CentroMed Finance Inc. Fraud

Don't Bear Internet Fraud

This fraudster should not be confused with any legitimate company of the same or similar name - the following amended stolen website graphics and the evidence of fraud clearly identify the fake CentroMed Finance Inc. website and these criminal fraudsters. The website template is stolen from a genuine company.

CentroMed Finance Inc. screenshot (10-Feb-2010)

CentroMed Finance Inc. This is just a standard serial scam website that has been set up to form a front for a money laundering job advertisement. The MO and the details clearly link this criminal to many other frauds, including Diamond-Exchange Inc., Silver Services Inc., Active Solutions Inc., Silver Finance Inc. and latterly Platinum Funds., Webeca Payments Inc., Neweca Payments Inc., Med Payments Inc., Paymate Solutions Inc., Den Payments Inc., scam plus a few others in there somewhere. The website domain centromed-finance.com has only been registered recently for a one year period, their website is clearly stolen from the genuine Medical Payment Solutions company, the fake CentroMed Finance Inc. are not registered as a company in their supposed country of location, (Finland), their contact details are bogus and they have no web presence whatsoever due to a robots.txt file blocking all search engine access to their website. The purpose of the website is simply to lend an air of legitimacy to the inevitable spamvertised illegal money mule function of 'Transfer Manager' that will get your bank account closed, your assets frozen, lose you a lot of money and could cost you your liberty - don't be tempted. The criminal has alternate identical aliases of My Health Direct Inc., Medical Direct Inc., Medical Finance Inc., World CentroMed Finance Inc., Medical Payments Inc., Med Finance Flow Inc. and Medical Payment Solutions Inc. (Stolen Identity) - this is quite clearly a prolific serial Eastern European fraudster.

CentroMed Finance Inc. : Evidence of Criminal Fraud

i) The CentroMed Finance Inc. 'About Us' page states "With years of experience in healthcare practice management and billing, CentroMed Finance Inc.' goal is to increase cash flow, minimize bad debt, lower the cost of collections and enhance patient satisfaction through its' advanced web-based payment services, expanded payment options and proactive account management", but their website domain centromed-finance.com was only registered with DOMAINCONTEXT, INC./SELLOUT.NAME - 11-jan-2010 for the usual 'criminal's domain' minimum period of only one year. A strong indication of a fraud domain.

ii) Stolen website - their website is a stolen copy of this Medical Payment Solutions website apart from the location details. That is clear and irrefutable evidence of site theft and fraud.

iii) This Washington Post article refers to these serial criminals - irrefutable evidence of fraud.

iv) They are supposedly a company registered and located in Finland, but they are not - a search of the Finnish BIS (Business Information System) shows that there is no such company as "CentroMed Finance Inc." registered in Finland - check for yourself - it is undeniably a fake company, (the suffic "Inc." wouldn't be used in Finland anyway - typical suffixes would be OY or OYJ). - irrefutable evidence of fraud.

v) A Google search shows absolutely no internet presence at all for this fake "CentroMed Finance Inc." which is not surprising as the criminals are using a robots.txt file to block all search engine access to their website - only a fraudulent website would do that.

vi) Another alias, another set of fake Website Contact Details:

CentroMed Finance Inc.
Kantzie 18, Helsinki, Finland, 00421
Phone: +358 20 7928 371
E-mail: Barbara@centromed-finance.com

• - The above address is just a minor variation on the address as used by the criminals for all of their aliases.
• - A Google search on the fake address of Kantie 18, Helsinki, Finland just returns their previous scam details. Neither Google nor Google Maps recognise it as a valid address.
• - A Wiki check on Finnish telephone numbers shows that the number +358 20 7928 371 is incorrectly formatted for an international number and has the wrong number of digits, (the example shown should be of the form +358 2 xxx xxx). It also has the incorrect area code for Helsinki. It is clearly fake.
• - Unsurprisingly, A Google check for the incorrect telephone number "+358 20 7928 371" returns no results.

All clear evidence of fake details and fraud.

vii) The Spam:

From: Rachel Wells <pnkuananamo@gmail.com>
Sent: Wednesday, February 10, 2010

Subject: NO EXPERIECE? NO PROBLEM! Positons to be filled IMMEDIATELY!

Dear xxxxxx

Our Company is in the business of processing payments to medical companies with services designed specifically to help physicians, healthcare facilities and medical billing companies collect the patient portion of medical care.

We have found your resume at CareerBuilder database, and consider you to be a great candidate for the job which we suggest.

Job Description:
- To gather transactions on a timely manner to a personal checking account;
- To transfer these funds to our branch in Sweden via Wire transfers or MoneyGram;
- To solve other relevant problems.

Daily communication with the company will make you an experienced "Transfer Manager".

Income: $600-$1500 per week.
It is a commission based position - 8% from each processed transaction.

