Rocking Icons Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
This fraud should not be confused with the any other company of the same or similar name - the website screenshot and the following fraud evidence refer to this fake company alone and no other.
Rocking Icons scam screenshot - 30-Jan-2010
Rocking Icons scam screenshot - 30-Jan-2010

The Rocking Icons scam appears on the face of it to be a pretty standard money laundering mule fraud website, but it isn't - it's the same MO as the Ebook/Devbill 'Rockphish/Asprox' Infobite Software Ltd. (strawberry websites), and the subsequent AlfaCor, United Swiss Trading Group, Swiss Internet Trading, 1st Class Recruitment, Job Specification, Job Instructor and Santarex Toys criminal fraudsters among many others who try to persuade you to set up your own limited company complete with merchant account for the purposes of laundering stolen funds from credit card fraud on the bogus pretext of a fraudulent retail franchise operation of some sort, exactly as before. Lots of information regarding this particular type of fraud can be found here and here. These criminals claim to have been in business "for more than a decade", but their initial website domain, (rockingicons.com), was only registered with ACTIVE REGISTRAR, INC./Active-Domain LLC on 28-Nov-2009 for the usual 'criminal's domain' minimum period of only one year and their whois details are hidden. Their location details are bogus, their site content is stolen from various places as detailed below and their Google internet presence is zero as they use a robots.txt file to block all search engine access - no genuine company would do that. They are not a registered company in their claimed location of Sweden, which demonstrates beyond doubt their fraudulent nature - check for yourself. This is a clear serial fraudster. Thanks to site contacts and MGD for confirmation and information.

Rocking Icons : Evidence of Site Theft and Criminal Fraud

i) The Rocking Icons criminal fraudsters are claiming on their "About Us" page: "Here at Rocking Icons, we've been creating extraordinary web applications for more than a decade", however, their website domain, (rockingicons.com), was only registered with ACTIVE REGISTRAR, INC./Active-Domain LLC on 28-Nov-2009 for the usual 'criminal's domain' minimum period of only one year and their whois details are hidden. - a clear indication of a fraudulent registration.

ii) They claim to be located in Sweden, but a check of the Swedish Company Registry shows that they are not a registered company in Sweden - irrefutable evidence of a fake company.

iii) Stolen site content - their site content has been stolen from various places, for example, their above home page has been stolen from this company, their 'Services' page has been stolen from this company and their "About Us" page has been stolen from the same company. Clear & irrefutable evidence of deception, site theft and fraud.

iv) A Google search for "Rocking Icons" returns absolutely no results, and the reason for that is that they are using a serverside robots.txt file to block all search engine access to their complete site. No genuine company would do that - in itself that defines Rocking Icons as a fraudulent operation.
v) The initial approach received by a site contact in response to a Careerbuilder account:
From: Peter Johns [First Class Recruitment] <vacancies@1stclassrecruitment.org>
Date: Wed, Jan 27, 2010
Subject: Concerning your resume at CarrerBuilder.com
To: xxxxx

Dear xxxxxx,

My name is Peter Johns, I am the Manager of First Class Recruitment, a leading recruiting agency for home based jobs. I email you with regard to the job seeking information you have posted. I have reviewed your resume and you seem to be an appropriate candidate for the position which is currently open within one of the companies we perform our recruiting campaigns for.

Could you please confirm that you are still interested in employment? If you are, please, let me know and I will get back to you with more information on the position.

Regards,
Peter Johns, First Class Recruitment
The above solicitation came from the recruiting arm of the Ebook/Devbill fraudsters, 1st Class Recruitment. On responding to the above email, the following was received:
From: Peter Johns <vacancies@1stclassrecruitment.org>
Date: Thu, Jan 28, 2010
Subject: Re: Concerning your resume at CarrerBuilder.com

Good day!

Thank  you  for the interest to our offer. Please let me give you more
information  about  offered  position. We are looking for candidate to
Assistant     Director     position     for    Rocking    Icons    Inc
(www.rockingicons.com).  Rocking  Icons  Inc  is  a design studio that
provides  customers  design  services.  Most of that is web-designing.
This  company  have a good place in the market of such services. Based
in  Sweden  they  have  customers all over Europe and now they want to
enter to the US market.

Rocking Icons Inc want to create webstore for sales in the US, but for
this  business  they  need a person there to control and maintain this
business. For this needs they are looking for Assistant Director. Main
duty   of  the  Assistant  Director  after  establishing  business  is
controlling   and  maintaining  the  accounts  and  handling  business
correspondence  with  future  forwarding  it to the manager of Rocking
Icons Inc.

Assistant  Director is a home-based part-time position. You can accept
it  with  your  full-time job, because you will need to have 1-2 hours
per  day  for  making  all  duties.  This position is commission only.
You'll get some percents of net profit of the webstore. But by Rocking
Icons's  Inc  calculations this commission will be about $1,500/month,
so about $18,000/year.

So,  I  gave  you  short information about Assistant Director position
that we offer you. If you're still interested please get back with me.
We  will  need your updated till current day resume for the record and
your  full  contact  information (full name, mailing address and phone
numbers).  And  please  feel  free  to  ask everything if you have any
questions.

