Expressdeal Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
ExpressDeal Logo.

This Expressdeal fraud is another scam that shares its roots with many others such as Best Trade Solutions, GenCorp Financial Consulting, Progold Investments, Elite Finance Group, E-Investment Projects Inc. and numerous others, in other words it's a standard fraud, a demonstrably fake site of the type that is turned out by the dozen by the same bunch of criminals. At the end of the day it's just another standard money laundering mule job spamvertising site like all the others.

This Expressdeal fraudster bears no relation to any other company of a same or similar name and should not be confused. The above website graphics and the money laundering job below are intended to identify this fraudster alone.

Expressdeal : Evidence of Criminal Fraud


i)  On their 'About Us' page they claim "Established in 2005" but their domain expressdeal.info was only registered on 19-Oct-2007 with OnlineNic

ii) Their bogus job is exactly the same one as advertised by the 
Elite Finance Group fraudster among many others as "Processing Manager".

iii) In the 'About Us' blurb Expressdeal claim: yet Expressdeal have absolutely no Google internet presence apart from many listings as fraudsters and scammers.

iv) They claim Dun & Bradstreet rating, yet a D & B search easily proves this is a lie as they are not listed.

v) Their listed US contact information:

            Corporate Office USA
            11500 Northlake Drive
            Suite 305
            Cincinnati, Ohio

is totally bogus - the address actually belongs to the genuine Ward Financial Group.

vi) Their listed UK 'branch address':
            Graham Grow, 1966
            D430
            London, United Kingdom

is plainly bogus meaningless nonsense

vii) The payload of the Expressdeal website is the usual part-time money mule job. This time it's under "ACCESABLE VACANCIES" (note the incorrect spelling), and is called a "Investment Payout & Shipping manager" and here are the details copied directly from their website:

ACCESABLE VACANCIES

Closing Date:    Open until filled

Position:   Investment Payout & Shipping manager

Salary:  Depends on Work Scope/ bonus & benefits

Duty Location: United States

Description of Duties

Correspondence Manager::

 The Investment Payout Manager is a very important position in corporation, eventually they are the main work-chain of BTS, that is why all CV's will be carefully checked, including but not limited with background information check and with criminal reports.

* Some details of the work with our company are subject for changes. However that should have give a reason for worries, as our employees are always notified in advance, and participate in work only if they agree to the changes.

Salary
The Salary depends on the work scope you wish to make, BTS will pay you AMOUNT$ per month, and AMOUNT% per transfer/payment you will successfully process. Our most successful Investment Payout Manager receive at least 12 transfers per month, and their salary starts from 1-2000$ per month.

This work is part-time, and you shall work at home, there is no need to be in the office for 10 hrs a day, you will need no more then 3 hrs per day to fulfill the tasks you will receive, then - you may do whatever you wish.


Candidate requirements

*The brief training course is enclosed.

 

General:
This job will allow You to:


In other words a standard illegal money mule job involving part time working from home processing 'transfers' via Western Union for a percentage cut. Note that they refer to themselves as "BTS" which is one of their previous aliases - Best Trade Solutions.
v) No legitimate company would use private individuals to transfer money in this way. To do so is illegal and defines the company as both bogus and criminal.


The above evidence clearly demonstrates that the Expressdeal website is a fraudulent website set up with intent to deceive. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is usually false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
Expressdeal Fraudsters - current hosting details [Updated 19th. Jan. 2008]

Current Main Domains, Hosts and  Registrars
Domain

expressdeal.info
Registrar

OnlineNic
Host Network

AbdAllah Internet Hizmetleri
Host IP

88.255.90.227

See table below for the full list of known active & suspended main domains used by this criminal.
Please notify me of any other current domains used by this criminal.

Current Botnet Nameserver Domains and Registrars
Not botnet hosted at present - DNS data below. See table below for the full list of known active & suspended nameserver domains for this criminal.

The Spam Headers

Fresh spam required, full source code please or as an attachment.



The Spam Content

Hello,

Expressdeal Company is looking for new candidates for the shipping
manager position.
We are the world's largest global transportation company, operating in
more than 18 countries and territories and employing 200 people worldwide.
Many Internet auctions and stores in the US do not ship the products
overseas. As the result thousands of customers in Europe and Asia are not able to
access the large market and purchasehigh-quality merchandise at so low
prices. Our service is in the ever-growing demand. Today we have more then 80
merchandise managers on the territory of the United States and Canada but quantity
of our customers increases and we plan to expand.

As a part-time employee, you'll have access to the following benefits:


- You need 8-10 hours free during the week, not more
- Free USPS shipping
-Comprehensive medical and life insurance for you and your dependents
- Weekly paychecks
- Direct deposit
- Set work schedule
- And more others benefits, which you can find on our web site or call to
our Careers Center!

More information about this position and our company you can find at
our web site: www.expressdeal.info

The Zombie Botnet

The criminal as not using a zombie botnet at this time. Normal DNS Data below.

DNS Data for expressdeal.info

How I am searching:

Searching for expressdeal.info A record at i.root-servers.net [192.36.148.17]: Got referral to C9.INFO.AFILIAS-NST.info. (zone: info.)
Searching for expressdeal.info A record at C9.INFO.AFILIAS-NST.info. [199.7.66.33]: Got referral to ns1.myserverdns.com. (zone: expressdeal.info.)
Searching for expressdeal.info A record at ns1.myserverdns.com. [88.255.90.226]: Timed out. Trying again.
Searching for expressdeal.info A record at ns1.myserverdns.com. [88.255.90.226]: Reports expressdeal.info. Response:
Domain Type Class TTL Answer
expressdeal.info. A IN 14400 88.255.90.227
expressdeal.info. NS IN 86400 ns2.myserverdns.com.
expressdeal.info. NS IN 86400 ns1.myserverdns.com.
ns1.myserverdns.com. A IN 14400 88.255.90.228
ns2.myserverdns.com. A IN 14400 88.255.90.229

Looking up at the 2 expressdeal.info. parent servers:

Server Response
ns2.myserverdns.com [88.255.90.229]  88.255.90.227
ns1.myserverdns.com [88.255.90.226]  88.255.90.227

The host of this criminal's website on 88.255.90.227 is the well known Russian RBN criminal host AbdAllah Internet Hizmetleri

The nameservers ns1 & ns2.myserverdns.com are used by numerous other criminal fraudsters. The domain myserverdns.com was only registered with Enom on 26-Oct-2007. It is obviously a criminal owned domain. These DNS details are also shared by the Progressive Escrow Fraudster.


Here are all of the known domains that are/have been used for the
Expressdeal - fraud:

Domain

expressdeal.info

myserverdns.com
Status

Active
Active
Registrar

OnlineNic
Enom (Rustelekom)

Please notify me of any errors or domains not listed here.

i) The criminal will not respond to your challenge, but will use the notice to prepare a new network - immediate suspension is requested please, if allowed for by your AUP.

Fraud Blog

Initial entry 19th. January 2008