Happy Kids Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
Happy Kids Logo

This 
Happy Kids fraud is a particularly odious spamvertized bogus charity criminal scam from the same criminals that have also brought you the Next Level fraud and its replacement, the High Level fraud among many others. The Happy Kids scam website has been stolen from a genuine US kids charity, Stoney's Kids.

The initial domains hk-usa.org and freelanceusa.org are listed as registered with OnlineNic in the whois data, (as are all the Next Level/High Level fraud domains, albeit via their reseller Uzak.net). Domains
job-in-usa.net and freelance-job-usa.com are listed as registered with OnlineNic/ Uzak.net and Uzak.net also provide the nameservers for the hosting of all of these and other fraudsters. The host IP is 88.255.78.75 and according to the whois data is owned by Narweb.net and maintained by Sistemnet Telekom, but the owner of Narweb.net has written to me to tell me that the data is incorrect and the block is actually now owned by Sistemnet Telekom. In any event it is the host IP for these fraudsters and the High Level criminals.

The domain 
children-europe.nu is hosted on the well-known Russian RBN criminal's AbdAllah Internet Hizmetleri network IP 88.255.90.138

The domain happykids-europe.org is the odd one out, being registered with PublicDomainRegistry.Com and hosted by HostForWeb Inc. of Chicago. It has now been suspended by
PublicDomainRegistry.Com.

Other Happy Kids domains and hosting listed under ***Latest News*** below as they are added.

Numerous classified adverts and forum spams have been found, (Google for 
"Happy Kids is a charity organization in Poland"), that have been placed by this criminal to fraudulently solicit charitable donations using the stolen website as the medium for donation.

 
Evidence of Site Theft, Fraud & Spamming.

i) The fake Happy Kids website has been stolen from the genuine Stoney's Kids website which has been in existence since 2005 and is a well respected, US, (San Diego), children's charity.

ii) They are spamvertising a money laundering mule job on http://children-europe.nu/JobinUK.html

iii)
The multiple fraud domains whois data is clearly bogus with different registration addresses, companies, telephone numbers etc, email addresses, etc.


iv) The Happy Kids criminal fraud domains are also mostly registered with OnlineNic/Uzak as are most of the High Level and Next Level fraudster's domains, but other registrars and hosts arer used - see list.

v)
Shared IP with money laundering fraudsters - the Happy Kids fraud websites (http://www.hkids-europe.org/ etc), are hosted on the same Turkish 
Sistemnet Telekom server farm IP as used by the High Level fraudsters - 88.255.78.75 and using the same ns1.uzaknet.org & ns2.uzaknet.org nameservers as the High Level criminals. The latter website http://www.children-europe.nu/ is hosted on a known criminal owned IP 88.255.90.138

vi) The bogus charity webpage says they were founded in 2002, however all the fraudsters domains were registered in December 2007 or later.


vii) Multiple domain registrations for the same bogus website - what has job-in-usa.net or freelanceusa.org got to do with a childrens charity? The answer is nothing, but they have lots to do with with money laundering, charity fraud and other criminality...

viii) Googling on scraps of the Happy Kids website text, e.g. "The team arrived at the hospital to meet Dr Olas Mindyuk, Director", show that this fake site is a direct replacement for the www.donationeurope.org fake charity scam which was suspended in May 2007, the text for which was originally mainly stolen from sos-childrensvillages.org among others and was extensively covered by many fraud forums e.g. http://forum.aa419.org/viewtopic.php?t=6644

ix) Other text for the site has been stolen from many sources, e.g. the 'End Homelessness Now' text on this page was stolen from this Romanian childrens charity page and below that, the 'Aid For Teens' text on the left hand of
this page was stolen from the 'Aims' text on this Bulgarian Charity page, complete with the same spelling mistakes, i.e. 'accute' and 'sponsering'. The list is endless, but definite proof of fraud.

x) Spamming - A google search for "
Happy Kids is a charity organization in Poland" shows massive spamming of forums and Classified Ads websites.

The Website Money Mule Job


Job offer

You can earn money and help children with us.
We receive donations in United Kingdom, you have a possibility to become a
"Freelance financial representative" of our organization.

