Summary
Another in a long line of "direct transfer" money mule scams [see sidebar for more information about money mule scams], Impex Consult appears to be a direct descendant of Athens Financial Group Ltd, because there is overlap in the nameservers used for the domain names.
The Spam
As in past cases, the message is presented in a GIF image, accompanied by "filter buster" text coloured to be invisible against the background.
Representative image
Sender names encountered
Capitalisation and punctuation may vary
- Impex Consult Financial Consulting Group
- Impex Consult Financial
- Impex Consult
Domain names involved
The following links have been encountered in spam, listed in order of encounter.
- http://icslt.net/
- http://icslt.com/
- http://icst.biz/
- http://icslt.cn/
- http://icslt.info/
- http://ixcslt.cn/
- http://im-consult.biz/
- http://impexconsult.net/
- http://impex-consult.biz/
- http://impexconsult.biz/
- http://imconsult.biz/
- http://imconsult.org/
- http://imcons.org/
- http://imcons.info/
- http://imcons.biz/
- http://impex-consult.org/
- http://imp-consult.com/
- http://imp-consult.net/
- http://impexconsult.org/
- http://im-consult.org/
- http://imp-consult.biz/
- http://consult-im.net/
- http://consult-imp.net/
- http://consult-im.biz/
- http://consult-imp.com/
- http://consult-im.org/
The above is not an exhaustive list of involved domains -- merely the ones we know about. Please post comments below if you are aware of other domains involved in this scam.
Website
Here is a snapshot of the website taken at around the time this blog entry was first posted.
Domain Information (for experts)
Limited WHOIS information is provided here, primarily for the purposes of trend analysis. I do not include most of the registrant details, since these are invariably fabricated and may point to innocent third parties.
icslt.net
Query at around 2006-12-07 16:59 UTC
Domain Name: ICSLT.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Updated Date: 08-Nov-2006
Creation Date: 08-Nov-2006
Expiration Date: 08-Nov-2007
email: richardpowell65@yahoo.com
Query at around 2006-12-08 09:02 UTC
Domain Name: ICSLT.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.FURI-CURI.COM
Name Server: NS2.FURI-CURI.COM
Updated Date: 08-Nov-2006
Creation Date: 08-Nov-2006
Expiration Date: 08-Nov-2007
email: michaelobertin@yahoo.com
icst.biz
Query at around 2006-12-08 10:49 UTC
Domain Name: ICST.BIZ
Domain ID: D15141626-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Sponsoring Registrar IANA ID: 113
Registrant ID: CNEU-142850
Registrant Email: michaelpdobeck@yahoo.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Wed Nov 08 14:53:40 GMT 2006
Domain Expiration Date: Wed Nov 07 23:59:59 GMT 2007
Domain Last Updated Date: Wed Nov 08 15:07:15 GMT 2006
icslt.cn
Query at around 2006-12-10 13:04 UTC
Domain Name: icslt.cn
ROID: 20061108s10001s91624629-cn
Registrant Name: Nellie Lucas
Administrative Email: nellielucas62@yahoo.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.furi-curi.com
Name Server:ns1.furi-curi.com
Registration Date: 2006-11-08 21:08
Expiration Date: 2007-11-08 21:08
icslt.info
Query at around 2006-12-13 16:12 UTC
Domain ID:D15271113-LRMS
Domain Name:ICSLT.INFO
Created On:08-Nov-2006 14:10:32 UTC
Last Updated On:08-Nov-2006 14:21:30 UTC
Expiration Date:08-Nov-2007 14:10:32 UTC
Sponsoring Registrar:CSL Computer Service Langenbach GmbH (R161-LRMS)
Registrant ID:CAFI-229245
Registrant Name:Ashley Cates
Registrant Email:ashleycatesss@yahoo.com
Name Server:NS2.FURI-CURI.COM
Name Server:NS1.FURI-CURI.COM
ixcslt.cn
Query at around 2006-12-21 14:37 UTC
Domain Name: ixcslt.cn
ROID: 20061220s10001s05471950-cn
Registrant Name: Dietrich Mundt
Administrative Email: wimue-tfk@hotmail.com
Sponsoring Registrar: CSL Computer Service (d.b.a. Joker.com)
Name Server:ns2.furi-curi.com
Name Server:ns1.furi-curi.com
