Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto in Spam, Scam and Phishbusters

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 05 Dec 2009 01:51:49 EDT

MGD : Yes that is likely, though to what extent is unknown. I suspect that "They work very bad" indicates that the syndicate's prior experience is one where the account flagging from chargebacks is triggered much quicker than most, and results in a prompt account freeze and then cancellation. Though not impossible, it becomes increasingly more difficult to open new merchant accounts for the same entity after having one revoked. Plus it is bound to make the cyber-mule suspicious.

Besides Cardservice International, the criminals also appear to have an adverse opinion of HSBC bank for business accounts. One of their documents in early 2008 stated "Please don't open the account in HSBC bank": »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto The crime syndicate continuously conducts R&D testing new vectors for setting up the accounts. They keep track of the success and failure rates and time frames, and will direct cyber-mules to the most current productive set ups. They perform the same R&D on hosting providers and registrations.

In the past six months they have gone into a new sophisticated "Stealth Mode" in order to avoid detection. Gone are the days of server factories where forty or fifty websites will be stashed on one IP. Now they spread the operation across the globe using many hosting providers at once. Almost a two to three websites per host ratio, and are constantly rotating. Another new tactic to avoid detection is that they have lowered the volume of monthly charges per site, and increased the number of sites and themes proportionally to compensate. Also, there are far more active recruiting sites as well, in order to disperse the focus and lower the noise ratio of complaints per entity.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 04 Dec 2009 20:25:55 EDT

Whip : This stuck out like a sore thumb to me:

quote:
Only please don't open the account in Cardservice International
company. They work very bad.

Is this an organization that has them figured out?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 04 Dec 2009 17:59:37 EDT

MGD : Back in April of 2009 I came across communications from the organized crime syndicate which indicated that they might be targeting transfirst.com as a merchant account provider for the recruited cyber-mules:

==============================================
From: Tatyana Wang [mailto:hr@unitelsoftware.com]
Sent: Friday, April 03, 2009 8:21 AM
To: XXXXXXX
Subject: Re: What's Next?

Good day XXXXXX,

How are things moving forward? You can full out the application form to
receive the merchant account at the Wells Fargo Bank, and at the same time
you can submit the application to receive the merchant account at the
TransFirst ( >http://www.transfirst.com). At the TransFirst, everything can be done online, you will not need to go to the local bank, and therefore, if you are rejected at the Wells Fargo, we can be certain that everything will be alright at the Transfirst.

Have a great day!

Best Regards,
Tatyana Wang.

==============================================

If you recall, unitelsoftware.com was one of almost a dozen fraud recruiting domains cloned from a subsidiary of EMC Corpration, and hosted in the Russian Federation on a series of Wahome.ru dedicated IPs. The modus-operandi of that first quarter 2009 cyber-mule recruiting campaign involved intensive solicitations via fraudulent employer accounts courtesy of Careerbuilder.com.

Subsequent communications from the crime syndicate in the second half of this year further indicated that transfirst.com was now a default back up merchant provider if the cyber-mule's account application was rejected by the bank:

==============================================

Hello,

We suppose because of the world finance crisis many banks don't want
to risk with new businesses.

Please try this merchant service www.transfirst.com

Or what other merchant service would like to use?

Best regards,
Adrian Nowak.
Chief manager of World Creative Studio, Inc.
adrian_nowak@worldcreativestudio.com
Phone/Fax for the USA: (954) 208-7279
==============================================
.
World Creative Studio, Inc. aka worldcreativestudio.com 954-208-7279 is part of a trifecta of mule recruiting domains which also includes Hong Kong Solutions Inc. aka hongkongsolutions.com 206-203-1947

Security at Transfirst was subsequently alerted and briefed to the organized card fraud laundering operation, once additional communications indicated that they were now selected as a primary target for merchant account processing. Recent fraud accounts subsequently identified as having obtained merchant processing via Transfirst, include: RAGDESIGN.COM aka REMOTE ACCESS GROUP INC. 206-666-4778 also BIGSTUDIODESIGN.COM aka ILLUSTRATIVE STUDIO, INC. 206-350-6215 and JAZZIPHONE.COM aka MOBILE INTERFACE, INC 206-338-6018.

Another recent find of a twin website card fraud laundering operation that was flushed out by Transfirst within the first few weeks of operation: REALPOCKETPC.COM and OPENDESIGNTEMPLATE.COM. The duped Florida cyber-mule originally registered CNCEVE SOLUTIONS, LLC on 06/23/2009 after being recruited by Hong Kong Solutions Inc. aka hongkongsolutions.com 206-203-1947:

[att=1]

==================================
Florida Limited Liability Company

CNCEVE SOLUTIONS, LLC
Filing Information
Document Number L09000060682
FEI/EIN Number NONE
Date Filed 06/23/2009
State FL
Status ACTIVE
Effective Date 06/22/2009

Principal Address
1786 OTISCO WAY
WINTER SPRINGS FL 32708 US

Mailing Address
1786 OTISCO WAY
WINTER SPRINGS FL 32708 US

Registered Agent Name & Address
AMERICAN SAFETY COUNCIL, INC.
5125 ADANSON ST.
SUITE 500
ORLANDO FL 32804 US

Manager/Member Detail
Name & Address
Title MGRM
CALKIN, W. DAVID
1786 OTISCO WAY
WINTER SPRINGS FL 32708 US
==================================

On 08/21/2009 two Florida Fictitious Business Names (FBN) were registered for REALPOCKETPC.COM

[att=2]

==================================
Fictitious Name

REALPOCKETPC.COM

Filing Information
Document Number G09000148240
Status ACTIVE
Filed Date 08/21/2009
Expiration Date 12/31/2014
Current Owners 1
County MULTIPLE
Total Pages 1
Events Filed NONE
FEI/EIN Number 27-0417302

Mailing Address
1786 OTISCO WAY
WINTER SPRINGS, FL 32708

Owner Information
CNCEVE SOLUTIONS, LLC
1786 OTISCO WAY
WINTER SPRINGS, FL 32708
FEI/EIN Number: 27-0417302
Document Number: L09000060682
==================================

[att=3]

and also OPENDESIGNTEMPLATE.COM

[att=4]
==================================
Fictitious Name

OPENDESIGNTEMPLATE.COM

Filing Information
Document Number G09000148251
Status ACTIVE
Filed Date 08/21/2009
Expiration Date 12/31/2014
Current Owners 1
County MULTIPLE
Total Pages 1
Events Filed NONE
FEI/EIN Number 27-0417302

Mailing Address
1786 OTISCO WAY
WINTER SPRINGS, FL 32708

Owner Information
CNCEVE SOLUTIONS, LLC
1786 OTISCO WAY
WINTER SPRINGS, FL 32708
FEI/EIN Number: 27-0417302
Document Number: L09000060682
==================================

[att=5]

We can tell that the cyber-mule was specifically told to apply for a merchant processing account at Transfirst.com because the cyber-mule's business bank account was set up at Bank of America. The default process at Bank of America would have directed the cyber-mule to apply for a business merchant account directly through them, and not Transfirst. Unknown to the duped cyber-mule at the time, but the trail of who is who, Hong Kong Solutions Inc, Bank of America, Transfirst, and of course the organized crime syndicate's exclusive and dedicated gateway processor for over half a decade, Authorize.net / Cybersource, are all listed on the required public notification for the FBN on 8/28/2009:

===========================================================================
NOTICE UNDER FICTITIOUS NAME STATUTE

TO WHOM IT MAY CONCERN:

Notice is Posted:
Location: Orlando, FL
Event Date: 8/28/2009
Description: CSE1014463

NOTICE UNDER FICTITIOUS NAME STATUTE TO WHOM IT MAY CONCERN:

Notice is hereby given that the undersigned pursuant to the "Fictitious Name
Statute", Chapter 865.09, Florida Statutes, will register with the Division
of Corporations, Department of State, State of Florida upon receipt of proof
of the publication of this notice, the fictitious name, to-wit:
opendesigntemplate.com under which we expect to engage in business at 1786
Otisco Way, Winter Springs, FL 32708. That the parties interested in said
business enterprise are follows: CNCeve Solutions, LLC, Hong Kong Solutions,
Inc., Bank of America, TransFirst Corporation, AuthorizeNet.com -CyberSource
Corporation. Phone# 407-340-8918. Dated 8-26-2009, Winter Springs, Seminole
County, FL.
===========================================================================

Transfirst subsequently neutered the setup, and advised the cyber-mule within the first few weeks of the operation. It never got off the ground.

From time to time several have asked how the dots of this over half decade massive card fraud operation by this eastern European organized crime syndicate are connected. There are mutiple pieces of evidence that connects all the operations listed in this thread, from the Digital Age fraud, the Pluto Data, and all the other fraud laundering websites up through these two. They are tied together in an intricate pattern of common connections, including the cross charging of the same hijacked card data.

With respect to this case, one of the items that ties Hong Kong Solutions Inc. aka hongkongsolutions.com 206-203-1947 and CNCEVE SOLUTIONS, LLC and its subsidiary FBNs, REALPOCKETPC.COM and OPENDESIGNTEMPLATE.COM together are the domain registrations. The websites were taken down shortly after the operation was exposed, however, the fraudulent domain registrations yield the trail:

==================================
REALPOCKETPC.COM

Domain Name: realpocketpc.com
Expiry Date: 10-Jul-2010
Creation Date: 10-Jul-2009

Name servers:
ns1.domain.com
ns2.domain.com

Registrant Name: Claudia Thorstensen
Registrant Company: realpocketpc.com
Registrant Email Address: claudia_tt60@yahoo.com
Registrant Address: 37 Bancroft Ave
Registrant City: 37 Bancroft Ave
Registrant State/Region/Province: MA
Registrant Postal Code: 01867
Registrant Country: US
Registrant Tel No: +1.9132738915
Registrant Fax No:

IP: 174.133.212.214
Domain Status: Registered And No Website
==================================

The name and address of Claudia Thorstensen was used back in January of 2008 to register the card fraud laundering domain of DRGTEMPLATES.COM:

==================================
Registrar: ENOM, INC.
Registration Service Provided By: NameCheap.com

Domain name: drgtemplates.com

IP 66.152.162.116

Registrant Contact: DRG
Claudia Thorstensen (drginter58@yahoo.com)
37 Bancroft Ave
Reading, MA 01867 US.

Tel: +1.3203868193
Fax: +1.3203868193

Status: Locked.
Name Servers: ns1.hostdone.com
Name Servers: ns2.hostdone.com

Creation date: 03 Jan 2008 22:22:35
Expiration date: 03 Jan 2009 22:22:35
==================================

The duped cyber-mule assigned to drgtemplates.com was recruited by "Gundars Kristopans" of Atala Designs, Inc aka Ataladesigns.com fame, supposedly from Riga, Latvia. This connects an entire chain of recent recruiting and card fraud domains back to the entire early 2008 operation.

Furthermore, the OPENDESIGNTEMPLATE.COM domain registration cements the structural connections to the long term massive fraud operation by this organized crime syndicate even more.

==================================
OPENDESIGNTEMPLATE.COM

ICANN Registrar:GODADDY.COM, INC.
Created:2009-08-10
Expires:2010-08-10

Registrant:
Charalampos Tyligadas
288 New York Ave #7
Brooklyn, New York 11216
United States

Domain Name: OPENDESIGNTEMPLATE.COM
Created on: 10-Aug-09
Expires on: 10-Aug-10
Last Updated on: 10-Aug-09

Administrative Contact:
Tyligadas, Charalampos charalampos_t@yahoo.com
288 New York Ave #7
Brooklyn, New York 11216
United States
2063375041 Fax --

IP: 97.74.181.128
==================================

I chuckled as soon as I looked up that registration for OPENDESIGNTEMPLATE.COM, but you will not find a prior reference to it in this thread. That name Charalampos Tyligadas, was used back in February 2008, to register a card fraud laundering domain called IPD-TECHNOLOGIES.COM

==================================
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com
Visit: www.NameCheap.com

Domain name: ipd-technologies.com

Registrant Contact:
IPD LLC
Charalampos Tyligadas (charalam_tylig@yahoo.com)
+1.3094025302
Fax: +1.3094025302
338 E44th StreetApt. 14N
New York, NY 10017
US

Status: Locked

Name Servers:

Creation date: 01 Feb 2008 20:28:09
Expiration date: 01 Feb 2009 20:28:09
==================================

Though the IPD-TECHNOLOGIES.COM website did exist back then, the fraud operation never got off the ground. The reason for that is a very sharp potential cyber-mule, who had responded to a job offer on Craigslist in January of 2008. He received a reply to his initial inquiry from Aleksandr Kostanda aleksandr_kostanda7@fellowsolutions.com which was posted along with screen shots of FELLOWSOLUTIONS.COM who listed their address as being in Sophia, Bulgaria.

The cyber-mule became suspicious as the recruitment and enrollment process got underway.

quote:
==================================
From: aleksandr_kostanda7@fellowsolutions.com
To: XXXXXXXXXXX
Sent: Thu, 24 Jan 2008 5:57 am

Subject: Aleksandr Kostanda

Hello XXXXXXXXX,

We are glad you want to work with our company.
Yes, we can wait while you investigate incorporation procedures.
The company may be registered as a Corporation, LLC, Sole
Proprietorship or other business entity. Also you can see the
file "How to incorporate" I sent you before.

I can assure you that our company is absolutely legal and we offer
absolutely legal job offer. I understand your concers about it. The
USA's market is the biggest online market and we want to work on it.
You will have full control in your hands because the company will be
your property and you will get your 10% in any case not depending what
fees we will have.

We can do 2 or 3 or more web sites for you.
Yes, we can do all this here in Europa. But to open the
merchant account costs approx. $4000-5000 and they take fees 5-10% of
all sales. It's ok for big online stores who sell the goods for
millions dollars. It's not for small business. So many companies as
our company can't allow this big fees and have to search the agetns in
the USA. Because to open the merchant account (it's required for
online purchases) costs $100-150 and they take fees for 1-2% of sales.
So we have to open this business in the USA. And we have to search
the agents in the USA to help us in our business and for this we pay
10%. It's real good for the agent (because he can work as usual and
plus work with our company and it's not required much time; and the
agents monitor only the bank account and do the transfer 1-2 times a
week) and for our company. We have good specialists (technical,
desing, support and others) and we can create really good templates
and we just need to sell them. It's usual business.

It's more easy and less costs to find the agent in the USA and pay
10% of sales for managing accounts that open merchant account here.

In this business the main is advertising to get as many customers as
possible. So we spend for advertising apporox. 40% of sales. Yes it's
much but it gives good results even in the first days of the working
the website.

And second (the main thing) that it's small business and one merchant
account allow to have the sales not above than $50,000.00 for each
account a month. If you open a merchant account that allows to have more than
$50,000.00 that means we will have to pay more fees and in this case
the merchant account hold the money first month (and for this business
the main is advertising and as more you advertise the website as more
you get customers and it's impossible for this business that merchant
account hold the money at all). So we have to search several agents
and open several websites because we know that we will have more than
$50,000.00 for each website (of course it will take 1-2 months to
reach such level; we don't promise gold mountains for our agents at
once, just a good level of additional profit). It's good opportunity
for the agent because for this work he spends not too much time and
can work for his usual work and for our company because we have the
opportunity to enter to the USA's market and have US merchant account
that allow to have a profit if your business is not too big.

As more you have the websites as more you can get new customers and of
course you get more profit. It's business strategy.

You will be responsible to pay taxes only on your 10% commission; the
rest taxable 90% is the responsibility of Fellow Solutions, Inc.
You will need the W-2 form or 1099 for taxes. Find out about it and
you will see that you will be responsible only for your 10%.

Our company produces webdesign and templates - primary web pages
with no content.
We sell: Web Template, Logo template, Flash Intro Template.

As for our customers. Most of them are the people who
only started to create their own websites, students who learn the
internet skills because the cost of our products is less than most of
other webshops have. And we can competite with them. We can offer such
low price because here the salary of our desingers and other workers
less than in the USA and we can do such low price.

If you have any questions please ask me

Best regards,
Aleksandr Kostanda,
Fellow Solutions, Inc.
==================================

The potential mule became increasingly suspicious as the process progressed

quote:
==================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXXXXXXXXXX
Sent: Wed, 6 Feb 2008 5:58 am

Subject: Aleksandr Kostanda

Hello XXXXXXXXXXXX,

I got your email.
I can't understand why you don't get my emails from
aleksandrkostanda@fellowsolutions.com
Please confirm if you get it now. I send from both email account.
This email and yahoo.

I didn't understand you correctly about this phrase:
" I don't fully understand why I can't go to the site directly without
going to ipd... first. "

Can you no go to the website www.ipd-technologies.com or what?
This website we will sell from.

I explain you how all works:

The customer goes to our webstore, chose the item he likes, then put
his credit card's info in the special page, then that info goes to
Gateway on authorize.net (they check the credit card's info if it's
valid and all datas is correct). If all is ok then that info goes to
the merchant account (they charge
the credit card) and then our system
gets the result and send the download link to the customer's email
where from he download template he chosed. Of course it's all
automatically and very quickly. Then after 1-2 days the money from the
merchant account (sales) goes to bank business account.

You will need to show the website? www.ipd-technologies.com to the
merchant manager in ane case I suppose.
If you ask you how much we are going to sell. Aprox. 2500-3500 a
month. Average price for each template is $12.00. So average sales in
dollars are $35,000 - $45,000.

When you get the merchant account you need to put this phone number
+1-(315)-359-6506 in the merchant service as our support phone number.
The individual receive a credit card statement from the issuer of
their card and in this statement must be put this phone number if he
did the purchase in our web shop.
It's necessary for our support.

Best regards,
Aleksandr Kostanda.
==================================

They ran multiple searches looking for any information or history on the proposed partnership function. That led to them contacting me, and, like several others in the same situation he agreed to assist me in gathering intelligence on the crime syndicate. Based on the stage that he was at, which was pending merchant account approval, it offered an opportunity for me to try and validate conclusions previously adopted about the syndicate's operation. The timing was perfect, as the syndicate would continue to communicate with the mule as long as they believed the merchant account application process was underway, which of course it was not once the cyber-mule had made contact with me. The window of opportunity would be short as once the syndicate realized it was not going to happen, they would move on.

One of the puzzling issues that I was addressing at the time was why the syndicate was not registering the domains to the cyber-mules. The obvious reason not to, was so that the mules could not be readily identified once the card fraud operation was underway, and the fraud charges surfaced. The question was why were they not concerned that this fraudulent domain registration would not be discovered during the merchant account application vetting process. The fact was that if they applied to any third party processors for a merchant account, especially in the double high risk category of internet sales, combined with intangibles, those third party processors will always check and confirm that the applicant is also the registered domain owner. With third party processing that verification check is considered vetting 101. So why when insisting that the merchant account applications be originated through the Banks where the business account was located, was this not an issue for the syndicate. I suspected that they knew that banks would not perform this verification which was a fundamental procedure with aftermarket providers.

During this narrow window of opportunity I wanted to present fictitious issues to the syndicate which were holding up the approval of the merchant account application to see what the responses were. The cyber-mule agreed to become an email proxy and forward communications as if they were his own.

A surprise, the bank wants to know why the domain assigned to the mule, IPD-TECHNOLOGIES.COM is registered to someone other than the applicant:

quote:
==================================
To: aleksandrkostanda@yahoo.com
Sent: Fri, 15 Feb 2008 12:00 pm

Subject: Merchant Account

Hello Aleksandr,

I have a curious question that needs to be answered before I can proceed any
further. The merchant provider called me to ask who "Charalampos Tyligadas
is. I told them I did not know that person. They then told me that
Charalampos Tyligadas from New York is who registered the
ipd-technologies.com web domain and that is the URL that is listed on the
merchant account application. I told them that I did not know that name but
would find out.

Can you please explain this? It is getting embarrassing and hard to come up
with answers that I do not know.

Best regards,

XXXXXXXXXX
==================================

The response clearly shows that the organized crime syndicate already knows that the banks do not check that the registration matches the applicant:

quote:
=====================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXX
Sent: Fri, 15 Feb 2008 1:02 pm
Subject: Aleksandr Kostanda

Hello XXXXXXXXXX,

Charalampos Tyligadas is a man who registered the domain name
ipd-technologies.com for us. I didn't know that merchant service can
ask you about it.

Best regards,
Aleksandr Kostanda.
=====================================

After multiple attempts to obtain a merchant account failed I wanted to try and see if they would allow any other gateway processor other than Authorize.net - Cybersource to be used. They would not, it was an absolute that Authorize.net - Cybersource must be used as the gateway to processing the fraudulent card charges. So then we proposed that our only option left to use Authorize.net - Cybersource as a processing gateway was to use a third party, would that be okay:

quote:
=====================================
To: aleksandrkostanda@yahoo.com
Sent: XXXXXX Feb 2008 12:00 pm

Subject: Merchant Account

Aleksandr,

I have got nothing but the run around from these banks.

Rather than waste more time trying, I propose setting up the
merchant account with a reliable reseller who I trust.
She has the gateway for authorize.net as well as merchant services.
If this is OK with your company I would liketo proceed.
I think this would be much easier and quicker than shopping
around for a bank that will accept this business.

Please let me know ASAP.
=====================================

Well, as long as authorize.net is used for the processing gateway.:

quote:
=====================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXXXXXXX
Sent: Thu, 14 Feb 2008 1:40 pm

Subject: Aleksandr Kostanda

Hello XXXXXXXX,

Ok, chose the merchant service not in bank.
Only please don't open the account in Cardservice International
company. They work very bad.

Best regards,
Aleksandr Kostanda.
=====================================

Also noteworthy, is that this operation also produced the first known record of the organized crime syndicate sending funds into the US. Up to this point all that is known is how and where the fraudulent funds exit the US and go to, various foreign banks to the beneficiary of Inowest Enterprises Inc and Midtown Intergroup Ltd.. Up until then all previous debriefed cyber-mules stated that they had paid all the set up costs out of pocket, and were reimbursed later from the initial fraud proceeds out of the business bank account.

quote:
=====================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXXXXXXX

We sent the money through Western Union. You can pick up the money in
any their branch.

We sent to these datas:

[Redacted]

You will need to know the datas of the sender:

The first name: NATALYA
The second name: MITROFANOVA
MTCN: 814-678-XXXX
Address: Nikolaev, Ukraine
Sum: $500

Yes you need to set up the Company and get FEIN and only then you are
able to open the bank, merchant and authorize.net accounts.
You can set up the Company and get FEIN yourself. Just go to home
state’s Secretary of State Office there and fill our all necessary
papers.

Best regards,
Aleksandr Kostanda.
=====================================

Remember, Fellow Solutions, Inc aka fellowsolutions.com although they listed two US phone numbers: 530-618-6428 & 606-764-1922, they stated that they were from Sophia, Bulgaria:

Aleksandr Kostanda,
Fellow Solutions, Inc.
36 Dragan Tsankov Blvd.,
Sophia, 1057
Bulgaria,
Phone/Fax for US: (606) 764-1922

So a follow up was sent in order to explain why the funds to pay the set up costs were sent from the Ukraine via Western Union:

quote:
=====================================
From: Aleksandr Kostanda aleksandrkostanda@yahoo.com

To: XXXXXXXXXXXXXXX

Subject: Aleksandr Kostanda

We sent $500 through the Western Union. You can pick up the money.

The datas to get the money:

Sender:
The first name: NATALYA
The second name: MITROFANOVA
MTCN: 814-678-XXXX
Address: Nikolaev, Ukraine
Sum: $500

We sent it from Ukraine because it's the cheapest way to send the
money for us.

Best regards,
Aleksandr Kostanda.
=====================================

From that time forward sending inbound support funds from various names and cities throughout the Ukraine in a somewhat Hawala type fashion, would become common place, and has been used again very recently in an operation that will be published in a later story.

At the time of initial contact with the cyber-mule Fellow Solutions, Inc aka fellowsolutions.com was unknown to me. However, when I asked the cyber-mule if a website had been assigned to him yet, and he confirmed that it was IPD-TECHNOLOGIES.COM then I was able to immediately confirm that it was this organized crime syndicate. Though I had not uncovered fellowsolutions.com prior to that, I was already shadowing IPD-TECHNOLOGIES.COM. They were identified from cyber forensic audits of various servers which served as organized crime syndicate "factories" for producing and stashing the card fraud laundering websites. At the time that he gave me the assigned website name, a quick search from notes made during the first quarter of 2008 of stashed sites on servers in Australia and the US produced a hit:

An extract of the February 2008 file at that time, which produced the result:

quote:

Audit results

Extracted hosting from shadowed servers:

IP 64.74.223.77 [no reverse DNS set]

1. Mvwebtemplates.com

2. Naturalordertemplate.com

3. Webperfecttemplates.com

-----------------------

[mcawebtechnology.com IP 66.152.162.116]

01/07/2008

[mcawebtechnology.com]

-----------------------
Round trip time to 202.60.92.179: 216 ms

Results for

202.60.92.179 [reverse DNS - ns1.aussiednsserver.com]

170 Results for 202.60.92.179

Identified fraud websites:

033. Ccdtemplates.com

081. Interactiveconsults.com

105. Monroviadesigns.com

106. Mcatemplates.com

107. Mcawebtechnology.com

113. Mvwebtemplates.com

117. Naturalordertemplate.com

156. Ulcsolutions.com

157. Ulcwebdesign.com

164. Webperfecttemplates.com

173. Dp-websolutions.com

------------------------------------

66.152.162.116 [reverse DNS - 116-162-152-66-dedicated.HostDone.com]

183 Results for 66.152.162.116

IP = 66.152.162.116

001. 100percent-solutions.com

003. 123gettemplates.com

017. Bg-websolutions.com

047. Digisoft-technologies.com

052. Drgtemplates.com

059. Everton-templates.com

060. Eyecontemplates.com

069. Fs-webconcepts.com

071. Funwork-design.com

075. Genesusinfoproducts.com

077. Gordontemplates.com

087. Infinitysonstemplates.com

108. Mi-webdesign.com

112. Mydcsolutions.com

118. Palaciantechnologies.com

122. Posicion-web.com

123. Profadminservices.com

143. Sds-websolutions.com

153. Superior-webconcepts.com

154. Supremewebtech.com

156. Synergetic-design.com

166. Wabbytraffic.com

167. Wameltraffic.com

172. Wst-design.com

175. Zgravitywebdesign.com

178. Bst-design.com

179. Wolfentechconcepts.com

180. Cca-templates.com

181. Cjb-concepts.com

182. Ipd-technologies.com

183. Fv-solutions.com

172. Xenontemplates.com

054. Dmnelsonenterprises.com

037. Coastwebtech.com

021. Bsi-concepts.com

019. Blueparaisosolutions.com

017. Bg-websolutions.com

187. Ts-webtemplates.com

--------------------------------------

To be updated:

Wrw-templates.com

Wrw-technologies.com

Synergetic-design.com

Supremewebtech.com

Superior-webconcepts.com

Stonegate-templates.com

Sc-webtemplates.com

Rpr-design.com

Ronztemplatestore.com

Rg-webtechnologies.com

Rd-webconcepts.com

Profadminservices.com

Pgp-concepts.com

Pg-templates.com

Palaciantechnologies.com

Mydcsolutions.com

Mi-webdesign.com

Mcg-websolutions.com

Mcawebtechnology.com

Mcatemplates.com

Infosystemplates.com

Gordontemplates.com

Funworksolutions.com

Ed-webtechnologies.com

Drgtemplates.com

Dmnelsonenterprises.com

Digisoft-technologies.com

Dhtraffic.com

Delamoratemplates.com

Cybernettemplates.com

Cjb-concepts.com (orange template)

Ccdtemplates.com

Bsi-concepts.com
-----------------------------

Besides the cross charging of the same hijacked card data which, weaves a connecting thread through the crime syndicate's operation. There are numerous other pieces of evidence, which, when combined, yield the connected infrastructure of a massive multi year, multi million dollar, well organized crime syndicate.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 03 Dec 2009 22:42:05 EDT

SnowyOne :

said by MGD :

=======================
Domain Name:1STCLASSRECRUITMENT.ORG
IP Address:205.178.145.65
IP Location: - Virginia - Herndon - Network Solutions Llc
Response Code:200
Domain Status:Registered And Active Website
=======================

Why am I not surprised that Network Solutions is playing a major role in all this?
$fontbg All the scum know Network solutions is a go to company $Fontbg

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 03 Dec 2009 22:11:09 EDT

MGD : Thanks to a heads up from BobBear.com »www.bobbear.co.uk for this active cyber-mule fraud recruiting website.

1STCLASSRECRUITMENT.ORG = FRAUD RECRUIT SCAM »1stclassrecruitment.org

[att=1]

==============================================
From: Linda Caradonna [mailto:hr@1stclassrecruitment.org]
Sent: Thursday, November 26, 2009 12:23 PM
To:
Subject: Re: Concerning your resume at CarrerBuilder.com

Dear ,

Thank you for your reply, I'm glad that our offer is interesting for you and
try to explain what did this position entails and how everything works.

Our client is the Swedish company Red Line web studio which wants to enter
the american market now because almost all on-line business are located in
the USA. So we have to search managers in the USA to create their
subsidiaries. Below this manager is called Assistant Director. Theh
Assistant Director's mission in the project is to create business tools
(registering a business, setting up business and merchant bank accounts) and
it is for these services that he or she will be paid.

Red Line, Inc creates a web-site (online store or subsidiary another words)
which will sell their products. They want to sell small-size low-price
downloadable content advertizing through the banners. This way makes
possible to reach a good profit because of large volume of sales.

The work of this web-store is impossible without a company and that's why
Assistant Director's first step is the LLC or Sole Proprietorship
registration. If you don't have enough of funds to register the LLC we have
an opportunity to register the business for you using on-line incorporation
agency. In this case you don't spend your own money. If you already have a
company, it's great and will make the start up yet faster. You just should
open bank business and merchant account and Gateway on Authorize.net.

You will never do any sales, advertising, presentation or something like
this. All promoting of the Web store will be done using on-line ADS
services. All expenses relating to ads placement will be on Red Line studio
at full. The specialists of marketing department of Brahe Design studio will
take care about reaching the stable profit of the store not less than
$30.000 each month. You will be paid 5% of this sum so it is guaranteed that
your income will be not less than $1500 monthly.

The position af Assistant Director doesn't require any special skills. You
should just be in touch with your personal manager and follow his/her
instructions. If you don't know how to do all this your personal manager
will explain you all actions step-by-step. You always can ask a question and
will be provided by the detailed instructions.

All work can be done on-line (Internet access is necessary requirement) so
you don't need to spent a lot of time. It is needed just 3-4 hours a week
and it is enough, so it is possible to combine
it with your direct work.

Please, take most seriously to this project and inform me about what do you
think about this offer as soon as you can and feel free for asking you
questions. I'm always glad to provide you with detailed information. If you
wish to join us please let me know and I will send you the Contractor
Agreement.
==============================================

==================================
Contact 1st Class Recruitment
We welcome your feedback and questions regarding our company, services and web site.

• Email: jobs@1stclassrecruitment.org

• Phone / Fax: +46-08-369-80-781

• Address: Gjorwellsgatan 28, 112 60 Stockholm, Sweden

==================================

»1stclassrecruitment.org/contact.php

[att=2]

Same template format as several previous ones, including: therecruiternetwork.org »therecruiternetwork.org webrecruit.org »webrecruit.org

Cloaked 08/26/09 domain registration:

Domain ID:D156963983-LROR
Domain Name:1STCLASSRECRUITMENT.ORG
Created On:26-Aug-2009 20:06:37 UTC
Last Updated On:26-Oct-2009 03:53:43 UTC
Expiration Date:26-Aug-2010 20:06:37 UTC
Sponsoring Registrar:Melbourne IT, Ltd. dba Internet Names Worldwide (R52-LROR)
Status:OK
Registrant ID:C125130853280358
Registrant Name:Andrea Anderson
Registrant Organization:Private Registration US
Registrant Street1:PO Box 61359
Registrant Street2:
Registrant Street3:
Registrant City:Sunnyvale
Registrant State/Province:CA
Registrant Postal Code:94088
Registrant Country:US
Registrant Phone:+1.5105952002
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:

Name Server:NS15.WORLDNIC.COM
Name Server:NS16.WORLDNIC.COM

Hosted on a familiar and repeatedly used IP / Host.

=======================
Domain Name:1STCLASSRECRUITMENT.ORG
IP Address:205.178.145.65
IP Location: - Virginia - Herndon - Network Solutions Llc
Response Code:200
Domain Status:Registered And Active Website
=======================

The recruitinlg letter's reference to "Our client is the Swedish company Red Line web studio" is an established ruse theme and so is the long term ruse of being based in Sweden.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 25 Nov 2009 03:10:35 EDT

MGD : In the last few hours, some more crumbs are surfacing with regard to UNIQUEDESKTOPSTYLE aka UNIQUEDESKTOPSTYLE.BIZ. and from Australia no less.

An Australian victim posted this today in the whirlpool.net.au forums:

quote:
User #215473

posted 2009-Nov-24,
wmh9

The credit card that I have for internet purchases has just been debited for $7.89US in favour of "uniquedesktopstylecom 573-3214029 MO". I dont recognise this crowd and I haven't used this card since before August.

I notice on the web that there are a couple of other people in the same boat so it must be a scam.

Ref:
»forums.whirlpool.net.au/forum-re···274.html

Kudos, they posted the exact line item charge. If you notice the line item lists com and not biz:

UNIQUEDESKTOPSTYLECOM 573-321-4029 MO There is no webpage for the .com domain:

=============================
namecheap.com

Domain name: uniquedesktopstyle.com

Registrant Contact:

VIVIDMOBILETHEMES.COM
Alice Snow (AliceSnow23@gmail.com)
+1.6013730167
Fax: +1.5555555555
144 Carpenter Dr
Jackson, MS 39212
US

Status: Locked

Name Servers:
dns1.registrar-servers.com
dns2.registrar-servers.com
dns3.registrar-servers.com

Creation date: 30 Aug 2009 08:14:54
Expiration date: 30 Aug 2010 08:14:54
=============================

It appears that there was a website at one time, and it was null routed ~ 11/08/09, possible carded registration:


UNIQUEDESKTOPSTYLE.COM
.
IP Address History
.
Event Date Action Pre-Action IP Post-Action IP 
==============================================
2009-08-31 New        -none-      67.228.23.32  
2009-09-02 Change  67.228.23.32   205.178.145.65  
2009-11-08 Change  205.178.145.65  127.0.0.1

.
The revoking on 11/08 makes sense also because UNIQUEDESKTOPSTYLE.BIZ was registered the next day on 11/09, as listed in the original post:»Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

A search of Missouri State records turns up a hit in the Fictitious Business registrations:

[att=1]

=======================================

Filed Documents

Business Name History

------------------------------------------

Name:

UNIQUEDESKTOPSTYLE.COM

Type: Legal
------------------------------------------

Fictitious Registration - Domestic - Information

Charter Number: X00993823

Status: Fictitious Active

Entity Creation Date: 9/2/2009

State of Business.: MO

Expiration Date: 9/2/2014
------------------------------------------

Owners

Name: ONLINE BUSINESS, LLC
Address: 300 N. Fourth Street # 607
St. Louis MO 63102
=======================================

So the the FBN UNIQUEDESKTOPSTYLE.COM is owned by ONLINE BUSINESS, LLC. That in turn leads to the cyber-mule:

[att=2]

=======================================
Missouri Division Of Corporations

Business Name History

------------------------------------------

Name Name Type

ONLINE BUSINESS, LLC

Type Legal
------------------------------------------

Limited Liability Company - Domestic - Information

Charter Number: LC0993815

Status: Active

Entity Creation Date: 9/2/2009

State of Business.: MO

Expiration Date: Perpetual

------------------------------------------

Registered Agent

Agent Name: Mark, John L.
Office Address: 300 N. Fourth Street, #607
St. Louis MO 63102
Mailing Address:
------------------------------------------
=======================================

Based on the dates of formation, it is likely that UNIQUEDESKTOPSTYLE.COM aka ONLINE BUSINESS, LLC 573-321-4029 began processing fraud charges around a month ago, and are now coming to the attention of some of the fraud victims.

