CurrencySource (Stolen site)

CurrencySource (Stolen Site and Identity)

Don't Bear Internet Fraud

CurrencySource stolen site (20-Sep-2009)

The owner of the genuine CurrencySource website on currencysource.com has contacted me to confirm this criminal activity using a fake website stolen from his own. This criminal activity is nothing whatsoever to do with the genuine CurrencySource company who are a much a victim of this criminal as anyone else. The stolen site has the 'Registration EXECUTIVE MANAGER' money mule entry option as below. The otherwise identical genuine site does not - do not be deceived.

This fraudster should not be confused with any legitimate company of the same or similar name - the fake website graphics and content have been stolen from the genuine CurrencySource.com company which has a different telephone number and clearly does not have a "Registration Financial Manager" option on its home page. The following evidence clearly identifies the fake website and these criminal fraudsters.

CurrencySource (mycurrencysource.net etc) is just the Poland Real Estate, San Marca and Babochka scammers branching out into the currency industry judging by the fact that they are using the usual MO of a stolen site and are hosted on the same Masterhost IPs and use the same registrar. They have clearly stolen this site from the genuine CurrencySource.com company, (confirmed by the genuine company owner), and added a different contact telephone number and a registration option that will only lead you into criminality. Their domains iq-biz.com.cn and currencysource.net were only registered very recently for the usual 'criminal's domain' minimum period of only one year - as are their subsequent domains - see domain list below for known current domains.

The whole purpose of this fraud site is to lend an air of legitimacy to a 'Money Mule' job that consists of accepting fake checks to your home address, cashing them and sending a balance back to these crooks in Russia/the Ukraine. See the spam sample below. It will get your bank account and your assets frozen, lose you a lot of money and earn you a criminal record - don't be tempted.

CurrencySource stolen site : Evidence of Criminal Fraud

i) The above CurrencySource fraud website content has been stolen from the genuine CurrencySource.com company and modified to include a registration page for a money laundering mule role which is being spamvertised in the usual way. Clear evidence of site theft and fraud - confirmed by the genuine company owner.

ii) The criminal's spamvertized domain iq-biz.com.cn was only registered on 26-Aug-2009 for the usual 'criminals domain' minimum period of only one year with the registrar this criminal has previously used, Web Commerce Communications Limited, (webnic.cc) A clear indication of a fraudulent registration. See the tables below for subsequent domains.

iii) They are advertising the job of “Financial Manager” which has no website details at all - just a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal operation as detailed in the following spam and contract which at the very least will cost you a lot of money.

v) No legitimate company would advertise for private citizens to operate as part-time, work from home "Financial Managers". To do so clearly defines the fake CurrencySource company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Do not be fooled.

vi) The Spams:

We analyzed your resume and see you as a potential candidate of our firm.

You may learn about firm business activity on our web-site.

We'd like to offer you the Financial Manager job.

You may also hold a job in a different firm as our vacancy won't occupy a lot of time.

Requirements for the Financial manager position:

* the first probation month - $1500 (it'll grow up to $2500 in future)
* every transaction's commission is not less than 10% (out of cashed check sum or out of sum entered to your account).

Financial manager position obligations:

* Well-timed encashment of the checks drawn on your name
* Monthly report under performed operations
* Work efficiency

Financial manager position payment:

* 1-3 hours of free time per week
* Over 23 years old
* THE CITIZENSHIP OF THE USA is a must.

Our company undertakes to cover transmission, check clearance and all other expenses at its own cost. If you agree to work for our company, it is necessary for you to:

1) Reply to this email.
2) Provide your full name, home address and phone. FILL IN YOUR DATA CORRECTLY.

You are to take the following steps in order to get down to work:

1) Log on our company site by the link click here

and:

Hello,

We found your CV on the Internet. Therefore we'd like to offer you a position of an "Executive Manager". Our HR department studied your CV and length of service and highly recommends you for this work in our firm. The given position consists of the following tasks:

- timely filing of reports on the carried out work

- record keeping of customers in the USA.

