Zeus Financial scam

Zeus Financial Fraud

Don't Bear Internet Fraud

Zeus Financial screenshot - 09-Feb-2009

This fraud should not be confused with any other company of the same or similar name - the following fraud evidence defines and refer to this fake company alone and no other. The above website has been stolen from the legitimate company CNL Financial Group, Inc. - clear evidence of fraud in itself.

Zeus Financial is just another fake financial site used as a vehicle to legitimise a money laundering fraud scam. The only reason it looks so glossy and professional is because the website content has been stolen in its entirety from the website of the genuine financial organisation CNL Financial Group, Inc.. It's not the only scam website this fraudster has produced using an identical MO. He has previous aliases of Paramount Finance, First Rate Finance, World Finance Group and others. The website fraud domain zeusfinancialonline.com was only registered on 28-jan-2009 and the crook has no web presence at all. The website is zombie botnet hosted which irrefutably defines it as a criminal website - no legitimate website is zombie botnet hosted. Reverse IP data on the zombies show it to be a 'Rockphish' operation without doubt.

Evidence of Criminal Fraud:

i) From the About Zeus page on their website: "The Zeus story begins in 1973". However, the fraudster's domain zeusfinancialonline.com was only registered with PUBLICDOMAINREGISTRY.COM (NICS.NAME) on 28-jan-2009. Clear evidence of fraudulent misrepresentation.

ii) The fake website content has quite clearly been stolen from the genuine company CNL Financial Group, Inc. and modified to suit the criminal's purposes. CNL Financial Group, Inc. have posted a warning of this criminal activity on their website, although the Australian location is undoubtedly fake, of course and it's a shame they didn't mention them by name. Clear evidence of fraudulent misrepresentation.

iii) As is usual for these criminals, a Google search shows that they have no internet presence at all despite their claim on their above screenshot: "Zeus Financial, Pty Ltd. (Zeus) is one of the nation’s largest privately held real estate investment and development companies". Not to be confused with any genuine Australian company of the same name.

iv) The Spam:

From: Michael Lovell <staffmanager@zeusfinancialonline.com>
Subject: Job Offer
Date: Friday, 6 February, 2009, 10:41 AM

Zeus Financial Pty Ltd
17 Belmore St, Burwood,
NSW, 2134, Australia.

Hello xxxxxxx,

my name is Michael Lovell and I am Zeus Financial Pty. Ltd. Staff manager.
We have found and reviewed your resume at totaljobs.com and decided to
offer this job to you.

Here is the information about Payment Protection Agent job position:

Job Basis
As the basis of our service is to provide payment protection deals on the
Internet we need payment protection agents all over the world. Attracting
clients from different corners of the world we should have our agents
everywhere in order to be able to provide instant payment protection
solutions (in-state bank transfers take no more than a few hours). We
engage new technologies to deal with the e-document exchange, which makes
the process reliable and safe. Our servicedeals only with the paperwork,
leaving the financial part (accepting funds on your personal bank accounts
from the buyers, and routing them to the sellers according to our
instructions afterwards) for you. We can't bare the financial
responsibility because in today's world of extremely fast solutions it is
time that is of significant importance to our clients. Having an escrow
agent in every country we can quickly transfer funds inside the country
without wasting time on the international bank transfers, and continue our
rapid growth rather than overwhelming our own bank account with inbound
and outbound transactions leading to severe hold times and probably
service interruption.

Career and Benefits
Your main task will be receiving money transactions to your personal bank
accounts and forwarding them to the next party of the payment protection
process, according to our instructions. You will benefit from the
commissions, which are 5-7% of each transaction and depend on the quantity
of completed transactions and the speed of your work + you will be paid a
basic salary of 1500 GBP per month. For your convenience there will be no
paychecks, your commission will remain in your account after every
successfully completed transaction. The money transfer fee is not included
in your commission, meaning that you will deduct it from the received
amount, not from your commission. Also you receive 5-7% of the transaction
amount. Normally the amounts that we process vary from 2,000GBP to
10,000GBP, but can go higher on special occasions.

If you are ready to proceed, please provide us with your AVAILABLE phone
number and
send it back to our Staff Manager at staffmanager@zeusfinancialonline.com

Please do not hesitate to contact us if you need more information.

