Poland Real Estate scam

Poland Real Estate Fraud

Don't Bear Internet Fraud

Poland Real Estate screenshot (08-Jun-2009)

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the following evidence clearly identify the fake website and these criminal fraudsters.

Poland Real Estate This is just a standard scam website that has been set up to form a front for a money laundering job spamming campaign. The above website content has been stolen from a company called Euroconsulting which is in itself flagged as an attack/malware site by Firefox and Google. Their five website domains have only been registered very recently for the usual 'criminal's domain' minimum one year period and they are not displaying any location/contact details. They are using the same host and IP address as the Job at Home criminal fraudsters. The whole purpose of this fraud site is to advertise a clear illegal part-time, work at home money mule position that will lose you a lot of money, get your bank account closed, your assets frozen and could earn you a criminal record. The fact that this scam is interchangeable with the Poland Job Office and Job at Home scammers can be seen by the fact that there is this version of the Poland Job Office site with the name "Poland Real Estate" in the template.

Poland Real Estate : Evidence of Criminal Fraud

i) The above Poland Real Estate website content has been stolen from a company called Euroconsulting which is in itself flagged as an attack/malware site by Firefox and Google, although I cannot currently see any obvious exploit in the page source code - take care, though.

ii) The criminal's five domains were all registered with Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com on the 28-May-2009 and all for the 'criminal's domain' minimum period of only one year. A clear indication of fraudulent registrations.

iii) A Google search shows absolutely no internet presence at all for this particular Poland Real Estate, (apart from their own fake website, of course). Not to be confused with all the other companies of the same or similar name - it is a pretty generic name.

iv) They do not appear to have any location or contact details on their website - just the form where you register for the illegal fake job.

v) They are advertising the following job of "Financial Manager" which leads to a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal money mule operation which will get your bank account and your assets frozen and could earn you a visit from the police. The job:

At the moment the position of Financial Manager is open.

      The position of the "Financial Manager" will require from the candidate a half-day activity. The work will consist in transferring money among our clients.

      Job description: Due to local Polish laws we are limited in receiving money from our US clients. However US clients are a big part of our consulting business. We do not have the branch of our company in the USA currently, so we need a financial manager who lives in United States and have a valid bank account.

      Our US clients will be sending checks with payments for our services directly to our Financial Manager address and under his/her name. The job of financial manager consists of cashing the checks and transferring funds to our company or other our clients.

      In average there will be 3-5 checks a week, each check for amount of $2.500.00-3.000.00.

The ideal candidate is :US citizen or permanent resident.

Basic skills in Internet and PC using is required.

The candidate should be responsible, honest, and punctual.

Compensation: fixed salary of $1.500.00-2.500.00 in the end of every month plus 5-10% as a fee from every check cashed. Virtually the compensation could reach up to $12.000.00 a month.

Details: The clients pay for already received services. You take your percentage daily at the time of cashing the checks. We NEVER ASK you for your bank account details. You can use your existing bank account or open a new one especially for this job.

We pay for money transferring. You do not need any money to start this job. You will NEVER be asked to buy any products or do sales. Our transfers never exceed 5000 USD. Reports are not included into IRS. Don’t worry, you wont have to pay taxes off these sums of money.

You do not break any US laws. You will be provided with detailed instructions and training if needed. No experience required.

vi) You do not get a clearer description of the ILLEGAL money mule function than that - it will get your bank account closed and your assets frozen, lose you a lot of money and earn you a visit from the police. Do not be tempted.

vii) No legitimate company would advertise for private citizens to operate as unlicensed and illegal money transfer agents. To do so clearly defines the fake Poland Real Estate company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Clear evidence of criminal fraud.

viii) If you sign up with these crooks you will eventually get your first bogus check from them, preceded by the following email:

From: "sales@polandre.net" <sales@polandre.net>
Date: Jul 17, 2009
Subject: The First Check for you

Hello,

Thank you for the collaboration with us. You have applied for a
part-time job and registered at our web site as a financial agent. We
would like to inform you that the first check was sent to your
address, which was indicated during registration. You will get it
within one to three days. For fast cashing, you can make use of one of
the nearest to you "cashing offices" (although they charge for fast
cashing, the fee will not exceed more than 3 of the check amount;
please pay it from our sum of money.)Than you will take 5 (percent)
from the cashed sum of money as your commission fee. And the rest you
should wire to us by Western Union.

