OnlineOfficeSource Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
OnlineOfficeSource scam (30-Oct-2009)
The owner of the genuine CurrencySource website on currencysource.com has contacted me to confirm this criminal activity using content stolen from his own website, including the genuine site location and contact details. This criminal activity is nothing whatsoever to do with the genuine CurrencySource company who are as much a victim of this criminal as anyone else.

OnlineOfficeSource (30-Oct-2009)

This fraudster should not be confused with any legitimate company of the same or similar name - the fake website content has been stolen from the genuine CurrencySource company's website. The following evidence clearly identifies the fake website and these criminal fraudsters.

OnlineOfficeSource is just the follow-on fraud to the CurrencySource (stolen identity) fraud which was a follow-on fraud to the Poland Real Estate, San Marca and Babochka scammers. They have clearly stolen their site content from the genuine CurrencySource company, (confirmed by the genuine company owner), including the genuine location and contact details. Their initial domains vitonlineoffice.com and onlineofficevit.com were only registered very recently for the usual 'criminal's domain' minimum period of only one year - see domain list below for all known current domains.
The whole purpose of this fraud site is to lend an air of legitimacy to a 'Money Mule' job that consists of accepting fake checks to your home address, cashing them and sending a balance back to these crooks in Russia/the Ukraine. See the spam sample below. It will get your bank account and your assets frozen, lose you a lot of money and earn you a criminal record - don't be tempted.

OnlineOfficeSource stolen site : Evidence of Criminal Fraud

i) The above OnlineOfficeSource fraud website content has been stolen from the genuine CurrencySource company, (including the genuine site contact and location details), and modified to include a registration page for a money laundering mule role which is being spamvertised in the usual way. Clear evidence of site theft and fraud - confirmed by the genuine company owner.

ii) On their 'About Us' page the criminals say: "Operating successfully since 1998, OnlineOfficeSource is one of the largest foreign exchange firms in North America", however, the criminal's domains vitonlineoffice.com and onlineofficevit.com were only registered on 27-Oct-2009 for the usual 'criminals domain' minimum period of only one year with the Turkish registrar used by many other criminal fraudsters, ALANTRON BLTD. A clear indication of a fraudulent registration. See the tables below for subsequent domains.

iii) Despite the above claims, a Google search for "OnlineOfficeSource" shows that these criminals have zero web presence, (apart from my fraud listing for them) - they simply do not exist, (ignoring any occurrence of any of their fake websites, of course).

iv) Exactly as per their previous alias, they are advertising the job of “Financial Manager” which has no website details at all - just a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal operation which at the very least will cost you a lot of money.

v) No legitimate company would advertise for private citizens to operate as part-time, work from home "Financial Managers". To do so clearly defines the fake OnlineOfficeSource company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Do not be fooled.
vi) Evidence of spamming: The owner of the genuine site whose content has been stolen by these criminals has sent me this following email enquiry he received from a potential victim of these  criminals:
From: xxxxx [mailto:xxxxx@hotmail.com]
Sent: Thursday, October 29, 2009 7:57 AM
To: info@currencysource.com
Subject: Someone is creating fraud using your content...

I recently received an email with a job offer that sounded too good to be true.  Online Office Source,http://vitonlineoffice.com/contact.html.  Are they partners of your company? They even offer the same testimonials, http://vitonlineoffice.com/testimonials.html.
 
Any information you can offer will be extremely helpful.
 
Thanks,
vii) The Spam:
Hello,

We found your curriculum vitae on the Internet. Therefore we'd like to offer you a position of an "Executive Manager". Our HR department looked through your curriculum vitae and record of work and highly recommends you for this work in our organization. The given vacancy consists of the following tasks:

- timely filing of reports on the carried out work

- record keeping of clients in the USA.

You will receive more detailed instructions during an interview over the phone.

Person specification :

- Age: starting from 25

- Citizenship: US

- Time: must have from 1 to 2 hours of free time a day for carrying out his duties.

salary for this vacancy makes up 7000USD a month. The payment will be carried out to your transaction account every month. There are many candidates willing to take up this offer, therefore we're kindly asking you not to delay with your decision about this vacancy.