You will receive more detailed instructions during an interview over the phone.

Person specification :

- Age: starting from 25

- Citizenship: US

- Time: must have from 1 to 2 hours of free time a day for carrying out his tasks.

salary for this position makes up 7000USD a month. The payment will be carried out to your bank account every month. There are many candidates willing to take up this offer, therefore we're kindly asking you not to delay with your decision about this position.

You may find detailed information about our firm at our homepage.

If this position is interesting to you, then please follow these steps:

1) Register at our homepage. To do so click on click here.

After doing so click on registration of "Executive Manager". Please fill out every field correctly, since data will be checked by our security department.

2) Pass an interview over the phone.

3) Sign a contract with our firm.

We would like to thank you beforehand and we're looking forward to a long-term cooperation.

vii) The Contract

CONTRACT # XR-3422

Financial Manager

CurrencySource
Ulica Senatorska,
34. 00-095 Warszawa, Poland
+48224892816

CurrencySource hereinafter referred to as PRINCIPAL, in the name of director general Anthony Miller, acting on the basis of company foundation charter of December, 12, 2004, on one side, and
Name (first, second, last)
E-mail
Daytime telephone number (with country code)
Cell phone number
Date of birth (mm / dd / yyyy)
Bank Account Number:
Routing number for ACH transfers:
Account type:

further referred to as MANAGER, acting on his own, on the other side, have concluded the present agreement on the following:
1. SUBJECT OF THE AGREEMENT

1.1. MANAGER shall carry out assets cashing in his country at the request of PRINCIPAL in his name and interest on the reward basis; the above-mentioned funds being the PRINCIPAL's property.

1.2. MANAGER is registered by PRINCIPAL under the code of US-1573. The code serves to provide mutual exchanges of MANAGER and PRINCIPAL.

2. OBLIGATIONS OF THE SIDES

2.1. MANAGER undertakes an obligation:

2.1.1. To accept bank checks to his/her postal address for further cashing at the request of PRINCIPAL

2.1.2. After getting the means delivered to the account of the MANAGER, to transfer them to the recipient indicated by PRINCIPAL within the following 24 hours with the exception of holidays and

2.1.3. To submit all the statements regarding executed operations connected with mutual activity to PRINCIPAL at his request.

2.2. PRINCIPAL is obliged:

2.2.1. To notify MANAGER timely about the issuance of check in his/her name for further cashing.

2.2.2. To pay for MANAGER's services of check cashing in the amount of 4-10% (percent) of the amount of the cashed check. MANAGER shall take out the mentioned sum during each transaction.

2.2.3. To pay MANAGER USD 1,500 monthly to his/her bank account as salary. The first payment is to be issued in a month after the conclusion of the present agreement.

2.2.4. To pay all the expenditures connected with: - check cashing - bank commission for money transfer - Western Union services. - other expenditures on agreement of the sides

2.2.5. Hold confidential data concerning MANAGER's personal account.

3. SPECIAL CONDITIONS AND RESPONSIBILITY OF THE SIDES.

3.1. MANAGER bears the responsibility for the means of PRINCIPAL being delivered to MANAGER as the result of PRINCIPAL's activity. MANAGER shall pay a penalty for the delay of money transfer in the amount of 1% (percent) for each delayed day.

3.2. In case of non-execution or violation of the conditions of the present agreement the sides shall be responsible within the limits of the existing legislation.

3.3. Termination of the agreement can be done before its term ends in case of systematic nonfulfillment of the duties by MANAGER, not earlier than within one month from the moment of notification sent to MANAGER by PRINCIPAL.

The sides shall settle accounts and MANAGER is obliged to hand over the assets pertaining to PRINCIPAL.

3.4. Disputes, unsettled by means of negotiation are subject to determination by arbitration court at the location of respondent.

Financial Consultant Company manager Anthony Miller

First and last name

First and last name
Date
Signature
Date Signature

4.1 ADDITIONAL INSTRUCTIONS After the contract sign, email or fax copy of signed contract and your personal ID to: E-mail: support@currencysource.net Fax: +1(678)609-4336

You don't get a clearer definition of the illegal 'Money Laundering Mule' function.

