Stanescu C Florica
Dragasani Valcea
This scammer worked closely with:
http://netscammers.blogspot.com/2010/04/cioc-dragos-alexandru.html
Here are some of the sites he was involved with:
cargolineescrow.com
shippingsecure.com
make-deals.com
make-business.com
thunder-trades.com
dynamic-trades.com
gold-pouchescrow.biz
gold-pouchescrow.org
goldpouchescrow.net
goldpouchescrow.biz
goldpouchescrow.org
goldpouch-deals.com
goldpouch-deals.net
goldpouch-deals.biz
goldpouch-deals.org
pulamea.com
goldpouchdeals.net
goldpouchdeals.biz
goldpouchdeals.org
1Fast-Deals.com
gold-deals.net
gold-deals.biz
gold-deals.org
golddeals.com
golddeals.net
golddeals.biz
golddeals.org
gelix.com
gelix.net
gelix.biz
gelix.org
gold-protection.com
real-business.com
ssl-trade.net
ssl-trade.com
make-trades.com
extra-deal.com
shippingsecure.com
tradingbusinessolutions.com
transactions-protect.com
Template is here:
http://escrow-fraud.com/index.php?page=gallery&layout=45
The scams involved eBay electronics and computer sellers, mostly in Europe and Australia.
These scammers also listed phones on eBay and asked for payment via Western Union and bank transfer to Italy.
Monday, April 19, 2010
Stanescu C Florica
Tuesday, April 6, 2010
70 Romanians Arrested on 6th of April 2010
Apparently one of the scammers, Cătălin Sârbu, recently died in a car accident:
http://adevarul.ro/locale/alexandria/frisca-hackerul-despre-spune-vandut-catedrala-alexandria-internet-inmormantat-fanfara-1_52527b47c7b855ff560c0e80/index.html
Update 04/14/2010
Due to Romanian laws Mr. Nicolae Popescu was indeed allowed to leave after no formal charges were filed against him within the alloted 24 hour period.
Story here:
http://garwarner.blogspot.com/2010/04/nicolae-popescu-romanian-hacker-at.html
However,
Mr. Popescu was indeed subsequently charged and given a 29 day sentence.
The fact that he left the jail and apparently left the country doesn't bode well for him and his accomplices.
His flight from Romania will appear as an admission of guilt.
Interpol will surely issue a warrant for his arrest.
Update 04/11/2010
The perpetrators arrested and detained for 29 days in Valcea case are Florin Dan Mişcoci, Alexandru Răduţ, Marius Adrian Ologu, Marian Sorin Grigorie, Laurenţiu Dumitru Anghel, Vasile Petronel Avram, Florin Buceag, Iulian Stere, David Gabriel Cârstea, Narcis Nicolae Petrache, Sebastian Lungu, Bogdan Mehedinţu, Daniel Alexandru Ciomag, Aurel Cătălin Dincă, Gheorghe Tiberiu Budărescu, Ionuţ Sorin Dumitru, Gabriel Drăghici, Nicolae Cristian Ciucă, Nicolae Popescu, Dumitru Daniel Busogioiu, Ovidiu Vlad Cristea, Ştefan Iordachi, Florin Nicula, Nicolae Andrei Paraschiva, Cătălin Sârbu, Marian Lovită Priboi, Mihaela Florina Ungureanu, Vlad Nicolae Vrapciu, Flore Valentin Boje, Alin Constantin Cotă, Florin Dorin Răducu, Călin Cornel Fălcuşan, Alexandru Nicolăescu, Claudiu Marian Turica.
Story here:
http://www.masuramedia.ro/news/11267.html
Translation here:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.masuramedia.ro%2Fnews%2F11267.html&sl=ro&tl=en&hl=&ie=UTF-8
Update 04/08/2010
Valcea Court issued Wednesday evening, after almost 10 hours of deliberations, arrest warrants for 29 days for all the 34 people detained by DIICOT prosecutors in Ramnicu Valcea Tuesday evening, after hearing more than 40 people suspected of being involved in electronic fraud.
Update 04/07/2010
Following the action on April 6, 2010, conducted by prosecutors DIICOT - Territorial Office Valcea, make the following comments:
Prosecutors DIICOT - Territorial Office Valcea ordered moving the prosecution and detention for 24 hours to 34 defendants and asked the court to order their arrest for 29 days.
Czech judicial authorities have detained 10 defendants, which were issued European arrest warrants.