Candidate requirements:

- Location in UK.
- free 2-3 hours a day;
- 21+ years old;
- Honest, responsible and prompt in operations;
- Have an adaptable, flexible and professional attitude;
- Polite, tactful;
- Have constant internet access for communication with us via e-mail.

This job will give you:
- part-time employment;
- work from home;
- communication and business skills for working in other spheres of activity;
- possibility to combine this job with your full-time employment and own schedule.
Additionally, you will receive awards and bonuses for high-quality and accurate work.

The salary for private persons is 200 - 1500 GBP per week.

Frequently Asked Questions about Freelance Job:

Q1: What do I need to do?

A:
Your functions will include controlling our donations flow in United Kingdom.
You will receive donations from our members to your bank account at a time and date convenient to you
and then forward the money to needy children in Europe via Western Union and MoneyGram money transfers.
Your commission from each transaction will be 5%.
We do NOT require any investment of money on your part.

Q2: What a profit for you?

A:
Bank transfers to countries with needy children take 3-5 days, Western Union and MoneyGram transfers are instant.
Working with freelancers we save time on the transfers.

Q3: Please give me an example of the job process.

A:
1. The Member sends the donation via his bank account to your bank account and notifies us. *
2. We inform you by phone and email that the transfer is made.
And send you notification email (example): "Transfer has been made to your bank account.
Amount is 5000 GBP.
Check your account please, withdraw money and send them via Western Union
or MoneyGram transfers to Kate Lewis, Kiev, Ukraine".
3. You go to your bank and withdraw funds.
4. Take your salary (5% of amount) and go to Western Union or MoneyGram agent with
remaining cash (95% of amount), send it to Kate Lewis, Kiev, Ukraine"
5. You send us details of Western Union or MoneyGram transfer and scanned copy of transfer's receipt
via email.

* Our manager will call you before bank transfer, if you are not able to receive the transfer then we'll make the transfer another day.
So you can combine the work with your own schedule.

Q4: What bank and bank account should I use for work?

A: You can use any suitable bank and bank account for work.
You can open a new bank account for this work as well.

Q5: How many transfers a day/week/month shall I process? What is average amount of each transfer?

A: We can do 2-3 transfers a week for first time. Average amount of each bank transfer is 2000-8000 GBP.

Q6: Do you have members for donations already? Or need i find them for you?

A: We have members already, you do not need to find anybody.

Q7: How can I send money via MoneyGram or Western Union transfers?

A: Read here please How to send money via MoneyGram transfers
Read here please How to send money via Western Union transfers

Q8: In what currency should I send the money?
Is it necessary to exchange the currency?

A: You should send the money in GBP. You don't need to exchange the currency.
Western Union and MoneyGram do this by themselves.


Q9: Who pays fees for sending the money via
Western Union and MoneyGram transfers
Is it subtracted from my commission?

A: The fees for Western Union and MoneyGram transfers are paid by our company.
Absolutely nothing is subtracted from your salary; you get exactly 5% from amount.
The fees will be discounted from the money that you will send via Western Union or MoneyGram transfers.

Q10: Where can I find Western Union or MoneyGram agent
?

A: You can find your Western Union agent location here
You can find your MoneyGram agent location here

This is the standard money mule job 
The Fraudster's known domains

Here are all the known domains that are/have been used for the fraud:

Domain

hk-usa.org
happykids-europe.org
job-in-usa.net
freelanceusa.org
freelance-job-usa.com
happykids-eu.org
hkids-europe.org
hk-europe.org
children-europe.nu
childreneurope.co.uk
childreneurope.org
hk-jobs.org
kids-europe.org
children-europe.org
childreneurope.cn


Status

Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
Suspended
DNS Refusal
Suspended
Redirects to Google
Active
Registrar

