Odono International Inc (odono.org) and others - Job Offer Scam

Trans Electronics UK LTD (transelectronics.net)

Hosted on 66.244.251.18 by Big Pipe Inc, Atlanta, Georgia to a (fake) registrant in Washington State, USA. However, the contact details on the site say:

Trans Electronics UK LTD
transelectronics.net
29 Harley Street, London
W1G 9QR    

There is no active company of that name in the UK.

The site content is ripped off from innocent third parties, notable  londoncenter.com and chrobinson.com. The registrant details are as follows (note that the contact details are almost definitely fake):

 Registrant:
 Trans Electronics
 7233 Douglas Ave S.E.
 Snoqualmie, WA 98065
 US

 Domain name: TRANSELECTRONICS.NET

 Administrative Contact:
    Milligan, Craig  manager_transelectronics@mailworks.org
    7233 Douglas Ave S.E.
    Snoqualmie, WA 98065
    US
    425-891-1601
 Technical Contact:
    Manager, Domains  support@netfirms.com
    5160 Yonge St
    1800
    Toronto, ON M2N 6L9
    CA
    +1.4166612100    Fax: +1.4166610700


 Registration Service Provider:
    Netfirms, Inc., support@netfirms.com
    +1.4166612100
    This company may be contacted for domain login/passwords,
    DNS/Nameserver changes, and general domain support questions.

 Registrar of Record: TUCOWS, INC.
 Record last updated on 09-May-2005.
 Record expires on 10-May-2006.
 Record created on 10-May-2004.

 Domain servers in listed order:
    NS1.NETFIRMS.COM   64.34.74.221
    NS2.NETFIRMS.COM   64.34.74.222

UnionPost Company (unionpost.net)

Hosted on 64.191.91.71 by Network Operations Center Inc. in Scranton, United States. Domain is registered to a (fake) individual in the Ukraine, although UnionPost claims to be based in New York City.

United States of America
UnionPost Company
2259 Broadway
New York, NY
10028
Fax/Phone# (917) 591-3076

The content for this site is ripped off from other innocent third parties, notably skynet.net.

64.191.91.71 is regularly blacklisted for a variety of spam and scam sites, despite this the host appears to be happy for this unlawful activity to take place.

The registrant details are as follows (note that the contact details are almost definitely fake):

Registration Service Provided By: VIDESS Contact: videss@mail.ru Abuse Desk Email Address: videss@mail.ru Domain Name: UNIONPOST.NET

Registrant:
    NewSOlution
    Vasa Purinov        (support@ecomers.net)
    Lazurnay st 52a 165
    Kiev
    null,51000
    UA
    Tel. +1.1111111

Creation Date: 31-Jan-2005 
Expiration Date: 31-Jan-2006

Domain servers in listed order:
    ns1.idghost.com
    ns2.idghost.com

Administrative Contact:
    NewSOlution
    Vasa Purinov        (support@ecomers.net)
    Lazurnay st 52a 165
    Kiev
    null,51000
    UA
    Tel. +1.1111111

Technical Contact:
    NewSOlution
    Vasa Purinov        (support@ecomers.net)
    Lazurnay st 52a 165
    Kiev
    null,51000
    UA
    Tel. +1.1111111

Billing Contact:
    NewSOlution
    Vasa Purinov        (support@ecomers.net)
    Lazurnay st 52a 165
    Kiev
    null,51000
    UA
    Tel. +1.1111111

Status:ACTIVE
 

Update 8-Dec-05: The webmaster of Softfacade.com contacted me to assert that he is not connected with this fraudulent activity. I have no evidence to say that Softfacade.com is connected to the scam, and it is quite possible that they are an innocent customer.

However, the host idghost.com still provides hosting services for fraudulent, phishing sites and what appear to be child pornography sites on 66.235.184.248 operated by HopOne Internet Corporation. The following sites are on that server, although some may be innocent parties.

Ship & Pay International (shipandpay.com)

Claims to have been founded in 2003, but the domain was only registered in July 2004. Hosted on 219.153.14.58 in China, a site that has been blacklisted many, many times before. For a while, TransferGate.com was hosted on the same server. Again. the name Robert Soloway is connected with this scam site.

Content is largely copied from the innocent skynet.net site

The address is listed as:

Ship & Pay International
7760 France Avenue South
Minneapolis, MN 55435
United States

Unusually, the domain name matches the fake contact address on the site. However, like the other sites mentioned here, this is a fraud. You can read more details here at joewein.de.

