dynamoo.com home

 
Site navigation

home
blog
technical
diary
webmaster
orange book
moobiles
shop
contact
links
  
Updated
May 2005

   Dynamoo 2005

 

 

 

 

Odono International Inc (odono.org) and others - Job Offer Scam

21st May 2005 (Updated October 2006)

Please note - every site listed here was FRAUDULENT at the time of writing - May 2005 - although many have been re-registered.

If you have received an email advertising these sites, please report it to SpamCop and/or the hosting company mentioned in the writeup. If this page has been useful to you, then please link to us.

Also note that is is quite possible that some of these sites will try to install malware. Do NOT visit them using Internet Explorer, and only visit them is your system is fully patched with all the latest security updates AT YOUR OWN RISK.

 Odono.org "Odono International Inc" is a bogus company name being used to carry out fraud, either money laundering or a cashier's check fraud. An email along the following lines is being circulated:

    Dear Future Employee,
    We have received your contact information from employment agency.
    My name is Karl Jorgensen, project coordinator and your direct
    supervisor at Odono Inc. Please read the information below about
    our company and your job description.

    Odono Inc. leader in wholesale produce distribution is looking for responsible
    individuals to be responsible for the areas of shipping operations, customer service,
    transaction and bank operations.

    Current openings: Transaction Manager
    You will receive transfers for our company, send/receive funds.
    You should have your local bank branch locating near you,
    so you can withdraw money from your account within several hours.
    You should have home, work or cell phone number (preferably), so we can contact you immediately.

    Requirements:
    * Be able to check your email several times a day
    * Be able to respond to emails immediately
    * Be able to work overtime if needed
    * Be responsible and hard working

    If you are interested in this position and meet the minimum requirements please
    visit and register here:

          
    http://www.odono.org/jobs.html



    Registration is FREE of charge.
    Copyright (C) 2005 Odono Inc. All rights reserved.

Like the recent TransferGate.com scam, the scammers behind this one have gone to some considerable effort to look genuine - indeed the evidence is that this is same criminal spam/scam gang.

There are several telltale ways of showing this this is a fraud though.

  • Although they claim that Odono has been around since 1999, the domain name was only registered in March 2005.
  • The contact details on the page claim that they are based in Illionois, United States. However, the domain is registered to an individual in Russia, and the server is located in China.
  • The unsolicited email does not mention you by name, whereas a genuine job offer would.
  • Telephone numbers of the site are clearly fake.
  • There are a number of web sites with exactly the same material, also with fake details.

Be in no doubt that the position of "transferring money" they they advertise is illegal and you will either end up out of pocket, or possibly in prison. "Odono International Inc" previously used the website odono.net but this has been shut down. The current odono.org server is hosted at 221.208.208.73 in China, along with the following sites:

  • www.Broadcastadvertise.net
  • www.Exportersco.com
  • www.Globalsoftlabs.net
  • www.Lindamoney.com
  • www.Max-girls.biz
  • www.Maxx-teens.biz
  • www.Odono.org
  • www.Prodazasklada.com
  • www.S-way.info
  • www.Seminar-ua.biz
  • www.Shopgamer.biz
  • www.Spamerz.com
  • www.M-pays.com

These appears to be either spamming sites, pornography or other scam sites. Some of these same sites were previously hosted on the same server as the TransferGate.com site. There is some evidence to show that 221.208.208.73 has been used to publish child pornography in the past with the domain best-pedo.com.

The domain contact details for this site are almost definitely fake:

    Domain ID:D105896049-LROR
    Domain Name:ODONO.ORG
    Created On:15-Mar-2005 21:10:23 UTC
    Last Updated On:24-May-2005 07:48:27 UTC
    Expiration Date:15-Mar-2006 21:10:23 UTC
    Sponsoring Registrar:eNom, Inc. (R39-LROR)
    Status:OK
    Registrant ID:EC6F792837DC9EAA
    Registrant Name:Alex Sidorovsky
    Registrant Organization:
    Registrant Street1:Lenina 52-19
    Registrant Street2:
    Registrant Street3:
    Registrant City:Siktivkar
    Registrant State/Province:RU
    Registrant Postal Code:736843
    Registrant Country:RU
    Registrant Phone:+7.808823246829
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant Email:LINDASMITH@EMAIL.COM
    Admin ID:BD5EF19B473D513E
    Admin Name:Alex Sidorovsky
    Admin Organization:
    Admin Street1:Lenina 52-19
    Admin Street2:
    Admin Street3:
    Admin City:Siktivkar
    Admin State/Province:RU
    Admin Postal Code:736843
    Admin Country:RU
    Admin Phone:+7.808823246829
    Admin Phone Ext.:
    Admin FAX:
    Admin FAX Ext.:
    Admin Email:LINDASMITH@EMAIL.COM
    Tech ID:B3C3E0699C64B6FE
    Tech Name:Alex Sidorovsky
    Tech Organization:
    Tech Street1:Lenina 52-19
    Tech Street2:
    Tech Street3:
    Tech City:Siktivkar
    Tech State/Province:RU
    Tech Postal Code:736843
    Tech Country:RU
    Tech Phone:+7.808823246829
    Tech Phone Ext.:
    Tech FAX:
    Tech FAX Ext.:
    Tech Email:LINDASMITH@EMAIL.COM
    Name Server:NS1.NO-FAT-CHICKS.BIZ
    Name Server:NS2.NO-FAT-CHICKS.BIZ

