company should not be confused with any other company that happens to
bear a similar name. This fraudulent company is identified by the
website graphics and the money laundering mule job it spamvertises.
Group Inc. :
of Criminal Fraud
claims on their website to have been "The company
was set up in 2001 in Montgomery, the USA by three enthusiasts having
financial education.", but the
criminal's domain renca.biz was only registered with OnlineNic,
(Rustelecom), on November the 20th. 2007. ii) The only Google hits
for "DES Group Inc." are as scammers and
iii) Similar website texts are used as on all the other
fraud sites listed above.
v) Of the numerous 'jobs'
on their website, this 'job' of 'TRANSCATIONAL OPERATOR'
(sic) and this one of 'COURIER' are the only two available.
One is the usual obvious (dyslexic) money mule job and the other is a
stolen goods laundering job. The Jobs:
vacancy is valid for American and Australian citizens ONLY at the
Location: USA, statewide Status: Opened Employee Type: Part-Time Employee
Transaction Operator is responsible for receiving and
transfers from participants of deals and completing those transactions
in accordance with the specified method. The detailed operational
scheme is available at request.
Competent management of payments and transfers between the
company and our clients;
Knowledge of the main payment systems;
Working schedule optimization skills;
Commit to be available to work 3-4 hours per day ;
PC, Internet, E-mail advanced skills;
Benefits of working for our company:
10% commission from each transaction (immediate payments
prorated from the total amount of payments)
In other words, just your
usual money laundering mule position and stolen goods fencing positions.
vi) What sort of
financial company is going to spamvertise
for "TRANSCATIONAL OPERATOR" among the untrained, inexperienced and
uncertified general population? I think we
all know the answer to that one.
evidence clearly demonstrates beyond any doubt that the DES
Group Inc. website has been set up by money laundering
fraudsters purely for
purpose of spamvertising an illegal money laundering 'mule' job. If you
are an abuse team that has received an abuse
report regarding these fraudsters, please
termination of their services in view of the absolutely undeniable
criminal money laundering activity and
spamming - please don't delay - these criminals will not
respond to any communication from you, (all their whois data is false),
but will simply take advantage of any attempt
at communication as a delaying tactic to allow them time to carry on
their criminal activity and prepare
Group Inc. Fraudsters -
current hosting details
Current Main Domains, Hosts
SoftLayer Technologies Inc.
See table below for the full
list of known active & suspended main domains used by
Please notify me of any other current domains used by this criminal.
Current Botnet Nameserver Domains
Not botnet hosted at present -
DNS data below.
See table below for the full
list of known active & suspended nameserver domains for this criminal.
Fresh spam required, full source code please or as an attachment. The
Fresh spam required, full source
code please or as an attachment.
The Zombie Botnet
The criminal as not using a zombie botnet at this time. Normal DNS Data
below. Initial DNS Data
How I am searching:
Searching for des-group.com A record at g.root-servers.net
[220.127.116.11]: Got referral to G.GTLD-SERVERS.NET. (zone: com.) [took
Searching for des-group.com A record at G.GTLD-SERVERS.NET.
[18.104.22.168]: Got referral to ns1.saitland.org. (zone:
des-group.com.) [took 53 ms]
Searching for des-group.com A record at ns1.saitland.org.
[22.214.171.124]: Reports des-group.com. [took 29 ms]
Looking up at the 2 des-group.com. parent servers:
host for this one is once again Softlayer Technologies (126.96.36.199)
who have not responded to abuse reports regarding other fraudster(s)
they host. Here are
all of the known domains that are/have been used for the Finance International
Status DNS deleted Suspended
OnlineNic (Rustelecom) Bizcn.com, Inc.
Please notify me of any errors or domains not listed here.
i) The criminal will not respond to your
challenge, but will use the
notice to prepare a new network -
immediate suspension is requested please, if allowed for by your AUP.