Zexchange

Zexchange Fraud

Don't Bear Internet Fraud

This criminal has stolen the website of the genuine? Zarco Exchange. The main difference between the sites is that on the fraud home page, (screenshot below), there is a click-box entitled 'Registration Executive Manager' where the prospective mule is intended to register and give all of his personal details to the criminal as part of the money laundering mule recruitment process which does not exist on the genuine site. Do not be fooled and do not be tempted.

Zexchange scam screenshot (23-Jan-2010)

Zexchange (previously the stolen identity of Zarco Exchange), is just another clearly fraudulent money mule recruiting spammer, (sample spam below), and scammer using a stolen website and identity. The spam is identical to the spam sent out by other scammers such as OnlineOfficeSource, OnlineCompanySite Inc and CurrencySource (Stolen Identity & Site) scammers as is the MO of stealing an entire site and company identity - these crooks have stolen the website and the identity of the genuine? Zarco Exchange company. Their domain zarcoexchange.org was only registered with DomainContext, Inc. (R1744-LROR) just a few days ago on 20-Jan-2010 for the usual 'criminal's domain' minimum period of only one year as were all their others.

The whole purpose of this fraud site is to lend an air of legitimacy to a 'Money Mule' job that consists of accepting stolen funds to your home address, and transferring a balance back to these crooks in Russia/the Ukraine via Western Union or Moneygram. It will get your bank account and your assets frozen, lose you a lot of money and earn you a criminal record - don't be tempted.

Zexchange : Evidence of Criminal Fraud

i) The above Zexchange fraud website content has been stolen from the genuine Zarco Exchange company and modified to include a registration click-box for a money laundering mule role which is being spamvertised in the usual way. Clear evidence of site theft and fraud.

ii) As the criminal's website is stolen in its entirety from the genuine Zarco Exchange company, any claims in it are irrelevant, but the criminal's domain zarcoexchange.org was only registered with DomainContext, Inc. (R1744-LROR) just a few days ago on 20-Jan-2010 for the usual 'criminal's domain' minimum period of only one year as were all his other domains - clear evidence of a criminal fraud registration.

iii) They are spamvertising the job of “Executive Manager” which has no website details at all - just a registration form for you to record your personal details - don't do it as it is simply a doorway to enrolling you in an illegal operation which at the very least will cost you a lot of money. If you read the copyright notice in the box on the registration form, you will see it currently refers to 'OnlineCompanySite Inc', (their previous alias) - clear evidence of serial fraud.

iv) No legitimate company would advertise for private citizens to operate as part-time, work from home "Financial Managers". To do so clearly defines the fake Zexchange company as both criminal and fraudulent. There is also a 'phishing' for identity theft aspect due to the nature of identity proof usually requested upon registration. Do not be fooled.

v) Stolen & Fake contact details from their website:

Contact
Zexchange Company Private Limited
32-A Lawrence road, Lahore PAKISTAN

Phone: +1(315)6424407
Fax: (716)3041626
Email: contract@zarcoexchange.org

• - The above location details are simply the location details of the genuine? Zarco Exchange company whose website they have stolen - clear evidence of fraud.
• - The telephone numbers are clearly not the genuine? Zarco Exchange numbers and not even Pakistan numbers, (refer to the genuine website contact page for genuine Pakistan numbers. These are clearly US numbers.
• - A Google search for the telephone number +1(315)6424407 returns no hits for these crooks. A reverse whois check shows it is a Phila, New York number.
• - A Google search for the Fax. number (716)3041626 returns no hits for these crooks. A reverse whois check shows it is a Niagara Falls, NY number - they must have a big office.

vi) The Spam:

From: "xxxxxx_emmons@yahoo.com <xxxxxx_emmons@yahoo.com>"
Sent: Sat, January 23, 2010 4:40:12 AM
Subject: Reply on CB Resume xxxxxxxx Suggests that You Review This Opportunity at RE/MAX International, Inc.

