AlfaCor Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
AlfaCor screenshot - 17-Aug-2008
Alfacor screenshot.
This fraud should not be confused with the any other company of the same or similar name - the above website screenshot and the following fraud evidence refer to this company alone and no other.

The AlfaCor scam appears on the face of it to be a pretty standard money laundering mule fraud website, but it isn't - it's the latest alias of the Infobite Software Ltd. criminal fraudsters who try to persuade you to set up your own limited company complete with merchant account for the purposes of laundering stolen funds from credit card fraud on the bogus pretext of a website and website template franchise operation, exactly as before. Thanks to Artists Against 419 (aa419.org) for the heads-up on this one - further details can be found on their website here and here and lots! of information here.

This is the direct replacement operation for the Infobite 'Strawberry' sites fraudster, (so called because the bogus 'franchise' websites supplied by the fraudster all used a distinctive strawberry template).

Exactly as before, the website content is stolen, this time from the genuine Belarus software company ScienceSoft Inc., (that much is obvious), and it is mostly hosted on the Russian host 'WAHOME-DEDIC'  (wahome.ru) with one website on a McColo Corporation IP.

AlfaCor Ltd : Evidence of Site Theft and Criminal Fraud

i) The AlfaCor criminal fraudsters have stolen the website of the genuine ScienceSoft Inc. That much is self-evident and is clear evidence of criminal fraud. The criminals have simply changed the name details, all the location details and added a 'Sales Representative' job under the 'Company' - 'careers' menu option for their money laundering job application form.

ii) On their bogus website 'Management' page they have retained three of the photographs of the genuine ScienceSoft Inc. management team but changed their names. Clear evidence of criminal fraud.

iii) The numerous fraud domains listed below are all very recently registered despite the above homepage claim "Founded in 1989"  - clear evidence of criminal fraud.

iv) Multiple registered domains for the same fraud site - legitimate companies have no need to use multiple domain registrations - clear evidence of criminal fraud.

v) The bogus job has an associated FAQ file, here (.doc), or (.html). You'll notice under "What are your responsibilities before us?" the words:
"- Transfers to the corporate account of the company InfoBite

 (2 times a week: Tuesday, Friday);

  * All costs or fees for transfers are covered by InfoBite." That's a direct link to the criminal's previous Infobite Software alias. - clear evidence of criminal fraud.

These are some of the generic fraudulent replacement templates for the 'Strawberry' template site that are set up for the unwitting mules, (the website name will vary as they register a different domain for every mule). The common link so far seems to be the web template 'business'. (Let me know if you come across any more):

Unopic.net Studio

Alfacor template site screenshot

Design Creative Bureau

Alfacor mule website

24graph.net

Alfacor mule site

24pic.net

Alfacor mule site
The above indisputable evidence clearly demonstrates that the AlfaCor website and the associated money mule websites are a criminal operation set up with intent to deceive. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

AlfaCor Ltd Fraudsters - current hosting details.

Main Domains, Hosts and  Registrars
Domain

alfacor-software.com
alfacor-software.org
alfacor-software.net
alfacor-software.biz

alfacorsoftware.com
alfacorsoftware.org
alfacorsoftware.net
alfacorsoftware.info
alfacorsoftware.biz

alfacoronline.com
alfacoronline.org
alfacoronline.net
alfacoronline.info
alfacoronline.biz

alfacorsoft.net
alfacorsoft.com

 Status

Suspended
Suspended
Suspended
Suspended

Suspended
Suspended
Suspended
Suspended
Suspended

Suspended
Suspended
Suspended
Suspended
Suspended

Suspended
Suspended

 Registrar (Date)

ESTDOMAINS INC  (09-Jul-2008)
ESTDOMAINS INC  (09-Jul-2008)
ESTDOMAINS INC  (09-Jul-2008)
ESTDOMAINS INC  (09-Jul-2008)

ESTDOMAINS INC  (08-Jul-2008)
ESTDOMAINS INC  (08-Jul-2008)
ESTDOMAINS INC  (08-Jul-2008)
ESTDOMAINS INC  (08-Jul-2008)
ESTDOMAINS INC  (08-Jul-2008)

