Cefin consulting & Finance Scam

Cefin consulting & Finance Fraud

Don't Bear Internet Fraud

This fraud should not be confused with any other company of the same or similar name - the above website screenshot and the following fraud evidence refer to this company alone and no other.

Cefin consulting & Finance scam screenshot (12-Feb-2010)

Cefin consulting & Finance is a website that has been set up purely for the purposes of lending a false air of legitimacy to a clear money mule job under the 'Vacancies' tab. You can check the pedigree of these frauds in several ways, i.e. compare site content or the site template or another way is to compare file structure. The file structure is very familiar - it's a PHP based site with a typical 'Rockphish' file structure - very similar to many other frauds documented on this website. The template logo is also a bit of a blast from the past having last been seen on the Mynes Consulting & Finance scam - it is clearly the same logo as is the fake job. That links these crooks to the majority of the Russian frauds on this website. The fake company claims on their 'About Us' page "Cefin consulting & Finance was founded at the beginning of 1990", but their domain cefincf.com was only registered with the unresponsive Turkish registrar of many fraud domains on this website, Alantron BLTD on 28-sep-2009 for the usual 'criminal's domain' minimum period of only one year. These fake certificates also link this fraud to most of the frauds on this site. They are not a registered company and their contact and location details are bogus.

Evidence of Criminal Fraud:

i) According to their 'About Us' page "Cefin consulting & Finance was founded at the beginning of 1990", however, their domain cefincf.com was only registered with the unresponsive Turkish registrar of many fraud domains on this website, Alantron BLTD on 28-sep-2009 for the usual 'criminal's domain' minimum period of only one year. A Clear indication of misrepresentation and fraud

ii) They claim to be New York based, but a webcheck shows that Cefin consulting & Finance are not a legal registered entity in New York state, clear evidence of a fake company. Check for yourself. In any event, would a legitimate New York company use a Turkish known fraud domain registrar and a Ukrainian host?

iii) A Google search shows that these crooks have no web presence at all apart from spamming and fraud site listings, (ignoring their own fake website, of course).

iv) Further information on this crook and a sample spam can be seen here.

v) The website carries the following money mule criminal solicitation under the 'Vacancies' menu option:

Financial Manager

Responsibilities: prompt processing of incoming money transfers in real-time mode.

Demands:

    * 20 years old and more
    * Be able to check your email several times a day
    * Confident PC user (SW package Office), mail programs, Internet
    * Foreign language (English is preferable).

What we offer:

    * Generous salary
    * Social benefits and medical insurance
    * Free training and seminars

If you are interested in this vacancy, please send your CV at support@cefincf.com or fill out the special application form in our site.

vi) The phrase "Responsibilities: prompt processing of incoming money transfers in real-time mode." indicates the function of this position - the acceptance of "incoming money transfers" to your bank account and the "prompt processing" of them back to these crooks using Western Union - do not be fooled - the activity is the function of a money laundering mule - it is illegal and will lose you a lot of money, your bank account and possibly your liberty.

vii) No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas, to do so defines the company as both bogus and criminal.

viii) These fake certificates are exactly the same ones used in dozens of these frauds, e.g. these UK two from "Greater Merseyside Enterprise Ltd" and "Portsmouth and South East Hampshire Chamber of Commerce and Industry" when the crooks are not even pretending to be in the UK - clearly fake:
Certificate1

Clear evidence of serial fraud.

ix) 'Contact Us' Details from the "Contact Us" page, (remember that they are not a legal registered company in NY, so these details are not going to be genuine):

Address:
Cefin consulting & Finance
is located at 510 East 80th Street,
New York, New York 10021 ,
United States

Phone numbers:
786-475-3994
786-475-3994 (FAX)

• - A Google search on the address "510 East 80th Street, New York, NY" returns no hits for these crooks.
• - A Google Maps search on the address "510 East 80th Street, New York, NY" shows that they are not a listed business at the address.
• - Note the combined telephone and fax. number - not a sign of a genuine company.
• - A Google search for the number "786-475-3994" returns no hits for these crooks, (ignoring their own fake website, of course).
• - A Reverse Phone Detective check on the number returns no evidence that the number even exists.

x) The Spam:

Cefin Consulting & Finanace is one of the leading providers of consulting services in the world. Our success depends both on high quality of services and on professionally managed and reliable business processes.