ONLINENIC, INC. (Uzak.net) (11-Dec-2007)
PublicDomainRegistry.Com (14-Dec-2007)
ONLINENIC, INC. (Uzak.net) (11-Dec-2007)
ONLINENIC, INC. (Uzak.net) (11-Dec-2007)
ONLINENIC, INC. (Uzak.net) (11-Dec-2007)
ONLINENIC, INC. (Uzak.net) (17-Dec-2007)
ONLINENIC, INC. (Uzak.net) (17-Dec-2007)
PublicDomainRegistry.Com (23-Dec-2007)
Nic.nu (Enom.com)
PublicDomainRegistry.Com (18-Jan-2008)
Enom Inc. (13-Feb-2008)
ONLINENIC, INC. (Uzak.net) (17-Dec-2007)
Enom Inc. (06-Jan-2008)
Enom Inc. (29-Jan-2008)
Enom Inc. (28-Feb-2008)
Network










Hostfresh (Hong Kong)
Hostfresh (Hong Kong)
SISTEMNET-TELECOM
SoftLayer Technologies Inc

Hostfresh (Hong Kong)

The fraudster uses the following network(s) :

DNS Data
hk-usa.org, job-in-usa.net, freelanceusa.org and freelance-job-usa.com

Looking up at the 2 parent servers:

Server Response
ns2.uzaknet.org [88.255.78.75]  88.255.78.75
ns1.uzaknet.org [88.255.78.74]  88.255.78.75

In all cases the above nameservers are stealthed through domain nameservers.

happykids-europe.org

How I am searching:

Searching for happykids-europe.org A record at h.root-servers.net [128.63.2.53]: Got referral to d0.org.afilias-nst.org. (zone: org.)
Searching for happykids-europe.org A record at d0.org.afilias-nst.org. [199.19.57.1]: Got referral to dns2.iksserver.com. (zone: happykids-europe.org.)
Searching for happykids-europe.org A record at dns2.iksserver.com. [205.234.212.246]: Reports happykids-europe.org. Response:
Domain Type Class TTL Answer
happykids-europe.org. A IN 14400 205.234.212.246
happykids-europe.org. NS IN 86400 ns1.xtraorbit.com.
happykids-europe.org. NS IN 86400 ns2.xtraorbit.com.
ns2.xtraorbit.com. A IN 66246 67.15.206.210

Looking up at the 2 happykids-europe.org. parent servers:

Server Response
dns2.iksserver.com [205.234.212.246]  205.234.212.246
dns1.iksserver.com [205.234.212.246]  205.234.212.246

Stealthed nameservers once again and also once again we see the nameserver domain iksserver.com as used by the Next Level fraudster. The host for this one is HostForWeb Inc. of Chicago (205.234.212.246) for both the nameservers and the domain IP.

happykids-eu.org

Looking up at the 2 happykids-eu.org. parent servers:

Server Response
ns2.remotemachsys.net [75.126.139.218]  75.126.132.7
ns1.remotemachsys.net [75.126.132.7]  75.126.132.7

The hosting for this alias of the criminal is provided by Softlayer Technologies on IP 75.126.132.7 Softlayer are quite a regular choice of these criminals.

The Spam Headers



The Spam

This criminal fraudulently solicits for donations by placing countless adverts in forums and on classified ad. sites as follows:
(Google for "Happy Kids is a charity organization in Poland")

Happy Kids

Happy Kids is a charity organization in Poland who help and support the community in the Central and East Europe region through his tireless efforts to help children of all ages.

Find out more about the people behind the Happy Kids Charity Organization and why they inspire others to help and make a difference at
http://happykids-eu.org

Happy Kids

http://happykids-eu.org
Poland
Pulkowa st. 29,
02-776 Warsaw
Phone/Fax: +48 (22) 389 6832

The spams are noted as posted by someone who registers himself as an Albanian with the email address fetamernmooft@mymail-in.net
__________________________________________________________________________________________________________________________
Spam also received as follows, spamvertising the above money mule job website link:

Subject:  Freelancers needed
Body:

Part-time job in USA.

http://children-europe.nu/job.php

Fraud Blog

15th. Dec. 2007

The domain happykids-europe.org has already been suspended by PublicDomainRegistry.com - well done guys. All the OnlineNic/Uzak ones however are still active.

16th. Dec. 2007
All the OnlineNic/Uzak.net domains are still active this morning. I'm not sure what has happened to OnlineNic - in the past I've always found them to be ethical and helpful in closing down these fraudsters, but lately they are failing to respond to abuse reports and are effectively aiding and abetting not only this fraudster but the related High Level fraudster too. Come on guys, what's going on at OnlineNic.com? Why are you supporting these criminals?

