Transfex

TransFex Inc. Fraud

Don't Bear Internet Fraud

TransFex Inc. is just another scam financial website that exists to draw the unwary into the world of money laundering fraud. Text similarities link it to other fraudulent financial websites such as Intertrans Inc., Palmer Inc., FranklinCo Inc. and Columbia Inc. all of which have been shut down. The criminal's website is zombie botnet hosted.

This fraudster should not be confused with any legitimate company of the same or similar name - the above website graphics and the included money laundering job clearly identify the fake website and these fraudsters.

Transfex Inc. : Evidence of Criminal Fraud

i) TransFex Inc. claim on this website page "Todd Stern joined TransFex Inc. in May 2004.", but the criminal's domain transfex.st was only registered with Nic.st on 13-Mar-2008. It is obviously a bogus claim.

ii) Their domain transfex.st is hosted on a zombie botnet - DNS details below. No legitimate website is hosted on a zombie botnet.

iii) Identical website texts link it to other recognised fraudulent financial websites such as Intertrans Inc., Palmer Inc., FranklinCo Inc. and Columbia Inc. all of which have been shut down.

iv) Their supposed website location address: Transfex Inc., 5 East 62nd Street, New York, NY 10065 is in reality the address of the Fifth Avenue Synagogue

v) The criminals send out the following spam:

Are you ready to put corporate layoffs and working to benefit somebody
else behind you?

You will create wealth and financial freedom for yourself working for us.
We have support staff ready now to set you up and guide you every step
of the way! Work as often as you want and see how easy it is to enjoy
the same success that so many others are living! We have several top earners
making over 100K from home doing this simple work!

We Are currently seeking 110 People immediately to Work
From Home Doing Simple Processing Work!

This is what you can expect...
Home Based Work Run From Your Own Computer
No Cold Calls
No startup cost
No Selling To Family or Friends
Automated Marketing System
Training For A Rapid Start
A System That Works 24/7
Profit From Each Sale
The Ability To Leverage Your Efforts And Create Residual Income
Learn From The Best and Pay It Forward

Our home based careers are great for people who want to supplement or
build terrific incomes for themselves working from home, a local office,
or on the Internet.

This job is perfect for....
- Parents with children at younger ages
- Parents who want to be at home for their children after school and during
school breaks
- Full-time career professionals who want to supplement their household incomes
- Retired people who want to supplement their retirement incomes
- People laid off or let go from any of the thousands of companies downsizing
- People living in rural areas, which do not provide the needed career options
- People with careers, which are limiting
- Single parents trying to support their families
- College and graduate school students who need summer jobs
- People wanting interim work while changing careers
- People wanting to pay off bills, which have built up over a time
- People who want to keep themselves busy
- People who have difficult commute times

Requirements:

You must have access to a computer that has an internet connection.

Experience is not needed. Paid training provided.

If you are interested, please fill out application at:
http://www.transfex.st/index-1.php

Best regards,
Mike Hanson

vi) A Google search for "Transfex Inc." turns up exactly zero hits as I write this, even though they claim "02 Jan ‘08 - Our financial year closes with over $200 million in global transfers". I don't think so, especially as their website domain wasn't registered until two months later.

The above evidence clearly demonstrates beyond any doubt that the TransFex website has been set up by fraudsters purely for the purpose of deception and spamvertising an illegal job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

TransFex Fraudsters - current hosting details

Current Main Domains, Hosts and Registrars

Domain

transfex.st

Registrar

Nic.st (13-Mar-2008)

Nameserver Host Network

TheServerDoctor

Botnet Nameserver Host IPs

65.75.191.207

Nameserver Domains

Domain

videopb.com

Registrar

SpiritDomains/IA Registry (05-Feb-2008)

Please notify me of any other current domains used by this criminal.

DNS Data (transfex.st)
How I am searching:

Searching for transfex.st A record at g.root-servers.net [192.112.36.4]: Got referral to NS1.BAHNHOF.NET. (zone: st.)
Searching for transfex.st A record at NS1.BAHNHOF.NET. [195.178.160.2]: Reports transfex.st. Response:

Domain	Type	Class	TTL	Answer
transfex.st.	A	IN	1800	71.192.111.168
transfex.st.	A	IN	1800	76.111.24.146
transfex.st.	A	IN	1800	82.79.128.174
transfex.st.	A	IN	1800	89.137.107.183
transfex.st.	A	IN	1800	220.88.91.61
transfex.st.	NS	IN	86400	ns1.videopb.com.
transfex.st.	NS	IN	86400	ns2.videopb.com.
ns1.videopb.com.	A	IN	98776	65.75.191.207
ns2.videopb.com.	A	IN	98776	20.80.95.10

Looking up at the 2 transfex.st parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.videopb.com [65.75.191.207]	220.88.91.61 71.192.111.168 76.111.24.146 82.79.128.174 89.137.107.183
ns2.videopb.com [20.80.95.10]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the nameserver ns1.videopb.com hosted by TheServerDoctor on IP 65.75.191.207 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT).

Web Page setup 17th. March 2008

***Latest News*** 19th. April 2008
Nic.st have suspended the domain transfex.st and no active domains are known for this fraudster - please let me know if you know of one.

A contact from the company TheServerDoctor has asked me to point out that as far as he is concerned the ARIN data for the IP 65.75.191.207 is incorrect and he is NOT the owner and responsible person. The IP is controlled by CaroNet hosting, (Caro.net), of Charlotte, North Carolina.