This is the reason why quality is our main concern. However, the only way to reach top-notch quality in our business is permanent struggle for quality and engineering of stable procedures.

It is not possible to reach high quality standards without dedicated personnel striving for flawless operation of processes and projects in their daily life. Currently we have a Financial Manager opening. No deadlines for applications are set.

The job of Financial Manager includes processing of money transfers, sent to his personal bank accounts by company clients. Upon receiving a transfer the Financial Manager has to redirect it to the account specified by our dispatchers. All you need for this job are: 3-4 free hours a day, your wish, ability to work in a team and responsibility. The initial wages will equal 5% of total monthly turnover.

Requirements to Candidates:

* 20 years old and more
* Be able to check your email several times a day
* Should have personal (or business) bank account
* Have a skill to communicate and access to the Internet.
* Foreign language (English is preferable).
* To have an opportunity in any working hours to go to closest Western Union location and make money transfer .

What we offer:

* Generous wages
(Your earnings will originally make 5 % from each payment. Your earnings will originally make 5 % from each payment. After 5 remittances if you will operatively work and correctly, your earnings raises up to 10 %. )
* Opportunity of increase in your earnings.
* Free seminars and training courses (After 6 months of great work).

If you are interested in this opening, don't hesitate to send your CV at our e-mail: cefincfsa@yahoo.com

2010 © Cefin Consulting & Finanace
All right reserved.

You don't get a clearer definition of the illegal 'Money Mule' fake job than that - clear evidence of fraud.

The above evidence clearly demonstrates beyond any doubt that the Cefin consulting & Finance website has been set up very recently by money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Known Website Domains

cefincf.com
ceffincfin.com

Registrar

ALANTRON BLTD - 28-sep-2009
Todaynic.com Inc. (07-mar-2010)

Host

SteepHost-DC-UA (Ukraine)
TR-VITAL (VITAL TEKNOLOJI - Dedicated Pool), (Turkey)

IP Address

195.190.13.106
93.186.127.252

Active
Suspended/Disabled

Domain Whois Data:

Registrar:     ALANTRON BLTD.
Status:        ok
Dates:         Created 28-sep-2009   Updated 27-nov-2009 Expires 28-sep-2010
DNS Servers:   NS1.109438129432.CN NS2.109438129432.CN

Arastirilan alan adi: cefincf.com
    Ad / Name      Goga Gastoyan
    Adres    Pokrishkina ul. d.36 kv.36 Moskva Moskva 119602
    Tel    +7.4957452002
    Faks    +7.4957452002
    E-posta   flier@infotorrent.ru
    Guncelleme / Updated

        Ad    gizli
        Ad / Name      Goga Gastoyan
        Adres Pokrishkina ul. d.36 kv.36 Moskva Moskva 119602
        Tel   +7.4957452002
        Faks     +7.4957452002
        E-posta   flier@infotorrent.ru
        Guncelleme / Updated

        Ad    gizli
        Ad / Name     Goga Gastoyan
        Adres Pokrishkina ul. d.36 kv.36 Moskva Moskva 119602
        Tel   +7.4957452002
        Faks     +7.4957452002
        E-posta   flier@infotorrent.ru
        Guncelleme / Updated

Alan Adi Sunucusu1 / DNS1       ns1.109438129432.cn
Alan Adi Sunucusu1 IP / DNS1 IP
Alan Adi Sunucusu2 / DNS2       ns2.109438129432.cn
Alan Adi Sunucusu2 IP / DNS2 IP
Son Guncelleme/ Last Updated
Kayit Tarihi / Registration Date    2009-09-28
SKT / Exp. Date                2010-09-28
Statu                    Aktif