21st. Dec. 2007
Both Uzak.net and OnlineNic are fully aware of this despicable criminal's thieving activities at the expense of underprivileged children and yet neither act to end the criminal fraud. It seems clear to me that Uzak.net are directly involved in the criminality and OnlineNic are are least guilty of aiding and abetting this criminal fraud. Sistemnet.com.tr are also fully aware of this crime and also do nothing to end the criminality. All in all it amounts to a pretty amoral nest of thieves - the same bunch that are harbouring the High Level money laundering fraudsters.

22nd. Dec. 2007
Domain happykids-eu.org spotted on classified ads. website. The criminal is obviously using that medium to reach his victims. Once again the domain is registered with OnlineNic who are knowingly aiding and abetting these criminals by ignoring requests to suspend the domains.

Looking up at the 2 happykids-eu.org. parent servers:

Server Response
ns2.remotemachsys.net [75.126.139.218]  75.126.132.7
ns1.remotemachsys.net [75.126.132.7]  75.126.132.7

The hosting for this alias of the criminal is provided by Softlayer Technologies on IP 75.126.132.7 Softlayer are quite a regular choice of these criminals.

All the other domains used by this criminal fraudster are still hosted on the Sistemnet Telekom server farm IP
88.255.78.75 using Uzak.net.tr nameservers with the full knowledge and collusion of the owners.

24th. Dec. 2007
No response from Softlayer who continue to host this fraudster's
happykids-eu.org domain and no response from the fraudster's other hosts either, but than I wouldn't expect a response from Uzak.net.tr or Sistemnet Telekom who also host the High Level money laundering fraudsters on the same IP, (88.255.78.75). PublicDomainRegistry.Com are the only company to show any understanding and ethical behaviour by suspending the crook's domain happykids-europe.org - so thanks to them. Looks like the criminals are going to have a happy and profitable Christmas courtesy of OnlineNic.com, Uzak.net.tr, Sistemnet Telekom and Softlayer Technologies.

***Latest News*** 28th. Dec. 2007
After an unnecessarily long and no doubt profitable run for these criminals, their domains have now all finally been suspended. If whoever is responsible for the suspension would care to contact me with any information I will be happy to publish your side of the story. Softlayer Technologies are continuing to host the suspended domain 
happykids-eu.org in the form of a 'Domain Suspended' information page.

Uzak.net.tr - perhaps you would now care to turn your attention to the numerous High Level criminal fraudster's domains that you are also hosting....

***Latest News*** 20th. Jan. 2008

Well, it didn't last long - these criminals are back up to their usual tricks, spamming with a new domain - hkids-europe.org
(OnlineNic/Uzak.net), using the usual
Sistemnet Telekom server farm IP 88.255.78.75 & using Uzak.net.tr nameservers exactly as before.

DNS Data (
hkids-europe.org):
How I am searching:

Searching for hkids-europe.org A record at i.root-servers.net [192.36.148.17]: Got referral to A0.ORG.AFILIAS-NST.INFO. (zone: org.)
Searching for hkids-europe.org A record at A0.ORG.AFILIAS-NST.INFO. [199.19.56.1]: Got referral to ns1.uzaknet.org. (zone: hkids-europe.org.)
Searching for hkids-europe.org A record at ns1.uzaknet.org. [88.255.78.74]: Reports hkids-europe.org. Response:
Domain Type Class TTL Answer
hkids-europe.org. A IN 86400 88.255.78.75
hkids-europe.org. NS IN 86400 ns.hkids-europe.org.
ns.hkids-europe.org. A IN 86400 88.255.78.75

Looking up at the 2 hkids-europe.org. parent servers:

Server Response
ns2.uzaknet.org [88.255.78.75]  88.255.78.75
ns1.uzaknet.org [88.255.78.74]  88.255.78.75


***Latest News*** 26th. Jan. 2008
No active domains are known for this fraudster - if you come across any, please let me know.

***Latest News*** 27th. January 2008
I have been informed that these criminals are active again with new domain(s). Domain hk-europe.org notified to me - please let me know of any others.