We found your resume on the CareerBuilder .. Therefore we'd like to offer you a job of an 'Executive Manager'. Our HR department studied your resume and length of service and highly recommends you for this work in our organization. The given vacancy consists of the following tasks:
- timely filing of reports on the carried out work
- record keeping of clients in the USA.
- clients business partners information support.
- execution fulfillment of financial transactions within the USA .
You will receive more detailed instructions during an interview over the phone.
Person specification :
- Age: starting from 25
- Citizenship: US
- Time: must have from 3 to 5 hours of free time a day for carrying out his/her (((duties.
salary for this vacancy makes up to 5000USD per month. The payment will be carried out to your bank account every month. There are many candidates willing to take up this offer, therefore we�re kindly asking you not to delay with your decision about this vacancy.
If this vacancy is interesting to you, then please follow these steps:
1) Register at our website. To do so go to click here. [the shortened link http://snipurl.com/u60oe currently links to http://zarcoexchange.org/]
After doing so click on registration of 'Executive Manager'. Please fill out every field correctly, since data will be checked by our security department.
2) Pass an interview over the phone.
3) Sign a contract with our organization.
We would like to thank you beforehand and we're looking forward to a long-term cooperation.

The above is the usual vague and meaningless description of the offered role which is commonplace now as the crooks try to evade detection, but make no mistake, the clearly fake nature of the stolen website guarantees that it is the illegal 'Money Laundering Mule' function of accepting funds to your personal bank account and transferring a balance back to these criminals in Russia or the Ukraine. The transferred money eventually comes back as stolen and is recovered by the bank, leaving you out of pocket by the amount you have tranferred and facing some awkward questions about why you are involved in criminal fraud. Do not be tempted.

If you reply back to the above spam, you are sent this contract:

CONTRACT # XR-3422

Financial Manager

Zarco Exchange
32-A Lawrence road,
Lahore PAKISTAN
7133668071

Zarco Exchange Inc hereinafter referred to as Company, in the name of director general
Anthony Miller, acting on the basis of company foundation charter of December, 12, 2004, on one
side, and

Name (first, second, last)

E-mail

Street address

Country

State

City

Zip (postal code)

Daytime telephone number (with country code)

Cell phone number

Date of birth (mm / dd / yyyy)

further referred to as MANAGER, acting on his own, on the other side, have concluded the
present agreement on the following:

1. A SUBJECT OF THE CONTRACT

1.1. The Company provides the Manager with an exclusive right on performance of managerial functions
on marketing and an opportunity of delivering the Company services on the territory of the USA,
hereinafter referred to as Territory.

2. OBLIGATIONS OF THE MANAGER

2.1. According to a subject of the present Contract the Manager is obliged:

- To promote Company services with use of advertising and promotional materials provided by the Company,
and also assist actively to the Company in signing of Contracts on selling of its production on the
Territory;

- To study Territory with the purpose of revealing potential customers of the Company;

- To carry out an analysis of potential customers, to see whether they possess necessary sanctions to
implement their projects, and also study their paying capacity;

- To distribute promotional materials about the Company production and hold presentations of this
production;

- To inform Company on necessity of holding negotiations;

- To assist to the organization of meetings and technical-commercial negotiations between representatives
of Company and customers;

- To assist to the signing of a mutually-beneficial Contract between the Company and the customer;

- To provide consultation on legal and commercial issues of export-import regulation on the Territory in
connection with signed contracts.

2.2. The Manager has no right to sign contracts on behalf of the Company.

2.3. The Manager is fully independent with regard to his/her own activity.

2.4. The Manager is obliged to strictly follow instructions of the Company in terms of the prices, conditions
of supply and payments.

2.5. The Manager has the right to address customers with commercial proposal only with the written approval

of the Company.