OUR COMPANY SUPPORT LINE NUMBER IS (917)-628-2261.

WE WOULD LIKE TO REMIND YOU THAT IN CASE YOU MANAGE TO CASH THE CHECK
WITHIN 1-3 DAYS FROM THE MOMENT YOU GET IT YOUR COMMISSION WILL BE
HIGHER. YOUR SHARE WILL BE 10 PERCENT OF THE CHECK AMOUNT. YOU MAY
TAKE 10 OF THE CHECK AMOUNT IF YOU TRANSFER MONEY WITHIN THIS TIME. IF
CHECK CASHING TIME EXCEEDS THIS TIME PERIOD YOU WILL GET STANDARD 5
COMMISSION OF THE CHECK AMOUNT.

ALL COSTS IN REGARD OF MONEY TRANSFER BY WESTERN UNION ARE DEDUCTED
FROM OUR SUM OF MONEY.You do not have to pay for anything.

Information for transferring money by Western Union:

1)First Name ** GULNORA

2)Last Name **    ORIFJONOVA

3)City        ** Dushanbe

4)Country    **   Tajikistan

Please use "money in minutes" service if available

After you have transferred money by Western Union you will be given
the MTCN (Money Control Transfer Number). It consists of 10 digits.

After you make the Transfer please email us the same day
the following data:

PLEASE, SPECIFY THE FOLLOWING DATA COMPLETELY
1) Your address (as you filled in the Western Union form):...........
2) Your full name (as you filled in the Western Union form):..........
3) Amount of the transfer:...............
4) Money Transfer Control Number [MTCN]:..........

After we get money and are certain of your efficiency, the number of
checks for cashing will be increased and you may be getting them on a
daily basis. We appreciate the quality of our partnership and hope for
mutual cooperation for a long time.

Please you are kindly requested to email us back in regard of this
message   that you have read it and understood.

Best wishes
Manager
Andrew Hakes

The above evidence clearly demonstrates beyond any doubt that the Poland Real Estate website has been set up by money laundering criminal fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Poland Real Estate Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

presiteonline.info
presitedirect.net
presite.us
preofficialsite.org
presite.biz
jobathomeoffice.biz
poland-estate.com.cn
real-poland.com.cn
estate-real.com.cn
*estate-poland.com.cn
polandre.net

Registrar

Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com (28-May-2009)
Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com (28-May-2009)
Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com (28-May-2009)
Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com (28-May-2009)
Directi Internet Solutions Pvt. Ltd./PublicDomainRegistry.com (28-May-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER (14-May-2009)
IP Mirror Pte Ltd. (24-Jun-2009)
IP Mirror Pte Ltd. (01-Jul-2009)
Web Commerce Communications Limited (10-Jul-2009)
IP Mirror Pte Ltd. (25-Jun-2009)
ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (21-jun-2009)

Host Network

DATAPOINT-NET2 (Infobox.ru)
DATAPOINT-NET2 (Infobox.ru)
DATAPOINT-NET2 (Infobox.ru)
DATAPOINT-NET2 (Infobox.ru)
DATAPOINT-NET2 (Infobox.ru)
INSOLVERTC (In-Solve/1Gb.ru)
Masterhost.ru
Masterhost.ru
Masterhost.ru
Masterhost.ru
INSOLVERTC

Host IP

77.221.129.178
77.221.129.178
77.221.129.178
77.221.129.178
77.221.129.178
81.177.24.92
83.222.23.126/83.222.23.176
83.222.23.126/83.222.23.176
83.222.23.126/83.222.23.176
83.222.23.126/83.222.23.176
81.177.24.92

Key:
Active
Suspended or Inactive
Parked

* - Uses Poland Job Office fraud website template.

Please notify me of any other current domains used by this criminal.

N.B. The first four domains originally redirected to the fifth, (http://www.presite.biz/).

