 MGDPremium,MVM join:2002-07-31 kudos:9 1 edit | Job Scam: SWISSIT.BIZ aka Swiss Internet Trading = FRAUD Kudos to bte52 for the "heads up" on a recent recent careerbuilder.com resume hit for a money mule laundering job proposal.
Swiss Internet Trading Avenue Wendt 17 1203, Geneva, Switzerland
FRAUD DOMAIN= swissit.biz
swiss.itrading@gmail.com
Alias= Mark Braun mark.braun@swissit.biz
Fake Website at »swissit.biz is 100% flash so there is nothing to archive or pull a dslr screen shot from. Amazing that these eastern European cyber criminals are still mesmerized by last decade web 1.0 flash.


First unsolicited contact:
Received: from smtp102.prem.mail.ac4.yahoo.com ([76.13.13.41]) by vms172047.mailsrvcs.net (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008; 32bit)) with SMTP id for REDACTED; Wed, 25 Mar 2009 09:23:37 -0500 (CDT) Received: (qmail 21687 invoked from network); Wed, 25 Mar 2009 14:23:36 +0000 Received: from unknown (HELO user2) (swiss.itrading@69.123.189.244 with login) by smtp102.prem.mail.ac4.yahoo.com with SMTP; Wed, 25 Mar 2009 14:23:35 +0000 Date: Wed, 25 Mar 2009 06:25:05 -0800 From: "=?windows-1251?B?TWFyayBCcmF1bg==?="
Subject: Job Offer
X-Originating-IP: [76.13.13.41] To: "=?windows-1251?B?RURXQVJEIEJMQUNLQlVSTg==?="
Reply-to: swiss.itrading@gmail.com Message-id: Organization: Swiss Internet Trading MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Mailer: Microsoft Outlook Express 6.00.2600.0000 Content-type: multipart/alternative; boundary="----=_NextPart_000_0087_01C2A9A6.34A3270E" X-Priority: 3 X-MSMail-priority: Normal
Greetings,
Your resume has been found at www.careerbuilder.com as a match to our criteria. We'd like to offer you a position in our company. Please respond to this e-mail if you're still interested in finding a job. I'll be happy to give you more details.
Mark Braun
In order to hide the true origin of the email, they sent it from a paid Yahoo account and logged in via a hijacked computer in New york. That compromised IP is being used as a socks proxy. That hijacked computer is located in Long Island, NY on the Verizon Cablevision network 69.123.189.244 [ool-457bbdf4.dyn.optonline.net]
That IP shows up twice on a Socks proxy list for port 47149, posted by someone from Iran: »74.125.93.104/search?q=cache:KFq···nk&gl=us
Familiar with this scam format bte52 sends a follow up that generates this response:
Greetings,
Thank you for your letter and your interest to our company. Here I would like to tell you some words about us, our company and what we deal with. I would like to notice that there will be a lot of important information in this letter for you so please read it very attentively and if you have some questions feel free to ask. As you know our company is called Swiss Internet Trading and our headquarters is situated in Switzerland. We specialize on purchase and resale of products in such industries as following: Electronics, Chemical Products, Expensive Construction Materials, IT-products and others. The field of our activities includes the distributed networks consisting of the international auctions as on the Internet and locally. Using our networks we usually receive new orders both for purchase and for sale. Now we require Payment Processing Manager in the countries where we conduct our business through our branches.
Payment Processing Manager will deal with the receiving companys financial assets to his work bank account and forwarding that funds following our instructions. He will be receiving payments from our customers and forwarding that payments to our representatives or to the seller directly.
There are 2 reasons we started looking for new employees:
1. Because of the high quality of services provided by the Swiss banks and a great demand for these services in the field of financial assets storage, Swiss laws that regulate financial sphere are too exact and strict and there exist inconvenient rules and high commission fees for bank transfer services. This helps to secure and protect financial assets but it is very inconvenient for conducting trading business.