However, the nameservers are distinctive and widely reported as being part of a major spam ring, probably connected with one Robert Soloway. Bearing in mind that whoever was behind the TransferGate.com scam is likely connected to this, then we look forward to submitting our evidence to the relevant authorities when the case comes to trial. For exposing the TransferGate scam, we were targetted by these criminals in a massive spam attack (known as a "Joe Job") in order to spread libellous accusations against us.

The domain Broadcastadvertise.net is hosted on the same server as "Odono International" (and also of the TransferGate.com site) with genuine contact details as follows:

    Registrant:
     Newport IM Corporation
     PO Box 1259
     Seattle, WA 98111
     US

     Domain name: BROADCASTADVERTISE.NET

     Administrative Contact:
        Soloway, Robert  broadcastadvertise@address.com
        PO Box 1259
        Seattle, WA 98111
        US
        +1.2062231270
     Technical Contact:
        Direct, Domain  dnstech@domaindirect.com
        96 Mowat Avenue
        Toronto, ON M6K 3M1
        CA
        +1.4165312084    Fax: +1.4165315584



     Registration Service Provider:
        Domain Direct, dnstech@domaindirect.com
        1-416-531-2084
        http://www.domaindirect.com
        This company may be contacted for domain login/passwords,
        DNS/Nameserver changes, and general domain support questions.


     Registrar of Record: TUCOWS, INC.
     Record last updated on 23-May-2005.
     Record expires on 13-Apr-2006.
     Record created on 13-Apr-2005.

     Domain servers in listed order:
        NS2.VIRTUALUSE.COM   213.159.109.2
        NS4.VIRTUALUSE.COM   66.53.9.62


     Domain status: REGISTRAR-HOLD
                    REGISTRAR-LOCK

Newport IM Corporation is better known as "Newport Internet Marketing". Check out those lawsuits. Spamhaus also has an comprehensive set of information on this spammer, including addresses that may be useful for you if you are considering legal action - see here.

There are a number of other web sites in the same spam/scam network.


Trans Electronics UK LTD (transelectronics.net)

Hosted on 66.244.251.18 by Big Pipe Inc, Atlanta, Georgia to a (fake) registrant in Washington State, USA. However, the contact details on the site say:

    Trans Electronics UK LTD
    transelectronics.net
    29 Harley Street, London
    W1G 9QR    

There is no active company of that name in the UK.

The site content is ripped off from innocent third parties, notable  londoncenter.com and chrobinson.com. The registrant details are as follows (note that the contact details are almost definitely fake):

     Registrant:
     Trans Electronics
     7233 Douglas Ave S.E.
     Snoqualmie, WA 98065
     US

     Domain name: TRANSELECTRONICS.NET

     Administrative Contact:
        Milligan, Craig  manager_transelectronics@mailworks.org
        7233 Douglas Ave S.E.
        Snoqualmie, WA 98065
        US
        425-891-1601
     Technical Contact:
        Manager, Domains  support@netfirms.com
        5160 Yonge St
        1800
        Toronto, ON M2N 6L9
        CA
        +1.4166612100    Fax: +1.4166610700


     Registration Service Provider:
        Netfirms, Inc., support@netfirms.com
        +1.4166612100
        This company may be contacted for domain login/passwords,
        DNS/Nameserver changes, and general domain support questions.

     Registrar of Record: TUCOWS, INC.
     Record last updated on 09-May-2005.
     Record expires on 10-May-2006.
     Record created on 10-May-2004.

     Domain servers in listed order:
        NS1.NETFIRMS.COM   64.34.74.221
        NS2.NETFIRMS.COM   64.34.74.222

 TransElectronics UK


UnionPost Company (unionpost.net)

Hosted on 64.191.91.71 by Network Operations Center Inc. in Scranton, United States. Domain is registered to a (fake) individual in the Ukraine, although UnionPost claims to be based in New York City.

