Adriatic Finance Services scam

Adriatic Finance Services Fraud

Don't Bear Internet Fraud

Adriatic Finance Services screenshot (Stolen Website) - 12-Aug-2009

Adriatic Finance Services screenshot - 12-Aug-2009

This fraud should not be confused with any other company of the same or similar name - the following fraud evidence defines and refer to this fake company alone and no other. The above website has been stolen from the legitimate company Sentry Financial Corporation - clear evidence of criminal fraud in itself.

Adriatic Finance Services is a 'Rockphish' serial fraud consisting of a fake financial site used as a vehicle to legitimise a money laundering fraud job scam. The only reason it looks so glossy and professional is because the website content has been stolen in its entirety from the website of the genuine financial organisation Sentry Financial Corporation. It's not the only scam website this fraudster has produced using an identical MO. He has previous aliases of Paramount Finance, First Rate Finance, World Finance Group, Zeus Financial Group and many, many others. This fraud is a clear follow-on fraud to the the Range Financial Corporation scam, using exactly the same stolen website.

The initial website fraud domain adriaticfinance.com was only registered with Bizcn.com on 12-Aug-2009 and the crook has no web presence at all, (not to be confused with genuine Australian company of the same name whose identity the criminal has stolen). The website is zombie botnet hosted which irrefutably defines it as a criminal website - no legitimate website is zombie botnet hosted. Reverse IP data on the zombies show it to be a 'Rockphish' operation without doubt and it uses the same zombies as other 'Rockphish' scams such as the Global Shipping Agency Ltd fraud. Their contact telephone number used, (+61 03 8648 5842), is the same as used for another 'Rockphish' fraudster - Toll Finance. All absolutely irrefutable evidence of fraud.

Evidence of Criminal Fraud:

i) Zombie botnet hosted: First and foremost, this criminal fraud site is hosted on a 5-IP 'FastFlux' 'Rockphish' zombie botnet as clearly evidenced by the DNS data. As no legitimate site is hosted on a zombie botnet this site is irrefutably defined as criminal. The zombies involved are also hosting other 'Rockphish' frauds such as the Global Shipping Agency Ltd scam. Reverse IP data on the zombies involved shows other hosted 'Rockphish' domains and phishing URLs.

ii) Stolen website: It is perfectly obvious that the Adriatic Finance Services criminals have stolen their entire fraud site from the genuine Sentry Financial Corporation and modified it for their own fraud purposes by adding a fake "Payment Protection" menu option that leads the potential mule into their web of deceit and ultimately into criminal activity. A lot of the site they haven't bothered to modify, for instance on their 'Contact Us' page you will see the same members of staff as on the genuine Sentry Financial Corporation 'Contact Us' page - clear evidence of site theft and fraud.

iii) As the Adriatic Finance Services criminals have stolen the website from the genuine Sentry Financial Corporation, the content has no real relevance, but although the text from the About Us page says they have been in business since 2007, the fraudster's domain adriaticfinance.com was only registered with Bizcn.com on 12-Aug-2009 for the usual 'criminal's domain' 1 year minimum period. Clear evidence of fraudulent misrepresentation.

iv) Serial fraudster - this is clearly the Range Financial Corporation scam under a new name.

v) As is usual for these criminals, a Google search shows that they have no internet presence at all despite the claim on their 'About Us' page to have been "incorporated in 2007". Do not confuse the criminals with a genuine Australian company of the same name whose identity these crooks have stolen as is their normal practice.

vi) The Spam:

Adriatic Finance Services Pty. Ltd.
61 Price Street,
Nerang,
QLD,
4211,
Australia

Hello, my name is Jack Iverson and I am Adriatic Finance Services Pty. Ltd. Staff manager.
We have found and reviewed your CV at Totaljobs job board and decided to offer this job to you.

Our services

When buying-selling operations via the Internet are concerned, the buyer
and the seller don�t know each other and are placed in different corners
of the world. Therefore, it is important both to the buyer and the seller
or their transaction to be made safely. Payment Protection means
receiving money, documents, goods (it might be both the seller�s and the
buyer�s) concerning the transaction by a reliable, experienced, impartial
person - our Payment Protection agent. The agent will hold all the money
and documents until all the terms of the deal are satisfied and only then
release them to the intended receiver. Please, visit our web-site for more
information.
(http://www.adriaticfinance.com/)

Why we need Payment Protection agents

Having a Payment Protection agent in every country we can quickly transfer
funds inside a country without wasting time on the international bank
transfers, and continue our rapid growth rather than overwhelming our own
bank account with inbound and outbound transactions leading to severe hold
times and possible service interruption. It is time that is of significant
importance to our clients.

Career and Benefits

Your main task will be receiving money transactions to any bank account
you would like to use for the purposes of this job; and then forwarding
these transactions to the next party of the Payment Protection process
according to our instructions. You will benefit from the commissions,
which are 5-7% of each transaction and depend on the quantity of the
completed transactions and the speed of your work. Besides, you will be
paid a basic salary of 1500 GBP per month. For your convenience there will
be no paychecks, your commission will remain in your account after every
successfully completed transaction. The money transfer fee is not included
in your commission, meaning that you will deduct it from the received
amount, not from your commission. Also you receive 5-7% of the transaction
amount. Normally the amounts that we process vary from 2,000 GBP to 10,000
GBP, but can go higher on special occasions.

