Navitex scam

Navitex Fraud

Don't Bear Internet Fraud

Navitex screenshot - 06-Mar-2009

This fraud should not be confused with any other company of the same or similar name - the following fraud evidence defines and refer to this fake company alone and no other.

Navitex is just another fake financial site used as a vehicle to legitimise a money laundering mule recruiting fraud scam. It's a zombie botnet hosted 'Rockphish' site using the same zombies as used for many other 'Rockphish' fake financial sites and phishing campaigns. Zombie botnet hosting irrefutably defines it as a criminal website - no legitimate website is zombie botnet hosted. Their site content has been stolen from the Carrley Business Consulting website, their initial domain companyhireorg.net (which clearly has nothing to do with Navitex), was only recently registered for one year only, they have no web presence, although there are lots of other Navitex's, probably because the website is simply an off the shelf generic template, (Template 19813 - Navitex Business Website Template) and they haven't bothered changing the name. Oh, and it doesn't work properly on Firefox.

Evidence of Criminal Fraud:

i) From the above screenshot "We have many years experience" but their domain companyhireorg.net was only registered with BIZCN.COM, INC. on 03-Mar-2009 for one year only. A clear indication of a fake website.

ii) The fake Navitex website content has quite clearly been stolen from the genuine company Carrley Business Consulting and modified to suit the criminal's purposes. Clear evidence of site theft and fraud.

iii) As is usual for these criminals, a Google search shows that they have no internet presence at all although there are other Navitex websites.

iv) The fake testimonials in the above screenshot appear all over the place as they have been generated by this fake testimonial generator hence this meaningless nonsense from the screenshot above: "This is the most reliable thing of thing we've ever used". Try a Google search for the phrase and you'll see what I mean... the same fake testimonial also appeared on the AmexFinance scam so this crook's pedigree is fairly evident.

v) The true purpose of the website is to lend legitimacy to an email spamming campaign attempting to recruit money laundering mules. Here is an example of the spam which purports to have come from Careerbuilder as many of these fraud emails do:

Subject: CareerBuilder Intuitive Recommendation List For You!

Dear job seekers!

Apply for the job. We recommend this position.

JobDescription

We are looking for people who can control the payment of our customers
from your state / region. The responsibilities of work included
compiling monthly reports on the overall turnover of funds, sending
documents on each transfer.

We offer you confidentially as you conduct a search to meet your
career goals and we can help you to understand and communicate what
makes you stand out in a crowd.

My role is to find the best candidates to meet the needs of my
clients. You could be just the person I'm looking for.

Job Requirements

As a Finance Manager, you are responsible for all aspects of
operation, including customer relations, team management, financial
management and team recognition/retention.

Minimum qualifications include:

- Well developed analytical, communication, and interpersonal skills
- Strong operational background and knowledge
- Exceptional people skills
- Problem solving skills
- Top notch communication and writing skills
- A drive to be the best

APPLY NOW

Please send your Resume to admin@companyhireorg.net

vi) The job is defined by the paragraph: "We are looking for people who can control the payment of our customers from your state / region. The responsibilities of work included compiling monthly reports on the overall turnover of funds, sending documents on each transfer." Controlling the payments of the customers and sending documents on each transfer means accepting fake cheques into your bank account and transferring a balance to these criminals via Western Union or Moneygram. Don't be fooled or you will end up losing a lot of money, having your bank account and your assets frozen and possibly ending up with a criminal record.

vii) No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas - do not be tempted.

viii) Fake 'Contact Us' Details from website:

Navitex, LLP

39 WETHERBY MANSIONS,
EARLS COURT SQUARE,
LONDON, SW5 9BH, United Kingdom

MAP

Phone: +44 20 3286 5308 (UK) +1 239 603 7660 (US)

Fax: +44 20 3286 5308 (UK) +1 239 603 7660 (US)

E-mail: contactus@navitex-company.com

• - A Google search shows that the address 39 WETHERBY MANSIONS, EARLS COURT SQUARE, LONDON, SW5 9BH is simply an accommodation address used by lots of company registrations. It is not the location of these criminals - in fact it is simply a flat or apartment according to the UK Postcode checker, the correct address is Flat 39, Wetherby Mansions, Earl's Court Square, LONDON, SW5 9BH
• - Dialling the telephone number +44 20 3286 5308 results in a "number not recognised" message - it is a fake number.
• - A Google search for the number "+1 239 603 7660" returns no results.

The above evidence clearly demonstrates beyond any doubt that the Navitex website has been set up very recently by 'Rockphish' money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Main Website Domains

companyhireorg.net
navitex-company.com

Registrar

Bizcn.com, Inc. - 03-Mar-2009
Bizcn.com, Inc. - 03-Mar-2009

Botnet Nameserver Domains

moveinstop.net

Registrar

REGISTER.COM, INC. - 18-Jan-2009

Nameserver Host

Sago Networks

Host IP

207.150.183.185

Active
Suspended/Disabled
Parked

The Zombie Botnet DNS Data (Valid for domain companyhireorg.net, navitex-company.com)

Looking up at the 2 companyhireorg.net. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.moveinstop.net [207.150.183.185]	68.42.187.195 68.45.12.57 70.234.245.1 71.101.160.73 75.0.155.84
ns2.moveinstop.net [89.125.31.83]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the criminal owned nameserver ns1.moveinstop.net hosted by Sago Networks on IP address 207.150.183.185 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT/NSLOOKUP). See The Zombie Botnet 'Host By Proxy' for an explanation of this method of hosting.

Reverse IP checks on the zombies used by this criminal reveal fraud and phishing domains hosted by known 'Rockphish' zombies, so this in undoubtedly a 'Rockphish' operation.

***Latest News*** 6th. March 2009
Webpage created

***Latest News*** 10th. September 2009
The criminals domains are either disabled or parked as above - please notify me of any active domains for this criminal.