Grehem GmbH Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
Grehem GmbH screenshot (18-May-2009)
Grehem GmbH screenshot (18-May-2009)

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the included money laundering job clearly identify the fake website and these criminal fraudsters.

Grehem GmbH This is just a standard scam website that has been set up to form a front for a money laundering job spamming campaign. The website is stolen from the genuine company DEG and modified to suit the criminal's purposes. They claim to have been founded in 1962, but the criminal's domain grehemgmbh.com was only registered with the Chinese registrar BIZCN.COM, INC. on 15-Apr-2009 for the usual criminal's registration minimum period of only one year. They claim to be located in Germany, but they are not registered in the German company register "Handelsregister" which clearly defines the company as fraudulent. The whole purpose of the stolen website is to lend an air of legitimacy to the heavily spamvertised, (spam copy below), illegal 'money mule' job of "Overseas operator" which entails accepting stolen funds into your personal account and transferring a balance back to these criminals by Western Union/Moneygram. It will get your bank account closed, your assets frozen, lose you a lot of money and could cost you your liberty - don't be tempted. They have another current alias of Deplast and an already suspended domain of grehem.com.

Grehem GmbH  : Evidence of Criminal Fraud

i) Grehem GmbH claim on the above screenshot of their stolen homepage: "Grehem, member of STR Investitionsgesellschaft (KfW banking group), has been financing and structuring the investments of private enterprises in developing and transition countries for more than 45 years. As one of the largest European development finance institutions for the promotion of the private sector, Grehem is a reliable partner with long-standing experience even in rather difficult times". However, the criminal's domain grehemgmbh.com was only registered with the Chinese registrar BIZCN.COM, INC. on 15-Apr-2009 for the usual criminal's registration minimum period of only one year - clear evidence of a fraudulent registration.

ii) A Google search for "Grehem GmbH" shows absolutely no internet presence at all for this particular Grehem GmbH, apart from their own fake website, of course and an already suspended domain of grehem.com. If they had indeed been in business for more than 45 years they would have a large presence. The fact that they do not is clear evidence of a fake company. The search also shows evidence of job spamming.

iii) Fake Contact Details:

Firstly from their 'Contact' page:
Contact

Lychener Str. 83/2 10437 Berlin, Germany.
(913) 1929 1420

e-mail: kurt.marek1973@gmail.com

• - Note the highly professional (not) contact email address of kurt.marek1973@gmail.com. Always an indication of a fraudster.
• - They are not listed by Google Maps at that address, nor by anyone else, apart from their own fake & suspended website, of course.
• - The telephone number (913) 1929 1420 returns no Google hits apart from their own fake website, of course.
Secondly from their 'Imprint and Disclaimer' page:
Imprint and Disclaimer
Grehem - Deutsche Investitions- und Entwicklungsgesellschaft mbH
Head Office     Kämmergasse 22, 50676 Köln, Germany
Postal Address     Postfach 10 09 61, 50449 Köln, Germany
Telephone     + 49 913 1929-1420
Telefax     + 49 913 1929-1420-573
Legal Status     GmbH (Limited liability company)
Registration Court     Amtsgericht Köln
Commercial Register No.     HRB 1005
Board of Management     Dr Winfried Polte (Chairman)
Dr Michael Bornmann
Philipp Kreutz
Chairman of the Supervisory Board     Erich Stather (State Secretary, Federal Ministry for Economic Cooperation and Development)
VAT Identification No.     DE 123 489 824
Responsible     Cordula Rinsche
Grehem, Corporate Strategy and Communications
E-mail     info@grehemgmbh.com
Concept and Programming     Grehem and KfW

• - Clearly fraudulent and very amateurish - totally different location from the first lot - it's simply the company details, (including the Handelsregister(HRB) number 1005) for the genuine company DEG from whom they have stolen the website. They've just replaced the genuine telephone numbers with their own fake ones & added their email address.
All absolutely irrefutable evidence of fraud

v) A search of the German Handelsregister shows that there is no such company as "Grehem GmbH" registered in Germany - irrefutable evidence of fraud.

vi) The Spam:
From: Miriam ROY <xxxxxxxx@hotmail.com>
Date: 2009/5/5
Subject: Looking for Part-time z-Job ?

Grehem GmbH.

Vacant position: Overseas operator.

As one of the world's leading investors, Grehem’s objective remains solid: to be the most important investor company in the world. We invest in people and technologies, support and fund industry research around the world.

We are looking for energetic, hardworking and responsible individuals to supervise orders from our clients.