Official News Release:
http://www.diicot.ro/index.php?option=com_content&view=article&id=299:comunicat-de-presa-07042010&catid=38:mass-media&Itemid=81
English Translation:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.diicot.ro%2Findex.php%3Foption%3Dcom_content%26view%3Darticle%26id%3D298%3Acomunmedia%26Itemid%3D81&sl=ro&tl=en&hl=&ie=UTF-8
The prosecutors from Valcea and Pitesti DIICOT (Directorate for
Investigating Organized Crime and Terrorism) Field Offices, in
collaboration with police officers from IGPR - DCCO and with the help of the
Romanian Gendarmerie carried out this morning a major action directed at
three organized cybercrime groups, involved in scamming and on-line frauds
and other Internet-related crimes.
The three criminal groups have been operating for about four years (as of
2006) on the territory of various countries - Spain, Italy, France, New
Zeeland, Denmark, Sweden, Germany, Austria, the United States, Canada,
Switzerland and were involved in multiple scams and on-line frauds.
Up to this moment, the members of the criminal groups have made over 800
victims, causing a prejudice estimated at about 800.000 Euros.
On the 6th of April 2010, 101 searches were conducted out under the
coordination of the DIICOT prosecutors. Of these, 31 took place in
Bucharest, 41 in Valcea, 12 in Teleorman, 4 in Timis as well as in other
Romanian counties: Argeş, Prahova, Braşov, Constanţa, Dolj, Giurgiu,
Suceava, Botoşani, Bacău - 1 in each county.
10 simultaneous searches were conducted in the capital of the Czech
Republic, Prague, where other members of the criminal groups were located.
70 persons were brought to the headquarters of the DIICOT Field Office in
Valcea for hearings.
300 police officers and 400 members of the Romanian Gendarmerie took part in
this major action.
The DIICOT prosecutors carried out the operation with the support of the FBI
and the help of United States Secret Service Office in Bucharest.
The operation, considered to be the most prominent action carried out in
2010 by the DIICOT prosecutors and the law enforcement agencies involved in
combating organized crime was aimed at the most important cybercrime groups
that act in Bucharest, Valcea - Dragasani and Teleorman - Alexandria - areas
that are now notorious for their cybercriminal potential.
Official Press Release:
http://www.diicot.ro/index.php?option=com_content&view=article&id=298:comunmedia&Itemid=81
English Translation:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.diicot.ro%2Findex.php%3Foption%3Dcom_content%26view%3Darticle%26id%3D298%3Acomunmedia%26Itemid%3D81&sl=ro&tl=en&hl=&ie=UTF-8
Here is a video interview with the head of the FBI Office in Bucharest, Gary Dickson, concerning Romanian involvement in internet crimes, compliments of http://www.hotnews.ro:
Saturday, April 3, 2010
CIOC DRAGOS-ALEXANDRU
CIOC DRAGOS-ALEXANDRU
last known address:
CRAIOVA jud. DOLJ
Participated in the following fake escrow sites that targeted eBay sellers:
make-deals.com
make-business.com
thunder-trades.com
dynamic-trades.com
goldpouchdeals.com
gold-protection.com
real-business.com
real-trading.com
ssl-trade.net
ssl-trade.com
make-trades.com
extra-deal.com
transactions-protect.com
secure-web-trade.com
platinum-trades.com
1fast-deals.com
1realdeals.com
Template is here:
http://escrow-fraud.com/index.php?page=gallery&layout=45
And yes its true. This is him:
http://www.bestjobs.ro/cidacu
Director Executiv BCR-Erste Sucursala Amaradia Craiova
turatii.ro Total threats on this site: 3687
http://safeweb.norton.com/report/show?url=http:%2F%2Fwww.turatii.ro%2Findex.php%3Ffunc=articol%26domeniu=4x4%20on%20Road%26articol=465
Threat Report
Total threats found: 3687
Security Risks (what's this?)
Threats found: 3655
Here is a sample:
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=59f645ccac4835348316cf256b6dcd2b&act=Members
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=59f645ccac4835348316cf256b6dcd2b&act=Help
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=59f645ccac4835348316cf256b6dcd2b&act=calendar
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=59f645ccac4835348316cf256b6dcd2b&act=idx
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=59f645ccac4835348316cf256b6dcd2b&
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?&act=Members&photoonly=&name=&name_box=all&max_results=10&filter=ALL&sort_order=desc&sort_key=posts&st=16930
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?&act=Members&photoonly=&name=&name_box=all&max_results=10&filter=ALL&sort_order=asc&sort_key=name&st=16930
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?&act=Members&photoonly=&name=&name_box=all&max_results=10&filter=ALL&sort_order=desc&sort_key=posts&st=16890
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?&act=Members&photoonly=&name=&name_box=all&max_results=10&filter=ALL&sort_order=asc&sort_key=name&st=16940
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?&act=Members&photoonly=&name=&name_box=all&max_results=10&filter=ALL&sort_order=desc&sort_key=posts&st=16940
Drive-By Downloads (what's this?)
