Just how dumb, or perhaps ingenious is a cybecriminal that would host his money mule recruitment operations using Yahoo!'s Web Hosting services? Is the reputable hosting location, worth the risk of having their campaigns taken down much easily than if there were hosting them on the bad reputation block, and would have never bothered replying to abuse notifications?
Whatever the motivation of the people behind this money mule recruitment campaign, they are currently using Yahoo! Web Hosting. Domains in question, including contact details:
555 11th St NW
Washington, DC 20004
Phone numbers:
(866) 863-6438
(202) 355-6678 (FAX)
Postal address:
Stevens Financial Solutions
Bahnhofstrasse 32
CH-8001 Zurich, Switzerland
Value Added Tax Nr.: 428 643
Phones and fax no's:
Phone: +41 (43) 219-2551
Fax 1: +41 (43) 219-2551
Fax 2: +1 (866) 703-7622 US Toll-Free
- Waters & Co. LLP - watersllp.com - 216.39.57.104
400 East Pratt Street,
Baltimore, MD 21202
United States
Phone numbers:
(443) 524-9221
(443) 524-9221 (FAX)
- Nilson Financial Solutions - nilson-fs.com - 98.136.92.76; 98.136.92.77; 98.136.92.78
Nilson Financial Solutions
Bahnhofstrasse 32
CH-8001 Zurich, Switzerland
Value Added Tax Nr.: 428 643
Phones and fax no's:
Phone: +41 (43) 219-2551
Fax 1: +41 (43) 219-2551
Fax 2: +1 (866) 472-0560 US Toll-Free
Upon submitting the personal details, the potential money mule is required to send a scanned copy of their ID or driving license:
- "Familiarize yourself with all clauses of the contract. Fill the contract and send us a scanned copy of it to the e-mail address info@watersllp.com or by fax: (443) 524-9221. The contract becomes valid from the moment of the reception of the correctly filled copy of the contract. You should be familiar with that the validity of the contract in the electronic form is completely identical to the contract signed at personal presence of both parties.* To pass the procedure of identity verification in order to prevent fraudulent registrations, you are required to send a scan of valid ID or a driving license to the e-mail: info@watersllp.com or by fax: (443) 524-9221. We guarantee full confidentiality of your personal information, more information on this matter you will find in our Privacy Policy PLEASE LET US KNOW BY EMAIL WHEN YOU WILL FAX BACK/EMAIL AS ATTACHEMENT THE CONTRACT AND APPLICATION FORM WITHIN 48 HOURS."
Related coverage of money laundering in the context of cybercrime:
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002
This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.
No comments:
Post a Comment