CBA Properties

CBA Properties Fraud

Don't Bear Internet Fraud

CBA Properties is from the same stable as the Silverlens, Creovision and Neolenses frauds. Like those frauds it uses a website stolen from a genuine company in order to try and lend legitimacy to the usual money laundering mule job. It is also hosted on the usual zombie botnet which guarantees its bogus & criminal nature even without the ample other evidence as documented below. A site contact tells me that the work agreement form she received from CBA Properties bore the company name of Silverlens, confirming the link beyond any doubt.

The CBA Properties website has been stolen from the genuine property company Property Frontiers who needless to say have nothing to do with this fraud - they are as much a victim as anyone else who falls for this scam.

The CBA Properties spam subjects usually include "Amazing job opportunity. Home-based.", "Real Job Offer with paid trial.", "Customer Service Representative vacancy. High salary!", "Home-Based Job position. PAID TRIAL!", but the one thing in common is the offer of a job as a money laundering mule that will lose you lots of money, get your bank account(s) and all your assets frozen and have you facing criminal charges - don't do it!

This fraudster should not be confused with any legitimate company of the same or similar name - the above website screenshot and the included money laundering job clearly identify the fake website and these fraudsters.

Current Zombie Botnet Host

ns1.aumode.com [206.71.148.154] - Convergent Network Services/Ironcolo.com - Notified 19th. Feb. 2008

The ethical majority of service providers, (all credit to them), act within 1-24 hours of being informed of the criminal abuse of their system, (the best in less than 1 hour), but there are unfortunately a few that do not, for one reason or another.

Known Website Domains

cbaproperty.com (Parked)
cba-property.com (Parked)
cbaproperty.net (Unhosted)

Nameserver Domains

aumode.com (Active)

Registrar

Register.com (12-Feb-2008)
Register.com (12-Feb-2008)
SpiritDomains/IA Registry (12-Feb-2008)

Register.com (05-Feb-2008)

Note for registrars
The criminal uses a zombie botnet to host all his website domains. That means that he has to register his own zombie botnet nameserver domain as he cannot use a legitimate DNS. It therefore follows that any domain in your database which has the current zombie botnet nameserver, (ns1.aumode.com) in the whois data IS zombie botnet hosted and IS a domain registered by the same criminal for the same criminal purposes. Would you please search for all the criminals domains, suspend them and delete the DNS data. Thank you.

Zombie Botnet
DNS Data: (Valid for cbaproperty.com, cba-property.com & cbaproperty.net)

How I am searching:

Searching for Cbaproperty.com A record at h.root-servers.net [128.63.2.53]: Got referral to a.gtld-servers.net. (zone: com.)
Searching for Cbaproperty.com A record at a.gtld-servers.net. [192.5.6.30]: Got referral to ns1.aumode.com. (zone: cbaproperty.com.)
Searching for Cbaproperty.com A record at ns1.aumode.com. [206.71.148.154]: Reports cbaproperty.com. Response:

Domain	Type	Class	TTL	Answer
cbaproperty.com.	A	IN	1800	82.45.111.145
cbaproperty.com.	A	IN	1800	84.100.6.47
cbaproperty.com.	A	IN	1800	59.9.230.23
cbaproperty.com.	A	IN	1800	79.112.30.68
cbaproperty.com.	A	IN	1800	79.115.161.85
cbaproperty.com.	NS	IN	1800	ns2.aumode.com.
cbaproperty.com.	NS	IN	1800	ns1.aumode.com.
ns1.aumode.com.	A	IN	1800	206.71.148.154
ns2.aumode.com.	A	IN	1800	208.21.44.10

Looking up at the 2 cbaproperty.com. parent servers:

Server	Response
ns1.aumode.com [206.71.148.154]	59.9.230.23 79.112.30.68 79.115.161.85 82.45.111.145 84.100.6.47
ns2.aumode.com [208.21.44.10]	Timeout

The DNS data shows a standard zombie botnet where the nameserver ns1.aumode.com hosted by the regular, (& historically completely unresponsive), host of these criminals, Convergent Network Services/Ironcolo.com of Hicksville NY on IP 206.71.148.154 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT). The nameserver domain, (aumode.com - REGISTER.COM, INC.) is by definition registered by the criminals as they cannot use a legitimate DNS server to host a zombie botnet.

Evidence of Criminal Fraud:

i) Site theft - the website content is stolen from the genuine company Property Frontiers.

ii) The website is hosted by the usual zombie botnet as demonstrated above.

iii) Spam received by site contact - sample below.

iv) Fake Location Details from site 'Contact Us' page:
Phone: + 44 (151) 324 2740
Fax: + 44 (151) 213 0380
30 Leicester Square
London WC2H 7LA
United Kingdom

Not only does the address 30 Leicester Square in reality belong to Yates Wine Lodge, but the telephone numbers are actually Liverpool numbers & not London ones - they must have a long telephone cord....

v) They claim on their website to be a founder member of the UK Property Professional's Association, the AIPP. In fact they are not listed in the association's database.

vi) Their multiple domains for the same website were all registered in the last week.

vii) Considering the claim: "We cover the majority of the worlds’ emerging property markets and are continuously seeking to expand our coverage. Currently we have over 9,000 properties listed over 40 countries in the following regions:" this particular bogus company has no internet presence other than as spammers and scammers.

viii) On the Application Form the CV is optional! What sort of company would recruit just anyone without even a CV? - A money mule recruiter, that's who.

ix) The registration whois data is hidden using 'Domain Discreet'. What sort of company does that? You guessed it - a criminal one.

