MT Rushphase Co.

MT Rushphase Co. Fraud

Don't Bear Internet Fraud

MT Rushphase home page screenshot:

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the included money laundering job clearly identify the fake website and these fraudsters.

MT Rushphase Co. is simply one of the latest operations of a huge Russian money laundering criminal network that has dozens of aliases. It is a follow-on fraud to the now defunct NTI Consult fraud, using the same website template. The same flash intro as depicted in the above screenshot was also used by the Russian Webcardmaster criminals, and the 'stripey ball' part of the website banner is the same as used by the AFC Financial Services, EU Investment Solutions, and EURO Investment Solutions so its pedigree is pretty apparent. The whole purpose of the website is to lend credibility to the inevitable illegal money mule job of "Company Representative" which they now no longer post on the website for obvious reasons, but that does not make it any less fraudulent. Despite claims of having been in operation for over ten years their multiple domains were only registered in the last few weeks and all their claims are easily demonstrated to be bogus. Their website home page text above is identical to previous fraudsters such as the Olan Complex criminals and they have no Google internet presence save for fraud website listings.

Evidence of Criminal Fraud:

i) Their above home page website text content is identical to one of their previous aliases, Olan Complex.- Clear evidence of criminality.

ii) Their website template is identical to another of their aliases - NTI Consult - Clear evidence of criminality.

iii) They claim on their home page above "We are strong team of brokers and have been working together over 10 years", however, as is usual with these crooks, their website domains were only registered in the last few weeks (04-Aug-2008).

iv) They hide their bogus whois data with Privacy Protect - why should a legitimate company do that? - Clear evidence of fraud.

v) Contact details from their website:

HEAD OFFICE

275 Madison Avenue- 5th fl
New York, NY 10183-2500
United States of America
Phone: (718) 208-4034

• - A Google check on the above telephone number shows it to be a New York City Zone 6 (Brooklyn) V.92 internet dial-up number - Clear evidence of fraud.

vi) The criminal uses the same host IP (196.2.198.241) and exactly the same network details, (including the same criminal owned, recently registered nameservers ns1.egns.vg and ns2.egns.vg), as are used for the Apollo Business Services fraudster. Clear evidence of criminality.

vii) Fraudulent endorsements - under the "Recommended brokers" heading the fraudster has a list of financial websites that supposedly recommend them, in fact they do nothing of the sort - it is simply a list of financial websites. Clear evidence of deception.

viii) They have absolutely no internet presence - a Google search for "MT Rushphase" simply returns their own fake websites and a selection of fraud website listings. Clear evidence of fraud.

The above evidence is clear proof that the MT Rushphase website is a fraudulent website set up with intent to deceive. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is invariably false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Known Website Domains

mt-rushphase.biz
mt-rushphase.info
mt-rushphase.com
mt-rushphase.org
mt-rushphase.net

Nameserver Domains

egns.vg

Registrar

REG2C.COM, INC. (04-Aug-2008)
REG2C.COM, INC. (04-Aug-2008)
REG2C.COM, INC. (04-Aug-2008)
REG2C.COM, INC. (04-Aug-2008)
REG2C.COM, INC. (04-Aug-2008)

adamsnames.tc (24-Jul-2008)

Active
Suspended/Disabled

If you know of any other active domains, please let me know.

DNS Data: (Valid for mt-rushphase.biz, mt-rushphase.info, mt-rushphase.com, mt-rushphase.org)

How I am searching:

Searching for mt-rushphase.biz A record at a.root-servers.net [198.41.0.4]: Got referral to F.GTLD.biz. (zone: biz.)
Searching for mt-rushphase.biz A record at F.GTLD.biz. [209.173.58.66]: Got referral to NS2.EGNS.VG. (zone: mt-rushphase.biz.)
Searching for mt-rushphase.biz A record at NS2.EGNS.VG. [196.2.198.242]: Reports mt-rushphase.biz. Response:

Domain	Type	Class	TTL	Answer
mt-rushphase.biz.	A	IN	14400	196.2.198.241
mt-rushphase.biz.	NS	IN	14400	ns2.egns.vg.
mt-rushphase.biz.	NS	IN	14400	ns1.egns.vg.
ns1.egns.vg.	A	IN	14400	196.2.198.241
ns2.egns.vg.	A	IN	14400	196.2.198.242

Looking up at the 2 mt-rushphase.biz. parent servers:

Server	Response
ns2.egns.vg [196.2.198.242]	196.2.198.241
ns1.egns.vg [196.2.198.241]	196.2.198.241

The host for this criminal is listed as EG-Net (Cairo) on IP address 196.2.198.241

These are exactly the same network details including the same criminal owned nameservers as for the Apollo Business Services fraudster.

DNS Data: (Valid for mt-rushphase.net)
How I am searching:

Searching for mt-rushphase.net A record at a.root-servers.net [198.41.0.4]: Got referral to J.GTLD-SERVERS.net. (zone: net.)
Searching for mt-rushphase.net A record at J.GTLD-SERVERS.net. [192.48.79.30]: Got referral to ns1.reg2c.com. (zone: mt-rushphase.net.)
Searching for mt-rushphase.net A record at ns1.reg2c.com. [89.106.13.101]: Reports mt-rushphase.net. Response:

Domain	Type	Class	TTL	Answer
mt-rushphase.net.	A	IN	86400	89.106.13.101
mt-rushphase.net.	NS	IN	86400	ns1.kostiga.com.

Looking up at the 2 mt-rushphase.net. parent servers:

Server	Response
ns2.reg2c.com [89.106.13.102]	89.106.13.101
ns1.reg2c.com [89.106.13.101]	89.106.13.101

The host for this criminal is listed as TURKTICARET-GRID-NET of Istanbul on IP address 89.106.13.101

Webpage set up 26th. August 2008

***Latest News*** 31st. October 2008

All the criminal's domains seem to have been suspended or disabled. Please notify me of any active links.

Consigned to Archive.