dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
94

Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium Member
join:2001-04-19
1970 442 W30

1 edit

Doctor Olds to MGD

Premium Member

to MGD

Re: Ebook websites, fraud charges, Devbill/DigitalAge/Pluto

Interesting read. Thanks for posting that. I remember you posting about the Russian expatriate Am-Ex mules in the Sacramento area that you tried to contact and how they suddenly forgot all of their English skills upon your phone contact.
MGD
MVM
join:2002-07-31

4 edits

1 recommendation

MGD

MVM

On several occasions over the past few years I have awarded the title of the organized crime syndicate's current "longest running card fraud money laundering LLC / website" which is still actively charging. It should also be noted that the award can only be assigned to the "longest known" fraud site. Despite over 6 years and thousands of postings on over a half dozen threads on DSLR, we still only scratch the surface of this massive operation.

I made the mistake back in July of 2009 of assigning that longest running active fraud title to: EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410. At the time, I had presumed that the prior record holder of four and half years of continuous fraud charging, KCSOFTWARECOM LLC aka KCSOFTLLC.COM had been shut down after THIS POST in October of 2008.

Unfortunately, 10 months later in October of 2009, I had to issue THIS RETRACTION when it was discoverd that KCSOFTWARECOM LLC aka KCSOFTLLC.COM.com had continued processing fraud charges and laundering the proceeds out the country as late as Jun 10th, 2009. Since KCSOFTWARECOM LLC aka KCSOFTLLC.COM began operation in March of 2004, that meant they had racked up over 5 years, or half a decade of continuous fraud charging:

»/r0/do ··· tllc.jpg

The corresponding business LLC registration:

»/r0/do ··· _LLC.png

Not long after that, a security insider at a major financial institution went on an intensive hunt to track down the associated business bank account, and have it closed down for fraud and money laundering. There have been no reported fraud charges since that time.

Several days ago when I saw more fraud charging coming in from EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 a 2006 organized crime syndicate's fraud entity, I decided it was time to firmly plant them in the # 1 spot again. I must admit, I am a little gun shy. Though there have been no fraud reports for over 6 months on KCSOFTWARECOM LLC aka KCSOFTLLC.COM, the cyber mule Ms. Kimberly Costanza continues to list it as her occupation:




I do not know about everyone else, but I would be tempted to remove it from my resume, if it had clearly sank in that for over half a decade I had been duped into setting up a card fraud money laundering business entity for a Russian organized crime syndicate:

=================================
Kimberly Costanza’s Experience
owner/partnership
Business Software

(Computer Software industry)

January 2004 — Present (6 years 4 months)

Selling web software design products on the business website in the United States. In partnership with a software company.

=================================




Ref:»www.linkedin.com/pub/kim ··· /6a7/6ba

Just doing a Google search of one's business entity KCSOFTLLC, would return a staggering over 1,400 hits and none of them are from anyone who actually made a legitimate purchase in the 5 plus years. I will agree that it is extremely difficult to comprehend how an individual could remain duped for such an extended period. If you only Googled the name of your fraudulent business entity just once in half a decade, even out of curiosity, what a story it would tell. While you shuttle and launder the fraud proceeds out of the country blissfully ignorant, companies as far away as France with almost identical names are being hounded by defrauded consumers. In August of 2005, in response to another round of fraud complaints in the security forum Snowy See Profile posted a link about the French company kcsoftwares.com, in the third entry here: »$9.95 scam, now from kcsoftllc.com who, at that time had posted an alert due to all the complaints that it was mistakingly receiving:

===========================
About Fraudulent purchases

Many persons have contacted us concerning fraudulent purchases charged on their credit cards with a name very similar to our company's name : KCSOFTWARE.COM LLC (from the United States of America).
We are not such company. We are KC Softwares SARL, based in France.

Charged made by our company are explicitly labeled KC Softwares SARL or Yaskifo. If not then we are NOT the company in cause. We have tried to contact KCSOFTWARE.COM LLC, but without any succes
==========================

The flooding of innocent companies with fraud charge complaints, is, and has been, a recurring issue. In that case the letter "s" was the only distinguishing item. I don't know when Ms. Costanza's LinkedIn page went up, but I do not recall seeing it in the latter half of 2009 when I last conducted a detail audit. So is it possible that a new bank and merchant account were set up for a replacement website for KCSOFTLLC.COM. It is clear to me that there were multiple merchant accounts supporting KCSOFTLLC.COM in the half decade that it existed. I can tell that based on the way victims reported the fraud charges over the years. The quoted line item charge known as a "billing descriptor" varies over the period. Since that bill descriptor is set by the merchant account provider, the most likely reason it changed over time is because the merchant provider changed. In this organized crime syndicate's operation the only reason for multiple merchant account providers is because the prior one gets canceled to excessive charge backs and fraud complaints. That would put KCSOFTWARE.COM LLC in the "Steve John Rogan" of Arizona category. However, it might be unfair to question the reasoning, logic, and intuitive, skills of Ms. Costanza without also including the similar but professional version of those skills at Authorize.net / Cybersource. After all, they were, and are, the preferred and so far as I can tell the sole provider of every payment gateway access for all of the organized crime syndicate's decade long card fraud and money laundering operation.