    United States of America
    UnionPost Company
    2259 Broadway
    New York, NY
    10028
    Fax/Phone# (917) 591-3076

The content for this site is ripped off from other innocent third parties, notably skynet.net.

64.191.91.71 is regularly blacklisted for a variety of spam and scam sites, despite this the host appears to be happy for this unlawful activity to take place.

The registrant details are as follows (note that the contact details are almost definitely fake):

    Registration Service Provided By: VIDESS Contact: videss@mail.ru Abuse Desk Email Address: videss@mail.ru Domain Name: UNIONPOST.NET

    Registrant:
        NewSOlution
        Vasa Purinov        (support@ecomers.net)
        Lazurnay st 52a 165
        Kiev
        null,51000
        UA
        Tel. +1.1111111

    Creation Date: 31-Jan-2005 
    Expiration Date: 31-Jan-2006

    Domain servers in listed order:
        ns1.idghost.com
        ns2.idghost.com

    Administrative Contact:
        NewSOlution
        Vasa Purinov        (support@ecomers.net)
        Lazurnay st 52a 165
        Kiev
        null,51000
        UA
        Tel. +1.1111111

    Technical Contact:
        NewSOlution
        Vasa Purinov        (support@ecomers.net)
        Lazurnay st 52a 165
        Kiev
        null,51000
        UA
        Tel. +1.1111111

    Billing Contact:
        NewSOlution
        Vasa Purinov        (support@ecomers.net)
        Lazurnay st 52a 165
        Kiev
        null,51000
        UA
        Tel. +1.1111111

    Status:ACTIVE

     

 UnionPost

These additional sites are also on this server - most of which are registered to individuals claiming to be from Eastern Europe. It is likely that some of these are also fraudulent (list compiled 21-May-05):
 

  • www.Aboutpc.net
  • www.Algoritmx.org
  • www.Antizoo.org
  • www.Attestat.com
  • www.Avtomarket.biz
  • www.Belkindecor.com
  • www.Benovshe.com
  • www.Crackandserial.com
  • www.Credoltd.com
  • www.Crystal-engine.com
  • www.Crystal-systems.org
  • www.Ctydio-21.com
  • www.Cvchat.net
  • www.Denisenko.org
  • www.Deservers.com
  • www.Dnipro.biz
  • www.Dosecure.com
  • www.Ecomers.net
  • www.Ecommers.net
  • www.Embrate.com
  • www.Energocomfort.com
  • www.Erlen.biz
  • www.Escc.biz
  • www.Eurowings-ag.net
  • www.Exchangelance.com
  • www.F-13.com
  • www.Garant-nn.com
  • www.Gayart.org
  • www.Gwor.net
  • www.Idg-news-updater.com
  • www.Idghost.com
  • www.Infsystem.com
  • www.Inter-parts.net
  • www.Internet-orange.com
  • www.Iodobrom.com
  • www.Johnnsoft.com
  • www.Kakashek.net
  • www.Laydors.com
  • www.Maximus-design.com
  • www.Miriam-yeung.ws
  • www.Mk-game.net
  • www.Mmandarin.com
  • www.Mp3klad.net
  • www.Mtb-forum.net
  • www.Mykaz.com
  • www.Mykaz.net
  • www.Neonman.net
  • www.News-updater.com
  • www.Pc4ever.net
  • www.Rasimsafe.com
  • www.Rus-host.org
  • www.Samaraautoclub.org
  • www.Serebrov.net
  • www.Shlifovka.com
  • www.Skaterider.com
  • www.Softfacade.com
  • www.Spb-guide.info
  • www.Stavki.net
  • www.Surgeryserver.com
  • www.Synstudio.net
  • www.Tds74.com
  • www.Test05.info
  • www.Tovop.com
  • www.Transunion.biz
  • www.Unionpost.net
  • www.Vair.biz
  • www.Varnoff.com
  • www.Varnoff.net
  • www.Varnoff.org
  • www.Vipsaercher.com
  • www.Web-programmer.net
  • www.Webext.info
  • www.World-express-mail.com
  • www.Worldartphoto.com
  • www.X-cyberdropz.com
  • www.Zovdrev.com
  • www.Zverevschool.net

Update 8-Dec-05: The webmaster of Softfacade.com contacted me to assert that he is not connected with this fraudulent activity. I have no evidence to say that Softfacade.com is connected to the scam, and it is quite possible that they are an innocent customer.

However, the host idghost.com still provides hosting services for fraudulent, phishing sites and what appear to be child pornography sites on 66.235.184.248 operated by HopOne Internet Corporation. The following sites are on that server, although some may be innocent parties.