Note the use of VIVIDMOBILETHEMES.COM in the uniquedesktopstyle.com registration. That domain is cloaked and is now expired:

==========================
Registration Service Provided By: NameCheap.com
Contact: support@NameCheap.com

Domain name: VIVIDMOBILETHEMES.COM

Registrant Contact:
WhoisGuard
WhoisGuard Protected ()

Fax:
8939 S. Sepulveda Blvd. #110 - 732
Westchester, CA 90045
US

Creation date: 21 Nov 2008
Expiration date: 21 Nov 2009
==========================

However, in researching the historical changes made to the domain registration, it shows that back in December of 2008 the domain was not privacy cloaked at that time. The domain had the identical registration as UNIQUEDESKTOPSTYLE.COM

==========================
Domain name: VIVIDMOBILETHEMES.COM

Registrant Contact:
VIVIDMOBILETHEMES.COM
Alice Snow (AliceSnow23@gmail.com)
+1.6013730167
Fax: +1.5555555555
144 Carpenter Dr
Jackson, MS 39212
US

Status: Locked

Name Servers:
ns19.worldnic.com
ns20.worldnic.com

Creation date: 21 Nov 2008
Expiration date: 21 Nov 2009
==========================

I cannot find any search returns on the domain name, However the hosting history of IP addresses:


VIVIDMOBILETHEMES.COM
.
IP Address History
.
Event Date Action Pre-Action IP Post-Action IP 
==============================================
2008-11-23 New      -none-      205.178.145.65  
2008-11-24 Not Resolvable 205.178.145.65  -none-  
2008-12-01 New      -none-      205.178.145.65  
2009-11-08 Change 205.178.145.65  69.64.156.62  
2009-11-23 Change 69.64.156.62  69.64.155.126

are not only the same as UNIQUEDESKTOPSTYLE.COM, they are also share the same IP as ECONTENTNOW.COM

==========================
ECONTENTNOW.COM

IP Address:205.178.145.65
IP Location: - Virginia - Herndon - Network Solutions Llc
Response Code:200
Domain Status:Registered And Active Website
==========================

This grouping:

LAVRI.NET aka LAVRI LLC 239-451-7017
ECONTENTNOW aka ECONTENTNOW.COM
UNIQUEDESKTOPSTYLE aka UNIQUEDESKTOPSTYLE.BIZ
aka UNIQUEDESKTOPSTYLECOM 573-321-4029

are all part of the design genre of which the longest active charge fraud entity is CHEAPESTTHEMES.COM, running since early January of this year: »www.google.com/search?hl=en&q=ch···oq=&aqi=

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 13 Nov 2009 06:17:18 EDT

MGD : LOL !! I believe that is why it is turned off, they probably consider it a "security risk" to the criminal operation. Though I know it is configured to work in some cases during the initial merchant account set up. I am aware of it being tested during the final approval process. Also, on at least one occasion they told a suspicious cyber-mule to "try it" to see that it worked. Though later when I arrived on the scene it was disabled.

Back in 2005 when the financial processing system was relatively ignorant, the syndicate used to batch the card data in bulk lots. Now they are more sophisticated. The data comes in individually, spaced apart time wise, to more closely mimic a real scenario, in order to fool any form of fraud detection triggers. I reviewed logs that indicate the data may be scripted to come in via bots in an irregular fashion from various domestic IPs.

The interesting thing is that my first major break came in the case which allowed me to "get in the door" in 2007 at the height of the "Inowest Enterprises Inc" laundering aka Fethard Finance, aka Fethard.biz »/r0/download/1···as_3.wav When a cyber-mule under the C&C of "Tomas Lasinkas"
»Ebook websites, fraud charges, Devbill/DigitalAge/Pluto contacted me after he became suspicious during an ongoing operation.

The final suspicious straw for the cyber-mule that prompted him to contact me, was when he decided to go ahead and "order a template" from the site that was assigned to him, which had been running for several months. He completed a purchase using his own card data, and nothing happened. However two days later he got an email from "Lasinkas" asking him why he had entered his credit card on the website.

That convinced the cyber-mule that all the daily transaction purchase reports that he was getting from Authorize.net, were not the result of the card holders making purchases from the site. After contacting me the cyber-mule agreed to stay dumb for a week or two which enabled a lot of intelligence gathering. We created numerous problems as to why the foreign wire transfers could never complete. As I recall, the account at that time had accumulated somewhere between $15,000 and $20,000 of fraud proceeds. So I was sure a scenario could be created to draw them out in the open to collect the money. I was convinced that they would do back flips for that amount of funds. We kept "trying" to complete the transfers as instructed to Inowest Enterprises Inc, at Eurobank, in Sofia, Bulgaria, then asked for other alternatives, including a domestic drop due to the "failures". They would not budge, and eventually became suspicious and walked away. I was shocked, most criminals would sell their mothers five times over for that amount. Little did I know at the time that this was just a drop in the bucket compared to the total ongoing operation. That became the first gauntlet in the "interference operation", cutting off the outbound fraud proceeds of the organized crime operation, and the most effective interference tactic. Prior to that, killing the website hosting had little or no effect on the operation whatsoever. The latter however, appeared to create severe anger management problems in Eastern Europe.

The intelligence gathered revealed for the first time how the whole process functioned. Recruiting and duping cyber-mules, and how it was done. Registering LLCs / Corps, obtaining IRS ein numbers, setting up business bank accounts, and obtaining merchant accounts. Also the mandatory non variable of always using Authorize.net for the merchant gateway for card fraud processing. Even though I thought it was still vary hard to subsequently identify and locate other cyber-mules, it was comparatively easy, unlike now. In circa 2006 through 2007, the contact phone number listed on the fraud websites could be used to identify the state where the LLC/Corp was registered, and thus where the cyber-mule lived. The geographic area code of the number was always the state where the corresponding LLC was registered. The syndicate caught on from the failure rate, they then made sure that both the registered domain address and the area code of the contact number were both from different states than where the cyber-mule was located. Later they also stopped the practice of having production factory servers, where batches of the fraud websites were initially created. Find one and shadow it, and you would then find twenty or more.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 13 Nov 2009 04:55:51 EDT

SnowyOne :

said by MGD :

All they need to process fraudulent card data is to interface a script directly with authorize.net.

That's about control, total control of what is piped into their processor. As I've mentioned before, if they had working carts on their sites all it would take is one jerk such as myself to start pumping a few hundred working credentials into the system on a daily basis & they'd become involuntarily disconnected in a hurry!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 13 Nov 2009 04:07:40 EDT

MGD :

said by SnowyOne :

said by MGD :

First time that hosting location has been observed. There is some concern, because that host may offer packaged merchant accounts or proxy card billing »www.networksolutions.com/e-comme···fits.jsp

There is a front end shopping cart interface but the back end is DOA.
The credentials should have had smooth sailing...

Thanks, good catch. In many cases the front end billing to the site is not hooked up. The syndicate scripts the hijacked card data processing directly to the merchant interface. The card fraud processing is automated.

During the merchant account application process they do sometimes have the web interface functioning, but will then unhook it. Depending on the merchant company they will test the interface and confirm SSL functionality etc.

In fact once they are approved for a merchant account, they do not even need the website. Card data can be entered directly at the Authorize.net gateway interface.

In recent times they are having a much higher failure rate with the standard bank originated merchant accounts. Many are now caught either during the enrollment process and rejected, or interdiction takes place shortly thereafter. AS a result they syndicate has been testing new methods and vendors for merchant processing, a la Transfirst. In this case I suspect that UNIQUEDESKTOPSTYLE.BIZ might have dealt directly with the hosting company for merchant services.

The ideal set up for the criminals is to obtain merchant services via the cyber-mule from the bank where the business account is located. That is the least restrictive process in terms of vetting, as it involves one on one human contact with an individual who meets a minimum credit score requirement. Consequently the merchant and website vetting is only subjected to a peripheral check.

One reliable indicator that the merchant account is bank originated along with a cyber-mule who has a high credit score, can be seen when the domain has a fraudulent registration. The banks never check it, and the OCS knows that they don't. A domain with a cloaked registration can be indicative that the merchant account was obtained in the secondary market. Accounts obtained in that field are more high risk and subjected to a higher level of scrutiny. In many cases there is no face to face meeting with the applicant, the process is done online. The domain registration data is required to be submitted as part of the approval process.

That was why I am suspicious that they may be testing this hosting service because it may offer an integrated merchant account. However, SSL does not appear to be active, and the source code on the ordering pages appears not to be incomplete:

=====================
form name = "purchase" action = "Li3O06mIeRh9U.php" method = "post"
input name="authscr" type="hidden" value="on"

input name="prid" type="hidden" value=""
input name="cust_country" type="hidden" value="US"
=====================

All they need to process fraudulent card data is to interface a script directly with authorize.net.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 13 Nov 2009 02:38:45 EDT

SnowyOne :

There is a front end shopping cart interface but the back end is DOA.
The credentials should have had smooth sailing...

DOA

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 12 Nov 2009 12:20:15 EDT

MGD : Kudos again to that JGB victim who posted a link over on 800notes.com »800notes.com/Phone.aspx/1-770-451-9777

I am still perplexed that the card validation processing using SAT-N-SOUND 770-451-9777 could go on for over a year. Something is clearly broken in the system. There is no external ability to globally block or blacklist a merchant account from processing. Individual banks can block or blacklist or generate alerts on specific incoming charges, but there is no system to block them at the root level. Some victims report that their instition flagged their card when the SAT-N-SOUND charge hit, so it is clear that some banks have blacklisted them.

If a victim of the SAT-N-SOUND 770-451-9777 fraud can provide the transaction ARN id on the charge, it may be possible to track down the bank where the merchant account is located, and have it closed.

Likewise listing the line item of any additional fraudulent charges will be helpfull.

In fact, the latest victim reports over on merchantcircle.com are providing additional evidence that attributes the overall operation to this organized crime syndicate. SInce my original posting, these reports have surfaced:

quote:
=============================================
Fraudulent charges on my BoA credit card

I received several bogus charges on my Bank of America credit card starting on November 2nd including NewEgg, Buy, Uniquedesktopstyle, Kahphoto, and SAT N Sound. I have canceled the card but Bank of America is not aware of any fraud leaks from their computers.

November 11, 2009 by Mark in Beverly Hills, CA

=============================================

Unauthorized credit card charges were made from helps247.com followed by Sat N Sound and Kahphoto.com.
All under 2 dollars. Beaware! Notify your banks, some of them still have no clues!

November 10, 2009 by Oxana in San Diego, CA
=============================================

Multiple people are reporting tandem ping charges from Kahphoto.com. However, if that name is correct, it is a legitimate webiste and business that has been around for several years. I do not yet know if it is a cloned or hijacked merchant account. It could be a copycat cloned domain, though I have checked all the TLDs.

In addtion to Kahphoto.com there are multiple reports of: helps247.com and Uniquedesktopstyle I have checked variations of helps247.com and its TLDs, and cannot nail it. On the other hand Uniquedesktopstyle is confirmed as a second OCS card fraud laundering website in addition to Konstantin Stuka's LAVRI.NET aka LAVRI LLC 239-451-7017

UNIQUEDESKTOPSTYLE aka UNIQUEDESKTOPSTYLE.BIZ

[Att=1]

No phone number, only email contact with an image cloaked address:

Snapped 2009-11-12 12:25:06

»uniquedesktopstyle.biz/contact.us.php

The usual money back request form in order to issue a credit and avoid chargebacks for the few who catch the fraud charge and pursue it:

Snapped 2009-11-12 12:24:44

»www.uniquedesktopstyle.biz/money···uest.php

Hidden in plain sight with a "deny all" robots.txt file:

Snapped 2009-11-12 12:24:24

»uniquedesktopstyle.biz/robots.txt

Though the design is different, the wording on the main page is a cloned copy of a previous card fraud laundering website acrossthescreenuniverse.com 786-522-9361 uncovered by music man on 08/29/2009 »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

It would be a great help if victims of the SAT-N-SOUND 770-451-9777, Kahphoto.com, helps247.com, Uniquedesktopstyle can provide additional info from the line item charges that is not already known. Also, if other names show up in tandem.

UNIQUEDESKTOPSTYLE.BIZ has a cloaked domain registration:

Domain Name: UNIQUEDESKTOPSTYLE.BIZ
Domain ID: D36803626-BIZ
Sponsoring Registrar: ACTIVE REGISTRAR, INC.
Sponsoring Registrar IANA ID: 1090
Domain Status: clientTransferProhibited
Registrant ID: DI_10654557
Registrant Name: Whois Manager
Registrant Organization: Whois Proof LLP
Registrant Address1: PO Box 4120
Registrant City: Portland
Registrant State/Province: OR
Registrant Postal Code: 97208-4120
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.2024700599
Registrant Facsimile Number: +1.8663666681
Registrant Email: jb8310x2e@whoisproof.com

Name Server: NS37.WORLDNIC.COM
Name Server: NS38.WORLDNIC.COM
Created by Registrar: ACTIVE REGISTRAR, INC.
Last Updated by Registrar: ACTIVE REGISTRAR, INC.
Domain Registration Date: Mon Nov 09 18:54:27 GMT 2009
Domain Expiration Date: Mon Nov 08 23:59:59 GMT 2010

Hosting:

IP Location: United States Belleville Monstercommerce Llc
IP Address: 206.188.193.62
Reverse IP: 1 other sites hosted on this server.
Blacklist Status: Clear

OrgName: MonsterCommerce, LLC
OrgID: MONST-1
Address: 8 Park Place
Address: Suite B
City: Belleville
StateProv: IL
PostalCode: 62226
Country: US

NetRange: 206.188.192.0 - 206.188.223.255
CIDR: 206.188.192.0/19
NetName: MONSTERCOMMERCE
NetHandle: NET-206-188-192-0-1
Parent: NET-206-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.MONSTERCOMMERCE.COM
NameServer: DNS2.MONSTERCOMMERCE.COM

First time that hosting location has been observed. There is some concern, because that host may offer packaged merchant accounts or proxy card billing »www.networksolutions.com/e-comme···fits.jsp

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 10 Nov 2009 00:37:43 EDT

MGD : Yes, that makes sense. Interesting that you brought it up, as that motivated me to pull the history. Though the cvurrent registration began in April of this year, it was not registered at first to this Florida name address:

Domain Name: FUNBOXPORTAL.COM

Registrant:
Funbox
CHERYL ARCHER (jm@4ordered.com)
21 Hickory Avenue
Shalimar
fl,32579
US
Tel. +850.000000

Creation Date: 17-Apr-2009
Expiration Date: 17-Apr-2010

The above configuration came into place sometime betwen 09/25 and 11/05. Between its original 04/29/09 date and 09/24 it was listed as follows;

==============================
DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM

Registration Service Provided By:
REAL INTERNATIONAL BUSINESS CORP.
Contact: +1.6462130098

Domain Name: FUNBOXPORTAL.COM

Registrant:
atm-master
MARTHA RIVERA (AxelHegel@gmx.de)
3064 brighton 3rd st ,
apt 2
brooklyn
NY,11235
US
Tel. +951.7553423

Creation Date: 17-Apr-2009
Expiration Date: 17-Apr-2010

Domain servers in listed order:
ns1.hqhost.net
ns0.hqhost.net
============================

Can you say carded !!

A prior unrelated registration expired in 09/2006, so a 2007 deletion would make sense. The name was then picked up and registered in April of this year. It is clear that neither of those names / addresses are likely to be the "owners".

I only glanced through the 148 site names on that server. Even though it does not appear completed, »www.funboxportal.com/ caught my attention because of its configuration. The domian reg added to that suspicion.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 09 Nov 2009 23:18:44 EDT

Whip : I don't know the validity of this site but:

»www.expiresoft.com/domains/avail···6-46.htm

shows that funboxportal was deleted sometime in 2007. I would imagine that it was once operational before.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 09 Nov 2009 19:44:52 EDT

MGD : The tip that led to this operation came as a result of search referrals to ths thread. Apparently an astute charge victim noticed the similarities between his fraud charge and the operation documented here.

Though there appears to be some strange anomolies occurring here, it is not without precedent. We know going back over five years that a portion of the card data that this organized crime syndicate uses is pre-validated via hijacked legtitimate merchant accounts. As far back as the Digital Age fraud operation many victims reported that their cards were ping charged prior to the fraud charges. The first revelation was in 2005 where a shop in Pennsylvania reported that its merchant account was used over a weekend to ping charge several thousand cards. Those victims were subsequently hit with various fraud charges from the crime syndicate.

In this current case multiple victims are reporting small fraud charges under $2.00 coming from a company in Georgia called SAT-N-SOUND 770-451-9777. The strange thing is that the first report of this goes back to March 26th 2009 on 800notes.com:

quote:
mcb - 26 Mar 2009
Credit card shows small amount ($1.96) from company called SAT-N-SOUND. Tuyrns out the phone number 770-451-9777 belongs to a company in Atlanta. Called the number, the company says they have had there records compromised and that these charges are not being made by them. If you see this on your debit or credit card, call you cc company. I cancelled my card and re-issuing - just to be safe. Be careful with the small initial "test" withdrawl attempt

However, during this month, November 2009, there are a flood of angry victims reporting these fraud charges:

[att=1]
[att=2]
[att=3]

Ref:»www.merchantcircle.com/business/···986-9998

Ref:»www.merchantcircle.com/business/···out/list

The more you dig, shows that this has been going on for almost a year. Not uncommon also, even a victim form Australia:

quote:
Shamsters - I've been hit in Australia
The other day I noticed a charge of $1.99 (Australian dollars) so spoke to my bank and the guy found the other reviews on this site and advised that I cancel my card immediately, which I did. These people need to be stopped. Does anyone know what we can do? They are obviously trying to rip people off world-wide.

March 18, 2009 by Tania

[att=4]
[att=5]

Ref:»www.merchantcircle.com/business/···iew/list
And:
Ref:»www.merchantcircle.com/business/···start=30
And:
Ref:»www.merchantcircle.com/business/···start=60

Though they are subjected to a large amount of cyber abuse SAT-N-SOUND 770-451-9777 ARE CLEARLY VICTIMS in this case. Though it is astonishing that this merchant account whether hijacked or fraudulently set up can continue to function for this considerable period of time. I will wager however, that the account uses authorize.net / Cybersource as a gateway.

quote:
Close your CC/Debit card ASAP!

Called the company (ATL DTH aka Sat n Sound) with this number (770) 451-9777, dialed for the Accounting Dept..spoke to a Chinese lady who notified me that someone has used their company as a front to make charges and steal CCs. They deal in satalite equipment apparently. She said she has notified the FBI and local police about their breach. In the meantime, close your cards ASAP and file for a refund through your bank. Good luck and f*ck these low life thieves!!!

November 06, 2009 by Nice try..but NO

Not only does SAT-N-SOUND 770-451-9777 have a fraud alert recording on option 6 of that phone number, they also have a website alert posted:

[att=6]

»www.satnsound.com/Fraud%20Page.html

. . . CREDIT CARD FRAUD ALERT

From October 30th 2008 and on, we have received many phone calls regarding small charges (mostly under $2) appearing on people's credit or debit card statements. These charges appear to have been made by us because they have a "Sat 'N Sound" notation and our Georgia phone number.

Please be advised that, Atlanta DTH, Inc., dba Sat ‘N Sound, did NOT initiate the charge(s). What happened is the result of Credit Card Fraud, and Theft of Corporate Identity.

A thief has apparently,

1) Set up a credit card merchant account using our company name and phone number

2) Stolen your credit card or debit card number

Then they charged a small amount to your card, hoping you would not notice it.

Please IMMEDIATELY notify your credit card company and inform them of this incident.

At this time, we have notified the FBI, the local law authority, and credit agencies about this fraud.

Thank you for contacting us and alerting us about it. If you have additional questions, please contact us at (770)451-9777 or the address as appeared on this letterhead.

Atlanta DTH, Inc.

Take note of the first reported date 10/30/2008

It is difficult to track subsequent charges as a result of the ping validation, because only victims who catch the ping charging are posting, and they subsequently cancel their cards. However in reviewing the numerous complaints throughout the net, I came across this valuable morsel:

quote:
BOA - 6 Nov 2009
I also got a charge for a $1.82 that originated from SAT N SOUND that I found today while I was canceling my card from an unauthorized charge from LAVRI.NET, phone number 239-451-7017 which appears to be a website run out of a residence in Lehigh Acres FL. Both of these charges were unsolicited. True to form the person I talked to at LAVRI.NET said she will refund my account after she gave me the cryptic email address of the the alleged purchase......Thanks JGB for the info on the ebook article

Ref:»800notes.com/Phone.aspx/1-770-451-9777

I am very interested in hearing from anyone who had subsequent charges after the SAT N SOUND fraud charge, and what they were.

Organized crime syndicate's Card fraud laundering:

LAVRI.NET aka LAVRI LLC 239-451-7017 »lavri.net

[att=11]

=======================

• client@lavri.net

• support@lavri.net

Sandra Trapp
4625 deleon st, apt 231,
fort mayers, fl, 33907

+1 (239) 491 7017

=======================

This genre and theme has been used multiple times over the years.

[att=7]

Lavri.net has been cloned from hexisoft.com & ppt2video.com

Checking the domain registration:

================================
ICANN Registrar:DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM
.
Registration Service Provided By: REAL INTERNATIONAL BUSINESS CORP.
Contact: +1.6462130098
.
Domain Name: LAVRI.NET
.
Registrant:
lavri
Sandra Trapp (lavrigroup@gmail.com)
11657 oxnarrd st. suit 229
Hollywood
null,91606
US
Tel. +372.253403775
.
Creation Date: 18-Sep-2008
Expiration Date: 18-Sep-2010
.
Domain servers in listed order:
ns0.hqhost.net
ns1.hqhost.net
.
Administrative Contact:
lavri
Konstantin Stuka (lavrigroup@gmail.com)
11657 oxnarrd st. suit 229
Hollywood
CA,91606
US
Tel. +372.253403775
================================

It is unlikely that "Sandra Trapp" is fluent in Russian, though that lavrigroup@gmail.com email account was set up via a Google Rusian language tld.

[att=8]

Note the regisration in September of 2008, compared to the october 2008 date noted by the alert from SAT N SOUND. Also note that the contact phone number contains the country code for Estonia. A check of Florida public records shows nothing for a Sandra Trapp at that address. (it could be a recent move). Also a check of Florida corporate records and DBA business registrations shows nothing relevant to LAVRI or Sandra Trapp.

Several days ago I called the number listed on the website 239-451-7017. The call was forwarded to another number. A female answered who sounded eastern European and a non native English speaker. I asked her what her relationship to the company was. She said that she answered the calls for them. I said "for who", she said for "Lavri net". I asked "Who do you work for", she replied " Sandra Trapp". I said "where is Sandra Trap at", she said Florida. I asked if it was a Florida company, she said "Yes". "Are they licensed and registered in Florida", she said "yes", though I had already checked and found no record. Is it a "corp / LL or DBA", I said, she said DBA. I asked "how I can reach Sandra Trapp", she said "I do not want to give that information out". I asked "what do you do when people call complaining of charges to their cards". She replied that "I email the information to the company". I said "what is their email address", she said "I do not want to give that information out".

I advised her that she is participating in an organized criminal operation of card fraud, money laundering, and identity theft, very serious crimes. She said "that is not possible, I do not believe that, we have been in operation since last year". I said that I am positive that you are, she said "this is very disturbing, can you call back tomorrow" and hung up. Several calls the next day went unanswered and were forwarded to voice mail.

I dug a little further, the domain registrant's name of Sandra Trapp, and that Florida address are new. They were added when the one year domain registration was renewed in September of 2009.

Prior to that date it was registered to:

================================
Registration Service Provided By:
REAL INTERNATIONAL BUSINESS CORP.
Contact: +1.6462130098

Domain Name: LAVRI.NET

Registrant:
lavri
Konstantin Stuka (lavrigroup@gmail.com)
11657 oxnarrd st. suit 229
Hollywood
CA,91606
US
Tel. +372.253403775

Creation Date: 18-Sep-2008
Expiration Date: 18-Sep-2009

Domain servers in listed order:
ns1.hqhost.net
ns0.hqhost.net
================================

A check of that address in Calfornia shows that "suit 229" is an apartment at "la Nouvelle Apartments" at that address. Furthermore, a check of California division of corporations records shows:

[att=9]

============================
LP/LLC

LAVRI LLC

Number: 200824710133
Date Filed: 8/26/2008
Status: active

Jurisdiction: CALIFORNIA

Address
11657 OXNARD ST UNIT 229
NORTH HOLLYWOOD, CA 91606

Agent for Service of Process:

KONSTANTIN STUKA
11657 OXNARD ST UNIT 229
NORTH HOLLYWOOD, CA 91606
============================

I am now wondering if the individual who was on the phone is related to the above name.

Many of the buy options on lavri.net do not function correctly. Those that do, not suprisingly, show an Authorize.net logo:

[att=10]

The website has been hosted from its inception in the UK, on IP 88.214.204.40. Though it lists the name as Hosting Solutions Ltd. GB, they are from the Ukraine:

IP Location: United Kingdom Hosting Solutions Ltd
IP Address: 88.214.204.40
Reverse IP: 149 other sites hosted on this server.
Blacklist Status: Clear

inetnum: 88.214.192.0 - 88.214.255.255
netname: UK-UAONLINE-20060118
descr: Hosting Solutions Ltd.
country: GB
org: ORG-RIBC1-RIPE
admin-c: HSLD1-RIPE
tech-c: HSLT1-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: uaonline
mnt-lower: hqhost
mnt-domains: uaonline
mnt-domains: hqhost
mnt-routes: uaonline
mnt-routes: hqhost
source: RIPE # Filtered

organisation: ORG-RIBC1-RIPE
org-name: Hosting Solutions Ltd.
org-type: LIR
address: Hosting Solutions LTD.
Sergiy Sabyetyev
145-157 St John Street
2nd Floor
EC1V 4PY LONDON
UNITED KINGDOM
phone: +16462333035
fax-no: +442032921594
admin-c: MS9776-ripe
admin-c: EA2-RIPE
mnt-ref: uaonline
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: hqhost
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered

role: Hosting Solutions Ltd. DBM
nic-hdl: HSLD1-RIPE
org: ORG-RIBC1-RIPE
address: Hosting Solutions LTD
address: Sergiy Sabyetyev
address: 145-157 St John Street
address: 2nd Floor
address: EC1V 4PY LONDON
address: UNITED KINGDOM
phone: +16462333035
fax-no: +442032921594
abuse-mailbox:
admin-c: MS9776-RIPE
admin-c: EA2-RIPE
tech-c: MS9776-RIPE
tech-c: EA2-RIPE
mnt-by: hqhost
source: RIPE # Filtered

role: Hosting Solutions Ltd. Tech
nic-hdl: HSLT1-RIPE
org: ORG-RIBC1-RIPE
address: Hosting Solutions LTD
address: Sergiy Sabyetyev
address: 145-157 St John Street
address: 2nd Floor
address: EC1V 4PY LONDON
address: UNITED KINGDOM
phone: +16462333035
fax-no: +442032921594
abuse-mailbox:
admin-c: HSLD1-RIPE
tech-c: HSLD1-RIPE
mnt-by: hqhost

.
An audit of the servers contents at that IP address 88.214.204.40 yields another suspicious domain FUNBOXPORTAL.COM »funboxportal.com . Note that there are no nefarious reports, it is the registration which is suspicious, and not likely to be legit:

ICANN Registrar:DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM

Registration Service Provided By:
REAL INTERNATIONAL BUSINESS CORP.
Contact: +1.6462130098

Domain Name: FUNBOXPORTAL.COM

Registrant:
Funbox
CHERYL ARCHER (jm@4ordered.com)
21 Hickory Avenue
Shalimar
fl,32579
US
Tel. +850.000000

Creation Date: 17-Apr-2009
Expiration Date: 17-Apr-2010

Domain servers in listed order:
ns0.hqhost.net
ns1.hqhost.net

.

To reiterate, as I mentioned earlier, testing a portion of the compromised card data via hijacked or bogus merchant accounts prior to charging them, has been a known tactic of this crime syndicate for many years. You can find that identical modus operadi going back over half a decade with this fraud operation:

For example, over 4 years ago in September of 2005

said by Doctor Olds :

A triple header.

September 11th, 2005

First a test charge authorization of $1.00 dollar from:

Telecommunications Equipment
Coastal Wave Internet
Port Clinton, OH

+++++++++++++++++++++++++

September 23rd, 2005

Then a $9.95 charge from:

KCSOFTLLC.com
Rochester, NY

Listed on BBB Warning page since March 24th, 2005
»www.spokane.bbb.org/alerts/alert···wstype=1

+++++++++++++++++++++++++

September 24rd, 2005

Then a $24.99 charge from:

Digital Age
Cypress

++++++++++++++++++++++++++

It looks like someone is testing the card and if the Auth goes through, then the other companies hit the card for their charges. Or is it just unrelated? One company is apparently legit.

Anyone else with these 3?

Regards,

Doctor Olds

Ref:»[scam] Digital Age, KCSOFTLLC and Coastal Wave Int

from 02/18/2005:

said by legalbegal :

Pluto Data Credit Card Charge

I got a charge for $29.99 on my credit card that read:

888 323 8955 PLUTO D - Nicosia

When I called the number, I was told that the charge was dfrom a company called "Folk and Tribal" and it was for a DVD. However, on the date that the purchase was made, I had just had surgery so there was no way I was buying stuff online or out shopping.

I could not find the charge anywhere in my records OR this company anywhere online.

So I called back and demanded the name and contact information for the company. They said that they do not keep those records. When I demanded a refund, I was then told that they would contact the company to request my refund.

WTF? I thought they did not have that info????
....
.

A third post later that day:

said by legalbegal :

Ah HA!!

I found yet ANOTHER charge on my card from:

Fpb Enterprises
119 Wildwood Cir
Gainesville, GA 30501
770-536-1736

I called this lady and she said that someone has used her company and made over 9000 transactions within a month for under $3.00. SHe said that 5000+ have been reveresed. They shut down her website and everything and the Department of Homeland Security and the FBI are paying her a visit.

She said that they are "pinging" people's credit cards and that she has nothing to do with it. She said that she runs a small website "Pamperedpreemies" and did not know what was happening when they called her.

This is obviously some scam. Yawl better check your credit card statements for pings from strange companies.

Ref: »Pluto Data Credit Card Charge

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 09 Nov 2009 00:12:44 EDT

MGD : This crime syndicate's card fraud laundering operation was nipped in the bud by a third party before it got too far off the ground.

MVP123ONLINE.COM aka MVP123Online LLC 215-337-4653

[Att=1]

===================================

MVP123Online
ph, +1 (215) 337-4653
sales@mvp123online

Please enter the required information below, to complete your order.
Please use the comments field to describe your order more specifically.

Icons: 9.95$

Logo: 9.45$

Vector: 8.75$

Vector from your image: 8.45$

Change your own logo/icon: 0.05$ ---> Cover for card pinging

=================================

[att=2]

Domain was registered to the cyber-mule:

Server Type:Apache
IP Address: 97.74.188.231
IP Location: - Arizona - Scottsdale - Godaddy.com Inc
Domain Status: Registered And Active Website

ICANN Registrar:GODADDY.COM, INC.

Registrant:
Marina Petcherskaia
12 Monica Drive
Holland, Pennsylvania 18966
United States

Domain Name: MVP123ONLINE.COM
Created on: 08-Sep-09
Expires on: 08-Sep-10
Last Updated on: 08-Sep-09

Administrative Contact:
Petcherskaia, Marina admin@mvp123online.com
12 Monica Drive
Holland, Pennsylvania 18966
United States
+1.2153998579 Fax --

Domain servers in listed order:
NS09.DOMAINCONTROL.COM
NS10.DOMAINCONTROL.COM

[att=3]

Cyber-mule was recruited from an online resume by SIA Digitala Pasaule claiming to be in Latvia:

JOB FRAUD SCAM = DIGITALAPASAULE.COM = JOB FRAUD SCAM »digitalapasaule.com

[att=4]

Fraudulent domain registration:

Server Type:Apache
IP Address:97.74.144.134
IP Location - Arizona - Scottsdale - Godaddy.com Inc
Response Code:200
Domain Status:Registered And Active Website

Registrant:
David McAllister davidalisters@yahoo.com
2672 West Church Street
Eden, New York 14057
United States

Domain Name: DIGITALAPASAULE.COM
Created on: 06-Apr-09
Expires on: 06-Apr-10
Last Updated on: 28-May-09

Administrative Contact:
McAllister, David davidalisters@yahoo.com
2672 West Church Street
Eden, New York 14057
United States
(585) 502-4102 Fax --

Domain servers in listed order:
NS33.DOMAINCONTROL.COM
NS34.DOMAINCONTROL.COM

quote:
Welcome to the official home page of "SIA Digitala Pasaule".

We offer a wide variety of services and products for all your needs.
We hope you will find what are looking for with www.digitalapasaule.com
Feel free to browse our company website for products or services available.
Our customer support managers are always ready to assist you in your search.

"SIA Digitala Pasaule" works on the market of online sales and provides qualified assistance to individuals and product manufactures on different steps of a journey called "successful business operation" We will always help you find new clients or points of sale for your products or services. Our qualified staff will analyze your needs and desires to improve your business situation. We are so proud of our services that we even offer a full money back guarantee to all new clients.

HR Department: recruitment@digitalapasaule.com
IT Department: web@digitalapasaule.com
Billing Department: payments@digitalapasaule.com
Customer Service: products@digitalapasaule.com ordelivery@digitalapasaule.com
services@digitalapasaule.com

Existing clients please use the login page to access your account information.

New clients please contact the customer service department for any questions regarding your products or delivery times. You will receive the login information after your order will be verified and approved.

=================================

Description: Office Employee.

Currently we do not have any available openings in our office.

Description: Representative/Contractor/Freelancer/Home-based Jobs.

We offer different jobs for freelancers in multiple countries.

Available home-based jobs are different every week.

To apply for the next available job vacancy please email your resume, motivation letter and references from your previous employment to our recruitment department at recruitment@digitalapasaule.com This e-mail address is being protected from spambots. You need JavaScript enabled to view it

Please also provide a list of the preferred jobs you would like to accept, additional benefits and the minimal monthly salary.

Your resume and additional information will be reviewed and stored for company records. The company will create a unique profile of your characteristics and skills. You will receive different job offers from the company, based on your profile, as soon as they will be available.

Job offers provided to you will have detailed information regarding the job, the salary, company benefits, working hours, location, responsibilities and duties, employment agreement and a detailed description of the available position.

Information in this section of the site is updated weekly, please check for updates later.

There was a thread on a Monster.com forum from several months back, where multiple people posted of receiving job offers. Ref:»saleshq.monster.com/topics/1488-···ny/posts

It is particularly important that potential cyber-mule recruits pay attention to this potential recruits post:
(emphasis added)

quote:
will be glad to forward anyone the information that I've received so far about the company. A couple of things I know for sure. Read on for the bottom line info: The company is based out of Latvia. I signed the contract - after speaking to someone on the phone from the company. I also had a very proficient lawyer friend look over the contract and he couldn't see any loopholes or tricks tied into it (to make sure this wouldn't come back to bite me in the butt in any way shape or form). They haven't asked for a penny of investment on my part . The contract clearly states that I will receive 1500 dollars biweekly from the company for managing one of their online stores and 5% of revenue from each additional online store I choose to manage. What I'm gathering as our "business relationship" is progressing is that they don't have any online stores, but really train people how to START THEIR OWN online stores. This assessment could be a tad premature, but I'll followup and inform everyone on what develops. - Joe Davis -

Joe never did post back, however, multiple cyber-mules who became involved in this massive fraud operation have told me that they also had a lawyer review the proposal and documents and were told that they appeared to be legitimate. Cyber-mules who were initially hesitant, went forward, and became involved thinking that they had performed due diligence on the job offer.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 14 Oct 2009 21:46:35 EDT

MGD : JOB FRAUD SCAM = Bright Art aka BRIGHTARRT.BIZ = JOB FRAUD SCAM

Hijacked Card data fraud laundering cyber-mule recruiting operation.

[att=1]

==============================
Give us a call:

+46-08-599 26 319

or contact online

info@brightart.biz

Rich Productions 2001 - 2009

Frejgatan 13 11479

Stockholm

Sweden

==============================
»brightart.biz

[att=2]

• employment opportunities
-----------------------------

If you are an ambitious, high-energy person who enjoys a fast-paced team environment laced with challenges and opportunities, you've come to the right place. Read on to discover how to pursue employment opportunities with us. Bright Art offers great jobs, great pay, great benefits and a great place to work!

• we want you to be part of our team
---------------------------------------
Email us to info@brightart.biz or just complete the form at Contact page. Our customer service will provide you with details regarding the position of Affiliate Company Director.

Hidden from everyone, except targeted recruits:

[att=3]

• e-commerce websites
--------------------------
Our developers are well versed with the implementation of shopping carts and integration with payment gateways to enable online shopping and processing of credit card payments.

LOL!! well versed is right. This OCS has "implemented" several thousand websites since the early 2000s for "online shopping and processing of credit card payments."

Every one of them to exclusively process fraud charges against consumer's hacked card data.

Snapped 2009-10-14 21:43:29

»www.inika.com/services.php

Problem with the extra monthly payment for domain registration privacy protection:

Circa 09/03/2009

Domain Name: BRIGHTART.BIZ
Domain ID: D33482294-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Domain Status: clientTransferProhibited
Registrant ID: F66F7EBC713B9797
Registrant Name: Whois Agent
Registrant Organization: Whois Privacy Protection Service, Inc.
Registrant Address1: PMB 368, 14150 NE 20th St - F1
Registrant City: Bellevue
Registrant State/Province: WA
Registrant Postal Code: 98007
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.4252740657
Registrant Email: wqwssgrj@whoisprivacyprotect.com

Circa 09/10/2009:

Not that you need any additional evidence, but the largest users of
"domain cloaking" are criminals and scammers.


