Help to Haiti Children Fraud

Don't Bear Internet Fraud

This despicable fake charity fraudster should not be confused with any legitimate charity of the same or similar name - the following website graphics and the evidence of fraud clearly identify the fake website and these fraudsters. There are several GENUINE Haiti children's charities that do very good work - this scam is being perpetrated by Russian registered and Russian hosted criminals using only the following website as per the screenshot below and these scam emails that are sent out by the criminals. Do not be misled - the criminals have also stolen site content from a genuine charity who have confirmed the site theft and fraud.

Help to Haiti Children Website screenshot 06-Apr-2010:

Help to Haiti Children, is a despicable and demonstrably fake charity website with stolen website content and fake location and contact details that cynically plays on the emotions to solicit donations via a spam campaign. The site content has been stolen from this genuine charity and simply re-arranged a bit as a comparison of the two sites can quickly verify. The whole purpose of the fake website is to lend an air of legitimacy to the usual spamvertised fraud. Their fake location details are actually the location details of a Pizza Express outlet and they are not registered in their claimed location of the UK, either in the UK Companies House or with the UK Charity Commission - irrefutable evidence of a fake charity. The site theft has been confirmed by the genuine charity who tell me, and I quote: "This is a fraud, we have no connection to this scam website, which has stolen our images and using them to raise money from unsuspecting donors". You do not get more conclusive evidence of fraud. If you are a service provider to these criminals, please take immediate action to end their criminal activity.

Help to Haiti Children : Evidence of Criminal Fraud

i) Despite the claim on their 'About Us' page to have been founded in 1994, their domain helptohaitichildren.com was only registered with the registrar UK2 GROUP LTD./1'ST DOMAIN NAME SERVICE (1dns.ru) on 08-feb-2010 for the usual 'criminal's domain' minimum period of only one year and the whois details are hidden by 'Privacy Protect' - Clear evidence of misrepresentation and fraud.

ii) Their fake location details place them in the UK, but they are not a registered company in the UK Companies House, nor are they registered as a UK charity with the UK Charity Commission - irrefutable evidence of a fake charity.

iii) A Google search for the name "Help to Haiti Children" or their stolen identity "Mercy & Sharing" shows no internet presence for these criminals, ignoring their own fake website, of course. Do not be misled by this genuine charity.

iv) The crook's website content has been stolen from this genuine charity website, (confirmed by the genuine charity). For instance - this is the crook's 'About Us' page, and this is the genuine charity 'About Us' page. This is the crook's 'Projects' page and this is the genuine charity's 'Projects' page. Crystal clear evidence of site theft and fraud.

v) Bogus Website Contact Details: (Remember that these crooks are NOT a registered charity or company in the UK so these details are going to be bogus).

Home
Contact Us

316 kennington road
London
SE11 4LD
(+44) 020 3239 0182

• - A Google search for the address "316 kennington road London SE11 4LD" shows it to be the address of a branch of Pizza Express with no sign of these crooks.
• - A Google Maps Street search for the address "316 kennington road London SE11 4LD" confirms the Pizza Express branch location, (notice the number 314 on the shop to the right).
• - A Google search for the malformed telephone number, (the 0 before the 2 should not be there for an international listing), (+44) 020 3239 0182 returns only the crooks fake website.
• - Calling the telephone number 020 3239 0182 from the UK returns a permanently engaged signal.
All clear evidence of fake location and contact details.

vi) The Spam (I have received many copies of these in my dedicated spamtrap addresses - clear evidence of a spammer):

Return-Path: <au@malmgrens.us>
Received: from mwinf3628.me.freeserve.com (mwinf3628.me.freeserve.com)
    by mwinb3c06 (SMTP Server) with LMTP; Mon, 05 Apr 2010 19:08:15 +0200
X-Sieve: Server Sieve 2.2
X-Bcc:
Envelope-to:
Received: from smtp6.freeserve.com (localhost [127.0.0.1])
    by mwinf3628.me.freeserve.com (SMTP Server) with ESMTP id 8C3171C00150;
    Mon, 5 Apr 2010 19:08:15 +0200 (CEST)
Received: from me-wanadoo.net (localhost [127.0.0.1])
    by mwinf3628.me.freeserve.com (SMTP Server) with ESMTP id 819E61C0005B;
    Mon, 5 Apr 2010 19:08:15 +0200 (CEST)
Received: from Dynamic-IP-1868318753.cable.net.co (unknown [186.83.187.53])
    by mwinf3628.me.freeserve.com (SMTP Server) with ESMTP id 3A5101C00150;
    Mon, 5 Apr 2010 19:08:15 +0200 (CEST)
X-ME-UUID: 20100405170815238.3A5101C00150@mwinf3628.me.freeserve.com
Received: from 186.83.187.53 by mail.malmgrens.us; Mon, 5 Apr 2010 14:08:13 -0300
Message-ID: <000d01cad4e2$9362bee0$6400a8c0@au>
From: "Everette Lozano" <au@malmgrens.us>
To:
Subject: Abandoned children need your help
Date: Mon, 5 Apr 2010 14:08:13 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4963.1700
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700

Mercy & Sharing is an organization that was co-founded by evangelical
Christians Susie and Joe Krabacher. Dedicated humanitarian, whose work is
saving, feeding and educating children, that's how People magazine, Marie
Claire, The Wall Street Journal is used to characterize Susie for her deeds in
helping the poor. While Joe is known for his blessed business career by
co-founding satellite communications company and fiber-optic networking company
as well as for his law practice with the law firm Sherman Howard. From the beginning
the organization's aim was at helping abandoned and mistreated children in the
Republic of Haiti, but in the recent years Mercy & Sharing's mission has
expanded to provide food to the elderly and oppressed in the northern part of
Haiti. Surveys have showed that in Haiti one of every three children dies by
age 5, because of the great rate of poverty 80% of population lives in poverty
and 54% are living in even more worse conditions. But with God's blessing the
organization succeeded in helping 5,100 children and elderly.
Mercy & Sharing have always been helping the poor population of
Haiti by using the inner infrastructure of Haiti. Due to the quake disaster
that recently happen, we have brought all our capacities to rescue, providing
emergency food, shelter, medical treatment to children and elderly. In addition
we are supervising over your donations so the right people who really need them
receive them.