  • www.Aboutpc.net
  • www.Appn.net
  • www.Belkindecor.com
  • www.Benovshe.com
  • www.Cash-out.biz
  • www.Chelaudit.com
  • www.Credoltd.com
  • www.Crystal-engine.com
  • www.Crystal-host.com
  • www.Crystal-office.net
  • www.Crystal-support.com
  • www.Crystal-systems.org
  • www.Delgbest.biz
  • www.Delgbest.com
  • www.Denisenko.org
  • www.Discovercaucasus.com
  • www.Dnipro.biz
  • www.Ecomers.net
  • www.Ecommers.net
  • www.Embrate.com
  • www.Energocomfort.com
  • www.Erlen.biz
  • www.Exchangelance.com
  • www.Ffegroup.org
  • www.Fikrataliyev.com
  • www.Filosof.info
  • www.Garant-nn.com
  • www.Gayart.org
  • www.Globalfinancesupport.org
  • www.Good-load.com
  • www.Guarex.com
  • www.Gwor.net
  • www.Idg-news-updater.com
  • www.Idghost.com
  • www.Infsystem.com
  • www.Ingan-art.com
  • www.Ingan-art.net
  • www.Instantexchange.biz
  • www.Inter-parts.net
  • www.Johnnsoft.com
  • www.Kiteco.net
  • www.Landz.info
  • www.Laydors.com
  • www.Lutic.com
  • www.Lws-studio.net
  • www.Mk-game.net
  • www.Mmandarin.com
  • www.Mtb-forum.net
  • www.Mykaz.com
  • www.Mykaz.net
  • www.Net-lola.net
  • www.Postexpress.biz
  • www.Rasimsafe.com
  • www.Rt-host.us
  • www.Rus-host.org
  • www.Samaraautoclub.org
  • www.Serebrov.net
  • www.Shlifovka.com
  • www.Silencedead.com
  • www.Skaterider.com
  • www.Spb-guide.info
  • www.Sts-az.com
  • www.Surgeryserver.com
  • www.Sweet-lola.org
  • www.Tds74.com
  • www.Unionpost.net
  • www.Uswebstyle.com [see below]
  • www.Vair.biz
  • www.Varnoff.com
  • www.Varnoff.net
  • www.Varnoff.org
  • www.Vipmts.com
  • www.Waterengines.net
  • www.Wearethewiners.com
  • www.Web-brand.net
  • www.Web-programmer.net
  • www.Webbystyle.com
  • www.Westernexpress.biz
  • www.Winegiftservice.com
  • www.Winerssystem.com
  • www.World-express-mail.com
  • www.Xxxfp.com
  • www.Zovdrev.com
  • www.Zverevschool.net

Note: uswebstyle.com expired and was subsequently re-registered by an innocent party.


Ship & Pay International (shipandpay.com)

Claims to have been founded in 2003, but the domain was only registered in July 2004. Hosted on 219.153.14.58 in China, a site that has been blacklisted many, many times before. For a while, TransferGate.com was hosted on the same server. Again. the name Robert Soloway is connected with this scam site.

Content is largely copied from the innocent skynet.net site

The address is listed as:

    Ship & Pay International
    7760 France Avenue South
    Minneapolis, MN 55435
    United States

Unusually, the domain name matches the fake contact address on the site. However, like the other sites mentioned here, this is a fraud. You can read more details here at joewein.de.

    Registrant:
     Ship & Pay International
     7760 France Avenue South
     Minneapolis, MN 55435
     US

     Domain name: SHIPANDPAY.COM

     Administrative Contact:
        Reynolds, David  reg@bp-dns.com
        7760 France Avenue South
        Minneapolis, MN 55435
        US
        +1 (651) 286-0973
     Technical Contact:
        Reynolds, David  reg@bp-dns.com
        7760 France Avenue South
        Minneapolis, MN 55435
        US
        +1 (651) 286-0973

     Registrar of Record: TUCOWS, INC.
     Record last updated on 25-Apr-2005.
     Record expires on 07-Jul-2005.
     Record created on 07-Jul-2004.

     Domain servers in listed order:
        NS1.SHIPANDPAY.COM   219.153.14.58
        NS2.SHIPANDPAY.COM   219.153.14.58

     Domain status: ACTIVE

 Ship & Pay International


Argo Post Company (argopost.com)

Claims to have been founded in 1999, however the domain was registered in October 2004. Hosted on 69.72.179.175, a server belonging to Pegasus Web Technologies of New Jersey.

Contact address claims to be:

    Argo Post Company
    Vladimirskaya Street, 27
    Kiev, 03027
    Ukraine
    Tel: 380 (44) 235-97-12
    U.S. Fax: (610) 561-5907

However, the domain is registered to an individual in the United States. The content is a variation on all the other sites listed here and is almost identical in content to the fraudulent shipandpay.com site.