The above evidence clearly demonstrates beyond any doubt that the fake CurrencySource website has been stolen and has set up by criminal fraudsters purely for the purpose of spamvertising a fraud job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

CurrencySource Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

iq-biz.com.cn
currencysource.net
mycurrencysource.net
mycurrencysource.com
mycurrencysource.org
currencysource.biz
currencysource.org
my-currency.cn
mycurriencies.net

Registrar

Web Commerce Communications Limited (02-Sep-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (27-aug-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (23-Sep-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (25-Sep-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (25-Sep-2009)
Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (14-Oct-2009)
Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (14-Oct-2009)
Directi Web Services Private Limited (15-Oct-2009)
Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (WWWNAME) (19-oct-2009)

Host Network

Masterhost.ru
INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider)
INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider)
INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider)
INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider)
China Unicom Shandong province network
China Unicom Shandong province network
China Unicom Shandong province network
China Unicom Shandong province network

Host IP

83.222.23.126/83.222.23.176
81.176.226.110
81.176.226.110
81.176.226.110
81.176.69.137
61.156.242.119
61.156.242.119
61.156.242.119
61.156.242.119

Key:
Active
Suspended, disabled or Inactive
Parked

Please notify me of any other current domains used by this criminal.

Domain Whois Data:

Domain Name: iq-biz.com.cn ROID: 20090826s10011s23703441-cn Domain Status: clientDeleteProhibited Domain Status: clientUpdateProhibited Domain Status: clientTransferProhibited Registrant Organization: Leon Olbri Registrant Name: Leon Olbri Administrative Email: keitanys@hotmail.com Sponsoring Registrar: Web Commerce Communications Limited Name Server:ns.masterhost.ru Name Server:ns1.masterhost.ru Name Server:ns2.masterhost.ru Registration Date: 2009-08-26 16:07 Expiration Date: 2010-08-26 16:07	Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER Status: clientTransferProhibited Dates: Created 27-aug-2009 Updated 27-aug-2009 Expires 27-aug-2010 DNS Servers: NS1.1GB.RU NS2.1GB.RU Domain name: CURRENCYSOURCE.NET Name Server: ns1.1gb.ru Name Server: ns2.1gb.ru Creation Date: 2009.08.27 Expiration Date: 2010.08.27 Status: DELEGATED Registrant ID: YZJQCND-RU Registrant Name: Boris L Soroka Registrant Organization: Boris L Soroka Registrant Street1: Gagarin 12, 89 Registrant City: Moscow Registrant State: Moscow Registrant Postal Code: 100200 Registrant Country: RU Administrative, Technical Contact Contact ID: YZJQCND-RU Contact Name: Boris L Soroka Contact Organization: Boris L Soroka Contact Street1: Gagarin 12, 89 Contact City: Moscow Contact State: Moscow Contact Postal Code: 100200 Contact Country: RU Contact Phone: +74958853209 Contact E-mail: swe900@gmail.com	Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER Status: clientTransferProhibited Dates: Created 23-sep-2009 Updated 23-sep-2009 Expires 23-sep-2010 DNS Servers: NS1.1GB.RU NS2.1GB.RU Domain name: MYCURRENCYSOURCE.NET Name Server: ns1.1gb.ru Name Server: ns2.1gb.ru Creation Date: 2009.09.23 Expiration Date: 2010.09.23 Status: DELEGATED Registrant ID: CBX3HO1-RU Registrant Name: Malvina P Nesterenko Registrant Organization: Malvina P Nesterenko Registrant Street1: Marata 12-1,33 Registrant City: Sankt-Peterburg Registrant State: Sankt-Peterburg Registrant Postal Code: 191119 Registrant Country: RU Administrative, Technical Contact Contact ID: CBX3HO1-RU Contact Name: Malvina P Nesterenko Contact Organization: Malvina P Nesterenko Contact Street1: Marata 12-1,33 Contact City: Sankt-Peterburg Contact State: Sankt-Peterburg Contact Postal Code: 191119 Contact Country: RU Contact Phone: +78125263322 Contact E-mail: ttctechnology@rambler.ru Registrar: ANO Regional Network Information Center dba RU-CENTER
Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER Status: clientTransferProhibited Dates: Created 25-sep-2009 Updated 25-sep-2009 Expires 25-sep-2010 DNS Servers: NS1.1GB.RU NS2.1GB.RU Domain name: MYCURRENCYSOURCE.COM Name Server: ns1.1gb.ru Name Server: ns2.1gb.ru Creation Date: 2009.09.25 Status: DELEGATED Registrant ID: 2ALVGPX-RU Registrant Name: Alexander M Kalinin Registrant Organization: Alexander M Kalinin Registrant Street1: Pushkin 23, 556 Registrant City: Moscow Registrant State: Moscow Registrant Postal Code: 100132 Registrant Country: RU Administrative, Technical Contact Contact ID: 2ALVGPX-RU Contact Name: Alexander M Kalinin Contact Organization: Alexander M Kalinin Contact Street1: Pushkin 23, 556 Contact City: Moscow Contact State: Moscow Contact Postal Code: 100132 Contact Country: RU Contact Phone: +7 495 2384535 Contact E-mail: jobs.lancer@gmail.com Registrar: ANO Regional Network Information Center dba RU-CENTER	Domain ID:D157188498-LROR Domain Name:MYCURRENCYSOURCE.ORG Created On:25-Sep-2009 08:01:34 UTC Last Updated On:25-Sep-2009 08:01:38 UTC Expiration Date:25-Sep-2010 08:01:34 UTC Sponsoring Registrar:ANO Regional Network Information Center dba RU-CENTER (R148-LROR) Status:CLIENT TRANSFER PROHIBITED Status:TRANSFER PROHIBITED Status:ADDPERIOD Registrant ID:MZMBSAN-RU Registrant Name:Boris L Soroka Registrant Organization:Boris L Soroka Registrant Street1:Pervomaiskaya 54, 44 Registrant Street2: Registrant Street3: Registrant City:Moscow Registrant State/Province:Moscow Registrant Postal Code:101001 Registrant Country:RU Registrant Phone:+7.4958745962 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:shhampton6@gmail.com Admin ID:MZMBSAN-RU Admin Name:Boris L Soroka Admin Organization:Boris L Soroka Admin Street1:Pervomaiskaya 54, 44 Admin Street2: Admin Street3: Admin City:Moscow Admin State/Province:Moscow Admin Postal Code:101001 Admin Country:RU Admin Phone:+7.4958745962 Admin Phone Ext.: Admin FAX: Admin FAX Ext.: Admin Email:shhampton6@gmail.com Tech ID:MZMBSAN-RU Tech Name:Boris L Soroka Tech Organization:Boris L Soroka Tech Street1:Pervomaiskaya 54, 44 Tech Street2: Tech Street3: Tech City:Moscow Tech State/Province:Moscow Tech Postal Code:101001 Tech Country:RU Tech Phone:+7.4958745962 Tech Phone Ext.: Tech FAX: Tech FAX Ext.: Tech Email:shhampton6@gmail.com Name Server:NS1.1GB.RU Name Server:NS2.1GB.RU	Domain Name: CURRENCYSOURCE.BIZ Domain ID: D34355751-BIZ Sponsoring Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM Sponsoring Registrar IANA ID: 303 Domain Status: clientTransferProhibited Registrant ID: PP-SP-001 Registrant Name: Domain Admin Registrant Organization: PrivacyProtect.org Registrant Address1: P.O. Box 97 Registrant Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org Registrant City: Moergestel Registrant Postal Code: 5066 ZH Registrant Country: Netherlands Registrant Country Code: NL Registrant Phone Number: +45.36946676 Registrant Email: contact@privacyprotect.org Administrative Contact ID: PP-SP-001 Administrative Contact Name: Domain Admin Administrative Contact Organization: PrivacyProtect.org Administrative Contact Address1: P.O. Box 97 Administrative Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org Administrative Contact City: Moergestel Administrative Contact Postal Code: 5066 ZH Administrative Contact Country: Netherlands Administrative Contact Country Code: NL Administrative Contact Phone Number: +45.36946676 Administrative Contact Email: contact@privacyprotect.org Billing Contact ID: PP-SP-001 Billing Contact Name: Domain Admin Billing Contact Organization: PrivacyProtect.org Billing Contact Address1: P.O. Box 97 Billing Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org Billing Contact City: Moergestel Billing Contact Postal Code: 5066 ZH Billing Contact Country: Netherlands Billing Contact Country Code: NL Billing Contact Phone Number: +45.36946676 Billing Contact Email: contact@privacyprotect.org Technical Contact ID: PP-SP-001 Technical Contact Name: Domain Admin Technical Contact Organization: PrivacyProtect.org Technical Contact Address1: P.O. Box 97 Technical Contact Address2: Note - All Postal Mails Rejected, visit Privacyprotect.org Technical Contact City: Moergestel Technical Contact Postal Code: 5066 ZH Technical Contact Country: Netherlands Technical Contact Country Code: NL Technical Contact Phone Number: +45.36946676 Technical Contact Email: contact@privacyprotect.org Name Server: NS1.CURRENCYSOURCE.BIZ Name Server: NS2.CURRENCYSOURCE.BIZ Created by Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM Last Updated by Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM Domain Registration Date: Wed Oct 14 08:37:02 GMT 2009 Domain Expiration Date: Wed Oct 13 23:59:59 GMT 2010 Domain Last Updated Date: Fri Oct 16 08:07:17 GMT 2009
Domain ID:D157346044-LROR Domain Name:CURRENCYSOURCE.ORG Created On:14-Oct-2009 08:37:13 UTC Last Updated On:16-Oct-2009 08:19:22 UTC Expiration Date:14-Oct-2010 08:37:13 UTC Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (R27-LROR) Status:CLIENT TRANSFER PROHIBITED Status:TRANSFER PROHIBITED Registrant ID:PP-SP-001 Registrant Name:Domain Admin Registrant Organization:PrivacyProtect.org Registrant Street1:P.O. Box 97 Registrant Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org Registrant Street3: Registrant City:Moergestel Registrant State/Province: Registrant Postal Code:5066 ZH Registrant Country:NL Registrant Phone:+45.36946676 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:contact@privacyprotect.org Admin ID:PP-SP-001 Admin Name:Domain Admin Admin Organization:PrivacyProtect.org Admin Street1:P.O. Box 97 Admin Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org Admin Street3: Admin City:Moergestel Admin State/Province: Admin Postal Code:5066 ZH Admin Country:NL Admin Phone:+45.36946676 Admin Phone Ext.: Admin FAX: Admin FAX Ext.: Admin Email:contact@privacyprotect.org Tech ID:PP-SP-001 Tech Name:Domain Admin Tech Organization:PrivacyProtect.org Tech Street1:P.O. Box 97 Tech Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org Tech Street3: Tech City:Moergestel Tech State/Province: Tech Postal Code:5066 ZH Tech Country:NL Tech Phone:+45.36946676 Tech Phone Ext.: Tech FAX: Tech FAX Ext.: Tech Email:contact@privacyprotect.org Name Server:NS1.CURRENCYSOURCE.ORG Name Server:NS2.CURRENCYSOURCE.ORG	Domain Name: my-currency.cn ROID: 20091015s10001s73452026-cn Domain Status: ok Registrant Organization: N/A Registrant Name: Soroka Boris Administrative Email: cool.kalinin2010@yandex.ru Sponsoring Registrar: Directi Web Services Private Limited Name Server:ns1.my-currency.cn Name Server:ns2.my-currency.cn Registration Date: 2009-10-15 04:54 Expiration Date: 2010-10-15 04:54	Domain Name: MYCURRIENCIES.NET Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM Status: clientTransferProhibited Dates: Created 19-oct-2009 Updated 19-oct-2009 Expires 19-oct-2010 DNS Servers: NS1.MYCURRIENCIES.NET NS2.MYCURRIENCIES.NET Registration Service Provided By: WWWNAME Contact: +7.4957439643 Website: http://wwwname.ru Registrant: N/A Soroka Boris (cool.kalinin2010@yandex.ru) Lugovaya, 5 , Moskva, 100101, RU Moskva Moskovskaya oblast,100101 RU Tel. +7.459890609 Creation Date: 19-Oct-2009 Expiration Date: 19-Oct-2010 Domain servers in listed order: ns2.mycurriencies.net ns1.mycurriencies.net Administrative Contact: N/A Soroka Boris (cool.kalinin2010@yandex.ru) Lugovaya, 5 , Moskva, 100101, RU Moskva Moskovskaya oblast,100101 RU Tel. +7.459890609 Technical Contact: N/A Soroka Boris (cool.kalinin2010@yandex.ru) Lugovaya, 5 , Moskva, 100101, RU Moskva Moskovskaya oblast,100101 RU Tel. +7.459890609 Billing Contact: N/A Soroka Boris (cool.kalinin2010@yandex.ru) Lugovaya, 5 , Moskva, 100101, RU Moskva Moskovskaya oblast,100101 RU Tel. +7.459890609 Status:ACTIVE