DNS Data for
hk-europe.org:
How I am searching:

Searching for hk-europe.org A record at b.root-servers.net [192.228.79.201]: Got referral to B0.ORG.AFILIAS-NST.org. (zone: org.)
Searching for hk-europe.org A record at B0.ORG.AFILIAS-NST.org. [199.19.54.1]: Got referral to ns4.lovinghosting.com. (zone: hk-europe.org.)
Searching for hk-europe.org A record at ns4.lovinghosting.com. [220.232.130.90]: Reports hk-europe.org. Response:
Domain Type Class TTL Answer
hk-europe.org. A IN 14400 220.232.130.89
hk-europe.org. NS IN 86400 ns3.lovinghosting.com.
hk-europe.org. NS IN 86400 ns4.lovinghosting.com.

Looking up at the 2 hk-europe.org. parent servers:

Server Response
ns4.lovinghosting.com [220.232.130.90]  220.232.130.89
ns3.lovinghosting.com [220.232.130.89]  220.232.130.89

The current host for this criminal is Pacific Internet (Hong Kong) Ltd (220.232.130.89)

***Latest News*** 1st. February 2008
New domain received in spam - 
children-europe.nu

DNS Details: (children-europe.nu)
How I am searching:

Searching for children-europe.nu A record at j.root-servers.net [192.58.128.30]: Got referral to NS.NIC.nu. (zone: nu.)
Searching for children-europe.nu A record at NS.NIC.nu. [69.25.75.70]: Got referral to dns4.name-services.com. (zone: children-europe.nu.)
Searching for children-europe.nu A record at dns4.name-services.com. [69.64.145.225]: Reports children-europe.nu. Response:
Domain Type Class TTL Answer
children-europe.nu. A IN 1800 88.255.90.138
children-europe.nu. NS IN 3600 dns1.name-services.com.
children-europe.nu. NS IN 3600 dns2.name-services.com.
children-europe.nu. NS IN 3600 dns3.name-services.com.
children-europe.nu. NS IN 3600 dns4.name-services.com.
children-europe.nu. NS IN 3600 dns5.name-services.com.
dns1.name-services.com. A IN 3600 69.25.142.42
dns2.name-services.com. A IN 3600 216.52.184.248
dns3.name-services.com. A IN 3600 63.251.92.200
dns4.name-services.com. A IN 3600 69.64.145.225
dns5.name-services.com. A IN 3600 70.42.37.7

Looking up at the 5 children-europe.nu. parent servers:

Server Response
dns4.name-services.com [69.64.145.225]  88.255.90.138
dns5.name-services.com [70.42.37.7]  88.255.90.138
dns2.name-services.com [216.52.184.248]  88.255.90.138
dns1.name-services.com [69.25.142.42]  88.255.90.138
dns3.name-services.com [63.251.92.200]  88.255.90.138

The first thing to notice is that they are still using the Russian RBN AbdAllah Internet Hizmetleri criminal's IP 88.255.90.138. Details here. It's time this IP range was removed from these criminals.

If the criminal's past history is anything to go by, there will be many more similar domains registered by them.

***Latest News*** 4th. February 2008
Nic.nu have forwarded a request to Enom to "take the necessary steps" regarding the criminal's domain children-europe.nu. Mind, Enom had already been copied an abuse report on 1st. February....


***Latest News*** 22nd. February 2008
New domains notified by site contactchildreneurope.org and childreneurope.co.uk registered with Enom & publicdomainregistry.com respectively and hosted with Hostfresh of Hong Kong as detailed below:

DNS Data: 
childreneurope.org, childreneurope.co.uk)
How I am searching:

Searching for childreneurope.co.uk A record at i.root-servers.net [192.36.148.17]: Got referral to NS6.NIC.uk. (zone: uk.)
Searching for childreneurope.co.uk A record at NS6.NIC.uk. [213.248.254.130]: Got referral to ns2.cybns.info. (zone: childreneurope.co.uk.)
Searching for childreneurope.co.uk A record at ns2.cybns.info. [58.65.239.11]: Reports childreneurope.co.uk. Response:
DomainTypeClassTTLAnswer
childreneurope.co.uk.AIN1440058.65.239.10
childreneurope.co.uk.NSIN86400ns2.cybns.info.
childreneurope.co.uk.NSIN86400ns1.cybns.info.
ns1.cybns.info.AIN1440058.65.239.10
ns2.cybns.info.AIN1440058.65.239.11

