Oranta Group Inc. is just
another of the numerous scam websites that has
been set
up to form a front for a
money laundering job advertisement. (The
identical job was posted by the Calisto
Trading Inc., Reynolds
Investment, & Simple
Investments
fraudsters and others). It's a bit slicker than most
but at
the end of the day its function is to con you into believing that they
are a legitimate company when the evidence clearly demonstrates that
they are crooks. It's an identical scam to Legal Operations Inc. & Secure Operations Inc.
This
fraudster should not be confused with any legitimate company - the
above website graphics and the included money
laundering job clearly identify the fake website and these fraudsters.
Oranta Group Inc. :
Evidence
of Criminal Fraud
i) Oranta Group Inc. claim on
their website "The company was set up in 1990 in New York, the USA by
three enthusiasts having financial education", but the
criminal's domain search-bbb.com
was only
registered
with Public Domain Registry on 10-Sep-2007 and emarket-solutions-mail.cn on 08-Jan-2008 with bizcn.com.
ii)
A Google search shows no internet presence at all for Oranta Group
Inc. They are also not listed at
the UK Companies House or the
UK Financial
Services Authority which they would have to be
to be able to legally trade in the UK - they are undoubtedly a bogus
company.
iii) This
scam is related to the Calisto
Trading Inc. scam among
others & is identical to the Legal Operations Inc. & Secure
Operations Inc. scams - it
even
has the same contact details for the different company: iv)European Contact Details
(copied from their website): EUROPE, United Kingdom (Iceland,
Republic of Ireland)
Street address: 81 holland road
City: london
State: london
Zip: nw105at
Country: United Kingdom
Director: Johnathan Carter
The above address is actually listed in UK Companies House as the
registered address of a company called HONEY'S DESIGN &
CONSTRUCTION LIMITED (Company No. 05416580).
In other
words it's a fake address as undoubtedly are all their others. It's
also the same address used for the Calisto Trading Inc. fraud and
others.
v) The
registrar whois data for the domain search-bbb.com is quite
obviously false: Name: Michelle Fischer Company: n/a Address: n/a n/a n/a City: n/a State: Country: US Zip: 000000 Tel No: 999 999999999 Fax No: Email:
vi) They use
criminal registered nameservers, (ns1.www-yahoo.biz
& ns1.www-news.biz), that on the face of it
appear to be something to do with Yahoo & news.biz, but do not
be fooled - the
domain www-yahoo.biz
& www-news.biz
have
been registered by the criminal with Public Domain Registry, &
Estdomains by the same Michelle Fischer also using
obviously false whois data in an attempt to fraudulently impersonate a
Yahoo network. In fact www-yahoo.biz has
now been suspended.
vii) Here is the obvious money
laundering
position of "CHECKS
PROCESSING MANAGER" posted on their website:
CHECKS PROCESSING MANAGER
The
vacancy is valid for US residents only
Location: USA, statewide Status: Opened Employee Type: Part-Time Employee
Cheques Processing Manager is responsible for receiving and processing
of cheques from participants of deals and further transfer of money in
accordance with the specified method. The detailed operational scheme
is available at request.
Requirements:
Competent management of payments and transfers between the
company and our clients;
Knowledge of the main payment systems;
Working schedule optimization skills;
Commit to be available to work 3-4 hours per day ;
PC, Internet, E-mail advanced skills;
Maturity age.
Benefits of working for our company:
10% commission from each transaction (monthly payments
prorated from the total amount of payments)
Flexible working schedule
Possibility to combine with the main job;
Training courses are always available.
In other
words, just your
average money laundering mule position.
viii) No
legitimate company is going to spamvertise among the untrained,
inexperienced and
uncertified general population
for a "CHECKS PROCESSING MANAGER" acting as a criminal money transfer
agent
Location: USA, state-wide
Opening currently available Yes
Employee Type: Part-Time employee
Job description:
The buyers of our international clients will send postal money orders
and cashiers checks to your home address as the payment for the bought
merchandise.
You can always easily cash postal money order in the nearest post
office or in any other cashing office. Cashiers check should be cashed
in the bank. If the cashier's check you will receive was issued by a
bank that has a branch in your town you should cash the received
cashiers check there. It will substantially shorten the time of
transaction and lower the associated fees. If there is no such branch
of the bank you have to cash the received cashiers check using your own
bank.