Our counsellors from International Financial and Law Consulting House: PricewaterhouseCoopers offered us the way out: the Agency agreements with representatives in the countries of business dealing for cooperation on the basis of the commission rate.
2. As we mentioned above, we conduct the international business transactions and that's why our activity includes regular financial streams. So the second reason for opening new vacancies in our company is the speed of acceptance of payments for our services to the bank accounts of our Managers in the country where the buyer lives. Usually after that funds should be forwarded to other our partners as payment for the services or in order to purchase the necessary items. That program allows us to work with streams of funds fast and to send them where we need without HIGH COMMISSION FEES and LONG TIME TRANSFER EXPENSES of the SWISS BANKS.
Also we need Managers help because if we had used international bank transfer it could take more than 3-5 days, but if the payment is sent to a bank account in the same country it takes just one business day.
If we work this way we will be able to speed up payment process and moreover we can deliver the items to the customers much more quickly than our competitors do. We are sure that you understand how important this for us and our business when all our clients are satisfied with our work.
Manager will receive 10% from the amount that will be successfully forwarded to the receiver. The manager can take his 10% commission immediately after the amount has been received. Usually we make 2-3 payments a week.
This kind of cooperation does not mean that you will get the transactions on your account constantly. The procedure described helps us to find a reliable, fair and responsible person for further cooperation. First we suggest you to go through a trial period to become acquainted with us and our business. This way of cooperation is very simple, and you will be well paid for this work.
During the first month your salary will be about $3,000, and then it will be increasing for about $500 each month up to $8,000 per month. The trial period in our company lasts for 2 years. After that we will offer you a new position of Project Manager and your salary will be $2,5k/week.
To do this work you don't need any special education or experience. But we want to underline that we need only honest, responsible and reliable people. You will have to transfer the funds you will get within 12 hours after the moment the funds arrive on your account. Payment inquires and notifications will be sent you beforehand and funds will be transfered to your account only when you confirm getting all the details. If payment is delayed for more than 12 business hours the agents commission will be cancelled and the funds should be sent without any revenue for agent. If the payment is delayed for more than 24 business hours the contract with agent will be terminated also and if the payment is not sent within 48 business hours police and authorities will be involved.
All the information you will provide us with will be used for our cooperation only and we will not disclose it to the 3rd parties or companies with the exception of your account number that will be sent to our customers for issuing payments to it. You can open new bank account if you want or use an existing one.
If you are interested and wish to try to work with us feel free to send us an email to mark.braun@swissit.biz and we will send you the Application Form. Just fill the form and send it back to us.
If you have any additional questions just drop an e-mail to mark.braun@swissit.biz . Thanks for reading our proposal. We hope that you are interested and we are looking forward to hear back from you.
Sincerely, Mark Braun Swiss Internet Trading E-mail: mark.braun@swissit.biz Web Site: www.swissit.biz
The above appears to be a plain money mule job, where they would forward funds from hijacked bank accounts into yours. Then have you withdraw it in cash and forward it.
However when pulling site screen shots and altering the resolution of the images in the careers section, this caught my eye:

specifically this portion, blown up:

Obviously the site doesn't match to the current proposal, dual mode criminals who forgot which version they were recruiting for.
MGD |
|
 pcdebbRIP dadkinsPremium join:2000-12-03 Brandon, FL kudos:4 | nice catch 
it was hard to pay attention to that long drawn out email tho -- | map your city | |
|
 AVDRespice, Adspice, ProspicePremium join:2003-02-06 Onion, NJ | just a small correction: optonline.net is cablevision, not verizon. |
|
 Smith6612Premium,MVM join:2008-02-01 North Tonawanda, NY kudos:21 | Was just about to mention that...
Betting whoever's PC just got owned there must be plugged directly into the cable modem :P |
|
 MGDPremium,MVM join:2002-07-31 kudos:9 | reply to AVD
said by AVD:just a small correction: optonline.net is cablevision, not verizon. said by Smith6612:Was just about to mention that... ... Thanks, corrected. That compromised IP is also listed as having an anonymous socks proxy on port 30863 as well as the port 47149.
Also the fraud domain swissit.biz is hosted at 216.239.138.9 [reverse DNS - 216-239-138.9.cluster.omnis.com]
and has a bogus, probably carded, domain registration:
Whois Record Domain Name: SWISSIT.BIZ Domain ID: D30294056-BIZ Sponsoring Registrar: ENOM, INC. Sponsoring Registrar IANA ID: 48 Domain Status: clientTransferProhibited Registrant ID: EE34455CE113C4BC Registrant Name: Debbie Carter Registrant Organization: Swiss Internet Trading, Inc Registrant Address1: 3560 Hopkins Road Registrant City: Powder Springs Registrant State/Province: GA Registrant Postal Code: 30127 Registrant Country: United States Registrant Country Code: US Registrant Phone Number: +1.9418272326 Registrant Email: DebbieeCarter@yahoo.com Administrative Contact ID: EE34455CE113C4BC Administrative Contact Name: Debbie Carter Administrative Contact Organization: Swiss Internet Trading, Inc Administrative Contact Address1: 3560 Hopkins Road Administrative Contact City: Powder Springs Administrative Contact State/Province: GA Administrative Contact Postal Code: 30127 Administrative Contact Country: United States Administrative Contact Country Code: US Administrative Contact Phone Number: +1.9418272326 Administrative Contact Email: DebbieeCarter@yahoo.com Billing Contact ID: EE34455CE113C4BC Billing Contact Name: Debbie Carter Billing Contact Organization: Swiss Internet Trading, Inc Billing Contact Address1: 3560 Hopkins Road Billing Contact City: Powder Springs Billing Contact State/Province: GA Billing Contact Postal Code: 30127 Billing Contact Country: United States Billing Contact Country Code: US Billing Contact Phone Number: +1.9418272326 Billing Contact Email: DebbieeCarter@yahoo.com Technical Contact ID: EE34455CE113C4BC Technical Contact Name: Debbie Carter Technical Contact Organization: Swiss Internet Trading, Inc Technical Contact Address1: 3560 Hopkins Road Technical Contact City: Powder Springs Technical Contact State/Province: GA Technical Contact Postal Code: 30127 Technical Contact Country: United States Technical Contact Country Code: US Technical Contact Phone Number: +1.9418272326 Technical Contact Email: DebbieeCarter@yahoo.com Name Server: NS1.OMNIS.COM Name Server: NS2.OMNIS.COM Created by Registrar: ENOM, INC. Last Updated by Registrar: ENOM, INC. Domain Registration Date: Wed Mar 11 18:39:17 GMT 2009 Domain Expiration Date: Wed Mar 10 23:59:59 GMT 2010 Domain Last Updated Date: Thu Mar 12 14:01:04 GMT 2009
.
MGD |
|
|
|
 | reply to MGD Thanks again for the heads up and good work. Really appreciated all your info, was very interesting to read. Keep up the good work CR |
|
 MGDPremium,MVM join:2002-07-31 kudos:9 | said by huskierph :
Thanks again for the heads up and good work. Really appreciated all your info, was very interesting to read. Keep up the good work CR Your post surprised me !!, I checked a few hours ago and Google had not archived it yet. In fact there was no mention of these cyber criminals.
I just re checked sinced you posted:

You are welcome, getting the word out fast is a good way to neuter these money laundering job scams. At least until they rinse and repeat under another name.
MGD |
|
 MGDPremium,MVM join:2002-07-31 kudos:9 | reply to MGD Before SWISSIT.BIZ aka Swiss Internet Trading these criminals were: USTGROUP.BIZ aka United Swiss Trading Group

Also a fraudulent domain registration »whois.domaintools.com/ustgroup.biz
Screenshot courtesy of the excellent fraud watch site: bobbear.co.uk who appears to have ben instrumental in having them shut down, see: »www.bobbear.co.uk/united-swiss-t···oup.html
quote: The host for this domain is the currently unresponsive host Yahoo on IP address 68.180.151.74 . They are so unresponsive that they are effectively accessories to these criminals. -------------------------------------------------------------------------------- ***Latest News*** Initial entry 25th. Feb 2009
-------------------------------------------------------------------------------- ***Latest News*** 11th. March 2009 News from Simon Bear - Yahoo have finally disabled the domain ustgroup.biz. Please notify me of any active domains for this criminal
Will send a heads up.
MGD |
|
 MGDPremium,MVM join:2002-07-31 kudos:9 | reply to MGD Before these eastern European cyber criminals were SWISSIT.BIZ aka Swiss Internet Trading and prior to USTGROUP.BIZ aka United Swiss Trading Group they were also operating a fraud recruiting operation as Geneva Financial Trading Group using a contact of lewis.gftg@gmail.com. There are reports from September of 2008, of the same identical solicitation made to individuals who had resumes posted on Careerbuilder.com. Geneva Financial Trading Group used the same fake address common to the other two:
Geneva Financial Trading Group Phone: Fax: Avenue Wendt 12, 1203 Geneva Ch-1203, Internet, Switzerland
See Ripoffreport filing: »www.ripoffreport.com/reports/0/3···6010.htm
and
»noworkerleft.blogspot.com/2008/0···oup.html
This is clearly a long running criminal enterprise that is constantly soliciting victims on careebuider.com, and presumably elsewhere. They just rotate new websites and names, after alerts are posted and hosting is revoked.
MGD |
|