InterWeb Exchange Scam

InterWeb Exchange Fraud

Don't Bear Internet Fraud

This fraud should not be confused with any other company of the same or similar name - the website screenshot below and the following fraud evidence define and refer to this fake company alone and no other company or no other person of the same name.

InterWeb Exchange scam screenshot (14-Feb-2010)

InterWeb Exchange is just another clearly fraudulent money mule recruiting spammer, (sample spam below), and scammer using a stolen website and identity. The spam is identical to the spam sent out by other scammers such as OnlineOfficeSource, OnlineCompanySite Inc, CurrencySource (Stolen Identity & Site) and Zexchange scammers. Their domain interweb-exchange.net was only registered with NETEARTH ONE, INC. DBA NETEARTH/SELLOUT.NAME on 29-Jan-2010 for the usual 'criminal's domain' minimum period of only one year as were all their others, (see tables below for details). The above site content is stolen, their location and contact details are bogus and they are not a registered company.

The whole purpose of this fraud site is to lend an air of legitimacy to a 'Money Mule' job that consists of accepting stolen funds to your home address, and transferring a balance back to these crooks in Russia/the Ukraine via Western Union or Moneygram. It will get your bank account and your assets frozen, lose you a lot of money and earn you a criminal record - don't be tempted. The fraud website is hosted on the same ProstoHosting LTD of Kiev, Ukraine IP address 195.189.247.119 as is also hosting the Zexchange scammer - they are clearly related.

InterWeb Exchange : Evidence of Criminal Fraud

i) The above InterWeb Exchange fraud website home page content has been stolen from this company and modified to include a registration click-box for a money laundering mule role which is being spamvertised in the usual way. Clear evidence of site theft and fraud.

ii) The criminals claim on their above home page, "Established in 1990, InterWeb is the worldwide leader in Foreign Exchange Payments and Services", but the criminal's domain interweb-exchange.net was only registered with NETEARTH ONE, INC. DBA NETEARTH/SELLOUT.NAME on 29-Jan-2010 for the usual 'criminal's domain' minimum period of only one year as were all their others, (see tables below for details). - clear evidence of a criminal fraud registration.

iii) They are spamvertising the job of “Executive Manager” which has no website details at all - just a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal operation which at the very least will cost you a lot of money. If you read the copyright notice in the box on the registration form, you will see it currently refers to 'OnlineCompanySite Inc', (their previous alias) - clear evidence of serial fraud.

iv) No legitimate company would advertise for private citizens to operate as part-time, work from home "Financial Managers". To do so clearly defines the fake InterWeb Exchange company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Do not be fooled.

v) If you click on their website 'Home' menu option you currently get this page:

Welcome to your new Drupal website!

Please follow these steps to set up and start using your website:

   1. Configure your website Once logged in, visit the administration section, where you can customize and configure all aspects of your website.
   2. Enable additional functionality Next, visit the module list and enable features which suit your specific needs. You can find additional modules in the Drupal modules download section.
   3. Customize your website design To change the "look and feel" of your website, visit the themes section. You may choose from one of the included themes or download additional themes from the Drupal themes download section.
   4. Start posting content Finally, you can create content for your website. This message will disappear once you have promoted a post to the front page.

For more information, please refer to the help section, or the online Drupal handbooks. You may also post at the Drupal forum, or view the wide range of other support options available.

Oops!

vi) Stolen & Fake contact details from their website:

Contact Us
Vainonkatu 3, 40100 Jyvaskyla, Finland.
Local Phone: +4(014) 653 211
US phone: +1 (315) 5122076

• - A Google Search for the address "Vainonkatu 3, 40100 Jyvaskyla, Finland" returns no hits for these criminals, (ignoring their own fake website, of course). In fact it is the address of the Cumulus Hotel Jyvaskyla. Clear evidence of a fake address and fraud.
• - A Google Maps Business Search and street view confirms that these criminals are not at that address.
• - The 'local phone' telephone number +4(014) 653 211 is clearly not a genuine Finnish number, (Finland country code is +358 for a start).
• - A Google search for the telephone number "+1 (315) 5122076" only returns the crooks fake website and no other hits.
All clear evidence of fake location and contact details.

vii) A search of the Finnish BIS (Business Information System) shows that there is no such company as "InterWeb Exchange" registered in Finland - check for yourself - it is undoubtedly a fake company - irrefutable evidence of fraud.

viii) The Spams:

From: HR Department (apolanco38@gmail.com)
Sent: Wed 2/10/10

Good time of a day dear xxxxxx !

Our HR managers found your resume on the CareerBuilder. They studied your resume and length of service and highly recommends you for this work in our corporation because your data is consistent with our requirements. We'd like to offer you a vacancy of an Executive Manager in our organization.