Cashiers check and money orders will be delivered to you by
the couriers of such shipping companies as: FedEx, UPS, USPS, DHL. In
every case we will provide you with all the information pertaining to
the given transaction like shipping company, tracking number of the
money order etc. It grants you with the opportunity to trace the check
en route. You have to be at home at the time of the planned arrival to
ensure you receive the mail in the shortest terms. Since you will
receive valuable papers the courier may ask you to present your ID and
sign the paperwork.
At the moment you receive cashiers check or money order the
main stage of the job work starts. You have to cash the received checks
as soon as possible. Please pay particular attention to this rule! You
have to memorize that from the moment you receive money order every
minute counts as the main advantage of our service is the fastest
forwarding of the funds from the buyer to the seller, our international
client, for the sold products. If you slow down the process our client
may cancel the contract with the Oranta Group Inc. and we will
incur serious financial losses. Please remember that you are handling
money, be very responsible and attentive!
According to the contract terms you will be held responsible
in the court of law in case you loose, spoil, spend or hold-up the
funds intended for our clients.
If you have received a postal money order before 12 am you
have to cash it during next 4 hours in the closest Post Office .The
process will not take more than 20 minutes.
If you have received a cashier's check before 12 am you have
to find out during next 4 hours whether there is a branch of the bank
that has issued cashiers check in your town and cash it. If there is no
branch you will have to visit your bank and cash your check using your
own bank account. You have to remember that your main task is complete
the transaction as soon as possible since our client is concerned to
receive his money ASAP.
Keeping the recommendations given above you will save your
time and evidently will not face additional problems.
After you have cashed the cashiers check or money order you
have to transfer the moneys to our client using international Western
Union payment system. Western Union fees along with all other costs,
such as bank fees, transportation costs and so in are paid by us and
are deducted from the sum total.
Your compensation will be also deducted from the received
funds on the commission basis. During first 30 days, that will be your
probationary period your compensation will be 5% from every
successfully handled transfer. After the completion of the probationary
period your salary will be raised to 10 % per successfully handled
transfer.
Our clients value our performance and are ready to pay extra
for shorter transaction terms. If we manage to deliver the merchandise
top the buyer during
10 days, the deal considers to be fulfilled in rapid terms.
You have to remember that time is working against you and you
have to perfectly execute your duties to receive bonuses for the prompt
and competent performance.
Probationary period also imposes restrictions on the social
packet of our corporation. You will be able to receive Oranta Group
Inc. social packet only after you successfully complete the
probationary period.
Social packet includes:
stock options, child-care subsidies, flex-time, business casual attire,
educational assistance and professional development programs.
Detailed information concerning the social packet will be sent
to you after the successful completion of the probationary period
Candidate requirements:
More than 18 years old.
An ability to reply promptly to the e-mails every day.
Oranta Group Inc. signs a legally binding
contract with each employee thus we will need the scan of your ID or
driving license to verify your identity and eliminate fraud risk. We do
not release the collected information to any third party. Please follow
the link below to read our Privacy Policy:
index.php?page=r_16
Every employee receives his or her personal login and password
to gain the access to the personal online activity. The database and
the accounting system
are fully automated thus you will be able to get access to the list of
the active tasks, inform us about the reception of cashiers checks or
money orders and get detailed instructions concerning your functions
during few seconds.
Expedited handlings payments manager in our corporation as
well as all other employees of our corporation are participating in the
best employee of the month program that offers valuable bonuses and
guaranteed promotion. Please look for more information here.
The above
evidence clearly demonstrates beyond any doubt that the Oranta Group Inc. website
has been set up by money laundering
fraudsters purely for
the
purpose of spamvertising an illegal money laundering 'mule' job. If you
are an abuse team that has received an abuse
report regarding these fraudsters, please
consider immediate
termination of their services in view of the absolutely undeniable
evidence of
criminal fraud - please don't delay - these criminals will not
respond to any communication from you, (all their whois data is false),
but will simply take advantage of any attempt
at communication as a delaying tactic to allow them time to carry on
their criminal activity and prepare
their
next network.
Oranta
Group Inc. Fraudsters -
current hosting details [Updated 5th. Feb 2008]
See table below for the full
list of known active & suspended main domains used by
this
criminal.
Please notify me of any other current domains used by this criminal.
Nameserver Domains
and
Registrars
www-yahoo.biz
- Public Domain Registry 10-Sept-2007 (This domain has been
registered by
the
criminals with obvious false/missing whois data in a blatant attempt to
imitate
a Yahoo network). -
Suspended www-news.biz
- Estdomains 14-Jun-2006 (This domain has been registered by
the
criminals with obvious false/missing whois data in an attempt to
imitate a legitimate domain).