DNS Lookup: iq-biz.com.cn A record
Searching for iq-biz.com.cn A record at d.root-servers.net [128.8.10.90]: Got referral to C.DNS.cn. (zone: cn.)
Searching for iq-biz.com.cn A record at NS.CERNET.NET. [202.112.0.44]: Got referral to ns2.masterhost.ru. (zone: iq-biz.com.cn.)
Searching for iq-biz.com.cn A record at ns2.masterhost.ru. [217.16.22.30]: Reports iq-biz.com.cn.
Response:

Domain	Type	Class	TTL	Answer
iq-biz.com.cn.	A	IN	900	83.222.23.126
iq-biz.com.cn.	A	IN	900	83.222.23.176
iq-biz.com.cn.	NS	IN	900	ns1.masterhost.ru.
iq-biz.com.cn.	NS	IN	900	ns2.masterhost.ru.
iq-biz.com.cn.	NS	IN	900	ns.masterhost.ru.
ns1.masterhost.ru.	A	IN	900	217.16.16.30
ns2.masterhost.ru.	A	IN	900	217.16.22.30
ns.masterhost.ru.	A	IN	900	217.16.20.30

Looking up at the 3 iq-biz.com.cn. parent servers:

Server	Response
ns2.masterhost.ru [217.16.22.30]	83.222.23.126 83.222.23.176
ns1.masterhost.ru [217.16.16.30]	83.222.23.126 83.222.23.176
ns.masterhost.ru [217.16.20.30]	83.222.23.126 83.222.23.176

The host of this criminal fraudster is Masterhost.ru on IP addresses 83.222.23.126 and 83.222.23.176. Unfortunately, Masterhost.ru support criminal fraudsters by refusing all requests to suspend the hosting of their criminal clients. These are the same hosting details as for the Poland Real Estate, San Marca, Babochka scammers and others.

DNS Lookup: currencysource.net A record
Searching for currencysource.net A record at i.root-servers.net [192.36.148.17]: Got referral to J.GTLD-SERVERS.net. (zone: net.)
Searching for currencysource.net A record at J.GTLD-SERVERS.net. [192.48.79.30]: Got referral to ns2.1gb.ru. (zone: currencysource.net.)
Searching for currencysource.net A record at ns2.1gb.ru. [195.161.112.91]: Reports currencysource.net.
Response:

Domain	Type	Class	TTL	Answer
currencysource.net.	A	IN	3600	81.176.226.110

Looking up at the 2 currencysource.net. parent servers:

Server	Response
ns2.1gb.ru [195.161.112.91]	81.176.226.110
ns1.1gb.ru [81.176.69.150]	81.176.226.110

The host of the criminal domain currencysource.net is INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider) on IP address 81.176.226.110

***Latest News*** Initial entry 20th. September 2009

***Latest News*** 22nd. September 2009
The domain hosting for iq-biz.com.cn appears to have been ceased.

***Latest News*** 23rd. September 2009
The hosting of the domain currencysource.net has been ceased.

***Latest News*** 25th. September 2009
New domain reported by site contact - mycurrencysource.com, (mycurrencysource.net and mycurrencysource.org also located), hosted as below:
DNS Data (valid for mycurrencysource.com, mycurrencysource.net)
DNS Lookup: mycurrencysource.com A record
Searching for mycurrencysource.com A record at i.root-servers.net [192.36.148.17]: Got referral to F.GTLD-SERVERS.NET. (zone: com.)
Searching for mycurrencysource.com A record at F.GTLD-SERVERS.NET. [192.35.51.30]: Got referral to ns1.1gb.ru. (zone: mycurrencysource.com.)
Searching for mycurrencysource.com A record at ns1.1gb.ru. [81.176.69.150]: Reports mycurrencysource.com.
Response:

Domain	Type	Class	TTL	Answer
mycurrencysource.com.	A	IN	3600	81.176.226.110

Looking up at the 2 mycurrencysource.com. parent servers:

Server	Response
ns2.1gb.ru [195.161.112.91]	81.176.226.110
ns1.1gb.ru [81.176.69.150]	81.176.226.110

The current host of the criminal domains mycurrencysource.net & mycurrencysource.com is INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider) on IP address 81.176.226.110.

The criminal has also registered the domain mycurrencysource.org, hosted on the following network:
DNS Data (valid for mycurrencysource.org)
DNS Lookup: mycurrencysource.org A record
Searching for mycurrencysource.org A record at g.root-servers.net [192.112.36.4]: Got referral to C0.ORG.AFILIAS-NST.INFO. (zone: org.)
Searching for mycurrencysource.org A record at C0.ORG.AFILIAS-NST.INFO. [199.19.53.1]: Got referral to ns1.1gb.ru. (zone: mycurrencysource.org.)
Searching for mycurrencysource.org A record at ns1.1gb.ru. [81.176.69.150]: Reports mycurrencysource.org.
Response:

Domain	Type	Class	TTL	Answer
mycurrencysource.org.	A	IN	3600	81.176.69.137

Looking up at the 2 mycurrencysource.org. parent servers:

Server	Response
ns2.1gb.ru [195.161.112.91]	81.176.69.137
ns1.1gb.ru [81.176.69.150]	81.176.69.137

The current host of the criminal domain mycurrencysource.org is INSOLVERTC2 (In-Solve/1Gb.ru hosting services provider) on IP address 81.176.69.137.

***Latest News*** 27th. September 2009
The criminal's domain mycurrencysource.org has been disabled, however, domains mycurrencysource.net and mycurrencysource.com remain active on IP address 81.176.226.110.

***Latest News*** 21st. October 2009
News from genuine site owner - the criminal is now using the domains currencysource.biz and currencysource.org for his criminal activities.

DNS Lookup for currencysource.biz

Searching for currencysource.biz. A record at M.ROOT-SERVERS.NET. [202.12.27.33] ...took 11 ms
Searching for currencysource.biz. A record at B.GTLD.biz. [209.173.57.162] ...took 120 ms
Searching for currencysource.biz. A record at NS2.currencysource.biz. [61.156.242.119] ...took 373 ms

A record found: 61.156.242.119

Domain	Type	TTL	Answer
currencysource.biz.	NS	14400	ns1.currencysource.biz.
currencysource.biz.	NS	14400	ns2.currencysource.biz.
currencysource.biz.	A	14400	61.156.242.119