Registration Date: 2006-12-20 06:25
Expiration Date: 2007-12-20 06:25
im-consult.biz
Query at around 2006-12-21 14:41 UTC
Domain Name: IM-CONSULT.BIZ
Domain ID: D15696367-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: 44946D208AC63138
Registrant Name: Michael Hamerlik
Registrant Email: michaelhamerlik@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 17:02:09 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 17:39:14 GMT 2006
impexconsult.net
Query at around 2006-12-22 12:41 UTC
Domain Name: IMPEXCONSULT.NET
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: NS1.FURI-CURI.COM
Name Server: NS2.FURI-CURI.COM
Updated Date: 20-dec-2006
Creation Date: 20-dec-2006
Expiration Date: 20-dec-2007
email: renejerez10@yahoo.com
impex-consult.biz
Query at around 2006-12-23 05:27 UTC
Domain Name: IMPEX-CONSULT.BIZ
Domain ID: D15696699-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: 94CBA57C384E8164
Registrant Email: jamesnemiah@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 17:11:13 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 17:39:16 GMT 2006
impexconsult.biz
Query at around 2006-12-24 01:35 UTC
Domain Name: IMPEXCONSULT.BIZ
Domain ID: D15695332-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: EFC8324F2E84F6CE
Registrant Email: nathanphillips@usa.com
Name Server: NS2.FURI-CURI.COM
Name Server: NS1.FURI-CURI.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Dec 20 15:55:39 GMT 2006
Domain Expiration Date: Fri Dec 19 23:59:59 GMT 2008
Domain Last Updated Date: Wed Dec 20 16:23:43 GMT 2006
imconsult.biz
Query at around 2007-01-07 07:44 UTC
Domain Name: IMCONSULT.BIZ
Domain ID: D15840768-BIZ
Sponsoring Registrar: ENOM, INC.
Sponsoring Registrar IANA ID: 48
Registrant ID: BB161ADE8447FC58
Registrant Email: margaretchatfield@yahoo.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Wed Jan 03 11:53:03 GMT 2007
Domain Expiration Date: Fri Jan 02 23:59:59 GMT 2009
Domain Last Updated Date: Wed Jan 03 11:55:57 GMT 2007
imconsult.org
Query at around 2007-01-07 09:17 UTC
Domain ID:D136440363-LROR
Domain Name:IMCONSULT.ORG
Created On:03-Jan-2007 12:12:41 UTC
Last Updated On:03-Jan-2007 12:15:53 UTC
Expiration Date:03-Jan-2009 12:12:41 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:A152FEA89F129699
Registrant Email:carolyncampbell2@yahoo.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM
imcons.org
Query at around 2007-01-10 00:38 UTC
Domain ID:D136738065-LROR
Domain Name:IMCONS.ORG
Created On:07-Jan-2007 21:55:06 UTC
Last Updated On:07-Jan-2007 21:57:10 UTC
Expiration Date:07-Jan-2008 21:55:06 UTC
Sponsoring Registrar:Gandi SAS (R42-LROR)
Registrant ID:O-1077339-GANDI
Registrant Email:b998b80aa7a07631a8546d249d6da20c-1079128@owner.gandi.net
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM
imcons.info
Query at around 2007-01-10 00:41 UTC
Domain ID:D16039381-LRMS
Domain Name:IMCONS.INFO
Created On:07-Jan-2007 22:10:40 UTC
Last Updated On:07-Jan-2007 22:12:36 UTC
Expiration Date:07-Jan-2008 22:10:40 UTC
Sponsoring Registrar:Gandi Sarl (R191-LRMS)
Registrant ID:O-1077351-GANDI
Registrant Email:b04842a113b683d1266373839a35fa92-1079140@owner.gandi.net
Name Server:NS2.MC-ROYAL.COM
Name Server:NS1.MC-ROYAL.COM
imcons.biz
Query at around 2007-01-10 10:19 UTC
Domain Name: IMCONS.BIZ
Domain ID: D15896055-BIZ
Sponsoring Registrar: GANDI SARL
Sponsoring Registrar IANA ID: 81
Registrant ID: O-1077336-GANDI
Registrant Email: ee551567e8231aefe0a649c80d6cc4fa-1079125@owner.gandi.net
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Created by Registrar: GANDI SARL
Last Updated by Registrar: GANDI SARL
Domain Registration Date: Sun Jan 07 21:39:51 GMT 2007
Domain Expiration Date: Sun Jan 06 23:59:59 GMT 2008
Domain Last Updated Date: Sun Jan 07 21:45:12 GMT 2007
impex-consult.org
Query at around 2007-01-15 20:13 UTC
Domain ID:D136738014-LROR
Domain Name:IMPEX-CONSULT.ORG