Be in no doubt that this site is fraudulent. The registration details (with fake contact names) are:

    Registration Service Provided By: Registerfly.com
    Contact: support@registerflysupport.com
    Visit: http://www.RegisterFly.com


    Registrant Contact:
       NA
       Dick Reich (dickrch@mailcan.com)
       +1.4062529256
       Fax: none
       408 Sun Valley Rd
       Billings,  59105
       US

    Administrative Contact:
       NA
       Dick Reich (dickrch@mailcan.com)
       +1.4062529256
       Fax: none
       408 Sun Valley Rd
       Billings,  59105
       US

    Technical Contact:
       NA
       Dick Reich (dickrch@mailcan.com)
       +1.4062529256
       Fax: none
       408 Sun Valley Rd
       Billings,  59105
       US

    Billing Contact:
       NA
       Dick Reich (dickrch@mailcan.com)
       +1.4062529256
       Fax: none
       408 Sun Valley Rd
       Billings,  59105
       US

    Status: Locked

    Name Servers:
       ns3.anonwebhost.com
       ns4.anonwebhost.com
      
    Creation date: 07 Oct 2004 14:51:17
    Expiration date: 07 Oct 2005 14:51:17

 Argo Post Company


Easy Pay Company (easypayco.com)

This site is an clone of the "Argo Post Company" site, hosted on 64.202.123.183, a server belonging to Appian Communications in Michigan.

Contact address claims to be:

    Easy Pay Company
    Krasnova Street, 108
    Kiev, 03025
    Ukraine
    Tel: 38 (044) 464-9762
    USA Fax: (740) 931-2124

The domain contact is a fake address in California howver. As with the "Argo Post" site, this is clearly fraudulent. The "company" claims to have been set up in 1999, but the domain only registered in October 2004.

The contact details are clearly fake:

    Registrant Contact:
       NA
       Matthew Smith (matsmith@airpost.net)
       +1.4155199351
       Fax: none
       357 Colby Street
       Oakland,  94618
       US

    Administrative Contact:
       NA
       Matthew Smith (matsmith@airpost.net)
       +1.4155199351
       Fax: none
       357 Colby Street
       Oakland,  94618
       US

    Technical Contact:
       NA
       Matthew Smith (matsmith@airpost.net)
       +1.4155199351
       Fax: none
       357 Colby Street
       Oakland,  94618
       US

    Billing Contact:
       NA
       Matthew Smith (matsmith@airpost.net)
       +1.4155199351
       Fax: none
       357 Colby Street
       Oakland,  94618
       US

    Status: Locked

    Name Servers:
       ns41.hostforweb.net
       ns42.hostforweb.net

 

 Easy Pay Company


Finance-Pilot Company  (finance-pilot.com)

An almost exact clone of the fraudulent shipandpay.com site, hosted on 64.202.163.214, a server belonging to GoDaddy Inc in Arizona.

Contact address claims to be:

    Latvia
    Riga
    Lavsala 49-15
    835007
    Tel. #: +371 (7) 520092
    USA Tel. #: (718) 504-6111

The domain contact address here is Ohio, so it doesn't match. Again, this "company" claims to have been set up in 2001, but the domain only registered in October 2004.

More faked contact details:

    Registrant:
       JAE LEE
       401college ave. box 152
       Ashland, Ohio 44805
       United States

       Registered through: GoDaddy.com
       Domain Name: FINANCE-PILOT.COM
          Created on: 11-Oct-04
          Expires on: 11-Oct-05
          Last Updated on: 11-Oct-04

       Administrative Contact:
          LEE, JAE  vvroilers@hotmail.com
          401college ave. box 152
          Ashland, Ohio 44805
          United States
          4191772911      Fax --
       Technical Contact:
          LEE, JAE  vvroilers@hotmail.com
          401college ave. box 152
          Ashland, Ohio 44805
          United States
          4191772911      Fax --

       Domain servers in listed order:
          WSC1.JOMAX.NET
          WSC2.JOMAX.NET

 Finance-Pilot Company


International Global Courier Service Inc  (igcs.us)

A copy of the fraudulent transelectronics.net site, hosted on 65.75.191.98 by Managed Solutions Group, Inc of California. Specifically, that IP address seems to be allocated to one C. Koehler of Fish Creek, Wisconsin. We assume that C. Koehler is a small web host with no connection to this fraud.

There are no contact details on the site, and the domain contact information is fake. Given that this is a clone of the fraudulent transelectronics.net site, then you should assume that the "International Global Courier Service" site is also fake and is involved in the business of money laundering or check fraud.