Registrant:
 Ship & Pay International
 7760 France Avenue South
 Minneapolis, MN 55435
 US

 Domain name: SHIPANDPAY.COM

 Administrative Contact:
    Reynolds, David  reg@bp-dns.com
    7760 France Avenue South
    Minneapolis, MN 55435
    US
    +1 (651) 286-0973
 Technical Contact:
    Reynolds, David  reg@bp-dns.com
    7760 France Avenue South
    Minneapolis, MN 55435
    US
    +1 (651) 286-0973

 Registrar of Record: TUCOWS, INC.
 Record last updated on 25-Apr-2005.
 Record expires on 07-Jul-2005.
 Record created on 07-Jul-2004.

 Domain servers in listed order:
    NS1.SHIPANDPAY.COM   219.153.14.58
    NS2.SHIPANDPAY.COM   219.153.14.58

 Domain status: ACTIVE

Argo Post Company (argopost.com)

Claims to have been founded in 1999, however the domain was registered in October 2004. Hosted on 69.72.179.175, a server belonging to Pegasus Web Technologies of New Jersey.

Contact address claims to be:

Argo Post Company
Vladimirskaya Street, 27
Kiev, 03027
Ukraine
Tel: 380 (44) 235-97-12
U.S. Fax: (610) 561-5907

However, the domain is registered to an individual in the United States. The content is a variation on all the other sites listed here and is almost identical in content to the fraudulent shipandpay.com site.

Be in no doubt that this site is fraudulent. The registration details (with fake contact names) are:

Registration Service Provided By: Registerfly.com
Contact: support@registerflysupport.com
Visit: http://www.RegisterFly.com


Registrant Contact:
   NA
   Dick Reich (dickrch@mailcan.com)
   +1.4062529256
   Fax: none
   408 Sun Valley Rd
   Billings,  59105
   US

Administrative Contact:
   NA
   Dick Reich (dickrch@mailcan.com)
   +1.4062529256
   Fax: none
   408 Sun Valley Rd
   Billings,  59105
   US

Technical Contact:
   NA
   Dick Reich (dickrch@mailcan.com)
   +1.4062529256
   Fax: none
   408 Sun Valley Rd
   Billings,  59105
   US

Billing Contact:
   NA
   Dick Reich (dickrch@mailcan.com)
   +1.4062529256
   Fax: none
   408 Sun Valley Rd
   Billings,  59105
   US

Status: Locked

Name Servers:
   ns3.anonwebhost.com
   ns4.anonwebhost.com
  
Creation date: 07 Oct 2004 14:51:17
Expiration date: 07 Oct 2005 14:51:17

Easy Pay Company (easypayco.com)

This site is an clone of the "Argo Post Company" site, hosted on 64.202.123.183, a server belonging to Appian Communications in Michigan.

Contact address claims to be:

Easy Pay Company
Krasnova Street, 108
Kiev, 03025
Ukraine
Tel: 38 (044) 464-9762
USA Fax: (740) 931-2124

The domain contact is a fake address in California howver. As with the "Argo Post" site, this is clearly fraudulent. The "company" claims to have been set up in 1999, but the domain only registered in October 2004.

The contact details are clearly fake:

Registrant Contact:
   NA
   Matthew Smith (matsmith@airpost.net)
   +1.4155199351
   Fax: none
   357 Colby Street
   Oakland,  94618
   US

Administrative Contact:
   NA
   Matthew Smith (matsmith@airpost.net)
   +1.4155199351
   Fax: none
   357 Colby Street
   Oakland,  94618
   US

Technical Contact:
   NA
   Matthew Smith (matsmith@airpost.net)
   +1.4155199351
   Fax: none
   357 Colby Street
   Oakland,  94618
   US

Billing Contact:
   NA
   Matthew Smith (matsmith@airpost.net)
   +1.4155199351
   Fax: none
   357 Colby Street
   Oakland,  94618
   US

Status: Locked

Name Servers:
   ns41.hostforweb.net
   ns42.hostforweb.net

Finance-Pilot Company  (finance-pilot.com)

An almost exact clone of the fraudulent shipandpay.com site, hosted on 64.202.163.214, a server belonging to GoDaddy Inc in Arizona.

Contact address claims to be:

Latvia
Riga
Lavsala 49-15
835007
Tel. #: +371 (7) 520092
USA Tel. #: (718) 504-6111

The domain contact address here is Ohio, so it doesn't match. Again, this "company" claims to have been set up in 2001, but the domain only registered in October 2004.