Job (From the website):

Vacancy Number: SLM37-322
Opening Date: 11/02/08
Closing Date: Open until filled
Position: Regional Manager
Salary: AUD$60,000 after tax annually
Duty Location: AUSTRALIA

We offer an exciting and rewarding career opportunities for a new Regional Manager to join an Australian team on the work-from-home basis.
Working within a service team of eighteen other personnel, this is a fantastic opportunity to gain permanent employment after a two weeks trial period if you are able to prove your abilities and commitment to the position.

Managing of current real estate database.
You will have to update information on existing properties which are currently for sale
You will have to inform potential clients of our existing offers via email (no sale skills required)
Handling customer enquiries
Building strong relationships with internal and external clients
Assist the Financial Representative as required

Wages: When benefits and bonuses are added to the base salary, the average total compensation for this position would be AUD$60,000 after tax annually.

Working hours: Monday to Friday, 9am - 4pm (EST Australian Time) with 1 hour for lunch. Part-time positions are also available: Monday to Friday, from 9.30am to 1pm (EST Australian Time).

Successful candidates will be posses the following:

Persistence, enthusiasm and professional attitude
Commitment to quality client service
Basic computer skills
Effective time management skills with the ability to multi task and meet deadlines
The desire to work for a progressive organisation

To the successful applicants we offer a position on a 2 weeks trial basis. During this trial period you will be receiving training and online support while working and being paid.

If you are interested in this vacancy and you feel, that your qualifications correspond to our requirements, please fill in an application form.

It is well disguised, but the actual part-time working from home function of anyone who applies for this position will turn out to be simply "Supporting the Financial Representative when required", (it's exactly the same as the Silverlens, Neolenses & Creovision job), and will consist of receiving stolen/counterfeit checks into your account and transferring them back to this criminal less 10% for yourself - the illegal money mule function.

Feedback, (in confidence), from anyone who has applied for this job would be appreciated.

Spam
From: Chris Norman [mailto:chris_hr@cbaproperty.com]
Sent: Saturday, 16 February 2008 8:55 AM
To: xxxx
Subject: SEEK application: Approved.

Hello,

On behalf of CBA Properties I would like to thank you for taking the time to
apply for a position of Regional Manager for our team in Australia.

After careful consideration of your qualifications, it has been decided that
you meet our minimum selection criteria for the position offered. Now that
we have taken your application further I would like to briefly clarify some
of the key points related to the job offer. More detail will be revealed
later in the employment agreement.

Company: CBA Properties is dedicated to supporting investors in the world?s
emerging property markets. In achieving our mission, we provide a range of
services including personal support, education, local expertise and access
to a huge variety of properties from around the world.
We cover the majority of the worlds? emerging property markets and are
continuously seeking to expand our coverage. Currently we have over 9,000
properties listed over 40 countries. To become familiar with our products
and services please refer to our website at http://www.cbaproperty.com

Job Title: Regional Manager

Your duties will include the following:

- Managing of current real estate database.
- You will have to update information on existing properties which are
currently for sale
- You will have to inform potential clients of our existing offers via email
(no sale skills required)
- Handling customer enquiries
- Building strong relationships with internal and external clients
- Assist the Financial Representative as required

Wage Details: Once you are hired, your base salary starts at AUD$55,000
(plus commission on every project you close and bonuses when your team meets
its goals). When benefits and bonuses are added to the base salary, the
average total compensation for this position would be at least AUD$60,000
after tax annually.

Working hours: Monday to Friday, 9am - 4pm (EST Australian Time) with 1 hour
for lunch.

Job Location: Travel/relocation is not required. You can work anywhere just
as long as you have access to the Internet.

Job Requirements:

- Persistence, enthusiasm and professional attitude
- Commitment to quality client service
- Basic computer skills
- Effective time management skills with the ability to multi task and meet
deadlines
- The desire to work for a progressive organisation

Costs and Fees: There are no costs.

Further Hiring Process: We are offering you a position within our company on
a trial basis for two weeks starting from the beginning of the work. At the
completion of the trial period, your supervisor can recommend continued
employment, extension of trial period, or termination. During this trial
period you will be receiving training and online support while working and
being paid. (During the trial period you will be paid fortnightly AUD$1,000
per week after tax. The Employee is eligible for an individual bonus of
AUD$500 when the trial is successfully over.)

Next Step: In order to proceed please submit your details via email (by
replying to this message) once again and confirm that they are correct and
up-to-date (your details will be treated in the strictest of confidence):

Current address:
Landline phone number:
Cell phone number:

I assume that you would be able to start working as soon as possible. Please
confirm this. Also, during the next several weeks, please keep me informed
of any deadlines that you may be facing (i.e. pending job offers, current
employment obligations). Thank you once again and feel free to email me any
questions that you may have at this point.

Yours sincerely,

Chris Norman
Human Resources Manager
CBA Properties
chris_hr@cbaproperty.com

The above evidence clearly demonstrates that the CBA Properties website is a stolen fraudulent website set up with intent to deceive. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data will be false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Fraud Log

Webpage created 19th. February 2008

***Latest News*** 20th February 2008
The criminal has moved his botnet:
DNA Data - (Valid for cbaproperty.com, cba-property.com & cbaproperty.net)
Looking up at the 2 cbaproperty.com. parent servers:

Server	Response
ns1.aumode.com [89.33.8.17]	24.93.117.56 86.125.118.76 89.40.5.124 89.42.201.169 99.139.49.2
ns2.aumode.com [208.21.44.10]	Timeout

The DNS data shows a standard zombie botnet where the nameserver ns1.aumode.com hosted by Maxnet.ro on IP 89.33.8.17 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT). The nameserver domain, (aumode.com - REGISTER.COM, INC.) is by definition registered by the criminals as they cannot use a legitimate DNS server to host a zombie botnet.