Money-mule recruitment site, looking for human "mules" to help criminals launder their spam, phishing and carding monies.

All hosting on these addresses appears to be controlled by Russian cybercriminals.

"Hello!




My name is James Gordon, I am the manager of House of Art Development Company. Our company is looking for personnel for the position of Financial Manager. I reviewed your resume on Careerbuilder.com and decided that you are a proper candidate for this post. The job I want to propose is not difficult and can be performed as additional work for your regular job.

Requirements:
1. To spend time in internet minim two hours a day.
2. Ability to spend no less than two hours a day to perform money operations with your bank.

Our company works with remote clients and many of them, when pay for their order to our executives, prefer to pay via wire or ACH transfers. Many customers use these systems as their bank accounts belong to companies and orders are often corporative. Many order executives are individual employers and it is suitable for them to receive moneygram transfers or transfers on their personal accounts in other countries. So we looks for personnel who can represent interests of both sides, make statistics and deal with documents. Besides, you will have training with our managers of personnel training and you will learn all work details and how to behave with clients if necessary. You will get your personal virtual room in our website and we will teach you rules of use and how to manage with every deal among customer and order executive.

To start work you should write a confirmation to my e-mail: contact@art-development.biz
After this you can register on our web-site, then Iâll make an access to your personal room in our web-site and explain all details and nuances of the work. After this you will sign a contract and then you can earn your first profit during first week after contract signing. Also you always can ask questions to me: (323) 284-5175

Go to www.art-development.biz to study our companyâs activity.

You salary - from $2,000.00 till $3,000.00 in the first month, your profit will be formed from number of deals you take part and the main profit factor depends on clientsâ stream. That why I cannot guarantee you a high income in first months, but as statistics says $2,000.00 - $3,000.00 this is a minimum which you will have in your pocket on average.

Yours sincerely,

James Gordon
House of Art Development
(323) 319-6447
www.art-development.biz"




[whois.neulevel.biz]
Domain Name: ART-DEVELOPMENT.BIZ
Domain ID: D20531470-BIZ
Sponsoring Registrar: DIRECT INFORMATION PVT LTD DBA PUBLICDOMAINREGISTRY.COM
Sponsoring Registrar IANA ID: 303
Domain Status: ok
Registrant ID: DI_7084044
Registrant Name: Vadim Kotovich
Registrant Organization: N/A
Registrant Address1: st. Klubnichnuy 3
Registrant City: Odessa
Registrant State/Province: Odessa Oblast
Registrant Postal Code: 65000
Registrant Country: Ukraine
Registrant Country Code: UA
Registrant Phone Number: +38.0503167634
Registrant Email: turubar_82@hotmail.com
Administrative Contact ID: DI_7084044
Administrative Contact Name: Vadim Kotovich
Administrative Contact Organization: N/A
Administrative Contact Address1: st. Klubnichnuy 3
Administrative Contact City: Odessa
Administrative Contact State/Province: Odessa Oblast
Administrative Contact Postal Code: 65000
Administrative Contact Country: Ukraine
Administrative Contact Country Code: UA
Administrative Contact Phone Number: +38.0503167634
Administrative Contact Email: turubar_82@hotmail.com
Billing Contact ID: DI_7084044
Billing Contact Name: Vadim Kotovich
Billing Contact Organization: N/A
Billing Contact Address1: st. Klubnichnuy 3
Billing Contact City: Odessa
Billing Contact State/Province: Odessa Oblast
Billing Contact Postal Code: 65000
Billing Contact Country: Ukraine
Billing Contact Country Code: UA
Billing Contact Phone Number: +38.0503167634
Billing Contact Email: turubar_82@hotmail.com
Technical Contact ID: DI_7084044
Technical Contact Name: Vadim Kotovich
Technical Contact Organization: N/A
Technical Contact Address1: st. Klubnichnuy 3
Technical Contact City: Odessa
Technical Contact State/Province: Odessa Oblast
Technical Contact Postal Code: 65000
Technical Contact Country: Ukraine
Technical Contact Country Code: UA
Technical Contact Phone Number: +38.0503167634
Technical Contact Email: turubar_82@hotmail.com
Name Server: NS1.NSPRIME.NET
Name Server: NS2.NSPRIME.NET
Created by Registrar: DIRECT INFORMATION PVT LTD DBA PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar: DIRECT INFORMATION PVT LTD DBA PUBLICDOMAINREGISTRY.COM
Domain Registration Date: Thu Oct 04 22:55:52 GMT 2007
Domain Expiration Date: Fri Oct 03 23:59:59 GMT 2008
Domain Last Updated Date: Sat Jan 19 20:37:28 GMT 2008