Job details

As the financial activity in your area is not too high, a Payment
Protection agent will be processing approximately 1-2 transactions per
week. Each transaction requires approximately 4-5 hours of the agent work.
Our manager always calls the agent beforehand to provide all the
instructions. Therefore, with the due time management, the agent is able
to combine this job with other activities (e.g. primary job or studies).

If you are ready to proceed, please provide your AVAILABLE phone number to
our hiring manager (Charles McAlister) at staffmanager@adriaticfinance.com

Please do not hesitate to contact us if you need more information.

--
Sincerely yours,
Jack Iverson,
Adriatic Finance Services Pty. Ltd.
visit us at http://adriaticfinance.com/

vii) You do not get a clearer definition of the illegal part time money mule function: "Your main task will be receiving money transactions to any bank account you would like to use for the purposes of this job; and then forwarding these transactions to the next party of the Payment Protection process according to our instructions", i.e. transferring them on via Moneygram or Western Union less a percentage commission - that on its own defines the company without doubt as criminal and bogus and is clear evidence of criminal fraud. It is also a more or less identical spam to the criminal's previous identical alias, the Range Financial Corporation fraudster and others.

viii) No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas. It will get your bank account and your assets frozen and could well earn you a criminal record - do not be tempted.

ix) Fake 'Contact Us' Details from website:

Adriatic Finance Services
61 Price St, Nerang,
QLD, 4211, Australia

Phone: +61 03 8648 5842
Fax: +61 03 8648 5842

• - A Google search for the address "61 Price St, Nerang" shows no sign of these criminals at that address, ignoring their own fake website, of course.
• - A Google Maps business search for the address "61 Price St, Nerang" shows these criminals are not listed as a business at that address.
• - A Google search for the Australian telephone number "03 8648 5842" shows that it is also being used for another 'Rockphish' fraud - the Toll Finance fraudster at a completely different fake address.
• - The telephone number +61 03 8648 5842 is a new Melbourne number, not a Nerang number, (City code 03 8).
• - They are displaying a single phone and fax number - a large financial organisation would not have a single phone and fax number.

All absolutely irrefutable evidence of fake contact/location details.

The above evidence clearly demonstrates beyond any doubt that the Adriatic Finance Services website has been set up very recently by 'Rockphish' money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Main Website Domains

adriaticfinance.com

Registrar

Bizcn.com, Inc. - 12-Aug-2009

Botnet Nameserver Domains

voda-fon.com

Registrar

RANGER REGISTRATION (MADEIRA) LLC. - 21-jul-2009

Nameserver Host

WholeSale Internet, Inc./Hosting Ventures, LLC

Host IP

69.197.142.240

Active
Suspended/Disabled
Parked

The Zombie Botnet DNS Data (Valid for domain adriaticfinance.com)
DNS Lookup: adriaticfinance.com A record
Searching for adriaticfinance.com A record at g.root-servers.net [192.112.36.4]: Got referral to F.GTLD-SERVERS.NET. (zone: com.)
Searching for adriaticfinance.com A record at F.GTLD-SERVERS.NET. [192.35.51.30]: Got referral to ns2.voda-fon.com. (zone: adriaticfinance.com.)
Searching for adriaticfinance.com A record at ns2.voda-fon.com. [146.30.45.31]: Timed out. Trying again.
Searching for adriaticfinance.com A record at ns1.voda-fon.com. [69.197.142.240]: Reports adriaticfinance.com.
Response:

Domain	Type	Class	TTL	Answer
adriaticfinance.com.	A	IN	1800	201.139.69.221
adriaticfinance.com.	A	IN	1800	74.3.203.93
adriaticfinance.com.	A	IN	1800	88.161.134.125
adriaticfinance.com.	A	IN	1800	89.229.198.123
adriaticfinance.com.	A	IN	1800	190.142.81.114
adriaticfinance.com.	NS	IN	1800	ns2.voda-fon.com.
adriaticfinance.com.	NS	IN	1800	ns1.voda-fon.com.
ns1.voda-fon.com.	A	IN	1800	69.197.142.240
ns2.voda-fon.com.	A	IN	1800	146.30.45.31

Looking up at the 2 adriaticfinance.com. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.voda-fon.com [69.197.142.240]	190.142.81.114 201.139.69.221 74.3.203.93 88.161.134.125 89.229.198.123
ns2.voda-fon.com [146.30.45.31]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the criminal owned nameserver ns1.voda-fon.com hosted by WholeSale Internet, Inc./Hosting Ventures, LLC
on IP address 69.197.142.240 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT/NSLOOKUP). See The Zombie Botnet 'Host By Proxy' for an explanation of this method of hosting.

***Latest News*** 12th. August 2009
Webpage created

***Latest News*** 22nd. August 2009
News from Simon Bear - the domain adriaticfinance.com has been suspended - please notify me of any active domains for this criminal.