Looking up at the 2 childreneurope.co.uk. parent servers:

ServerResponse
ns2.cybns.info [58.65.239.11] 58.65.239.10
ns1.cybns.info [58.65.239.10] 58.65.239.10

The listed owner of IP 58.65.239.10 is Hostfresh of Hong Kong

Later - two more domains notified -
hk-jobs.org, kids-europe.org

DNS Data (hk-jobs.org)

How I am searching:

Searching for hk-jobs.org A record at h.root-servers.net [128.63.2.53]: Got referral to tld1.ultradns.net. (zone: org.) [took 62 ms]
Searching for hk-jobs.org A record at tld1.ultradns.net. [204.74.112.1]: Got referral to ns2.uzaknet.org. (zone: hk-jobs.org.) [took 35 ms]
Searching for hk-jobs.org A record at ns2.uzaknet.org. [88.255.78.75]: Reports hk-jobs.org. [took 219 ms] Response:
DomainTypeClassTTLAnswer
hk-jobs.org.AIN8640088.255.78.75
hk-jobs.org.NSIN86400ns.hk-jobs.org.
ns.hk-jobs.org.AIN8640088.255.78.75

Looking up at the 2 hk-jobs.org. parent servers:

ServerResponse
ns2.uzaknet.org [88.255.78.75] 88.255.78.75
ns1.uzaknet.org [88.255.78.74] 88.255.78.75

The listed owner of IP 88.255.78.75 = SISTEMNET-TELECOM

DNS Data (kids-europe.org)

How I am searching:

Searching for kids-europe.org A record at m.root-servers.net [202.12.27.33]: Got referral to TLD1.ULTRADNS.NET. (zone: org.)
Searching for kids-europe.org A record at TLD1.ULTRADNS.NET. [204.74.112.1]: Got referral to dns2.name-services.com. (zone: kids-europe.org.)
Searching for kids-europe.org A record at dns2.name-services.com. [216.52.184.248]: Reports kids-europe.org. Response:
DomainTypeClassTTLAnswer
kids-europe.org.AIN180075.126.132.7
kids-europe.org.NSIN3600dns1.name-services.com.
kids-europe.org.NSIN3600dns2.name-services.com.
kids-europe.org.NSIN3600dns3.name-services.com.
kids-europe.org.NSIN3600dns4.name-services.com.
kids-europe.org.NSIN3600dns5.name-services.com.
dns1.name-services.com.AIN360069.25.142.42
dns2.name-services.com.AIN3600216.52.184.248
dns3.name-services.com.AIN360063.251.92.200
dns4.name-services.com.AIN360069.64.145.225
dns5.name-services.com.AIN360070.42.37.7

Looking up at the 5 kids-europe.org. parent servers:

ServerResponse
dns5.name-services.com [70.42.37.7] 75.126.132.7
dns4.name-services.com [69.64.145.225] 75.126.132.7
dns3.name-services.com [63.251.92.200] 75.126.132.7
dns1.name-services.com [69.25.142.42] 75.126.132.7
dns2.name-services.com [216.52.184.248] 75.126.132.7

The listed owner of IP 75.126.132.7 = SoftLayer Technologies Inc. Looks like he's using Enom's DNS facilities.

***Latest News*** 3rd. March 2008
New domain notified by site contact - childreneurope.cn - registered with Enom 28-Feb-2008 - hosted by Hostfresh:
DNS Data: (childreneurope.cn)

Looking up at the 5 childreneurope.cn. parent servers:

ServerResponse
dns2.name-services.com [216.52.184.248] 58.65.239.10
dns4.name-services.com [69.64.145.225] 58.65.239.10
dns3.name-services.com [63.251.92.200] 58.65.239.10
dns5.name-services.com [70.42.37.7] 58.65.239.10
dns1.name-services.com [69.25.142.42] 58.65.239.10

The listed owner of IP 58.65.239.10 is Hostfresh of Hong Kong