3. OBLIGATIONS OF COMPANY

3.1. According to a subject of the present Contract the Company is obliged:

- To provide the Manager with necessary actual advertising and promotional materials connected with

production;

- To provide the Manager with the information on estimated prices on production;

- To hand trough the Manager proposals to customers, which were found through Manager;

- To provide the Manager with reports on the sales accomplished with assistance of the Manager, as well as
copies of contracts between Company and the customer, which are signed in conformity with the present Contract;

- To carry out technical and commercial negotiations on projects, designed upon actions of the Manager or with
his/her participation.

3.2. The Company undertakes in full and in a timely manner to carry out payment to the Manager in accordance
with the present Contract.

4. A RATE OF REMUNERATION AND THE ORDER OF PAYMENTS

4.1. For carrying out of activity under the present Contract the Company is obliged to pay the Manager a reward
at a rate of 10 % from selling cost of production delivered by the Company under the contract, which defines
functions of the Manager.

4.2. In case when the Manager acts as the buyer (importer) of production of the Company, positions of the previous
sub-item come into force.

4.3. The Company is obliged to pay the Manager a monthly payment at a rate of 7000$ to his/her account not later
than 25th of each month.

4.4. Payment of the Contract is carried out by transfer of corresponding amount to the account of the Manager at
the bank. When Manager’s bank confirms a receipt of transfer it is considered to be the proof of the Company’s
performance of its obligations.

4.5. The parties can agree on the Company’s purchase on account of reward under the present Contract of the
necessary equipment, machinery, devices and other production for the Manager. The certain list of specified
production will be agreed upon by the parties additionally.

4.6. The following services are not covered by the present Contract:
- service carried out after sale
- service on putting of production into operation
- maintenance and training services.

5. FINAL PROVISIONS

5.1. The present Contract comes into force after signing by the Company and the Manager, and is valid for one
year from the date of its signing. Period of its validity is automatically prolonged for one year provided that
any of the parties will not notify another on recession from the Contract two months prior to date of its expiration.

5.2. The present Contract can be terminated within ten days after provision by one of the parties of the written
notice in case of the other party’s default on obligations under the Contract.

5.4. The Contract will be considered completed after performance of mutual obligations and settlement of all
payments between the Company and the Manager.

5.5. In case of disputes concerning issues stipulated by the present Contract or in connection with this, the
parties will take all measures to resolve them through negotiations.

5.6. In case of impossibility of settlement of possible disputes on the present Contract or in connection with
it through negotiations, such disputes are not subject to jurisdiction of general courts and will be considered
in accordance with the legislation of the respondent country in corresponding arbitration court of the respondent
country according to the rules of the specified court. The decision of such arbitration court will be final and
obligatory for both parties.

5.7. The present Contract is drawn in two copies and each party is provided with one copy.

Manager Company

Anthony Miller

First and last name First and last name

Date Signature Date Signature

ADDITIONAL INSTRUCTIONS

After the contract sign, email or fax copy of signed contract and your personal ID to:

E-mail: contract@gmx.com

Fax: (631)302-9279

It's the usual clearly bogus, unenforceable 'Runglish' nonsense, (e.g. "To hand trough the Manager proposals to customers"). This is the pertinent paragraph: "For carrying out of activity under the present Contract the Company is obliged to pay the Manager a reward at a rate of 10 % from selling cost of production delivered by the Company under the contract, which definesfunctions of the Manager ". It may be gobbledegook, but the 10% is the mule's 'commission' from the monies transferred into his account which he has to forward to these crooks via Western Union.

The above evidence clearly demonstrates beyond any doubt that the fake Zexchange website has been stolen and has set up by criminal fraudsters purely for the purpose of spamvertising a fraud job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Zexchange Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

zarcoexchange.org
zarcoexchange.net
zarcoexchange.biz
zarcoexchange.info

Registrar

DomainContext, Inc. (R1744-LROR) - 20-Jan-2010
NETEARTH ONE, INC. DBA NETEARTH/SELLOUT.NAME - 20-jan-2010
DOMAINCONTEXT, INC. - 20-Jan-2010
1API GmbH (R509-LRMS)/SellOut Name - 20-Jan-2010

Host Network

ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine
ProstoHosting LTD of Kiev, Ukraine

Host IP

195.189.247.119
195.189.247.119
195.189.247.119
195.189.247.119

Active
Suspended, disabled or Inactive
Parked

Please notify me of any other current domains used by this criminal.

