Decapolis Investments

Decapolis Investments Fraud

Don't Bear Internet Fraud

Decapolis Investments is just another run-of-the mill fake financial site that exists solely to ensnare the unwary, whether it is to 'phish' for bank details or mainly to recruit money mules. The clues are all there that give the criminal's game away without a shadow of a doubt.

A search does not reveal any genuine company with a similar name, but this fraud should not be confused with any genuine company. The above logo is taken from the fraudulent site.

Evidence of Criminal Fraud:

i) According to the Decapolis Investments website front page: "We are strong team of brokers and have been working together over 10 years." Apart from the usual poor grammar, the domain decapolis-trading.com was only registered with ENOM, INC. on 26-Nov-2007.

ii) Their alternate domains decapolis-financial.com & decapolis-financial.org are/were hosted on the criminal hosting network AbdAllah Internet Hizmetleri/Ahlen.biz which is part of the Russian RBN criminals empire and is blocked in the UK.

iii) They have absolutely no internet presence as a genuine company.

iv) The criminals domain decapolis-trading.com has totally different bogus whois data to the other two.

v) Spammers - sample spam below.

vi) Standard money laundering mule job - note the "part-time/home based position" & "8% commission from every processed customer".

vii) They seem to be confused about whether they are called Decapolis Investments or Decapolis Financial, (both are used in the spam and on the website) or even Decapolis Trading.

Known Website Domains

decapolis-financial.org (Active)
decapolis-trading.com (Active)
decapolis-financial.com (Active)
krdns.biz (Active)

Nameserver Domains

krdns.biz (Active)

Registrar

ENOM, INC. 07-Nov-2007
ENOM, INC. (Rustelekom) 26-Nov-2007
ENOM, INC. (Rustelekom) 07-Nov-2007
ONLINENIC, INC. 21-Nov-2007

ONLINENIC, INC. (21-Nov-2007)

Network Data

How I am searching:

Searching for decapolis-trading.com A record at e.root-servers.net [192.203.230.10]: Got referral to I.GTLD-SERVERS.NET. (zone: com.)
Searching for decapolis-trading.com A record at I.GTLD-SERVERS.NET. [192.43.172.30]: Got referral to ns2.krdns.biz. (zone: decapolis-trading.com.)
Searching for decapolis-trading.com A record at ns2.krdns.biz. [211.172.232.125]: Reports decapolis-trading.com. Response:

Domain	Type	Class	TTL	Answer
decapolis-trading.com.	A	IN	14400	211.172.232.125
decapolis-trading.com.	NS	IN	86400	ns1.krdns.com.
decapolis-trading.com.	NS	IN	86400	ns2.krdns.com.

Looking up at the 2 decapolis-trading.com. parent servers:

Server	Response
ns2.krdns.biz [211.172.232.125]	211.172.232.125
ns1.krdns.biz [211.172.232.88]	211.172.232.125

Spam Headers: [awaiting headers]

Spam Body:

Subject: Absolute material independence!

Good day.

Our company has an opening for a Company Representative position. This will be a part-time/home based position and the applicant must have the following qualifications:

- E-mail access and ability to work 3-4 hours a day
- MS Word, MS Excel, PDF qualification
- Cell phone for urgent duties
- Adult age
- Higher education

Starting salary is 1,000.00 USD per month + 8% commission from every processed customer (over 3, 500.00 USD monthly).

Send your resume to our web form:
http://decapolis-trading.com/careers.php

We are proud to be an equal opportunity employer!

Sincerely Yours,
Michael Bonneville,
Decapolis Financial
www.decapolis-trading.com

Fraud Log

2nd. Dec. 2007
Webpage created

***Latest News*** 3rd. Dec. 2007
The three domains decapolis-financial.org, decapolis-trading.com, and decapolis-financial.com all reported as shut down by site contact. New domain noticed in the wild - ns2.krdns.biz (krdns.biz). He's actually using his nameserver domain as a site domain. Lets have a look at the network on that one!

Looking up at the 2 krdns.biz. parent servers:

Server	Response
ns2.krdns.biz [211.172.232.125]	211.172.232.88
ns1.krdns.biz [211.172.232.88]	211.172.232.88

If it proves one thing, it proves without doubt that these crooks register & use their own nameserver domains.

The host for that one (211.172.232.88 & 211.172.232.125) is HANNET-INFRA/KOREACOMPUTERIDC