The
Spam Headers
Fresh spam required, full source code please or as an attachment. The
Spam Content
Thank you
for being interested in open vacancy. If you decide contact
me, please use the following e-mail address: job@search-bbb.com
Firstly I have to tell
you, that it is not a job where you need to invest your own money to start
working.
One of the main targets
of Oranta Group Inc. corporate strategy is to become one of the biggest companies
on the corporate market of online trade by providing internet users through
universal and flexible payment instrument for products and services which are
available for sale in the internet. The main objective of Oranta Group Inc.
is to provide the most strict security level without complicating the
usability to wide public.
We are happy to see you
on the position of the Independent Agent. You don't need to have any
complicated and particular knowledge, huge amount of time or effort and as is written
above you are not required to make any investments.
Job Requirements:
- you have to be
eighteen (18) years old or older - bank account,
(Business bank preferred) - internet access and a
valid phone number where we can reach you at any time
At this position we want
to see competent and responsible person who will search for the best ways
to fastest and perfect implementation of current task, who can be
permanently available for contact during working hours, and can follow instructions.
For last three months of
the current year is detected the record economic growth in every
department of Oranta Group Inc. It is result of excellent and active work of our
members of the staff. As we can see in statistical reports, 98 of our financial
managers who worked for less than three months are completely satisfied
with work condition and salaries, and they want to pass the further training to
improve skills and advance in their careers. Oranta Group Inc. is trying to
constantly seize the control on the
maximum part of the financial
services market. Now you can make the first steps to your perspective career today!
Every employee who
occupies the Independent Agent position receives a social package which is
available after successful test period. It consists of:
- Stock options - Child-care subsidies - Flex-time - Business casual attire - Educational assistance
and professional development programs
Also our employee can
enjoy such advantages as:
-long term credit up to
8 years -training on the
improvement of professional skill in the international institutes -participation in
corporate bonus programs - Wonderful
opportunities for career growth
If you come up to our
expectations we can open our branch in your city with you at the leading
position in this department. It only depends on you if you want to live your life
with respect and money or not.
The roots of Oranta Group Inc. success are located in flexible
and individual approach to every client
and corporative model of mass standard services. Transactions of our
clients can be safe because of high protection of their funds and we are trying
to provide them the perfect service while completing online transactions.
If you want to try
yourself on this vacancy, please reply to this e-mail and you'll receive an answer
with all necessary instructions.
If you have any
questions mail to job@legal-operations.org
We really hope you'll be
interested in the Oranta Group Inc. team as soon as you can!
Sincerely,
Robert Watkins Oranta Group Inc. Department of Employment
The Zombie Botnet
The criminal as not using a zombie botnet at this time. Normal DNS Data
below. DNS Data
(search-bbb.com, emarket-solutions-mail.cn, oranta-group-mail.cn, oranta-group.cn)
How I am searching:
Searching for search-bbb.com A record at d.root-servers.net
[128.8.10.90]: Got referral to M.GTLD-SERVERS.NET. (zone: com.)
Searching for search-bbb.com A record at M.GTLD-SERVERS.NET.
[192.55.83.30]: Got referral to ns2.www-news.biz. (zone:
search-bbb.com.)
Searching for search-bbb.com A record at ns2.www-news.biz.
[74.53.59.165]: Timed out. Trying again.
Searching for search-bbb.com A record at ns1.www-news.biz.
[77.221.133.181]: Reports search-bbb.com. [took 164 ms]
Response:
Domain
Type
Class
TTL
Answer
search-bbb.com.
A
IN
3600
77.221.133.181
search-bbb.com.
NS
IN
3600
ns1.www-news.biz.
search-bbb.com.
NS
IN
3600
ns1.www-yahoo.biz.
ns1.www-news.biz.
A
IN
30
77.221.133.181
ns1.www-yahoo.biz.
A
IN
30
77.221.133.181
Looking up at the 2 search-bbb.com. parent servers:
Server
Response
ns1.www-news.biz
[77.221.133.181]
77.221.133.181
ns2.www-news.biz
[74.53.59.165]
Timeout
How I am searching:
Searching for emarket-solutions-mail.cn A record at
m.root-servers.net [202.12.27.33]: Got referral to NS.CERNET.NET.
