M Web Hosting

M Web (Megaweb) Hosting Fraud

Don't Bear Internet Fraud

M Web Hosting (MegaWeb Hosting) screenshot

M Web Hosting (MegaWeb Hosting) is one of a number of identical Russian 'technoscams' including Unix Hosting, Sun Hosting, (dead), Star Net, Maestro Hosting, Web Star, Web Ground and no doubt others. All using a fake webhosting front company to hide the usual phishing for personal details/money laundering part time work from home 'job' that consists of accepting stolen funds from credit card fraud into your private bank account and transferring them back out via Moneygram or Western Union. In this case their current domain megaweb-hosting.com was only registered with Melbourne IT (Yahoo) on 25-Aug-2008 and the registrant's whois details are hidden by Privacy Protect which is not the action of a legitimate company. Their website uses content stolen from a variety of places, including The Planet. For example, their "Executive team" texts are stolen from the Webhostingbuzz website and the photographs of their supposed Executive team are actually the Opera Software Executive team. Here is the identical Web Ground scammer victim's story, from Rip-Off report, along with a couple of reports from victims of another clone fraud Unix Hosting here and here. The fake company is not registered in its supposed headquarters state of IL & the location details are bogus.

This fraud should not be confused with any other company of the same or similar name - the above website screenshot and the following fraud evidence refer to this criminal company alone and no other.

Evidence of Criminal Fraud:
Where applicable, links are provided for you to easily verify the following irrefutable evidence of fraud. Please bear in mind that criminals modify their websites to discredit or disrupt the evidence of criminality - The information is correct as of 19-Feb-2009 please inform me of any errors noted.

i) According to the M Web Hosting home page (linked screenshot above):

"We have created and launched hundreds of successful websites since our inception". However, their current domain megaweb-hosting.net was only registered with GODADDY.COM, INC. on 06-Oct-2008 and the registrant's whois details are hidden by Privacy Protect which is not the action of a legitimate company.

ii) An Illinois state LLC registration websearch shows that their is no such LLC as "M Web Hosting" registered in the state of IL. Clear verifiable evidence of fraud.

iii) The M Web Hosting Inc. website carries the following "Transfer Management Assistant" money mule criminal solicitation under the "Careers" tab. The Job Description for this task is as follows:

Transfer Management Assistant Vacancy

The Transfer Department is responsible for driving the transactions between payment systems. This Transfer Department is part of the M Web Hosting team, whose mission is web hosting and web design service.

Transfer Management Assistant Vacancy

The Transfer Management Assistant works in constant cooperation with the Senior Transfer Manager. The assistant is provided access to the company’s account to supervise its activity. The assistant executes orders from the senior manager and helps him or her process payments and continuously reports to him or her about any activity on the account.

Responsibilities

    * Assist the Transfer Manager with client payments.
    * Handle money receiving and disbursement systems.
    * Manage, review, and reconcile the company's checking account.
    * Maintain the payroll and benefit journals.
    * Manage and execute the billing process.
    * Monitor bank accounts and transfer funds as needed.
    * Record and report the grants and contributions from various sources.
    * Handle inquiries regarding billing issues and their resolution.

Salary

$25 USD per hour.

Work schedule

15 hours per week (or more). Flexible time table.

Training

Training by means of a several test transactions online. Training is free of charge.

That is a clear 'money mule' function. The 'transactions' and 'transfers' are transferring stolen funds via Moneygram and Western Union back to the criminals. No legitimate company is going to advertise for this sort of part time, 'work from home' money transfer position among the uncertified general population overseas, to do so defines the company as both bogus and criminal.

iv) The critical sentence is the last one. The training is actually the job and consists of 'several test transactions' consisting of accepting stolen funds from credit card fraud into your account and transferring them back to the criminals via Moneygram and Western Union. After these fraud 'test transactions' are completed, all communication with the fake company ceases and no more is heard from them as per this Webground victim's story. Clear evidence of criminal fraud.

v) If you respond, this will be the reply you will receive (courtesy of a site contact):

Dear John Doe,
We are pleased to inform you that your application for the Transfer Management Assistant position has been favorably reviewed. Your application materials clearly show that you are ready to thrive in an entrepreneurial environment and to manage your operation. In addition, and equally important, you are ready for success! You should find all necessary employment documentation enclosed. If you can not find employment documentation in this letter, please visit our web site:

http://www.m-web-hosting.net/support/documentation/

How to join us:

Read job description document and feel free to respond with any questions you may have.
Fill out the employment agreement, sign it, and return it to the address provided.
Email : robert.morris@master-web-hosting.com
or
Fax : +1-800-590-6905

We will forward your application documents to our hiring department.
You will receive a letter confirming your employment within 2 days.
That is it! Enjoy being a part of our team and earning money from the convenience of your own home.
Note:

You may find more information on our Web site, and feel free to ask any questions about your job duties and salary. My job is to assist you in managing payments and I will do my utmost to help you whenever possible.