Network Data (presite.biz)
How I am searching:

Searching for presite.biz A record at l.root-servers.net [199.7.83.42]: Got referral to e.gtld.biz. (zone: biz.)
Searching for presite.biz A record at e.gtld.biz. [209.173.58.65]: Got referral to NS1.HOST-INVEST.RU. (zone: presite.biz.)
Searching for presite.biz A record at NS1.HOST-INVEST.RU. [77.221.129.178]: Reports presite.biz. Response:

Domain	Type	Class	TTL	Answer
presite.biz.	A	IN	3600	77.221.129.178
presite.biz.	NS	IN	3600	ns1.host-invest.ru.
presite.biz.	NS	IN	3600	ns2.host-invest.ru.
ns1.host-invest.ru.	A	IN	3600	77.221.129.178
ns2.host-invest.ru.	A	IN	3600	77.221.138.146

Looking up at the 2 presite.biz. parent servers:

Server	Response
ns2.host-invest.ru [77.221.138.146]	77.221.129.178
ns1.host-invest.ru [77.221.129.178]	77.221.129.178

The host of this criminal fraudster is DATAPOINT-NET2 (Infobox.ru) on IP address 77.221.129.178

***Latest News*** Initial entry 8th. Jun 2009

***Latest News*** 11th. Jun 2009

New domain notified by site contact - jobathomeoffice.biz registered with ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER (14-May-2009) and hosted on the following network:
Network Data (jobathomeoffice.biz)
How I am searching:

Searching for jobathomeoffice.biz A record at a.root-servers.net [198.41.0.4]: Got referral to C.GTLD.biz. (zone: biz.)
Searching for jobathomeoffice.biz A record at C.GTLD.biz. [209.173.60.65]: Got referral to NS2.1GB.RU. (zone: jobathomeoffice.biz.)
Searching for jobathomeoffice.biz A record at NS2.1GB.RU. [195.161.112.91]: Reports jobathomeoffice.biz. Response:

Domain	Type	Class	TTL	Answer
jobathomeoffice.biz.	A	IN	3600	81.177.24.92

Looking up at the 2 jobathomeoffice.biz. parent servers:

Server	Response
ns2.1gb.ru [195.161.112.91]	81.177.24.92
ns1.1gb.ru [81.176.69.150]	81.177.24.92

The host of this criminal fraudster is INSOLVERTC (In-Solve/1Gb.ru) on IP address 81.177.24.92

***Latest News*** 13th. Jun 2009
DirectI have suspended all of their domains - no response from ANO REGIONAL NETWORK INFORMATION CENTER DBA RU-CENTER, but as domain jobathomeoffice.biz is still redirecting to the dead domain presite.biz it is academic, although it needs watching. Please notify me of any active domains for this criminal.

***Latest News*** 27th. Jun 2009
News from site contact - new domain poland-estate.com.cn registered with IP Mirror Pte Ltd. and hosted on the following network:

DNS Lookup: estate-real.com.cn A record
Searching for estate-real.com.cn A record at a.root-servers.net [198.41.0.4]: Got referral to E.DNS.cn. (zone: cn.)
Searching for estate-real.com.cn A record at E.DNS.cn. [203.119.29.1]: Got referral to ns2.masterhost.ru. (zone: estate-real.com.cn.)
Searching for estate-real.com.cn A record at ns2.masterhost.ru. [217.16.22.30]: Reports estate-real.com.cn.
Response:

Domain	Type	Class	TTL	Answer
estate-real.com.cn.	A	IN	900	83.222.23.126
estate-real.com.cn.	A	IN	900	83.222.23.176
estate-real.com.cn.	NS	IN	900	ns1.masterhost.ru.
estate-real.com.cn.	NS	IN	900	ns2.masterhost.ru.
estate-real.com.cn.	NS	IN	900	ns.masterhost.ru.
ns1.masterhost.ru.	A	IN	900	217.16.16.30
ns2.masterhost.ru.	A	IN	900	217.16.22.30
ns.masterhost.ru.	A	IN	900	217.16.20.30

Looking up at the 3 estate-real.com.cn. parent servers:

Server	Response
ns1.masterhost.ru [217.16.16.30]	83.222.23.126 83.222.23.176
ns2.masterhost.ru [217.16.22.30]	83.222.23.126 83.222.23.176
ns.masterhost.ru [217.16.20.30]	83.222.23.126 83.222.23.176

The host of this criminal fraudster is Masterhost.ru on IP address 83.222.23.176 and 83.222.23.126

***Latest News*** 27th. Jun 2009
New fraud domain from site contact - real-poland.com.cn registered with IP Mirror Pte Ltd. (01-Jul-2009) and hosted on the above Masterhost.ru network;

***Latest News*** 10th. Jul 2009

The domains real-poland.com.cn and poland-estate.com.cn have been suspended by the registrar - please notify me of any active domains for this criminal.

***Latest News*** 16th. Jul 2009
New domain notified by site contact - estate-real.com.cn registered with Web Commerce Communications Limited (10-Jul-2009) and hosted on the above Masterhost.ru network.

Later - News from Site contact - new domain estate-poland.com.cn used for a modified version of this Poland Job Office scam, but with the name Poland Real Estate in the template, (but still Poland Job Office in the page footer!). Registered with IP Mirror Pte Ltd. (25-Jun-2009) and hosted on the same network:
DNS Lookup: estate-poland.com.cn A record
Searching for estate-poland.com.cn A record at i.root-servers.net [192.36.148.17]: Got referral to NS.CERNET.NET. (zone: cn.)
Searching for estate-poland.com.cn A record at NS.CERNET.NET. [202.112.0.44]: Got referral to ns.masterhost.ru. (zone: estate-poland.com.cn.)
Searching for estate-poland.com.cn A record at ns.masterhost.ru. [217.16.20.30]: Reports estate-poland.com.cn.
Response:

Domain	Type	Class	TTL	Answer
estate-poland.com.cn.	A	IN	900	83.222.23.176
estate-poland.com.cn.	A	IN	900	83.222.23.126
estate-poland.com.cn.	NS	IN	900	ns1.masterhost.ru.
estate-poland.com.cn.	NS	IN	900	ns2.masterhost.ru.
estate-poland.com.cn.	NS	IN	900	ns.masterhost.ru.
ns1.masterhost.ru.	A	IN	900	217.16.16.30
ns2.masterhost.ru.	A	IN	900	217.16.22.30
ns.masterhost.ru.	A	IN	900	217.16.20.30

Looking up at the 3 estate-poland.com.cn. parent servers:

Server	Response
ns2.masterhost.ru [217.16.22.30]	83.222.23.126 83.222.23.176
ns1.masterhost.ru [217.16.16.30]	83.222.23.126 83.222.23.176
ns.masterhost.ru [217.16.20.30]	83.222.23.126 83.222.23.176

The host of this fraudster's domain is Masterhost.ru on IP addresses 83.222.23.126 and 83.222.23.176

***Latest News*** 17th. Jul 2009
New domain notified by site contact - polandre.net registered with the unresponsive registrar ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (21-jun-2009) and hosted on the following network:
DNS Lookup: polandre.net A record
Searching for polandre.net A record at b.root-servers.net [192.228.79.201]: Got referral to F.GTLD-SERVERS.net. (zone: net.)
Searching for polandre.net A record at F.GTLD-SERVERS.net. [192.35.51.30]: Got referral to ns2.1gb.ru. (zone: polandre.net.)
Searching for polandre.net A record at ns2.1gb.ru. [195.161.112.91]: Reports polandre.net.
Response:

Domain	Type	Class	TTL	Answer
polandre.net.	A	IN	3600	81.177.24.92

Looking up at the 2 polandre.net. parent servers:

Server	Response
ns2.1gb.ru [195.161.112.91]	81.177.24.92
ns1.1gb.ru [81.176.69.150]	81.177.24.92

The host of this criminal fraudster is INSOLVERTC (In-Solve/1Gb.ru hosting services provider)

***Latest News*** 20th. Jul 2009
Masterhost.ru refuse to accept abuse complaints unless they are submitted to them in Russian, but as they also refuse to take any action without a court order it is academic. It is a sad and frustrating situation.