Domain Name:                                 BRIGHTART.BIZ
Domain ID:                                   D33543124-BIZ
Sponsoring Registrar:                        ENOM, INC.
Sponsoring Registrar IANA ID:                48
Domain Status:                               clientTransferProhibited
Registrant ID:                               96D4D7FCD42CF61D
Registrant Name:                             Linda  Ray
Registrant Address1:                         126 Bittercreek Dr
Registrant City:                             Folsom
Registrant State/Province:                   CA
Registrant Postal Code:                      95630
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.2393447607
Registrant Email:                            rozvel345@gmx.com
Administrative Contact ID:                   F4402907AC132993
Administrative Contact Name:                 William Vacher
Administrative Contact Organization:         USWebHosting
Administrative Contact Address1:             6 Harcourt Terrace
Administrative Contact Address2:             Headington
Administrative Contact City:                 Oxford
Administrative Contact State/Province:       OXON
Administrative Contact Postal Code:          OX3 7QF
Administrative Contact Country:              United Kingdom
Administrative Contact Country Code:         UK
Administrative Contact Phone Number:         +44.1865451641
Administrative Contact Email:                support@uswebhosting.com
Billing Contact ID:                          96D4D7FCD42CF61D
Billing Contact Name:                        Linda  Ray
Billing Contact Address1:                    126 Bittercreek Dr
Billing Contact City:                        Folsom
Billing Contact State/Province:              CA
Billing Contact Postal Code:                 95630
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.2393447607
Billing Contact Email:                       rozvel345@gmx.com
Technical Contact ID:                        F4402907AC132993
Technical Contact Name:                      William Vacher
Technical Contact Organization:              USWebHosting
Technical Contact Address1:                  6 Harcourt Terrace
Technical Contact Address2:                  Headington
Technical Contact City:                      Oxford
Technical Contact State/Province:            OXON
Technical Contact Postal Code:               OX3 7QF
Technical Contact Country:                   United Kingdom
Technical Contact Country Code:              UK
Technical Contact Phone Number:              +44.1865451641
Technical Contact Email:                     support@uswebhosting.com
Name Server:                                 NS1.USWEBHOSTING.COM
Name Server:                                 NS2.USWEBHOSTING.COM
Created by Registrar:                        ENOM, INC.
Last Updated by Registrar:                   ENOM, INC.
Domain Registration Date:                    Tue Sep 08 21:02:52 GMT 2009
Domain Expiration Date:                      Tue Sep 07 23:59:59 GMT 2010
Domain Last Updated Date:                    Tue Sep 08 21:02:54 GMT 2009

The twin fraud cyber-mule recruiting clone:

JOB FRAUD SCAM = The Design 4 You aka THEDESIGN4YOU.COM = JOB FRAUD SCAM

[att=4]

Different phone number (voip)

==============================
Give us a call:

+46-08-599 26 863

or contact online

info@thedesign4you.com

Rich Productions 2001 - 2009

Frejgatan 13 11479

Stockholm

Sweden

==============================
»thedesign4you.com

Snapped 2009-10-14 21:43:11

»thedesign4you.com/services.php

Snapped 2009-10-14 21:42:54

»thedesign4you.com/robots.txt

Snapped 2009-10-14 21:42:37

»thedesign4you.com/employment.php

Both fraud recruiting websites Bright Art aka BRIGHTARRT.BIZ and The Design 4 You aka THEDESIGN4YOU.COM are hosted on:

Server Type: Apache
IP Address: 72.34.55.197
IP Location - California - Encino - Ih Networks
Response Code:200
Domain Status: Registered And Active Website

================================
Registration Service Provided By: USWebHosting
Contact: support@uswebhosting.com
Visit: >http://elahost.com/

Domain name: thedesign4you.com

Registrant Contact:
USWebHosting
William Vacher ()

Fax:
6 Harcourt Terrace
Headington
Oxford, OXON OX3 7QF
GB

Administrative Contact:
USWebHosting
William Vacher (support@uswebhosting.com)
+1.1865451641
Fax:
6 Harcourt Terrace
Headington
Oxford, OXON OX3 7QF
GB

Technical Contact:
USWebHosting
William Vacher (support@uswebhosting.com)
+1.1865451641
Fax:
6 Harcourt Terrace
Headington
Oxford, OXON OX3 7QF
GB

Status: Active

Name Servers:
ns1.uswebhosting.com
ns2.uswebhosting.com

Creation date: 30 Aug 2009 14:13:01
Expiration date: 30 Aug 2010 14:13:00

================================

MGD

JOB FRAUD SCAM = Bright Art aka BRIGHTARRT.BIZ = JOB FRAUD SCAM

JOB FRAUD SCAM = The Design 4 You aka THEDESIGN4YOU.COM = JOB FRAUD SCAM

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 14 Oct 2009 19:08:03 EDT

MGD :

said by Naive :

I just set up an LLC and merchant acct for Riddick-Design. I was in last stages when I read this. I have frozen the bank acct and changed the authorize.net password. What else should I do. I certainly have been naive, and I certainly don't want to get into trouble.

Thank you for posting,

Naive, maybe yes, however, congratulations for being very astute and deciding to do some early research. At this stage you have stopped the fraud before it got off the ground, and there should be no additional issues, Kudos !!.

• Were any charges ran through the account ?

You should check the authorize.net account again and make sure that no cards have been ran since you changed the password.

For further protection you can set the authorize.net account into TEST MODE. Though card data can be entered, they will not be processed.

=========================================

Follow these instructions:

To set the authorize.net account in test mode:

1. Log into your Merchant Interface at »https://account.authorize.net.
2. Click Settings in the main left side menu.
3. Click Test Mode.
4. Click the Turn Test ON button. The interface will confirm that the Test Mode Settings have been Successfully Applied

Setting the accounts to TEST MODE will prevent any processing of real charges to credit cards.

=========================================

It would be helpful in tracking these criminals if you can provide some information.

• How did Riddick-Design recruit you ?. Did you have a resume posted on Monster or Careerbuilder ?.

• Did they specify the name of the LLC/Corp to be registered?.

• Did they process the LLC/Corp registration via an online service, if so, with who, or did you handle that process directly?.

• Did the criminals reimburse you for the set up costs up front, or did you pay for it, and they stated that you would be reimbursed from the initial proceeds?.

If they paid you up front were the funds sent via Paypal or via Western Union, or some other method.

• Did they provide you a list of banks affiliated with authorize.net on where to open a business bank account at?. Did they state a preference on which bank to use?. Did they direct you to a specific provider to apply for a merchant account at, such as Transfirst ?.

• Did they specifically state which bank/s not to use, or, state a specific merchant provider/s not to use?. If so who

• Did they insist that you send them a picture indentification as part of the "employee background check" procedure. Did you send them your SSN number ?

Again, congratulations on your sixth sense, and decision to research them. You have caught this very early, well before any trouble. There are hundreds of others who wish they had done what you did this early in the game.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 13 Oct 2009 13:08:52 EDT

anon : I just set up an LLC and merchant acct for Riddick-Design. I was in last stages when I read this. I have frozen the bank acct and changed the authorize.net password. What else should I do. I certainly have been naive, and I certainly don't want to get into trouble.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 06 Oct 2009 12:25:41 EDT

MGD : Two of the organized crime syndicate's card fraud laundering websites recently suspended by GoDaddy.

DPOCOLLC.COM aka DPOCO, LLC 423-436-0167

[att=1]

=================================================
Contact details
Dpocollc.com support is available during normal business hours Monday though Friday, 10:00am to 5:00pm EST. If a support engineer is not available, you will receive a call back based on a first come, first served basis.

support@dpocollc.com (24/7 based).
Contact form (24/7 based. average response time 1 hour)
(423)-436-0167 (10am - 5pm Mon-Fri)
=================================================

[att=2]

Cyber-mule registered the LLC in Tennessee:

[att=3]

Server Data
Server Type: Apache
IP Address: 208.109.165.52
IP Location - Arizona - Scottsdale - Godaddy.com Inc
Response Code: 200
SSL Cert: www.dpocollc.com expires in 181 days.
Domain Status: Registered And Active Website

Whois Record
Registrant:
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Domain Name: DPOCOLLC.COM
Created on: 09-Feb-09
Expires on: 09-Feb-10
Last Updated on: 09-Feb-09

Administrative Contact:
Private, Registration
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2598

==============================
08-09-2009,

garethsk:

Wondering if anyone here as seen a charge on their CC from anything resembling this:

X BC FORESTRY, NORTH HAMPTON, VA

I have an account that I rarely use except for play
.... Today I have a $20.00 pending charge from whatever X BC Forestry is.

==============================

08-10-2009,

garethsk:

Great...new charge just showed up.

PRE-AUTHORIZATION DEBIT AT DPOCOLLC COM, CHATTANOOGA, TN

==============================

08-26-2009

zooyorq:

Not to hash up a dead thread but I had the same charge for roughly 7 dollars on one card on the 15th of August and 12 dollars on another card of mine also on the 15th.

Odd thing is these two cards are used by me for business purposes only. I've obviously charged alot of things with them but I bet I could find a pattern of two places I've used both cards in the last year or so. If you're interested in seeing if any match where you've used yours let me know and I'll whip up a list.

Fyi, I'm in IT. So I purchase alot of tech goods.
==============================
»www.tngunowners.com/forums/gener···rry.html

==============================
New CC likely fraud

August 22, 2009 by atthecrux

Not that this’ll be interesting to most people, but posting it for the benefit of anyone searching for info in a similar situation.

I recently had a charge for $5.18 come through from DPOCOLLC.COM 423-4360167 TN on my Bank of America card. The odd thing is, they used a number that hasn’t been active for a number of years. (It’s a card I had with Fleet before they were merged into Bank of America.) I just called B of A and they said they’d credit me for the amount, and asked me to call the company and tell them never to charge me again. I’m not sure that they actually processed it as a fraud issue, but I guess it’s no skin off of my nose if they wait to call it “fraud” and more charges come through (though it does seem ridiculous that they’re still allowing charges through using the old number!).

==============================
»atthecrux.wordpress.com/

DPOCOLLC.COM appears to now be down, this one did not appear to make it off the ground, merchant interception.

ONECLICKPPC.COM aka ONECLICKPPC.COM LLC 253-345-4666

[att=4]

=================================================

Contact details
OneClickPPC.com support is available during normal business hours Monday though Friday, 10:00am to 5:00pm EST. If a support engineer is not available, you will receive a call back based on a first come, first served basis.

support@oneclickppc.com (24/7 based).
Contact form (24/7 based. average response time 1 hour)
(253)-345-4666 (10am - 5pm Mon-Fri)
When submitting a request via email, please include all relevant information pertaining to the problem, your name and the best time to contact you.
=================================================

[att=5]

Washington state LLC:

[att=6]

Server Data
Server Type: Apache
IP Address: 97.74.39.142
IP Location - Arizona - Scottsdale - Godaddy.com Inc
Response Code: 200
SSL Cert: www.oneclickppc.com expires in 294 days.
Domain Status: Registered And Active Website

Whois Record
Registrant:
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Domain Name: ONECLICKPPC.COM
Created on: 11-Jun-09
Expires on: 11-Jun-10
Last Updated on: 11-Jun-09

Administrative Contact:
Private, Registration
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599 Fax -- (480) 624-2598

Both are from the genre of the previously listed grouping: »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

ANKERSOLUTIONSLLC.COM AKA ANKER SOLUTIONS LLC 262-510-0045 706-819-4216

DDV-ENTERPRISES.COM aka DDV ENTERPRISES LLC 636-364-9432 706-819-4216

RET-NEK.COM AKA Ret-Nek LLC, 913-232-2266 706-819-4216

RAPIDADVERTS.COM AKA DWG Consulting & Services 803-667-3922

FLARETRAFFIC.COM aka FLARETRAFFIC = Assumed Name of DAVES ENTERPRISES LLC
865-940-0556

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 04 Oct 2009 13:49:14 EDT

Whip :

quote:
A domain registered to a Butler, PA address (fraudulent).

Well, they tried to imitate a Pa address anyway.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 04 Oct 2009 12:52:37 EDT

MGD : FRAUD ALERT JOB SCAM = Hong Kong Solutions Inc. aka hongkongsolutions.com = FRAUD ALERT JOB SCAM

There are two known names that they are using to communicate with potential cyber-mules:

Donald Chan
donaldchan@hongkongsolutions.com

Harry Wong
harrywong@hongkongsolutions.com

Hosting information for hongkongsolutions.com:

Server Type: Apache
IP Address: 72.167.232.158
Godaddy.com Inc
Response Code:200
Domain Status:Registered And Active Website

IP Information for 72.167.232.158
IP Location: United States Scottsdale Godaddy.com Inc
Resolve Host: p3nlh078.shr.prod.phx3.secureserver.net
IP Address: 72.167.232.158
Reverse IP: 3,538 other sites hosted on this server.
Blacklist Status: Clear

OrgName: GoDaddy.com, Inc.
OrgID: GODAD
Address: 14455 N Hayden Road
Address: Suite 226
City: Scottsdale
StateProv: AZ
PostalCode: 85260
Country: US

NetRange: 72.167.0.0 - 72.167.255.255
CIDR: 72.167.0.0/16
OriginAS: AS26496
NetName: GO-DADDY-SOFTWARE-INC
NetHandle: NET-72-167-0-0-1
Parent: NET-72-0-0-0-0
NetType: Direct Allocation
NameServer: CNS1.SECURESERVER.NET
NameServer: CNS2.SECURESERVER.NET
NameServer: CNS3.SECURESERVER.NET
Comment:
RegDate: 2007-07-05
Updated: 2008-01-18

The domain hongkongsolutions.com has a fraudulent registration:

ICANN Registrar:GODADDY.COM, INC.
Created:2009-05-23
Expires:2010-05-23

Registrant:
Gary Herrit garyherrit@yahoo.com
208 E. Metzger Ave.
Butler, Para 16001
United States

Domain Name: HONGKONGSOLUTIONS.COM
Created on: 23-May-09
Expires on: 23-May-10
Last Updated on: 23-May-09

Administrative Contact:
Herrit, Gary garyherrit@yahoo.com
208 E. Metzger Ave.
Butler, Para 16001
United States
4259847064 Fax --

Technical Contact:
Herrit, Gary
208 E. Metzger Ave.
Butler, Para 16001
United States
4259847064 Fax --

Domain servers in listed order:
NS35.DOMAINCONTROL.COM
NS36.DOMAINCONTROL.COM

A very smart potential cyber-mule, who, when contacted recognizes it as a scam:

quote:
SCAM:

Yes, it is - www.hongkongsolutions.com - a website and SEO company. I received a "business offer" from them too. I think they saw my resume on Monster or Careerbuilder. In a nutshell they say you'll make about 50K a year simply by starting an S-Corp and opening-up some kind of online store so they can run their US sales through it. 50K for basically doing nothing sounded fishy. I've got a lot more info in saved emails from "Harry" (if that's his real name) who is with Hong Kong Solutions. If anyone wants to see them let me know...

Ref:»www.trustlink.org/ViewQuestion.a···onID=224

HONGKONGSOLUTIONS.COM

Lists an address in:

=========================
Hong Kong Solutions Inc. aka hongkongsolutions.com
RM 1315 Ctr 45 Chong
Yip St Kwub Tong Kl
Hong Kong,

Telephone +1-(206)-203-1947
=========================

With a Washington state IPKall VOIP forwarding phone number. A domain registered to a Butler, PA address (fraudulent).

Priors:

World Creative Studio Inc. aka worldcreativestudio.com pretending to be in Warsaw Poland.

Balaton Design, Inc. aka balatondesign.com pretending to be in Balatonföldvár, Hungary.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 04 Oct 2009 02:52:23 EDT

MGD : Cyber_Mule recruiting alert !!

FRAUD ALERT JOB SCAM = Hong Kong Solutions Inc. aka hongkongsolutions.com = FRAUD ALERT JOB SCAM

Continuing in the Russian Organized Crime syndicate's theme of the 100% Flash and text as an image fraud recruiting website:»www.hongkongsolutions.com

[att=1]

=========================
Hong Kong Solutions Inc. aka hongkongsolutions.com
RM 1315 Ctr 45 Chong
Yip St Kwub Tong Kl
Hong Kong,

Telephone +1-(206)-203-1947
=========================

Our company is a multiple-discipline Internet company (please visit www.hongkongsolutions.com). One of our direction is a creating web-products (iPhone themes,PocketPC themes, Mobile themes, wallpapers, games.), which are intended for many clients. Our company carries on this business for 8 years.

HK Solutions, Inc is one of the leaders in our country of the companies which do these services. In Present days Internet influences all the areas of human activity. That's why our company develops rapidly every year. We aren't the waiting for the fortune company. We do the success ourselves. Our marketing department elaborated a plan, which will help us to get international market and the USA first of all.

We need some managers who will produce our company in the USA. It is a very profitable project not only for our company but for our representatives too. Future trends of this business are unlimited. We guarantee a stable growth of your income and professional skills. From you we need only some efforts in the first stage to develop our business. Later you will not spend much time to keep the project.

Attention: No skills and experience in programming and web design are required from you. This is not a technical position. If you've got a burning desire to succeed and are interested in maximizing your personal and professional growth, please kindly get back to us via our email address

Harry Wong

harrywong@hongkongsolutions.com

NOTE: careerbuilder.com, Monster.com, et all, by default allow cyber criminals to obtain employer accounts. (All you need is a credit card, anyone's will do) An Employer account gives criminals access to entire databases of job seeker resumes. This enables career criminals and organized crime syndicates to target job hunters, and solicit them.

DO NOT ASSUME, that because an email from a prospective employer comes via Careerbuilder, or monster's system, that it in any way confirms legitimacy. Careerbuilder's and Montser's systems are wide open for anyone to join as an employer. No distinction is made between criminals, scammers, and legitimate employers. That burden is left to the prospective employee to do.

From Harry Wong harrywong@hongkongsolutions.com

In this email I will explain you about this job offer.

Also I forward you our Instructions, FAQ and Agreement. Use Adobe
Acrobat Reader to view the above files. If you do not have this
software on your computer, please go to
>http://www.adobe.com/products/acrobat/readstep2.html and download the
program for free.

Our company enters the american market now because almost all online
business are located in the USA. So we have to search managers in the
USA to create our subsidiaries.

Our Marketing Department has developed a perfect idea to boost sales.
The idea is to have more subsidiaries that would resell our items
(iPhone themes,PocketPC themes, Mobile themes, wallpapers, games etc).
The more subsidiaries we have the more things we sell and our profit
grows accordingly.

Your mission in the project is to create business tools (registering a
business, setting up business and merchant bank accounts) and it is
for these services that you will be paid.

Hong Kong Solutions, Inc creates a web-site (online store or
subsidiary another words) which will sell our products. The work of
this web site is impossible without a company and that's why your
first step will be the opening of company (the company may be
registered as a Corporation, LLC, Sole Proprietorship or other
business entity).

If you already have a company, it's great and will make the start up
yet faster. Next you open bank business and merchant account and
Gateway on Authorize.net.

Your commission will be 10 percent from all the sales (you'll earn
about 4000-5000$ a month). Also all bank and merchant fees will be
paid by our company. You will get your 10 percent in any case not
depending what fees we will have. Your income will increase as the
business progresses.

About the taxes:
The taxes in this kind of business we will need to pay only in
starting the 2nd year.
US taxes are not conventional; is one makes more than a certain amount
of $ in a year through a corporation, they need to pay taxes every
three months. This is called Estimated Quarterly Taxes.
In our situation, these aren't paid the first year, only starting the
2nd year. All taxes will be go through your company but you will take
the necessary funds from our part when it's time to pay for taxes. So
our company will pay all taxes not you.
Since what we sell isn't tangible (can't be touched), we don't file
Sales tax. Only thing we pay is income tax, to the federal
governement.

If you are interested please send me the signed agreement (I sent you
it. did you get it?) or via email or via fax (206)339-1058.

If you have any questions else please ask me.

Best regards,
Harry Wong,
Hong Kong Solutions, Inc
>http://www.hongkongsolutions.com/

»www.google.com/search?hl=en&sour···oq=&aqi=
A previous and still operating fraud job recruiting site of this clone is:

World Creative Studio Inc. aka worldcreativestudio.com

Prior postings

»worldcreativestudio.com

=========================
worldcreativestudio.com

World Creative Studio Inc.
Ul Chmielna 26 #5
Warsaw, 00020
Poland

Telephone: +1 954-208-7279
=========================

And before that, we had another clone:

Balaton Design, Inc. aka balatondesign.com

=========================
Balaton Design, Inc., balatondesign.com
Somogyi Bela u. 1.,
8623, Balatonfildvar,
Hungary,

Telephone +1 801-926-8016
=========================

Prior postings

MGD

FRAUD ALERT JOB SCAM = Hong Kong Solutions Inc. aka hongkongsolutions.com = FRAUD ALERT JOB SCAM
FRAUD ALERT JOB SCAM = Hong Kong Solutions Inc. aka hongkongsolutions.com = FRAUD ALERT JOB SCAM
FRAUD ALERT JOB SCAM = Hong Kong Solutions Inc. aka hongkongsolutions.com = FRAUD ALERT JOB SCAM

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 24 Sep 2009 01:33:01 EDT

Doctor Olds :

said by MGD :

I also attract attention from individuals masquerading as all forms of LE, trying to id me.

I bet that is a growing problem and I know that has to suck having to deal with. :[
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 23 Sep 2009 19:32:30 EDT

MGD :

said by sbf :

mgd, I'm LE and would like to get in touch with you directly about some of this stuff.. is that possible?

Yes it is, unfortunately I have attracted a nefarious following as a result of my anti cyber crime work. If I post an email address, even a throwaway one, it will be bombed into oblivion, sometimes in a matter of minutes.

You can either sign up anonymously for a free account: »/join/new which will then give you the option to send me an IM (instant message).

Alternatively, and if necessary, you can also send an email to the website contacts listed here »/contacts admin or press, and put forward to MGD in the subject.

Not required, though if possible include an email domain that can be vetted. I also attract attention from individuals masquerading as all forms of LE, trying to id me.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 23 Sep 2009 16:23:32 EDT

anon : mgd, I'm LE and would like to get in touch with you directly about some of this stuff.. is that possible?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 22 Sep 2009 23:49:50 EDT

MGD : Thanks for posting univenus,

Do you know if the email is targeted because of a resume posted with a online service?. Any additional info on that issue is appreciated.

The fake cyber-mule recruiting website REDBALLOONDESIGN.ORG is another clone in the year long Riddick Design Red Line theme

REDBALLOONDESIGN.ORG = FAKE JOB SCAM

Snapped 2009-09-22 23:09:44

»redballoondesign.org

REDBALLOONDESIGN.ORG is also hosted on the same server as the still active:

RIDDICK DESIGN aka RIDDICK-DESIGN.COM = JOB FRAUD SCAM

Snapped 2009-09-22 23:11:05

»Riddick-design.com

RED LINE aka REDLINE-WEBDESIGN.ORG = JOB FRAUD SCAM

Snapped 2009-09-22 23:10:48

»Redline-webdesign.com

RECRUIT CENTER aka RECRUIT-CENTER.ORG = JOB FRAUD SCAM

Snapped 2009-09-22 23:10:26

»Recruit-center.org

Both fraudulent addresses in Sweden are used:

======================

Gjorwellsgatan 28,

112 60 Stockholm, Sweden

======================
Frejgatan 13, 11479
Stockholm Sweden

+46-46-288 52 67
.
Frejgatan 13 11479
Stockholm
Sweden
======================

A fresh audit of the hosting on that California server DEEPTECHNOLOGY.NET / DT-HOSTING.COM at IP 69.80.200.112

======================
Server Data
Server Type: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.7a PHP/4.4.8
IP Address: 69.80.200.112 IP Location - California - San Jose - Deep Technology
Response Code: 200
Domain Status: Registered And Active Website
======================

Worth noting that the recruit Fraud Site's Testimonials:

[att=1]

Appear to be direct hijacked copies of those on an Indian site inika.com:

Snapped 2009-09-22 23:35:15

»www.inika.com/testimonials.htm

The IP 69.80.200.112 audit also shows a fresh fake mobile themed card fraud laundering website, which appears to be currently unassigned:

WORLDANDYOURGLOBAL.COM = CARD FRAUD LAUNDERING

Snapped 2009-09-22 23:23:18

»worldandyourglobal.com

That is in addition to the already known group on that server such as:

WORLDINYOURMOBILE.COM + CARD FRAUD LAUNDERING

Snapped 2009-09-22 23:39:56

»worldinyourmobile.com

and

ALARMWEBSTUDIO.COM = CARD FRAUD LAUNDERING

Snapped 2009-09-22 23:49:02

»Alarmwebstudio.com

As in all of the previous red recruit mule fraud sites, REDBALLOONDESIGN.ORG has a cloaked privacy reigstration:

Whois Record
Domain ID:D156709748-LROR
Domain Name:REDBALLOONDESIGN.ORG
Created On:22-Jul-2009 21:00:25 UTC
Last Updated On:21-Sep-2009 03:56:55 UTC
Expiration Date:22-Jul-2010 21:00:25 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:fc0e1b498311df0e
Registrant Name:Whois Agent
Registrant Organization:Whois Privacy Protection Service, Inc.
Registrant Street1:PMB 368, 14150 NE 20th St - F1
Registrant Street2:
Registrant Street3:
Registrant City:Bellevue
Registrant State/Province:WA
Registrant Postal Code:98007
Registrant Country:US
Registrant Phone:+1.4252740657
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:

Name Server:NS1.DEEPTECHNOLOGY.NET
Name Server:NS1.DT-HOSTING.CO

.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 21 Sep 2009 15:49:42 EDT

anon : Also the same group known as Drive Recruitment is emailing purportedly as rep for this company: (»redballoondesign.org). The signature is as follows:
Best regards, Anika Morgan
Gjorwellsgatan 28, 112 60 Stockholm, Sweden

Re: Recruit Fraud: SKYDEX SOFT LTD aka SKYDEXSOFT.COM

Sat, 19 Sep 2009 16:45:24 EDT

MGD :

********** WARNING !! **********

MALWARE INFECTED, DO NOT VISIT SKYDEXSOFT.COM >http://skydexsoft.com

The website has been under observation for the past two weeks. At 9.00 AM on 09/15/2009 a hidden Iframe drive by malware was detected on the skydexsoft.com website main index page. The hidden Iframe ran a script from >http://red-wolf.ru:8080/index.php. The iframe was embedded in the main page as :

[Att=1]

The iframe source domain has been changed several times within the past 72 hours from red-wolf.ru to previous-life.ru to life-before.ru and past-another-life.ru, also suspected is theanotherlife.ru. The path format is identical to the others above.

>http://previous-life.ru:8080/index.php

[att=2]

The last check at ~ 23.00hrs EST 09/18 shows another malware domain

[att=3]

biozavr.ru. As you can see from the server response log below the latest iframe malware domain would have been updated when the site was last saved earlier Friday.

quote:
09/18/09 22:49:15 Browsing >http://skydexsoft.com
Fetching >http://skydexsoft.com/ ...
GET / HTTP/1.1Host: skydexsoft.comConnection: close
Date: Sat, 19 Sep 2009 02:46:39 GMTServer: Apache/1.3.41 (Unix) mod_perl/1.30 PHP/4.4.9 mod_ssl/2.8.31 OpenSSL/0.9.8bLast-Modified: Fri, 18 Sep 2009 18:20:45 GMT

It is not known if the fake job site skydexsoft.com is self infected, or if it has been hacked. There is at least one report each coming from Australia, France, South Korea, and Iran, from people whose websites have been hacked and infected with the red-wolf.ru specific exploit. The .ru infector domains have dynamic DNS which can point to between 4 and 6 IPs where they are hosted. This is not a known modus-operandi of the crime syndicate with respect to this fraud operation. I am unable to rule anything in or out with respect to skydexsoft.com A typical hack vector for this form of Iframe is via FTP. An example

.

This confirmed crime syndicate's cyber-mule recruit fraud Skydex operation posted by iDeceive is a perfect example of one of the constant engines that drives this non stop massive organized fraud operation. The primary engine that drives it all of course, is the organized crime syndicate's constant unfettered hacked access to consumer's full card account data. The most crucial ingredient in processing that hacked data into cash, and laundering it out of the country, is the need for a consistent supply of duped cyber-mules. Consequently a large amount of resources are dedicated to this function, and the process is sophisticated. Not only have job adds been placed on Careerbuilder and Monster, the crminals have also opened business employer accounts with both, which enabled them to filter and peruse through their large databases of resumes. Some of the uncovered cyber-mules reported that they were directly targeted from their on file resumes with these online services

This confirms the belief that one the many components required to dismantle this multi year fraud operation is the alerting and educating of the population via mass media, etc, to this sophisticated recruiting vector. Reducing and eliminating the potential pool of recruits is a crucial ingredient of constricting this multi million dollar fraud laundering operation.

Let's have a look at the configuration phases of the cyber-mule fraud recruiting operation Skydex Soft Ltd aka skydexsoft.com Alex Malenkovsky career@skydexsoft.com

As noted by iDeceive and Whip , the domain was registered on 08/07/2009 and is hosted in Kiev, Ukraine at IP Address: 195.189.226.159 with hosting/DNS provided by VIP-NAME.COM.UA. The skydexsoft.com cyber-mule recruiting domain was fraudulently registered to a US name and address by someone whose primary language is Russian, via the usual:


ICANN Registrar:  
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: SKYDEXSOFT.COM 
.
Registrant:
    GLENN llc.
    JENNIFER GLENN        (jglenn19@gmail.com)
    2650 COUNTY ROAD 101
    TULELAKE
    California,96134
    US
    Tel. +743.3828992
.
Creation Date: 07-Aug-2009  
Expiration Date: 07-Aug-2010
.
Domain servers in listed order:
    ns2.vip-name.com.ua

.

Even though the registration including the email address, all appears to be US based, we can establish that Russian was the primary language of the user from the email account. When the lost password procedure for the Gmail account is activated, the password reset question that was selected at set up time is in Russian:

Password reminder reset for jglenn19@gmail.com
[att=8]

Translation: "Number of the bus, which I regularly use?"

Within days after the domain registration the search engine seeding began. As mentioned already, hundreds of fake blog testimonial postings were made. These are two of the shorter ones made on August 13, 2009 on businessweek.com June article:

quote:
Reader Comments

Jamie Heidlage
August 13, 2009 12:00 PM

Our firm has been working on the internet market for several years,
and we've dealt with a lot of companies during these years, but Skydex
Soft Ltd(www.skydexsoft.com) deserves a special attention. The specialists
from this company work hard in order to please their customers and deliver
the best service. Frankly, we have not seen such qualitative product as
Skydex provides to us. They always meet deadlines for all the project
with the precise accuracy and all wishes carried out. We are happy
with result of their work, and we plan to co-operate with them
further. Now they are in the list of the best companies with which we
deal! We advise to consider this company and see if you can buy it
out.

==============================================

Renae Kaiser
August 13, 2009 03:45 PM

How could you describe the Skydex Soft Ltd(www.skydexsoft.com) activity?
It is the highest quality and fast delivery! This is exactly what is
needed! There is nothing else to add! I have not seen any other company
who would pay so much attention to clients. It is just a simple pleasure
to work with them. They actually are the best in the business! I thank God
that I came to know this company when I was looking who to use to
execute my project. So if you want a qualitative decision of your
problem – you can use this company without any doubt. They have a lot
of talented professionals working there.

Ref: businessweek.com

The purpose is to create a fake history of testimonials, and flood pages of search engines with the results:

[Att=4]

Potential recruits will see an extended positive history. Any posts regarding job suspicions or fraud alerts will have to compete with these already established rankings.

The fake skydexsoft.com is hidden from the rest of us:

[att=5]

Where did a majority of these fake postings originate from?

IP 91.214.201.92

IP Information for 91.214.201.92
IP Location: Moldova, Republic Of Srl Roxnet-com
Resolve Host: static-91-214-201-92.roxnet.md
IP Address: 91.214.201.92


Whois Record
inetnum:        91.214.200.0 - 91.214.203.255
netname:        ROXNET-COM-NET
descr:          SRL ROXNET-COM
descr:          Chisinau, Moldova
country:        MD
org:            ORG-SR21-RIPE
admin-c:        IFS1-RIPE
tech-c:         IFS1-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-by:         MNT-ROXNET-COM
mnt-routes:     MNT-ROXNET-COM
mnt-domains:    MNT-ROXNET-COM
source:         RIPE # Filtered
.
organisation:   ORG-SR21-RIPE
org-name:       SRL ROXNET-COM
org-type:       OTHER
address:        MD-2024
address:        Chisinau, Moldova
address:        str. T.Vladimiresku  8/1
e-mail:         
mnt-ref:        MNT-ROXNET-COM
mnt-by:         MNT-ROXNET-COM
source:         RIPE # Filtered
.
person:         Igor F. Spac
address:        MD-2024
address:        Chisinau, Moldova
address:        str.T.Vladimiresku  8/1
e-mail:         
phone:          +37369409540
phone:          +373-22-438819
nic-hdl:        IFS1-RIPE
mnt-by:         MNT-ROXNET-COM
source:         RIPE # Filtered
.
route:          91.214.200.0/22
descr:          SRL ROXNET-COM
origin:         AS49527
mnt-by:         MNT-ROXNET-COM
source:         RIPE # Filtered

.
ROXNET.MD

Snapped 2009-09-19 14:45:48

»translate.google.com/translate?h···26sa%3DG

Coincidentally the same city and country where the numerous forum postings of the various card fraud websites originated from. In that case the seeding was intended to mask postings about the fraud charges. It is my conclusion that the Moldovian blackhat operation is one of hired posters. The quality of that work is sub par compared to the core operation. Indicative of hired hands is the sloppy methods which leave trails. For example, if you needed additional convincing that the Crayon Web template group, the later Anti virus malware group, and the new ragdesign.com group format were related, you only have to look at samples the SEO work.:

[att=6]

All posted consecutively on the same forum thread from Moldova. Ties them all to one source in a nice package.

[att=7]

We know from iDeceive 's posting alert, that by 08/26 the syndicate had opened a business account on Monster.com and was sifting through resumes looking for potential cuber-mules for targeting. Once the seeding of the search engines were completed another phase of the skydexsoft.com fraud recruiting operation began. During the evening hours of Friday September 11th 2009 the first signs of a mass job posting run was detected on Careerbuilder.com.

The posted fraud job:

[att=9]

Note that the job add included a direct link that when clicked opened the application page on skydexsoft.com within a window:

[att=10]

The posting of job adds on careerbuilder.com continued over the weekend By late Saturday night there were over one hundred and twenty job adds posted for cities around the US:

[att=11]

Even though they list limited Saturday hours, mutiple attempts top reach Careerbuilder by phone to get the adds pulled failed. That failure is what prompted me to write in an earlier report that authorize.net / Cybersource was in danger of loosing their number one ranking for incompetence relevant to this long running massive fraud operation. However in this case there was a positive outcome.

On Sunday 09/13 a stage two phase of job postings began. The reason that this was considered a second phase is that the text of the posted job add had changed. This may indicate that there were two syndicate members doing the posting. The listed requirements for the job were now different. For example one of the listed requirements of the the first add stated "Over 30 years of age". On the second phase of the run on Sunday that requirement had changed to "Be over 21 year old"

[att=12]

Also note the apparent embedded error code in the job posting, indicating that the format was prepared on a Computer with a Russian language / keyboard setting:

"normal 0 false false false RU X-NONE X-NONE MicrosoftInternetExplorer4"

The mass Careerbuilder job posting ultimately peaked between midnight Sunday 09/13 and 2AM Monday 09/14 with a total of 153 jobs posted on careerbuilder.com. A search of Carrerbuilder's database ran around midnight Sunday for "SKYDEX" produced 153 job entires in cities around the US totalling 7 pages of results:

[att=13]

[att=14]

The fraudulent job adds were targeted in 153 cities across the USA:

[att=15][att=16][att=17][att=18]

Worse yet, during Saturday and Sunday 09/12 & 09/13, the fraudulent cyber-mule recruiting jobs adds were propagating across many of careerbuilder.com afiliates, including indeed.com and AOL Jobs. It was crucial to get the careerbuilder source shut down as soon as possible. Shortly after 8AM on Monday 09/14 several reports were sent to careerbuilder.com detailing the mass run of fake job adds and their purpose, along with requests to immediately remove all 153 job adds from their database. Though no direct response was received, by around 11AM all the jobs were removed from the main database. Though all the propagated adds that filtered down though affiliates still existed, all the links to the careerbuilder jobs would be dead.

I am not sure how much this operation cost at careerbuilder, however, an attempt to duplicate what the syndicate had set up, produced an estimate of several thousand dollars. I can not be positive that it was the alert which caused the removal, as no direct reply was received. Nevertheless the fake jobs were removed, and that is what counts.

Continued in next post .....

MGD

Re: Skydex Soft

Sat, 19 Sep 2009 13:51:20 EDT

MGD : Thanks dbflynn,

I will contact you.

MGD

Re: Skydex Soft

Wed, 16 Sep 2009 11:22:45 EDT

anon : MGD,

This is a very interesting post. You have obtained a very large amount of information on these companies and I must admit I did not read the entire 46 pages of posts. I am interested in what you know about the those involved in keeping this illegal business open and what you can prove. Also if there has been any low enforcement involvement. I work similar cases but I must admit that the information you have provided goes a bit over my head and I can't connect the dots yet. If you can present a case drop me an email.

dbflynn@pittcountync.gov

Re: Skydex Soft

Mon, 14 Sep 2009 05:34:02 EDT

Doctor Olds :

said by MGD :

I have tracked the posting origination of many of these manufactured fake blog testimonials to a specific IP address in Moldova. Which coincidentally, is the same country where the forum spam posts listing many of the card fraud laundering domains and their phone numbers originated from.

Not the best place to be. :[
»https://www.cia.gov/library/publications···/md.html
Read the sections on "Trafficking in persons:" and "Illicit drugs:"

With the Government being corrupt and a large underground, it is going to a thorn a long time. I say cut them off of the tcp/ip grid.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Skydex Soft

Mon, 14 Sep 2009 02:20:02 EDT

MGD :

said by iDeceive :

Here's another mule recruitment email. A quick search of this topic finds no previous mention of "Malenkovsky" or "Skydex". For the record, skydexsoft.com was registered on 07-Aug-2009.
......
..

Absolutely outstanding work my friend !!.

I have been shadowing this operation since you posted. I have confirmed that it is this organized crime syndicate. Though you have reported this operation at the very early stage, unfortunately, I was unable to prevent a massive recruiting operation that began on Friday and is still underway. I am preparing a detailed post of what went on, nd the absolute failure of reasonable due diligence that is about to rival the mutli year incompetence of Authorize.net / Cybersource.

said by Whip :

...
They appear to be flooding the net with sales pitches for a site that isn't even online yet. Some are from at least 20 days ago.

Good catch, what you uncovered was part of a set up plan which included "seeding" of search engines ahead of time. In this case the seeding involved paid posters writing blog comments about the company, fake customer testimonials. This was done in advance as advance preparation for another stage that would have generated searches from potential cyber-mule recruits. When potential recruits attempt to vet the company by conducting online searches, they will see hundreds of these fake "Testimonials" and are intended to dupe them into believing that the job offer is legit.

Secondly, since these fake blog comments began as soon as the domain was registered they will rank ahead of any potential subsequent posts that report this as a scam.

I have tracked the posting origination of many of these manufactured fake blog testimonials to a specific IP address in Moldova. Which coincidentally, is the same country where the forum spam posts listing many of the card fraud laundering domains and their phone numbers originated from.

More to follow.

MGD

==========================================
FRAUD JOB SCAM = SKYDEX SOFT LTD = MULE RECRUIT FRAUD

FRAUD JOB SCAM = SKYDEXSOFT.COM = MULE RECRUIT FRAUD

FRAUD JOB SCAM = Skydex = MULE RECRUIT FRAUD

FRAUD JOB SCAM = Skydex HR Dept. = MULE RECRUIT FRAUD

FRAUD JOB SCAM = career@skydexsoft.com = MULE RECRUIT FRAUD

Head Office:
KIC Plaza
290 Songhu Rd.,YangPu
Shanghai
China
International Business Unit:
BEA Tower
Millennium City 5, 418 Kwun Tong Road, Kwun Tong, Kowloon
Hong Kong
China
tel: +852-8197-7232

FRAUD JOB SCAM = SKYDEX SOFT LTD = MULE RECRUIT FRAUD

FRAUD JOB SCAM = SKYDEXSOFT.COM = MULE RECRUIT FRAUD

FRAUD JOB SCAM = Skydex = MULE RECRUIT FRAUD

FRAUD JOB SCAM = Skydex HR Dept. = MULE RECRUIT FRAUD

FRAUD JOB SCAM = career@skydexsoft.com = MULE RECRUIT FRAUD
==========================================

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 14 Sep 2009 01:01:16 EDT

MGD :

said by FrgtMyLogin :

Nice. I just got hit up for $9.85 from GAMARTON.COM on Aug 23.

keeps us posted on the outcome. Many banks go out of their way to avoid processing these charges as fraudulent, as there is more paperwork involved. However it is what it is, and the avoidance maneuvers only serve to facilitate the fraud operation. The only way the fraudulent account will get halted, barring investigative intervention, is when the chargeback ratios are exceeded.

Also be advised that recent communication interceptions from the organized crime syndicate, reveal that they are actively disputing the chargebacks. This is done by submitting fraud documentation that purports to show the data transaction history, which includes a USA IP address that the purchase originated from, along with a user id /pw and email address that was created prior to the purchase. Though all of the documentation is faked, some chargebacks have been reversed to the victim as a result of that submission.

I never ceased to be amazed by some of the information that is uncovered.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 14 Sep 2009 00:37:14 EDT

MGD :

said by Whip :

Looks like there is a new (old) one coming online.

Was tipped off by this:

quote:
Re: Bright World Games
Does anyone out there know if this company is a scam or not? Please reply

...

Great catch !!

It appears that the site was taken offline by the hosting company sometime within the past 48 hours.

Snapped 2009-09-14 00:35:29

»www.brightworldgames.com

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 14 Sep 2009 00:02:16 EDT

MGD :

said by music man :

From the same stable as therecruiternetwork.org- »webrecruit.org

Snapped 2009-08-29 15:37:53

»webrecruit.org/about.php

As usual all contact details are cloaked using images. For total confirmation that this is a faker we have the usual robots.txt file.

Registry Data
Created: 2009-05-05
Expires: 2010-05-05

Another hidden registrant as well.

Great finds, a recap of the criminal contents of IP 72.34.55.197 Uswebhosting.com


Whois Record
OrgName:    IH Networks 
OrgID:      IHNET
Address:    16060 Ventura Blvd
Address:    Suite 105
City:       Encino
StateProv:  CA
PostalCode: 91436
Country:    US
.
NetRange:   72.34.32.0 - 72.34.63.255 
CIDR:       72.34.32.0/19 
NetName:    IHNET-PI-1
NetHandle:  NET-72-34-32-0-1
Parent:     NET-72-0-0-0-0
NetType:    Direct Allocation
.    
RegDate:    2005-02-09
Updated:    2006-08-14
.
OrgTechHandle: IHNET-ARIN
OrgTechName:   IH Networks 
OrgTechPhone:  +1-213-634-1497
OrgTechEmail:  admin[AT]ihnetworks.net

Hosted on IP Address: 72.34.55.197 via Uswebhosting.com

Cheapestthemes.com 904-352-1238 = Card Fraud money laundering

Still processing card fraud charges. First report in February 2009. Most recent fraud charge report September 10th 2006 »800notes.com/Phone.aspx/1-904-352-1238/4

acrossthescreenuniverse.com 786-522-9361 = Card Fraud money laundering

this1isawesome.com = Card Fraud money laundering

imagestudiodesign.com 813-200-4105 = Card Fraud money laundering

therecruiternetwork.org = JOB SCAM = RECRUIT FRAUD

webrecruit.org = JOB SCAM = RECRUIT FRAUD

Dear -,

I represent recruiting company Web Recruit specialized in searching the candidates at the request of employers all over the world. I have found this position on Career Builder.

There is a position available at the moment offered by European company. Please see below a short description of this position.

Assistant Director

I'm pleased to offer you a part time employment as a representative of European company, interested in expanding the business to the US market. The company will create the web site oriented to the US customers with high revenues guaranteed by the complex of high-performance promotional measures. In spite of the project's intricate, your duties will be quite easy to perform. No special education or experience are required from your side. Your personal manager will lead you step by step to the success by providing you with detailed and quite easy to understand instructions. This position has a very high potential in a personal income boost as a result of business growing all in all.

The minimum salary at this position is $30,000/year (5 from the project revenues). There are no fees to pay from your side.

As a part-time position it will take only 7-9 hours a week to perform the duties. The same time the company offers you a long term business relationship that is definitely very important in difficult times of financial crisis, because it means a guarantee of getting a stable income regardless of the situation on the labour-market.

To ask for detailed description including duties and responsibilities of the position just respond to this offer with the following subject:

"Interested in getting the position of Assistant Director."

or in case you don't like this offer for any reason, please let me know and I'll try to find something else for you.

Best regards,

Maria Olson

Gjorwellsgatan 28, 112 60 Stockholm, Sweden

Emphasis added
Ref: »www.419legal.org/employment-scam···uit.html

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 11 Sep 2009 06:50:08 EDT

anon : Nice. I just got hit up for $9.85 from GAMARTON.COM on Aug 23.

Of course, the idiot at the bank CS line wants ME to try to have them refund it. At least they've shut off the card and are sending a new one.

I'm still following up on this one and will be reporting it as fraudulent with the IC3 whether or not the bank cooperates.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 10 Sep 2009 19:00:46 EDT

Whip : Contact Us page:

quote:
Head Office:
KIC Plaza
290 Songhu Rd.,YangPu
Shanghai
China
International Business Unit:
BEA Tower
Millennium City 5, 418 Kwun Tong Road, Kwun Tong, Kowloon
Hong Kong
China
tel: +852-8197-7232

Copyright 2005-2009 © Skydex Soft Ltd. All rights reserved.
Powered by Skydex Soft Ltd

So they allege to be website developers yet use dark blue font on a black background on their own 'site' that is hidden from archiving anyway.

Snapped 2009-09-10 19:00:15

»skydexsoft.com/robots.txt

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 10 Sep 2009 15:57:55 EDT

music man : @Whip

Now with added website

Snapped 2009-09-10 16:08:23

»www.skydexsoft.com/index.html

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 09 Sep 2009 20:49:25 EDT

Whip : Looks like there is a new (old) one coming online.

Was tipped off by this:

quote:
Re: Bright World Games
Does anyone out there know if this company is a scam or not? Please reply

»scam.com/showthread.php?p=803165#post803165

quote:
Registration Service Provided By: Landis Holdings Inc.
Contact: sales@jaguarpc.com

Domain name: BRIGHTWORLDGAMES.COM

Administrative Contact:
-
Paul Murphy (paullmurph@yahoo.com)
+1.9158087683
Fax: -
334 Cornelia Street
Plattsburg, NY 12901
US

Technical Contact:
-
Paul Murphy (paullmurph@yahoo.com)
+1.9158087683
Fax: -
334 Cornelia Street
Plattsburg, NY 12901
US

Registrant Contact:
-
Paul Murphy ()

Fax:
334 Cornelia Street
Plattsburg, NY 12901
US

Status: Locked

Name Servers:
ns51.domaincontrol.com
ns52.domaincontrol.com

Creation date: 08 Nov 2007 21:47:25
Expiration date: 08 Nov 2009 21:47:25

Familiar format to the email address and the phone number is a Sweetwater Texas area code.

Snapped 2009-09-09 20:39:38

»www.brightworldgames.com/allgames.php

All the links get redirected to this same page regardless and has their link names added on to the end of the url.
The copyright of the site is 2009, not the year of registration 2007. So maybne this has just been sitting around dormant.

And of course:

Snapped 2009-09-09 20:42:08

»www.brightworldgames.com/robots.txt

this was posted on this site:

»www.xceedspeed.com/forums/showth···&page=32

quote:
from Mark Carson
reply-to Mark Carson
to Gregory Haberek
date Tue, Aug 5, 2008 at 3:13 PM
subject Job Offer from Careerbuilder.com for you.

My name is Mark Carson and I represent Bright World Games Inc.

We received your contact information from the services of www.Careerbuilder.com recruiting agency and we would like to offer you a home based position with our company. The job we offer is under our Affiliate Program and I hope we will be able to build a successful
cooperation with you as our Affiliate.

We will be glad if you find interesting the detailed information given in the text documents attached and get back to me at your earliest convenience.

You can also have a look at our website
www.BrightWorldGames.com in order to get a better understanding of the business.

Respectfully,
Mark Carson
Human Resources Head
Bright World Games, Inc.

Re: Skydex Soft

Wed, 09 Sep 2009 10:12:33 EDT

Whip :

quote:
Domain Name: SKYDEXSOFT.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: »www.PublicDomainRegistry.com
Name Server: NS1.VIP-NAME.COM.UA
Name Server: NS2.VIP-NAME.COM.UA
Status: clientTransferProhibited
Updated Date: 07-aug-2009
Creation Date: 07-aug-2009
Expiration Date: 07-aug-2010

Current Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
IP Address: 195.189.226.159 (ARIN & RIPE IP search)
IP Location: UA(UKRAINE)-KYYIV-KIEV
Lock Status: clientTransferProhibited
DMOZ no listings
Y! Directory: see listings
Data as of: 23-Apr-2008

They appear to be flooding the net with sales pitches for a site that isn't even online yet. Some are from at least 20 days ago.

»www.google.com/search?q=Skydex+S···irefox-a

Skydex Soft

Wed, 09 Sep 2009 09:37:43 EDT

iDeceive : Here's another mule recruitment email. A quick search of this topic finds no previous mention of "Malenkovsky" or "Skydex". For the record, skydexsoft.com was registered on 07-Aug-2009.

From: Skydex HR Team

Good afternoon,

My name is Alex Malenkovsky; I am the HR Manager of the company Skydex Soft Ltd., China. Several days ago, you filled out the application form for the position of the Project Manager/Sales Representative on our website. We have reviewed the information that you have provided to us, along with the information we have found at careerbuilder, and have come to the conclusion that you are likely to become a suitable candidate for the position of the Project Manager/Sales Representative. Although I must say that it is not our final decision, as we will need to carry out additional screening procedures and analyze you as a potential candidate for this position one more time.

However, I would like to tell you about the project that we will offer to you, your role in it and the tasks you will be tackling. So, let me begin here:

As you already know, we are a software development company with the head office located in Shanghai. For the past few months, we have been analyzing the market with the view to enter the segment of retail sales of software providing comprehensive computer security and protection. We have developed several unique products, each of which boasts several competitive advantages compared to products offered by our competitors.

What are these products?

1) Antivirus - with high-quality heuristics, capability to recognize and identify yet unknown viruses, Trojans, malware, adware, etc.

2) Firewall - a program for protecting the computer from external intrusions and fighting off hacker attacks.

3) Eraser - a program for secure and irreversible deleting of sensitive information from the computer, for example, files containing confidential information.

It will be these three products that will be offered for retail in the US market.

Where will these products be sold?

Nowadays, the most relevant and effective sales venue is the Internet; all large-scale companies sell their products through their own websites, and we are no exception from this rule: we are going to develop a unique website for selling each product separately.

How will these products be sold?

Since all sales will be carried out through the Internet, it is necessary to use one of the most relevant payment methods on the Internet, which at the present moment is online payments via a credit card, when a customer can pay for the product he/she likes with his/her credit card in real-time mode.

What is the role of the Project Manager/Sales Representative when he/she participates in a project?

The key role and objective is to provide the sales platform, namely it is the following: we enter into a formalized, legally binding agreement, which confirms your official status of the Reseller.

For you to be able to carry out sales through the Internet, you will need to open:

1) Company (it can be any type of company, from LLC to Inc, Corp)

If you already have a company of your own, we can formalize our business relationship as partnership and give the status of the “Reseller” to your existing company.

1) Obtain the Tax ID

2) Open a business checking account for your company at a local bank

3) Receive the website from us (free of charge) and we carry out all the necessary setup work (free of charge); the website will contain the complete information on the products and present the product itself.

4) At the bank, where you opened the business checking account for your company, you will have to open an E-commerce Merchant Account; this account will allow you to accept payments made on your website with credit cards.

That concludes the preliminary stage of the project; our experts carry out the complete work for setting up the entire system, so that the customer – upon having made the payment through the Internet – could immediately receive the software purchased, or rather – receive the activation key and use it to activate the program he/she just purchased on the website.

How will customer support be provided?

We will provide a call center for your project; therefore, each customer will have the opportunity to ask the questions he/she may have directly at the call center and receive prompt response.

Who will be handling the advertising and promotion for the project?

At the initial stage, we will provide 100% support to the project in terms of promoting it and advertising it.

How will the project’s revenue be distributed?

There are 2 variants here:

1) If you sell products through the website on your own, you will receive 50% of each sale made, and send the other 50% to our company.

2) If sales are made due to our advertising and promotion campaign and the customers were attracted due to our promotional efforts, you will receive a commission in the amount of 5 % of each sale made.

If the 2nd option is the main variant of work, there are several options in terms of your compensation; for example, it may be a fixed salary per month, which will not depend on the sales level, or it may be a combination of the two, i.e. a fixed-sum salary + a certain % from each sale made. We will be able to discuss this possibility in more detail at a later stage.

The above is a brief introduction and information on the project, but it is sufficient for you to already have a certain impression of the vacancy of the Sales Representative/Project Manager offered by our company.

Now, we will need to analyze the information you provided and you as a potential candidate one more time, in greater detail; in the meantime while we are doing that, you can compile a list of any questions that you may have to send to me; we are expecting to hear from you within the next 72 hours. If we receive no reply from you within the next 72 hours, we will no longer be considering you as a potential candidate for the position of the Sales Representative/Project Manager.

Looking forward to your reply.

--

Best Regards,
Alex Malenkovsky,
HR Manager,
Skydex Soft Ltd

--
Suckers Wanted -- Employment Opportunities That Will Cost You

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 31 Aug 2009 00:55:05 EDT

anon : Not to mention that the address they used to file is a bogus box at a ups store, per federal address validation:

UpS Store The (630) 554-5955 - 2758 Route 34, Oswego, IL

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 29 Aug 2009 15:41:49 EDT

music man : Yet another on 72.34.55.197, ladies and gentlemen I give you »acrossthescreenuniverse.com

Snapped 2009-08-29 15:42:06

»acrossthescreenuniverse.com/index.php

As with all of the work of our Slav friends it comes complete with

User-agent: *
Disallow: /

Registry Data
ICANN Registrar: ENOM, INC.
Created: 2009-03-24
Expires: 2010-03-24

Etc, etc etc!!!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 29 Aug 2009 15:37:43 EDT

music man : From the same stable as therecruiternetwork.org- »webrecruit.org

Snapped 2009-08-29 15:37:53

»webrecruit.org/about.php

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 29 Aug 2009 15:19:44 EDT

music man : And yet another one- »this1isawesome.com

Snapped 2009-08-29 15:20:08

»this1isawesome.com/index.php

Even comes with its own dedicated refund page!!

Snapped 2009-08-29 15:19:52

»this1isawesome.com/moneyback.php

Usual vlad tactics - no contact phone number, no address. Email addy is obfuscated by being an image.

Registry Data
ICANN Registrar: ENOM, INC.
Created: 2009-06-11
Expires: 2010-06-11

Privacyprotected registration as well.

Re: The Recruiter Network

Thu, 27 Aug 2009 17:15:43 EDT

MGD :

said by iDeceive :

A correspondent has asked me about the following recruitment offer. I've advised him that it's a money mule job of the sort discussed here (and pointed him to the forum). I don't know how useful this information will prove to be -- there's not much to go on -- but I'm posting it here for future reference, just in case. (Also useful if anyone searches based on this text.)

Excellent decision to post iDeceive .

said by iDeceive :

.....
I don't know how useful this information will prove to be -- there's not much to go on --

More than you thought, sometimes all that is needed is a mere crumb of information. Not only is the mention of setting up an LLC /Corp and obtaining merchant services a primary clue, which ties it to this organized crime syndicate. I can confirm absolutely that it is the same criminals.

Several of the graphic images that have been used before are on here:

Snapped 2009-08-27 12:59:43

»therecruiternetwork.org

Snapped 2009-08-27 13:18:32

»therecruiternetwork.org/images/cand.jpg

Snapped 2009-08-27 13:18:30

»therecruiternetwork.org/images/pic.jpg

Despite listing a born on 2007 date the therecruiternetwork.org image files were uploaded on 08/10:

Snapped 2009-08-27 13:18:27

»therecruiternetwork.org/images/

It belongs to the download themed group whose recruiting C&C repeatedly projects itself as being based in Sweden. They are also using the same address as a recently posted recruiting email for the known fraud Riddick-Design.

Riddick is a subset of a large group of let's pretend we are in Sweden fraud cyber-mule recruiting sites. Not only is the SCAM therecruiternetwork.org FRAUD hidden such that only those whose resumes are targeted can find it:

[att=1]

According to the source code of the main index page that are no more that a few text words on there. Everything is in a graphic non searchable format including the contact details:

Snapped 2009-08-27 12:59:25

»therecruiternetwork.org/contact.php

therecruiternetwork.org
Server Data
Server Type: Apache
IP Address: 72.34.55.197
IP Location - California - Encino - Ih Networks
Response Code: 200
Domain Status: Registered And Active Website

Not only is this group associated with recruiting for the mobile themes, but the scam recruiting website therecruiternetwork.org is hosted on the same server as Cheapestthemes.com

IP Address: 72.34.55.197

Hosting Audit

045. Cheapestthemes.com
192. Therecruiternetwork.org

The fraud website Cheapestthemes.com has been processing fraud charges since early February with the latest report less than 24 hours ago

An audit of the 200 odd websites hosted on IP Address: 72.34.55.197 reveals that in addition to Therecruiternetwork.org and Cheapestthemes.com a mobile themed download fraud website imagestudiodesign.com is also hosted on that server:

Snapped 2009-08-27 17:01:58

»imagestudiodesign.com

Administrative Contact:
   Whois Privacy Protection Service, Inc.
   Whois Agent ()
   +1.4252740657
   Fax: +1.4256960234
   PMB 368, 14150 NE 20th St - F1
   C/O imagestudiodesign.com
   Bellevue, WA 98007
   US
.
Status: Locked
.
Name Servers:
   ns1.uswebhosting.com
   ns2.uswebhosting.com
.
Creation date: 05 Feb 2009 23:52:25
Expiration date: 05 Feb 2010 23:52:00

Snapped 2009-08-27 17:01:36

»imagestudiodesign.com/contacts.php

The imagestudiodesign.com contact phone number of 813-200-4105 is cloaked as an image file:

Snapped 2009-08-27 17:01:18

»imagestudiodesign.com/Fd56nf.php···7e11&t=p

That image format is identical to the contact details of Therecruiternetwork.org same php script:

Snapped 2009-08-27 17:11:00

»therecruiternetwork.org/txt2img.···5663&t=p

Snapped 2009-08-27 17:10:59

»therecruiternetwork.org/txt2img.···5663&t=a

RECRUIT FRAUD = therecruiternetwork.org =JOB SCAM
RECRUIT FRAUD = klara.jagerhon@therecruiternetwork.org =JOB SCAM
RECRUIT FRAUD = Klara Jagerhon =JOB SCAM
RECRUIT FRAUD = The Recruiter Network =JOB SCAM
Gjorwellsgatan 28, 112 60Stockholm, Sweden
RECRUIT FRAUD= Swedish web-design studio "Rich Productions" =JOB SCAM

MGD

Re: Gamatron fraud charges, Devbill/DigitalAge/Pluto

Thu, 27 Aug 2009 16:03:08 EDT

K Patterson : Pllease DO NO dispute the charge. Insist that the card copany process it as fraudulent.

If it is reported as disputed, the fraudsters will protest, anything to keep the site up a few more days.

Gamatron fraud charges, Devbill/DigitalAge/Pluto

Thu, 27 Aug 2009 15:24:55 EDT

anon : This company also charged my BofA account in the amount $9.45 in August of 2009. I tried calling their number and going to their website but there was little to zero helpful information. Be very careful and do dispute and report them should you see Gamatron charges on your statement and please cancel your card and request a new one.

The Recruiter Network

Thu, 27 Aug 2009 11:23:11 EDT

iDeceive : A correspondent has asked me about the following recruitment offer. I've advised him that it's a money mule job of the sort discussed here (and pointed him to the forum). I don't know how useful this information will prove to be -- there's not much to go on -- but I'm posting it here for future reference, just in case. (Also useful if anyone searches based on this text.)

From: Klara Jagerhon 
Subject: Assistant Director Positon
To: [redacted]
Date: Wednesday, August 26, 2009, xx:xx

Dear Applicant,

I represent the The Recruiter Network, Sweden based company that provides
recruitment services globally. We work in partnership with our candidates
and clients to provide both with our expertise in every part of the 
recruitment process, to delivery added value to our candidates and clients.

Our client, Swedish web-design studio "Rich Productions", is looking for managers
in the USA to create Rich Productions' subsidiaries. I have found you resume on 
»www.monster.com/ and I suppose that this position could be 
a good opportunity for you to get additional income.

Your mission in this project is to establish business tools (to register
a business entity, to set up business and merchant bank accounts), and,
basically, after that all you will have to do is to spend a couple of 
hours a week to monitor sales level, incoming and outgoing payments, and
perform simple tasks from Rich Productions' manager.

Rich Productions will create a web-site (online store, Rich Productions' subsidiary)
that will sell their products. The operation of  this  web-site 
impossible without a merchant account, that  is  why  your  mission of 
establishing the listed above business tools  is  so  important  for  the  
project.  Certainly,  you  will be reimbursed for all expenses.

If you already have a company, you can use it instead of registering a
new one, it will make the start up yet faster.

Your commission will be 5% from gross sales (you'll earn about 1500-2000$ 
a month). You will get this commission in any case regardless any fees
applied to business.

Your income will increase as the business progresses. And, as you can
see, everything is very simple and all partnership activities are 
absolutely transparent.

Please e-mail me at alva.stahrberg@1stclassrecruitment.com, and I will
provide you with all the details. Even if you are not interested in this
position, let me know and I will contact you if we have any other, more
suitable for you, opportunity.

Sincerely,
Klara Jagerhon, HR Agent
The Recruiter Network
Gjorwellsgatan 28, 112 60 
Stockholm, Sweden

Note that 1stclassrecruitment.com is registered anonymously, created on 13-jan-2009; therecruiternetwork.org is registered under the name "Doris Weeks" (address info exists), created on 23-Jul-2009 21:31:03 UTC.

--
Suckers Wanted -- Employment Opportunities That Will Cost You

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 25 Aug 2009 11:00:29 EDT

anon : I have a charge of $13.15 on my CA based card

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 21 Aug 2009 03:27:55 EDT

MGD : I posted victim alerts on 800notes.com for the group of cyber-mule SADIE SALAZAR's card fraud laundering websites:

1) RAGDESIGN.COM aka REMOTE ACCESS GROUP INC. 206-666-4778

2) BIGSTUDIODESIGN.COM aka ILLUSTRATIVE STUDIO, INC. 206-350-6215

3) JAZZIPHONE.COM aka MOBILE INTERFACE, INC 206-338-6018

RAGDESIGN.COM was the first posted, and generated victim reports which assisted in tracking down the Corporation.

There have been numerous search referrals from search engines on JAZZIPHONE.COM, a sure sign that there are many fraud victims finding charges from them.

Within three days of posting the BIGSTUDIODESIGN.COM three victims reported in to the thread, of which one was of particular interest:

quote:
lml - 19 Aug 2009

Received a fraudulent charge of $13.15 from Bigstudiodesign.com on 8-16-2009 also from gamarton $9.45, NWFRESH $20.00 and adaptablechargers $54.95
These have all been reported as farud to Chase.com

Ref: »800notes.com/Phone.aspx/1-206-350-6215

In addition to the $13.15 Bigstudiodesign.com they also reported tadem charges from: gamarton $9.45, NWFRESH $20.00 and adaptablechargers $54.95

I am trying to find info on both NWFRESH and adaptablechargers to see if they are fraud laundering or syndicate use of the card for self purchases. NWFRESH appears to be a fraud laundering for sure, but I cannot locate anything on that.

On the other hand the tandem fraud charge from "gamarton $9.45" has been traced to another new crime syndicate operation:

GAMARTON.COM aka PROCESSING PROMISE LLC 231-480-4869 »gamarton.com

[att=1]

========================
Home :: Contact Us
gamarton.com
Sales: Tasha Blake
124 Evart street, Cadillac
MI 49601 USA (+1)(231) 480-4869

If you want to contact us for any reason please write email to: sales@gamarton.com or fill the form below:
========================

Snapped 2009-08-21 03:14:28

»gamarton.com/index.php?main_page=contact_us

The website is hosted on a GoDaddy dedicated IP, and the domain is registered to the cyber-mule:

Server Data
Server Type: Apache
IP Address: 208.109.156.230
IP Location - Arizona - Scottsdale - Godaddy.com Inc
Response Code: 200
SSL Cert: www.gamarton.com expires in 216 days.
Domain Status: Registered And Active Website


Whois Record
Registrant:
   Tasha Blake admin@gamarton.com
   124 Evart St.
   Cadillac, Michigan 49601
   United States
.
   Domain Name: GAMARTON.COM
      Created on: 24-Mar-09
      Expires on: 24-Mar-10
.
   Domain servers in listed order:
      NS21.DOMAINCONTROL.COM
      NS22.DOMAINCONTROL.COM

.
First PROCESSING PROMISE LLC was registered on March 18th 2009:

[att=2][att=3][att=4]
.


MICHIGAN DIVISION OF CORPORATIONS
.
Name PROCESSING PROMISE, LLC 
. 
Type: Domestic Limited Liability Company
.  
Resident Agent:  TASHA BLAKE
.
Registered Office Address: 
.
124 EVART ST., CADILLAC, MI 49601
.  
Mailing/Office Address:           
. 
Formation/Qualification Date:3-19-2009 
. 
Jurisdiction of Origin:MICHIGAN 
.
Managed by: Members 
. 
Status: ACTIVE    Date: Present

.
Then on April 6th 2009 TASHA BLAKE filed an Assumed Name of GAMARTON.COM under the ownership of PROCESSING PROMISE, LLC:

[att=5]
.


Assumed Names: 
GAMARTON.COM  
.
Id Num
E46279
.
Creation Date: 4-6-2009
Renewal Date: 12-31-2014
Name:PROCESSING PROMISE, LLC

.

Take note of this fake price list, which also incudes items for 4 cents !!.

[att=6]

Place a bet that they are also pinging card data for validation with this set up as well. The last time they ran many thousands of ping charges through those Texas set sites specifically set up for card validation, it made the national media. In keeping with the new strategy of going in to complte hide mode, they may plan on mingling the ping validations in with regular fraud processing. By listing a .04 priced item the hope to fool anyone who suspects card testing. They may well run the pinged cards thorugh their other fraud sites the following month.

GAMARTON.COM aka PROCESSING PROMISE LLC 231-480-4869 already has numerous fraud reports starting about 12 days ago:

[att=7]
ref: »www.numberinvestigator.com/phone···869.html

There are likely to be several more in this themed group currently in operation, all will be GoDaddy hosted.

EDIT ADD:

A close examination of the documents shows that an online service called "Start Biz Here Inc" »STARTBIZHERE.COM was used by the crime syndicate to process the Michigan LLC registration. It is really a clueless move for that US based business to have a cloaked Canadian domain registration. What were they thinking !!

Whois Record
Registrant:
Contactprivacy.com
96 Mowat Ave
Toronto, ON M6K 3M1
CA

Domain name: STARTBIZHERE.COM

»www.majon.com/advanced/pressrele···inc.html

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 19 Aug 2009 11:58:21 EDT

hoyleysox : The circumstances described in this thread seem like an efficient way to exploit those 170 million credit card account numbers. The current US population is about 300 million people!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 19 Aug 2009 10:02:57 EDT

anon : »www.huffingtonpost.com/2009/08/1···378.html

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 15 Aug 2009 16:59:01 EDT

MGD :

said by music man :

OK- add »worldinyourmobile.com to the list of fakers

Excellent work music man

I am searching for fraud charge reports. Some may be dormant, possibly the result of cyber-mule failure, or other events. In fact this post you made on 07/11 regarding sibersoftllc.net aka Siberian Software LLC »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto was another great find:

said by music man :

Not too sure about this one but it shares some of the same text as E-RPMSOFT.COM

Snapped 2009-07-11 03:06:02

»sibersoftllc.net/contactus.aspx

Recent domain registration

Registry Data

ICANN Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Created: 2009-04-16
Expires: 2010-04-16
Updated: 2009-04-16
Registrar Status: clientTransferProhibited
Name Server: NS1.OFFICELIVE.COM (has 649,658 domains)
Name Server: NS2.OFFICELIVE.COM (has 649,658 domains)
Whois Server: whois.melbourneit.com

Detroit cellphone number for contact

Information on phone number range +1 313 999XXXX

Number billable as mobile number
Country or destination United States
City or exchange location Detroit, MI
Original network provider* Nextel Communications, Inc.

No contact address

.
sibersoftllc.net aka Siberian Software LLC is confirmed as one of the organized crime syndicate's set ups. However, it is now dormant, and failed during the set up phase. In fact, the website, in its current configuration, is a good example to merchant providers and others, to see how the OCS can adapt and morph the websites during the approval and merchant account aplication process. That site was abandoned upon completion of the set up phase. In many cases, the criminals will display the full legitimate contact information, and have everything match to the registrant and LLC owner. The intention is to make the merchant account underwriter believe that it is indeed a legitimate operation. Thus the details listed will be transparent and match. Only after the approval process will the criminals then remove this information, and change it to the usual impossible to track configuration. So the websites that an underwriter may review, will not necessarily be the same ones that are subsequently seen by the fraud victims, with respect to the listed contact details. These criminals are totally adept at manipulating every phase and component of the operation.

sibersoftllc.net aka Siberian Software LLC proved to be a lucky break for both the cyber-mule and the merchant account underwriter. The cyber-mule was recruited by the cloned recruiting fraud:

Redstone Software, Ltd. aka Redstonesoft.com

.
.
.
He was recruited by Redstone Software, Ltd. aka Redstonesoft.com as a result of the massive carpet bombing job fraud recruiting campaign on careerbuilder.com:
.
.
.

.
.
Believing it to be a legitimate job offer, the cyber-mule completed the application process and background check. As instructed, he set up an LLC, and opened a business bank account, and applied for, and was approved, for a merchant card processing account. He, as instructed by the crime syndicate, contacted Authorize.net, and applied for and obtained gateway services from them.

The costs associated with registering and setting up the LLC, the initial banking fees, and the Authorize.net gateway fees, were immediately reimbursed to the cyber-mule. That reimbursement was sent to the cyber-mule via PayPal from:

Sergey Chuksin serega_zlt@mail.ru from Zlatoust, Russia.

.
.
Sergey Chuksin serega_zlt@mail.ru
.

Everything was in place and cleared, all were ready go. The lucky break came a week later during a phone call that the duped cyber-mule had with the merchant account underwriter. During that casual conversation something the cyber-mule mentioned set off an alert with the merchant account underwriter. ( I will not state the specifics, as that will be of value to the organized crime syndicate, who are avid readers of this thread.) Within 30 minutes the underwriter called the cyber-mule back, and told him that he locked the merchant processing account, and was in the process of cancelling it. The underwriter then explained to the cyber-mule that he had reviewed the entire set up, and had identifird that he, the cyber-mule, was the victim of a recruiting fraud.

Kudos to the very alert merchant account underwriter, who, not only immediately cancelled the prior approved account, but also explained the process in detail to the cyber-mule. Doing so removes the cyber-mule from the available victim pool. In prior cases where the underwriter would just cancel an account, the uninformed cyber-mule would be sent elsewhere by the OCS to apply for and open a new one. The massive multi million dollar multi year fraud documented in this thread, has been well disseminated across multiple layers of the financial system. The benefits and results of that have been apparent for some time now.

The cyber-mule obviously immediatly dropped out, and the crime syndicate subsequently abandoned the website, sibersoftllc.net

MGD
EDIT = Corrected typos, added text

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 14 Aug 2009 15:15:08 EDT

music man : Next you can add »www.intlibrary.biz

Snapped 2009-08-14 15:13:45

»www.intlibrary.biz/about.php

No contact phone number

Whois
Whois Record

Domain Name: INTLIBRARY.BIZ
Domain ID: D31342974-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Domain Status: clientTransferProhibited
Registrant ID: BB7CCA32B33232A2
Registrant Name: Thomas Soles
Registrant Organization: -
Registrant Address1: 4433 Glen Rose St
Registrant City: Fairfax
Registrant State/Province: VA
Registrant Postal Code: 22032
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.5016219448

Phone number from whois comes out to Little Rock ,AR!!

Same registrant, same web template, different domain-

Snapped 2009-08-14 15:13:28

»intellectlibrary.com/contacts.php

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 14 Aug 2009 15:00:38 EDT

music man : OK- add »worldinyourmobile.com to the list of fakers

Snapped 2009-08-14 15:00:11

»worldinyourmobile.com/contacts.php

Phone number (804-3351435) is a cellphone, site has that phone number as an image.

Registrant details

Domain Name: WORLDINYOURMOBILE.COM
Created on: 14-Apr-08
Expires on: 14-Apr-10
Last Updated on: 20-Jan-09

Administrative Contact:
Singer, Arthur
24346 Sparta Rd
Milford, Virginia 22514
United States
8043351435 Fax --

Technical Contact:
Singer, Arthur
24346 Sparta Rd
Milford, Virginia 22514
United States
8043351435 Fax --

Domain servers in listed order:
NS51.DOMAINCONTROL.COM
NS52.DOMAINCONTROL.COM

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 13 Aug 2009 17:18:21 EDT

MGD : Another round of forum spamming is ready to start for E-RPMSOFT.COM 336-793-0285 »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Within the past 48 hours there have been numerous forum registrations under E-RPMSOFT.COM.

[att=1] and [att=2]

Confirmation that the new registrations are once again originating from the Moldova, can be seen on forums where the member's country of origin is auto entered based on the geo location of the IP address of the applicant.

[att=3]

Though there are now numerous victim reports of the fraud charging, it is likely that this new round of spamming is intended to counteract the E-RPMSOFT.COM 336-793-0285 operation going into full blast fraud mode. The intent is to push any reference of the fraud charging off the first few pages of Google:

»www.google.com/search?hl=en&q=E-···oq=&aqi=

Snapped 2009-08-13 17:18:18

»www.google.com/search?hl=en&q=E-···oq=&aqi=

The posts are all copy and pastes of previous posts on the thread topic. It is obvious that the poster has no command of the English language. Similar postings on Russian forums are however unique and not copies of previous posts.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 12 Aug 2009 06:43:11 EDT

MGD : When a fraudulent LLC / Corp., and corresponding cyber-mule is uncovered, and identified as belonging to the organized crime syndicate's operation, a profile search is usually conducted on the cyber-mule. That has become more vital recently as the Organized Crime Syndicate has now pursued a path of exteme stealth behavior. When several attempts to silence the expose of their multi year massive fraud and laundering operation failed, they revamped and changed many of their common tactics which they believed were used to track and shadow their operation. This multi million dollar a year operation, which is an industry within itself that is now embedded within the financial system, needed to return back to its silent hidden operational format. This has resulted in many of the established long term monitoring points being abandoned, and has made them considerably more difficult to shadow. Even though this thread really only scratched the surface of the operation, it was still an Achilles heel, because it published and documented that this multi year organized fraud has existed unchallenged for years. Their current goal is to return the operation to its former status of apparent non existence. While there have been articles which discussed Russian organized crime infiltrating and hacking card data systems, such as these prophetic predictions over eight years ago, by some sharp individuals:

From circa 2001:

Tuesday, July 17, 2001

The Russian Mob is recruiting

The Russian Mob is recruiting hackers to raid e-commerce sites for credit-card numbers. Security experts said the Russian Mafia hacking rings are often run by former KGB agents who recruit hackers in their 20s to do the dirty work. The young hackers typically answer Internet advertisements for computer programmers, planted by organized crime outfits in Moscow, St. Petersburg and Murmansk.
..
.
Spearheading the organized hacking rings is the Russian mafia, security experts say. The Russian mafia has infiltrated many businesses in the former Soviet Union, and is becoming increasingly sophisticated in computer crimes.

These groups are penetrating computers in the US and other Western countries to obtain illegal profits, said John Collingwood, FBI assistant director for public affairs, during a briefing at FBI headquarters in Washington, DC, recently.

"For the foreseeable future, we are going to see an explosion in this area," Collingwood said. "It's literally a brand new area for us. And it is one where no one is sure of what the implications will be."
...
..

»www.zdnetasia.com/news/business/···5,00.htm

There has not been much published of an actual long term operation that has infiltrated and embedded itself within the financial systems, virtually undetected for such an extended period. Especially one which still manages to launder millions a year out of the country via the US banking system, despite the increased regulations of the Patriot Act, which, in theory, should make this an impossible feat.

As an IT security evangelist, one of the primary goals was to identify the OCS's sources of the millions of card data accounts which they obtained every year. Regardless of whether the ring leaders can be identified and prosecuted, identifying the methods and source of the hacked data, is a crucial component to any strategy in disrupting this multi year fraud operation. The anticipated compromise of many of the shadowing tactics being exposed to the criminals by going public, was considered a worthwhile trade off, in order to generate attention to the data sources. Much of the acquired knowledge of their tactics could still be utilized in tracking them, even if they subsequently radically altered their modus operandi in order to remain hidden. From a forensic standpoint, very little data has been uncovered about the card data sourcing operations. There has been much speculation as to potential sources, including the well publicized connection by many of the victims to a very common, and sometimes sole prior transaction with Equifax. That connection was a focal point of Bob Sullivan's Red Tape Chronicles article in November of 2007. There have been numerous other articles over the years, focusing on the apparent common link du jour among victims. However, none have reached the level needed to make irrefutable confirmations.

In fact, there has only ever been one absolute 100% confirmation of a source, and that was for a very small portion of the overall hijacked data processed by this syndicate. That revealing fact can be attributed to a failure of the syndicate to recognize the unique characteristics of the card data which they hijacked. Even the usual tactic of mixing multiple source data within fraud charge runs, in order to preserve the sources, would not dilute the unique tracking characteristics of that data. That mixing tactic is one of the reasons that a minimum requirement for focusing on the data source, is to combine the billing records from at least a hundred or more fraud sites over an extended period, in order to have a large enough analysis database that will overcome the dilution tactics. It was the crime syndicate's hacking of the entire multiple year database of Ranger Joes customer's card data via an Sql exploit, which left a trail that led right to their front door. Within days of the data hacking, the hijacked Ranger Joes card data was processed with fraud charges spread across a dozen or more of the organized crime syndicate's fraud sites. Though it was mixed in with other hijacked data in submitted charge batches across the multiple sites, the unique identifier of the source could not be diluted. Ranger Joes card data had such a unique client identifier that rarely exists in any order database. All of the card holders represented a very small subset of the overall population, they were all either current or former Military or Law Enforcement personnel. So within a week or two following the hack, military personnel stationed in Germany, Iraq, Saudi Arabia, along with some in the US, all began reporting fraud charges originating from various active fraud laundering websites of the crime syndicate. The pattern stuck out like a red flare. Never before had such a unique group all with one prior event in common report their first fraudulent card activity as coming from one the known active group of fraud websites. The syndicate's error in not recognizing the unique data qualifiers, and its ramifications, is an inherent flaw which lacks localized context due to their location and native language.

With respect to the now crucial profile checking of cyber-mules, to detect new patterns of the crime syndicate, I just completed a thorough check of the above listed cyber-mule of the REMOTE ACCESS GROUP, INC aka RAGDESIGN.COM 206-666-4778 operation, it produced valuable intelligence, and it was certainly worth the time. Running the cyber-mule through multiple data bases shows that she did not appear to have any prior formal business related activities. However, after her duped recruitment by the Russian crime syndicate, she has become a prolific business entrepreneur. Two months after the 05/12/09 formation of REMOTE ACCESS GROUP corporation, Ms. Salazar formed another Florida corporation called ILLUSTRATIVE STUDIO, INC. Based on the electronic format of all the filings, it is likely that the criminals are setting them up via an online service, then the service is sending the documents to Ms. Salazar.

[att=1]

====================================
Florida Profit Corporation

ILLUSTRATIVE STUDIO, INC.

Filing Information

Document Number P09000060438
FEI/EIN Number NONE
Date Filed 07/16/2009
State FL
Status ACTIVE
Effective Date 07/15/2009

Principal Address

2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US
Mailing Address
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US

Registered Agent Name & Address
SALAZAR, SADIE
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US

Officer/Director Detail

Name & Address

Title P

SALAZAR, SADIE
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US
====================================

[Att=2][att=3]

Regular readers, may already have a good idea what themed website group that the above INC name may be for. I picked it too up front, but was absolutely postive when I then tracked down a sub Fictitious Business Name (FBN) that was registered under ILLUSTRATIVE STUDIO, INC, three weeks later on 08/06/2009, called BIGSTUDIODESIGN.COM

[att=4]

====================================
Fictitious Name

BIGSTUDIODESIGN.COM

Filing Information

Document Number G09000143178
Status ACTIVE
Filed Date 08/06/2009
Expiration Date 12/31/2014
Current Owners 1
County CLAY
Total Pages 1
Events Filed NONE
FEI/EIN Number NONE

Mailing Address

2100 NW 99TH TERRACE
PEMBROKE PINES, FL 33024

Owner Information

ILLUSTRATIVE STUDIO, INC
2100 NW 99TH TERRACE
PEMBROKE PINES, FL 33024
FEI/EIN Number: 27-0556632
Document Number: P09000060438
====================================

[att=5]

Note that the above FBN lists "CLAY COUNTY" Florida as the primary place of business. As noted above, RAGDESIGN.COM listed "CHARLOTTE COUNTY" Florida as its primary place of business, though Broward County is where the listed address is. I am still not sure of the purpose of the wilful false statement on the documents, maybe an attempt by the syndicate to hide the cyber-mule. Or it could be a factor in creating multiple merchant accounts, and hiding the fact that other businesses exist. I do not really know at this point, just speculations, but they apparently have an intended purpose.

Even before I went to the website which was undetected up until now, I knew it would be a "Gargoyle" a la Nuranstudio.com

ILLUSTRATIVE STUDIO, INC. aka BIGSTUDIODESIGN.COM 206-350-6215 »bigstudiodesign.com

[att=6]

====================
Bigstudiodesign.com
bigstudiodesign.com
1-(206)-350-6215
===================

[att=7]

Server Data: BIGSTUDIODESIGN.COM
IP Address: 205.178.145.65
IP Location - Massachusetts - West Springfield - Network Solutions Llc
Response Code: 200
Domain Status: Registered And Active Website

NOTE = BIGSTUDIODESIGN.COM and RAGDESIGN.COM are hosted on the same sever.


ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD.  = YAWN !!
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: EVERITY, INC.
Contact: +1.8005538470
Website: >http://www.everity.com
.
Domain Name: BIGSTUDIODESIGN.COM 
.
Registrant:
    N/A
    Karl Fischer        (fisher_karl9@yahoo.com)
    25 Autumn St. 
    Everett
    MA,02149
    US
    Tel. +01.2707210588
.
Creation Date: 15-Jul-2009  
Expiration Date: 15-Jul-2010
.
Domain servers in listed order:
    ns38.worldnic.com
    ns37.worldnic.com

.
A check of that registration shows that same address in MA, with a different name, was used back in March of 2008 to register a Black Flash Template fraud site AS-MULTISERVICES.COM. Running the name Karl Fischer through my records reveals that his name was used in conjunction with a Florida address back in November of 2008 to register one of the Orange template fraud sites: CONNECTDIZ.COM AKA Web Connections, Inc. 205-705-3265. Over the years, these criminals have acquired a vast data base, and apparently utilize it.

Snapped 2009-08-12 06:19:20

»bigstudiodesign.com/robots.txt

In what can be best described as a "MARY ATTALLA" flashback, digging further revealed that on 07/16/2009 a week prior to the registration of ILLUSTRATIVE STUDIO, INC, Salazar had registered a third Florida corporation on 07/08/2009 called MOBILE INTERFACE, INC.

[att=8]

====================================
Florida Profit Corporation

MOBILE INTERFACE, INC

Filing Information

Document Number P09000058491
FEI/EIN Number NONE
Date Filed 07/08/2009
State FL
Status ACTIVE
Effective Date 07/08/2009

Principal Address

2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US

Mailing Address

2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US

Registered Agent Name & Address
SALAZAR, SADIE
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US

Officer/Director Detail

Name & Address

Title P

SALAZAR, SADIE
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024 US
====================================

[att=9][att=10]

Are you thinking maybe this one is for the mobile themes download group?, I was too.

Cross checking the Florida Fictitious Business Name database for any registered FBN filed under ownership of MOBILE INTERFACE, INC produced this, JAZZIPHONE.COM

[att=11]

====================================
Fictitious Name

JAZZIPHONE.COM

Filing Information

Document Number G09000135485
Status ACTIVE
Filed Date 07/15/2009
Expiration Date 12/31/2014
Current Owners 1
County BROWARD
Total Pages 1
Events Filed NONE
FEI/EIN Number NONE

Mailing Address

2100 NW 99TH TER
PEMBROKE PINES, FL 33024

Owner Information

MOBILE INTERFACE, INC.
2100 NW 99TH TER
PEMBROKE PINES, FL 33024
FEI/EIN Number: 27-0515844
Document Number: P09000058491
====================================

[att=12]

Chalk up a fresh new design to this group:

MOBILE INTERFACE, INC aka JAZZIPHONE.COM 206-338-6018 »jazziphone.com

[att=13]

====================================
Contacts

Please feel free to contact us anytime.

JazziPhone.com

+ 1-(206)-338-6018

support@jazziphone.com

====================================

[att=14]

Server Data JAZZIPHONE.COM
Server Type: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8

IP Address: 174.132.217.242
IP Location - Texas - Dallas - Theplanet.com Internet Services Inc
Response Code: 200
SSL Cert: beacon.ihostsupport.net expires in 250 days.
Domain Status: Registered And Active Website


ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Whois Record
Registration Service Provided By: EVERITY, INC.
Contact: +1.8005538470
Website: »www.everity.com
.
Domain Name: JAZZIPHONE.COM 
.
Registrant:
    N/A
    Karl Fischer        (fisher_karl9@yahoo.com)
    25 Autumn St. 
    Everett
    MA,02149
    US
    Tel. +01.2707210588
.
Creation Date: 07-Jul-2009  
Expiration Date: 07-Jul-2010
.
Domain servers in listed order:
    ns14.everity.com
    ns13.everity.com

.
A duplicate of the BIGSTUDIODESIGN.COM registration.

Snapped 2009-08-12 06:18:58

»jazziphone.com/robots.txt

The organized crime syndicate is clearly well underway with the new stealth strategy of creating layers upon layers of registrations in order to make it far more difficult, if not impossible, to track down and identify then close down the individual operations. Combining this tactic with the robots.txt files, which block search archiving, and now spreading the websites across individual hosts around the globe, is intended to make the operation once again disappear from public view. Only the recruited duped cyber-mule, the merchant account underwriter, and eventually a fraud victim, are the only ones intended to know that a website even exists. These two newly discovered ventures are right in the setup phase.

It is now rare for an exhaustive digging session to produce these kind of results in one hunting expedition. It is sort of an icing on the cake, as it followed an earlier reconnaissance mission which targeted and successfully infiltrated the organized crime syndicate's computer systems. That foray included the recovery of a database which contained a large pool of resumes and applicants from a recent mass job posting campaign.

[att=15][att=16][att=17][att=18]

Though resumes and applications by themselves are not usually considered to be identity theft risks, reviewing the captured data indicates that when combined with the syndicate's usual follow ups, which include the applicant submitting a picture id along with other bio data for the "security background check", may pose enormous risks. Having such massive detailed biographical data of US residents, in the hands of a Russian organized crime syndicate, especially when combined with picture identities, is, in my opinion a startling security risk. More on that in later posts.

The only evidence uncovered to date of even quasi identity theft, has been the use of the data to register domains, and obtain hosting and other supporting services for the fraud. In fact, in one specific case where a domain registration was contested as being fraudulent, the crime syndicate responded by producing a picture id (a driver's license) which matched the domain registration. The criminal respondent assumed that identity, and protested that the registration was legitimate. It is also suspected, though I have yet to review the data, that these identities are used to registered prepaid debit cards obtained domestically using the fraud proceeds. These massive city by city carpet bombing job campaigns utilizing Careerbuilder.com and others, produce thousands of applicants and resumes. We already know that the organized crime syndicate operates within the shadows of online Drug Pharma, Extreme Porn, HYIP and other online Ponzi scams, and child porn. So it is not unreasonable to conclude that such an identity database could serve many purposes in hiding the real criminals. Could they assume some of those identities and obtain real or forged travel documents?, who knows for sure.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 10 Aug 2009 18:17:05 EDT

MGD : Though Ms. Salazar is probably not aware of this, I can guarantee you 100% that there will be no activity performed under this name which will even remotely fall under the "Article 3" definition:

[att=1]

I am confused by one issue in the above document filings. Take note of the Florida Fictitious Name filing documents for RAGDESIGN.COM. which list the county as "Charlotte". The listed address for REMOTE ACCESS GROUP, INC. is in southern Broward County, on the east coast. Charlotte county is on the Gulf side of Florida.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 10 Aug 2009 17:59:49 EDT

MGD : The card fraud laundering website of RAGDESIGN.COM 206-666-4778 was originally published in this thread back on July 7th: »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Snapped 2009-08-10 17:29:15

»ragdesign.com

EDIT= SInce the website is all in flash it prevents live DSLR screen shots from being captured.

[att=6]

Snapped 2009-08-10 17:51:30

»ragdesign.com/contacts.php

At that time the cyber-mule and corresponding US business registration had not been uncovered. However, it was believed at the time that they were already in fraud charging mode, as the fraudulent site was already being forum spammed in order to manipulate search results. To assist in combating search manipulation, a fraud alert was also posted on 800notes.com. In addition, I asked fraud victims to post the line charge in order to assist in locating the possible state of origin of the fraudulent business bank and merchant accounts.

This post just came in a few hours ago:

quote:
MGD - 23 Jul 2009

If you receive a fraud charge from RAGDESIGN.COM 206-666-4778 please post the line item details of the charge. I am looking for the two letter state abbreviation, which will narrow down the state where the fraudulent merchant account was obtained from, and where the acquirer bank is located.

Thanks,

MGD

=============================================

Reply
LRH - 3 hours 49 minutes ago

i RECEIVED A CHARGE FROM THIS COMPANY ON MY BANK ACCOUNT. RAGDESIGN.COM 206-666-4778 FL

»800notes.com/Phone.aspx/1-206-666-4778

I am not sure if this is part of the organized crime syndicate's new uber obfuscation tactics, however they instructed the cyber-mule to register a corporation in Florida on 05/12/2009 named REMOTE ACCESS GROUP, INC

[att=1]

====================================
Florida Profit Corporation

REMOTE ACCESS GROUP, INC

Filing Information

Document Number P09000042170
FEI/EIN Number NONE
Date Filed 05/12/2009
State FL
Status ACTIVE
Effective Date 05/12/2009

Principal Address

2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024

Mailing Address

2100 NW 99TH TERRACE
PEMBROKE PINES FL 33024

Registered Agent Name & Address

SALAZAR, SADIE
2100 NW 99TH TERRACE
PEMBROKE PINES FL 33025 US

Officer/Director Detail

Name & Address

Title P

SALAZAR, SADIE
2100 NW 99TH TERRACE

PEMBROKE PINES FL 33024 US
====================================

[att=2]
[att=3]

Seventeen days later, on 05/29/2009 they registered a Fictitious Business name under the umbrella of REMOTE ACCESS GROUP, INC and called it RAGDESIGN.COM:

[att=4]

====================================
Fictitious Name

RAGDESIGN.COM

Filing Information

Document Number G09000111925
Status ACTIVE
Filed Date 05/29/2009
Expiration Date 12/31/2014
Current Owners 1
County CHARLOTTE
Total Pages 1
Events Filed NONE
FEI/EIN Number NONE

Mailing Address

2100 NW 99TH TER
PEMBROKE PINES, FL 33024

Owner Information

REMOTE ACCESS GROUP, INC.
2100 NW 99TH TER
PEMBROKE PINES, FL 33024
FEI/EIN Number: 27-0183168
Document Number: P09000042170
====================================

[att=5]

I am not sure if this was the result of merchant account application approval and the name disparity between the website and the Inc. It is also possible that this Corp. and a merchant account under a sub FBN was part of a strategy to enable multiple merchant accounts under a holding Corp, or just the super stealth mode that the organized crime syndicate is now practicing in order to remain hidden from view.

Based on the first report today, it is apparent that they commenced fraud charging sometime in June. During the start up phase they will mimic a legit business by seasoning the merchant account, starting with a small flow of fraud charges. Then they increase the flow until they ramp up to full volume within a month or two.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 07 Aug 2009 19:19:18 EDT

MGD : Another card fraud laundering website uncovered:

OLMOSSOFT.COM AKA OLMOS SOFTWARE LLC 281-724-8673

Snapped 2009-08-07 19:15:29

»olmossoft.com

===============================

Name of Company : OLMOSSOFT.COM
Phone : (281) 724-8673
Email : support@olmossoft.com

==============================

[att=1]

The usual search engine blocking:

[att=2]

The cyber-mule and LLC have been traced to a residential address in SHAVANO PARK, TEXAS:


TEXAS DIVISION OF CORPORATIONS
.
32038970763
.
05/11/2009
.
OLMOS SOFTWARE LLC
.
106 LIMESTONE OAK,
SHAVANO PARK, 
TX, 78230

.

The fraud domain registration is identical to that of WRISOFT.NET AKA White Royal Indigo LLC 256-251-5229: »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto


 
ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: OLMOSSOFT.COM 
.
Registrant:
    KASSON ltd
    SCOT    KASSON        (s.kasson@mail15.com)
    1052 LOVELL AVE
    ROSEVILLE
    Minnesota,55113
    US
    Tel. +651.2304612
.
Creation Date: 06-Mar-2009  
Expiration Date: 06-Mar-2010
.
Domain servers in listed order:
    ns.masterhost.ru
    ns2.masterhost.ru
    ns1.masterhost.ru

.

Once again forum spammed starting around the end of April:

Snapped 2009-08-07 19:15:10

»www.google.com/search?hl=en&q=%2···oq=&aqi=

OLMOSSOFT.COM, WRISOFT.NET and the last dozen fraud websites were all forum spammed from an IP address on starnet.md in Chisinau, Moldova owned by

--------------------------------------
StarNet Internet Solutions Provider

Adresa: str. Maria Cebotari, 28, Chisinau, MD-2012

»www.starnet.md

--------------------------------------

OLMOSSOFT.COM AKA OLMOS SOFTWARE LLC 281-724-8673 was originally hosted in
the Ukraine, then moved to Russia:

IP Location: Ukraine Tov Data-xata
Resolve Host: webtex-1-a1.data-xata.net
IP Address: 91.197.128.251

Then moved to:

Server Type: Apache
IP Address: 90.156.153.48
IP Location - Moscow City - Moscow - Masterhost.ru
Is A Hosting And Technical Support Organization
Domain Status: Registered And Active Website


            Action  Pre-Action IP   Post-Action IP
 
2009-03-16    New       -none-      91.197.128.251
.  
2009-05-04   Change 91.197.128.251  90.156.153.48

.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 18:49:10 EDT

MGD :

said by jamaica :

Regarding E-RPM SOFT.COM and fraudulent charges,
...
..
However, in watching for it I noticed I was just charged $11.49 by someone named "E-RPM Soft Com." After googling it, I discovered pages of references to e-book fraud, so I called my credit card company and reported it immediately and cancelled my card.

said by Noemi from LA :

Today I checked my CC Account activity and I saw this on my account:

Collapse details for this transaction 07/16/2009 E-RPM SOFT COM Purchase $11.49
Transaction Date: 07/14/2009
Card Type: --
Transaction Type: Purchase
Merchant Description: E-RPM SOFT COM
Merchant Information: 336-7930285 NC

I only have my DirectTV automatically bill to my credit card and never use it for anything else...

Thank you for posting, I wrote a request on 800notes.com »800notes.com/Phone.aspx/1-336-793-0285 for fraud victims to list the line item charge. I needed to narrow down the location of the acquirer bank and merchant account to a specific state. All show that it is originating from North Carolina. I initially reviewed a list of all Corps/ LLCs formed in N.C. during the entire months of February and March of 2009. (The domain was registered in March). However, that search did not produce any relatively apparent match for this entity.

A complete search of the entire database only produces one possible related name that was formed in 2005: »www.secretary.state.nc.us/corpor···=7754394 I wont post the actual name, as further research is needed in order to establish if they are connected. it is not unusual for an existing LLC /Corp to be used, and the syndicate even promotes doing so. However in the above case the originator of the LLC has moved to CA.

There does not appear to be any other close possibilities, and this is a close fit. However, confirmation is needed since there is a possibility that E-RPMSOFT.COM 336-793-0285 could be a DBA / FBN.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 16:45:43 EDT

MGD :

said by Lizzotaj :

Here's an email I received in regards to one of these fraudulent job offers from Riddick-Design. I share it here in the hopes that someone else sees it and doesn't fall for it.
...
.

Thanks for posting Lizzotaj, if you check back in I would like to know how contact was made, and from where. Was the original contact made under a different name, since they refer to Riddick-Design as their "partner"?. I do not see any job postings that mention Riddick-Design, it appears well hidden and only shows in follow up conversations. Also, any email addresses that they send from, and where, how, and the name they used for the first contact would be very helpful.

A fresh audit of the hosting IP:

Server Type: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.7a PHP/4.4.8
IP Address: 69.80.200.112
IP Location - California - San Jose - Deep Technology

now shows that besides the known Riddick-design.com and Redline-webdesign.com there is also Recruit-center.org

Snapped 2009-08-03 16:45:32

»www.recruit-center.org/

"Every 8 Minutes RECRUIT CENTER Recruits Another New Hire"

I do not doubt that, but the victims certainly do not find your site first:

Snapped 2009-08-03 16:45:17

»www.recruit-center.org/robots.txt

Though privacy cloaked since two days after it was registered:


Whois Record
Domain ID:D154918033-LROR
Domain Name:RECRUIT-CENTER.ORG
Created On:17-Dec-2008 00:45:13 UTC
Last Updated On:22-Jul-2009 10:06:00 UTC
Expiration Date:17-Dec-2009 00:45:13 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Registrant ID:c0a986865626886b
Registrant Name:Whois  Agent
Registrant Organization:
Whois Privacy Protection Service, Inc.
Registrant Street1:PMB 368, 14150 NE 20th St - F1
Registrant Street2:
Registrant Street3:
Registrant City:Bellevue
Registrant State/Province:WA
Registrant Postal Code:98007
Registrant Country:US
Registrant Phone:+1.4252740657
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:

.
The first 48 hours showed a suspended DNS and this:


Domain ID:D154883868-LROR
Domain Name:RECRUIT-CENTER.ORG
Created On:11-Dec-2008 21:50:02 UTC
Last Updated On:11-Dec-2008 23:36:13 UTC
Expiration Date:11-Dec-2009 21:50:02 UTC
Sponsoring Registrar:Wild West Domains, Inc. (R120-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:GODA-056815196
Registrant Name:Alicia Blair
Registrant Street1:105 Lagoon Ave
Registrant Street2:
Registrant Street3:
Registrant City:Melbourne
Registrant State/Province:Florida
Registrant Postal Code:32901
Registrant Country:US
Registrant Phone:+1.3862591186
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: ssmail445@gmail.com
.
Name Server:NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Name Server:NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM

I am not sure what that meant originally.

SCAM JOB FRAUD = Recruit-center.org = FRAUD JOB SCAM

SCAM JOB FRAUD = Redline-webdesign.com = FRAUD JOB SCAM

SCAM JOB FRAUD = Riddick-design.com = FRAUD JOB SCAM

Any info from anyone about how initial contact is made, and the names and email addresses that are used.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 13:22:00 EDT

MGD :

said by MGD :

...
..
Currently the record holder for still active longest surviving fraud operation is EBSEBOOKS.COM AKA Electronic Business Resources 412-927-0410 »ebsebooks.com

Snapped 2009-07-08 13:31:59

»ebsebooks.com

Snapped 2009-07-08 13:31:41

»ebsebooks.com/contacts.php

Snapped 2009-07-08 13:31:23

»ebsebooks.com/robots.txt

They were listed as actively processing fraud charges in the very first post of this thread on 12/14/2007 and they are still processing fraud charges.
..

Based on the results of a recent audit the above information is incorrect. Though EBSEBOOKS.COM AKA Electronic Business Resources 412-927-0410 has been exclusively processing fraud laundering charges since 2007, and still is, it is not the longest still active fraud operation.

The record holder by far KCSOFTLLC was removed from the still active list in December of 2008, as that was when the merchant account was believed to have been revoked. I am not sure if that information was correct, and they subsequently obtained another merchant account, however, an audit has revealed that they have continued to process fraud charges. The last report was a month ago at the end of June.

Samples of June 2009 :

quote:
Janet
Jun 28th, 2009 at 12:46 pm

I just got hit!!! June 28, 2009! I cannot believe these people! There is a charge on my debit card for $9.99. I am so glad that I found this website. How can they operate like this with impunity!!! I just cancelled my accounts! This is such a hassle and all because some *******!!!

=========================================

Victim1234
Jun 16th, 2009 at 2:48 pm

I was just victimized by KCSOFTLLC last week. They have been doing this for 4 years now based on reviews above. Give me a break. This has wasted hours of my time to have accounts and pay online bills changed. I am sick that our government has done a single thing about this for 4 years. It even makes me sicker that the banks just go along here and charge us fees to issue new cards and numbers.

I think the banks are invloved in this too.

=============================================

Kris
Jun 11th, 2009 at 4:15 am

I seemed to remember clicking on an ad for some type of amazing lightbulb that lasted “forever” or something shortly before noticing the charge on my credit card… It was quite a while ago, and I don’t remember if I filled out any personal information before getting off the link… Does anyone else remember doing this?

I hope that the Obama administration establishes some kind of task force to go after these scammers and starts to make “examples” out of these guys, because up til now, it seems they can carry out this scam indefinitely without any repercussions for them. At least four years now and counting and they STILL haven’t shut them down…

I wrote to my state senators here in Alabama and got back a nice and polite (but totally USELESS) reply from Jeff Sessions and Robert Shelby telling me basically that there was NOTHING they could do about it. I also wrote to the US Attorney General who I believe referred me to the Secret Service. I faxed a whole bunch of information to them and apparently they probably just threw the stack of papers I sent them in the trash…. ho hum…

=============================================

customer
Jun 10th, 2009 at 11:09 pm

I just told B of A my kcsoftllc.com charge. So any idea on how these companies get your number in the first place?

=============================================

Tim
Jun 10th, 2009 at 5:24 pm

In doing my taxes for ‘08 (sorry), I just noticed a repeat charge for $9.95 from the scamsters kcsoftllc.com - the first one occurred last year and reversed last June, Called B of A and the first agent said that since the charge was more than 60 days old, they couldn’t do anything about it. They transferred me to another agent who ‘made me happy’ by agreeing to reverse the charge. I noted to her that B of A is aware of these guys (see Mar 17 post here). I have a new cc# now (as of 1/09), and haven’t noticed any other kcsoftllc.com charges, but the year is young.

The above are all from one blog which has a chronological list exclusively of KCSOFTLLC fraud charges from the end of June 2009 back to the original fraud charge posted by the author on June 11th, 2005. »vaguelyaware.com/2005/06/11/chec···d-bills/

My records show that the first reported fraud charge that I picked up was from almost a year before that first one, all the way back to July of 2004. That is a 5 year, yes, FIVE YEAR run of a single entity of the OCS.

quote:
Report: Devbill Hosting Kcsoftllc

Devbill Hosting Kcsoftllc
Phone: 509-461-1556
Fax: 590-461-1556
www.kcsoftllc.com

Submitted: 7/26/2004 5:48:47 AM

I just recently receive a charge on my credit card for $9.95 and when researching the charge I found that KCSOFTLLC was responsible. So when I was filling out their form to report an unauthorized charge I found that they had a bogus security certificate provided by the bogus devbill hosting company. Now I found this website and am reporting them so hopefull this won't happen to anyone else in the future. I have no idea how they retrieved my credit card information, but one common link I have seen with devbill is paypal. I hope that paypal is not the leak because it is a highly dependable website.

Dave
Cumberland, Maryland
U.S.A.

Ref:»www.ripoffreport.com/reports/0/1···0521.htm

In fact Ripoffreport.com alone has two pages of KCSOFTLLC fraud reports:
»www.ripoffreport.com/searchresul···&start=0 This shatters a few records for the organized crime syndicate.

Obviously the highest award for cyber-mule extraordinaire, with a half decade of service, goes to:

=============================
Andrey
Mar 8th, 2009 at 10:38 pm

Visa card-National City bank. Today is March 08 2009

Got the same charge.
03/09/2009 VISA CHECKCARD DB-POINT OF SALE
KCSOFTLLC COM ROCHESTER NY Debit $9.95
==============================

In this case, at least one of the line item charges makes it not exactly rocket science to track down. If this was one acquirer bank for the entire 5 years, it would mean that they missed trigger criteria to file SARs (Suspicious Activity Reports) close to 120 consecutive times over the period, assuming two foreign wires a month of the fraud proceeds. I suspect though that multiple merchant accounts were used over the period, as the line item format changed several times.

On the cyber-mule awards podium, Ms. Constanza would be flanked on the lower left in 2nd by the Scottsdale, Arizona husband and wife team, of Steve Rogan & Carol Richey for the most websites record. I believe it was eight of the orange web templates, in a litle over twelve months. On the right in third position, holding the "dumbest cyber-mule" award would be Mike Allision, League City, Texas., of "globus / photo" fame. After a forty five minute phone conversation detailing the fraud operation, followed by email documentation, he ceased all communication, with a last sentence being "This is not a fraud, I even plan on expanding and adding more websites. In fact I am hiring employees to help, this is too much for one person to do"

KCSOFTLLC has been operating for do long that its original website was from version 2.0:

[att=1]

That domain has long ago disappeared, the original domain registration even has the devbill.com name servers aka "Developer Billing", which was common to an entire run of the fraud sites.


Registrar:  ENOM, INC. 
.
Registration Service Provided By: Registerfly.com
Contact: support@registerflysupport.com
.	
Domain name: kcsoftllc.com
.
   RegisterFly.com - Ref# 10639240
   Whois Protection Service - ProtectFly.com 
(10639240.fly@spamfly.com)
   +1.2122952121
   Fax: +1.2122952153
   230 Park Avenue
   Suite 864
   New York, NY 10169
   US
.
Status: Active
.
Name Servers:
   ns1.devbill.com
   ns2.devbill.com
.   
Creation date: 31 Mar 2004 16:31:55
Expiration date: 31 Mar 2005 16:31:55

As you can see from this DSLR search link: »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto Doctor Olds was hit with fraud charges circa 2005 from both KCSOFTLLC and "DIGITAL AGE" Cyprus. It was at that time that the process of correlating all of the cross charging of the same cards, began to reveal that this was a massive layered operation under a central command and control. Even though there was a wide range of themes and designs, they were all hitting the same card data. In fact it was KCSOFTLLC that linked a new apparently unrelated themed Globus / Photo group to the same organization:

quote:
Stockphotoportal.com And Kcsoftllc.com

These were transactions from the web on my wifes debit without a pin# Internet

Submitted: 4/3/2008 12:37:28 PM

We first noticed an odd transaction pending on our bank account for under $10.00. I looked up the name (stockphotoportal.com) and noticed the domain name had been removed last year. Today I went to check again and there was a new one for under $10.00. This one (kcsoftllc.com) is live and still going and is the subject of many ripoff notices.

The bank is now investigating and crediting both transactions, killing the card as well. Hopefully both of them get a hard look eventually with so many complaints piling up. Watch out for those small transactions a week or so apart. I'm just glad we caught it before someone tried a larger transaction.

Jls
tulalip, Washington
U.S.A.

Ref: »www.ripoffreport.com/reports/0/3···3406.htm

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 11:11:21 EDT

MGD :

said by scoutmom :

Thank you so much for this information as it has been so valuable in the last day. I have a new website that I have not seen mentioned on here. They just charged my CC $4.81 for a screensaver. I have reported it as fraud to my bank. They go by the name of www.cheapestthemes.com
...
.

Hi scoutmom, and you are welcome.

This thread has over 870 posts and 44 pages, so it is hard to find some of them on here. Plus it only shows at the end of the second page of a Google search. Thanks to a tip from Whip cheapestthemes.com 904-352-1238 had a short entry back on 03/07/09 »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto However, I am glad that you brought it up again, because the mobile games / themes fraud sites are difficult to track to a specific state where the merchant account and cyber-mule are located. Did your line item charge by chance contain a two letter state abbreviation?.

I see they recently made the headlines on the Ocean City, Maryland, official police blog: »ocpdmdinfo.blogspot.com/2009/07/···est.html That's a sure sign that someone in the PD got hit with a fraud charge. $2.81, $4.81, and $6.81 are the 3 charges that they use.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 10:08:40 EDT

anon : Thank you so much for this information as it has been so valuable in the last day. I have a new website that I have not seen mentioned on here. They just charged my CC $4.81 for a screensaver. I have reported it as fraud to my bank. They go by the name of www.cheapestthemes.com
I did happen to find this info on the BBB-

Name: cheapestthemes.com
Phone: (510) 595-2002
Address: P O Box 99800

Emeryville, CA 94662
Principal: Cheryl Winston
Customer Contact: Cheryl Winston - (510) 595-2002
File Open Date: March 2009
TOB Classification: Internet Service Provider

Hopefully they can be stopped as well.
Thank you for all you do-
Ellen

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 03 Aug 2009 02:28:26 EDT

MGD :

said by music man :

I think you can probably add CFAMSOFT.com to the "failed" pile.

Same text, recent registration ( Directi! :uhh:)

Google has a cached copy but I can't get to the contact details

Great catch, that one is confirmed, but never made it to prime time.

CFAMSOFT.COM aka CFAM SOFTWARE LLC 201-467-5618

Caches taken 07/11/2009:

[att=1]

Name of Company : CFAMSOFT.COM
Phone :(201) 467-5618
Email : support@cfamsoft.com

[att=2]

Tracked cyber-mule to a Texas LLC CFAM SOFTWARE LLC registered on 03/20/2009 by a RAMON CASTRO


TEXAS DIVISION OF CORPORAATIONS
.
32039147502
.	
CFAM SOFTWARE LLC                                 	
2200 N YARBROUGH DR STE B181            	
EL PASO, TX 79925	
.	
801100951
.	
03 20 2009
.   	
RAMON CASTRO                                      	
2200 N. YARBROUGH, SUITE B181           	
EL PASO, TX 79925

.
Domain was registered on 04/01/09


ICANN Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: CFAMSOFT.COM 
.
Registrant:
    myron ltd.
    myron    harris        (myron.harris@mail15.com)
    7562 quail wood dr
    charlotte
    New York,28226
    US
    Tel. +980.7228125
.
Creation Date: 01-Apr-2009  
Expiration Date: 01-Apr-2010
.
Domain servers in listed order:
    slave.hostsila.net

.
The website now shows as suspended, but began hosting on:


Event Date Action Pre-Action IP Post-Action IP 
.
2009-04-06     New     -none-      91.197.129.16

.
IP Location: Ukraine Tov Data-xata
Resolve Host: webtex-1-a3.data-xata.net
IP Address: 91.197.129.16

Then moved to:


Event Date Action Pre-Action IP Post-Action IP 
.
2009-05-04    Change 91.197.129.16     62.149.18.63

.
IP Address: 62.149.18.63
IP Location - Kyyiv - Kiev - Hostpro Hosting

It is possible that the cyber-mule may have been alerted while attempting to obtain merchant account services. There is no forum spamming for the name and phone number. That indicates that it never got as far as a merchant account.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 24 Jul 2009 15:49:00 EDT

music man : Rzaruba is absolutely spot-on! Do not call E-RPMSoft. Do not give them the chance to credit your account and reduce their chargeback ratio. The only way is to report this as a fraud and get your CC company to get off their arses and actually do something about this scam.

MGD has been chronicling and documenting this fraud for years and still none of the CC companies ( and certainly not Authorize.con) have done a thing about it!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 24 Jul 2009 13:42:54 EDT

rzaruba : DO NOT call the dispute line.

It is a fraud and should be reported as such, and your card should be canceled and reissued

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 24 Jul 2009 13:05:33 EDT

anon : Today I checked my CC Account activity and I saw this on my account:

Collapse details for this transaction 07/16/2009 E-RPM SOFT COM Purchase $11.49
Transaction Date: 07/14/2009
Card Type: --
Transaction Type: Purchase
Merchant Description: E-RPM SOFT COM
Merchant Information: 336-7930285 NC

I only have my DirectTV automatically bill to my credit card and never use it for anything else...this is why I was quickly able to spot it. I did an online chat session with BofA on this and they suggested I call the vendor. Of course the vendor either 1. Will not answer the phone or 2. Will argue that I did make a purchase. I will simply call BofA's Dispute's line at: 1-866-266-0202.

This time it was $11.49...what will it be next time?!

Hope this doesn't happen to you!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 23 Jul 2009 16:21:20 EDT

jamaica : Regarding E-RPM SOFT.COM and fraudulent charges, please note that they are getting card numbers from click through ads for supposed work-from-home schemes, using Google Keywords and Blazing Words as business entities. I was reading what I thought was an online article with the Los Angeles Times about a person who was recently unemployed and got a job working from home keying in links for Google Ads...Please don't think I am an idiot. I am usually pretty savvy about such things, especially work-from-home schemes, but this sounded very credible.

The claims were not overly extravagant, and they were offering to send a "How to get started" booklet for just the cost of shipping-$1.99. Well, I clicked on it and agreed, and a few days later I saw a charge for Blazing Words on my card for $1.99 and another for $15.95. A few days after that there was what was listed as a monthly subscription to a similar service (I don't remember the name) and it was for $74.95. If I hadn't caught this, I would have been charged that $75 every month till I noticed it!

I did call the company and pleaded insanity over not noticing any such fine print, and they claim to have reversed the charges--although they still hasn't shown up. However, in watching for it I noticed I was just charged $11.49 by someone named "E-RPM Soft Com." After googling it, I discovered pages of references to e-book fraud, so I called my credit card company and reported it immediately and cancelled my card. Most of the references reported multiple charges after the initial fraud, so I didn't waste any more time.

So please note, they seem to have expanded into a new area, and they are using working for Google to make it seem legitimate. I hope this helps someone--I am still watching and waiting for the repercussions. (By the way, don't cancel your card BEFORE you print out the online statement with all the charges and identities. Once you do, they pull the card information off the website--now I have to go look for my hard copies of statements! Ugh!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 14 Jul 2009 15:18:19 EDT

anon : Here's an email I received in regards to one of these fraudulent job offers from Riddick-Design. I share it here in the hopes that someone else sees it and doesn't fall for it.

Thank you for your answer. I believe our cooperation will bring us a
lot of positive experience. Please see below the detailed description
of the position of Assistant Director.

Our Swedish partner - Riddick-Design, is looking for a
candidate to the position of Assistant Director. They've applied to us
to find the proper person for this position according to their
requirements.

Riddick-Design provides their customers with wide variety of design
services for many years already and has a great experience in this
sphere. Recently, the management of the company has decided to enter
the US market, and for this purpose they need an associated business
unit in US. This decision was also caused by the difficulties existing
for European companies who wish to sell products and services to US
customers as well as by intention to avoid heavy domestic taxes (as
you might know, Swedish taxation is probably one of the heaviest in
the world).

Riddick-Design's engineers will create a Web-store for US company to
sell their original products online. They will promote this Web-store
and provide it with hosting, development and support. To accept
payments online, it will be necessary to have a merchant account.
Unfortunately it is impossible for European company, which has a
merchant account in European bank, to accept payments online from US
customers (basically, it is possible, but with a lot of limitations
that make it impossible). So the Assistant Director, as a company
representative, will need to open a merchant account in US. True
Design Art will provide you with all necessary information and
instructions.

The primary duties of Assistant Director are:

a. Business bank account and Merchant account maintaining and
monitoring;
b. Handling business correspondence and transmitting it to
Riddick-Design by fax or by mail (all expenses are reimbursed).
c. Being in touch with Riddick-Design's representative by e-mail and
accurately following his/her instructions.

First of all you'll need to register the LLC in your Secretary of
State or at »instacorp.com. (Feel free to ask for my help with
this question at any time). Your company will operate as an on-line
store and will sell a digital content for PC provided by
Riddick-Design. Also Riddick-Design will be responsible
for customers and technical support. You will be responsible only
for performing the duties above.

Riddick-Design's requirements:

1. A punctuality, clear background.
2. Deep desire to achieve financial success.
3. Computer / Internet / e-mail skills.
4. Internet and e-mail access.
5. US citizenship or Green Card.

Your commission will be 5% from the store revenues (you'll earn about
2,500-3,000$ per month). Also all bank and merchant fees will be paid
by the parent company. You will get your 5% in any case not depending
what fees we will have. Your income will increase along with business
boost. You will be responsible to pay taxes only on your commission;
the rest taxable 95% is a responsibility of the parent company.

Let me sum up all I said above about your duties briefly in few clear
steps:

1. You need to file a legal entity in your state (city) (it can be a
LLC or Sole Proprietorship). If you already have a company, it's
great, it will save us some time. The cost of registering a small
business starts from $200, but it strongly depends on the State. The
time frame for a company set-up also differs from state to state and
normally the process of registration takes 2-10 business days. The
parent company will reimburse you for these start up expenses from the
first revenues your web-store produces.

2. After the LLC is registered you'll need to open a business checking
account in any bank in your area.

After that your personal manager will provide you with instructions on
how to open the merchant account for the store. Here ends the start up
process and your duties will be just to monitor the accounts and take
your regular commission.

As you can see, all steps are very easy.

Feel free to ask any questions you have and let me know your decision.
In case it is positive I'll send you an Agreement to sign that
welcomes you to the Riddick-Design successful team.

Best regards, Maria Olson
Gjorwellsgatan 28, 112 60 Stockholm, Sweden

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 11 Jul 2009 03:16:49 EDT

music man : I think you can probably add CFAMSOFT.com to the "failed" pile.

Same text, recent registration ( Directi! :uhh:)

Google has a cached copy but I can't get to the contact details

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 11 Jul 2009 03:08:38 EDT

music man : Not too sure about this one but it shares some of the same text as E-RPMSOFT.COM

Snapped 2009-07-11 03:06:02

»sibersoftllc.net/contactus.aspx

Recent domain registration

Registry Data

ICANN Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Created: 2009-04-16
Expires: 2010-04-16
Updated: 2009-04-16
Registrar Status: clientTransferProhibited
Name Server: NS1.OFFICELIVE.COM (has 649,658 domains)
Name Server: NS2.OFFICELIVE.COM (has 649,658 domains)
Whois Server: whois.melbourneit.com

Detroit cellphone number for contact

Information on phone number range +1 313 999XXXX

Number billable as mobile number
Country or destination United States
City or exchange location Detroit, MI
Original network provider* Nextel Communications, Inc.

No contact address

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 09 Jul 2009 13:12:31 EDT

moike :

said by MGD :

I personally went through an unbelievable nightmare with PNC Bank trying to close one down. Believe it or not, a cyber-mule whom I had contacted and sent them to the bank to immediately stop an outbound foreign wire transfer of the fraud proceeds, called me from the bank and said that they would not allow them to shut their own account down. Flabbergasted I asked for an explanation, the mule said that they informed the bank rep as to why they wanted to freeze everything based on the fact that I had just contacted them and revealed the true nature of the operation. A security executive at the PNC bank HQ in Pittsburgh, reviewed the account charge backs to date, and informed the cyber-mule that they were probably being fed a ruse story by a competitor.

Unbelievable - one down, but I wonder how many other security officers have this level of understanding?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 23:21:50 EDT

MeanPeepsSuk :

said by MGD :

said by K Patterson :

OK, which one of you guys set fire to the Authorize.net data center?

LOL!!

»Credit Card Processing Company Authorize.net Knocked Offline

Gateway down for over 13 hours, that is probably the longest break in the last decade that consumers have gone without having organized fraud charges processed against their card data. No doubt sections of eastern Europe were in crisis mode for several hours. If it went on any longer the GDP projections of some areas would need to be revised.

MGD

ROFL!!!

No sh*t.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 22:16:31 EDT

Fraud PI : MGD, I am a retired federal agent newly working for a merchant services company. I am interested in learning more and am seeking someone at the federal level interested in prosecuting these cases. (Most agents find them way to complex and therefore aren't interested.) I sent you an instant message with my contact information. Would love to talk to you.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 19:27:31 EDT

Doctor Olds : Thanks for the detailed clarification MGD I now understand where my confusion was. I had assumed wrongly that vetting was cut/dried process that always stopped fraud sites when it is a process depending on the individual companies vetting/checking criteria instead which may have holes in their process large enough to drive a Mack truck through. :[
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 15:58:22 EDT

garys_2k : Well, I just rechecked htfcreative.com and it's still not showing up as a fraud in FF. I included a blurb about it not being a phishing site, but a fraudulent card processing site with a link to this thread, but so far nothing.

I wonder if we could get in touch with a real person in the Firefox organization that could help to get those pages in asap.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 14:59:36 EDT

MGD :

said by Doctor Olds :

said by garys_2k :

Assuming the bank's already vetted them (a certainty once fraud charges start to hit)

The vetting or approval process of the cyber-mule's application for a merchant account, includes the underwriter reviewing the website that is listed on the application for which the merchant account will be used for. In that review process the underwriter may check that the shopping cart has SSL encryption, and that there is a refund and privacy policy stated:

quote:
Notes re [EffectiveSoft Ltd AKA effectivesoft.com]

From: Marek Shulcovicz shulcovicz2002@gmail.com
Sent: Thursday, February XX, 20XX XX:XX PM
To: REDACTED

Subject: Re: Another Questtion

Hello REDACTED,

You must receive the merchant account at the same bank that you opened the company's account at.

For example:

• Bank of America
• Citizens Bank
• Wachovia Bank
• Wells Fargo Bank
• Washington Mutual Bank

We recommend the Wachovia, as the most convenient and reliable bank. As soon as you have received the merchant account, you can proceed with the registration of Authorize.Net, which is the payment gateway – it will allow your website and merchant account to interact and serve as the platform for accepting payments made with credit cards.

Q: What is the phone number for your customer support?
(it is necessary to indicate when you register a Merchant account in a bank, and also an account in Authorize.net.

(660)-6XX-XXXX

(660)-6XX-XXXX

P.S.
I have forgotten to mention that the company Vonage, our partners in the field of telecommunications, which provides us with phone numbers for the support service, has sent you a Phone Adapter – it is an option that comes with their packet of service. You will not need it in your future work, so this Phone Adapter can be simply put aside, as you will not be using it for work. As I said, it is just a free option included in the service packet of our partners, the company Vonage.

Best Regards,
Marek

During the vetting / approval process Wachovia noted that there was no encryption on the website, and held up the account until a cert was installed.

quote:
From: XXXX Wachovia
Sent: REDACTED
To: REDACTED

Subject: FW: 801XXXXXXX

FYI- Please read below. Secure checkout page all that is needed.

Thanks,

REDACTED

What Wachovia, the merchant account underwriter, and the cyber-mule , did not know, was that they and the criminals were the only ones that knew that website existed. The website was essentially hidden from everyone else, and that is how the crime syndicate intended it to be. Later fraud victims may find it, which is why they always have a phone number and a contact support@ listed. Once the account is approved and up and running, there is nothing that will stop it, other than excessive charge backs. However, that can be a gradual process that includes alert warnings. the crime syndicate will attempt to overcome those initial warnings by flooding the account with fresh charges in order to dilute the current ratio of charge backs. Remember it can over 30 days from the time a charge is processed for a victim to report it. The criminals intend for any victim who does catch it to contact them first so that they can issue a refund, thus avoiding the charge back.

Many of the card fraud laundering accounts may take considerable time to exceed the charge back thresh hold, if at all. The SOP for a victim who contacts their bank and just questions the charge, is to be told to first contact the vendor. That drives many of them straight to the crime syndicate and allows a credit to be issued.

Currently the record holder for still active longest surviving fraud operation is EBSEBOOKS.COM AKA Electronic Business Resources 412-927-0410 »ebsebooks.com

Snapped 2009-07-08 13:31:59

»ebsebooks.com

Snapped 2009-07-08 13:31:41

»ebsebooks.com/contacts.php

Snapped 2009-07-08 13:31:23

»ebsebooks.com/robots.txt

They were listed as actively processing fraud charges in the very first post of this thread on 12/14/2007 and they are still processing fraud charges. The cyber-mule was later identified as Terra Milbourne:

Note the February 2006 date, which makes this almost two and a half years old. I believe the first reported fraud charge from a victim was in December of 2007: »800notes.com/Phone.aspx/1-412-927-0410 and has continued, with the most recent one being a few days ago:

quote:
Nan - 3 Jul 2009

A $4.95 charge was posted to my 03/2009 acct. and now it's impossible to make the credit card people understand.

Caller ID: 4129270410
Caller: Elec.Bus. Resolutions

»whocallsme.com/Phone-Number.aspx···270410/4

Depending on the bank where the fraudulent business account was opened at, it can be near impossible to have it shut down if the charge back ratios are within spec. CitiBank refused to close a fraud processing account down that was way over a year old, until industry insiders put pressure on them.

I personally went through an unbelievable nightmare with PNC Bank trying to close one down. Believe it or not, a cyber-mule whom I had contacted and sent them to the bank to immediately stop an outbound foreign wire transfer of the fraud proceeds, called me from the bank and said that they would not allow them to shut their own account down. Flabbergasted I asked for an explanation, the mule said that they informed the bank rep as to why they wanted to freeze everything based on the fact that I had just contacted them and revealed the true nature of the operation. A security executive at the PNC bank HQ in Pittsburgh, reviewed the account charge backs to date, and informed the cyber-mule that they were probably being fed a ruse story by a competitor. Not being amused by the ignorance of the bank fraud security official I tracked him down and immediately called him.

A very frustrating conversation followed which revealed the complete lack of cyber awareness of at least some bank security officials. Explaining the fact that the site could not have any customers as it was hidden, and leading him to the robots.txt file, was way above his understanding level. Showed him that the domain was registered to someone other than the cyber-mule in another state, who they did not even know was explained off by him that many start ups do not manage their own websites. Proceeded to give him a lesson on domain registration, showing him that the "registrant" is the domain name owner, and should match the business and merchant account. If the website was being managed by a professional, then that info would be appropriately listed under the "Administrative Contact" data. However the legal domain owner needed to be the same as the merchant account, and was not. Then proceeded to tell him that he could pull as many charge records randomly from the to date billing as he wanted, contact the card holders, and no one would have made a purchase at the site.

Again, reiterated that every single charge processed though that account was fraudulent. He said that the website may be factor billing for other entities. That was not possible since factored billing is prohibited under most TOS, and besides these fraud operations are completely documented. The conversation ended with telling him to look at the overall behavior of that business account at his bank. It generated all of its proceeds from credit card billing of intangible purchases on a website that had no search hit returns. All of the proceeds less 10% were then wired out of the country from the bank to locations that rank high on the list of money laundering conduits. If he checked the federal regulations for financial institutions SAR reporting requirements, he would find several criteria that fit this operation. Luckily PNC routed the merchant processing account through Firstdata.com, and a follow call to firstdata resulted in the merchant account being immediately frozen at their end, which started the rest of the ball rolling.

Even though they have a posted "Terms of Service", don't expect any vetting to come from Authorize.net / cybersource. Vetting appears to be a word that is missing from their vocabulary, though they need to make sure that they add "malfeasance" in there. If the merchant account applicant has a business bank account and pays the fee, authnet will give them the keys to the card processing highway. That toll booth is just a formality.

garys_2k 's idea of reporting active websites as fraud may be beneficial:

said by garys_2k :

I just submitted those last two sites to Firefox for inclusion in their fraud alert system, but I wonder if that does any good at all. Assuming their main reasons to exist are to give an appearance of legitimacy to anyone seeing if they should issue a merchant account, and for fraud victims to see who they should complain to, the usefulness of the fraud list is questionable.

Assuming the bank's already vetted them (a certainty once fraud charges start to hit) then they won't get to see an alert. Victims going there may get some benefit, to at least know they should look further.
....
.

If they are in operation, and they show up on a fraud alert when searched or visited, that could trigger an alert to institutions / underwriters who are checking based on several fraud complaints which have yet to qualify as excessive charge backs.

Some institutions have already put procedures in place to filter and catch these fraud merchant processing accounts, and that is having a noticeable effect. Though I do not know the specific reasons, I see several set ups that only survive for no more than a few weeks, if even that.

For example:

SICREATIVE.NET 720-897-7619 only lasted for ~ 7 weeks »www.google.com/search?hl=en&q=%2···oq=&aqi=

The card fraud laundering site was hosted on IP 93.174.92.114 from ~ 02/16/09 until ~ 04/20/09

-------------------------------
IP Location: Netherlands Amsterdam As29073 Ecatel Ltd
IP Address: 93.174.92.114
Blacklist Status: Clear
-------------------------------


ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
.
Domain Name: SICREATIVE.NET 
.
Registrant:
    weblink llc
    Carlos Morris        (cm0328@gmail.com)
    3022 K Street SE
    Washington
    Washington,20019
    US
    Tel. +202.4373922
.
Creation Date: 06-Feb-2009  
Expiration Date: 06-Feb-2010
.
Domain servers in listed order:
    ns2.sicreative.net
    ns1.sicreative.net

.

SICREATIVE.NET never made it to "prime time", as its assigned contact phone number 720-897-7619 was also used by:

SYNVIAWEB.COM AKA SYNIVA INVESTMENT CO. 720-897-7619

-------------------------
Server Type: Apache/2
IP Address: 93.174.92.114 IP Location - Noord-holland - Amsterdam - As29073 Ecatel Ltd
Response Code: 200
Domain Status: Registered And Active Website
-------------------------

The website is not active, but it moved to that current location ~ 02/16/09

-------------------------


Event Date   Action    Pre-Action IP    Post-Action IP 
2009-02-02    New       -none-          216.120.237.8  
2009-02-16 Change   216.120.237.8   93.174.92.114

-------------------------

It was also forum spammed: »www.google.com/search?hl=en&q=%2···B.COM%22


Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
.
Domain Name: SYNVIAWEB.COM 
.
Registrant:
    Nic Company LLC
    Nic    Stamoulis        (nic.stamoulis@mail333.com)
    2719 E. 2nd St.
    Long Beach
    California,90803
    US
    Tel. +818.3249089
.
Creation Date: 24-Jan-2009  
Expiration Date: 24-Jan-2010
.
Domain servers in listed order:
    ns1.synviaweb.com
    ns2.synviaweb.com

.

Another failure was:

KOOLBD.COM 530-554-2980

»www.google.com/search?hl=en&q=%2···oq=&aqi=

Ran from around 03/16 to ~ 05/18 on:

-------------------------
IP Location: Ukraine Kiev Volia Dc
Resolve Host: 148.220.144.82.colo.static.dc.volia.com
IP Address: 82.144.220.148
-------------------------

ICANN Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM
.
Registration Service Provided By:
HIGH QUALITY HOST COMPANY
.
Domain Name: KOOLBD.COM
.
Registrant:
Nichol ltd
Thomas Nichol (t.nichol@mail333.com)
122 E. McNair Hall
Houghton
Michigan,49931
US
Tel. +906.4836212
.
Creation Date: 06-Mar-2009
Expiration Date: 06-Mar-2010
.
Domain servers in listed order:
ns2.koolbd.com
ns1.koolbd.com

.
The failure rate at start up has grown significantly

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 08 Jul 2009 02:16:15 EDT

Doctor Olds :

said by garys_2k :

Assuming the bank's already vetted them (a certainty once fraud charges start to hit)

I'm confused, I thought vetting is where they stop fraudulent sites from getting a Merchant Account in the first place, yet you make it sound the opposite as no charges are processed on vetted applications from my understanding.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 07 Jul 2009 20:38:18 EDT

garys_2k : I just submitted those last two sites to Firefox for inclusion in their fraud alert system, but I wonder if that does any good at all. Assuming their main reasons to exist are to give an appearance of legitimacy to anyone seeing if they should issue a merchant account, and for fraud victims to see who they should complain to, the usefulness of the fraud list is questionable.

Assuming the bank's already vetted them (a certainty once fraud charges start to hit) then they won't get to see an alert. Victims going there may get some benefit, to at least know they should look further.

Anyway, thanks again, MGD! Amazing work.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 07 Jul 2009 17:48:05 EDT

MGD : Another new themed card fraud laundering website design from the organized crime syndicate:

RAGDESIGN.COM 206-666-4778 »ragdesign.com

[att=1]

------------------
RAGDESIGN.COM
ragdesign.com
1-(206)-666-4778
support@ragdesign.com
---------------------

[att=2]

Hosted:

IP Address: 205.178.145.65
IP Location - Virginia - Herndon - Network Solutions Llc
Response Code: 200
Domain Status: Registered And Active Website

Search engine archive blocking:

[Att=3]

Again, Multiple Forum spamming from Chisinau, Moldova:

[Att=4]

Many posts within the past week:

[att=8]


ICANN Registrar:  ACTIVE REGISTRAR, INC. 
.
Registration Service Provided By: Active-Domain LLC
.
Domain Name: ragdesign.com
Expiry Date: 25-May-2010
Creation Date: 25-May-2009
.
Name servers:
ns41.worldnic.com
ns42.worldnic.com
.
Registrant Name: kazuko fuller
Registrant Company: ragdesign.com
Registrant Email Address: robyn_wise47@yahoo.com
Registrant Address: 1705 stilton arch
Registrant City: chesapeake
Registrant State/Region/Province: VA
Registrant Postal Code: 23323
Registrant Country: US
Registrant Tel No: +1.9289625224
Registrant Fax No:

.
It is possible that the cyber-mule is named Robyn Wise
.
==============================================

HTFCREATIVE.COM 206-338-2535 »htfcreative.com

[Att=5]

------------------
HTFCREATIVE.COM
htfcreative.com
1-(206)-338-2535
support@htfcreative.com
------------------

[Att=9]

Registered and hosted via GoDaddy:

IP Address: 72.167.232.34
IP Location - Arizona - Scottsdale - Godaddy.com Inc
Response Code: 200
Domain Status: Registered And Active Website

Search engine archive blocking:

[Att=6]

Group forum spamming from Chisinau, Moldova:

[Att=7]

Same domain reg as HTFCREATIVE.COM, different email address:


ICANN Registrar:  GODADDY.COM, INC. 
.
Registrant:
   kazuko fuller
   1705 stilton arch
   chesapeake, Virginia 23323
   United States
.
   Domain Name: HTFCREATIVE.COM
      Created on: 25-May-09
      Expires on: 25-May-10
      Last Updated on: 25-May-09
.
   Administrative Contact:
      fuller, kazuko  kazuko_fuller@yahoo.com
      1705 stilton arch
      chesapeake, Virginia 23323
      United States
      9289625224      Fax -- 9289625224
.
   Domain servers in listed order:
      NS35.DOMAINCONTROL.COM
      NS36.DOMAINCONTROL.COM

.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 06 Jul 2009 18:30:55 EDT

MGD : A new card fraud laundering site in the malware AV theme:

E-RPMSOFT.COM 336-793-0285 »e-rpmsoft.com

Snapped 2009-07-06 17:49:45

»e-rpmsoft.com

-----------------------------------
Name of Company : E-RPMSOFT.COM
Phone : (336) 793-0285
Email : support@e-rpmsoft.com
----------------------------------

[Att=1]

Already processing fraud charges as the above voip number forwards to a human answering service.

Forum link spamming:

Snapped 2009-07-06 17:49:26

»www.google.com/search?hl=en&q=33···oq=&aqi=

Active "Deny All" robots file blocking any search archiving.

[att=2]

Some interesting behavior while the operation was being shadowed. Initially the fraud site E-RPMSOFT.COM was hosted on a HOSTNOC.NET US IP 64.191.33.70 leased to ZLATHOST.RU:

-------------------------------
Server Type: nginx/0.6.36
IP Address: 64.191.33.70
IP Location - Pennsylvania - Scranton - Network Operations Center Inc
SSL Cert: zlathost.net.ru expires in 31 days.
-------------------------------

At that time, the domain was registered as followed:


ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD.
 D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: HIGH QUALITY HOST COMPANY
.
Domain Name: E-RPMSOFT.COM 
.
Registrant:
    Bausemer ltd.
    Stephen Bausemer  (st.baus@gmail.com)
    17145 North Bay Rd Apt 4405
    Sunny Isles
    Florida,33160
    US
    Tel. +786.2741710
.
Creation Date: 18-Mar-2009  
Expiration Date: 18-Mar-2010
.
Domain servers in listed order:
    ns2.serverside.name
    ns1.serverside.name

The domain now shows as suspended, with a different registration, possibly originally carded, though I am not sure:


Domain Name: E-RPMSOFT.COM 
.
Registrant:
    E-RPMSOFT DOT COM
    Ivan Burkin        (st.baus@gmail.com)
    Krasnobogatirskaya street 79-65
    Moscow
    Moskovskaya oblast,107076
    RU
    Tel. +336.7930285
.
Creation Date: 18-Mar-2009  
Expiration Date: 18-Mar-2010
.
Domain servers in listed order:
    ns2.serverside.name
    ns1.serverside.name
.
Status:SUSPENDED
        Note: This Domain Name is Suspended. 
        In this status the domain name is InActive and will not function.

.
However the website is still reachable, now on IP 84.16.228.146:

Domain Name: E-RPMSOFT.COM
-------------------------------
Server Type: nginx/0.6.35
IP Address: 84.16.228.146
IP Location - Berlin - Berlin - Netdirekt E.k
Domain Status: On-hold (generic)
-------------------------------

Also, the manual link spamming for many of the card fraud websites has been originating from an IP address from Chisinau the capital city of the republic of MOLDOVA a former Soviet Bloc state that lies between the Ukraine and Romania.

[att=3]

It is also clear that the forum link spammer has additional information that is not listed on the fraud websites. Over a half dozen of the fraud websites have been spammed from Chisinau in Moldova.

E-RPMSOFT.COM is a clone of the not ready for prime time, and now defunct, MRBSOFT.COM previously listed in this 04/28/2009 post

Snapped 2009-04-28 04:44:18

»mrbsoft.com/contact.html

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 06 Jul 2009 03:02:05 EDT

MGD : The organized crime syndicate has now moved the entire card fraud laundering operation into stealth mode. They have changed their prior strategies, and altered all of their procedures which they believe enabled their operation to be repeatedly exposed. The goal of course is to melt the operation back into complete anonymity. Allow it to continue as originally designed, which was to extract millions of dollars a year from consumers by exploiting flaws in the financial system, and to do so without anyone discovering and exposing the massive fraud operation.

The fraud laundering websites are now individually dispersed on unique hosts. All are using the robots.txt file to block any form of archiving. No one but the crime syndicate, the recruited duped cyber-mules, and the merchant account underwriters are aware that they exist. The last two have no idea that they are viewing and approving a website, and related support services which no one else knows exists. All of that combined with the routine link spamming, intended to bury any reported fraud charge completes the new stealth function. The syndicate has also greatly increased the number of active design themes. Unless new methods of discovery are devised, the massive card fraud and laundering operation will now fade back into pre 2006 obscurity.

A recent uncovery confirms taht the crayon group is still active:

PJSTEMPLATES.COM 843-376-4826

Snapped 2009-07-06 02:55:00

»pjstemplates.com

Company name: PJSTEMPLATES.COM
Phone Number: (843)-376-4826
Email: support@pjstemplates.com

[Att=1]

Includes a "deny all" robots file:

Snapped 2009-07-06 02:54:45

»pjstemplates.com/robots.txt

Heavy manual link spamming on forums during April and May:

Snapped 2009-07-06 02:54:25

»www.google.com/search?q=pjstempl···=20&sa=N

So far I have not been able to uncover any victim reports. The contact number 843-376-4826 does not have the usual cyber-mule recording with instructions. So it may be possible that this never made it past the seasoning process.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 06 Jul 2009 01:36:02 EDT

MGD : In a 04/28/09 post which exposed the large Crayon Group of card fraud laundering sites, included was the following:

IOSWEBSTORE.COM AKA Innovative On Line Solutions, LLC 240-249-0393

Snapped 2009-04-28 04:07:13

»IOSWEBSTORE.COM/index.php?show_aux_page=7

Even thought the syndicate link spammed this website heavily:

Snapped 2009-07-06 01:32:54

»www.google.com/search?hl=en&q=IN···oq=&aqi=

it went offline along with many of the others shortly afterwards. Subsequent digging failed to uncover any fraud charge reports, however, that work did eventually uncover the LLC and the cyber-mule behind it. Innovative On Line Solutions, LLC was registered in the state of Georgia on 1/7/2009.

[att=1]


GEORGIA DIVISION OF CORPORATIONS
.
--------------------------------------------
Business Name History
.
--------------------------------------------
. 
Name Name Type 
INNOVATIVE ON LINE SOLUTIONS LLC  Current Name 
.
--------------------------------------------
. 
Limited Liability Company - Domestic - Information
.  
Control No.: 09001199 
Status: Active/Compliance   
  
Entity Creation Date: 1/7/2009 
.  
Jurisdiction: GA 
Principal Office Address: 2916 Legislative Lane
Buford GA 30519  
Last Annual Registration Filed Date:  
Last Annual Registration Filed:  
.
--------------------------------------------
. 
Registered Agent
.  
Agent Name: Martin, Curtis  
.
Office Address: 
2916 Legislative Lane
Buford GA 30519  
Agent County: Hall 
--------------------------------------------

.
The domain registration was not previously listed either:


Domain Name: IOSWEBSTORE.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD.
 D/B/A PUBLICDOMAINREGISTRY.COM
.
Registration Service Provided By: HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: IOSWEBSTORE.COM 
.
Registrant:
    Shirlee Company LLC
    Shirlee    Kong        (shirlee.kong@pisem.net)
    1412 Butler Avenue 2
    Los Angeles
    California,90025
    US
    Tel. +310.5755242
.
Creation Date: 24-Jan-2009  
Expiration Date: 24-Jan-2010
.
Domain servers in listed order:
    ns2.ioswebstore.com
    ns1.ioswebstore.com

.
No that it should be a surprise or anything, but many of the domain contact email addresses are Russian language only webmails, such as the above: »www.pisem.net

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sat, 04 Jul 2009 00:07:03 EDT

MGD :

said by K Patterson :

OK, which one of you guys set fire to the Authorize.net data center?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Fri, 03 Jul 2009 15:06:51 EDT

K Patterson : OK, which one of you guys set fire to the Authorize.net data center?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 01 Jul 2009 04:33:28 EDT

MGD : eastcoastmobilestyle.biz 912-289-0124 which started in late 2008, has a cyber-mule in Georgia, and is still processing fraud charges, has now made it to the media in Switzerland. Désirée Pomper, a journalist from Zurich, Switzerland, wrote a recent article in 20min.ch about a Zurich resident who was hit with a fraud charge on their card from eastcoastmobilestyle:

Translated:
[att=1]

»www.20min.ch/finance/news/story/15667525
translated:
»translate.google.com/translate?h···6hl%3Den

Prior to this, there has been a fraud report from a UK victim, and also one in South America. »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 30 Jun 2009 16:33:24 EDT

MGD : As noted in the above post one of the latest fraud cyber-mule recruiting sites were QUETOYS.COM QUETOYS.NET, and QUETOYS.ORG As you can see from Google, Que Toys Ltd., was a derivative of the prior fraud recruiting Tetronix Toys Ltd.

[att=1]Que Toys Ltd - Tetronix Toys Ltd.

Also noted was the fact that the QUETOYS group was hosted on the Russian owned cesspool of cybercrime network of 3FN / Pricewert LLC / APS Telecom. That should not have been a surprise as the crime syndicate has a long relationship history with this genre, such as McColo, Atrivo, EST, etc. They do not use these cyber crime services exclusively, over the years they have based some of their operations at GoDaddy, Hostdone, Everyones Internet, Inc., JaguarPC.com / Landis Holdings Inc., etc.

They surprise this time around though was where QUETOYS.COM ended up being moved to 24 hours after the plug was pulled on 3FN. As you are aware, the FTC disconnected 3FN with no prior notice, the result of an "ExParte" court order, and was a well kept secret beforehand. Not only was the speed at which QUETOYS.COM resurfaced remarkable, but also the fact that it turned up on another US based IP, 66.225.241.14

QUETOYS.COM = 66.225.241.14


IP Address History
.
Event Date Action Pre-Action IP Post-Action IP 
.
2009-06-01 New      -none-        216.195.62.132  
2009-06-08 Change 216.195.62.132  66.225.241.14  
 
Name Server History
.
Event Date Action Pre-Action Server Post-Action Server
. 
2009-05-26 New         -none-        3fn.net  
2009-06-05 Transfer 3fn.net          Zevshost.net

.

IP 66.225.241.14 is owned by a Chicago based hosting company called HOSTFORWEB:

IP Address: 66.225.241.14
IP Location - Illinois - Chicago - Hostforweb Inc

Name Server: DNS1.ZEVSHOST.NET (has 232 domains)
Name Server: DNS2.ZEVSHOST.NET

Server Central Network SCN-2 (NET-66-225-192-0-1)
66.225.192.0 - 66.225.255.255
HostForWeb Inc. HOSTFORWEB-5 (NET-66-225-241-0-1)
66.225.241.0 - 66.225.241.255

OrgName: HostForWeb Inc.
OrgID: HOSTF-1
Address: PO BOX 1164
City: Chicago
StateProv: IL
PostalCode: 60690
Country: US

NetRange: 66.225.241.0 - 66.225.241.255
CIDR: 66.225.241.0/24
NetName: HOSTFORWEB-5
NetHandle: NET-66-225-241-0-1
Parent: NET-66-225-192-0-1
NetType: Reallocated
Comment:
RegDate: 2004-05-21
Updated: 2004-05-21

OrgTechHandle: ADMIN240-ARIN
OrgTechName: Administrator
OrgTechPhone: +1-312-343-4678
OrgTechEmail: alex.k[@]hostforweb.com

The president of Hostforweb is Alex Korneyev presumably of Russian heritage:

»www.google.com/search?hl=en&q=Al···oq=&aqi=

»www.google.com/search?hl=en&q=al···oq=&aqi=

[att=2] Hostforweb Corp

That in itself may not be remarkable, however, when you combine it with the fact that a group of the identical American Express card fraud laundering websites were also stashed on a Hostforweb IP it certainly rises to that level. While it may be just a remarkable co incidence, remember that as a hosting entity, hostforweb is a relatively small operation, though it does host many .ru domains. One has to also presume that due to the surprise shutdown of 3FN, and the subsequent prompt relocation of QUETOYS.COM to IP 66.225.241.14, that the syndicate had prior knowledge of Hostforweb's existence. It is doubtful that they discovered Hostforweb and managed to relocate there all within hours of the 3FN shutdown.