The faked contact details are:

    Domain Name:                                 IGCS.US
    Domain ID:                                   D5810594-US
    Sponsoring Registrar:                        TUCOWS INC.
    Domain Status:                               ok
    Registrant ID:                               TUH2XZ3DCWRCA5JH
    Registrant Name:                             IGCS IGCS
    Registrant Organization:                     IGCS
    Registrant Address1:                         IGCS.US
    Registrant City:                             NewYork
    Registrant State/Province:                   NY
    Registrant Postal Code:                      11003
    Registrant Country:                          United States
    Registrant Country Code:                     US
    Registrant Phone Number:                     +1.8002345678
    Registrant Email:                            support@igcs.us
    Registrant Application Purpose:              P1
    Registrant Nexus Category:                   C21
    Administrative Contact ID:                   TUR1X2OFO6J7FRJM
    Administrative Contact Name:                 IGCS IGCS
    Administrative Contact Organization:         IGCS
    Administrative Contact Address1:             IGCS.US
    Administrative Contact City:                 NewYork
    Administrative Contact State/Province:       NY
    Administrative Contact Postal Code:          11003
    Administrative Contact Country:              United States
    Administrative Contact Country Code:         US
    Administrative Contact Phone Number:         +1.8002345678
    Administrative Contact Email:                support@igcs.us
    Administrative Application Purpose:          P1
    Administrative Nexus Category:               C21
    Billing Contact ID:                          TUDKFDY9DSI3F1T7
    Billing Contact Name:                        IGCS IGCS
    Billing Contact Organization:                IGCS
    Billing Contact Address1:                    IGCS.US
    Billing Contact City:                        NewYork
    Billing Contact State/Province:              NY
    Billing Contact Postal Code:                 11003
    Billing Contact Country:                     United States
    Billing Contact Country Code:                US
    Billing Contact Phone Number:                +1.8002345678
    Billing Contact Email:                       support@igcs.us
    Billing Application Purpose:                 P1
    Billing Nexus Category:                      C21
    Technical Contact ID:                        TUEVSEXYJJMNKL0A
    Technical Contact Name:                      IGCS IGCS
    Technical Contact Organization:              IGCS
    Technical Contact Address1:                  IGCS.US
    Technical Contact City:                      NewYork
    Technical Contact State/Province:            NY
    Technical Contact Postal Code:               11003
    Technical Contact Country:                   United States
    Technical Contact Country Code:              US
    Technical Contact Phone Number:              +1.8002345678
    Technical Contact Email:                     support@igcs.us
    Technical Application Purpose:               P1
    Technical Nexus Category:                    C21
    Name Server:                                 NS1.SAFEDNS.BIZ
    Name Server:                                 NS2.SAFEDNS.BIZ
    Created by Registrar:                        TUCOWS INC.
    Last Updated by Registrar:                   TUCOWS INC.
    Domain Registration Date:                    Mon Apr 05 12:04:22 GMT 2004
    Domain Expiration Date:                      Tue Apr 04 23:59:59 GMT 2006
    Domain Last Updated Date:                    Wed Apr 06 20:45:26 GMT 2005

SAFEDNS.BIZ is a well-known provider for spam/scam sites (see here).

 igcs.us


Interway GmbH (interway-solutions.com)

Hosted on 69.50.188.132 by Atrivo in Santa Rosa, California. This claims to be a German company founded in 2000, but the domain was only registered in March 2005.

Contact address claims to be:

    Germany
    Faradayweg 4-6,
    14195 Berlin

The domain contact is in Munich, but neither address can be verified as genuine. The contact email addresses give for both the domain and site are at fusemail.com - essentially a free webmail service like Hotmail. No respectable business would use a mail service like this.

You would also expect a German company to host their servers in Germany. The server 69.50.188.132 is used primarily to host hard core pornography, adult sex toys, and Rx affiliate sites. It is inconceivable that a blue chip German company would use a host such as this. These other sites are typically registered to people in Eastern Europe, Cuba or South East Asia.

Other sites on 69.50.188.132 include:

 

 Interway GmbH

  • www.Airteens.com
  • www.All-find.org
  • www.Aretech.org
  • www.Asianjam.com
  • www.Big-search.org
  • www.Blacknature.com
  • www.Coolvids.net
  • www.Dotsidegroup.com
  • www.Drspider.com
  • www.Fhg2.com
  • www.Fhgcomposer.com
  • www.Fucksuck.biz
  • www.Gay-planet.biz
  • www.Gay-room.com
  • www.Goldensearch.biz
  • www.Group-place.com
  • www.Handjobforme.com
  • www.Hqfuck.net
  • www.Indianmatrix.com
  • www.Interway-solutions.com
  • www.Kristallsoft.com
  • www.Latinalert.com
  • www.Maxdial.net
  • www.Metrocharter.org
  • www.Momspornmovies.com
  • www.Momspornpics.com
  • www.Oralfuns.com
  • www.Pillsgalaxy.com
  • www.Rocktgp.com
  • www.Sdtteens.com
  • www.Search-world.biz
  • www.Sex-toy-adult-store.com
  • www.Sexti.net
  • www.Shemalesfun.com
  • www.Smart-search.biz
  • www.Swansex.com
  • www.Tigerporn.net
  • www.Titfuns.com
  • www.Tri-z.com
  • www.Usaporn.org
  • www.Vodkababes.com


Again, we have some clearly fake contact details indicating that domain services are being supplied by a company in Estonia.