--- reading URL ART-DEVELOPMENT.BIZ
--- contacting host art-development.biz [202.44.53.30] on port 80

HTTP/1.1 200 OK
Date: Fri, 15 Feb 2008 x GMT
Server: Apache
X-Powered-By: PHP/5.2.5
Set-Cookie: 991efbb0d66e3d8793884a5e20038ba1=-; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Fri, 15 Feb 2008 11:16:42 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

337e
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Art Development - Home</title>




[whois.enom.com]

Registration Service Provided By: Rustelekom
Contact: info@rustelekom.biz

Domain name: NSPRIME.NET

Registrant Contact:

Excmo Embajador (embajador@gmail.com)
+54.74873851
Fax:
Embajada de Argentina
Kingston, ACT 2604
AR

Administrative Contact:

Excmo Embajador (embajador@gmail.com)
+54.74873851
Fax:
Embajada de Argentina
Kingston, ACT 2604
AR

Technical Contact:

Excmo Embajador (embajador@gmail.com)
+54.74873851
Fax:
Embajada de Argentina
Kingston, ACT 2604
AR

Status: Locked

Name Servers:
ns1.nsprime.net
ns2.nsprime.net

Creation date: 26 Dec 2007 14:25:23
Expiration date: 26 Dec 2008 14:25:23




$ dig @ns1.nsprime.net ART-DEVELOPMENT.BIZ ns

; <<>> DiG 9.2.4 <<>> @ns1.nsprime.net ART-DEVELOPMENT.BIZ ns
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19816
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;ART-DEVELOPMENT.BIZ. IN NS

;; ANSWER SECTION:
ART-DEVELOPMENT.BIZ. 14400 IN NS ns1.nsprime.net.
ART-DEVELOPMENT.BIZ. 14400 IN NS ns2.nsprime.net.

;; ADDITIONAL SECTION:
ns1.nsprime.net. 14400 IN A 202.44.53.30
ns2.nsprime.net. 14400 IN A 202.44.53.31

;; Query time: 256 msec
;; SERVER: 202.44.53.30#53(202.44.53.30)
;; WHEN: Fri Feb 15 11:28:05 2008
;; MSG SIZE rcvd: 116




banifs.org A 202.44.53.30
x-y-zz.org A 202.44.53.30
mail.x-y-zz.org A 202.44.53.30
ravenic.com A 202.44.53.30
froxik.com A 202.44.53.30
itv-solution.com A 202.44.53.30
bankeofscotlands.com A 202.44.53.30
sjpbanks.com A 202.44.53.30
bradford-binigley.com A 202.44.53.30
traffpoint.info A 202.44.53.30
4careers.us A 202.44.53.30
www.4careers.us CNAME 4careers.us
nsprime.net A 202.44.53.30
ns1.nsprime.net A 202.44.53.30
art-development.biz A 202.44.53.30

banifs.org
x-y-zz.org
searchingforthevhostipadres.com
bankeofscotlands.com
z-financeinc.com
bankssofscotlands.com
ravenic.com
unicajas.com
bradford-binigley.com
sjpbanks.com
abbeyinterneational.com
itv-solution.com
dominion-finance.com
ace-rentals.com
123expressinc.com
123expessinc.com
nsprime.net
z-finance-international.net
traffpoint.info
art-development.biz




[whois.apnic.net]

inetnum: 202.44.52.0 - 202.44.55.255
netname: WORLDINTH
descr: World Internetwork Co.,Ltd , Thailand.
country: TH
admin-c: LC587-AP
tech-c: CC469-AP
mnt-by: APNIC-HM
status: ASSIGNED PORTABLE
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: This object can only be updated by APNIC hostmasters.
remarks: To update this object, please contact APNIC
remarks: hostmasters and include your organisation's account
remarks: name in the subject line.
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed: hm-changed@apnic.net 20040823
changed: hm-changed@apnic.net 20040909
source: APNIC

person: Lasdsakchai Chunarom
nic-hdl: LC587-AP
e-mail: admin@win.co.th
address: 22/1 Moo2 Sumrongtai Prapradang Samutprakan 10130
phone: +66-275-59731
fax-no: +66-275-59730
country: TH
changed: admin@win.co.th 20040908
mnt-by: MAINT-NEW
source: APNIC

person: Chaiyaprug Chunarom
nic-hdl: CC469-AP
e-mail: technical@internetthai.com
address: 22/1 Moo2 Sumrongtai Prapradang Samutprakan 10130
phone: +66-275-59731
fax-no: +66-275-59730
country: TH
changed: technical@internetthai.com 20040908
mnt-by: MAINT-NEW
source: APNIC