The presented vacancy consists of the following tasks:
- actual sending of reports on the carried out work
- maintaining of records of clients in the USA.
- business partners information support
- fulfillment of financial transactions within the USA

You will get more detailed instructions during an interview over the phone.
Person specification :
- Age: starting from 25
- Citizenship: US
- Time: must have from 3 to 5 hours of free time a day for carrying out his/her obligations. salary for this vacancy makes up to 5000USD per month. The payment will be carried out to your bank account every month. There are many candidates willing to take up this job therefore we're kindly asking you not to delay with your decision about this vacancy.

If this vacancy is interesting to you, then please follow these steps:
1) Register at our homepage. To do so follow this link . Please fill out every field correctly, since data will be checked by our security department.
2) Pass an interview over the phone.
3) Sign a contract with our company.
4) Send the signed contract via fax or email.

With best regards HR department of InterWeb Exchange
We're looking forward to a long-term cooperation.

55 For a detailed description of PKI mechanisms and the functioning of electronic signatures, see the previous ECB issues of surprise elements and context-sensitive data in the security processes may keep the systems more Mobile phones and other wireless communication devices offer new ways to access accounts and to use payment Recapitulation and outlook, Working paper, November 2003 and 1.1a2, Electronic Money and E-money Institutions, information from the magnetic stripe on a card inserted by an unsuspecting customer. Other methods selling. Based on their own customer data collection, as well as on external available information and not representative. However, a continuation and updating of the survey, including more providers and schemes, is already Innovative trends are also emerging at traditional shops. constitute different combinations of credit card and electronic money schemes (see Sources: De Nederlandsche Bank, 2004; Gresvik et al., 2003; Humphrey et al., 2003b (EUR 1 = USD 1.027).

From: HR Department <hr_depart8@gmx.com>
Date: Fri, Feb 12, 2010
Subject: Executive Manager position for xxxxxxx

Dear xxxxxxxx

Your CV was found on the CareerBuilder. That’s why we are glad to propound you a position of an “Executive Manager”. Your resume was learnt thoroughly by our HR department and they were satisfied. Therefore you suit this job absolutely.

Your work will include following targets:-well-timed filling of accounts on done work- tabbing of customers in the USA- inform customers about all they’d like to know- Fulfillment of financial deals within the USA. All the following information you will get during an colloquium over the phone.

Staff requirements:

Nationality: US
3-5 free hours daily to hold your dutiesobligations
From 25 years old

Your salary will be up to 5000USD monthly. Money will be transferred to your bank account every month.

Many applicants wishing to have this vacancy, that’s why we’d ask you not to take your time and make your decision as soon as possible about this vacancy.

All the information about our company you may find website When you make your positive vote about this job, you should follow these steps. Make a registration at our here .Then find a count of “Executive Manager”. There you should fill in all the fields neatly. All data will de controlled by our security.After that will held an interview over the phone. Then a contract with our firm should be signed.

We are very grateful to you and hope for a long and mutually relationships.

The above are the usual vague and meaningless descriptions of the offered role which is commonplace now as the crooks try to evade detection, but make no mistake, the sentence "- fulfillment of financial transactions within the USA" and the clearly fake nature of the stolen website guarantees that it is the illegal 'Money Laundering Mule' function of accepting funds to your personal bank account and transferring a balance back to these criminals in Russia or the Ukraine. The transferred money eventually comes back as stolen and is recovered by the bank, leaving you out of pocket by the amount you have tranferred and facing some awkward questions about why you are involved in criminal fraud. Do not be tempted. Note the spammers Bayesian filter avoidance text.

The above evidence clearly demonstrates beyond any doubt that the fake InterWeb Exchange website has been stolen and has set up by criminal fraudsters purely for the purpose of spamvertising a fraud job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

InterWeb Exchange Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

interweb-exchange.net
interweb-exchange.com
interweb-exchange.org
interweb-exchange.biz

Registrar

NETEARTH ONE, INC. DBA NETEARTH/SELLOUT.NAME - 29-Jan-2010
DomainContext, Inc. (R1744-LROR)/SELLOUT.NAME - 29-jan-2010
DomainContext, Inc. (R1744-LROR) - 29-jan-2010
DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM - 29-Jan-2010

Host Network

ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine

Host IP

195.189.247.119
195.189.247.119
195.189.247.119
195.189.247.119

Active
Suspended, disabled or Inactive
Parked

Please notify me of any other current domains used by this criminal.