In any event, and presuming Ms. Costanza has retired from:
..."Selling web software design products on the business website in the United States. In partnership with a software company". ...., I feel it is appropriate to now crown:

EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 as the OCS's reigning longest continuous and still active card fraud laundering operation.


»ebsebooks.com
Snapped 2009-01-26 03:27:06



»ebsebooks.com
Snapped 2009-07-08 13:31:59



»ebsebooks.com/contacts.php
Snapped 2009-07-08 13:31:41



»ebsebooks.com/robots.txt
Snapped 2009-07-08 13:31:23


Although the card fraud charging and laundering of EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 is believed to have began long before this first public report in December of 2007:
quote:
Amanda
28 Dec 2007
Found online that the number belongs to ebsebooks.com AKA Electronic Business Resources 412-927-0410

Ref: »800notes.com/Phone.aspx/ ··· 927-0410

The most recent fraud charge report is from a few days ago, March 31st., on whocallsme.com:
quote:
Mike G
31 Mar 2010
I was reviewing my statement and found a 4.95 charge for which I know nothing. It looks as though I am not the only one being fraudly charged by this company

»whocallsme.com/Phone-Num ··· 270410/4

The first report on that forum is in February of 2008. But we know that the Pennsylvanian cyber mule, Terra Milbourne registered the Electronic Business Resources LLC on February 6th. 2006, which makes it over 4 years old:

»/r0/do ··· sLLC.png

It is also possible that there was a previosu website, as EBSEBOOKS.COM was not registered until May 30th., 2006, then repeatedly renewed, as I am sure it passed all expectations of the organized crime syndicate's longevity:


Registration Service Provided By:
Jaguar Technologies LLC
Contact: sales[@]jaguarpc.com

Domain name: ebsebooks.com

Administrative Contact: ------>FRAUDULENT
-
Richard Stewart (ebsebooks@yahoo.com)
+1.3094077237
Fax: -
910 Freeport Road
Pittsburgh, PA 15238
US

Name Servers:
ns3.jaguarpc.net
ns4.jaguarpc.net

Creation date: 30 May 2006 20:43:47
Expiration date: 30 May 2008 20:43:47
Expiration date: 30 May 2009 20:43:47
Expiration date: 30 May 2010 20:43:47


.

The documented hosting and nameserver activity history shows:

EBSEBOOKS.COM


IP Address History
===================
Event Date Action Pre-Action IP Post-Action IP
======================================================
2006-06-01 New -none- 207.210.81.180
2006-10-14 Change 207.210.81.180 69.73.180.196
2007-04-22 Change 69.73.180.196 69.73.139.29
2007-10-21 Not Resolvable 69.73.139.29 -none-
2008-06-02 Change 69.73.139.29 8.15.231.113
2008-06-04 Change 8.15.231.113 69.73.139.29

Name Server History
===================
Event Date Action Pre-Action Serve Post-Action Server
============================================================
2006-06-01 New -none- Jaguarpc.net
2008-06-02 Transfer Jaguarpc.net Name-services.com
2008-06-04 Transfer Name-services.com Jaguarpc.net

.

The fact that it goes back over 4 years is a reminder of how the Crime Syndicate routinely and repeatedly used jaguarpc.net, for numerous domain registrations and hosting, which is now owned by Landis Holdings Inc, and was once the OCS's preferred provider. In fact a search for "Jaguar" of the entire DSLR records, will produce 3 pages of results all related to this card fraud and money laundering crime syndicate going back to September of 2005

Repeated efforts to track Ms. Milbourne down have failed. The Pittsburgh, PA., website of magicalhandsmassage.com, which once had a listing for a matching name, is now NLA:
quote:
Terra Milbourne received her massage and body work training from the Pittsburgh School of Massage Therapy. While trained in numerous therapies, her area of specialty is Thai Massage, also know as the lazy man's yoga. She comes from a long line of Native American Healers and uses this healing knowledge in massage. Terra is skilled in the use of herbs, essential oils and their healing properties.

Magical Hands Massage · 5817 Forward Ave · 412.422.2284 · M-F 10am - 7pm, Sat 10am - 4pm

Ref: »magicalhandsmassage.com/ ··· are.html

Other digging may indicate that Ms. Milbourne, believed to be in her early thirties, could be related to a famous baseball player from the mid 70's to mid 80's, who played with the Astros, and Yankees, possibly a daughter.