ESTDOMAINS INC  (09-Jul-2008)
ESTDOMAINS INC  (20-Jul-2008)
ESTDOMAINS INC  (20-Jul-2008)
ESTDOMAINS INC  (20-Jul-2008)
ESTDOMAINS INC  (20-Jul-2008)

ESTDOMAINS INC  (20-Jul-2008)
ESTDOMAINS INC  (29-Jul-2008)

 Host

WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC

WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC

WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC

WAHOME-DEDIC
McColo Corporation

 IP Address

92.241.163.12
92.241.163.12
92.241.163.12
92.241.163.12

92.241.163.13
92.241.163.13
92.241.163.13
92.241.163.13
92.241.163.13

92.241.163.12
92.241.163.17
92.241.163.17
92.241.163.17
92.241.163.17

92.241.163.17
208.72.172.211

Mule Domains, Hosts and Registrars
Domain

unopic.net
24graph.net
degpic.net
24pic.net

 Status

Suspended
Suspended
Suspended
Suspended
 Registrar (Date)

ESTDOMAINS INC (30-Jul-2008)
ESTDOMAINS INC (30-Jul-2008)
ESTDOMAINS INC (30-Jul-2008)
ESTDOMAINS INC (13-Aug-2008)
 Host

WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
WAHOME-DEDIC
 IP Address

92.241.163.18
92.241.163.19
92.241.163.20
92.241.163.21

If you've either received an active website link in a spam, or know of an active domain and it is not listed in the domain tables above, then please let us know by reporting it using the 'Report Active Domain' option in the title bar above.
The Spam Content
Copy of fresh spam required, please.
DNS Data - listed domains
How I am searching:

Searching for alfacorsoftware.biz A record at b.root-servers.net [192.228.79.201]: Timed out. Trying again.
Searching for alfacorsoftware.biz A record at e.root-servers.net [192.203.230.10]: Got referral to A.GTLD.biz. (zone: biz.) [took 52 ms]
Searching for alfacorsoftware.biz A record at A.GTLD.biz. [209.173.53.162]: Got referral to NS1.ALFACORSOFTWARE.COM. (zone: alfacorsoftware.biz.) [took 49 ms]
Searching for alfacorsoftware.biz A record at NS1.ALFACORSOFTWARE.COM. [92.241.163.12]: Reports alfacorsoftware.biz. [took 204 ms] Response:
Domain Type Class TTL Answer
alfacorsoftware.biz. A IN 14400 92.241.163.13
alfacorsoftware.biz. NS IN 14400 ns1.alfacorsoftware.com.
alfacorsoftware.biz. NS IN 14400 ns2.alfacorsoftware.com.

Looking up at the 2 alfacorsoftware.biz. parent servers:

Server Response
ns2.alfacorsoftware.com [77.91.231.130]  92.241.163.13
ns1.alfacorsoftware.com [92.241.163.12]  92.241.163.13

The domains & IPs may vary, (all listed above) but the network remains the same - WAHOME-DEDIC (wahome.ru). (IPs as Listed above)
DNS Data - alfacorsoft.com
How I am searching:

Searching for alfacorsoft.com A record at j.root-servers.net [192.58.128.30]: Got referral to D.GTLD-SERVERS.NET. (zone: com.)
Searching for alfacorsoft.com A record at D.GTLD-SERVERS.NET. [192.31.80.30]: Got referral to ns.alfacorsoft.com. (zone: alfacorsoft.com.)
Searching for alfacorsoft.com A record at ns.alfacorsoft.com. [208.72.172.211]: Reports alfacorsoft.com. Response:
Domain Type Class TTL Answer
alfacorsoft.com. A IN 86400 208.72.172.211
alfacorsoft.com. NS IN 86400 ns.alfacorsoft.com.
ns.alfacorsoft.com. A IN 86400 208.72.172.211

Looking up at the 1 alfacorsoft.com. parent server:

Server Response
ns.alfacorsoft.com [208.72.172.211]  208.72.172.211

The host for this domain  McColo Corporation ( 208.72.172.211)
Fraud Blog Initial entry 17th. Aug 2008
***Latest News*** 21-Aug-2008

Mule domains and templates 24graph.net, degpic.net and 24pic.net added - please let me know if you find any more.
***Latest News*** 07-Jul-2009
No further activity known for this fraudster - let me know if you know different - consigned to archive.