Farelli.net

Farelli.net Fraud

Don't Bear Internet Fraud

Farelli.net is just another run of the mill money Russian money laundering fraud site which is the spamvertised website for the ubiquitous money laundering spam campaign, (sample spam below). It's the usual glossy website that is set up to lend credence to the inevitable solicitation to commit criminal fraud by accepting 'payments' into your bank account and transferring them back out to these criminals, (less your percentage, of course), by Moneygram or Western Union. This is the usual (illegal!), money laundering function. Like most of these criminal websites, it has aliases, i.e. other identical sites under different bogus names. The sister site to this one is Osell International. See if you can spot the similarities, (it isn't very difficult - they're pretty well identical apart from the name......). They also had an identical alias of Fadella International but Estdomains have suspended their domain. Penson group Inc. is another old alias already taken down.

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the included money laundering job clearly identify the fake website and these fraudsters.

Farelli.net : Evidence of Criminal Fraud

i) Farelli.net claim on their website "Our company has been working in the field of electronic commerce for many years already.", but the criminal's domain Farelli.net was only registered with Estdomains on 21-DEC-2007.

ii) According to their front page, they only have 500 customers which is not very good if indeed they had been "working in the field of electronic commerce for many years already."

iii) The website is littered with the usual poor grammar and bad spelling of these bogus Russian sites, e.g. "Hollidays" and "comming" instead of "holidays" and "coming" on the home page.

iv) They have an identical alias in Osell International which also has exactly the same contact and location details.

v) As I type this, a Google search for "Farelli.net", (include quotes), shows no web presence, but it does show that their domain farelli.net was a deleted domain, (Deleted, Mar 13, 2007).

vi) The spam:

Hello, We thought that you might be interested in part time position to work from home with our company. My name is Paolo Covington, project coordinator and your direct supervisor at Farelli.net. Please read the information bellow about our company and your job description. Farelli.net is an online-to-offline international money transfer service. Farelli.net currently offers a secure, fast, and inexpensive means to send money from any of 26 countries to recipients in 18 countries. Farelli.net's headquarters is located in Rome, Italy. For more information, please visit our website: www.Farelli.net There are 5 openings for a representative to assist in creation our virtual local presence for the back office functions. Person, who is accepted for this position, will perform these tasks: 1. Facilitate the financial transactions from the clients. Farelli.net will organize the sales and marketing campaigns. Our manager will inform you when the transaction is expected to arrive. 2. Report to our manager on arrival of the payment. 3. Forward the payment to the customer at the destination. The instructions will be provided on the case-per-case bases
. 4. The average monthly salary is about 1500 - 4000 EURO. Your wages will be paid every month from the start of your employment by direct deposit to your bank account. You must have a bank account to receive wages from us. Plus you will receive a commission (3.5% - 4%) for the completed transaction. This commission will be paid out after every transaction. Also we have a rating system and bonus systems for the quarterly review. Dependant on your work results, you might be promoted to the management positions within 3-6 months. To continue please fill in our online application: http://www.Farelli.net/register.php Your information will be used only within Farelli.net. Every employee, who satisfies our requirements, will be contacted by our manager. At that time you will be able to ask any questions you might have. Best regards, Mr. Paolo Covington Project coordinator Farelli.net http://www.Farelli.net

The above is clearly a money mule function.

The above evidence clearly demonstrates beyond any doubt that the Farelli.net website has been set up by money laundering fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Farelli.net Fraudsters - current hosting details

Current Main Domains, Hosts and Registrars

Domain

Farelli.net

Registrar

Estdomains - 21-Dec-2007

Host Network

ZAO PeterStar

Host IPs

84.204.229.19

Please notify me of any other current domains used by this criminal.

Criminal Nameserver Domains and Registrars

N/A

DNS Data (Farelli.net)
How I am searching:

Searching for Farelli.net A record at f.root-servers.net [192.5.5.241]: Got referral to I.GTLD-SERVERS.net. (zone: net.)
Searching for Farelli.net A record at I.GTLD-SERVERS.net. [192.43.172.30]: Got referral to ns2.bizhosting.ru. (zone: farelli.net.)
Searching for Farelli.net A record at ns2.bizhosting.ru. [81.3.150.64]: Reports farelli.net. Response:

Domain	Type	Class	TTL	Answer
farelli.net.	A	IN	600	84.204.229.19
farelli.net.	NS	IN	600	ns1.bizhosting.ru.
farelli.net.	NS	IN	600	ns2.bizhosting.ru.
farelli.net.	NS	IN	600	ns3.bizhosting.ru.
ns1.bizhosting.ru.	A	IN	600	81.3.137.194
ns2.bizhosting.ru.	A	IN	600	81.3.150.64
ns3.bizhosting.ru.	A	IN	600	213.248.60.34

Looking up at the 3 farelli.net. parent servers:

Server	Response
ns2.bizhosting.ru [81.3.150.64]	84.204.229.19
ns3.bizhosting.ru [213.248.60.34]	84.204.229.19
ns1.bizhosting.ru [81.3.137.194]	84.204.229.19

The Russian host is ZAO PeterStar (84.204.229.19)

Fraud Blog Initial entry 4th. March 2008