Domain Whois Data: (The whois details of these fraud domains are stolen or fake - all personal details redacted where necessary)

Domain Name: INTERWEB-EXCHANGE.NET
Registrar:     NETEARTH ONE, INC. DBA NETEARTH
Status:        clientTransferProhibited
Dates:         Created 29-jan-2010   Updated 29-jan-2010 Expires 29-jan-2011
DNS Servers:   NS1.EVERYDNS.NET NS2.EVERYDNS.NET NS3.EVERYDNS.NET NS4.EVERYDNS.NET

Registration Service Provided By: SELLOUT.NAME
Contact: +007.9066516665
Website: http://sellout.name/

Registrant:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila, 6, 5d
    Riga
    Rîgas Apripkis,LVS1055
    LV
    Tel. +372.65005422

Creation Date: 29-Jan-2010
Expiration Date: 29-Jan-2011

Domain servers in listed order:
    ns4.everydns.net
    ns3.everydns.net
    ns2.everydns.net
    ns1.everydns.net

Administrative Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila, 6, 5d
    Riga
    Rîgas Apripkis,LVS1055
    LV
    Tel. +372.65005422

Technical Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila, 6, 5d
    Riga
    Rîgas Apripkis,LVS1055
    LV
    Tel. +372.65005422

Billing Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila, 6, 5d
    Riga
    Rîgas Apripkis,LVS1055
    LV
    Tel. +372.65005422

Status:ACTIVE

Domain Name: INTERWEB-EXCHANGE.COM
Registrar:     DOMAINCONTEXT, INC.
Status:        clientTransferProhibited
Dates:         Created 29-jan-2010   Updated 29-jan-2010 Expires 29-jan-2011
DNS Servers:   NS1.EVERYDNS.NET NS2.EVERYDNS.NET NS3.EVERYDNS.NET NS4.EVERYDNS.NET

Registration Service Provided By: SELLOUT.NAME
Contact: +007.9066516665
Website: http://sellout.name/

Registrant:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila 6 5d
    Riga
    Dobeles Apripkis,LVS1055
    LV
    Tel. +372.65005422

Creation Date: 29-Jan-2010
Expiration Date: 29-Jan-2011

Domain servers in listed order:
    ns4.everydns.net
    ns3.everydns.net
    ns2.everydns.net
    ns1.everydns.net

Administrative Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila 6 5d
    Riga
    Dobeles Apripkis,LVS1055
    LV
    Tel. +372.65005422

Technical Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila 6 5d
    Riga
    Dobeles Apripkis,LVS1055
    LV
    Tel. +372.65005422

Billing Contact:
    N/A
    Kastas Tabars        (ctthorntonlapel@yahoo.com)
    Perisovos Eila 6 5d
    Riga
    Dobeles Apripkis,LVS1055
    LV
    Tel. +372.65005422

Status:ACTIVE

Domain ID:D158229897-LROR
Domain Name:INTERWEB-EXCHANGE.ORG
Created On:29-Jan-2010 08:53:17 UTC
Last Updated On:29-Jan-2010 08:53:19 UTC
Expiration Date:29-Jan-2011 08:53:17 UTC
Sponsoring Registrar:DomainContext, Inc. (R1744-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:DI_11020091
Registrant Name:Kastas Tabars
Registrant Organization:N/A
Registrant Street1:Perisovos Eila 6 5d
Registrant Street2:
Registrant Street3:
Registrant City:Riga
Registrant State/Province:Dobeles Apripkis
Registrant Postal Code:LVS1055
Registrant Country:LV
Registrant Phone:+372.65005422
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:ctthorntonlapel@yahoo.com
Admin ID:DI_11020091
Admin Name:Kastas Tabars
Admin Organization:N/A
Admin Street1:Perisovos Eila 6 5d
Admin Street2:
Admin Street3:
Admin City:Riga
Admin State/Province:Dobeles Apripkis
Admin Postal Code:LVS1055
Admin Country:LV
Admin Phone:+372.65005422
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:ctthorntonlapel@yahoo.com
Tech ID:DI_11020091
Tech Name:Kastas Tabars
Tech Organization:N/A
Tech Street1:Perisovos Eila 6 5d
Tech Street2:
Tech Street3:
Tech City:Riga
Tech State/Province:Dobeles Apripkis
Tech Postal Code:LVS1055
Tech Country:LV
Tech Phone:+372.65005422
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:ctthorntonlapel@yahoo.com
Name Server:NS1.EVERYDNS.NET
Name Server:NS2.EVERYDNS.NET
Name Server:NS3.EVERYDNS.NET
Name Server:NS4.EVERYDNS.NET