Created On:07-Jan-2007 21:50:54 UTC
Last Updated On:07-Jan-2007 22:03:50 UTC
Expiration Date:07-Jan-2009 21:50:54 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:12768FFE6F81FF7F
Registrant Email:robertowerssr88@yahoo.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM
imp-consult.com
Query at around 2007-01-15 20:36 UTC
Domain Name: IMP-CONSULT.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Updated Date: 12-jan-2007
Creation Date: 12-jan-2007
Expiration Date: 12-jan-2008
Registrant:
Domain Discreet
ATTN: imp-consult.com
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Email: 164a8c1f0a1e6728011f30fa5658e23d@domaindiscreet.com
imp-consult.net
Query at around 2007-01-15 20:41 UTC
Domain Name: IMP-CONSULT.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.MC-ROYAL.COM
Name Server: NS2.MC-ROYAL.COM
Updated Date: 12-jan-2007
Creation Date: 12-jan-2007
Expiration Date: 12-jan-2008
Registrant:
Domain Discreet
ATTN: imp-consult.net
P.O. Box 278
Yarmouth, NS B5A 4B2
CA
Email: 1656f9210a1e672a001304dafc828191@domaindiscreet.com
impexconsult.org
Query at around 2007-01-15 20:44 UTC
Domain ID:D136738160-LROR
Domain Name:IMPEXCONSULT.ORG
Created On:07-Jan-2007 22:03:06 UTC
Last Updated On:07-Jan-2007 22:36:54 UTC
Expiration Date:07-Jan-2009 22:03:06 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:C9A798A71E5D4173
Registrant Email:jasmineprovidence@mail.com
Name Server:NS1.MC-ROYAL.COM
Name Server:NS2.MC-ROYAL.COM
im-consult.org
Query at around 2007-01-24 18:46 UTC
Domain ID:D137869565-LROR
Domain Name:IM-CONSULT.ORG
Created On:21-Jan-2007 10:44:01 UTC
Last Updated On:24-Jan-2007 09:03:59 UTC
Expiration Date:21-Jan-2008 10:44:01 UTC
Sponsoring Registrar:Register.com Inc. (R71-LROR)
Registrant ID:7529641415d9e460
Registrant Name:Domain Discreet
Name Server:NS1.BU-BOW.COM
Name Server:NS2.BU-BOW.COM
imp-consult.biz
Query at around 2007-01-24 19:15 UTC
Domain Name: IMP-CONSULT.BIZ
Domain ID: D16082251-BIZ
Sponsoring Registrar: REGISTER.COM
Sponsoring Registrar IANA ID: 9
Registrant ID: 3801454535015505
Registrant Name: Domain Discreet
Name Server: NS1.BU-BOW.COM
Name Server: NS2.BU-BOW.COM
Created by Registrar: REGISTER.COM
Last Updated by Registrar: REGISTER.COM
Domain Registration Date: Sun Jan 21 11:03:36 GMT 2007
Domain Expiration Date: Sun Jan 20 23:59:59 GMT 2008
Domain Last Updated Date: Wed Jan 24 08:56:50 GMT 2007
consult-im.net
Query at around 2007-01-31 17:38 UTC
Domain Name: CONSULT-IM.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008
Registrant:
Domain Discreet
consult-imp.net
Query at around 2007-02-01 03:09 UTC
Domain Name: CONSULT-IMP.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008
Registrant:
Domain Discreet
consult-im.biz
Query at around 2007-02-01 11:01 UTC
Domain Name: CONSULT-IM.BIZ
Domain ID: D16243115-BIZ
Sponsoring Registrar: REGISTER.COM
Sponsoring Registrar IANA ID: 9
Registrant ID: 3999838F90DF4450
Registrant Name: Domain Discreet
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Created by Registrar: REGISTER.COM
Last Updated by Registrar: REGISTER.COM
Domain Registration Date: Wed Jan 31 16:24:54 GMT 2007
Domain Expiration Date: Wed Jan 30 23:59:59 GMT 2008
Domain Last Updated Date: Wed Jan 31 16:26:45 GMT 2007
consult-imp.com
Query at around 2007-02-01 14:07 UTC
Domain Name: CONSULT-IMP.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.TRANSFER-BK.COM
Name Server: NS2.TRANSFER-BK.COM
Updated Date: 31-jan-2007
Creation Date: 31-jan-2007
Expiration Date: 31-jan-2008
consult-im.org
Query at around 2007-02-02 18:19 UTC
Domain ID:D138652407-LROR
Domain Name:CONSULT-IM.ORG
Created On:31-Jan-2007 15:37:36 UTC
Last Updated On:31-Jan-2007 15:43:42 UTC
Expiration Date:31-Jan-2008 15:37:36 UTC
Sponsoring Registrar:Register.com Inc. (R71-LROR)
Registrant ID:4223172cdbc7a082
Registrant Name:Domain Discreet
Name Server:NS1.TRANSFER-BK.COM
Name Server:NS2.TRANSFER-BK.COM