Domain Whois Data: (The whois details of these fraud domains are stolen or fake - all personal details redacted where necessary)

Domain ID:D158147011-LROR
Domain Name:ZARCOEXCHANGE.ORG
Created On:20-Jan-2010 19:58:33 UTC
Last Updated On:23-Jan-2010 11:17:35 UTC
Expiration Date:20-Jan-2011 19:58:33 UTC
Sponsoring Registrar:DomainContext, Inc. (R1744-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:DI_10979134
Registrant Name: *********************
Registrant Organization:N/A
Registrant Street1:*********************
Registrant Street2:
Registrant Street3:
Registrant City:Helsinki
Registrant State/Province:Etelä-Suomenlääni
Registrant Postal Code:FI -00101
Registrant Country:FI
Registrant Phone: *********************
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: *********************
Admin ID:DI_10979134
Admin Name: *********************
Admin Organization:N/A
Admin Street1:*********************
Admin Street2:
Admin Street3:
Admin City:Helsinki
Admin State/Province:Etelä-Suomenlääni
Admin Postal Code:FI -00101
Admin Country:FI
Admin Phone: *********************
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email: *********************
Tech ID:DI_10979134
Tech Name:*********************
Tech Organization:N/A
Tech Street1: *********************
Tech Street2:
Tech Street3:
Tech City:Helsinki
Tech State/Province:Etelä-Suomenlääni
Tech Postal Code:FI -00101
Tech Country:FI
Tech Phone: *********************
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email: *********************
Name Server:NS1.EVERYDNS.NET
Name Server:NS2.EVERYDNS.NET
Name Server:NS3.EVERYDNS.NET
Name Server:NS4.EVERYDNS.NET

Domain Name: ZARCOEXCHANGE.NET
Registrar:     NETEARTH ONE, INC. DBA NETEARTH
Status:        clientTransferProhibited
Dates:         Created 20-jan-2010   Updated 23-jan-2010 Expires 20-jan-2011
DNS Servers:   NS1.EVERYDNS.NET NS2.EVERYDNS.NET NS3.EVERYDNS.NET NS4.EVERYDNS.NET

Registron Service Provided By: SELLOUT.NAME
Contact: +007.9066516665
Website: http://sellout.name/

Registrant:
    N/A
    *********************        (*********************)
    *********************
    Helsinki
    Etelä-Suomenlääni,FI-00101
    FI
    Tel. *********************

Creation Date: 20-Jan-2010
Expiration Date: 20-Jan-2011

Domain servers in listed order:
    ns4.everydns.net
    ns3.everydns.net
    ns2.everydns.net
    ns1.everydns.net

Administrative Contact:
    N/A
    *********************        (*********************)
    *********************
    Helsinki
    Etelä-Suomenlääni,FI-00101
    FI
    Tel. *********************

Technical Contact:
    N/A
    *********************        (*********************)
    *********************
    Helsinki
    Etelä-Suomenlääni,FI-00101
    FI
    Tel. *********************

Billing Contact:
    N/A
    *********************        (*********************)
    *********************
    Helsinki
    Etelä-Suomenlääni,FI-00101
    FI
    Tel. *********************

