Auction Online Solution Fraud

Don't Bear Internet Fraud

Auction Online Solution scam screenshot 27-May-2009:

This criminal fraud website should not be confused with any other company of the same or similar name - the above screenshot of the criminal's website home page and the detailed evidence below are intended to identify this fraudster and this fraudster alone.

Auction Online Solution scam is just another of the numerous Russian money laundering mule job websites, in this case masquerading as an auction drop site. Their website content is stolen from The Online Outpost, (which is self evident and clear evidence of fraud), they have no internet presence, their location and contact details are bogus, they are not a registered company at their supposed location, they have multiple recently registered domains, (for the usual criminal's domain minimum period of one year), and they are hosted on the same criminal fraudster's network and IP address, (Cayman British Islands Offshore Network on IP - 78.129.166.5), as numerous other fraudster's, including World Market Auction, American Finance, Approved Finance Solutions, AREM Networks, AST Finance & Consult, Browncorp Financial Services, Great Expedition, Komerset Logistics, LC Escrow & Consulting and Western Trust, LLP. The payload of this fraud site is the usual money laundering mule job of "Administrative Agent" under the 'Vacancies' tab.

If you are a registrar or a host who has received an abuse report concerning this criminal then please review the irrefutable evidence below and take prompt and permanent action to shut this criminal down.

If you've either received an active website link in an Auction Online Solution fraud spam, or know of an active domain and it is not listed in the domain tables below, then please let us know by reporting it using the 'Report Active Domain' option in the title bar above. Please see the tables below and the latest news for the latest hosting and domain details.

Auction Online Solution : Evidence of Criminal Fraud

i) The criminal's website has been stolen from the genuine website The Online Outpost with the addition of a bogus job under a 'Vacancies' tab which does not appear on the genuine site. Clear evidence of site theft and criminal fraud.

ii) The bogus Auction Online Solution website has multiple domains as listed below, all registered in April 2009 for the 'criminal's domain' minimum period of one year - A clear indication of fraud.

iii) A Google search for "Auction Online Solution" shows that they have no internet presence at all apart from fraud website listings.

iv) The Bogus job from the website:

Auction Online Solution eBay Drop Off Store Vacancies :
Administrative Agent Position :

Location : United Kingdom / United States

Work Type: Part Time
Area: Anywhere in UK / US

Responsibilities:

- Day to day liaison with manager
- Achieving a high level of customer service and satisfaction
- Preparing of weekly, monthly and yearly sales reports
- Daily reporting

Main Duties:

- Deal effectively with sales enquires from manager over the e-mail and phone,
advising and selling the range of available services to potential and existing customers
- Complete all administrative tasks to ensure compliance with company procedures
- Maintain a clean and tidy reports/documentation
- In instances of lone working or in the Manager and Supervisors absence take key holder responsibility

Person Specification:

In order to be successful in the position the jobholder will need to demonstrate:

- A good level of written and verbal communication skills
- Ability to speak clearly and demonstrate effective listening skills when communicating
with managers/customers
- Self discipline, working within guidelines and procedures whilst being attentive to detail
- Comfortable working in a small team environment and adapt to lone working
- Project confidence and services on completion of the induction and probation period

We are offering a flexible work schedule,
commission right after the successfully processed operation, benefits plus
stable salary after probationary period. Your wage can reach up to 2,000-3,000 UK pounds/US dollars per month while spending only 15-25 hours a week. We looking for well-organized individuals, older than 18 years old who have PC (or notebook) and Internet access at home. Knowledge of MS Office is obligatory.

For a probationary period we sign an Agreement valid within 4 weeks. You undertake no expenses! If you are interested in growing your income and willing for a better salary - welcome in our team !

This Offer available for United Kingdom and United States residents only.

There you have the usual clear part time, work from home position. They don't spell out the function these days, but the clues are there, such as "commission right after the successfully processed operation". How it works: Firstly, be absolutely certain that there is no job here at all. These crooks sign you up, get you to hand over your ID details and sign a bogus contract. After that you are in what they call a 'probationary' period, or 'training period'. The 'training' consists of accepting transfers of stolen money into your personal account and transferring a balance back to these criminals using Western Union. This carries on until the first transfer comes back as fraudulent, (i.e. when the initial victim notices it missing from his account). As soon as that happens and you contact them to find out what is going on they will disappear and you will be in the position of having your account and its contents frozen, you will have lost all the real money that you have sent them and you will likely be facing a criminal investigation. Don't be tempted.

v) The Spam: A sample spam can be viewed on this anti-fraud website

vi) The fake location and contact details, (from the website):

Corporate Headquarters

Netherlands
Museumplein 21
1071 DJ Amsterdam

Phone: (269) 756-1161
Facsimile: (484) 698-5281

• - A Google search on the address "Museumplein 21" Amsterdam shows three things, firstly that there is no third party evidence that these crooks are there and secondly, there do not appear to be any numbered buildings in the square, and thirdly Museumplein, or 'Museum Square' is the 'cultural hub' of Amsterdam, home to museums, art galleries, concert halls etc. - it certainly is not the home of these criminals.
• - The telephone numbers (269) 756-1161 and (484) 698-5281 are certainly not Amsterdam numbers or even Dutch numbers as the format is wrong - in fact they are American phone numbers and have been used in spams for this type of fraud before, e.g. here for (269) 756-1161 and here and here for (484) 698-5281
All clear evidence of fake details and fraud.

vii) This is a 'Rip-Off Report' for one of the criminal's previous 'auction drop' aliases that also uses the above same telephone number (484) 698-5281

viii) There is no such company as 'Auction Online Solution' registered at the above address in the Dutch company register. As such registration is compulsory for every Dutch company it is irrefutable evidence of a fake company.

The above evidence clearly demonstrates beyond any doubt that the criminal's website has been set up by fraudsters purely for criminal purposes. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Auction Online Solution Fraudsters - current hosting details.

Current Domains, Registrars and Hosts

Domain

aosemployment.biz
aosemployment.com
aosemployment.net
aosemployment.org
aosemployment.us
aosposition.biz
aosposition.com
aosposition.net
aosposition.org
aosposition.us
auctioneonlinesolution.com
auctiononlinesolution.com
theauctiononlinesolution.com

Criminal Registered Nameserver Domains

srvdns.co.uk

Registrar

Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com (Rustelekom) - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com (Rustelekom) - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com (Rustelekom) - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com (Rustelekom) - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com - 09-Apr-2009
UK2 Group Ltd. (1'ST Domain Name Service) - 08-Apr-2009
Directi Internet Solutions/PublicDomainRegistry.com (Rustelekom) - 13-Apr-2009
COMMUNIGAL COMMUNICATIONS LTD (30-May-2009)

Register.com Inc (22-Jan-2009)

Host and IP Address

Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Cayman British Islands Offshore Network (78.129.166.5)
Netelligent Hosting Services Inc. of Laval QC
Cayman British Islands Offshore Network (78.129.166.5)
Netelligent Hosting Services Inc. of Laval QC

Cayman British Islands Offshore Network (78.129.166.233)

Active
Suspended/Disabled

Please notify me of any errors or domains not listed here.

Notes for Registrars

i) The criminal will not respond to your challenge but will use the notice to prepare a new network - immediate suspension is requested, please.

Network Details (Valid for domain auctioneonlinesolution.com)

How I am searching:

Searching for auctiononlinesolution.com A record at l.root-servers.net [199.7.83.42]: Got referral to f.gtld-servers.net. (zone: com.)
Searching for auctiononlinesolution.com A record at f.gtld-servers.net. [192.35.51.30]: Got referral to ns1.srvdns.co.uk. (zone: auctiononlinesolution.com.)
Searching for auctiononlinesolution.com A record at ns1.srvdns.co.uk. [78.129.166.5]: Reports auctiononlinesolution.com. Response:

Domain	Type	Class	TTL	Answer
auctiononlinesolution.com.	A	IN	14400	78.129.166.5
auctiononlinesolution.com.	NS	IN	14400	ns2.srvdns.co.uk.
auctiononlinesolution.com.	NS	IN	14400	ns1.srvdns.co.uk.
ns1.srvdns.co.uk.	A	IN	14400	78.129.166.5
ns2.srvdns.co.uk.	A	IN	14400	78.129.166.6

Looking up at the 2 auctiononlinesolution.com. parent servers:

Server	Response
ns1.srvdns.co.uk [78.129.166.5]	78.129.166.5
ns2.srvdns.co.uk [78.129.166.6]	78.129.166.5

The host for this criminal fraudster is listed as Cayman British Islands Offshore Network on IP address 78.129.166.5. This host and IP address have also been used for numerous other frauds listed in the opening paragraph, and has been implicated in hosting Zeus attack sites. Reverse IP checks show a whole host of attack, malware and fraud sites, not only on this IP but the whole block - a cess-pit of criminal activity. This host appears to have no internet presence and the Google hits it returns are mainly related to criminal activity. IP contact data:

Information related to '78.129.166.5'

inetnum:        78.129.166.0 - 78.129.166.255
netname:        KY-PRVT-NWRK-019231
descr:          Cayman British Islands Offshore Network
country:        KY
admin-c:        JW1886-RIPE
tech-c:         JW1886-RIPE
status:         ASSIGNED PA
mnt-by:         RAPIDSWITCH-MNT
changed:        abuse[at]rapidswitch.com 20090122
source:         RIPE

person:         Jan Willson
address:        George Town, Cayman Islands,
phone:          +3459497923
nic-hdl:        JW1886-RIPE
changed:        support[at]kynetworks.biz 20081115
source:         RIPE

% Information related to '78.129.128.0/17AS29131'

route:          78.129.128.0/17
descr:          RapidSwitch Ltd
origin:         AS29131
mnt-by:         RAPIDSWITCH-MNT
changed:        abuse[at]rapidswitch.com 20070426
source:         RIPE

The domain kynetworks.biz was only registered with Network Solutions, (XiaMen BizCn Computer & NetWork Co.,Ltd as reseller for Network Solutions Inc.), on 16-Nov-2008 and was until recently resolving as a suspended account on a Russian host, OTCEK.com. The IP block 78.129.166.0 - 78.129.166.255 has been provided by Rapidswitch.com.

***Latest News*** Initial entry 27th. May 2009

***Latest News*** 29th. May 2009

The Directi Internet Solutions/PublicDomainRegistry.com registered domains have all been suspended. An excellent response from DirectI as always. The only domain left active is the domain auctioneonlinesolution.com registered with UK2 Group Ltd. (1'ST Domain Name Service). Rapidswitch.com are aware of this criminals activity but so far do not appear to be interested in doing anything about it, in fact their abuse address parser rejects the IP 78.129.166.5 making it impossible to contact their abuse department, even though they are clearly listed as the parent block owner and the abuse contact. Their sales and support departments are however aware of the criminal activity but refuse to take action. Please notify me of any active domains for this criminal.

***Latest News*** 14th. Jun 2009
This criminal is still engaging in his criminal activity of recruiting money mules - new hosting details:

Network Details (Valid for domain auctioneonlinesolution.com, theauctiononlinesolution.com)
How I am searching:

Searching for auctioneonlinesolution.com A record at f.root-servers.net [192.5.5.241]: Got referral to E.GTLD-SERVERS.NET. (zone: com.)
Searching for auctioneonlinesolution.com A record at E.GTLD-SERVERS.NET. [192.12.94.30]: Got referral to ns1.net-media.ca. (zone: auctioneonlinesolution.com.)
Searching for auctioneonlinesolution.com A record at ns1.net-media.ca. [67.212.80.121]: Reports auctioneonlinesolution.com. Response:

Domain	Type	Class	TTL	Answer
auctioneonlinesolution.com.	A	IN	14400	67.212.80.121
auctioneonlinesolution.com.	NS	IN	14400	ns2.net-media.ca.
auctioneonlinesolution.com.	NS	IN	14400	ns1.net-media.ca.
ns1.net-media.ca.	A	IN	14400	67.212.80.121
ns2.net-media.ca.	A	IN	14400	67.212.80.122

The host for this criminal fraudster is Netelligent Hosting Services Inc. of Laval QC, Canada who inherited most if not all of the Cayman British Islands Offshore Network fraudsters of which this crook is one. Other criminal fraud domains included on this IP active at time of writing are:

20thcenfinan.com ***Warning*** attack site and fraud site - also see 20th Century Financial
Velso.biz - Velso Estate Solutions fraudster - fake real estate site promoting money mule job.
Morris-ltd.com - Fake manufacturing money mule recruiting site, (domain only registered 24-feb-2009 but claims to be a 'Global Leader', in business since 2006).
Lcescrow.com - Fake escrow money mule recruiting site - see LC Escrow & Consulting
Komersetlogistics.com - Fake logistics money mule recruiting site - see Komerset Logistics
Grehemgmbh.com - fake bank money mule recruiting site - see Grehem GmbH
Financentury20.com - Another 20th Century Financial fraud domain.
8gb-iphone.ru - Googles as Russian fraud site.

Along with the above there are numerous suspended domains, fake diploma domains, fake casino domains that attempt to get you to download the spyware/malware file 'casino.exe'. I could not find a single legitimate domain on this IP. It appears to be owned by criminals and fraudsters.