General requirements:

5-10 hours per week
Age from 21 to 65 ;
Honesty, responsibility and promptness in operations;
Microsoft Word skills;
Willingness to work from home, take responsibility and achieve higher goals;

If you want to join our team, please visit our web-site .[The snip-url link http://snipurl.com/ubjvw currently redirects to the crook's registration page, http://centromed-finance.com/?link=getjob&style=new&rnd=71935964]

WE WILL UNDERTAKE FOR ALL THE FEES CONNECTED WITH YOUR EMPLOYMENT

viii) You do not get a clearer description of the ILLEGAL money mule function than that - it will get your bank account closed and your assets frozen, lose you a lot of money and earn you a visit from the police. Do not be tempted.

ix) No legitimate company would advertise for private citizens to operate as unlicensed and illegal money transfer agents. To do so clearly defines the fake EFIS Company company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Clear evidence of criminal fraud.

The above evidence clearly demonstrates beyond any doubt that the CentroMed Finance Inc. website has been set up by money laundering criminal fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

CentroMed Finance Inc. Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

centromed-finance.com

Registrar

DOMAINCONTEXT, INC./SELLOUT.NAME - 11-jan-2010

Host Network

ilyopicha (ilyopicha - Ilia Iliev)/hosting.ua of "Sofia, Bulgaria"

Host IP

78.109.31.24

Key:
Active
Suspended or Inactive
Parked

Please notify me of any other current domains used by this criminal.

Domain Whois Data [These are criminal registered domains - the whois details are fake or stolen - personal details redacted]

Domain Name: CENTROMED-FINANCE.COM
Registrar:     DOMAINCONTEXT, INC.
Status:        clientTransferProhibited
Dates:         Created 11-jan-2010   Updated 11-jan-2010 Expires 11-jan-2011
DNS Servers:   NS1.EVERYDNS.NET NS2.EVERYDNS.NET NS3.EVERYDNS.NET NS4.EVERYDNS.NET

Registration Service Provided By: SELLOUT.NAME
Contact: +007.9066516665
Website: http://sellout.name/

Registrant:
    N/A
    **********************
    **********************
    Pluederhausen
    Berlin,73655
    DE
    **********************
Creation Date: 11-Jan-2010
Expiration Date: 11-Jan-2011

Domain servers in listed order:
    ns4.everydns.net
    ns3.everydns.net
    ns2.everydns.net
    ns1.everydns.net

Administrative Contact:
    N/A
    **********************
    **********************
    Pluederhausen
    Berlin,73655
    DE
    **********************

Technical Contact:
    N/A
    **********************
    **********************
    Pluederhausen
    Berlin,73655
    DE
    **********************

Billing Contact:
    N/A
    **********************
    **********************
    Pluederhausen
    Berlin,73655
    DE
    **********************
Status:ACTIVE

DNS Lookup: centromed-finance.com A record
Searching for centromed-finance.com A record at g.root-servers.net [192.112.36.4]: Got referral to F.GTLD-SERVERS.NET. (zone: com.)
Searching for centromed-finance.com A record at F.GTLD-SERVERS.NET. [192.35.51.30]: Got referral to ns1.everydns.net. (zone: centromed-finance.com.)
Searching for centromed-finance.com A record at ns1.everydns.net. [208.76.62.100]: Reports centromed-finance.com.
Response:

Domain	Type	Class	TTL	Answer
centromed-finance.com.	A	IN	3600	78.109.31.24
centromed-finance.com.	NS	IN	86400	ns1.everydns.net.
centromed-finance.com.	NS	IN	86400	ns2.everydns.net.
centromed-finance.com.	NS	IN	86400	ns3.everydns.net.
centromed-finance.com.	NS	IN	86400	ns4.everydns.net.
ns1.everydns.net.	A	IN	43200	208.76.62.100
ns2.everydns.net.	A	IN	43200	78.129.207.168
ns3.everydns.net.	A	IN	86400	208.76.63.100
ns4.everydns.net.	A	IN	86400	208.76.60.100

Looking up at the 4 centromed-finance.com. parent servers:

Server	Response
ns4.everydns.net [208.76.60.100]	78.109.31.24
ns3.everydns.net [208.76.63.100]	78.109.31.24
ns1.everydns.net [208.76.62.100]	78.109.31.24
ns2.everydns.net [78.129.207.168]	78.109.31.24

As listed, this criminal's website is still hosted by the Bulgarian host ilyopicha (ilyopicha - Ilia Iliev)/hosting.ua of Sofia, Bulgaria on IP address 78.109.31.24 - last time I checked the hosting details for the crook's previous alias's (Med Finance Flow Inc.) hosting on the adjacent IP address 78.109.31.23 they were serverofsv (Dmitriy Serdyuk)/hosting.ua. of St Petersburg. Make of that what you will.

***Latest News*** Initial entry 10th. February 2010