You may find detailed information about our organization at our web-site.

If this vacancy is interesting to you, then please follow these steps:

1) Register at our web-site. To do so follow click here.

After doing so click on registration of "Executive Manager". Please fill out every field correctly, since data will be checked by our security department.

2) Pass an interview over the phone.

3) Sign a contract with our organization.

We would like to thank you beforehand and we're looking forward to a long-term cooperation.
viii) More stolen content, not only has the criminal stolen content as shown on the screenshot above from the genuine website, as indicated above he has also stolen the genuine site's testimonials and also stolen the genuine location and contact details - clear evidence of site theft, misrepresentation and criminal fraud
The above evidence clearly demonstrates beyond any doubt that the fake OnlineOfficeSource website content has been stolen and has set up by criminal fraudsters purely for the purpose of spamvertising a fraud job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
OnlineOfficeSource Fraudsters - hosting details

Main Domains, Registrars and Hosts  
Domain

vitonlineoffice.com
onlineofficevit.com
 Registrar

ALANTRON BLTD. (27-oct-2009)
ALANTRON BLTD. (27-oct-2009)
 		Host Network

China Unicom Shandong province network
China Unicom Shandong province network
 Host IP

61.156.242.119
61.156.242.119
Key:
Active
Suspended, disabled or Inactive
Parked

Please notify me of any other current domains used by this criminal.
Domain Whois Data:
WHOIS - vitonlineoffice.com

Registrar:     ALANTRON BLTD.
Status:        clientTransferProhibited
Dates:         Created 27-oct-2009   Updated 27-oct-2009  Expires 27-oct-2010
DNS Servers:   NS1.VITONLINEOFFICE.COM  NS2.VITONLINEOFFICE.COM  

Arastirilan alan adi: vitonlineoffice.com  
    Ad / Name      Maria Varshavskaya
    Adres    ul. Elninskaya d.14 k.1 kv.10 Moscow Moscow 121615
    Tel    +7.4959219347
    Faks    +7.4959219347
    E-posta   moist@8081.ru
    Guncelleme / Updated 

        Ad    gizli
        Ad / Name      Maria Varshavskaya
        Adres ul. Elninskaya d.14 k.1 kv.10 Moscow Moscow 121615
        Tel   +7.4959219347
        Faks     +7.4959219347
        E-posta   moist@8081.ru
        Guncelleme / Updated    

        Ad    gizli
        Ad / Name     Maria Varshavskaya
        Adres ul. Elninskaya d.14 k.1 kv.10 Moscow Moscow 121615
        Tel   +7.4959219347
        Faks     +7.4959219347
        E-posta   moist@8081.ru
        Guncelleme / Updated

Alan Adi Sunucusu1 / DNS1       ns1.vitonlineoffice.com
Alan Adi Sunucusu1 IP / DNS1 IP 61.156.242.119
Alan Adi Sunucusu2 / DNS2       ns2.vitonlineoffice.com
Alan Adi Sunucusu2 IP / DNS2 IP 61.156.242.119
Son Guncelleme/ Last Updated          
Kayit Tarihi / Registration Date    2009-10-27
SKT / Exp. Date                2010-10-27
Statu                    Aktif
WHOIS - onlineofficevit.com

Registrar:     ALANTRON BLTD.
Status:        clientTransferProhibited
Dates:         Created 27-oct-2009   Updated 27-oct-2009  Expires 27-oct-2010
DNS Servers:   NS1.ONLINEOFFICEVIT.COM  NS2.ONLINEOFFICEVIT.COM 

Arastirilan alan adi: onlineofficevit.com 
    Ad / Name      Sergei Marshinin
    Adres    Osenny bulvar d.15 kv.32 Moscow Moscow 121609
    Tel    +7.4957454014
    Faks    +7.4957454014
    E-posta   ezra@co5.ru
    Guncelleme / Updated 