                                                   www.helptohaitichildren.com

I have received numerous copies of the above spam to different spamtrap addresses, all with different forged header details and from different IP addresses. This one's come from the dynamically allocated cable IP address 186.83.187.53, so it's pretty certainly an infected end user machine. It's also listed in at least half a dozen blacklists. Clear evidence of spamming and fraud.

Fake donation page details:

you can send money to:
name: Janis Tribe
bank name: Halifax
Sort code: 11-00-01
Roll number: D/49637054- 0
Account number: 06291704

The above evidence clearly proves beyond any doubt that the fake Help to Haiti Children website has been set up by criminal fraudsters. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Help to Haiti Children Fraudsters - current hosting details

Current Main Domains, Hosts and Registrars

Domain

helptohaitichildren.com

Registrar

UK2 GROUP LTD./1'ST DOMAIN NAME SERVICE (08-feb-2010)

Listed Host Network

Hostnoc/Burst.net/xlhost.ru

Host IP

64.120.169.149

Active
Registration Suspended/Disabled
Hosting Disabled
Parked

Domain Whois Data:WHOIS - helptohaitichildren.com (These are criminal fraud registrations and the registrant details are fake or stolen so may be redacted where necessary)

Registrar:     UK2 GROUP LTD.
Status:        clientTransferProhibited
Dates:         Created 08-feb-2010   Updated 08-feb-2010 Expires 08-feb-2011
DNS Servers:   NS1.XLHOST.RU NS2.XLHOST.RU

Registration Service Provided By: 1'ST DOMAIN NAME SERVICE
Contact: +373.79449745
Website: http://www.1dns.ru

Domain Name: HELPTOHAITICHILDREN.COM

Registrant:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Creation Date: 08-Feb-2010
Expiration Date: 08-Feb-2011

Domain servers in listed order:
    ns2.xlhost.ru
    ns1.xlhost.ru

Administrative Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Technical Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Billing Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Privacy Protect have removed the cloaking to reveal:

Domain Name: HELPTOHAITICHILDREN.COM

Registrant:
XLhost
Ruslan S Zhavryd ()
ul. Zhukovskogo, 32, kv. 11
Odessa
Odessa Oblast,220022
UA
Tel. +380.0000000

Creation Date: 08-Feb-2010
Expiration Date: 08-Feb-2011

Domain servers in listed order:
ns2.xlhost.ru
ns1.xlhost.ru

Administrative Contact:
XLhost
Ruslan S Zhavryd ()
ul. Zhukovskogo, 32, kv. 11
Odessa
Odessa Oblast,220022
UA
Tel. +380.0000000

Technical Contact:
XLhost
Ruslan S Zhavryd ()
ul. Zhukovskogo, 32, kv. 11
Odessa
Odessa Oblast,220022
UA
Tel. +380.0000000

Billing Contact:
XLhost
Ruslan S Zhavryd ()
ul. Zhukovskogo, 32, kv. 11
Odessa
Odessa Oblast,220022
UA
Tel. +380.0000000

Status:LOCKED

Please notify me of any other current domains used by this criminal.

DNS Lookup: helptohaitichildren.com A record
Searching for helptohaitichildren.com A record at a.root-servers.net [198.41.0.4]: Got referral to j.gtld-servers.net. (zone: com.)
Searching for helptohaitichildren.com A record at j.gtld-servers.net. [192.48.79.30]: Got referral to ns1.xlhost.ru. (zone: helptohaitichildren.com.)
Searching for helptohaitichildren.com A record at ns1.xlhost.ru. [64.120.169.151]: Reports helptohaitichildren.com.
Response:

Domain	Type	Class	TTL	Answer
helptohaitichildren.com.	A	IN	14400	64.120.169.149
helptohaitichildren.com.	NS	IN	14400	ns2.xlhost.ru.
helptohaitichildren.com.	NS	IN	14400	ns1.xlhost.ru.
ns1.xlhost.ru.	A	IN	14400	64.120.169.151
ns2.xlhost.ru.	A	IN	14400	64.120.169.149

Looking up at the 2 helptohaitichildren.com. parent servers:

Server	Response
ns2.xlhost.ru [64.120.169.149]	64.120.169.149
ns1.xlhost.ru [64.120.169.151]	64.120.169.149

Host Data
The listed host for this criminal fraudster is Hostnoc/Burst.net/xlhost.ru on IP address 64.120.169.149

***Latest News*** Initial entry 6th. April 2010

***Latest News*** 10th. April 2010
News from site contact - Privacy Protect have removed the criminal's anonymity - whois data updated.

***Latest News*** 13th. April 2010
News from site contact - the criminal's domain has been suspended by UK2 - please inform me of any active domains for these criminals.