Since the fraud charging and money laundering entity: EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 just passed its 4th birthday, and is now in its 5th year of operation, it really needs to be shut down. The financial system security contact responsible for tracking down and terminating the last know accounts of KCSOFTWARECOM LLC aka KCSOFTLLC.COM, has know begun the process of trying to travk down the associated fraud accounts for EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410. This wizard has developed a sixth sense whereby they can smell the aroma of any of the Organized Crime syndicate's card fraud laundering operations if any related paperwork passes within 250ft of them, regardless of how well disguised it is. However, the task will be significantly easier if a fraud victim can provide the 21 digit ARN (Acquirer Reference Number) of the related fraud charge from EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410. Even the 2nd through 7th digits would be of help.

I will return to EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 in the second post from now as they are uniquely linked to the new card fraud laundering operation that this Organized Crime Syndicate has now morphed into. During the second half of 2009, the overall merchant account fraud detection rate at enrollment time peaked at an all time high. The modus operandi became well know within the system and thus the detection at set up time was significant. Since them the OCS has totally changed the way they operate. They had long ago abandoned the factory servers where over a 100 fraud websites were stashed in various stages of construction and operation. The days of shadowing the operation as they shuttled the production between servers in Australia and the US are no more. The multi year configurations of fake Web Templates, E-Books, Mobile Games, etc are fading fast. They have been replaced with an entirely new genre, designed to co-mingle with legitimate startups and be undetected. Single server hosting scattered individually, all around the globe, along with the strategy of reducing the monthly fraud throughput per site by 50% has produced an entirely new operation totally unlike the prior history. Though the output per unit is dropped to avoid detection and complaints the number of performing units has been increased to compensate. We will return to this rebirth facade, and how the 4 plus year EBSEBOOKS.COM aka Electronic Business Resources 412-927-0410 fraud operation is directly linked to it.

But next we will head over to the UK and take a peek at a database of the new matching recruiting operation ...

MGD
music man
Premium Member
join:2008-08-12

music man

Premium Member

Good work fella!!!

You mentioned the UK!! You have my full attention!
MGD
MVM
join:2002-07-31

2 edits

1 recommendation

MGD

MVM

Actually the reference to the UK was not that any new operation had been uncovered there, it was a reference to the excellent work that bobbear.co.uk is doing with respect to uncovering, exposing, and closing down many of the organized crime syndicate's recent recruiting websites. As you may know the volunteer group bobbear.co.uk »bobbear.co.uk has served as a collection point, a central database, and global resource on mule recruiting of all kinds. I frequently collaborate with Bob and have confirmed mule recruiting websites that are ran by this organized crime syndicate.

Recently Bob has been instrumental in uncovering several of this crime syndicate's latest recruiting operations. Many potential mule recruits who have resumes posted at Careerbuilder.com have contacted bobbear.co.uk after being solicited by the criminals. Potential mules who were suspicious of the solicitations, and contacted bobbear after searching and finding similarities between their correspondence and existing data on bobbear.co.uk.

This collaboration has yielded clues as to the OCS's new operational strategy and tactics. Those clues combined with other pieces of evidence gathered elsewhere, tell the story of the the organized crime syndicate's new and emerging tactics. As I mentioned in an above post in the second half of 2009 the criminals were fettered by an increasing level of early detection of the fraudulent merchant accounts and associated operation. This growing failure rate prompted the syndicate to significantly alter their operation. The fraudulent front websites which are a cover for the card fraud laundering, are no longer hosted in clusters, but are distributed individually across the globe. In addition, to almost eliminate any victim group collection of fraud reporting, and thus uncovering, they have reduced the amount processed monthly by each card fraud website. That reduction has been compensated for by increasing the total number of active fraud processing sites. The survival benchmarks are the ebsebooks.com, cheapestthemes.com, kcsoftllc.com. The strategy is to return to a virtual stealth mode of card fraud laundering where the noise levels are so reduced and dispersed that once again no one will be aware that there is a massive fraud operation taking place. The keystone of this new strategy is to diversify the fake websites from intangible products, into appearing to sell real products, thus making merchant account flag filtering at application time even more difficult. This new genre of themed websites can now be exposed.

Bobbear.co.uk uncovered the third mule recruiting website in the trilogy of the China based "Toy manufacturing" fake front. First it was Tetronix toys Ltd aka Tetronixtoys.com who were carpet bombing Careerbuilder with job adds supporting the Crayon Group. Then came the identical clone Que toys Ltd aka quetoys.com which attempted to create an instant established history by mass seeding posts with a Russian bot crawler script, and also flooded Careerbuilder with job adds. The third identical version came complete with multiple actual real press to seed a fake history of joint ventures and Santarex Toys Ltd aka santarextoys.net was uncovered and neutered by Bobbear.co.uk.