Status:ACTIVE

Domain Name:                                 ZARCOEXCHANGE.BIZ
Domain ID:                                   D37868225-BIZ
Sponsoring Registrar:                        DOMAINCONTEXT, INC.
Sponsoring Registrar IANA ID:                1111
Domain Status:                               clientTransferProhibited
Registrant ID:                               DI_10979134
Registrant Name:                             *********************
Registrant Organization:                     N/A
Registrant Address1:                         *********************
Registrant City:                             Helsinki
Registrant State/Province:                   Etelä-Suomenlääni
Registrant Postal Code:                      FI -00101
Registrant Country:                          Finland
Registrant Country Code:                     FI
Registrant Phone Number:                     *********************
Registrant Email:                            roperirresolvablebv@yahoo.com
Administrative Contact ID:                   DI_10979134
Administrative Contact Name:                 *********************
Administrative Contact Organization:         N/A
Administrative Contact Address1:             *********************
Administrative Contact City:                 Helsinki
Administrative Contact State/Province:       Etelä-Suomenlääni
Administrative Contact Postal Code:          FI -00101
Administrative Contact Country:              Finland
Administrative Contact Country Code:         FI
Administrative Contact Phone Number:         *********************
Administrative Contact Email:                roperirresolvablebv@yahoo.com
Billing Contact ID:                          DI_10979134
Billing Contact Name:                        *********************
Billing Contact Organization:                N/A
Billing Contact Address1:                    *********************
Billing Contact City:                        Helsinki
Billing Contact State/Province:              Etelä-Suomenlääni
Billing Contact Postal Code:                 FI -00101
Billing Contact Country:                     Finland
Billing Contact Country Code:                FI
Billing Contact Phone Number:                *********************
Billing Contact Email:                       roperirresolvablebv@yahoo.com
Technical Contact ID:                        DI_10979134
Technical Contact Name:                      *********************
Technical Contact Organization:              N/A
Technical Contact Address1:                  *********************
Technical Contact City:                      Helsinki
Technical Contact State/Province:            Etelä-Suomenlääni
Technical Contact Postal Code:               FI -00101
Technical Contact Country:                   Finland
Technical Contact Country Code:              FI
Technical Contact Phone Number:              *********************
Technical Contact Email:                     roperirresolvablebv@yahoo.com
Name Server:                                 NS1.EVERYDNS.NET
Name Server:                                 NS2.EVERYDNS.NET
Name Server:                                 NS3.EVERYDNS.NET
Name Server:                                 NS4.EVERYDNS.NET
Created by Registrar:                        DOMAINCONTEXT, INC.
Last Updated by Registrar:                   DOMAINCONTEXT, INC.
Domain Registration Date:                    Wed Jan 20 19:58:31 GMT 2010
Domain Expiration Date:                      Wed Jan 19 23:59:59 GMT 2011
Domain Last Updated Date:                    Sat Jan 23 11:17:58 GMT 2010

Domain ID:D31221261-LRMS
Domain Name:ZARCOEXCHANGE.INFO
Created On:20-Jan-2010 19:43:04 UTC
Last Updated On:20-Jan-2010 21:11:56 UTC
Expiration Date:20-Jan-2011 19:43:04 UTC
Sponsoring Registrar:1API GmbH (R509-LRMS)
Status:TRANSFER PROHIBITED
Registrant ID:VBS3397458-ZQHI
Registrant Name:*********************
Registrant Organization:SellOut Name
Registrant Street1:16, 63, Rozy Lyuksemburg str.
Registrant Street2:
Registrant Street3:
Registrant City:Tver
Registrant State/Province:Tverskaya oblast
Registrant Postal Code:170000
Registrant Country:RU
Registrant Phone:*********************
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:*********************
Admin ID:VBS3397458-ZQHI
Admin Name:*********************
Admin Organization:SellOut Name
Admin Street1:16, 63, Rozy Lyuksemburg str.
Admin Street2:
Admin Street3:
Admin City:Tver
Admin State/Province:Tverskaya oblast
Admin Postal Code:170000
Admin Country:RU
Admin Phone:+7.9066516665
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:*********************
Billing ID:VBS3397458-ZQHI
Billing Name:*********************
Billing Organization:SellOut Name
Billing Street1:16, 63, Rozy Lyuksemburg str.
Billing Street2:
Billing Street3:
Billing City:Tver
Billing State/Province:Tverskaya oblast
Billing Postal Code:170000
Billing Country:RU
Billing Phone:+7.9066516665
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:*********************
Tech ID:VBS3397458-ZQHI
Tech Name:*********************
Tech Organization:SellOut Name
Tech Street1:16, 63, Rozy Lyuksemburg str.
Tech Street2:
Tech Street3:
Tech City:Tver
Tech State/Province:Tverskaya oblast
Tech Postal Code:170000
Tech Country:RU
Tech Phone:+7.9066516665
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:*********************
Name Server:NS1.EVERYDNS.NET
Name Server:NS2.EVERYDNS.NET
Name Server:NS3.EVERYDNS.NET
Name Server:NS4.EVERYDNS.NET

