SAN MARCA scam

SAN MARCA Fraud

Don't Bear Internet Fraud

SAN MARCA screenshot (17-Aug-2009)

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the following evidence clearly identify the fake website and these criminal fraudsters. N.B. The above website content has been stolen from here.

SAN MARCA is just the Poland Real Estate scammers branching out into the fashion industry.. The giveaway is the initial website domain that these criminals are using - polandreal-estate.com.cn, which was only registered with Web Commerce Communications Limited, (webnic.cc) on 15-Jul-2009 for the usual 'criminals domain' minimum period of only one year and is hosted on the usual unresponsive masterhost.ru who reject all requests to take action against their criminal clients such as these. The crook's website has apparently been stolen from a Russian fashion company of the same name and modified to include a purchase manager fraud fake job of "Goods Shipment Agent" which is being spamvertised in the usual way.

The whole purpose of this fraud site is to lend an air of legitimacy to a 'Purchase Manager' job that consists of buying goods on a fake credit card issued in the 'Agent's' name and sending them off to these crooks in Russia or the Ukraine or wherever. See the spam for details - the stolen website consists solely of the registration portal. Don't be fooled - the 'agent' will be responsible for settling the card debt - whatever it costs to buy the goods and send them abroad will be lost. Any money the crooks deposit on the card will be stolen funds and stands a high chance of being recovered leaving the dupe out of pocket and facing some awkward questions.

SAN MARCA : Evidence of Criminal Fraud

i) The above SAN MARCA fraud website content has been stolen from a Russian fashion company of the same name and modified to include a reshipping fraud fake job of "Goods Shipment Agent" ('Purchase Manager' role), which is being spamvertised in the usual way.

ii) The criminal's initial domain polandreal-estate.com.cn is clearly one left over from his previous Poland Real Estate scam and was only registered with Web Commerce Communications Limited, (webnic.cc) on 15-Jul-2009 for the usual 'criminals domain' minimum period of only one year A clear indication of a fraudulent registration.

iii) The crooks have simply stolen the website in its entirety from this Russian fashion company and not changed anything apart from adding the usual crooks website registration portal for unsuspecting dupes to hand over all of their personal details.

iv) They are advertising the following job of “GOODS SHIPMENT AGENT” which has no website details at all - it simply leads to a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal operation which will cost you a lot of money at the very least.

v) The Spam:

Hello,

We studied your resume and we think that you are the right
candidate for this position. We have the following
position “GOODS SHIPMENT AGENT”

The “GOODS SHIPMENT AGENT” has the following duties:

1) Our company will issue a bank card on agent’s name.
This card will be delivered to his/her address provided during registration at our website.
The goods shipment agent should make purchases with this card. Mainly purchased goods are clothes.
Each time our company will notify the agent what item to buy.
Our company will also provide an exact address where this purchase has to be made.

2) The goods shipment agent has to forward a good to the address that we provide.
YOU WON’T BEAR ANY EXPENSES, OUR COMPANY PAYS FOR EVERYTHING BEFOREHAND

Your salary in the amount of $2500 will be effected into your account on the 25th of each month. The payment will be
transferred to your account or through any payment system you prefer.

If this position is of interest to you, than you should do the following:
1) Access the website of our company by following this link click here
2) Click on the tab GOODS SHIPMENT AGENT registration.
(Provide your real data during registration)
3) After registration you will need to download a Contract. Please download the Contract and fill it out

We will contact you immediately upon receipt of your signed Contract. You can get started as soon as our legal department
fulfills identification.

About the company: The main idea of SAN MARCA L.T.D trade mark is boldness of
self-expression and individual approach to every client. Everyone is willing to emphasize his/her
character today. Creative team of company designers will
be on your side to help you to show yourself to the world in the most favorable way.

We are young, challenging professionals pushing forward to achieve recognition of our clients.
notions “fashion” and “style” mean more than just simple things to us. Our fashion sets are always the
most advanced and highly individual. You will always be the life of the party during any event!

You can find more information on our website

The link to the crook's website is the usual Tinyurl link currently favoured by these crooks. In this case http://tinyurl.com/ng4gke

vi) You do not get a clearer description of the fraudulent 'Purchase Manager' function than that. At the very least it will cost you a lot of money when you are liable for the costs of everything you are asked to buy. You may also have to answer quesions about stolen funds. Do not be tempted.

vii) No legitimate company would advertise for private citizens to operate as purchase agents sending goods abroad in this way using a card in the 'agents' name. To do so clearly defines the fake SAN MARCA company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Do not be fooled.

The above evidence clearly demonstrates beyond any doubt that the SAN MARCA website has been stolen and has set up by criminal fraudsters purely for the purpose of spamvertising a fraud job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

SAN MARCA Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

polandreal-estate.com.cn

Registrar

Web Commerce Communications Limited (10-Jul-2009)

Host Network

Masterhost.ru

Host IP

83.222.23.126/83.222.23.176

Key:
Active
Suspended or Inactive
Parked

Please notify me of any other current domains used by this criminal.

DNS Lookup: polandreal-estate.com.cn A record
Searching for polandreal-estate.com.cn A record at d.root-servers.net [128.8.10.90]: Got referral to NS.CERNET.NET. (zone: cn.)
Searching for polandreal-estate.com.cn A record at NS.CERNET.NET. [202.112.0.44]: Got referral to ns.masterhost.ru. (zone: polandreal-estate.com.cn.)
Searching for polandreal-estate.com.cn A record at ns.masterhost.ru. [217.16.20.30]: Reports polandreal-estate.com.cn.
Response:

Domain	Type	Class	TTL	Answer
polandreal-estate.com.cn.	A	IN	900	83.222.23.176
polandreal-estate.com.cn.	A	IN	900	83.222.23.126
polandreal-estate.com.cn.	NS	IN	900	ns1.masterhost.ru.
polandreal-estate.com.cn.	NS	IN	900	ns2.masterhost.ru.
polandreal-estate.com.cn.	NS	IN	900	ns.masterhost.ru.
ns1.masterhost.ru.	A	IN	900	217.16.16.30
ns2.masterhost.ru.	A	IN	900	217.16.22.30
ns.masterhost.ru.	A	IN	900	217.16.20.30

Looking up at the 3 polandreal-estate.com.cn. parent servers:

Server	Response
ns1.masterhost.ru [217.16.16.30]	83.222.23.126 83.222.23.176
ns2.masterhost.ru [217.16.22.30]	83.222.23.126 83.222.23.176
ns.masterhost.ru [217.16.20.30]	83.222.23.126 83.222.23.176

The host of this criminal fraudster is Masterhost.ru on IP addresses 83.222.23.126 and 83.222.23.176. Unfortunately, Masterhost.ru reject all requests to suspend the hosting of their criminal clients. These are the same hosting details as for the Poland Real Estate scammer and others.

***Latest News*** Initial entry 17th. Aug 2009