        Ad    gizli
        Ad / Name      Sergei Marshinin
        Adres Osenny bulvar d.15 kv.32 Moscow Moscow 121609
        Tel   +7.4957454014
        Faks     +7.4957454014
        E-posta   ezra@co5.ru
        Guncelleme / Updated   

        Ad    gizli
        Ad / Name     Sergei Marshinin
        Adres Osenny bulvar d.15 kv.32 Moscow Moscow 121609
        Tel   +7.4957454014
        Faks     +7.4957454014
        E-posta   ezra@co5.ru
        Guncelleme / Updated

Alan Adi Sunucusu1 / DNS1       ns1.onlineofficevit.com
Alan Adi Sunucusu1 IP / DNS1 IP 61.156.242.119
Alan Adi Sunucusu2 / DNS2       ns2.onlineofficevit.com
Alan Adi Sunucusu2 IP / DNS2 IP 61.156.242.119
Son Guncelleme/ Last Updated         
Kayit Tarihi / Registration Date    2009-10-27
SKT / Exp. Date                2010-10-27
Statu                    Aktif

DNS Lookup: vitonlineoffice.com A record
Searching for vitonlineoffice.com A record at c.root-servers.net [192.33.4.12]: Got referral to M.GTLD-SERVERS.NET. (zone: com.)
Searching for vitonlineoffice.com A record at M.GTLD-SERVERS.NET. [192.55.83.30]: Got referral to ns1.vitonlineoffice.com. (zone: vitonlineoffice.com.)
Searching for vitonlineoffice.com A record at ns1.vitonlineoffice.com. [61.156.242.119]: Reports vitonlineoffice.com.
Response:
Domain Type Class TTL Answer
vitonlineoffice.com. A IN 14400 61.156.242.119
vitonlineoffice.com. NS IN 14400 ns1.currencysource.biz.
vitonlineoffice.com. NS IN 14400 ns2.currencysource.biz.

Looking up at the 2 vitonlineoffice.com. parent servers:

Server Response
ns1.vitonlineoffice.com [61.156.242.119] 61.156.242.119
ns2.vitonlineoffice.com [61.156.242.119] 61.156.242.119

The host of this criminal fraudster is China Unicom Shandong province network on IP address 61.156.242.119
DNS Lookup: onlineofficevit.com A record
Searching for onlineofficevit.com A record at c.root-servers.net [192.33.4.12]: Got referral to J.GTLD-SERVERS.NET. (zone: com.)
Searching for onlineofficevit.com A record at J.GTLD-SERVERS.NET. [192.48.79.30]: Got referral to ns2.onlineofficevit.com. (zone: onlineofficevit.com.)
Searching for onlineofficevit.com A record at ns2.onlineofficevit.com. [61.156.242.119]: Reports onlineofficevit.com.
Response:
Domain Type Class TTL Answer
onlineofficevit.com. A IN 14400 61.156.242.119
onlineofficevit.com. NS IN 14400 ns2.currencysource.biz.
onlineofficevit.com. NS IN 14400 ns1.currencysource.biz.

Looking up at the 2 onlineofficevit.com. parent servers:

Server Response
ns2.onlineofficevit.com [61.156.242.119] 61.156.242.119
ns1.onlineofficevit.com [61.156.242.119] 61.156.242.119

The host of this criminal fraudster is China Unicom Shandong province network on IP address 61.156.242.119
The above China Unicom Shandong province network IP address 61.156.242.119 is also hosting other clear fake money mule/financial fraud/reshipping fraud websites such as 24 Spanish Realty Ltd. (TODAYNIC.COM, INC.), Castellum Group (ALANTRON BLTD.), Diamond (Advertising Agency) (ALANTRON BLTD.), InLogistics Ltd. (ALANTRON BLTD.), Top Box (ALANTRON BLTD.), NF Factory ('bulletproof' blackhat host), (Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com).
***Latest News*** Initial entry 30th. October 2009
***Latest News*** 9th. January 2010
The criminal's domains vitonlineoffice.com and onlineofficevit.com have both been disabled - please notify me of any active domains for this criminal.