Waiting for your answer.
Sincerely,
Peter Johns.
and there you have the link to Rocking Icons Inc - they are in fact the same criminals.
How the scam works: These crooks persuade their dupes to set up a company complete with a merchant account on the pretext of running a 'franchise operation'. Amounts of money are stolen by the criminals from victims credit cards by making unauthorised charges for non-existent products supposedly provided by the fake "subsidiary company" that has been set up in the mule's name and the charges are paid into the mules associated merchant account. The mule then refunds 90% of all amounts that are paid into his merchant account back to the criminals via Moneygram or Western Union, keeping 10% for himself. This is a classic money laundering operation and the stolen money will be traceable directly to the mug who has been suckered into setting up the fake company and merchant account in his/her name by these very plausible criminals. The first thing they will know about it is when the police come knocking at their door and their nightmare will begin - they will lose a lot of money and end up facing criminal charges - don't say you haven't been warned.
vi) Fake location details from the website: (Remember that they are not a registered company in Sweden, so they are not going to be genuine and so it proves)

Main Office: Malmskillnadsgatan 53, Stockholm, Sweden
Phone +46 (0)8-442 44 60
Email: info@rockingicons.com

• - A Google search for the address "Malmskillnadsgatan 53, Stockholm, Sweden" returns no hits.
• - A Google Maps search for the address "Malmskillnadsgatan 53, Stockholm, Sweden" also returns no hits - not surprising as a Google street search shows that the odd numbers on Malmskillnadsgatan do not go up to 53, this is the last building on Malmskillnadsgatan as far as I can see which is number 49.
• - A Google search for the telephone number "+46 (0)8-442 44 60" shows that it clearly doesn't belong to these crooks at all, but to this organisation.

All clear and irrefutable evidence of fake details and fraud.
There may be associated mule websites involved in this fraud and also possibly other main website domains. If you know of any other domains or any 'subsidiary company' websites, please let me know about them.
The above evidence clearly demonstrates that the Rocking Icons website is a criminal website set up with intent to deceive and defraud. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
Rocking Icons Ltd Fraudsters - hosting details.
Main Domains, Hosts and  Registrars
Domain

rockingicons.com

 		Registrar

ACTIVE REGISTRAR, INC./Active-Domain LLC (28-nov-2009)
 Host

SoftLayer Technologies Inc./arvixe.com
 IP Address

75.126.53.64

Key:
Active
Suspended/Disabled
Parked
Redirect Error
If you've either received an active website link in a spam, or know of an active domain and it is not listed in the domain tables above, then please let us know by reporting it using the 'Report Active Domain' option in the title bar above.
Domain Whois Data:
Domain Name: rockingicons.com
Registrar:     ACTIVE REGISTRAR, INC.
Status:        ok
Dates:         Created 28-nov-2009   Updated 27-jan-2010  Expires 28-nov-2010
DNS Servers:   NS1.CROC.ARVIXE.COM  NS2.CROC.ARVIXE.COM 

Registration Service Provided By: Active-Domain LLC
Contact:  http://www.active-domain.com

Expiry Date: 28-Nov-2010
Creation Date: 28-Nov-2009

Name servers:
ns1.croc.arvixe.com
ns2.croc.arvixe.com

Registrant Name: Whois Manager
Registrant Company: Whois Proof LLP
Registrant Email Address: hmc4bxv54@whoisproof.com
Registrant Address: PO Box 4120
Registrant City: Portland
Registrant State/Region/Province: OR
Registrant Postal Code: 97208-4120
Registrant Country: US
Registrant Tel No: +1.2024700599
Registrant Fax No: +1.8663666681

Admin Name: Whois Manager
Admin Company: Whois Proof LLP
Admin Email Address: hmc4bxv54@whoisproof.com
Admin Address: PO Box 4120
Admin City: Portland
Admin State/Region/Province: OR
Admin Postal Code: 97208-4120
Admin Country: US
Admin Tel No: +1.2024700599
Admin Fax No: +1.8663666681

Tech Name: Whois Manager
Tech Company: Whois Proof LLP
Tech Email Address: hmc4bxv54@whoisproof.com
Tech Address: PO Box 4120
Tech City: Portland
Tech State/Region/Province: OR
Tech Postal Code: 97208-4120
Tech Country: US
Tech Tel No: +1.2024700599
Tech Fax No: +1.8663666681
DNS Lookup: rockingicons.com A record
Searching for rockingicons.com A record at c.root-servers.net [192.33.4.12]: Got referral to H.GTLD-SERVERS.NET. (zone: com.)
Searching for rockingicons.com A record at H.GTLD-SERVERS.NET. [192.54.112.30]: Got referral to ns2.croc.arvixe.com. (zone: rockingicons.com.)
Searching for rockingicons.com A record at ns2.croc.arvixe.com. [75.126.53.64]: Reports rockingicons.com.
Response:
Domain Type Class TTL Answer
rockingicons.com. A IN 14400 75.126.53.64
rockingicons.com. NS IN 86400 ns2.croc.arvixe.com.
rockingicons.com. NS IN 86400 ns1.croc.arvixe.com.
ns2.croc.arvixe.com. A IN 62088 75.126.53.64

Looking up at the 2 rockingicons.com. parent servers:

Server Response
ns2.croc.arvixe.com [75.126.53.64] 75.126.53.64
ns1.croc.arvixe.com [74.86.92.42] 75.126.53.64

The host for this domain  is SoftLayer Technologies Inc/arvixe.com on IP address 75.126.53.64.
***Latest News*** Initial entry 30th. January 2010