Range Financial Corporation scam

Range Financial Corporation (Range Finance) Fraud

Don't Bear Internet Fraud

Range Financial Corporation (Range Finance) screenshot (Stolen Website) - 06-Mar-2009

This fraud should not be confused with any other company of the same or similar name - the following fraud evidence defines and refer to this fake company alone and no other. The above website has been stolen from the legitimate company Sentry Financial Corporation - clear evidence of criminal fraud in itself.

Range Financial Corporation (Range Finance) is just another fake financial site used as a vehicle to legitimise a money laundering fraud scam. The only reason it looks so glossy and professional is because the website content has been stolen in its entirety from the website of the genuine financial organisation Sentry Financial Corporation. It's not the only scam website this fraudster has produced using an identical MO. He has previous aliases of Paramount Finance, First Rate Finance, World Finance Group, Zeus Financial Group and others. The initial website fraud domain rangefinance.com was only registered with Bizcn.com on 01-Mar-2009 and the crook has no web presence at all, (not to be confused with genuine US and Adelaide registered holding companies of the same name - the fraudster is trying to ride on the back of them). The website is zombie botnet hosted which irrefutably defines it as a criminal website - no legitimate website is zombie botnet hosted. Reverse IP data on the zombies show it to be a 'Rockphish' operation without doubt and it uses the same criminal registered nameservers as the Zeus Financial Group fraud so it is either a replacement for that fraud or an additional fraud to it. The telephone number and the hosting details are the same as for the Abcat Finance fraudster - they are clearly the same crooks. Why would an Australian company use a Chinese registrar and a Latvian host? They wouldn't, of course.

Evidence of Criminal Fraud:

i) As these criminals have stolen the website in its entirety from the genuine Sentry Financial Corporation, the content has no relevence, but although the crooks have stolen the text from the About Us page which says they have been in business since 1986, the fraudster's domain rangefinance.com was only registered with Bizcn.com on 01-Mar-2009 for a 1 year period. Clear evidence of fraudulent misrepresentation.

ii) The fake website content has quite clearly been stolen from the genuine company Sentry Financial Corporation and modified to suit the criminal's purposes. Clear evidence of fraudulent misrepresentation.

iii) As is usual for these criminals, a Google search shows that they have no internet presence at all despite the claim on their 'About Us' page to have been "incorporated in 1979", (not to be confused with the genuine US and AU holding companies of the same name).

iv) They seem a little confused about who they are, being both Range Financial Corporation and Range Finance Corporation on the same page above, however there is no company of either name with their listed contact address registered in the Australian Business Register, (not to be confused by an AU holding company of the same name at a different Adelaide address).

v) The Spam:

From: "Jack Sheller" <staffmanager@rangefinance.com>
Sent: Tuesday, March 03, 2009 5:41 PM
To: "undisclosed-recipients:"
Subject: Job offer

Range Finance Corporation,
3 Pulteney St, Adelaide,
SA, 5000, Australia.

Hello,
my name is Jack Sheller and I am Range Finance Corporation Pty. Ltd. Staff
manager. We have found and reviewed your CV at careerbuilder.co.uk and
decided to offer this job to you.

Our services

When buying-selling operations via the Internet are concerned, the buyer
and the seller don't know each other and are placed in different corners
of the world. Therefore, it is important both to the buyer and the seller
for their transaction to be made safely. Payment protection means
receiving money, documents, goods (it might be both the seller's and the
buyer's) concerning the transaction by a reliable, experienced, impartial
person - our payment protection agent. The agent will hold all the money
and documents until all the terms of the deal are satisfied and only then
release them to the intended receiver. Please, visit our web-site for more
information. (http://www.rangefinance.com/)

Why we need payment protection agents

Having a payment protection agent in every country we can quickly transfer
funds inside a country without wasting time on the international bank
transfers, and continue our rapid growth rather than overwhelming our own
bank account with inbound and outbound transactions leading to severe hold
times and possible service interruption. It is time that is of significant
importance to our clients.

Career and Benefits

Your main task will be receiving money transactions to any bank account
you would like to use for the purposes of this job; and then forwarding
these transactions to the next party of the payment protection process
according to our instructions. You will benefit from the commissions,
which are 5-7% of each transaction and depend on the quantity of the
completed transactions and the speed of your work. Besides, you will be
paid a basic salary of 1500 GBP per month. For your convenience there will
be no paychecks, your commission will remain in your account after every
successfully completed transaction. The money transfer fee is not included
in your commission, meaning that you will deduct it from the received
amount, not from your commission. Also you receive 5-7% of the transaction
amount. Normally the amounts that we process vary from 2,000 GBP to 10,000
GBP, but can go higher on special occasions.