Registrar:     TODAYNIC.COM, INC.
Status:        clientTransferProhibited
Dates:         Created 07-mar-2010   Updated 07-mar-2010 Expires 07-mar-2011
DNS Servers:   NS1.GINSERDY.COM NS2.GINSERDY.COM

Domain name: ceffincfin.com
Status: Active

Protection Status: public
( make contact info private at http://www.now.cn/domain/domainPrivate.php )

Registrant:
Name: Albert Rokoshevich
Address: 15 Pulawska
City: Warszawa
Province/state: poland
Country: PL
Postal Code: PL-02 513

Administrative Contact:
Name: Albert Rokoshevich
Organization: Albert Rokoshevich
Address: 15 Pulawska
City: Warszawa
Province/state: poland
Country: PL
Postal Code: PL-02 513
Phone: +48.740913432
Fax: +48.740913432
Email: winter343@hotmail.com

Technical Contact:
Name: Albert Rokoshevich
Organization: Albert Rokoshevich
Address: 15 Pulawska
City: Warszawa
Province/state: poland
Country: PL
Postal Code: PL-02 513

Nameserver Information:
    ns1.ginserdy.com
    ns2.ginserdy.com

Create: 2010-03-08 04:21:19
Update: 2010-03-08
Expired: 2011-03-08

DNS Lookup: cefincf.com A record
Searching for cefincf.com A record at c.root-servers.net [192.33.4.12]: Got referral to L.GTLD-SERVERS.NET. (zone: com.)
Searching for cefincf.com A record at L.GTLD-SERVERS.NET. [192.41.162.30]: Got referral to ns2.109438129432.cn. (zone: cefincf.com.)
Searching for cefincf.com A record at ns2.109438129432.cn. [195.190.13.107]: Reports cefincf.com.
Response:

Domain	Type	Class	TTL	Answer
cefincf.com.	A	IN	3600	195.190.13.106
cefincf.com.	NS	IN	3600	ns1.stp0-08.steephost.net.
cefincf.com.	NS	IN	3600	ns2.stp0-08.steephost.net.

Looking up at the 2 cefincf.com. parent servers:

Server	Response
ns2.109438129432.cn [195.190.13.107]	195.190.13.106
ns1.109438129432.cn [195.190.13.106]	195.190.13.106

The host of this criminal fraudster is SteepHost-DC-UA (Ukraine), on IP address 195.190.13.106

***Latest News*** Webpage created 12-Feb-2010

***Latest News*** 13-Mar-2010
The criminal's domain cefincf.com has been disabled and the crook is now using the new domain ceffincfin.com, registered with Todaynic.com (07-mar-2010):
DNS Lookup: ceffincfin.com A record
Searching for ceffincfin.com A record at h.root-servers.net [128.63.2.53]: Got referral to g.gtld-servers.net. (zone: com.)
Searching for ceffincfin.com A record at g.gtld-servers.net. [192.42.93.30]: Got referral to ns1.ginserdy.com. (zone: ceffincfin.com.)
Searching for ceffincfin.com A record at ns1.ginserdy.com. [93.186.127.205]: Reports ceffincfin.com.
Response:

Domain	Type	Class	TTL	Answer
ceffincfin.com.	A	IN	30	93.186.127.252
ceffincfin.com.	NS	IN	30	ns2.ceffincfin.com.
ceffincfin.com.	NS	IN	30	ns1.ceffincfin.com.
ns1.ceffincfin.com.	A	IN	30	93.186.127.205
ns2.ceffincfin.com.	A	IN	30	93.186.127.252

Looking up at the 2 ceffincfin.com. parent servers:

Server	Response
ns2.ginserdy.com [93.186.127.212]	93.186.127.252
ns1.ginserdy.com [93.186.127.205]	93.186.127.252

The host of this criminal fraudster is TR-VITAL (VITAL TEKNOLOJI - Dedicated Pool), (Turkey), on IP address 93.186.127.252