A HostforWeb IP 64.202.102.8 first came to attention back in early January of 2008 as the host of several of the American Express card fraud laundering domains related to: VALLJRSX, VALL-JRSX, VIN DESIGN, VIN-DESIGN, PARADISE WEB, PARADISEWEB, E NAT, VR-S.COM. These were all associated with the multi year Amex card fraud laundering operation that all have Russian ex patriate cyber-mules. The operation is concentrated in the Sacramento and surrounding counties in California.

Some examples:

quote:
Kevin:
Very interesting reading. I just noticed a charge of 9.45 on my AMEX from VIN Design. I did the research and ended up here. Strange thing about this- 2 months ago, I disputed a charge of 9.59 from an obscure mobile game developer in Sacramento (which is near Plumas Lake, CA). I did a lookup of the address and found the site vr-s.com. I don’t download games from 3rd party sites so I disputed the charge. When I looked at the most recent charge, and did an address lookup, I ran into an e-book site, ibookstfs.com. Lo and behold, the website copy of both ibookstfs.com and vr-s.com is identical. Compare the privacy policy- it’s boilerplate, as is the site design, logo placment, etc. The domain owner is someone named Vladimir for both domains, and all addresses for these are in or around Sacramento, California. Going to check out that linked article above now.

Ref:»www.cjupin.com/2007/09/13/credit···rketcom/

quote:
Fraudulent Charges and Equifax …

Three times in as many months, I have had weird charges from California appear on my American Express statement. I did not do business with these companies and I cannot find any information about them online.

10/22/07 $11.87 - E NAT NATALIYA MAKOVCARMICHAEL CA ELECTRONICS STORE
12/05/07 $11.95 - PARADISE WEB PARADISPLUMAS LAKE CA DIRECT MKTG INTERNET
12/26/07 $ 9.45 - VALLJRSX VALL-JRSX WEST SACRAMENTO CA DIRECT MKTG INTERNET
Each time, I called American Express to dispute the charges and they were promptly credited back to my account. I asked them if they could provide me more information about the company that charged me like their phone number, address or website. But, they never had any additional information they could provide. Apparently, whatever I can see when I manage my account on their website is all they can see.

It’s obvious that someone got a hold of my account number. So, I called American Express today and they canceled my card and are issuing me a new card with a new number.

But, I just ran across this article »redtape.msnbc.com/2007/11/chris-···ml#posts by Bob Sullivan (really enjoy reading his stuff) on the Red Tape Chronicles on MSNBC. His article talks about people that have had small bogus charges posted to their debit or credit cards. And, just like the people in the article, I also subscribe to Equifax credit monitoring services. Maybe there is a connection? You would think that Equifax’s website and customer data is secure. But, it’s hard to deny these connections.

Ref:»cybercjh.com/blog/2007/12/28/fra···-equifax

The Amex card fraud laundering is a mirror copy of the Devbill VISA and MASTER CHARGE fraud operation. In fact, the non stop AMEX fraud can be documented operating from as far back as 2002. American Express card fraud laundering domains While the Devbill operation is far more sophisticated, and is spread across a diverse group of financial institutions, and merchant account providers, and thus obfuscates detection. On the other hand the AMEX fraud is conducted exclusively through American Express's facilities. Once the criminals have hijacked global American Express victim account data, they open fraudulent merchant accounts directly from AMEX and launder the hijacked card data via bogus fraud charges right back to AMEX. Amex in turn converts the fraud charges into cash and deposits the funds into the criminal's bank accounts, where it is then wired abroad back to the criminals. This will go down in history not only for its longevity, but also for its undetected simplicity.

As a result of the discovery of the Amex card fraud hosting in early 2008, the Hostweb IP 64.202.102.8 has been under routine observation ever since then. Due to continued shadowing operations, some but not all, of the domains hosted there were published in previous posts. Here is a final list of the peak hosting on IP 64.202.102.8

From notes circa 02/2008:

Hosting audit IP 64.202.102.8

01. Activexupdateweb.com
02. Az-bookspace.com **
03. Best-ebooks4you.com **
04. Crosswaronline.com
05. Digiwexonline.com
06. E-bookstrail.com
07. Ebooks-tfw.com **
08. Ez-booksonline.com **
09. Gameboxmobileshop.com
10. Ibook-space.com **
11. Ibookspace.com
12. Ibookstfs.com **
13. Liveinmotion.net
14. M-gamezshop.com
15. Mobilehomegame.com
16. Newmobile-shark.com **
17. Online4ebooks.com
18. Vr-s.com **

** = domains that were listed or discussed previously.

I acknowledge research contributions from back then by DSR member sch9171

Two domains on the above list never had associated websites, and appear to be the first on that IP, Activexupdateweb.com and Digiwexonline.com. The former Activexupdateweb.com was registered in 04/2006 with a cloaked Domains by Proxy GoDaddy 2 year registration, and was renewed for another two years in 04/2008. Though the later Digiwexonline.com registration and renewal time frames matched identically to Activexupdateweb.com its registration details were not cloaked, and are as follows:

Registrant:
Lucy Peat (lucypeat345@yahoo.co.uk)
Highbury Lodge
Hill Farm Castle
Bytham, Grantham NG334RW
United Kingdom

Domain Name: DIGIWEXONLINE.COM
Created on: 06-Apr-06
Expires on: 06-Apr-10
Last Updated on: 05-Apr-08

It is reasonable to suspect that this is a carded and/or fraudulent registration. Not only that but in 2006 DIGIWEXONLINE.COM was a call home domain for a virus known as W32/Kibik.a

quote:
Discovery Date 11/09/2006

Characteristics -

The W32/Kibik.a detection covers rogue copies of explorer.exe that are patched by W32/Kibik.dr. This virus was most recently caught spreading in the wild through a malicious website hosting Exploit-XMLCoreSrvcs.

Once explorer.exe is restarted or the system is rebooted, the rogue explorer.exe (W32/Kibik.a) is loaded into memory. When run, W32/Kibik.a loads and injects a thread from W32/Kibik.dll into the following running processes where available:

•explorer.exe

•iexplorer.exe

•firefox.exe

•opera.exe

•avp.exe

These processes typically have permissions to access the Internet, in an attempt to bypass desktop firewall policies.

W32/Kibik.dll performs a search on Google Blog Search using a hardcoded unique string. Currently, this search request does not yield any results on Google, but can possibly be used at a later time to download additional instructions or malware. Unlike Google Search, Google Blog Search may more specifically link to blog sites via RSS or Atom feeds.

It also contacts a CGI script hosted on the following domain:

digiwexonline.com At the time of writing, this website is not responding with data. It may also have been used to simply track the locations and number of infections.

Ref: »vil.nai.com/vil/content/v_140866.htm

Though I never saw a hosted site on DIGIWEXONLINE.COM, apparently there was one there for a very short period. Domiantools.com pulled this interesting site shot during an audit on 06/04/2008

[att=3]

Though it lists itself as "Enterprise Business Solutions" mobile billing, the page appears to be an entire fake. There is no record of a listed Joshua Reventrop, nor of such a statement:

quote:
"We are a vibrant mobile billing company with capabilities for premium rate services and superior delivery"

Joshua Reventrop
Marketing Director
Enterprise Business Solutions LLC

Activexupdateweb.com and Digiwexonline.com were subsequently moved in unison to another hostforweb IP 75.102.25.150 in June of 2008.

During that time frame the last two domains that showed up on the original IP 64.202.102.8 were Crosswaronline.com and Liveinmotion.net. At first both appeared innocuous, and the SMTP server on port 25 of IP 64.202.102.8 announced itself as Liveinmotion.net. Furthermore liveinmotion.net had an open verified domain registration which one might consider exculpatory on that server:

ICANN Registrar: GODADDY.COM, INC.

Registrant:
Sergey Tcherednichenko (sergeytch[@]gmail.com)
Kirov av. 78/24
Dnipropetrovsk, Dnipropetrovsk 49000
Ukraine
+380667032959

Domain Name: LIVEINMOTION.NET
Created on: 14-Feb-07
Expires on: 14-Feb-11
Last Updated on: 13-Feb-09

Domain servers in listed order:
NS33.DOMAINCONTROL.COM
NS34.DOMAINCONTROL.COM

Sergey Tcherednichenko AKA Sergeytch appears to be a game developer in the Ukraine, and has multiple posts on forums regarding graphics design, etc: »www.google.com/search?hl=en&q=Se···oq=&aqi=
A 01/26/2008 screen shot of Crosswaronline.com shows the website was a static image of a game "Crosswar".

[att=4]

Initially it was thought that there was no connection between Crosswaronline.com and Sergey Tcherednichenko's domain Liveinmotion.net. In fact, when Crosswaronline.com was first detected on that dedicated IP it was immediately connected to the AMEX card fraud laundering operation because of its domain registration:

Registrant:
vlad mironyuk (vladsdesign@hotmail.com)
4840 buffwood way
sacramento, California 96841
United States

Domain Name: CROSSWARONLINE.COM
Created on: 06-Jul-07
Expires on: 06-Jul-09
Last Updated on: 06-Jul-07

Domain servers in listed order:
NS57.DOMAINCONTROL.COM
NS58.DOMAINCONTROL.COM

That crosswaronline.com registration to a VLADIMIR MIRONYUK aka VLAD, was the same registration as the known Amex card fraud laundering domains of VR-S.COM and its companion NEWMOBILE-SHARK.COM: »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Two subsequent events confirmed Sergey Tcherednichenko's direct control over crosswaronline.com. They were both moved to IP 62.149.27.79:

Server Type: Apache/2.2.10 (Unix) PHP/5.2.7
IP Address: 62.149.27.79
IP Location - Kyyiv - Kiev - Colo-cc

1. Crosswaronline.com
2. Liveinmotion.net
3. Liveinpoker.com 0
4. Yourlastletter.com

And also Liveinmotion.net now displays two real mobile phone games, one of them being crosswar.

[att=5]

What Sergey Tcherednichenko's direct connection to, or knowledge of, the Amex card fraud laundering operation is not known, but there are multiple direct connections. The commonality of the entire mobile game download component theme in both fraud operations is not lost in this relationship either.

With respect to some of the other websites that were hosted on IP 64.202.102.8 and not part of the group of 8 discussed previously, E-bookstrail.com had a cloaked GoDaddy registration also, and its privacy policy listed it as a division of PARADISEWEB 1076 lost trail dr., Plumas lake, California 95961 800-959-8715

[att=6]

Another fraud site of interest was Gameboxmobileshop.com now currently assigned to Hostweb IP 75.102.25.153. On the privacy notice page Gameboxmobileshop.com listed itself as:

VB Service LLC, 2114 Sherington Way, Sacramento, CA 95835 916-396-4310

[att=7]

------------------
You can change your preferences on receiving information from us and third
parties at any time by writing to us at [VB Service LLC 2114 Sherington way
Sacrfamento, CA 95835 tel. (916) 396-4310 USA] or by sending an email to
support@gameboxmobileshop.com.
------------------

As discussed previously, though several of the Russian ex pat AMEX cyber-mules have been tracked and contacted, none were cooperative. As many claimed not to speak English, the conclusion was that they were recruited via Russian language solicitations. So far only one vector was found, and it mentioned VB Service LLC.

It was a posting on a Russian website irr.az:

[att=8]

A translation of the title yielded: "VB Service LLC announces the recruitment for the vacancy in the department of marketing and sales"

[att=9]

A matching California LLC was identified listing the owner as a ALICE KIRILYUK in Sacramento, "surprise surprise"

VB SERVICE LLC
Number: 200734510075
Date Filed: 12/11/2007
Status: active
Jurisdiction: CALIFORNIA
Address
2114 SHERINGTON WAY
SACRAMENTO, CA 95835
Agent for Service of Process
ALICE KIRILYUK
2114 SHERINGTON WAY
SACRAMENTO, CA 95835

[Att=10]

Though a few attempts to reach her failed, ALICE KIRILYUK appears to have a reasonable grasp of the English language:

quote:
Friday, February 17, 2006

Alice Kirilyuk, 22, loves shoes and bags but could never find what she liked in Sacramento. She and 30-year-old partner Russ Akhmerov, both of whom are originally from Moscow, decided last summer they'd open their own store. Vetta Bollare, which means "top brand" in Italian, is set to open April 1 next to Doubleday Bookshop. It'll sell shoes and handbags from Italy, Brazil and Spain, at prices from $130 to $450 -- lower than you'd find them for in San Francisco, Kirilyuk says.

Ref: »assets.bizjournals.com/sacrament···mn1.html

There is also a Porn connection, Alice Kirilyuk and Russ Akhmerov are listed as the owners of a FBN called DOLPHIN ENTERTAINMENT which produces and markets gay porn movies featuring young Russians and Latvians. They also own/ed numerous Porn domains including GayRussia.com. »www.google.com/search?hl=en&q=%2···oq=&aqi=

[att=11]

Russ Akhmerov aka Rouslan aka Ruslan.

At the time of that discovery, circa 02/2008 I ran their last names through my files. I got a hit on Alice's last name "Kirilyuk", and I am not sure if there is any connection or not. However, the name "Kirilyuk" takes us back through 7 years of the AMEX card fraud operation to a Sacramento County Fictitious Business name registration by a RUSLAN KIRILYUK. Who in July of 2002 registered the FBN of ESTOREONLINE.

[att=12]

The peak of AMEX fraud charge complaints for that entity occurred in 2005 at the same time the "DIGITAL AGE" Visa / MC fraud was in full bloom. In fact the fraud charging complaints were intermingled in threads of Digital AGE, several follow up fake templates sites and ESTOREONLINE. Besides DSLR, and dozens of other forums, there was a 22 page thread on fatwallet.com

quote:
....... Just realized for the past 2 months ESTOREONLINE ROCKLIN, CA has been charging my card, and its a bookstore... that doesn't exist.

funny thing is i don't ever use this card. ..

Also see: »news.cnet.com/5208-7350_3-0.html···&start=0 and »209.85.165.104/search?q=cache:5k···40&gl=us Even four years later Google can still resurrect line such as

...."I have an AX account and there is a 25 dollar charge from estoreonline (thats all it says) and I have no idea what it is and I havent used the card in years, just got this myserious bill.
....
»www.google.com/search?hl=en&q=%2···oq=&aqi=

The irony is that in September of 2005 a sharp AMEX rep posted this in the fatwallet forum:

quote:
"hi i work for AMEX and just was given this website by a cardmember to
alert AMEX about this problem. i have set up an investigation and we are
looking into this and will get it correct asap. thank you all for your
understanding and responses it will help us in our investigation.

ashleigh "
Sep/21/2005 2:06 PM

Ashleigh later followed up with this:

quote:
okay new update on the investigation at AMEX, it is called
www.ecollectiononline.com

ashleigh

ESTOREONLINE
2823 Catalina Drive
Rocklin, CA 95765

I wonder if now, almost four years and several million dollars of consumer Amex charge fraud later, if someone should break the bad news to American Express investigators. We know from the 2008 federal indictment of ALEXSANDR BERNIK AKA "ALEX", the cyber-mule of the AMEX card fraud laundering LEXBAY LTD fame, that during the eleven months it lasted in 2005/2006, he was racking up almost $45,000 a month of net fraud proceeds between August 2006 and November 2006.

ecollectiononline.com was a GoDaddy domain by proxy reg, however, there is a WebArchive screen shot from circa 2005 of the webpage:
The »web.archive.org/web/200508140201···dex.html We also now that ESTOREONLINE aka ecollectiononline.com was not RUSLAN KIRILYUK's only venture. Seven years ago, back in 2002 and 2003 his name shows up as the registrant ofat least two other GoDaddy registered Amex card fraud laundering domains: EBOOKS-SHOP.NET and TRAFICHUNTERS.COM

Registrant:
Ruslan Kiriluk webserv77@hotmail.com
E-books-Pro
4339 galbrath dr
Sacto, California 95610
United States

Registered through: Go Daddy Software
Domain Name: EBOOKS-SHOP.NET
Created on: 14-Aug-02
Expires on: 14-Aug-03
Last Updated on: 22-Aug-02

Domain servers in listed order:
NS.EBOOKS-SHOP.NET
NS.PROMOTE5.COM

---------------------------------------

Record expires on 24-Jan-2003.
Record created on 24-Jan-2002.

Domain Name: TRAFICHUNTERS.COM

Registrant:
TraficHunters.com TRAFICHUNTERS-COM-DOM
612 Coppervale Circle
Rocklin, CA 95677
USA
.
Administrative Contact:
Ruslan Kirilyuk epros@msn.com
612 Coppervale Circle
Rocklin, CA 95677
USA

Name Server: NS.EBOOKS-SHOP.NET
Name Server: NS.TRAFICHUNTERS.COM

The same themes are still in use now: »web.archive.org/web/200211212213···ers.com/

A fraud charge complaint from circa 2002/2003 for "TRAFLCHUNTERS.COM 4153095956 CA"

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 22 Jun 2009 16:20:10 EDT

MGD : The organized crime syndicate's cyber-mule recruitment program continues unabated. The China Toy company ruse theme a la Tetronix Toys Ltd aka Tetronixtoys.com, & .info, .org, The latest operation is carried on by Que Toys Ltd, and I am sure there are more:

QUETOYS.COM »quetoys.com

[att=1]

Same layout as before

Company name: Que Toys Ltd
Company address: 23,Harbour Road, Wan Chai
City: Hong Kong
Country: China
E-mail: info@quetoys.com

[att=2]

Posted:
5/29/2009

Description Company Que Toys Ltd, China, Hong Kong was found in 2002 and currently is one of the leaders in the design and manufacture of toys for children. We support the wholesale supply in many regions and countries of the world such as Europe, Middle East, Russia, and India.

We have developed a new program for the company growth in order to increase the presence not only in the wholesale market of toys, but also in the retail sales market.

The main key to the implementation of the program is expanding sales using the Internet (online stores). For accomplishing this program we need to have Project Manager/Sales Representative in the USA for who would be taking care of the sales, represent the interests of our company in the United States and direct participation in the development of our projects in the United States

Your main responsibilities will include organizing sales structure for our products. There is nothing complicated, as it might seem from the first glance. The company already has an action plan in progress, and we only need a reliable partner in the country where we are going to form a direct sales network.

Requirements Here are some requirements for the position:

Be over 21 year old;
Have good referrals from the previous or present employer;
Have a medium or high level of computer literacy sufficient to work with Word, Excel, Internet Explorer

Be able to cooperate with people and be responsible;
Have self motivation and desire to excel;
The availability of personal transportation is welcome.

Here are the important points for this vacancy:

The position can be approached as a part-time job;
The average salary is 1,250-2,000 USD per month.
This position can be easily combined with your current occupation, and without compromising anything. We can talk more about it and come up with a schedule that would appropriate for both sides.

The most important point is that you do not require to invest any of your personal money. All the work related expenses are taken care of by our company.

The open "Project Manager" position:

Snapped 2009-06-22 16:20:04

»www.quetoys.com/career.html

and apply here:

Snapped 2009-06-22 16:19:29

»www.quetoys.com/vac_2.php

As usual they flooded career sites with job adds:

[att=3]
[att=4]
[att=6]

The QUETOYS.COM domain is recent, registered less than a month ago:


Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: QUETOYS.COM 
.
Registrant:
    ALLEN ltd.
    JOHN ALLEN        (j.allen@mail15.com)
    408 elm
    coffeyville
    Maryland,67337
    US
    Tel. +443.9940349
.
Creation Date: 25-May-2009  
Expiration Date: 25-May-2010

.

QUETOYS.COM also has a robots.txt file blocking any search archiving:

[att=5]

Despite the no robots, the crime syndicate is link spamming the site. One such user id is : Nikolacay25 who is also link spamming for several Russian language websites:

[att=7][att=8]

This type of link spamming, different from the manual intelligent forum spamming of the card fraud sites, is not new either. For example Russian click bots were detected spewing links for ddv-enterprises and that entire group. They were detected mingled in outbound bot traffic that was pumping mostly Russian domains.

[att=9][att=10]

quote:
1 >http://www.ddv-enterprises.com/
digsdig it Job - resume search, job listing, job opportunity
submitted by sawo7ty 2 hours ago (via ddv-enterprises.com)
Only at our web site you will find the best job: job employment, job opportunity, job vacancies, resume databases, resume search and job listing, etc.

>http://memark.info/stories/9924/Job__resume_search_job_listing_job_opportunity.html

-----------------------------------------

1 >http://www.bombcreator.ru/
digsdig it ???????? ????? ????????: ????????? ????
submitted by sawo7ty 2 hours ago (via bombcreator.ru)
Professional wedding photo shooting for the model portfolio portrait photography children and adults acting portfolio nude art.

»www.google.com/search?hl=en&q=%2···oq=&aqi=
>http://memark.info/stories/9923/____.html

Besides ddv-enterprises it included others from that group such as ankersolutions. Much of the RSS output came from two accounts, sawo7ty and grus3ti.:

quote:
digsdig it Job - job listing, job search, job resumes
submitted by grus3ti 1 hour ago (via ankersolutionsllc.com)
Only at our job site you will find everything you need: job listing, job employment, job opportunity, etc.

digsdig it Job - resume search, job listing, job opportunity
submitted by sawo7ty 2 hours ago (via ddv-enterprises.com)
Only at our web site you will find the best job: job employment, job opportunity, job vacancies, resume databases, resume search and job listing, etc.

In the QUETOYS.COM case there are several noteworthy characteristics in play. One of which is the first connection, albeit somewhat anecdotal, to the California Multi year Russian American Express card fraud laundering operation. I will discuss those connections in a follow up post.

Though the prior Tetronixtoys aka Tetronix Toys Ltd. group had 5 domains and were hosted in Russia:

-------------------------------
Server Type: Apache/2
IP Address: 92.241.191.50

IP Location - Moscow City - Moscow - Wahome Dedicated

92.241.191.50 [no reverse DNS set]

1. Tetronixtoys.biz
2. Tetronixtoys.com
3. Tetronixtoys.info
4. Tetronixtoys.net
5. Tetronixtoys.org

-------------------------------

This time around QUETOYS aka Que Toys Ltd is only using 3 TLDs' QUETOYS.COM, QUETOYS.NET, and QUETOYS.ORG, all hosted on dedicated IPs at 216.195.62.132, 216.195.62.133, and 216.195.62.133 respectively. Though those dedicated IPs are located in the US, they were obtained from the recently shut down 3FN / Pricewert LLC / APS Telecom. A nefarious Ukrainian based operation masquerading as a US entity, see: »FTC Shutters N. Calif. Hosting Firm for Botnets, Kiddie Porn

QUETOYS.COM was subsequently relocated, though QUETOYS.NET, and QUETOYS.ORG remain shuttered:


 
ICANN Registrar:  DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
Created:  2009-05-25 
Expires:  2010-05-25 
.
Whois Record
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
.
Domain Name: QUETOYS.NET 
.
Registrant:
    EDWARDS llc.
    BELINDA EDWARDS        (edwards@mail333.com)
    1017 e. 11th. st.
    Pittsburg
    Kansas,66762
    US
    Tel. +128.3780752
.
Creation Date: 25-May-2009  
Expiration Date: 25-May-2010
.
Domain servers in listed order:
    dns293-2.3fn.net
    dns293.3fn.net
.
.
.
Domain ID:D156227362-LROR
Domain Name:QUETOYS.ORG
Created On:25-May-2009 11:32:31 UTC
Last Updated On:25-May-2009 12:39:33 UTC
Expiration Date:25-May-2010 11:32:31 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. 
d/b/a PublicDomainRegistry.com 
(R27-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_9912249
Registrant Name:MELISSA JONES
Registrant Organization:JONES ltd.
Registrant Street1:704 lewark
Registrant Street2:
Registrant Street3:
Registrant City:Coffeyville
Registrant State/Province:Kansas
Registrant Postal Code:67337
Registrant Country:US
Registrant Phone:+128.3251316
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: mjones@pisem.net
Name Server:DNS293.3FN.NET
Name Server:DNS293-2.3FN.NET

.
.
All were registered on May 25th, and bogus address registration data is never an issue for Directi Internet Solutions.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Wed, 17 Jun 2009 01:41:37 EDT

MGD : As nwrickert stated you can enroll for a free dslr account without giving personal information and them send an IM to me.

said by DRC :

This group or whatever is making Purchases on eBay.
It would appear they are planning to start producing the Physical Cards......

Card readers, card encoders, and card white stock have been openly available for sale for quiet some time, including on Ebay. In the past we have ran across cyber criminals on the phishtrack project who were sending pics of card encoders that they had bought on Ebay, and had successfully shipped to eastern Europe. So this has been going on for some time.

said by DRC :

.....
I think this means they are getting dumps of the Magnetic Stripes and not just stealing text information. Also this is more difficult so the cyber mules are being less effective.
...
Will they have to manufacture and use the cards in the US?
How will they be profiting from these cards? Cyber Mules by things and mail them to Russia?

It is less effective since goods purchased with stolen cards need to be reshipped and converted to cash. There are still package reshipping mule programs operated by the low hanging criminal fruit. It is a more tedious operation and the conversion rate is rather low.

Generally though card swipe data is resold or sent to the US where it is encoded on cards here, and a portion of the proceeds are sent back. Currently one of the most common methods is to encode the track 2 data on to used prepaid debit or gift cards. That saves having to buy printed card stock and bypasses the checking process at purchase time. Here is an example of that kind of operation:

6 arrested in $1 million gift card scam

Six women arrested for allegedly encoding stolen credit card information onto gift cards, then using them to buy more than $1 million worth of merchandise at area stores, are part of an international crime ring, authorities said Tuesday.

"The Richmond Girls," as investigators have dubbed them, allegedly traveled up and down Intersate 80 – from San Francisco to Sacramento – using the bogus cards to buy Louis Vuitton purses, designer clothes and more than $540,000 in goods from Target and Wal-Mart.
..........
.....
..
All six of the women – who range in age from 21 to 37 – have ties to Richmond and are believed to be friends. Authorities say their crime ring, though, is more far-reaching; over the past year, the women allegedly wired more than $120,000 to Eastern Europe, including Russia and Ukraine.

Investigators believe the transfers paid for stolen credit account numbers from foreign banks. The numbers were re-encoded onto gift cards using equipment legally bought over the Internet.

Officials say suspects usually made a small purchase with a re-encoded card first, to make sure it worked. They then made larger purchases.

"There's no need at that point to ask for ID. In fact, (clerks) can't, because a gift card is considered the same as cash," Cooper said.
......
...

The rest of the story: »www.sacbee.com/ourregion/story/1085922.html

This fraud operation is more sophisticated and they have the entire card account data, not just the swipe or track 2 data. The track 2 swipe data includes F&L name, card number, and expiration date. In this program they have that data plus the full address and cvv2 security code. The above track 2 data only enables the card to be cloned and used for card present POS transactions. Where as the other data enables a CNP card not present transaction, or the track 2 portion could be encoded on to cards if desired.

This process enables the data to be converted to cash, and delivered right back to them. Every batch of 100,000 card data will yield over a million dollars returned in cash to their front door. That process (unlike burning cards) avoids most detection processes, and thus enables the operation to be sustained for many years. Churning millions in cash right back to them at relatively low operating cost.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 15 Jun 2009 18:43:33 EDT

MGD :

said by Mystikangel :

... I noticed a charge on my account Friday (6/12) from nuranastudio.com . Like Artificer, I filed on ripoffreport.com before finding this site.
»www.ripoffreport.com/reports/0/4···1520.htm

My bank statement read: "CKCD DEBIT 06/08
www.nuranastudio.com 415-3667187 NY $13.29"

I called the number listed and received a recorded message to send an email to support@nuranastudio.com. I sent an email with only my name and asked for the details of my "supposed order" and the ip address it originated from.

I stopped my debit card and filed a dispute with my bank about the charges. I filed an IC3 complaint and sent an email to Active-Domain LLC about the site being involved in credit card fraud. They have replied and asked for "documentary proof or reports to substantiate your claim".

MGD, I have been reading your posts. I had to join just to post and say thank you. This is the first time my card has been fraudulently charged and it's nice to know that there are people like you out there trying to uncover these thieves. Bravo for all that you do.

.

Hi Mystikangel ,

Thank you, and I very much appreciate the Kudos. Allow me to return the praise, as it is victims such as you who take the initiative to follow through on such a fraud charge, that contributes to getting the message out there about this long running multi million dollar a year fraud perpetrated on consumers by this organized crime syndicate. You are one of a small minority of victims who decide to devote resources well above the initial cost of the fraud charge, in order to uncover the fraud. bear in mind that random sampling of some of the fraudulent merchant accounts show that well over 80% of the fraud charges go uncontested, or end up as a chargeback. In fact some of the fraudulent accounts that have survived in operation for over a year had chargeback ratios below 3%. That is less than many legitimate e-commerce entities. Thanks to people such as you, this crime syndicates multi year operation will go down as the cybercrime of the decade, both for its sophistication and longevity, and also for the total cost, well in excess of 100 million dollars.

I also thank you for listing the line item charge which shows that the acquirer bank is in the sate of New York. When NURANASTUDIO.COM was first reported I spent some time reviewing corporate registrations for New York in an attempt to identify the cyber-mule, and failed to locate the corresponding registration. Your posting of the line item charge prompted me to go back and spend some time reviewing the records again. I now located the matching corporate registration of NURANA WEB DESIGN INC on 01/14/2009 to a recruited cyber-mule in DEER PARK, NEW YORK, 11729:

NURANA WEB DESIGN INC. aka NURANASTUDIO.COM 415-366-7187

[att=1]


NYS Department of State
Division of Corporations
Entity Information
.
------------------------------------------
.
Selected Entity Name: NURANA WEB DESIGN INC.
Selected Entity Status Information 
Current Entity Name: NURANA WEB DESIGN INC. 
Initial DOS Filing Date: JANUARY 14, 2009 
County: SUFFOLK 
Jurisdiction: NEW YORK 
Entity Type: DOMESTIC BUSINESS CORPORATION 
Current Entity Status: ACTIVE  
.
Selected Entity Address Information DOS Process 
(Address to which DOS will mail process 
if accepted on behalf of the entity) 
.
NURANA WEB DESIGN INC.
388 NICOLLS RD
DEER PARK, NEW YORK, 11729  
Registered Agent 
NONE  
--------------------------------------

.

That address corresponds to a last name of Goberdhan. Records indicate that those names were the residents on the above date of registration, and have been since at least 2004.

Recently, many of these card fraud laundering and recruiting domains have been registered via the accredited domain registrar Active-Domain In fact, according to ICANN regulations all of the domains are subject to immediate revocation by the registrar, due to the fact that they are fraudulently registered. In the case of NURANASTUDIO.COM, Sossi Postajian did not register this domain, neither did Sossi register FLASHWEBDIZ.COM which was one of 5 card fraud laundering domains that the OCS assigned to Mary Attalla. Though not at the top of the list, one of the many downsides to being recruited as a cyber-mule, is that this Russian crime syndicate will use your identity after your term as a cyber-mule expires. During the recruiting process cyber-mules are required to submit identity documents to the criminals, which at the least includes a picture id, such as a drivers license. The OCS began assuming the identities of former cyber-mules as a counter measure against domain revocation. In the past the registrars were being notified of the fraud domains, many of which were carded. However in 2008 a registrar responded that a domain payment was valid and that the registrant responded to the complaint by submitting their drivers license to confirm their identity.

As is typical, the email contact address and the listed telephone number will be under the control of the criminals and they will readily respond to inquiries by producing a copy of Sossi Postajian's identity. Sossi did not register either of those domains, nor have a clue that his identity has been used to do so. In fact Sossi apparently dropped out of the cyber-mule recruiting process early in the game. That name first came up while shadowing the US Strawberry fraud group while it was a work in progress. This screen shot of setemplates.com was taken in the first week of December 2008 showing the website as:

Shrist Electronics, Inc
www.setemplates.com
1-(970)-300-2035
support@setemplates.com

[att=2]

Shrist was a dormant California corporation registered to Sossi:

[att=3]

However, during a routine audit in January of 2009, setemplates.com had been changed to:

WEB Service Solutions, LLC
setemplates.com
1-(970)-300-2035
support@setemplates.com

WEB Service Solutions, LLC was another California entity registered by a different cyber-mule. At the time the conclusion was that Sossi had dropped out and was replaced. That was confirmed when Mary Attalla's FLASHWEBDIZ.COM was uncovered. The crime syndicate will only register domains using the identities of non active cyber-mules.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 15 Jun 2009 10:03:04 EDT

Mystikangel : Thank you all for the advice.
I did indeed send them a link to this thread. I received a very prompt reply stating : "....We have written to the domain owner to stop all illegal activities and notify us of his action. Otherwise the domain will be suspended within a specified time frame. "

I also tried looking up the telephone number on a few sites to find the service provider. It shows as Broadwing Communications/Level 3. I don't know if it will do any good, but I sent their abuse department an email explaining that the telephone number is being used by a website/person engaged in credit card fraud.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 15 Jun 2009 07:28:24 EDT

music man : Or direct them to this thread. It lays out the scam pretty well- just takes a while to read it all!!

I have to agree with K Patterson though- why would any legitimate trading website seek to stop Google from indexing it! It doesn't make any business sense at all!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Mon, 15 Jun 2009 07:15:54 EDT

K Patterson : The site uses a robots.txt file to block all search engines from indexing it. That might be enough "documentary proof" for active-domain LLC.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 14 Jun 2009 20:42:08 EDT

Whip : Michigan phone number with a California address.

quote:
Registration Service Provided By: Active-Domain LLC
Contact: »www.active-domain.com

Domain Name: NURANASTUDIO.COM
Expiry Date: 14-Apr-2010
Creation Date: 14-Apr-2009

Name servers:
ns1.unixsrv8.com
ns2.unixsrv8.com

Registrant Name: Sossi Postajian
Registrant Company: nuranastudio.com
Registrant Email Address: s_postajian1@yahoo.com
Registrant Address: 20224 sherman way apt 48
Registrant City: Canoga Park
Registrant State/Region/Province: CA
Registrant Postal Code: 91306
Registrant Country: US
Registrant Tel No: +1.3135572056
Registrant Fax No:

Admin Name: Sossi Postajian
Admin Company: nuranastudio.com
Admin Email Address: s_postajian1@yahoo.com
Admin Address: 20224 sherman way apt 48
Admin City: Canoga Park
Admin State/Region/Province: CA
Admin Postal Code: 91306
Admin Country: US
Admin Tel No: +1.3135572056
Admin Fax No:

Tech Name: Sossi Postajian
Tech Company: nuranastudio.com
Tech Email Address: s_postajian1@yahoo.com
Tech Address: 20224 sherman way apt 48
Tech City: Canoga Park
Tech State/Region/Province: CA
Tech Postal Code: 91306
Tech Country: US
Tech Tel No: +1.3135572056
Tech Fax No:

That number 415-366-7187 is a Belvedere, California number though not that it means anything.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 14 Jun 2009 19:46:24 EDT

Mystikangel :

said by Artificer :

yet another site: »WWW.NURANASTUDIO.COM

Same format as MGD posted a few posts ago. (makewebdiz.com)

Found out about it with a fraudulant charge, then found this forum topic.

I noticed a charge on my account Friday (6/12) from nuranastudio.com . Like Artificer, I filed on ripoffreport.com before finding this site.
»www.ripoffreport.com/reports/0/4···1520.htm

My bank statement read: "CKCD DEBIT 06/08
www.nuranastudio.com 415-3667187 NY $13.29"

I called the number listed and received a recorded message to send an email to support@nuranastudio.com. I sent an email with only my name and asked for the details of my "supposed order" and the ip address it originated from.

I stopped my debit card and filed a dispute with my bank about the charges. I filed an IC3 complaint and sent an email to Active-Domain LLC about the site being involved in credit card fraud. They have replied and asked for "documentary proof or reports to substantiate your claim".

MGD, I have been reading your posts. I had to join just to post and say thank you. This is the first time my card has been fraudulently charged and it's nice to know that there are people like you out there trying to uncover these thieves. Bravo for all that you do.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 11 Jun 2009 21:30:31 EDT

nwrickert : Very interesting. Thanks.