Robert Morris,
Human Resources Manager

vi) The criminals 'Executive Team' text details have all been stolen from the Webhostingbuzz website and renamed, (albeit rather carelessly as the bio for the fake "Michael Maison" mistakenly includes a reference to the stolen persona of Alex). The photographs of their supposed Executive team are actually the Opera Software management team. Absolutely irrefutable evidence of criminal fraud.

vii) Original Fake Contact Details from the website: (New details below)

Headquarters in San Francisco, USA
Address

M Web Hosting
715 Harrison St
CA 94107 San Francisco
USA
Mailing address

M Web Hosting
715 Harrison St
CA 94107 San Francisco
USA

Tel:
    +1-800-946-6702
Fax:
    +1-800-590-6905
Telephone hours:
    9 am - 5 pm

Contact online
Satellite offices
San Diego, USA

M Web Hosting
4242 Jutland Dr.
Suite 15
San Diego, CA 92117
Mountain View, USA

M Web Hosting
692 E. El Camino Real
Suite 207
Mountain View, CA 94040
Tokyo, Japan

M Web Hosting
Tokyu Ikejiriohashi bldg 1F
3-8-2 Higashiyama Meguro
Tokyo 153-0043

Tel: +81 3 5768 8223
Fax: +81 3 5768 8224
Beijing, China

M Web Hosting
Rm. 1002, Full Tower
No.3 DongSanHuanZhong Road
100020, Beijing

Tel:
    +86 10 85 91 18 30

Seoul, Korea

M Web Hosting
Suite 702, City Air Terminal, 152-6
Samsung-dong, Gangnam-gu,
Seoul, Korea

Tel: +82 2 551 3876
Fax: +82 2 551 3879

• - A Google search clearly shows that the headquarters address 715 Harrison St., San Francisco is a gay venue called 'The X', (aka 'Goat Hill Pizza', The 'Crib', 'City Nights' and 'Glow', depending on the night), so you may get some unexpected replies to mail enquiries regarding hosting... Clear, verifiable evidence of fraud.
• - The fake 'satellite offices' are all exactly the same as for all of the criminal's other identical fraud aliases, (listed above), but the fake head office addresses differ. Clear evidence of fraud.
• - A USPS Zip code check on the address 4242 Jutland Dr. San Diego returns the following message: "The address you provided is not recognized by the US Postal Service as an address we serve. Mail sent to this address may be returned". It is a fake address. Clear verifiable evidence of fraud.

19-Feb-2009
These crooks have new fake contact details:

M Web Hosting
5005 NewPort Dr Suite
60008 Rolling Meadows
USA
• - There's no Google evidence that these crooks are at that address- they are also not listed at that address by Google Maps..
• - Suite what? (60008 is the zip code). They probably stole the address from Webhostingpad.com and missed the suite number off to make it anonymous & useless....

The above evidence clearly demonstrates beyond any doubt that the M Web Hosting Inc. website has been set up very recently by money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Known Website Domains

megaweb-hosting.com
megaweb-hosting.net
m-web-hosting.net

Registrar

Melbourne IT (Yahoo) 25-Aug-2008
Melbourne IT (Yahoo) 02-sep-2008
GODADDY.COM, INC. 06-Oct-2008

Active
Suspended/Disabled

Network Data

(Valid for domain megaweb-hosting.com)

How I am searching:

Searching for megaweb-hosting.com A record at j.root-servers.net [192.58.128.30]: Got referral to J.GTLD-SERVERS.NET. (zone: com.)
Searching for megaweb-hosting.com A record at J.GTLD-SERVERS.NET. [192.48.79.30]: Got referral to yns1.yahoo.com. (zone: megaweb-hosting.com.)
Searching for megaweb-hosting.com A record at yns1.yahoo.com. [66.218.71.205]: Reports megaweb-hosting.com. Response:

Domain	Type	Class	TTL	Answer
megaweb-hosting.com.	A	IN	1200	68.180.151.27
megaweb-hosting.com.	A	IN	1200	68.180.151.28
megaweb-hosting.com.	A	IN	1200	68.180.151.29
megaweb-hosting.com.	A	IN	1200	68.180.151.30
megaweb-hosting.com.	A	IN	1200	68.180.151.31
megaweb-hosting.com.	A	IN	1200	68.180.151.80
megaweb-hosting.com.	NS	IN	86400	yns2.yahoo.com.
megaweb-hosting.com.	NS	IN	86400	ns9.san.yahoo.com.
megaweb-hosting.com.	NS	IN	86400	yns1.yahoo.com.
megaweb-hosting.com.	NS	IN	86400	ns8.san.yahoo.com.
yns1.yahoo.com.	A	IN	1800	66.218.71.205
yns2.yahoo.com.	A	IN	1800	216.109.116.20
ns8.san.yahoo.com.	A	IN	1800	66.218.71.205
ns9.san.yahoo.com.	A	IN	1800	216.109.116.20

Status: Records all match.