(zone: cn.)
Searching for emarket-solutions-mail.cn A record at NS.CERNET.NET.
[202.112.0.44]: Got referral to ns1.www-news.biz. (zone:
emarket-solutions-mail.cn.)
Searching for emarket-solutions-mail.cn A record at
ns1.www-news.biz. [77.221.133.181]: Reports emarket-solutions-mail.cn.
Response:
Domain
Type
Class
TTL
Answer
emarket-solutions-mail.cn.
A
IN
3600
77.221.133.181
emarket-solutions-mail.cn.
NS
IN
3600
ns1.www-yahoo.biz.
emarket-solutions-mail.cn.
NS
IN
3600
ns1.www-news.biz.
ns1.www-news.biz.
A
IN
30
77.221.133.181
ns1.www-yahoo.biz.
A
IN
30
77.221.133.181
Looking up at the 2 emarket-solutions-mail.cn. parent servers:
Server
Response
ns1.www-yahoo.biz
[77.221.133.181]
77.221.133.181
ns1.www-news.biz
[77.221.133.181]
77.221.133.181
How I am searching:
Searching for oranta-group-mail.cn A record at b.root-servers.net
[192.228.79.201]: Got referral to B.DNS.cn. (zone: cn.)
Searching for oranta-group-mail.cn A record at B.DNS.cn.
[203.119.26.1]: Got referral to ns1.www-yahoo.biz. (zone:
oranta-group-mail.cn.)
Searching for oranta-group-mail.cn A record at ns1.www-yahoo.biz.
[77.221.133.181]: Reports oranta-group-mail.cn. Response:
Domain
Type
Class
TTL
Answer
oranta-group-mail.cn.
A
IN
3600
77.221.133.181
oranta-group-mail.cn.
NS
IN
3600
ns1.www-news.biz.
oranta-group-mail.cn.
NS
IN
3600
ns1.www-yahoo.biz.
ns1.www-news.biz.
A
IN
30
77.221.133.181
ns1.www-yahoo.biz.
A
IN
30
77.221.133.181
Looking up at the 2 oranta-group-mail.cn. parent servers:
Server
Response
ns1.www-yahoo.biz
[77.221.133.181]
77.221.133.181
ns1.www-news.biz
[77.221.133.181]
77.221.133.181
How I am searching:
Searching for oranta-group.cn A record at m.root-servers.net
[202.12.27.33]: Got referral to B.DNS.cn. (zone: cn.)
Searching for oranta-group.cn A record at B.DNS.cn. [203.119.26.1]:
Got referral to ns1.www-news.biz. (zone: oranta-group.cn.)
Searching for oranta-group.cn A record at ns1.www-news.biz.
[77.221.133.181]: Reports oranta-group.cn. Response:
Domain
Type
Class
TTL
Answer
oranta-group.cn.
A
IN
3600
77.221.133.181
oranta-group.cn.
NS
IN
3600
ns1.www-yahoo.biz.
oranta-group.cn.
NS
IN
3600
ns1.www-news.biz.
ns1.www-news.biz.
A
IN
30
77.221.133.181
ns1.www-yahoo.biz.
A
IN
30
77.221.133.181
Looking up at the 2 oranta-group.cn. parent servers:
Server
Response
ns1.www-yahoo.biz
[77.221.133.181]
77.221.133.181
ns1.www-news.biz
[77.221.133.181]
77.221.133.181
The DNS data shows nameservers using bogus domains registered
by the criminal, www-yahoo.biz,
(Public Domain Registry -
10-Sept-2007), and www-news.biz,
(Estdomains - 14-Jun-2006), using false whois data in an attempt to
impersonate a Yahoo domain and a news domain. The site host
IP 77.221.133.181
is
owned by a Russian host - datapoint.ru/DATAPOINT-NET2 and has a RDNS
entry of 77.221.133.181.addr.datapoint.ru
so it may well be a criminally owned end user machine or zombie. The
nameserver
host [77.221.133.181]
is the same Russian host - datapoint.ru/DATAPOINT-NET2 Here are
all of the known domains that are/have been used for the
fraud:
Please notify me of any errors or domains not listed here.
i) The criminal will not respond to your
challenge, but will use the
notice to prepare a new network -
immediate suspension is requested please, if allowed for by your AUP.If
you have been a victim of this or any other of these fraudsters
& would like to tell
your
story on these pages as a warning & to help others, please
contact me.