I suggest you consider signing up for a free account at dslreports.com. That will allow you to send private messages to MGD about the information you have.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 11 Jun 2009 21:04:37 EDT

anon : This group or whatever is making Purchases on eBay.
It would appear they are planning to start producing the Physical Cards.

»feedback.ebay.com/ws/eBayISAPI.d···:US:1183

I think this means they are getting dumps of the Magnetic Stripes and not just stealing text information. Also this is more difficult so the cyber mules are being less effective.
I think they may be caught soon.

Will they have to manufacture and use the cards in the US?
How will they be profiting from these cards? Cyber Mules by things and mail them to Russia?

I have more information but don't want to post it online, but it is definitely the same people.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 23:24:12 EDT

MGD : As expected, yourpetssupplier.com aka You Pet’s Supplier 507-933-4157 also processes card fraud payments via Authorize.net's gateway:

[Att=1]

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 23:01:57 EDT

MGD : Excellent find !!

Same directory:
»www.yourpetssupplier.com/goods/
and
»www.yourpetssupplier.com/data/

Not only the same DIRECTI registrar and time frame as the others, but also the same "Registration Service Provided By: SIMPA STUDIO" which appears to be out of Bosnia.


YOURPETSSUPPLIER.COM 
.
ICANN Registrar: 
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM
.
Registration Service Provided By: SIMPA STUDIO
Contact: +1.0000000000
.
Domain Name: YOURPETSSUPPLIER.COM 
.
Registrant:
    n/a
    David D Gran        (david.gran@yahoo.com)
    320 4th Street NW, Suite 200
    Faribault
    Minnesota,55021
    US
    Tel. +1.5077236242
.
Creation Date: 08-Sep-2008  
Expiration Date: 08-Sep-2009
.
Domain servers in listed order:
    ns8.reliablesolution.com
    ns7.reliablesolution.com

.
Contact us
You Pet’s Supplier
320 4th Street NW, Suite 200
Faribault, MN 55021
Phone: 1 (507) 933-4157
Fax: 1 (507) 933-4157
Email: support@yourpetssupplier.com
.

As in the other "Pet Stores" the addresses are mail drop boxes. In this case 320 4th Street NW, Suite 200 is the The UPS Store #5731.

From music man 's link:

yourpetssupplier.com aka You Pet’s Supplier 507-933-4157

quote:
Ezra - 11 Mar 2009

I had the same problem. The charge on my card was $27.98. I've sent in a formal complaint to the Better Business Bureau. Also, not long after this I got a charge from "Photo Bank" with phone number (888) 216-7758. This is also a scam that's been reported on this site. Maybe these two are connected?

»whocallsme.com/Phone-Number.aspx/5079334157

Indeed it is Photo Bank 888-216-7758 aka Photo Depot is directly connected to the the fake template websites, a quote of mine:

quote:
...This $7.50 fraud charge from "photo depot" showed up as a tandem charge alongside iltemplates.com AKA Internet Logistics,LLC. 352-353-0375. In fact victims of the iltemplates fraud charges have also reported tandem charges from GETNEWITEMS, REBATESOFT, MORBLADO, and now Photo Depot: ......

»Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

music man Google link shows numerous fraud complaint threads: link:»www.google.com/search?hl=en&q=88···oq=&aqi=

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 14:44:28 EDT

music man : Lets add »www.yourpetssupplier.com/ to the "suspect" list.

Snapped 2009-06-04 14:42:13

»www.yourpetssupplier.com/support.php

Registry Data
ICANN Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Created: 2008-09-08
Expires: 2009-09-08

Plus a load of complaints here and here

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 11:52:09 EDT

MGD :

said by Doctor Olds :

said by MGD :

“Stuff for Minions” claims to be a pet supply store with a suspiciously bland catalog and website.

These are not the first "pet supply" fraud sites either, I believe some months back there was one Listed in New York, maybe in Melville or something like that. It was part of the group that were using the same virtual rent an office address space company on various locations.

MGD

This one? »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

.

Nice work Doctor Olds , you beat me to it. I started writing before your post showed up and you were there ahead of me after I posted. You will definitely be a valuable consulting asset if we can ever get a documentary made of this huge cybercrime

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 11:45:44 EDT

MGD :

said by MGD :

....
[edit add]

These are not the first "pet supply" fraud sites either, I believe some months back there was one Listed in New York, maybe in Melville or something like that. It was part of the group that were using the same virtual rent an office address space company on various locations.

MGD

From back in March:

CONTACT US

We value your business and we want your online pet supply shopping experience to be easy and enjoyable. Our customer service department is available 24/7 and dedicated to providing the best customer service.

E-mail: support@adeleservices.com
Toll-free: (800) 578-9641
Mailing Address: Adele Services Inc
68 S.Service Rd, Melville, NY 11747

Some of the reported fraud under adeleservices.com were ping charges.

»Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

»www.google.com/search?hl=en&q=ad···oq=&aqi=

This also ties in to the massive card validation pinging campaign from back in January that generated a lot of media attention: »www.boston.com/business/personal···f_users/

and:

»voices.washingtonpost.com/securi···big.html

The fact that many thousands of cards were hit with less than 10 cent charges, confused many as to the possible theory behind it. One of mine was that these were intended to be pre authorization ping charges that roll off in 24 hours. Otherwise it would only be a heads up alert to victims and reduce the card pool. Pre auth roll offs would only be noticed by those who checked their card accounts online during the period.

We know that for years a portion of the OCS card data was validated by hacking into small business merchant accounts (usually PayPal) and racking up several thousand pre auth ping charges over a weekend, sticking the owner with a large bill. Te first report of that goes back to early 2005 during the Digital Age fraud where some DSLR victims caught a pre ping roll off coming from a flower shop in PA, a day or two before the actual fraud charges. When contacted the vendor confirmed that their small business merchant account was hacked over a weekend and over 7,000 pre auth ping charges were ran through their account.

More recently I believe that some processors have instituted procedures that prevent this type of mass bulk pre auth pings. Don't quote me, but I believe that merchant systems for some institutions will now flag after a small threshold of ping auths come through an account. (unusual activity). That flagging is in "auto mode" such that the account will automatically be blocked from processing any additional pre auths pings until the account holder contacts the rep. It is an automated system and is in effect 24/7. The flag deviations and threshold triggers cause the account to be auto locked, until contact is made.

I believe that the cyber criminals intended those massive pings to be pre auths, and then got locked out at the beginning of the mass run. The only alternative for them to validate was to process the ping as an actual charge and not a pre auth. Thus the mass reporting of actual sub 10 cent fraud charges, rather than a pre auth that would not have been noticed by many, and would subsequently roll off.

What confused many was why criminals would be fraud charging cards at a loss. In essence the cost of the processing exceeded the charge value. However, in the global scheme this was just a small cost to the OCS in anticipation of larger revenue recovery. The downside with the unexpected change was that a lot more of the data became unusable due to the alert that consumers received versus a roll off.

Even though the amount of fraud websites and documentation in this thread is significant, it still only scratches the surface of this mass ongoing multi year fraud. A much larger percentage is still going on undetected. The mass dispersion of fraud sites and various themes, makes any attempt to get ones arms around the totality of the ongoing fraud process extremely difficult. You may use any multiple factor of your choosing of what is reported to date, in order to estimate the totality of what is easily a high eight figure annual loss to this fraud, if not more.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 11:14:38 EDT

Doctor Olds :

This one? »Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Thu, 04 Jun 2009 01:36:17 EDT

MGD : NURANASTUDIO.COM 415-366-7187 is not the only card fraud laundering website actively processing fraud charges from the current "Gargoyle" group. It appears that CCWEBCREATIVE.COM 785-527-9676 is actively processing fraud charges also. I am sure that many of the others in that group are as well, both known and unknown. However, it has become more difficult to detect reports, as the organized crime syndicate's operation is becoming more stealthy.

A current fraud report for CCWEBCREATIVE.COM 785-527-9676 shows that a common tactic from circa 2005 has resurfaced, along with the use of fraud sites appearing to sell products and not intangibles. If you recall, both the Digital Age (diage.com & da-support.com) and Pluto Data Ltd. charges were between $20 to $30 and in the case of Pluto were for fake products such as a DVD Both of these large charges were either immediately preceded or followed by a $7 to $10 web template / game download, et all, fraud charge. After Digital Age and Pluto the OCS focused on the $10 and under fraud charges, since it was the $20 - $30 fraud charges that managed to generate mainstream media attention. Though ultimately it had no lasting effect on the organized fraud operation, which is now close to a decade old.

Kudos to Phillip Dampier who posted this on his blog around a month ago, and included the line item charges:

quote:
Be sure and check those credit card and debit card statements every month. While perusing mine, I discovered two fraudulent charges I never authorized, and the bank is closing the card number down and charging them back:

04-25-2009 STUFF FOR MINIONS 561-459-1883 FLUS $30.99
05-05-2009 CCWEBCREATIVE 785-527-9676 NYUS $13.29

“Stuff for Minions” claims to be a pet supply store with a suspiciously bland catalog and website. The name doesn’t exactly match either. Calling the number takes you nowhere. “CC Web Creative” is permanently forwarded to a voicemail box with a NYC accented woman prompting you to e-mail them instead. Yeah, like that is going to happen. The website is a generic web template slightly modified with contact information that is hardly detailed.

Stuff for Minions hit more folks early on, and usually for around $30. The CC Web Creative charge is more recent and is probably now popping up on credit card and debit card statements only this week. ....

Ref:»stopthecap.com/2009/05/05/off-to···rd-scam/

Ironically, a poster added this comment to his blog:

quote:
..... Good to know you found out about these fraudulent charges. Seems like everyone’s trying to scam/fraud someone these days, but that is no surprise really. Take a look at DSLReport’s Spam and Phishbusters forum. It’s typically quite busy. ....

It would have been a cool "heads up" back on may 5th.

We can now tell from Phillip's line item that though the CCWEBCREATIVE contact area code of 785 is Kansas, and the domain reg is Minnesota, the line item code of NY tells us that the cyber-mule set up the merchant account in New York state. The acquirer bank is in NY, and the cyber-mule also resides somewhere there. Based on the cyber-mules voice on the recording on 785-527-9676, we can also surmise that they are probably a twenty something female.

Of course the most interesting item is the tandem fraud charge STUFF FOR MINIONS 561-459-1883 FLUS $30.99 At first, I was not sure what to make of:

STUFFFORMINIONS.COM aka STUFF FOR MINIONS 561-459-1883 aka Pet Stop Shop
»STUFFFORMINIONS.COM

Snapped 2009-06-04 01:25:39

»STUFFFORMINIONS.COM

I did not take long to designate it as an exclusive card fraud laundering site. First the site is clearly just a basic shell: »stuffforminions.com/goods/ It uses the EU English spelling of "CATALOGUE" and clearly is not intended for marketing products to the public. Though it is not hidden from search indexing, it has little or no text to archive. Nor is there any advertising or promotion.

The standard contact format:

[att=1]

Contact us
Stuff for Minions
1632 N STATE RD SUITE 114
WELLINGTON, FL 33414
Phone: 1 (561) 459-1883
Fax: 1 (561) 459-1883
Email: support@stuffforminions.com

The icing on the cake of course is the de facto registrar of record for cybercrime:


STUFFFORMINIONS.COM
.
ICANN Registrar:
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: SIMPA STUDIO
Contact: +1.0000000000
.
Domain Name: STUFFFORMINIONS.COM 
.
Registrant:
    n/a
    Christopher Zitelli (christopherzitelli@yahoo.com)
    1632 N STATE RD SUITE 114
    WELLINGTON
    Florida,33414
    US
    Tel. +1.5616468752
.
Creation Date: 08-Sep-2008  
Expiration Date: 08-Sep-2009
.
Domain servers in listed order:
    ns2.getpaidsolutions.com
    ns1.getpaidsolutions.com

.
Server Data
Server Type: Apache/1.3.41 (Unix) PHP/4.4.9 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
IP Address: 209.62.57.146
IP Location - Texas - Dallas - Theplanet.com Internet Services Inc
Response Code: 200

Going through a STUFFFORMINIONS.COM purchase (no pre sign up account required) leads to, surprise surprise !!, who would have guessed Authorize.net ??:

[att=3]

Pulled the source code to reveal the authorize account referral data:

[att=2]

The domain registration appears to match to the the line item charge. Interestingly there are multiple fraud ~ $30 fraud charge reports for STUFFFORMINIONS.COM going back to early February: »www.callercomplaints.com/SearchR···459-1883

--------------------------------------------------------------------
Rick Filed by Rick at 5/9/2009 7:46:34 AM Caller Type: Unknown

Phone Number Report: The phone number appears on bank statement next to fraud charge of 30.99. Callback to phone number is disconnected. website appears to be stuffforminions.com. Site if registered to Christopher Zitelli in Florida. Website domain info has phone number as 561-646-8752. Registered to Zitelli America, Inc

quote:
--------------------------------------------------------------------
Phillip Filed by Phillip at 5/5/2009 2:43:15 PM Caller Type: Unknown

Phone Number Report: $30.99 on the 25th here in western NY. Also watch for CCWebsolutions
which followed a week or so later for $13. Scam.
--------------------------------------------------------------------

I am not sure if the other charge is »ccwebsolutions.com/index.html which may be a legit hosting that the OCS used the card to pay for ?, needs further research.

Thanks to this 05/19 posting from Kim which reveals an earlier clone of stuffforminions.com

quote:
--------------------------------------------------------------------
Kim Filed by Kim at 5/19/2009 6:17:42 PM Caller Type: Unknown

Phone Number Report: Fraudulantly makes charges to credit cards without getting authorization and without the credit card owners permission. Uses two fake web site: »www.stuffforminions.com/support.php and www.petstopshop.com (I'm sure they have more fradulant web addresses set up but these two are all I know about currently) They used to use this phone number (561) 459-1883 but it has since been disconnected and they started using this one. 407-965-1386.
--------------------------------------------------------------------

Ref: »www.callercomplaints.com/SearchR···965-1386

PETSTOPSHOP.COM 407-965-1386 aka Pet Stop Shop »petstopshop.com

Snapped 2009-06-04 01:25:22

»petstopshop.com

same domain reg format:


PETSTOPSHOP.COM 
.
ICANN Registrar:  
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
D/B/A PUBLICDOMAINREGISTRY.COM 
.
Registration Service Provided By: SIMPA STUDIO
Contact: +1.0000000000
.
Domain Name: PETSTOPSHOP.COM 
.
Registrant:
    n/a
    Scot C Robertson (scotrobertson@ymail.com)
    3453 E ORLANDO AVE
    WINTER PARK
    Florida,32789
    US
    Tel. +1.4073874378
.
Creation Date: 25-Aug-2008  
Expiration Date: 25-Aug-2009
.
Domain servers in listed order:
    ns1.riuhost.com
    ns2.riuhost.com

.
Server Data
Server Type: WebServerX
IP Address: 66.7.200.85
IP Location - Florida - Orlando - Hostdime.com Inc
Response Code: 200
SSL Cert: *.dizinc.com expires in 1358 days.

.

Contact us
Pet Stop Shop
522 HUNT CLUB BLVD SUITE 547
APOPKA, FL 32703-4960
Phone: 1 (407) 965-1386
Fax: 1 (407) 965-1386
Email: scot@petstopshop.com

[att=4]

Other than Kim's alerting post, I do not see any fraud reports on PETSTOPSHOP.COM. This is the first time in a while that there is a direct connection to $20 - $30 fraud charges for fake non tangibles. For some time though the OCS has been observed setting up such sites. The last event was during the McColo hosting phase of the UK strawberry and the software recruiting sites where two UK tangible format sites were shadowed on the same IPs:

megaphotostore.net
»/r0/download/1···crop.png

»Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

kiddytoys.net
»/r0/download/1···crop.png

No record of actual processing activity was found.

In fact another clone toy site is still up:

fntoy.com »fntoy.com

Snapped 2009-06-04 01:25:04

»fntoy.com

»whois.domaintools.com/fntoy.com

FNTOY.COM is hosted on one of the organized crime syndicate's home base providers, WAHOME:

Server Type: Apache/2
IP Address: 77.91.231.130
IP Location - Russian Federation - Wahome Dedicated

IP 77.91.231.130 coincidentally, is right next door to:

Hosting Results for 77.91.231.131 [no reverse DNS set]

1. Unitelcompany.biz
2. Unitelcompany.com
3. Unitelcompany.info
4. Unitelcompany.net
5. Unitelcompany.org
6. Unitelsoftware.com

[edit add]

These are not the first "pet supply" fraud sites either, I believe some months back there was one Listed in New York, maybe in Melville or something like that. It was part of the group that were using the same virtual rent an office address space company on various locations.

[edit #2 add]

I neglected to mention in reference to FNTOY.COM, that the OCS also spammed forums with posts using the FNTOY.COM domain name to preload search ranking: »www.google.com/search?hl=en&q=fn···oq=&aqi= which was one of the reasons it was under surveillance, as it was presumed to be fraud charging UK card data. However, no fraud reports were ever found.

MGD


STUFFFORMINIONS.COM BUY
STUFFFORMINIONS.COM BUY

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 02 Jun 2009 20:15:28 EDT

Whip :

said by MGD :

Located another card fraud laundering website from this group. We need a name for this new theme.

Gargoyle. It's the first thing I think of when I see that stupid thing in the middle on top.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 02 Jun 2009 19:19:38 EDT

MGD : Located another card fraud laundering website from this group. We need a name for this new theme.

»ccwebcreative.com

ccwebcreative.com
ccwebcreative.com
1-(785)-527-9676

Or you can send us email directly: support@ccwebcreative.com

[att=1][att=2]

Remember the multi site cyber-mule JIM LENNON? »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto


ICANN Registrar:  ACTIVE REGISTRAR, INC. 
Registration Service Provided By: 
Active-Domain LLC
.
Domain Name: ccwebcreative.com
Expiry Date: 13-Apr-2010
Creation Date: 13-Apr-2009
.
Name servers:
NS13.EVERITY.COM
NS14.EVERITY.COM
.
Registrant Name: Jim Lennon
Registrant Company: ccwebcreative.com
Registrant Email Address: lennon_al@yahoo.com
Registrant Address: 1700 Lexington Ave So
Registrant City: St Paul
Registrant State/Region/55118
Registrant Country: US
Registrant Tel No: +1.4259847064
Registrant Fax No:

.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 02 Jun 2009 15:49:21 EDT

MGD :

said by Artificer :

yet another site: »WWW.NURANASTUDIO.COM

Same format as MGD posted a few posts ago. (makewebdiz.com)

Found out about it with a fraudulant charge, then found this forum topic.
..
.

.
Outstanding Artificer,

Thank you for posting. I looked for a ripoffreport posting but did not find it. Can you post the line item charge as it appears on your statement including the amount. I am interested in tracking down the state where the business was registered.The two letter abbreviation may appear on the line item charge. You could also ask your bank, or the transaction item ARN code, can yield info on the acquirer bank bank here the cyber-mule's business account is located at.

Yours is the first known fraud charge from the organized crime syndicate's latest themed group. As you mentioned there are two priors:

--------------------------

makewebdiz.com
makewebdiz.com
1-(516)-320-6036

Or you can send us email directly: support@makewebdiz.com

--------------------------

hfdiz.com
hfdiz.com
1-(224)-333-2000

Or you can send us email directly: support@hfdiz.com

--------------------------

And now:

--------------------------

nuranastudio.com
www.nuranastudio.com
1-(415)-366-7187

Or you can send us email directly: support@nuranastudio.com

--------------------------

Snapped 2009-06-02 15:43:48

»www.nuranastudio.com/index.php

I presume that there are at least over a dozen more operating in stealth mode.

The latest themed group have direct connections to all of the priors, and nuranastudio.com follows that:

quote:
IP 66.45.226.2 = nuranastudio.com

Server Data
Server Type: Apache/2.2.11 (Unix) mod_ssl/2.2.11

OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4

FrontPage/5.0.2.2635 PHP/5.2.6
IP Address: 66.45.226.2

IP Location - New Jersey - Berkeley Heights - Interserver Inc
Response Code: 200
Domain Status: Registered And Active Website
Reverse IP: 228 other sites hosted on this server


ICANN Registrar:  ACTIVE REGISTRAR, INC. 
Registration Service Provided By: 
Active-Domain LLC
.
Domain Name: nuranastudio.com
Expiry Date: 14-Apr-2010
Creation Date: 14-Apr-2009
.
Name servers:
ns1.unixsrv8.com
ns2.unixsrv8.com
.
Registrant Name: Sossi Postajian
Registrant Company: nuranastudio.com
Registrant Email Address: 
Registrant Address: 20224 sherman way apt 48
Registrant City: Canoga Park
Registrant State/Region/Province: CA
Registrant Postal Code: 91306
Registrant Country: US
Registrant Tel No: +1.3135572056
Registrant Fax No:

.
Sossi Postajian was connected to one of the LLC's planned for the us Strawberry Group, and was also used as the registrant for one of Mary Attalla's group of five orange webtemplate fraud sites: »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 02 Jun 2009 13:59:22 EDT

anon : yet another site: »WWW.NURANASTUDIO.COM

Same format as MGD posted a few posts ago. (makewebdiz.com)

Found out about it with a fraudulant charge, then found this forum topic.

Same robots.txt file as always, so no google activity. I filed a ripoff report on it before finding this site.

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Tue, 26 May 2009 19:11:55 EDT

anon : Yep,
That is definitely the site: »wdsstudio.com
and I paid to set up my LLC out of my own pocket, of course they would reimburse me from funds processed into my account.
'Adrian' still thinks I'm a total idiot, he offered to reimburse me for the LLC set up fees...........all he needs now is my bank info!

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 24 May 2009 13:51:09 EDT

MGD :

said by MGD :

A follow up regarding the direct connection between internet HYIP Ponzi fraud schemes and this crime syndicate. In earlier posts I documented a direct connection between the now defunct HYIP largesum.com and the currently active (though not for long) Stoic Capital Management Inc. AKA stoic-capital.com

Both of those HYIPs were having victims wire funds to the exact same accounts and beneficiary as the proceeds from the card fraud laundering operation were going to.
......
..
MGD

Well as predicted and right on schedule, Stoic Capital Management Inc. AKA stoic-capital.com has absconded with all the "investors" funds.

For almost a week now, the main page of stoic-capital.com has this hysterical, humorous, and of course totally bogus alert.

Snapped 2009-05-24 13:30:45

»stoic-capital.com

The fictitious alert capitalizes on the widely circulating references to this thread:

stoic-capital.com

Interim activity moratorium

With apologies to inconveniencies to all parties concerned, we have to declare an interim activity moratorium due to the following events that have recently taken place:

1) Our company has been abruptly targeted by official structures of Europe and the U.S. The attack of Feds was all-embracing, distressful and multi-purposeful; all assets, cash and bonds were seized. All our accounts have been blocked to avoid further in-out market motions with insecured previous deals involved. Our offices sealed, offshore and onshore companies halted. The termination is complete.

2) The basic Federal claim is strong suspicion in money-laundring and indulgence of investors in concurrent and steady tax evasion. In line with the charges moved forward, the offcials demand that we should disclose all investors' pool data, accounts and gains earned through our company's work. Our lawyers have elaborately investigated the issue, and got down to work, so that the privacy of investors, their revenues and rights to utilize their means in the most free way be defended notwithstanding any circumstances engaged. Our company has always been dealing in the stock exchange markets despite underhand plotting of magnates next to certain establishments.

3) The given situation and appeared problems needs some time to take care of. The event has also made impossible the expected investors Congress in the nearest future (all Congress fees already received by us will be returned to available balance as soon as possible).

4) To conclude the given above statement, due to objective circumstances we have to open up interim activity moratorium for new deposits as well as yields and principals up to August 31, 2009. During this period of time, we estimate that our lawyers will settle down the matter, and obtain necessary assent to continue our company's work, so that in short a time we restructure our liabilities in payouts with the help of returned means that are now seized.

5) We would be grateful to all our investors for cooperation who voluntary give us power to disclose their data and required details about all incomes received with the assistance of our company, so that we provide the files to the Secret Service, Postal Service and SEC. Please be informed that you're required to provide the authorization to pay all taxes that are liable therein and confirm the taxes paid already.
For this please e-mail us your account holder authorization in writing signed.

»stoic-capital.com

Rolls over laughing... !!!

..The attack of Feds was all-embracing, distressful and multi-purposeful; all assets, cash and bonds were seized. All our accounts have been blocked to avoid further in-out market motions with insecured previous deals involved. Our offices sealed, ...

The "attack of the Feds", hmmm nothing in the US..
"all assets, cash and bonds were seized" ... it is all in Russia.
"Our offices sealed,".. you mean they put a piece of masking tape over the 4" X 10" mail forwarding box in London ?

Easy to predict that they had reached the maximum potential to collect funds. During the prior two months "investors" who tried to withdraw their deposits, were sent on a delay tactic wild goose chase of having to submit all kinds of identity documents, passports etc., for "verification purposes". Mind you, no such requirements existed to send the money in, usually via some of the most notorious criminal ecurrency providers. That was one of the many signs that it was coming to an end. Fools who submitted identity documents run the risk of having them used for nefarious purposes, least of which will be domain reistrations, or as serious as being used for fronting child porn operations.

Of course Stoic Capital is just one of dozens of these criminals cyber fraud ponzi HYIPs. As current ones come down, the inventpory is replinished with others. Such as:

expressinvest.biz Express Invest International Company which is still under construction:

Snapped 2009-05-24 13:48:05

»expressinvest.biz

Though it already has the identical contact info of the now defunct Stoic Capital:

[Att=1]

quote:
expressinvest.biz

Headquarters:
Golden Cross House,
456-458 Strand,
Westminster London UK
(8AM-5PM, GMT, business days)

Phone: + 44 207 419 5037
(8AM-5PM, GMT, business days)

Fax, voice-mail: + 44 207 900 1905
(24x7)

E-Mail:
support@expressinvest.biz

Mailing address:
Stoic Capital Management Inc
Golden Cross House,
456-458 Strand, Westminster London UK WC2R 0DZ

Legal address:
306 Victoria House, Victoria, Mahe, Seychelles

The "Rinse & Repeat" process, the Russian version of the "419" scam.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 24 May 2009 12:29:20 EDT

MGD : It appears the Crayon Group of fraud sites are still a going concern. New ones are showing up, along with the rebirth of previous "fake suspended" sites.

CheapLates.com 270-282-4535

Snapped 2009-05-24 12:21:42

»cheaplates.com

Company name : CheapLates.com
Phone Number :(270) 282-4535
Email: support@cheaplates.com

[att=1]


ICANN Registrar:  
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
.
Domain Name: CHEAPLATES.COM 
.
Registrant:
    Lince llc.
    Daniel    Lince        (cheaplat@bigmir.net)
    7951 Clark Rd.
    Bath
    Michigan,48808
    US
    Tel. +517.5555123
.
Creation Date: 04-May-2009  
Expiration Date: 04-May-2010
.
Domain servers in listed order:
    ns2.kosmohost.com
    ns1.kosmohost.com

.
Kentucky area code for contact number, and a domain with a Michigan registration. Right off the bat you can eliminate both of those states as the location of the cyber-mule.

A rebirth:

Company name : J&C Stores llc
Company address :3816 Oakhurst Dr.
Phone Number :(970) 372-4551
Email: support@JCTEMPLATES.COM

J&C Stores llc 970-372-4551 formerly JCTEMPLATES.COM is now cheapdiz.com

Snapped 2009-05-24 12:21:23

»cheapdiz.com

Only the domain name has changed:

[att=2]


ICANN Registrar:  
DIRECTI INTERNET SOLUTIONS PVT. LTD. 
.
Registration Service Provided By: 
HIGH QUALITY HOST COMPANY
.
Domain Name: CHEAPDIZ.COM 
.
Registrant:
    Pickett llc.
    David    Pickett        (dickett@mail15.com)
    4700 Terracewood Dr.
    Bloomington
    Michigan,55437
    US
    Tel. +952.8812113
.
Creation Date: 30-Apr-2009  
Expiration Date: 30-Apr-2010
.
Domain servers in listed order:
    ns2.kosmohost.com
    ns1.kosmohost.com

.
I am sure that there are more. The above two are hosted on:

IP 195.190.12.246

195.190.12.246 [reverse DNS - katrin5.kosmohost.net]

Server Data:

Server Type: Apache/1.3.37 (Unix) PHP/5.2.5 mod_ssl/2.8.28 OpenSSL/0.9.7a mod_perl/1.29 FrontPage/5.0.2.2510
IP Address: 195.190.12.246
IP Location - Russian Federation - Kosmohost It Technologies Ltd

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 24 May 2009 11:53:26 EDT

MGD :

said by music man :

Better add this one to the criminals "roll of honour"- >http://alarmwebstudio.com

Snapped 2009-05-24 04:55:45

»alarmwebstudio.com/index.php

...

Nice find !

Domain Name: ALARMWEBSTUDIO.COM
Created on: 15-Jan-09
Expires on: 16-Jan-10

Hard to believe they could even obtain a merchant account. Absolutely no site contact info, no name, no phone number. Domain was registered to the small hosting provider, one of those $5 a month packages. Who knows what name they might have been billing under.

MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 24 May 2009 04:57:20 EDT

music man : Better add this one to the criminals "roll of honour"-»alarmwebstudio.com

Snapped 2009-05-24 04:55:45

»alarmwebstudio.com/index.php

Administrative Contact:
Kumar, Lalit
DT Hosting
3266 Trabuco COurt
San Jose, California 95135
United States
(408) 270-5624 Fax -- (408) 270-5624

Technical Contact:
Kumar, Lalit
DT Hosting
3266 Trabuco COurt
San Jose, California 95135
United States
(408) 270-5624 Fax -- (408) 270-5624

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Sun, 24 May 2009 01:32:52 EDT

MGD :

said by teetimeii :

MGD,
Thanks for your kind words, it does make me feel a little better. ...

You are welcome !

said by teetimeii :

...
The fake front site: »wdsstudio.com was up until a few days ago. It was almost entirely flash, just like the mother site: »worldcreativestudio.com.

So the website assigned to you that the merchant account was to be used for was wdsstudio.com which is NLA, but was identical to, and a clone of, worldcreativestudio.com, correct ? If so, that is unusual as the C&C recruiting websites are usually kept separate from the fake template fraud processing sites assigned to the cyber-mules.

Question: How was the LLC set up costs paid ?.

There are three typical methods used:

1) The cyber-mule pays for the LLC and merchant account set up fees out of pocket, and is reimbursed from the initial fraud proceeds of the card processing.

2) The organized crime syndicate registers the LLC themselves using the cyber-mules credentials, via one of many online registration services. They use prepaid debit cards to pay the fees, which were purchased with previous fraud proceeds. The registration documents are then sent via courier to the cyber-mule.

3) The OCS either sends cash via Western Union / MoneyGram, or the more recent method via PayPal from a Russian ecurrency convertor.

I suspect in your case it may have been #2.

This entire organized fraud operation functions on a multiple hub and spoke basis, where there is always multiple duplicate conduits set up for a given function. That way if any one conduit is quickly cut off, the operational effect is minimal. Lessons learned from the long running exclusive use of the Fethard Finace conduits of Inowest Enterprises, and the Midtown Group.

The info that you have provided so far, has now led to the uncovering of an enitre new design format of fraud charge laundering websites. Does this look familiar?. Here is a full body shot of a new card fraud charge processing website:

The "diz" factor again:

makewebdiz.com »makewebdiz.com

[att=1]

Edit = Add

The usual robots.txt file blocking all search engine archiving of the website:

[att=3]

End Edit

makewebdiz.com
makewebdiz.com
1-(516)-320-6036

Or you can send us email directly: support@hfdiz.com

Snapped 2009-05-24 01:14:57

»makewebdiz.com/contacts.php

That image needs to be distrubted to and posted by merchant account underwriters. Flag on sight !!.


ICANN Registrar: ACTIVE REGISTRAR, INC 
.
Registration Service Provided By: 
Active-Domain LLC
.
Domain Name: makewebdiz.com
Expiry Date: 27-Mar-2010
Creation Date: 27-Mar-2009
.
Name servers:
ns57.1and1.com
ns58.1and1.com
.
Registrant Name: Joseph Blakely
Registrant Company: makewebdiz.com
Registrant Email Address: murphy_joe01@yahoo.com
Registrant Address: 5735 W Montrose Ave Unit 1
Registrant City: Chicago
Registrant State/Region/Province: IL
Registrant Postal Code: 60634
Registrant Country: US
Registrant Tel No: +1.4355188979
Registrant Fax No:

.

The essence of good cyber forensics, leave no stone unturned. Every cyber criminal can ultimately be indentified, no matter where they are, and no matter how smart and sharp they are. These Russian cyber criminals are creatures of habit, follow them closely enough and identify every pattern of behavior. the email contact >murphy_joe01@yahoo.com used for the domain reg of makewebdiz.com must be an address that the criminals have access to in order to coplete the registration process. In fact it is the only part of the registration credential that is guaranteed to be under their control. That contact address has a long history:

quote:
J B Electronics, Inc.
etechdiz.com
1-(505)-999-1311
support@etechdiz.com
Registrar:  GODADDY.COM, INC. 
.
Domain Name: ETECHDIZ.COM
      Created on: 08-Dec-08
      Expires on: 08-Dec-09
      Last Updated on: 08-Dec-08
.
   Administrative Contact:
      Murphy, Edward  murphy_joe01@yahoo.com
      1060 Park Row North
      Atlanta, Georgia 30312
      United States
      (435) 518-8979      Fax -- 
.
Domain servers in listed order:
      NS1.HOSTDONE.COM
      NS2.HOSTDONE.COM
.
Regular readers may remember Mr. Murphy as the cyber-mule who fronted two sites back in earlly 2008 mvwebtemplates.com AKA Most Valuable WebTemplates / MURPHY VENTURES, INC 404-474-3440 and 123gettemplates.com AKA 123GETITDONE, INC 404-474-0491

Another clone:

hfdiz.com »Hfdiz.com

[att=2]

hfdiz.com
hfdiz.com
1-(224)-333-2000

Or you can send us email directly: support@hfdiz.com

Snapped 2009-05-24 01:14:22

»Hfdiz.com/contacts.php


ICANN Registrar:  ACTIVE REGISTRAR, INC. 
.
Registration Service Provided By: 
Active-Domain LLC
.
Domain Name: hfdiz.com
Expiry Date: 10-Apr-2010
Creation Date: 10-Apr-2009
.
Name servers:
ns57.1and1.com
ns58.1and1.com
.
Registrant Name:Evelio Areas
Registrant Company: hfdiz.com
Registrant Email Address: 
Registrant Address: :2710 Sheldon Court
Registrant City: :El Sobrante
Registrant State/Region/Province: :CA
Registrant Postal Code: :94803
Registrant Country::US
Registrant Tel No: +1.7274952168
Registrant Fax No:

.
Note the typical use of a prior recruited cyber-mule's identity to register a new cyber-mules domain for obsfucation purposes. Remember they have his picture ID, which can be forwarded to support the validity of the reqistration if it is flagged. Evelio Areas has no clue that the identity documents which he scanned and and emailed to the Russian organized crime syndicate, along with a utility bill, as part of the application process, will be used for various nefarious purposes, long after his stint as a cyber-mule has expired.

Evelio Areas was the cyber-mule for the orange template Eatemplates.com AKA EA Web Designs 434-878-3659 »Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

quote:
Gayle - 12 Sep 2008
I also had a debit to my banking account for $9.45 to Online Service Group and this month I was tapped $11.49 to someone called MC-EA WEB DESIGNS EL SOBRANTE when I called the bank they told me to call the fraud line and report it and I will get my money back, this seems to be a national problem, and usually these charges are under $15.00.
Caller ID: 188-241-2101
Caller: unknown

Also used as the registrant for:


Sewebtemplates.com 
IP 66.152.173.190
.
Registrant: 
Evelio Areas 
2710 Sheldon Court 
El Sobrante, California 94803 
United States 
.
Registered through: GoDaddy.com, Inc.  
Domain Name: SEWEBTEMPLATES.COM 
Created on: 12-Dec-08 
Expires on: 12-Dec-09 
Last Updated on: 12-Dec-08 
.
Administrative Contact: 
Areas, Evelio evelio_areas@yahoo.com 
2710 Sheldon Court 
El Sobrante, California 94803 
United States 
(702) 446-5062
.
Domain servers in listed order: 
NS1.HOSTDONE.COM 
NS2.HOSTDONE.COM

said by teetimeii :

... I'm only sorry I wasn't aware of this thread earlier, again thanks to the risk manager that forwarded me this link.

I can tell you that the work that is being done at that end, has had the most significant impact to date, on this organized crime syndicate's abilty to launder hijacked card data into cash. Only the interdiction of the foreign wire transfers comes close to matching the effect that these alert and sharp underwriters have had.

MGD