More faked contact details:

Registrant:
   JAE LEE
   401college ave. box 152
   Ashland, Ohio 44805
   United States

   Registered through: GoDaddy.com
   Domain Name: FINANCE-PILOT.COM
      Created on: 11-Oct-04
      Expires on: 11-Oct-05
      Last Updated on: 11-Oct-04

   Administrative Contact:
      LEE, JAE  vvroilers@hotmail.com
      401college ave. box 152
      Ashland, Ohio 44805
      United States
      4191772911      Fax --
   Technical Contact:
      LEE, JAE  vvroilers@hotmail.com
      401college ave. box 152
      Ashland, Ohio 44805
      United States
      4191772911      Fax --

   Domain servers in listed order:
      WSC1.JOMAX.NET
      WSC2.JOMAX.NET

International Global Courier Service Inc  (igcs.us)

A copy of the fraudulent transelectronics.net site, hosted on 65.75.191.98 by Managed Solutions Group, Inc of California. Specifically, that IP address seems to be allocated to one C. Koehler of Fish Creek, Wisconsin. We assume that C. Koehler is a small web host with no connection to this fraud.

There are no contact details on the site, and the domain contact information is fake. Given that this is a clone of the fraudulent transelectronics.net site, then you should assume that the "International Global Courier Service" site is also fake and is involved in the business of money laundering or check fraud.

The faked contact details are:

Domain Name:                                 IGCS.US
Domain ID:                                   D5810594-US
Sponsoring Registrar:                        TUCOWS INC.
Domain Status:                               ok
Registrant ID:                               TUH2XZ3DCWRCA5JH
Registrant Name:                             IGCS IGCS
Registrant Organization:                     IGCS
Registrant Address1:                         IGCS.US
Registrant City:                             NewYork
Registrant State/Province:                   NY
Registrant Postal Code:                      11003
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.8002345678
Registrant Email:                            support@igcs.us
Registrant Application Purpose:              P1
Registrant Nexus Category:                   C21
Administrative Contact ID:                   TUR1X2OFO6J7FRJM
Administrative Contact Name:                 IGCS IGCS
Administrative Contact Organization:         IGCS
Administrative Contact Address1:             IGCS.US
Administrative Contact City:                 NewYork
Administrative Contact State/Province:       NY
Administrative Contact Postal Code:          11003
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.8002345678
Administrative Contact Email:                support@igcs.us
Administrative Application Purpose:          P1
Administrative Nexus Category:               C21
Billing Contact ID:                          TUDKFDY9DSI3F1T7
Billing Contact Name:                        IGCS IGCS
Billing Contact Organization:                IGCS
Billing Contact Address1:                    IGCS.US
Billing Contact City:                        NewYork
Billing Contact State/Province:              NY
Billing Contact Postal Code:                 11003
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.8002345678
Billing Contact Email:                       support@igcs.us
Billing Application Purpose:                 P1
Billing Nexus Category:                      C21
Technical Contact ID:                        TUEVSEXYJJMNKL0A
Technical Contact Name:                      IGCS IGCS
Technical Contact Organization:              IGCS
Technical Contact Address1:                  IGCS.US
Technical Contact City:                      NewYork
Technical Contact State/Province:            NY
Technical Contact Postal Code:               11003
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +1.8002345678
Technical Contact Email:                     support@igcs.us
Technical Application Purpose:               P1
Technical Nexus Category:                    C21
Name Server:                                 NS1.SAFEDNS.BIZ
Name Server:                                 NS2.SAFEDNS.BIZ
Created by Registrar:                        TUCOWS INC.
Last Updated by Registrar:                   TUCOWS INC.
Domain Registration Date:                    Mon Apr 05 12:04:22 GMT 2004
Domain Expiration Date:                      Tue Apr 04 23:59:59 GMT 2006
Domain Last Updated Date:                    Wed Apr 06 20:45:26 GMT 2005

SAFEDNS.BIZ is a well-known provider for spam/scam sites (see here).

Interway GmbH (interway-solutions.com)

Hosted on 69.50.188.132 by Atrivo in Santa Rosa, California. This claims to be a German company founded in 2000, but the domain was only registered in March 2005.

Contact address claims to be:

Germany
Faradayweg 4-6,
14195 Berlin

The domain contact is in Munich, but neither address can be verified as genuine. The contact email addresses give for both the domain and site are at fusemail.com - essentially a free webmail service like Hotmail. No respectable business would use a mail service like this.

You would also expect a German company to host their servers in Germany. The server 69.50.188.132 is used primarily to host hard core pornography, adult sex toys, and Rx affiliate sites. It is inconceivable that a blue chip German company would use a host such as this. These other sites are typically registered to people in Eastern Europe, Cuba or South East Asia.

Other sites on 69.50.188.132 include: