IT-Security Business Alliance Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon

IT Security Logo.

IT-Security Business Alliance is just another run-of-the mill fake financial site that exists solely to ensnare the unwary, whether it is to 'phish' for bank details or mainly to recruit money mules. The clues are all there that give the criminal's game away without a shadow of a doubt. It is exactly the same bunch of criminals that have produced the majority of the money laundering scams listed on this site.

This fraudster should not be confused with any genuine company with the same or similar name. The above logo identifies the fraudulent site.
Evidence of Criminal Fraud:

i) The  IT-security Business Alliance fraudster's grandiose claims are even more ludicrous than normal here's a selection:

"«It-security Business Alliance» emerged in 1992 as a result of partnership of German entrepreneurs, striving for development, and a group of experts in the field of classical and investment consulting. Currently the company has a gained a unique reputation in the Germany as a consummate consulting professional and the owner of real estate of high commercial value.

The company boasts to have financial support for its investment projects from the leading World banks. The International Union of Attorneys ensures legal support and security of «It-security Business Alliance» customers.

Among 1500 customers of the Group there are several top-level world corporations, which influence economies of the whole regions. In general the «It-security Business Alliance» database includes more than 18000 clients, who could feel the comfort of cooperation or have concluded contracts with the company at some stages.

«It-security Business Alliance» operates through its dedicated permanent staff including 2600 employees scattered over more than 50 countries worldwide. In addition about 150 freelance experts (in the field of marketing, technology, design and engineering) support various projects when necessary."

You have to laugh - their website domain itsecurity-ba.com was only registered with BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN on 08-Jan-2008. Haven't they done well in less than a couple of weeks? You can see the joins where they slot in their different aliases.

ii) Despite the above claims, Google has never heard of them except as spammers and scammers.

iii) The payload of the site is this usual money mule job of "Regional Company Representative/Agent" under the 'Vacancies' menu option:
Regional Company Representative/Agent

Vacancy Announcement Number: ITsec-4900/R
Opening Date: 01/10/2007
Closing Date: Open until filled
Salary: Depends on Work Scope/ bonus & benefits
Duty Location: United States of America

The duties of Company representative (Agent) shall include:

    * Processing payments from, or for our clients
    * Daily reporting about each completed task.

Salary:

    * The Salary depends on the work scope you wish to make. IT-security will pay you 1800$ per month, and commission per transfer/payment you will successfully process.

Candidate requirements:

    * Prior customer service experience is a good benefit, but not a must
    * Honesty, responsibility and promptness in operations
    * The ability to operate with more than one task effectively, and have an adaptable, flexible, professional attitude
    * Effective dealing with tight deadlines and frequently changing priorities
    * The ability of stable communication with our company and on-time and detailed reporting.
It's the usual part time money mule function, of course.

iv) No genuine company would recruit "money transfer agents" from among the untrained, unknown general population in a foreign country - the whole idea is ludicrous apart from the fact that the activity is totally illegal.

v) Contact details from website:
Mailing Address:
Rosa-Luxemburg-Strasse 15
Berlin , 10178 ,
Germany

Phone number:
46-513-389-389

They claim to be in Berlin, but the number is a Swedish one - they must have a long telephone cord... Mind they'd need a similar one for their Switzerland office - that telephone number is listed as a UK one.

vi) They are not registered at Germany's 'Companies House'.

vii) They've got the usual bunch of fake certificates that these crooks love to post. Why do they think that these would convince anyone? They've even got one from the UK Portsmouth and South East Hampshire chamber of commerce when they are not even pretending to be in the UK.

viii) Do a Google search for this scrap of text from their Privacy Policy to see just a few of this criminal's aliases: "We use business information to provide a payment service between commerce participants who are also users"
The above evidence clearly demonstrates that the IT-security Business Alliance website is a fraudulent website set up with intent to deceive. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is usually false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
 
Known Website Domains

itsecurity-ba.com (Suspended)
itsecurity-online.com (Suspended)
 Registrar

BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN 08-Jan-2008
Enom Inc. (Rustelekom) 29-Nov-2007

Network Data (itsecurity-ba.com)

 How I am searching:

Searching for itsecurity-ba.com A record at m.root-servers.net [202.12.27.33]: Got referral to B.GTLD-SERVERS.NET. (zone: com.)
Searching for itsecurity-ba.com A record at B.GTLD-SERVERS.NET. [192.33.14.30]: Got referral to ns2.cyber-punk-host.cn. (zone: itsecurity-ba.com.)
Searching for itsecurity-ba.com A record at ns2.cyber-punk-host.cn. [79.135.181.20]: Timed out. Trying again.
Searching for itsecurity-ba.com A record at ns1.cyber-punk-host.cn. [79.135.181.19]: Reports itsecurity-ba.com. Response:
Domain Type Class TTL Answer
itsecurity-ba.com. A IN 14400 79.135.181.18
itsecurity-ba.com. NS IN 14400 ns2.cyber-punk-host.cn.
itsecurity-ba.com. NS IN 14400 ns1.cyber-punk-host.cn.
ns1.cyber-punk-host.cn. A IN 14400 79.135.181.19
ns2.cyber-punk-host.cn. A IN 14400 79.135.181.20

Looking up at the 2 itsecurity-ba.com. parent servers:

Server Response
ns2.cyber-punk-host.cn [79.135.181.20]  79.135.181.18
ns1.cyber-punk-host.cn [79.135.181.19]  79.135.181.18

The host of this one is TurkeyColo (79.135.181.18)
Network Data

How I am searching: (itsecurity-online.com)

Searching for itsecurity-online.com A record at j.root-servers.net [192.58.128.30]: Got referral to H.GTLD-SERVERS.NET. (zone: com.)
Searching for itsecurity-online.com A record at H.GTLD-SERVERS.NET. [192.54.112.30]: Got referral to ns1.dramsns.net. (zone: itsecurity-online.com.)
Searching for itsecurity-online.com A record at ns1.dramsns.net. [209.123.8.185]: Reports itsecurity-online.com. Response:
Domain Type Class TTL Answer
itsecurity-online.com. A IN 14400 64.247.59.155
itsecurity-online.com. NS IN 14400 ns2.dramsns.net.
itsecurity-online.com. NS IN 14400 ns1.dramsns.net.
ns1.dramsns.net. A IN 14400 209.123.8.185
ns2.dramsns.net. A IN 14400 64.247.59.152

Looking up at the 2 itsecurity-online.com. parent servers:

Server Response
ns2.dramsns.net [64.247.59.152] 64.247.59.155
ns1.dramsns.net [209.123.8.185] 64.247.59.155

The host for this one is Net Access Corporation, (64.247.59.155) (the same host as the Walla Truck fraudster at present).

Spam Headers:
Spam Body: 
Fraud Log

31st. Jan. 2008
Webpage created
***Latest News*** 25th. February 2008
Information from site contact - both known donmains dead. Please inform me of any known active domains via the 'Notify Active Domain' facility.