    Registration Service Provided By: ESTDOMAINS
    Contact: support@estdomains.com
    Website: http://www.estdomains.com
    Abuse Desk Email Address: abuse@estdomains.com

    Domain Name: INTERWAY-SOLUTIONS.COM

    Registrant:
        UMC
        Alexander Koldakov        (umc.group@fusemail.com)
        Bahnhofsplatz 179
        Munich
        null,12905
        DE
        Tel. +49.6925577305

    Creation Date: 02-Mar-2005 
    Expiration Date: 02-Mar-2006

    Domain servers in listed order:
        ns11.esthost.com
        ns12.esthost.com

    Administrative Contact:
        UMC
        Alexander Koldakov        (umc.group@fusemail.com)
        Bahnhofsplatz 179
        Munich
        null,12905
        DE
        Tel. +49.6925577305

    Technical Contact:
        UMC
        Alexander Koldakov        (umc.group@fusemail.com)
        Bahnhofsplatz 179
        Munich
        null,12905
        DE
        Tel. +49.6925577305

    Billing Contact:
        UMC
        Alexander Koldakov        (umc.group@fusemail.com)
        Bahnhofsplatz 179
        Munich
        null,12905
        DE
        Tel. +49.6925577305

    Status:ACTIVE


Taleongroup Company  (taleongroup.com)

Hosted on 64.202.163.213 at GoDaddy, the next IP address along from the fraudulent finance-pilot.com site, this is a pretty amateur mismash of copied elements.

Contact details claim to be:

    Office #1
    United States of America
    Taleongroup Inc.
    2271 Broadway
    New York, NY
    10028
    Fax/Phone# +(718) 504-6111

    Office #2
    Latvia
    Taleongroup Inc.
    Monteanapolis 381-19
    L3W 3Y7
    Fax/Phone# +(371) 392-3992

The "Latvia" address is clearly bogus. The New York address is almost identical to the fraudulent unionpost.net site.

Again, this site claims to have been set up in 1999, but the domain was only registered in December 2004.

The contact details are almost definitely bogus:

    Registrant:
       Sam Yoon
       900 South washington st #202
       Falls Church, Virginia 22046
       United States

       Registered through: GoDaddy.com
       Domain Name: TALEONGROUP.COM
          Created on: 24-Dec-04
          Expires on: 24-Dec-05
          Last Updated on: 05-Jan-05

       Administrative Contact:
          Yoon, Sam  buergameister@aol.com
          900 South washington st #202
          Falls Church, Virginia 22046
          United States
          2121928191
       Technical Contact:
          Yoon, Sam  buergameister@aol.com
          900 South washington st #202
          Falls Church, Virginia 22046
          United States
          2121928191

       Domain servers in listed order:
          WSC1.JOMAX.NET
          WSC2.JOMAX.NET

 Taleongroup Company


TermoZone GmbH  (termozone.org)

Hosted by Affinity.com of California on a large server located at 207.150.192.12. This site is an almost exact copy of the fraudulent Interway GmbH site.

Contact details claim to be:

    Empire State Building
    350 5th Ave, New York
    NY 10118, USA
    USA Tel #: 212-381-0110
    USA Fax #: 646-619-4344

However, "GmbH" indicates that this is supposed to be a German company, and yet there are no German contact details whatsover. The TermoZone site alleges that is was set up in 2000, but the domain was only registered in December 2004.

This site uses the SpyLog tracking system to monitor visitors, a tool used almost exclusively by Russian webmasters.

