Sunday, October 23, 2011 Betrug  FAKE BETRUG SCAM

New site:
Send complaints to:
OrgAbuseHandle: ABUSE1740-ARIN
OrgAbuseName:   ABUSE
OrgAbusePhone:  +1-404-260-8434

Der Betrug Website wird von gehostet
Bitte Datei Beschwerden hier:

Die Person, die versuchen, Ihr Geld zu stehlen, ist hier zu nennen:

Hier sind Bilder von der gefälschten Seite:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Tuesday, October 18, 2011

Grmtransport Fraud  FAKE FRAUD SCAM

193 00
Phone:+30 (210) 322 4712

For technical support and questions please contact us at the following e-mails:
  Headquarters Office:
GRM Transport is a fraud site created and run by scammers in Romania.
These scammers are targeting victims in Spain.

Other sites using the same template:

Images of the fraud site:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

2 Scam Yahoo Domains

Make that 3 domains ;)

UAE would normally signify United Arab Emirates

Both domains are associated, being created by the same scammer.
If you look at the domain registration information in the links next to the domains above,  you will see that both sites are registered to 2 different women. is registered to a man.

These scam domains are easy to spot, given that someone like me has the time and rescources to investigate them.
This situation also shows that web hosts and domain registration companies enable scams with no protection for the consumer or the credit card theft victims who's cards are used to create these fake sites.

There are no files uploaded to the domains as of 10-18-11 7am,  but I can assure you they are both fraud.
Need proof?
Contact me:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Bloomberg Express and Cargo Limited

This is an interesting site that uses text and terms from other sites.

One of the addresses used on this site:
"29 Commercial Way, London NW107XF"
Has been used on several other fake shipping sites.
Its actually a DHL office:
DHL Express (UK) Ltd  29 Commercial Way, London NW10 7XF, United Kingdom +44 844 248 0967

The term:
"was established in 1986 with one simple philosophy: that our shipper's deserve the highest level of service and reliability based on our attention to detail and knowledge of our customer's unique needs and circumstances."
has about 16 Google Search results.

The term:
"2. Delivering of your credit card, debit card to any location of your choice. You may have lost your credit card while on a journey and demand a new one from your bank, with letter of authority to us to help collect new one from your bank, be happy that it will be done in a no time and deliver to you wherever you may be. And many other reasons why you would need this tailored services. "
returns 8 results.
I'm sorry but I would never consider using a third party to ship my credit card.

Is it a scam site?
My guess is yes.
Here is a clone site:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Sunday, October 16, 2011

Twitter Phish

This morning I checked my Gmail Spam folder and found this message:

I looked at the headers
Received: by with SMTP id ks1cs22539qcb;
        Sat, 15 Oct 2011 19:36:09 -0700 (PDT)
Received: by with SMTP id a4mr27500607pbf.80.1318732568273;
        Sat, 15 Oct 2011 19:36:08 -0700 (PDT)
Return-Path: <>
Received: from ( [])
        by with ESMTP id d6si11731607pbw.115.2011.;
        Sat, 15 Oct 2011 19:36:08 -0700 (PDT)
Received-SPF: pass ( domain of designates as permitted sender) client-
Authentication-Results:; spf=pass ( domain of designates as
permitted sender); dkim=pass
X-DKIM: Sendmail DKIM Filter v2.8.2 B70E36BD917C
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple;; s=dkim;
 t=1318732567;; bh=ZjBfBfxqWvFuogB4SWW35pMhpNI=;
X-DomainKeys: Sendmail DomainKeys Filter v1.0.2 B70E36BD917C
DomainKey-Signature: a=rsa-sha1; s=default;; c=simple; q=dns;
Date: Sun, 16 Oct 2011 02:36:07 +0000
From: Twitter <>
Message-Id: <>
Subject: Here & Now (@hereandnow) has sent you a direct message on Twitter!
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=mimepart_4e9a4317b62d5_c33bf72229882316e
X-Twitterimpressionid: am-18336062913187325677065615
List-Unsubscribe: <
Errors-To: Twitter <>
Bounces-To: Twitter <>

I checked my Twitter Messages and found this:

I did a Google Search and found this post:

Has hereandnow's Twitter account been hacked?
Yes, it was.
Its all explained here:!/hereandnow

Its the Twitter account for:
(a show that features Robin Young, a crush from the days when I lived in Massachusetts ;))

The link in the fake Twitter message forwards the intended victim to the phishing website:

The domain is actually

Its hosted in China:

inetnum: -
netname:      CHINANET-YN
descr:        CHINANET yunnan province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       CH93-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-YN
changed: 20010711
changed: 20081210
source:       APNIC
person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:   < send complaints here
address:      No.31 ,jingrong street,beijing  
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed: 20070416
mnt-by:       MAINT-CHINANET
source:       APNIC

Here is another page on the phishing site :

The source code of that page includes this:
link rel="icon" href=""/

A Google search leads here:

This is scary:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Friday, October 14, 2011 SCAM  FAKE FRAUD SCAM

Transport 7 Ltd
Carpenter Court 1, Maple Road
United Kingdom
Company Number:

There is no such thing in real life as a shipping and escrow company.

This fraud site is pretending to be the real company: uses a SSL Certificate,
issued by GeoTrust, Inc.

This should not be interpreted as meaning the site is safe or legitimate.
GeoTrust, Inc. will sell anyone, including scammers, an SSL Certificate.
GeoTrust, Inc. even gives them away for free 30 day trails:
A call to GeoTrust, Inc. sales department yielded no respone, apparently the sales department was too busy giving away free SSL Certificates yesterday.

Should we trust SSL Certifications issued by GeoTrust, Inc.?

The fraud site is hosted by:

organisation:   ORG-PAK5-RIPE
org-name:       PP Alexey Klimenko
org-type:       OTHER
address:        Ukraine, Sevastopol,
address:        Heroev Sevastopola 21-10
phone:          +380994015332

A Google Search on this web host reveals this blog post:
Evil network: Alexey Klimenko / UAHOSTER-NET / / GreatHost-ALTNET, AS41390 (
It appears this web host is connected to other scams and sites that inject viruses to people who visit the sites they host.

Here are some images of the fraud site:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Thursday, October 13, 2011


DGO EXPRESS is a fake shipping and escrow company.
There is nothing in real life as a shipping and escrow comapny.

Europe Offices 29 Nether St.
North Finchley London
N12 7NL
United Kingdom

U.S.A. Offices
1219 Locust Street
PA 19105
United States

The fraud site is hosted by:
Net Onboard Sdn Bhd
No 31 & 33, Jalan Utama 2/18,
    Taman Perindustrian Puchong Utama,
    Tel. +6.0380625088
    Fax. +6.0380624955

Previous sites run by the same scammers can be seen here:

It appears that the hosting company has a penchant for hosting sites by this particular group of scammers.
A reverse search of the ip reveals the following domains used by the same scammers:  active dead  dead  

Net Onboard also previously hosted the scammer's other site:

It is apparent that Net Onboard has little if any regard for scams operating on its servers.
Why would a web host enable scammers to do this?
The answer is money.
Net Onboard accepts payments for services using the same methods the scammers do:
i) Direct Cash/Cheque Deposit
ii) Internet Funds Transfer
iii) Cheque Postal (recommended Registered or PosLaju or Courier)
iv) Western Union
v) TT wire transfer
vi) Credit card (via Paypal only)

It stands to reason that a domain registered using a specific email address, that is determined to be fraud and removed, would be an indication others using the same email address and or template would also be scam sites.  active dead  dead dead and no IP

DGO EXPRESS and the other sites are run by scammers in Romania,
These scammers post ads for vehicles on the internet and ask for payments using bank transfer to, you guessed it, Barclay's Bank in the UK.
Here is one of the accounts they used previously:

Bank: Barclays
Bank Branch: Kenton Park Parade Branch, London, United Kingdom
Account name: EKM Express
Account number: 33289575
Sort Code: 20-37-16
IBAN: GB82 BARC 2037 1633 2895 75
Transfer reason: 342921

That information is from this discussion of the site  dead, registered using the email address same email address as the clone site on the same server  active
The discussion can be seen here:

Here are images of the fraud sites mentioned above:

Here is some text from the fraud sites:

DGO EXPRESS has been providing superior domestic and international transportation services for over 10 years. Our employees and agents are skilled professionals
with both the knowledge and the experience to get the job done. From small items, documents, electronics to cars & container shipments we can provide the
equipment and the expertise to handle any job, no matter how demanding it may be
BUYER and SELLER agree to terms
Both parties agree to terms of the transaction, which includes a description of the merchandise, sale price, and transaction information.
SELLER sends the merchandise via our services
Our agency verifies & inspects the type, condition and authenticity of the merchandise. We issue a tracking number to confirm that the merchandise is in our depots, and
it is scheduled for departure upon payment confirmation.
BUYER sends the payment to DGO EXPRESS
The buyer sends the payment to our company using the 3 available payment methods. Upon payment verification, we will ship the merchandise to the buyer and update
the tracking information. Delivery times vary by destination from 1 to 8 working days.
BUYER receives the merchandise
The merchandise is delivered to the buyer along with our inspection certificate that guarantees the type, condition and authenticity of the products(s). The Buyer will
notify DGO EXPRESS within 3 days after the delivery if he will accept or reject the merchandise.
Once the merchandise is approved and received by the Buyer, we release the payment to the seller.The transaction is complete.
You can send the payment by Bank Wire Transfer or with cash trough Western Union or Money Gram transfer

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Monday, October 10, 2011

Green Card Lottery, Diversity Immigrant Visa Program Scam

The scammers are using the domains:
Send complaints to:
Scammer using details:
Name : Charles Penoi
Address: 73 Queens Avenue
London, N20 0JB
United Kingdom
Fax the Western Union receipt at +44 1613328264 and e-mail at
Send complaints to:

with the email addresses:
U.S. Department of State <>

It appears this scammer previously used:

Report and .org to:
Reg.Ru Network Operations
Russia, Moscow, Vassily Petushkova st., house 3, Office 326
         SPAM reports:

Report all 3 domains to the web host here:

role:            Digital Network Hosting Department
address:         13a, Yaroslavskaya st.,
address:         Moscow, Russia, 129366
phone:           +7 495 660 8383
fax-no:          +7 495 660 8383
admin-c:         MIF
tech-c:          DNO-RIPE
nic-hdl:         DHO-RIPE
mnt-by:          DN-MNT

Here is another fraud domain used by scammers.
   Whois Server:
   Referral URL:
   Name Server: NS7.WORLDNIC.COM
   Name Server: NS8.WORLDNIC.COM
   Status: clientTransferProhibited
   Updated Date: 26-nov-2011
   Creation Date: 26-nov-2011
   Expiration Date: 26-nov-2012
Please report the fraud domain to:
That scammer is asking for Western Union payments.
As of 11-14-11, 2858 have visited this post.
173 people sent emails to
50 people complained to the web host.
Please make complaints.
This scammer is asking for payments using Western Union.
Remember, NEVER send Western Union payments for anything on the internet.
Forward any suspicious emails to:

Also report the scammer here:

More on this type of fraud:

Here is what the scammer is sending intended victims:

Your registered name xxx is included to show this message originated from U.S. Department of State. U.S. Department of State notifies "intended victims"   of being selected as a winner of the Diversity Visa program.

Dear  xxx , You are one of the 50,000 winners selected by the computer random draw from the 12.1 million entries registered in the Diversity Immigrant Visa Program . The Diversity Immigrant Visa program is a United States congressionally-mandated lottery program for receiving a United States Permanent Resident Card. It is also known as the Green Card Lottery

Diversity Visa Details
With the Diversity Visa (also known as Green Card) you will enjoy all the advantages and benefits of a U.S. permanent resident, including health and education benefits, and employment opportunities along with guidance in your new country, orientation sessions and programs to integrate into mainstream American society. Once received you can use it at any time you want to move in the United States or just travel. The visa must be renewed after 10 years.

U.S. Government helps you with the accommodation and offers you Health Insurance (Freedom HSA Direct Individual Health insurance for 1 year), Dwelling (Apartment in any city you prefer, 1 bedroom for 3 months ), a guaranteed job (in the field that you are are currently qualified so you can start working even from the first week you arrive in the United States and get paid as U.S citizen. ) and education (for U.S. Students or Higher Education through EducationUSA. It includes transfer to a U.S college or University so you can continue your educational study. More details can be found at .)

Processing fees
Type of Residence Card Status Amount (per person)
United States Permanent Resident Card Granted! - Waiting for payment of processing fee $879
Processing fees Included
Total $879
Although the Diversity Visa participation was free, the law and regulations require to every diversity visa winner to pay a visa processing fee of $879. The Diversity Visa(Green Card) is guaranteed upon receiving the payment.
The per person fee for each Diversity Visa is $879, payable in U.S. dollars or equivalent of your local currency. This $879 fee is the only fee a winner needs to pay throughout the entire relocation process.
Accompanying family members(wife/husband, fiancee, brothers, sisters, childrens, cousins) may be included in the program and their visas will be provided at the same time with yours so you can travel/move together in the same time. However the fees must be paid per person and each member(e.g wife, brother, parents, childrens, cousin) must pay $879. There is no discount for childrens.

Please note that you are allowed to take with you as many family members you want. However for each person you must pay an additional amount of U.S $879
For example if you decide to move in the United States with your wife and a kid the total fee is US$879(your fee) + US$879(your wife) + US$879(your kid) = US$2637.
PURPOSE: The U.S. Department of State uses the fee payment primarily to process your visa related documents and verify your identity.
Visa Payment processing instructions
The fees must be paid using Western Union money transfer and will be processed by the U.S. embassy in the United Kingdom.
Western Union is a leading provider of International person-to-person money transfer. With more than 150 years experience and 245,000 Agent locations in over 200 countries and territories, Western Union is recognized for sending money quickly, reliably, and safety.
You can send the payment in U.S. dollars or equivalent of your local currency .
Click on the following link to find the nearest Western Union agency and send the fees payment :
Find Western Union Agency
If you are unable to find a Western Union agency near your location, you may ask a relative or friend to pay the fee on your behalf.
After you find a Western Union agency you need to go with cash money, an identity card(e.g passport or national identity card) and send the payment to the U.S. embassy agent address in United Kingdom:

Name   : Darren Childs also using Kevin Wine,  Alexander Preis,  Alan Thompson, Richard Hawk, Thomas Krumme
Address:  73 Queens Avenue
              London, N20 0JB
              United Kingdom

The payment must be sent to the above U.S. embassy agent address in United Kingdom because the U.S. Department of State decided this based on the diplomatic relations with your country.
After you send the payment follow the next steps: 
Fax the Western Union receipt at +44 207 691 7968 !
                               also using +44 2030041354
Then wait for the confirmation that the payment was received.
Within 48 hours, you will receive a confirmation via email with your Case Number/Confirmation Number and exact date and time(approx. 2 days) of the final interview. Upon successful interview you will receive your documents and travel information to move in the United States. Under no circumstances your visa status won't be affected by the interview. After you have paid the processing fees your visa is guaranteed !