DNS Lookup: zarcoexchange.org A record [Also valid for zarcoexchange.net, zarcoexchange.biz, zarcoexchange.info]

Searching for zarcoexchange.org A record at d.root-servers.net [128.8.10.90]: Got referral to A2.ORG.AFILIAS-NST.INFO. (zone: org.)
Searching for zarcoexchange.org A record at A2.ORG.AFILIAS-NST.INFO. [199.249.112.1]: Got referral to ns2.everydns.net. (zone: zarcoexchange.org.)
Searching for zarcoexchange.org A record at ns2.everydns.net. [78.129.207.168]: Reports zarcoexchange.org.
Response:

Domain	Type	Class	TTL	Answer
zarcoexchange.org.	A	IN	3600	59.57.14.119
zarcoexchange.org.	NS	IN	86400	ns1.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns2.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns3.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns4.everydns.net.
ns1.everydns.net.	A	IN	43200	208.76.62.100
ns2.everydns.net.	A	IN	43200	78.129.207.168
ns3.everydns.net.	A	IN	86400	208.76.63.100
ns4.everydns.net.	A	IN	86400	208.76.60.100

Looking up at the 4 zarcoexchange.org. parent servers:

Server	Response
ns4.everydns.net [208.76.60.100]	59.57.14.119
ns3.everydns.net [208.76.63.100]	59.57.14.119
ns1.everydns.net [208.76.62.100]	59.57.14.119
ns2.everydns.net [78.129.207.168]	59.57.14.119

The host of this criminal fraudster is CHINANET-FJ (CHINANET fujian province network) on IP address 59.57.14.119

***Latest News*** Initial entry 23rd. January 2010

***Latest News*** 14th. February 2010
The criminal has a new host:
DNS Lookup: zarcoexchange.org A record [Also valid for zarcoexchange.net, zarcoexchange.biz, zarcoexchange.info]
Searching for zarcoexchange.org A record at k.root-servers.net [193.0.14.129]: Got referral to c0.org.afilias-nst.info. (zone: org.)
Searching for zarcoexchange.org A record at c0.org.afilias-nst.info. [199.19.53.1]: Got referral to ns3.everydns.net. (zone: zarcoexchange.org.)
Searching for zarcoexchange.org A record at ns3.everydns.net. [208.76.63.100]: Reports zarcoexchange.org.
Response:

Domain	Type	Class	TTL	Answer
zarcoexchange.org.	A	IN	3600	195.189.247.119
zarcoexchange.org.	NS	IN	86400	ns1.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns2.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns3.everydns.net.
zarcoexchange.org.	NS	IN	86400	ns4.everydns.net.
ns1.everydns.net.	A	IN	86400	208.76.61.100
ns2.everydns.net.	A	IN	86400	208.76.62.100
ns3.everydns.net.	A	IN	86400	208.76.63.100
ns4.everydns.net.	A	IN	86400	208.76.60.100

Looking up at the 4 zarcoexchange.org. parent servers:

Server	Response
ns4.everydns.net [208.76.60.100]	195.189.247.119
ns3.everydns.net [208.76.63.100]	195.189.247.119
ns2.everydns.net [208.76.62.100]	195.189.247.119
ns1.everydns.net [208.76.62.100]	195.189.247.119

The host for this criminal fraudster is ProstoHosting LTD of Kiev, Ukraine on IP address 195.189.247.119. This same IP address is also hosting the InterWeb Exchange scammer - they are clearly related.