Contact details claim to be:

    Domain ID:D105304274-LROR
    Domain Name:TERMOZONE.ORG
    Created On:07-Dec-2004 22:36:10 UTC
    Last Updated On:06-Feb-2005 04:02:54 UTC
    Expiration Date:07-Dec-2005 22:36:10 UTC
    Sponsoring Registrar:Network Solutions LLC (R63-LROR)
    Status:CLIENT TRANSFER PROHIBITED
    Registrant ID:38787856-NSI
    Registrant Name:Lisa McNitt
    Registrant Organization:
    Registrant Street1:HC 61 4043
    Registrant Street2:
    Registrant Street3:
    Registrant City:RAMAH
    Registrant State/Province:NM
    Registrant Postal Code:87321
    Registrant Country:US
    Registrant Phone:+1.6457464756
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant Email:carmody45@yahoo.com
    Admin ID:38787856-NSI
    Admin Name:Lisa McNitt
    Admin Organization:
    Admin Street1:HC 61 4043
    Admin Street2:
    Admin Street3:
    Admin City:RAMAH
    Admin State/Province:NM
    Admin Postal Code:87321
    Admin Country:US
    Admin Phone:+1.6457464756
    Admin Phone Ext.:
    Admin FAX:
    Admin FAX Ext.:
    Admin Email:carmody45@yahoo.com
    Tech ID:19867907-NSI
    Tech Name:Affinity Hosting, LLC
    Tech Organization:Affinity Hosting, LLC
    Tech Street1:16611 S. Vermont Ave
    Tech Street2:
    Tech Street3:
    Tech City:Gardena
    Tech State/Province:CA
    Tech Postal Code:90247
    Tech Country:US
    Tech Phone:+1.9543348460
    Tech Phone Ext.:
    Tech FAX:
    Tech FAX Ext.:
    Tech Email:contact@AHNET.NET
    Name Server:NS1.HOSTSAVE.COM
    Name Server:NS2.HOSTSAVE.COM
    Name Server:NS3.HOSTSAVE.COM

 TermoZone


Post Financial Company  (post-service.org)

A clone of the fraudulent finance-pilot.com and shipandpay.com sites. Hosted on 67.18.147.194 by ThePlanet.com in Dallas, Texas.

Contact details claim to be:

    Post Financial Company
    2259 Broadway
    New York, NY
    10024
    Fax/Phone# (718) 524-2096

Which is the same address as the fraudulent unionpost.net website. Claims to have been founded in 1999, but the domain name was only registered in June 2004 to a fake address in California:

    Domain ID:D104500511-LROR
    Domain Name:POST-SERVICE.ORG
    Created On:06-Jun-2004 10:08:23 UTC
    Last Updated On:05-Feb-2005 01:18:44 UTC
    Expiration Date:06-Jun-2005 10:08:23 UTC
    Sponsoring Registrar:Go Daddy Software, Inc. (R91-LROR)
    Status:CLIENT DELETE PROHIBITED
    Status:CLIENT RENEW PROHIBITED
    Status:CLIENT TRANSFER PROHIBITED
    Status:CLIENT UPDATE PROHIBITED
    Registrant ID:GODA-06854835
    Registrant Name:Barbara Foster
    Registrant Organization:
    Registrant Street1:6601 Almond Valley Way
    Registrant Street2:
    Registrant Street3:
    Registrant City:Quartz Hill
    Registrant State/Province:California
    Registrant Postal Code:93536
    Registrant Country:US
    Registrant Phone:+1.6615727929
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant Email:santillo34@earthlink.net
    Admin ID:GODA-26854835
    Admin Name:Barbara Foster
    Admin Organization:
    Admin Street1:6601 Almond Valley Way
    Admin Street2:
    Admin Street3:
    Admin City:Quartz Hill
    Admin State/Province:California
    Admin Postal Code:93536
    Admin Country:US
    Admin Phone:+1.6615727929
    Admin Phone Ext.:
    Admin FAX:
    Admin FAX Ext.:
    Admin Email:santillo34@earthlink.net
    Tech ID:GODA-16854835
    Tech Name:Barbara Foster
    Tech Organization:
    Tech Street1:6601 Almond Valley Way
    Tech Street2:
    Tech Street3:
    Tech City:Quartz Hill
    Tech State/Province:California
    Tech Postal Code:93536
    Tech Country:US
    Tech Phone:+1.6615727929
    Tech Phone Ext.:
    Tech FAX:
    Tech FAX Ext.:
    Tech Email:santillo34@earthlink.net
    Name Server:NS1.SSLCATACOMBNETWORKING.COM
    Name Server:NS2.SSLCATACOMBNETWORKING.COM

Post Financial Company


 Other domains used

A number of other domains have been used for this scam in the past, including:

  • e-c0mmerce.com
  • express-delivery.org
  • farix.org
  • lufthansa-aircargo.net
  • lufthansa-air-express.com
  • post-pro.org
  • postforward.org
  • stbworldwide.org
  • umcpfs.com
  • wpdelivery.org

 Clearly some of these violate trademarks which may explain why they are no longer in use.

 

 Subj: Shopping and Services

 

 home   technical   diary   webmaster stuff   orange book   shop   contact   links   your privacy