=====================================

Tetronix toys Ltd Tetronixtoys.com

Company name: Tetronix toys Ltd
Company address:49/F, World Trade Centre,
280 Gloucester Road, Causeway Bay
City:Hong Kong
Country: China
E-mail: info@Tetronixtoys.com
=====================================

Que toys Ltd www.quetoys.com

Company name: Que toys Ltd
Company address: 23,Harbour Road, Wan Chai
City: Hong Kong
Country: China
E-mail: info@quetoys.com
=====================================

Santarex Toys Ltd www.santarextoys.net

Company name: Santarex Toys Ltd
Company address: Worldwide Executive Centre,
9/F World-Wide House, 19 Des Voeux Road Central
City: Hong Kong, China
Phone: +852 8120 3741
E-mail: info@santarextoys.net
=====================================





Cyber-mule jobs are by invitation only !! you will not just "run across" the fake website, or find in any job searching:


..........
.....
..
We plan to develop a network of sales through our own Internet shops
with help of Sales Representative / Project Manager. We have developed
the necessary marketing strategy. Main duty of a Sales Representative
will be the organization of sale strategies for the products. Our
company is already working on a reliable plan; and, all we need is a
partner whom we can trust.

Please, check the requirements for the job below, and decide if it
works for you:

-Age: must be over 21 years;
-References: positive feedback from the previous employer (possibly
from the last one);
-Knowledge: good or deep knowledge of Word, Excel. Internet Explorer;
-Personal Qualities: communicative, responsible, self-motivation and
self-development;
-Transportation: having a personal car would be a plus;
-You will need to open a company in the state of your residence; it
maybe a LLC, or any other kind of company.

Furthermore:
It can be considered as a part-time employment;
Salary: we have 2 options (from which you will need to choose one variant.):
1. $2,000 USD fixed per month
2. 10% commission on each sale.

You can work with us in parallel with the main activities you have. We
will discuss all the details more once you accept the offer. Also, we
are willing to work around your schedule so that you have more time to
spend with your family. And, the most important part, you are not
required to investment your own funds; all costs are covered
by the company.

I'm looking forward to hearing from you soon.

--
Best Regards,
Alexander Kalmanovsky,
HR Manager,
Santarex Toys Ltd.
Bogus Press Release actually sent out on the paid wire service by the organized crime syndicate:




The Fake fraudulent PR was even picked up by Fidelity Investments: »eresearch.fidelity.com/e ··· s&gic=25
This seeding of enews to create a searchable bogus history, aimed at duping victims who think they are performing due diligence is becoming commonplace in organized cyber crime.

Though santarextoys.net was displaying a cloaked privacy domain registration:


Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM

Registration Service Provided By:
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098
Domain Name: SANTAREXTOYS.NET

Registrant:
PrivacyProtect.org
Domain Admin (contact@privacyprotect.org)
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 09-Nov-2009
Expiration Date: 09-Nov-2010

Domain servers in listed order:
ns2.echo-host.com
ns1.echo-host.com


IP Location: Russian Federation Moscow For Mediasoft Expert Ltd
Resolve Host: c002n01.zahost.ru
IP Address: 88.212.201.90

When you lift up the privacy cloak and look under:


Domain Name: SANTAREXTOYS.NET

Registrant:
HOLT llc.
SHAWN HOLT (isaactimidvj@hotmail.com)
45 Quail Trail
Buxton
Maryland,04093
US
Tel. +145.789807

Creation Date: 09-Nov-2009
Expiration Date: 09-Nov-2010

Domain servers in listed order:
ns2.echo-host.com
ns1.echo-host.com


There was a backup .com domain waiting in the wings SantaRexToys.COM:


Registration Service Provided By:
HIGH QUALITY HOST COMPANY
Contact: +1.6462130098

Domain Name: SANTAREXTOYS.COM

Registrant:
Cooper llc.
Brian Cooper (zombaklinevat@hotmail.com)
480 Etowah Drive
Cartersville
Georgia,30120
US
Tel. +168.7098790

Creation Date: 04-Nov-2009
Expiration Date: 04-Nov-2010

Domain servers in listed order:
ns3.netter.ru
ns1.netter.ru

IP Location: Russian Federation St. Petersburg Ooo Company Delfa
Resolve Host: 156.10.arpa.delfa.net
IP Address: 193.124.10.15

Thanks to the great work at Bobbear.co.uk, both domain names were subsequently suspended by the registrar:

Domain servers in listed order:
ns2.suspended-domain.com
ns1.suspended-domain.com

More fraud mule recruit websites and the new webface versions of card fraud laundering sites to follow

Also, Canadian residents beware ... active recruiting of cyber mules in CANADA is back. There ..IS .. was at least one active card fraud laundering website fronted by a Canadian cyber mule.

Last known active Canadian cyber-mules for the OCS was in 2006 and 2008.

MGD