DNS Lookup for currencysource.org

Searching for currencysource.org. A record at H.ROOT-SERVERS.NET. [128.63.2.53]
Searching for currencysource.org. A record at a0.org.afilias-nst.info. [199.19.56.1]
Searching for currencysource.org. A record at ns1.currencysource.org. [61.156.242.119]

A record found: 61.156.242.119

Domain	Type	TTL	Answer
currencysource.org.	NS	14400	ns1.currencysource.biz.
currencysource.org.	NS	14400	ns2.currencysource.biz.
currencysource.org.	A	14400	61.156.242.119

The common host of these two criminal fraud domains is China Unicom Shandong province network on IP address 61.156.242.119. This IP is also the host to other fake clear money mule/financial fraud/reshipping fraud websites such as 24 Spanish Realty Ltd.(TODAYNIC.COM, INC.), Castellum Group (ALANTRON BLTD.), Diamond (Advertising Agency) (ALANTRON BLTD.), InLogistics Ltd.(ALANTRON BLTD.), Top Box(ALANTRON BLTD.), NF Factory (fake 'bulletproof' host), (Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com).

Later: The domains currencysource.biz and currencysource.org have been suspended by the registrar - please notify me of any active domains for this criminal.

***Latest News*** 22nd. October 2009
New domain reported by genuine website and company owner - my-currency.cn, registered with 'Directi Web Services Private Limited' and still hosted on the previous network as follows:

Searching for my-currency.cn. A record at E.ROOT-SERVERS.NET. [192.203.230.10]
Searching for my-currency.cn. A record at D.DNS.cn. [203.119.28.1]
Searching for my-currency.cn. A record at ns1.my-currency.cn. [61.156.242.119]

A record found: 61.156.242.119

Domain	Type	TTL	Answer
my-currency.cn.	NS	14400	ns1.currencysource.biz.
my-currency.cn.	NS	14400	ns2.currencysource.biz.
my-currency.cn.	A	14400	61.156.242.119

The host of the domain my-currency.cn is China Unicom Shandong province network on IP address 61.156.242.119. This IP is also the host to other fake clear money mule/financial fraud/reshipping fraud websites such as 24 Spanish Realty Ltd.(TODAYNIC.COM, INC.), Castellum Group (ALANTRON BLTD.), Diamond (Advertising Agency) (ALANTRON BLTD.), InLogistics Ltd.(ALANTRON BLTD.), Top Box(ALANTRON BLTD.), NF Factory (fake 'bulletproof' host), (Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com).

***Latest News*** 5th. November 2009
The domain my-currency.cn has been suspended. New domain noticed for these criminals - mycurriencies.net, (note the 'interesting' spelling), registered with DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM (WWWName.ru as reseller), and hosted on the same IP as before:

DNS Lookup: mycurriencies.net A record
Searching for mycurriencies.net A record at k.root-servers.net [193.0.14.129]: Got referral to j.gtld-servers.net. (zone: net.)
Searching for mycurriencies.net A record at j.gtld-servers.net. [192.48.79.30]: Got referral to ns2.mycurriencies.net. (zone: mycurriencies.net.)
Searching for mycurriencies.net A record at ns1.mycurriencies.net. [61.156.242.119]: Reports mycurriencies.net.
Response:

Domain	Type	Class	TTL	Answer
mycurriencies.net.	A	IN	14400	61.156.242.119
mycurriencies.net.	NS	IN	14400	ns1.currencysource.biz.
mycurriencies.net.	NS	IN	14400	ns2.currencysource.biz.

The host of the domain mycurriencies.net is China Unicom Shandong province network on IP address 61.156.242.119. This IP is also the host to other fake clear money mule/financial fraud/reshipping fraud websites such as 24 Spanish Realty Ltd.(TODAYNIC.COM, INC.), Castellum Group (ALANTRON BLTD.), Diamond (Advertising Agency) (ALANTRON BLTD.), InLogistics Ltd.(ALANTRON BLTD.), Top Box(ALANTRON BLTD.), NF Factory (fake 'bulletproof' host), (Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com) and others.

Later: The domain mycurriencies.net has been suspended - please notify me of any active domains for this criminal.