Threats found: 32
Here is a sample:
Threat Name: HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?act=Login&CODE=06
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getlastpost
Location: http://turatii.ro/forum/index.php?s=07cfdec30337a3bc4baaf392ac492aa1
Threat Name: Direct link to HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=e5ef27f5d9f615debd41a3ff6c60c6c8&act=idx
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getnewpost
Location: http://turatii.ro/forum/index.php?s=64872e1430c24efb8e6378175ffabc66
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getlastpost
Location: http://turatii.ro/forum/index.php?s=2a6d1b2bbb41fe61d6632f5fd0a50985&act=idx
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getnewpost
Location: http://turatii.ro/forum/index.php?s=c1550339d66816678d0d730607a64dca&act=idx
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getnewpost
Location: http://turatii.ro/forum/index.php?s=5c5d5a7c85374a340da772aaf44171f6
Threat Name: Direct link to HTTP Malicious Toolkit Variant Activity
Location: http://turatii.ro/forum/index.php?s=e974eeb8f7d7ac9cdbbba80a63457340&act=idx
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getnewpost
Location: http://turatii.ro/forum/index.php?s=b978a5837bb5f83893b6c4b28da93aea
Direct link to: http://turatii.ro/forum/index.php?showtopic=2&view=getlastpost
Location: http://turatii.ro/forum/index.php?s=e915e20f857de0936615406f946bef32&act=idx
Wednesday, March 31, 2010
fedexfastdelivery.com
http://www.coolwhois.com/d/fedexfastdelivery.com
Registration Service Provider:
services@123-reg.co.uk
08712309525
08709126612 (fax)
http://www.123-reg.co.uk
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.
...yes and ask them how and why they can allow someone to register a domain named:
fedexfastdelivery.com
Using erroneous contact data:
Administrative Contact:
courier, fedex dicksonwalls@yahoo.com
12
sadoh
johan, johannesburg BS10 5NG
GB
+44.783543633
A simple Google search of dicksonwalls@yahoo.com reveals:
http://www.google.com/search?q=%22dicksonwalls%40yahoo.com%22&hl=en&lr=&filter=0
http://www.yaari.com/?controller=profile&action=show&id=1395168
http://www.yaari.com/?controller=profile&action=show&id=1632084
In addition to using a domain to most likely send spoof emails pretending to be FedEx, dicksonwalls@yahoo.com is also a romance scammer.
HI DEAR,
I am very glad to meet you on this site, however l love to share, l love to
preserve and l will love to hold for a lifetime relationship with somebody my
heart longs for.
I am Dickson Walls, I am currently working in UK , I am 38 years of old. girl,
I am a honest, loving, caring and sincere, I am a man who knows the
pricelessness of a sincere relationship. A man who will love to go a long way
and an extra mile for the woman who will sincerely and carelessly share her
precious time with me, holding a special place for me in her heart.
To me, l really desire a woman to build a future with, who is sincere,
responsible, caring understanding. it just don't matter much how you look on
the outside in this relationship but it really matters how you look right inside
because "beauty is skin deep". If you really sincerely want to build a
world of passion, caring, sharing those emotional feelings that seems to
be
betrayed and a committed long-term relationship, I'm yours! Together we can
create great impressions in each other heart that's forever.
Well get to know more about me at dicksonwalls@yahoo.com or
dickson.walls@live.com
can call me on +447045759841 begin_of_the_skype_highlighting +447045759841 end_of_the_skype_highlighting
l really don't want to play around, l want to get to your heart and show
you the deepest love and passions that is endless. l hope you will understand my
heart-beats. I look forward to reading from you.
Dickson walls
xhost.ro Total threats found: 19
http://safeweb.norton.com/report/show?url=xhost.ro
Viruses
Threats found: 18
Here is a sample:
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=funny_weeks&pagetitle=Weeks
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=huburi&pagetitle=Huburi
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=sitemap&pagetitle=Sitemap
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=mylinks&pagetitle=Linkuri-utile
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=banculzilei&pagetitle=Zambetul-Zilnic
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=valuta&pagetitle=Valute
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=rss&pagetitle=RSS
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=radio&pagetitle=Radio
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php?filename=texte&pagetitle=Texte-Cugetari
Threat Name: Trojan.Malscript!html
Location: http://zackyty11.xhost.ro/index.php
Phishing Attacks (what's this?)
Threats found: 1
Here is a complete list:
Location: http://zaff.xhost.ro/
Sunday, March 28, 2010
gcn.ro not safe?
http://safeweb.norton.com/report/show?url=gcn.ro
Threats found: 2
Here is a complete list:
Threat Name: Trojan Horse
Location: http://auth.gcn.ro/files/Download/nod32.rar
Threat Name: Hacktool
Location: http://auth.gcn.ro/files/Download/cr-wr370.zip
Trojan Horse and Hacktool on a server in Romania?