URL: http://bankeofscotlands.com

Server IP address is 202.44.53.30 SBL63252

HTTP/1.1 302 Found
Connection: close
Date: Tue, 19 Feb 2008 x GMT
Transfer-Encoding: chunked
Location: http://www.10-million-hits.com/
Server: Apache
Content-Type: text/html
X-Powered-By: PHP/5.2.5


<!--html code here-->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Bank Of Scotland - Home - </title>



$ dig @202.44.53.30 bankeofscotlands.com

; <<>> DiG 9.2.4 <<>> @202.44.53.30 bankeofscotlands.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40969
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;bankeofscotlands.com. IN A

;; ANSWER SECTION:
bankeofscotlands.com. 14400 IN A 202.44.53.30

;; AUTHORITY SECTION:
bankeofscotlands.com. 14400 IN NS ns2.nsprime.net.
bankeofscotlands.com. 14400 IN NS ns1.nsprime.net.

;; ADDITIONAL SECTION:
ns1.nsprime.net. 14400 IN A 202.44.53.30
ns2.nsprime.net. 14400 IN A 202.44.53.31

;; Query time: 252 msec
;; SERVER: 202.44.53.30#53(202.44.53.30)
;; WHEN: Tue Feb 19 2008
;; MSG SIZE rcvd: 133



ikibesh.org A 202.44.53.30
banifs.org A 202.44.53.30
x-y-zz.org A 202.44.53.30
mail.x-y-zz.org A 202.44.53.30
www.x-y-zz.org A 202.44.53.30
ravenic.com A 202.44.53.30
froxik.com A 202.44.53.30
bankeofscotlands.com A 202.44.53.30
searchingforthevhostipadres.com A 202.44.53.30
sjpbanks.com A 202.44.53.30
bradford-binigley.com A 202.44.53.30
traffpoint.info A 202.44.53.30
4careers.us A 202.44.53.30
www.4careers.us CNAME 4careers.us
nsprime.net A 202.44.53.30
ns1.nsprime.net A 202.44.53.30
art-development.biz A 202.44.53.30



ALSO [added - SR20 - 1 March 2008]
-----------------------------------
-----------------------------------
Also luxury phone clones:
Spam for "Re:Lux ph0Ne cL0nez here.."
Spamvertized URL: http://www.vertucopies.com
'Luxury VERTU cellphone copies and clones, get hold of your own VERTU copy NOW!
http://www.vertucopies.com
p.s.: N0KIA and iPH0NE too.'

===========================================================
For the host:
"www.vertucopies.com"

NAMESERVERS listed in the root servers for vertucopies.com:
-----------------------------------------------------------
vertucopies.com NS ns1.domaindns.biz
vertucopies.com NS ns2.domaindns.biz
ns1.domaindns.biz A 202.44.53.30
ns2.domaindns.biz A 202.44.53.30

[extract from dig]
------------------
dig @202.44.53.30
www.vertucopies.com
A +noqu +noadd +noau +norec
;; flags: qr aa ra <-- AUTHORITATIVE and NON-RECURSIVE
www.vertucopies.com A 202.44.53.30
===========================================================
-----------------------------------
-----------------------------------

To have record SBL63252 (202.44.53.30/31) removed from the SBL, the Abuse/Security representative of win.co.th (or the Internet Service Provider responsible for supplying connectivity to 202.44.53.30/31) needs to contact the SBL Team by email (use this link) to explain how the spam problem has been terminated (we need to know exactly how the issue has been dealt with and that this spam problem is fully terminated). If the spam problem that caused this listing has been terminated we will normally remove the listing from the SBL without delay.

It is essential that emails to the SBL Team about this SBL listing include this exact ticket information in the email Subject:

If you are a representative of win.co.th, you also need to see: Current Live win.co.th SBL Listings