Please Note!
The payment must be sent via Western Union in maxx 72 hours after you have received and read the email from U.S. DEPARTMENT of STATE. You are strongly encouraged not to wait until the last day to pay. Heavy demand may result in system delays .
The visa processing fee(US $879) is mandatory for each person and the U.S. Government doesn't offer any discount, loan or exception.
You have been selected winner of the Diversity Visa lottery so the visa is guaranteed upon receiving the payment fees on time.
A hard copy of this letter will be mailed to your postal address upon receiving the payment fees.
Please be advised that even through you are a winner of Diversity Visa your Case Number/Confirmation Number will be provided only after you send the payment confirmation of the fees. Please do not contact us to ask for the Case Number/Confirmation Number.
If it would be necessary to contact the U.S. Department of state YOU MUST ALWAYS REFER TO YOUR NAME. The email is !
also using  The email is

CONFIDENTIALITY STATEMENT: AUTHORITIES: The information asked for on this form is requested pursuant to Section 222 of the Immigration and Nationality Act. Section 222(f) provides that the records of the Department of State and of diplomatic and consular offices of the United States pertaining to the issuance and refusal of visas or permits to enter the United States shall be considered confidential and shall be used only for the formulation, amendment, administration, or enforcement of the immigration, nationality, and other laws of the United States. Certified copies of such records may be made available to a court provided the court certifies that the information contained in such records is needed in a case pending before the court.
Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Thursday, October 6, 2011 FRAUD FAKE FRAUD SCAM

The site is hosted by Yahoo

This fake shipping site, Trust World Courier,  is being run by a Nigerian scammer who is operating out of Lagos.

The scammer is pretending to be a company selling phones:
Electronics Security Limited
United Kingdom

He is then pretending to ship these non existant phones, using this fake shipping site, to intended victims in the Phillipines.

Here is an image of the fraud site:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Wednesday, October 5, 2011 FRAUD

The site actually claims to be

The domain registration contains this data:

Amazon Service (
   527 3rd Avenue
   New York, NY 10001

The phone number that was posted is not even a Manhatten number:

The address is for the UPS Store

The person who created the site put a YouTube video on it:

To top it off the "Today's Deals" Page
uses Google Checkout !!!!
Here are some images of the fake site:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…

Sunday, October 2, 2011 FRAUD FAKE FRAUD SCAM

This particular site opened a "can of worms" so to speak.
The site is hosted by:
Registration Service Provided By: ROBERTSHOST.NET
Contact: +001.6126682588
Website: also hosts the following similar domains:
 has registration information:
A search for the address reveals the property at the address in Minneapolis, Minnesota is owned by someone who has a different name.

I have my doubts as to the legitimacy of due to the fact that it hosts only the fake parcel2go sites. is hosted by:

The fraud parcel2go sites are imitations of the legitimate site:
Read and report the fraud sites here:

The fraud site proves itself to be a scam because it asks for payments using Western Union, shown in the image below.
The fraud site also mentions a fake bank account, used on other fraud sites, also shown in the image below:
Parcel2Go International Airmail - How to make payment via Checks or Bank to Bank Money Transfer - for amounts up to USD $10,000.00
Please make your check or money order payable to Internet Parcel2Go Services, include the Parcel2Go transaction number, and send it to one of the addresses below. Money order and check payments are only accepted when drawn on a US bank, have a limit of $ 4.999.99, and are subject to a 10 days bank hold. We do not accept checks drawn on a credit card.
U.K./Air Mail: Internet Parcel2Go Services
Bank of England
Threadneedle Street
London, EC2R 8AH, United Kingdomn
Express Mail: Internet Parcel2Go Services
Bank of England
Threadneedle Street
London, EC2R 8AH, United Kingdomn
Bank Transfer - up to USD $10,000.00
Bank transfers can be submitted with the help of your banking institution. Provide your bank with the information below to properly transfer your payment:
Bank Name: Bank of England
Address: Threadneedle Street
London, EC2R 8AH, United Kingdomn
ABA Routing #: 121000358
Swift Code: BOFAUS3N
Credit Account Name: Internet Parcel2Go Services
Credit Account #: 01286498
The above information is for payments on transactions that are made in United States Dollars only (USD).

Here are the images:

Oh! what a tangled web we weave When first we practise to deceive! Sir Walter Scott NEVER use instant payment services like Western Union or MoneyGram to buy items on the internet

Leia Mais…