--
Sincerely yours,
Michael Lovell,
Zeus Financial Pty. Ltd.
staffmanager@zeusfinancialonline.org
zfsparebox@hotmail.com
Visit us at www.zeusfinancialonline.org

v) You do not get a clearer definition of the illegal part time money mule function: "Your main task will be receiving money transactions to your personal bank
accounts and forwarding them to the next party of the payment protection process, according to our instructions", i.e. transferring them on via Moneygram or Western Union less a percentage commission - that on its own defines the company without doubt as criminal and bogus and is clear evidence of criminal fraud.

vi) No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas. It will get your bank account and your assets frozen and could well earn you a criminal record - do not be tempted.

vii) Fake 'Contact Us' Details from website:

Corporate Headquarters
Zeus Financial Pty Ltd
17 Belmore St, Burwood,
NSW, 2134, Australia.
+61-386-485-716
Investor Inquiries
P.O. Box 3755
Burwood,
NSW, 2134, Australia.
+61-386-485-716

• - The address 17 Belmore St, Burwood Googles as the address of A & T Computer with no evidence of these crooks at that address - clear evidence of criminal fraud.
• - A Google search for the telephone number +61-386-485-716 returns zero results.

The above evidence clearly demonstrates beyond any doubt that the Zeus Financial website has been set up very recently by 'Rockphish' money laundering criminals purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal activity - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

Main Website Domains

zeusfinancialonline.com
zeusfinancialonline.org

Registrar

PUBLICDOMAINREGISTRY.COM (NICS.NAME) - 28-Jan-2009
Bizcn.com, Inc. - 16-Feb-2009

Botnet Nameserver Domains

supports-service.com

Registrar

IA Registry/Spiritdomains - 29-Jan-2009

Nameserver Host

Layershift Limited (UK)/WizzVPS

Host IP

87.239.22.94

Active
Suspended/Disabled
Parked

The Zombie Botnet DNS Data (Valid for domain zeusfinancialonline.com, zeusfinancialonline.org)

Looking up at the 2 zeusfinancialonline.com. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.supports-service.com [66.197.202.90]	173.21.76.127 173.25.25.38 173.27.248.203 68.205.189.47 72.253.177.150
ns2.supports-service.com [125.167.52.118]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the criminal owned nameserver ns1.supports-service.com hosted by HostNOC/Burst.net on IP address 66.197.202.90 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT/NSLOOKUP). See The Zombie Botnet 'Host By Proxy' for an explanation of this method of hosting.

Reverse IP checks on the zombies used by this criminal reveal fraud and phishing domains hosted by known 'Rockphish' zombies, so this in undoubtedly a 'Rockphish' operation.

***Latest News*** 9th. Feb 2009
Webpage created

***Latest News*** 14th. February 2009
News from Simon Bear - the domain zeusfinancialonline.com has been suspended - please notifiy me of any active domains for this criminal.

***Latest News*** 17th. February 2009
New domain notified by site contact - zeusfinancialonline.org hosted on the above HostNOC/Burst.net zombie botnet

***Latest News*** 19th. February 2009
Hostnoc/burst.net have so far failed to take action on this criminal activity that they are hosting, (first reported 17-Feb-2009)

***Latest News*** 22nd. February 2009
Finally a response from Burst.net abuse to say they've disconnected the IP due to a lack of response from the client..... Having probably been well warned, the crook's botnet is unsurprisingly straight back up on ns1.supports-service.com. [87.239.22.94] with no downtime that I've seen.

The Zombie Botnet DNS Data (Valid for domain zeusfinancialonline.org)

Looking up at the 2 zeusfinancialonline.org. parent servers:

Zombie Botnet Nameserver	Botnet Nameserver 'A' Records (Zombie Site Host IPs)
ns1.supports-service.com [87.239.22.94]	24.205.43.59 67.182.38.125 69.234.146.136 98.119.126.38 98.234.74.152
ns2.supports-service.com [125.167.52.118]	Timeout - Fake nameserver, (never resolves).

The data shows a standard 5-IP site hosting zombie botnet where the criminal owned nameserver ns1.supports-service.com hosted by Layershift Limited (UK)/WizzVPS on IP address 87.239.22.94 is acting as a zombie botnet controller 'herding' the rotating zombies, (as determined by RDNS), in the 'A' records list which are hosting the fraud site (as determined by TRACERT/NSLOOKUP). See The Zombie Botnet 'Host By Proxy' for an explanation of this method of hosting.

***Latest News*** 26th. February 2009
The criminal's domain zeusfinancialonline.org has been suspended - please notify me of any active domains for this criminal.

See the Range Financial Corporation fraud for the follow-on fraud to this one.