one thing in common: “true” users were reporting unauthorized charges while other postings were made by bots.

We started to monitor the threads and discovered that someone has been spamming these particular discussions. It seems they do it for one purpose: to confuse the audience and keep it off track.

In many cases they even create a discussion thread for a particular number well in advance before any fraudulent charges are noticed and reported. They then spam it with unrelated postings. Like, for example, in this thread the first posting was made on Feb 16th2008, and then only on March 5th users started reporting strange transactions (we didn't remove the 'bot' postings for demonstration purposes and will clean it up shortly).

We are now building the list of the phone numbers that match this pattern and so far have 60 phone numbers responsible for fraudulent charges. All the numbers are from 888, 877, 866, and 800 area code.

The fraudulent charges are placed using the following company names:'Link Services', 'Link Group', 'Source Limited', 'System Development', 'HBS', 'Electronic Business Resources', 'Image company', 'World Wide Services', 'World Trade', 'ICS Services', 'Homebase', 'Home Port', 'DEN Enterprises', 'EST Company', 'BEI', 'Site Services', 'Search Services', 'ESTA', 'SENSATE TECHNOLOGY', 'Market Billing', 'MCA Templates', 'Web Templates', Will Services, 'Office Services', 'Terra', 'World Development', 'UNITED SERVICES', 'SITE DEVELPOMENT', 'ALS', 'Mera', 'Search Management', 'ONLINE GROUP', and 'ACM'.

We are looking into ways to prevent them from posting. If you find a thread with the pattern described above, please use the 'Report Abuse' button to alert us.

.
.
That detection list reads like a veritable Who's Who inventory list of the syndicate's operation. In fact, there are some on there that I was not aware of before.

The example link that the 800notes admin posted was for 866-473-8739 which lists fraud charges from:

LINK SERVICES 866-473-8739 CA
Merchant Category: Merchandise - ELECTRONIC STORES

That one has been reported nultiple times as a follow up cross charge from other known entities of the criminal's operation. However, even though some are coded as originating from California, multiple searches fail to turn up a matching cyber-mule entity. That is a constant issue especially with the toll free fraud group, since many of them are really business names and not formal LLCs or Corps. Posting the full line item charge, including the phone number and any abbreviation codes, is very helpful in tracking the origination point.

MGD