Domain Name: INTERWEB-EXCHANGE.BIZ
Domain ID:                                   D38054994-BIZ
Sponsoring Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Sponsoring Registrar IANA ID:                303
Domain Status:                               clientTransferProhibited
Registrant ID:                               DI_11023786
Registrant Name:                             Kastas Tabars
Registrant Organization:                     N/A
Registrant Address1:                         Perisovos Eila, 6, 5d
Registrant City:                             Riga
Registrant State/Province:                   Rîgas Apripkis
Registrant Postal Code:                      LVS1055
Registrant Country:                          Latvia
Registrant Country Code:                     LV
Registrant Phone Number:                     +372.65005422
Registrant Email:                            ctthorntonlapel@yahoo.com
Administrative Contact ID:                   DI_11023786
Administrative Contact Name:                 Kastas Tabars
Administrative Contact Organization:         N/A
Administrative Contact Address1:             Perisovos Eila, 6, 5d
Administrative Contact City:                 Riga
Administrative Contact State/Province:       Rîgas Apripkis
Administrative Contact Postal Code:          LVS1055
Administrative Contact Country:              Latvia
Administrative Contact Country Code:         LV
Administrative Contact Phone Number:         +372.65005422
Administrative Contact Email:                ctthorntonlapel@yahoo.com
Billing Contact ID:                          DI_11023786
Billing Contact Name:                        Kastas Tabars
Billing Contact Organization:                N/A
Billing Contact Address1:                    Perisovos Eila, 6, 5d
Billing Contact City:                        Riga
Billing Contact State/Province:              Rîgas Apripkis
Billing Contact Postal Code:                 LVS1055
Billing Contact Country:                     Latvia
Billing Contact Country Code:                LV
Billing Contact Phone Number:                +372.65005422
Billing Contact Email:                       ctthorntonlapel@yahoo.com
Technical Contact ID:                        DI_11023786
Technical Contact Name:                      Kastas Tabars
Technical Contact Organization:              N/A
Technical Contact Address1:                  Perisovos Eila, 6, 5d
Technical Contact City:                      Riga
Technical Contact State/Province:            Rîgas Apripkis
Technical Contact Postal Code:               LVS1055
Technical Contact Country:                   Latvia
Technical Contact Country Code:              LV
Technical Contact Phone Number:              +372.65005422
Technical Contact Email:                     ctthorntonlapel@yahoo.com
Name Server:                                 NS1.EVERYDNS.NET
Name Server:                                 NS2.EVERYDNS.NET
Name Server:                                 NS3.EVERYDNS.NET
Name Server:                                 NS4.EVERYDNS.NET
Created by Registrar:                        DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar:                   DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Domain Registration Date:                    Mon Feb 01 07:32:00 GMT 2010
Domain Expiration Date:                      Mon Jan 31 23:59:59 GMT 2011
Domain Last Updated Date:                    Mon Feb 01 07:32:03 GMT 2010

DNS Lookup: interweb-exchange.net A record [Also valid for interweb-exchange.com, interweb-exchange.org, and interweb-exchange.biz]
Searching for interweb-exchange.net A record at k.root-servers.net [193.0.14.129]: Got referral to i.gtld-servers.net. (zone: net.)
Searching for interweb-exchange.net A record at i.gtld-servers.net. [192.43.172.30]: Got referral to ns1.everydns.net. (zone: interweb-exchange.net.)
Searching for interweb-exchange.net A record at ns1.everydns.net. [208.76.61.100]: Reports interweb-exchange.net.
Response:

Domain	Type	Class	TTL	Answer
interweb-exchange.net.	A	IN	3600	195.189.247.119
interweb-exchange.net.	NS	IN	86400	ns1.everydns.net.
interweb-exchange.net.	NS	IN	86400	ns2.everydns.net.
interweb-exchange.net.	NS	IN	86400	ns3.everydns.net.
interweb-exchange.net.	NS	IN	86400	ns4.everydns.net.
ns1.everydns.net.	A	IN	86400	208.76.61.100
ns2.everydns.net.	A	IN	86400	208.76.62.100
ns3.everydns.net.	A	IN	86400	208.76.63.100
ns4.everydns.net.	A	IN	86400	208.76.60.100

Looking up at the 4 interweb-exchange.net. parent servers:

Server	Response
ns4.everydns.net [208.76.60.100]	195.189.247.119
ns3.everydns.net [208.76.63.100]	195.189.247.119
ns2.everydns.net [208.76.62.100]	195.189.247.119
ns1.everydns.net [208.76.61.100]	195.189.247.119

The host for this criminal fraudster is ProstoHosting LTD of Kiev, Ukraine on IP address 195.189.247.119. This same IP address is also hosting the Zexchange scammer - they are clearly related.

***Latest News*** Initial entry 14th. February 2010

***Latest News*** 19th. February 2010
News from Simon Bear - the domains interweb-exchange.net, interweb-exchange.com, interweb-exchange.org have all been deleted and interweb-exchange.biz is dns disabled - please notify me of any active domains for this criminal.