Finance scam

Finance Fraud

Don't Bear Internet Fraud

Finance scam screenshot - 08-Sep-2009

This fraud should not be confused with any other company of the same or similar name - the above screenshot and the following fraud evidence defines and refers to this fake company alone and no other.

Finance is just another fake financial site used as a vehicle to legitimise a Russian money laundering mule recruiting fraud scam spamming campaign. The same website part-time, work from home money mule job of "Customer Manager" has also appeared on the Finance & Trade Advisory and Statecorporate scams among others and their fake location address of 29 Harley Street, London has been previously used by the Analytics and Trend Analytics scammers, so this crook's pedigree is pretty obvious. Their initial domain finance-ltd.com was only registered on 26-may-2009 for one year only with the unresponsive Turkish registrar ALANTRON BLTD and they are hosted by the Russian host, openhosting.ru. The payload of the site is a money mule 'job' of 'Customer Manager' located under the 'Careers' menu option. They have no web presence, their location and contact details are all bogus, their site content is stolen and they are not a genuinely registered business entity in their supposed location (UK).

Evidence of Criminal Fraud:

i) On their 'Company' page, (which is all stolen content, partly stolen from here and here and translated into pure Runglish), they claim "Finance Ltd has operate widely throughout the UK for many years and has been helpful in the development of a wide vary of destinations" but their domain finance-ltd.com was only registered with the Turkish registrar ALANTRON BLTD. on 26-may-2009 for one year only. A clear indication of a fake website. Why would a UK company use a Turkish registrar and a Russian host?

ii) The company name 'Finance' is so generic there is no point in doing a Google search for it and that is one reason why no genuine company would use such a generic name.

iii) The true purpose of the website is to lend legitimacy to a job website and email spamming campaign attempting to recruit money laundering mules and reshipping donkeys. Here is the job they publish on their own website:

Customer Manager

Job Summary:
- You will make some basic tasks from your manager daily;
- Manage personal assets;
- Making simple financial operations.

Requirements:
- High school or college in relevant field or 1+ years experience in management;
- Basic computer, good verbal and grammar skills;
- Well developed analytical, communication, and interpersonal skills
- Strong operational background and knowledge
- Exceptional people skills
- Problem solving skills
- Top notch communication and writing skills
- Drive to be the best

Apply Now

iv) The job is defined by the sentences:
- Manage personal assets;
- Making simple financial operations.

Do not be fooled - the first of the two tasks involves accepting 'personal assets' to your home address and reshipping them off to these fraudsters. The second involves accepting stolen funds to your personal bank account and transferring a balance to these crooks. Don't be fooled or you will end up losing a lot of money, having your bank account and your assets frozen and possibly ending up with a criminal record as this is the classic illegal money laundering mule and reshipping fraud functions.

Here's a typical job website spam from these crooks, (you'll currently see loads of them if you do a a Google search for "Receiving and processing of clients payments"):

v) The Job Website spam:

CUSTOMER MANAGER JOB $38000 Annually
Craigslist Chicago - Fri, 2009-08-21 15:45
Finance Ltd is seeking qualified candidates for the position of Customer Manager.

Duties:

Receiving and processing of clients payments.

Requirements:

? Ability to schedule working hours effectively.
? Availability of spare time (3-4 hours per day).
? Advanced user ability to operate computer and to use Internet and e-mail.
? Adult age.