Status: Records all match.

Looking up at the 2 megaweb-hosting.com. parent servers:

Server	Response
yns1.yahoo.com [66.218.71.205]	68.180.151.18 68.180.151.19 68.180.151.20 68.180.151.21 68.180.151.22 68.180.151.23
yns2.yahoo.com [66.196.84.168]	68.180.151.58 68.180.151.59 68.180.151.60 68.180.151.80 68.180.151.81 68.180.151.82

The host for this criminal is the Yahoo 'small business network' so often used by these criminals.

Fraud Log

1st. September 2008
Webpage created

***Latest News*** 10th. September 2008
The domain megaweb-hosting.com has been disabled by Yahoo and the criminal is now operating under another domain - megaweb-hosting.net hosted using Yahoo nameservers but hosted on a Starhub Internet IP (203.117.111.8)

How I am searching:

Searching for megaweb-hosting.net A record at k.root-servers.net [193.0.14.129]: Got referral to f.gtld-servers.net. (zone: net.)
Searching for megaweb-hosting.net A record at f.gtld-servers.net. [192.35.51.30]: Got referral to yns1.yahoo.com. (zone: megaweb-hosting.net.)
Searching for megaweb-hosting.net A record at yns1.yahoo.com. [66.218.71.205]: Reports megaweb-hosting.net. Response:

Domain	Type	Class	TTL	Answer
megaweb-hosting.net.	A	IN	600	203.117.111.8
megaweb-hosting.net.	NS	IN	86400	ns8.san.yahoo.com.
megaweb-hosting.net.	NS	IN	86400	ns9.san.yahoo.com.
megaweb-hosting.net.	NS	IN	86400	yns2.yahoo.com.
megaweb-hosting.net.	NS	IN	86400	yns1.yahoo.com.
yns1.yahoo.com.	A	IN	1800	66.218.71.205
yns2.yahoo.com.	A	IN	1800	216.109.116.20
ns8.san.yahoo.com.	A	IN	1800	66.218.71.205
ns9.san.yahoo.com.	A	IN	1800	216.109.116.20

Looking up at the 2 megaweb-hosting.net. parent servers:

Server	Response
yns2.yahoo.com [66.196.84.168]	203.117.111.8
yns1.yahoo.com [66.218.71.205]	203.117.111.8

The host for this criminals website is STARHUB INTERNET (Starhub.com) of Singapore on IP 203.117.111.8

***Latest News*** 18th. February 2009
Unfortunately this criminal is still going strong and continuing to scam people from the feedback that I am receiving. Their new domain m-web-hosting.net is registered with GoDaddy.com Inc. who have proved themselves not to be the most ethical of registrars as they do not readily co-operate in the fight against internet fraud.

Network Data (Valid for m-web-hosting.net)
How I am searching:

Searching for m-web-hosting.net A record at h.root-servers.net [128.63.2.53]: Got referral to g.gtld-servers.net. (zone: net.)
Searching for m-web-hosting.net A record at g.gtld-servers.net. [192.42.93.30]: Got referral to yns1.yahoo.com. (zone: m-web-hosting.net.)
Searching for m-web-hosting.net A record at yns1.yahoo.com. [98.136.43.32]: Reports m-web-hosting.net. Response:

Domain	Type	Class	TTL	Answer
m-web-hosting.net.	A	IN	1200	68.180.151.74
m-web-hosting.net.	NS	IN	86400	yns1.yahoo.com.
m-web-hosting.net.	NS	IN	86400	yns2.yahoo.com.
m-web-hosting.net.	NS	IN	86400	ns9.san.yahoo.com.
m-web-hosting.net.	NS	IN	86400	ns8.san.yahoo.com.

Looking up at the 2 m-web-hosting.net. parent servers:

Server	Response
yns2.yahoo.com [66.196.84.168]	68.180.151.74
yns1.yahoo.com [98.136.43.32]	68.180.151.74

The host of this criminal fraudster is once again Yahoo on IP address 68.180.151.74

***Latest News*** 12th. March 2009
News from Simon Bear - Yahoo have at long last disabled the criminal's domain m-web-hosting.net. I wonder how many victims they have recruited while Yahoo have been dragging their feet. GoDaddy are no better. Please notify me of any active domains for this criminal.