Job Details:

    * Company: Grehem GmbH.
    * Location: Europe
    * Employee Type: Full or Part-Time
    * Industry: Investments
    * Job Type: Overseas operator
    * Experience: Not Specified

The duties include:

    * Analyzing the market
    * Gathering information about firms in your region
    * Processing weekly payments for orders
    * Maintaining your own salary records

Minimum qualifications include:

    * Age: from 23 years
    * Well developed analytical and interpersonal skills
    * Top notch communication and writing skills
    * Strong operational background and knowledge

If you are interested please reply to: foster.kropp@gmail.com

Thank you.
An identical spam is being posted on Craigslist etc. by their Deplast alias. The pertinent sentence is "* Processing weekly payments for orders" which consists of the ILLEGAL money laundering mule function of accepting stolen funds into your personal account and transferring a balance back to these criminals by Western Union/Moneygram. It will get your bank account closed, your assets frozen, lose you a lot of money and could cost you your liberty - don't be tempted.
If you reply to this spammy solicitation, you will get the following job information:
Activity details

At the territory of Europe our company has a lot of partner-companies, which Grehem GmbH helps with investments. In order to pay for our services they prefer to use money transfers and often refuse other ways of payment.

How does it works

Our customers (natural persons) send money transfer to your bank account. We contact you by phone – inform you about transfer (for example, 2000 euros). After that you withdraw received money from an account, keep 5% of transfer (in this case 100 euros) – it is your agential fee, the rest 1900 euro you send through Western Union to our courier, we will provide you with courier information beforehand. Part-time work, 1-3 transfers per week. Our partners have chosen this way of paying for our sells services, because this is the most effective and economical method, and often refuse to pay for our services in other way. Only a money transfer to our financial operators in Europe.

This is official work. Placing in a job is realized according to European legislation and fixed international standards in a sphere of protection of labour. Your CV will be examined and if you will be approved on a position of regional agent we will send you a contract (agential agreement) which is need to be signed. After signing the contract, you send us scanned version of this agreement (scan of the contract). Then from our party also there is a contract signing by a responsible face of the company, we assure the contract a common seal and we send to you by E-mail. One copy should be stored at you, the second in archive of a staff department of the company. The contract insures both parties against the possible risks connected with monetary transactions. The contract comes into force after acknowledgement by you, that you have accepted it.

From you it is required

1. Send to company’s E-mail your CV (short about yourself)
2. To send scanned version of your passport
3. Your bank account details for transfer of money.


Please, send the resume to the address of staff manager : 
foster.kropp@gmail.com

Best regards, staff manager Foster.

www.grehemgmbh.com
I love the pure 'Runglish' of these things....In other words, it's just your average ILLEGAL money laundering mule position of accepting STOLEN FUNDS into your bank account that will get your account and your assets frozen, lose you a lot of money and could earn you a criminal record. Clear evidence of criminal fraud. You also get a contract to sign and Fax. back and an identity theft form, (aka 'EMPLOYEE REGISTRATION FORM' which even asks if you are married or engaged to be married so perhaps it doubles up as a dating site registration form....), and a bank details form which I'll not publish as they are rather space consuming & wordy...
vii) No legitimate company is going to advertise among the untrained, inexperienced and uncertified general population for an "Overseas operator" acting as a criminal money transfer agent. Apart from all of the other damning evidence, it clearly defines Grehem GmbH as a criminal fraud organisation.
The above evidence clearly demonstrates beyond any doubt that the Grehem GmbH website has been set up by money laundering criminal fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
Grehem GmbH Fraudsters - hosting details

Main Domains, Registrars and Hosts  
Domain

grehem.com
grehemgmbh.com
 		 Registrar

ENOM, INC. (Rustelekom) 17-Feb-2009
BIZCN.COM, INC. on 15-Apr-2009
 Host Network

-
Netelligent Hosting Services Inc. of Laval, Quebec, Canada
 Host IP

-
67.212.80.121
Key:
Active
Suspended or Inactive
Parked

Please notify me of any other current domains used by this criminal.
Network Data (grehemgmbh.com)

How I am searching:

Searching for grehemgmbh.com A record at l.root-servers.net [199.7.83.42]: Got referral to g.gtld-servers.net. (zone: com.)
Searching for grehemgmbh.com A record at g.gtld-servers.net. [192.42.93.30]: Got referral to ns1.net-media.ca. (zone: grehemgmbh.com.)
Searching for grehemgmbh.com A record at ns1.net-media.ca. [67.212.80.121]: Reports grehemgmbh.com. Response:
Domain Type Class TTL Answer
grehemgmbh.com. A IN 14400 67.212.80.121
grehemgmbh.com. NS IN 14400 ns2.net-media.ca.
grehemgmbh.com. NS IN 14400 ns1.net-media.ca.
ns1.net-media.ca. A IN 14400 67.212.80.121
ns2.net-media.ca. A IN 14400 67.212.80.122

Looking up at the 2 grehemgmbh.com. parent servers:

Server Response
ns1.net-media.ca [67.212.80.121] 67.212.80.121
ns2.net-media.ca [67.212.80.122] 67.212.80.121

This criminal's website is hosted by Netelligent Hosting Services Inc. of Laval, Quebec, Canada on IP address 67.212.80.121
***Latest News*** Initial entry 18th. May 2009
***Latest News*** 8th. July 2009
News from Simon Bear - the domain grehemgmbh.com has been suspended by the registrar - please notify me of any active domains for this criminal.