Forward your resume to e-mail - job.manager@email.su

vi) No legitimate company is going to advertise for this sort of illegal part time, 'work from home - Receiving and processing of clients payments' money transferring among the untrained, inexperienced and uncertified general population overseas. It will cost you a lot of money and eventually the police will come knocking at your door. Do not be tempted.

vii) the Fake contact details from the website:

ADDRESS:

Suite B, 29 Harley Street, W1G 9QR, London

TEL/FAX: +44 20 3286 0762

GENERAL E-MAIL: mail@finance-ltd.com

ADDITIONAL OFFICE (USA):

TEL/FAX: +1 718 785 9491

• - A Google search for "29 Harley Street, London" clearly shows that this is an accommodation address, (and a virtual office service), and a well used one at that, (it was also used by the Analytics and Trend Analytics scammers.
• - Calling the number +44 20 3286 0762 results in the message "The number you have dialled has not been recognised" - it is a fake number
• - A Google Search for the telephone number +1 718 785 9491 returns only a fraud site listing and this crook's fake website.

viii) Finance are not a legal registered business entity in the UK Companies House, (the crooks have stolen the details of a non-trading company 'name-for-sale'), so the above details are bound to be bogus.

The above evidence clearly demonstrates beyond any doubt that the Finance website has been set up very recently by money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Main Website Domains

finance-ltd.com

Registrar

ALANTRON BLTD. - 26-may-2009

Active
Suspended/Disabled
Parked

Domain Whois Data:

Registrar: ALANTRON BLTD.
Status: ok
Dates: Created 26-may-2009 Updated 25-jul-2009 Expires 26-may-2010
DNS Servers: NS.OPENHOSTING.RU NS2.OPENHOSTING.RU

Arastirilan alan adi: finance-ltd.com
Ad / Name Eugeni Drobovitch
Adres ulitsa Leningradskaya d.30 kv.113 Sosnoviy Bor Leningradskaya oblast 188537
Tel +7.8136933024
Faks +7.8136933024
E-posta juror@mediahouse.at
Guncelleme / Updated

Ad gizli
Ad / Name Eugeni Drobovitch
Adres ulitsa Leningradskaya d.30 kv.113 Sosnoviy Bor Leningradskaya oblast 188537
Tel +7.8136933024
Faks +7.8136933024
E-posta juror@mediahouse.at
Guncelleme / Updated

Ad gizli
Ad / Name Eugeni Drobovitch
Adres ulitsa Leningradskaya d.30 kv.113 Sosnoviy Bor Leningradskaya oblast 188537
Tel +7.8136933024
Faks +7.8136933024
E-posta juror@mediahouse.at
Guncelleme / Updated

Alan Adi Sunucusu1 / DNS1 ns.openhosting.ru
Alan Adi Sunucusu1 IP / DNS1 IP
Alan Adi Sunucusu2 / DNS2 ns2.openhosting.ru
Alan Adi Sunucusu2 IP / DNS2 IP
Son Guncelleme/ Last Updated
Kayit Tarihi / Registration Date 2009-05-26
SKT / Exp. Date 2010-05-26
Statu Aktif

DNS Lookup: finance-ltd.com A record
Searching for finance-ltd.com A record at g.root-servers.net [192.112.36.4]: Got referral to H.GTLD-SERVERS.NET. (zone: com.)
Searching for finance-ltd.com A record at H.GTLD-SERVERS.NET. [192.54.112.30]: Got referral to ns2.openhosting.ru. (zone: finance-ltd.com.)
Searching for finance-ltd.com A record at ns2.openhosting.ru. [81.176.237.10]: Reports finance-ltd.com.
Response:

Domain	Type	Class	TTL	Answer
finance-ltd.com.	A	IN	10800	81.176.236.12
finance-ltd.com.	NS	IN	10800	ns2.openhosting.ru.
finance-ltd.com.	NS	IN	10800	ns.openhosting.ru.
ns.openhosting.ru.	A	IN	10800	81.176.236.10
ns2.openhosting.ru.	A	IN	10800	81.176.237.10

Looking up at the 2 finance-ltd.com. parent servers:

Server	Response
ns2.openhosting.ru [81.176.237.10]	81.176.236.12
ns.openhosting.ru [81.176.236.10]	81.176.236.12

The host for this criminal fraudster is OPENHOSTING-RT (VPS Hosting) on IP address 81.176.236.12

***Latest News*** 8th. September 2009
Webpage created