World Duty Free

World Duty Free Fraud

Don't Bear Internet Fraud

World Duty Free fraud screenshot:

This fraudulent World Duty Free company should not be confused with any other company that may have the same or a similar name. The web graphics and the fraudulent 'job' betray the fake site as documented here.

This World Duty Free Fraud is the replacement fraud for the Duty Free International fraud. It is zombie botnet hosted, (which confirms its criminal status without the rest of the damning evidence below), using the same criminal nameservers as the Duty Free International scam which itself was the replacement for the Marvell Financial Group fraud.The website exists purely to convey a sense of legitimacy to the inevitable money mule job posted under the 'Careers' tab. These criminals are also spamvertising a stolen goods handling job as is becoming more common.

These criminals operate(d) a veritable multitude of sites, e.g. Marvell Financial Group, Eden Financial Group, BestTradeSolutions, Royal Finances & Consulting Group, Progold Investments and Duty Free International Text similarities also link them to Expressdeal.

Evidence of Criminal Fraud:

i) This criminal fraud site is zombie botnet hosted using the same criminal registered nameservers (ns1.mapade.com and ns2.mapade.com) as the Duty Free International criminals which firstly proves its criminal nature beyond doubt and secondly proves that it is the same criminal gang. DNS data below. No legitimate website uses zombie botnet hosting. Clear and irrefutable evidence of criminal fraud.

ii) This bogus World Duty Free company has no internet presence. (Not to be confused with the genuine BAA business of the same name).

iii) The criminal's domains world-duty-free.net, world-duty-free.org, workdatabase.net and workdatabase.org were all only registered with BIZCN.COM, INC./DomainsReg, Inc. on 03-Jul-2008

iv) The 'jobs' (from the website):

Description of Duties

Carrers & Vacancies

1. Payment handling manager

The applicant should meet the following requirements:
- PC user skills
- stable access to Internet
- ability to use and operate e-mail
- responsiveness
- personal banking account (in order to receive and handle payments transactions from our customers)
- 1-2 hours of free time during a day (from Monday to Friday to perform assignments)

Payment:
-10% value of the amount of handled payments
- salary is paid every 10 day since the first order is handled

2. Mail handling manager

The applicant should meet the following requirements:
- PC user skills
- stable access to Internet
- ability to use and operate e-mail
- responsiveness
- availability of actual address for receiving and sending of goods and products to our customers (but not P.O. box)
- 1-2 hours of free time during a day (from Monday to Friday to perform assignments)

Payment:
-8% value of handled mail cost
- salary is paid on a monthly basis

It is self evidently the usual money mule function with the additional reshipping fraud role of fencing stolen goods. See here for information on these criminal activities. Note the illiterate spelling of 'Careers' as 'Carrers'.

v) No legitimate company would employ private individuals working unsupervised and uncontrolled at home as illegal money transfer agents or goods re-shipping clerks. Clear evidence of fraud.

vi) They use multiple domains for the same website.

vii) They've stolen their 'Legal Statement' straight from the Zurich Financial Services website, even including the Zurich Insurance Company name - sloppy.

viii) Their 'Privacy Statement' has been stolen from this HSBC page.

ix) Contact Details from their website:
Contacts

Head Office
Address : 1 Wang Yuen Street, Kowloon Bay, Hong Kong
E-mail : head.dept@duty-free-international.net

USA Office
Address : 3480 Lakemont Blvd., New York, USA
E-mail : usa.dept@duty-free-international.net

Europe Office
Address : Grosse Bockenheimer Strasse 50, Frankfurt, Germany
E-mail : eu.dept@duty-free-international.net

Notice that they haven't even changed their email address from their previous duty-free-international.net fraud alias.

The above evidence proves beyond any doubt that the World Duty Free Fraud website has been set up by serial money laundering/re-shipping fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job and a re-shipping fraud 'job'. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity and spamming - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

DNS Data (world-duty-free.net, world-duty-free.org, workdatabase.net, workdatabase.org)

How I am searching:

Searching for world-duty-free.net A record at d.root-servers.net [128.8.10.90]: Got referral to F.GTLD-SERVERS.net. (zone: net.)
Searching for world-duty-free.net A record at F.GTLD-SERVERS.net. [192.35.51.30]: Got referral to ns2.mapade.com. (zone: world-duty-free.net.)
Searching for world-duty-free.net A record at ns2.mapade.com. [35.72.52.232]: Timed out. Trying again.
Searching for world-duty-free.net A record at ns1.mapade.com. [69.57.168.227]: Reports world-duty-free.net. Response:

Domain	Type	Class	TTL	Answer
world-duty-free.net.	A	IN	1800	85.217.208.58
world-duty-free.net.	A	IN	1800	62.182.74.148
world-duty-free.net.	A	IN	1800	81.181.17.57
world-duty-free.net.	A	IN	1800	82.137.47.165
world-duty-free.net.	A	IN	1800	84.109.128.210
world-duty-free.net.	NS	IN	1800	ns1.mapade.com.
world-duty-free.net.	NS	IN	1800	ns2.mapade.com.
ns1..	A	IN	1800	69.57.168.227
ns2.mapade.com.	A	IN	1800	35.72.52.232

Looking up at the 2 world-duty-free.net. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.mapade.com [69.57.168.227]	62.182.74.148 81.181.17.57 82.137.47.165 84.109.128.210 85.217.208.58
ns2.mapade.com [35.72.52.232]	Timeout

The data shows a standard zombie botnet where the nameserver ns1.mapade.com hosted by FortressITX/pwebtech.com on IP 69.57.168.227 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT).

All Known Website Domains

verymegashare.org (Active - DNS Looped)
world-duty-free.net (Active)
world-duty-free.org (Active)
workdatabase.net (Active)
workdatabase.org (Active)

Nameserver Domains

mapade.com (Active)

Registrar:

Internet Invest, Ltd. dba Imena.ua (26-May-2008)
BIZCN.COM, INC./DomainsReg, Inc. (03-Jul-2008)
BIZCN.COM, INC./DomainsReg, Inc. (03-Jul-2008)
BIZCN.COM, INC./DomainsReg, Inc. (03-Jul-2008)
BIZCN.COM, INC./DomainsReg, Inc. (03-Jul-2008)

SPIRITDOMAINS/IAREGISTRY (20-may-2008)

N.B. - all domains registered as using current botnet nameserver (ns1.mapade.com) are registered by this criminal.

Initial entry created 20th. July 2008