Renaissance Capital Advisors Ltd. Fraud

Don't Bear Internet Fraud

This Renaissance Capital Advisors Ltd. scam has identical text formats to several other web based and email based frauds including Trust Company Inc, Finance International, E-Z Transfer, SurRate Inc, Des Group Inc., Business & Professional Consultants Inc., and no doubt many others, in other words it's a standard run-of-the mill, patently transparent money transfer fraud of the type that are turned out by the dozen by the same bunch of criminals using the same hosts and registrars that they regularly use. It's exactly the same fraud as this email based one.

N.B. This fraudulent company should not be confused with any other company bearing a similar name. This fraudulent company is identified by these website graphics and the money laundering mule job it spamvertises.

Renaissance Capital Advisors Ltd. : Evidence of Criminal Fraud

i) Renaissance Capital Advisors Ltd. claims on their website to have been "The company was set up in 2002 in Los Angeles, CA, the USA by three enthusiasts having financial education.", but the criminal's domain renca.biz was only registered with PUBLICDOMAINREGISTRY.COM on December the 9th. 2007.

ii) The only Google hits for "Renaissance Capital Advisors Ltd." are as scammers and fraudsters.

iii) The same website text is used as on all the other fraud sites listed above.

iv) Their 'Privacy Protection' page refers to them as 'Bower Investments' which is just another one of their aliases - if you want to see more of their criminal aliases, do a Google Search on "is firmly committed to protecting the privacy and confidentiality of personal and business information."

v) Of the six 'jobs' advertised on their website, this 'job' of 'Financial Agent' is the only one available and it uses exactly the same text as used by the Finance International scammers and others.:

• FINANCIAL AGENT •

Worldwide!
AVAILABLE

Location: Worldwide
Status: Opened
Employee Type: Part-Time Employee

The major duty of the incumbent is to promptly receive and process stockbrokers' payments to further transfer them applying specified method. Please enquire for detailed work scheme.

Requirements:
• Expert skill in managing payments and transfers between our company and clients.
• Knowledge of basic payment systems.
• Ability to schedule working hours effectively.
• Availability of spare time (3-4 hours per day).
• Advanced user ability to operate computer and to use Internet and e-mail.
• Legal age.
Payment basis: commissions in the amount of 7% from each transaction (monthly payments of the total earnings). The minimum salary is $2300 monthly.

In other words a clear money laundering mule position.

vi) No legitimate financial company would spamvertise for "FINANCIAL AGENT" among the untrained, inexperienced and uncertified general population to illegally receive and transfer payments.

The above evidence clearly demonstrates beyond any doubt that the Renaissance Capital Advisors Ltd. website has been set up by money laundering fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal money laundering activity and spamming - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Renaissance Capital Advisors Ltd. Fraudsters - current hosting details [Updated 31st.. December 2007]

Current Main Domains, Hosts and Registrars

Domain

rcaonline.info

Registrar

Estdomains

Host Network

STARHUBINTERNET-SG

Host IP

203.117.111.102

See table below for the full list of known active & suspended main domains used by this criminal.
Please notify me of any other current domains used by this criminal.

Current Botnet Nameserver Domains and Registrars

Not botnet hosted at present - DNS data below. See table below for the full list of known active & suspended nameserver domains for this criminal.

The Spam Headers

Fresh spam required, full source code please or as an attachment.

The Spam Content

Fresh spam required, full source code please or as an attachment.

The Zombie Botnet

The criminal as not using a zombie botnet at this time. Normal DNS Data below.

DNS Data (renca.biz)

How I am searching:

Searching for renca.biz A record at k.root-servers.net [193.0.14.129]: Got referral to a.gtld.biz. (zone: biz.)
Searching for renca.biz A record at a.gtld.biz. [209.173.53.162]: Got referral to NS9.ZONEEDIT.COM. (zone: renca.biz.)
Searching for renca.biz A record at NS9.ZONEEDIT.COM. [66.240.231.42]: Reports renca.biz. Response:

Domain	Type	Class	TTL	Answer
renca.biz.	A	IN	7200	203.117.111.102
renca.biz.	NS	IN	7200	ns3.zoneedit.com.
renca.biz.	NS	IN	7200	ns9.zoneedit.com.

Looking up at the 2 renca.biz. parent servers:

Server	Response
ns9.zoneedit.com [66.240.231.42]	203.117.111.102
ns3.zoneedit.com [72.51.43.223]	203.117.111.102

Here are all of the known domains that are/have been used for the Finance International fraud:

Domain

renca.biz
rcamail.info
renaissanceca.us
rcaonline.info

Status

Suspended
Mx Only
DNS looped
Suspended

Registrar

PUBLICDOMAINREGISTRY.COM
PUBLICDOMAINREGISTRY.COM
PUBLICDOMAINREGISTRY.COM
Estdomains (16-Jan-2008)

Please notify me of any errors or domains not listed here.

i) The criminal will not respond to your challenge, but will use the notice to prepare a new network - immediate suspension is requested please in accordance with your AUP.

Fraud Blog

Initial entry 31st. December 2007

***Latest News*** 19th. February 2008
New domain notified by site contact - rcaonline.info

DNS Data (rcaonline.info)
How I am searching:

Searching for rcaonline.info A record at l.root-servers.net [199.7.83.42]: Got referral to e9.info.afilias-nst.info. (zone: info.)
Searching for rcaonline.info A record at e9.info.afilias-nst.info. [192.100.59.33]: Got referral to 34157.managedns2.estboxes.com. (zone: rcaonline.info.)
Searching for rcaonline.info A record at 34157.managedns2.estboxes.com. [69.50.183.26]: Reports rcaonline.info. Response:

Domain	Type	Class	TTL	Answer
rcaonline.info.	A	IN	38400	203.117.111.102

Looking up at the 4 rcaonline.info. parent servers:

Server	Response
34157.managedns4.estboxes.com [69.50.183.30]	203.117.111.102
34157.managedns2.estboxes.com [69.50.183.26]	203.117.111.102
34157.managedns3.estboxes.com [69.50.182.22]	203.117.111.102
34157.managedns1.estboxes.com [69.50.182.20]	203.117.111.102

The criminal is still using the same STARHUBINTERNET-SG IP (203.117.111.102) as he was previously.

Later - Information from site contact - domain rcaonline.info suspended - no known active domains.