Job details

As the financial activity in your area is not too high, a payment
protection agent will be processing approximately 1-2 transactions per
week. Each transaction requires approximately 4-5 hours of the agent work.
Our manager always calls the agent beforehand to provide all the
instructions. Therefore, with the due time management, the agent is able
to combine this job with other activities (e.g. primary job or studies).

If you are ready to proceed, please provide your AVAILABLE phone number to
our hiring manager (Fabrice Luscan) at hiring@rangefinance.com

Please do not hesitate to contact us if you need more information.

--
Sincerely yours,
Jack Sheller,
Range Finance Corporation Pty. Ltd.
staffmanager@rangefinance.com
Visit us at http://www.rangefinance.com/

vi) You do not get a clearer definition of the illegal part time money mule function: "Your main task will be receiving money transactions to your personal bank
accounts and forwarding them to the next party of the payment protection process, according to our instructions", i.e. transferring them on via Moneygram or Western Union less a percentage commission - that on its own defines the company without doubt as criminal and bogus and is clear evidence of criminal fraud. It is also an identical spam to the Zeus Financial Group fraudster.

vii) No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas. It will get your bank account and your assets frozen and could well earn you a criminal record - do not be tempted.

viii) Fake 'Contact Us' Details from website:

Range Finance Corporation
3 Pulteney St, Adelaide,
SA, 5000, Australia

Phone: +61-88-1256-653
Fax: +61-88-1256-653

• - A Google search for the address "3 Pulteney St, Adelaide" returns zero results which is extremely unlikely for a large company supposedly established over 20 years.
• - A Google search for the telephone number +61-88-1256-653 shows that it is also being used for the Abcat Finance fraudster - clear evidence of fraud.
• - They are displaying a single phone and fax number - a large financial organisation would not have a single phone and fax number.

The above evidence clearly demonstrates beyond any doubt that the Range Financial Corporation website has been set up very recently by 'Rockphish' money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Main Website Domains

rangefinance.com

Registrar

Bizcn.com, Inc. - 01-Mar-2009

Host Network

S7P-TELIALV/S7P-TELIALV (Telia Latvija)

Host IP

80.233.221.253

Botnet Nameserver Domains

supports-service.com

Registrar

IA Registry/Spiritdomains - 29-Jan-2009

Nameserver Host

Host IP

Active
Suspended/Disabled
Parked

The Zombie Botnet DNS Data (Valid for domain rangefinance.com)
Looking up at the 2 rangefinance.com. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.supports-service.com [87.239.22.94]	123.214.182.67 68.45.12.57 70.234.245.1 71.239.156.182 75.138.113.226
ns2.supports-service.com [125.167.52.118]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the criminal owned nameserver ns1.supports-service.com hosted by Layershift Limited (UK)/WizzVPS
on IP address 87.239.22.94 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT/NSLOOKUP). See The Zombie Botnet 'Host By Proxy' for an explanation of this method of hosting.

Reverse IP checks on the zombies used by this criminal reveal fraud and phishing domains hosted by known 'Rockphish' zombies, so this in undoubtedly a 'Rockphish' operation.

***Latest News*** 6th. Mar 2009
Webpage created

***Latest News*** 2nd. Apr 2009
The criminal has forsaken his botnet and has a new network:
DNS Data (Valid for domain rangefinance.com)
How I am searching:

Searching for rangefinance.com A record at j.root-servers.net [192.58.128.30]: Got referral to H.GTLD-SERVERS.NET. (zone: com.)
Searching for rangefinance.com A record at H.GTLD-SERVERS.NET. [192.54.112.30]: Got referral to ns2.rangefinance.com. (zone: rangefinance.com.)
Searching for rangefinance.com A record at ns2.rangefinance.com. [80.233.221.253]: Reports rangefinance.com. Response:

Domain	Type	Class	TTL	Answer
rangefinance.com.	A	IN	14400	80.233.221.253
rangefinance.com.	NS	IN	14400	ns2.astongroup.org.
rangefinance.com.	NS	IN	14400	ns1.astongroup.org.

Looking up at the 2 rangefinance.com. parent servers:

Server	Response
ns2.rangefinance.com [80.233.221.253]	80.233.221.253
ns1.rangefinance.com [80.233.221.253]	80.233.221.253

The criminal's host is listed as S7P-TELIALV/S7P-TELIALV (Telia Latvija) on IP address 80.233.221.253
These are the same hosting details as for the Abcat Finance fraudster - they are clearly the same crooks.