Thursday, September 30, 2010

vpptransactions.org

vpptransactions.org FAKE FRAUD SCAM
Remember, the scammers are asking for your eBay username and password on that site.
If you use them the scammers will hijack your eBay account.
http://www.vpptransactions.org/ is being used to direct intended victims to this site:
http://67.228.184.3/sys/classes/livechat.html
Which is a fake eBay Live Help site, also mentioned here:
http://netscammers.blogspot.com/2010/07/fake-ebay-vpp-online-support.html
More spoof sites here:
http://netscammers.blogspot.com/2010/04/spoof-sites.html

67.228.184.3
resolves to what appears to be a hacked site:
www.weeklyhomebuyerslist.com
A call to the number on the site went unanswered.

Here is what the email looks like from:





Congratulations - You Are Approved To Buy!
Offer for buying item: 2006 Honda Gold Wing
Transaction VPP-30098023842
You are receiving this email because the seller of this item have sent you an offer for buying it. The seller (Dan Stern) is a member of eBay's Vehicle Purchase Protection Program and also, if you accept this offer, you will be protected by eBay's Vehicle Purchase Protection Program. Currently, the seller can provide a Vehicle Purchase Protection Coverage up to US $20,000.00. Transactions with this eBay seller are covered by purchase protection against fraud and description errors.

How does this works?
1. If you accept this offer you need an eBay account and you must contact eBay VPP Online Support. If you don't have an eBay account click here to register. To accept this offer and contact eBay VPP Online Support click only the blue button below.
2. The buyer receives an invoice and complete the money transfer to Vehicle Purchase Protection Program Department. After the payment is received by eBay Vehicle Purchase department and approved the seller will initiate the delivery. The seller has three business days to send the buyer and eBay the tracking number of the shipment. If no tracking number is provided, a full refund is immediately sent to the buyer
3. Buyer receives the merchandise and has five days to inspect it. If it is complete and as described, the buyer should accept the merchandise. If he refuses the merchandise, the buyer must ship the merchandise back to the seller within three business days.The seller will pay for shipping back the merchandise.
4. After the inspection period is over ( 5 business days ), the buyer must contact us with the result of the inspection. If the buyer refuses the merchandise, the refund will be sent to the buyer after the tracking number for the returned shipment is verified. Should you need a refund for this transaction, the insured amount will be taken from the seller's purchase protection account and sent to you. The refund is sent to your bank account, or by check or money order. The way you are refunded is at your choice. You have 30 days from the above verification date to request a refund. Refund requests are processed within 3 days. The insurer of this transaction is eBay Inc., located at 2145 Hamilton Avenue, San Jose, CA 95125, United States of America. The account is managed by eBay's SquareTrade center. This transaction is supervised by eBay's SafeHarbor team.

Someone left a post, and I thank you, in the comments area below.
I cannot post the company's other phone number without their permission.
I did call them and the person that is in charge is supposed to call back.

Yes I am correct, the fake site is using the website IP 67.228.184.3 for www.weeklyhomebuyerslist.com
This means the site is compromised and the scammers placed the fake live chat files there.
Its not rocket science.

Address lookup


canonical nameweeklyhomebuyerslist.com.
aliases
addresses67.228.184.3

Domain Whois record

Queried whois.internic.net with "dom weeklyhomebuyerslist.com"...
Domain Name: WEEKLYHOMEBUYERSLIST.COM
   Registrar: GODADDY.COM, INC.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: NS1.PERFORMANCEHOSTING.NET
   Name Server: NS2.PERFORMANCEHOSTING.NET
   Status: clientDeleteProhibited
   Status: clientRenewProhibited
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Updated Date: 09-oct-2006
   Creation Date: 30-jan-2000
   Expiration Date: 30-jan-2013

Oh! what a tangled web we weave
When first we practise to deceive!
Sir Walter Scott
NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet.

Leia Mais…

Yahoo Loves Scammers

http://automotive-ltd-transports.com/
http://automotive-limited-transport.com/
data here:
http://forum.aa419.org/viewtopic.php?t=45935
(same scammers)
2 Yahoo registrations for the same domain name:
Thread here:
http://forum.aa419.org/viewtopic.php?t=46788
Database entry here:
http://db.aa419.org/fakebanksview.php?key=51525
Domain Name.......... automotive-ltd-transports.com
Creation Date........ 2010-09-16
Registration Date.... 2010-09-16
Expiry Date.......... 2011-09-16
Organisation Name.... automotive-ltd-transports
Organisation Address. PO Box 61359
Organisation Address.
Organisation Address. Sunnyvale
Organisation Address. 94088
Organisation Address. CA
Organisation Address. US
The newer one:

Domain Name: AUTOMOTIVE-LTD-TRANSPORTS.COM
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Status: clientTransferProhibited
   Updated Date: 01-oct-2010
   Creation Date: 01-oct-2010
   Expiration Date: 01-oct-2011

http://www.automotive-ltd-transport.com/
is a fraud site  which has been registered by MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE and hosted by Yahoo.com FIVE TIMES with FIVE different registrations in a little over 30 days.


Domain: automotive-ltd-transport.com
Cache Date: 2010-08-24
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Server: whois.melbourneit.com
Created: 2010-08-23
Updated: 2010-08-23
Expires: 2011-08-23



Domain: automotive-ltd-transport.com
Cache Date: 2010-09-06
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Server: whois.melbourneit.com
Created: 2010-09-05
Updated: 2010-09-05
Expires: 2011-09-05




Domain: automotive-ltd-transport.com - Domain History
Cache Date: 2010-09-14
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Server: whois.melbourneit.com
Created: 2010-09-13
Updated: 2010-09-13
Expires: 2011-09-13


Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Name Server: YNS1.YAHOO.COM
Name Server: YNS2.YAHOO.COM
Status: clientTransferProhibited
Updated Date: 29-sep-2010
Creation Date: 29-sep-2010
Expiration Date: 29-sep-2011

Address lookup


canonical nameautomotive-ltd-transport.com.
aliases
addresses67.195.145.142
67.195.145.141

Domain Whois record

Queried whois.internic.net with "dom automotive-ltd-transport.com"...
Domain Name: AUTOMOTIVE-LTD-TRANSPORT.COM
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: YNS1.YAHOO.COM
   Name Server: YNS2.YAHOO.COM
   Status: clientTransferProhibited
   Updated Date: 06-oct-2010
   Creation Date: 06-oct-2010
   Expiration Date: 06-oct-2011

You can see for yourself here:
http://forum.aa419.org/viewtopic.php?t=46313
Here is what the scammers are using for a site template:





Oh! what a tangled web we weave
When first we practise to deceive!
Sir Walter Scott
NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet.

Leia Mais…

secured-etransfers.com

secured-etransfers.com  SCAM FRAUD FAKE
http://www.secured-etransfers.com/

This site is targeting jewelry sellers on eBay.
Most commonly the victims are asked to send the items to Europe and mark the items with a reduced value on the customs forms.
Report the person who is asking you to use the site.
They are the scammer who is also running the fake escrow.



secured-etransfers.com has the same contact information as 53 old fake escrow sites using this design.
This template was used in 2005.



The registrant of this site is listed as:
Balan Marian
Aleea Agigea Nr3
Bucuresti, Bucuresti 032736
RO
I am quite sure this information is fake.
If you have any information on this scam please post in the "comments" area below.

Leia Mais…