This De Cart Ltd. scam is the replacement fraud for the Renaissance Capital Advisors Ltd scam. It has identical text formats to several other web based and email based frauds including Trust Company Inc, Finance International, E-Z Transfer, SurRate Inc, Des Group Inc., Business & Professional Consultants Inc., and no doubt many others, in other words it's a standard run-of-the mill, patently transparent money transfer fraud of the type that are turned out by the dozen by the same bunch of criminals using the same hosts and registrars that they regularly use.

N.B. This fraudulent company should not be confused with any other company bearing a similar name. This fraudulent company is identified by these website graphics and the money laundering mule job it spamvertises.

De Cart Ltd. : Evidence of Criminal Fraud

i) De Cart Ltd. claims on their website: "The company was set up in 1997 in Los Angeles, CA, the USA by three enthusiasts having financial education.", but the criminal's multiple domains are all recently registered, e.g. the domain decartltd.biz was only registered with Melbourne IT (Yahoo as reseller) on January the 11th. 2008.

ii) Multiple domains used for the same fraud website, all with different bogus whois data.

iii) The only Google hits for "De Cart Ltd." are as scammers and fraudsters.

iv) The same website text is used as on all the other fraud sites listed above.

v) Their 'Privacy Protection' page refers to them as 'Bower Investments' which is just another one of their aliases - if you want to see more of their criminal aliases, do a Google Search on "is firmly committed to protecting the privacy and confidentiality of personal and business information."

vi) Of the six 'jobs' advertised on their website, this 'job' of 'Financial Agent' is the only one available and it uses exactly the same text as used by the Finance International scammers and others.:

FINANCIAL AGENT

Worldwide!
AVAILABLE

Location: Worldwide
Status: Opened
Employee Type: Part-Time Employee

The major duty of the incumbent is to promptly receive and process stockbrokers' payments to further transfer them applying specified method. Please enquire for detailed work scheme.

Requirements:
You must have Pay Pal Premier or Business account, and complete all verification.
Your Pay Pal account should be opened not less month ago.
Ability to schedule working hours effectively.
Availability of spare time (2-3 hours per day).
Advanced user ability to operate computer and to use Internet and e-mail.
Legal age.
Payment basis: commissions in the amount of 10% from each transaction (monthly payments of the total earnings). The salary is $2300 monthly.

Benefits:
Flexible work schedule.
Possibility to combine the job with primary employment.
Free training course.

There are NO start up or training fees. If you are interested in this vacancy please submit your resume to manager@decartltd.biz with subject "Financial Manager position" and it will be reviewed soon.
Time spent for consideration of your application can be reduced if you attach resume to your email.

In other words, just your average money laundering mule position.

vii) What sort of financial company is going to spamvertise for "FINANCIAL AGENT" among the untrained, inexperienced and uncertified general population? I think we all know the answer to that one.

The above evidence clearly demonstrates beyond any doubt that the De Cart Ltd. website has been set up by money laundering fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal money laundering activity and spamming - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

De Cart Ltd. Fraudsters - current hosting details [Updated 31st.. December 2007]

Current Main Domains, Hosts and Registrars

Domain

de-cartltd.biz
de-cartltd.org
decartltd.net
decartltd.biz
decartltd.org

Registrar

MELBOURNE IT LTD (Yahoo)
MELBOURNE IT LTD (Yahoo)
MELBOURNE IT LTD (Yahoo)
MELBOURNE IT LTD (Yahoo)
MELBOURNE IT LTD (Yahoo)

Host Network

Yahoo
Yahoo
Yahoo
Yahoo
Yahoo

Host IP

See DNS data
See DNS data
See DNS data
See DNS data
See DNS data

See table below for the full list of known active & suspended main domains used by this criminal.
Please notify me of any other current domains used by this criminal.

Current Botnet Nameserver Domains and Registrars

Not botnet hosted at present - DNS data below. See table below for the full list of known active & suspended nameserver domains for this criminal.

The Spam Headers

Fresh spam required, full source code please or as an attachment.

The Spam Content

Fresh spam required, full source code please or as an attachment.

The Zombie Botnet

The criminal as not using a zombie botnet at this time. Normal DNS Data below.

Initial DNS Data (de-cartltd.biz, de-cartltd.org, decartltd.net, decartltd.biz, decartltd.org)

How I am searching:

Searching for decartltd.biz A record at d.root-servers.net [128.8.10.90]: Got referral to A.GTLD.biz. (zone: biz.)
Searching for decartltd.biz A record at A.GTLD.biz. [209.173.53.162]: Got referral to YNS2.YAHOO.COM. (zone: decartltd.biz.)
Searching for decartltd.biz A record at YNS2.YAHOO.COM. [216.109.116.20]: Reports decartltd.biz. Response:

Domain	Type	Class	TTL	Answer
decartltd.biz.	A	IN	1200	216.39.58.205
decartltd.biz.	A	IN	1200	216.39.58.206
decartltd.biz.	A	IN	1200	216.39.58.207
decartltd.biz.	A	IN	1200	216.39.58.208
decartltd.biz.	A	IN	1200	216.39.58.209
decartltd.biz.	A	IN	1200	216.39.58.235
decartltd.biz.	NS	IN	86400	yns1.yahoo.com.
decartltd.biz.	NS	IN	86400	ns8.san.yahoo.com.
decartltd.biz.	NS	IN	86400	ns9.san.yahoo.com.
decartltd.biz.	NS	IN	86400	yns2.yahoo.com.
yns1.yahoo.com.	A	IN	1800	66.218.71.205
yns2.yahoo.com.	A	IN	1800	216.109.116.20
ns8.san.yahoo.com.	A	IN	1800	66.218.71.205
ns9.san.yahoo.com.	A	IN	1800	216.109.116.20

Looking up at the 2 decartltd.biz. parent servers:

Server	Response
yns2.yahoo.com [216.109.116.20]	216.39.58.202 216.39.58.203 216.39.58.204 216.39.58.205 216.39.58.206 216.39.58.207
yns1.yahoo.com [66.218.71.205]	216.39.58.192 216.39.58.193 216.39.58.194 216.39.58.195 216.39.58.196 216.39.58.197

The criminal is using the Yahoo 'small criminal's network' that is so often a favourite of crooks and scammers.

Here are all of the known domains that are/have been used for the De Cart Ltd. fraud:

Domain

de-cart-ltd.com
de-cartltd.biz
de-cartltd.com
de-cartltd.org
decart-ltd.com
decart-ltd.info
decart-ltd.biz
decart-ltd.org
decartltd.com
decartltd.net
decartltd.info
decartltd.biz
decartltd.org

Status

Unhosted
DNS Failure
Unhosted
Unhosted
Unhosted
Unhosted
Unhosted
Unhosted
Unhosted
DNS Failure
Unhosted
DNS Failure
DNS Failure

Registrar

MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)
MELBOURNE IT, LTD. (Yahoo)

Please notify me of any errors or domains not listed here.

i) The criminal will not respond to your challenge, but will use the notice to prepare a new network - immediate suspension is requested please, if allowed for by your AUP.

Fraud Blog

Initial entry 24th. January 2008

22nd. Feb. 2008 - No active domains known