Kinda dodgy

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

ThePlanet have killed it Twisted Evil

It now shows as:

http://intelweb.biz/suspended.page

This Account Has Been Suspended

Posted: Sun Jan 07, 2007 6:45 pm

Theplanet has become very proactive about killing fakes since it merged with EV1. Nice work, SP! Very Happy

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ It is back online again at a different host already Evil or Very Mad

, I have sent Meyer a PM on aa419 asking him to update the database to show it has been rehosted for a second time, it's now with:

Quote:

www.efias.com (whois)
title: ABOUT US
75.126.2.92, (reverse ip), dns18.2mhost.com., SoftLayer Technologies Inc. , [email protected]

Abuse being sent to [email protected] shortly when the database has been updated to show it's hosted with them now.

Posted: Sun Jan 07, 2007 7:26 pm

If he's not hosting his DNS entries can the DNS provider be notified, then he's stuffed.

edit: Looks like it's these people http://www.2mhost.com/

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Scam Patroller could also send a copy of the report to Joker.com, the Registrar, which could zap the domain completely.
I don't know how cooperative they are, though.

Posted: Sun Jan 07, 2007 7:54 pm

IIRC, joker.com aren't exactly proactive.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Meyer updated the aa419 database and absue has now been sent to softlayer.com

I will get in touch with Internic/ICANN and Joker.com this evening and make them aware of what's been going on with this faker Twisted Evil

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I have just sent an email to joker.com:

Quote:

Hi,

Can I bring your attention to a scammers fake check/mule scam website, here is the domain:

http://www.efias.com

You are the registrar of the scammers domain:

Domain Name: EFIAS.COM
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Name Server: DNS17.2MHOST.COM
Name Server: DNS18.2MHOST.COM

Two days ago, the scammers http://www.efias.com website was being hosted by http://www.gnax.net and Gnax closed their hosting and site down for fraud, yesterday, the scammers rehosted their site on http://www.theplanet.com and ThePlanet.com killed their site just this morning for being used for fraud, they have now rehosted again with http://www.softlayer.com today, this is the topic on Gnax's support forum after they closed it down:

http://www.tranxactglobal.com/forum/showthread.php?p=7560

We have it in the fake bank database on aa419.org , see here where it lists Gnax.net as the hosts and an update when it was rehosted on ThePlanet.com before being rehosted again by softlayer.com today:

http://db.aa419.org/fakebanksview.php?key=11662

This scammers site needs to be closed down fast before more victims lose money, please also be aware that this scammer more often than not uses stolen credit cards to pay for his webhosting and domain name purchases, so you might be looking at a credit card chargeback!

It's a fake site being used in fake employment/mule scams, whereby they offer people jobs processing checks, the jobs involve cashing cheques (checks) for their clients (except there are no clients, the scammer sends them fake checks) , the victim, who thinks they have a legitimate job, cashes the checks, keeps 5% as their commission and sends 95% back to the scammers, some time later, they are informed by their banks that the checks were counterfeit, the victim then faces having their bank account frozen, facing possible arrest and imprisonment for passing fake checks and money laundering, they also have to repay the bank the full amount of the check they deposited, scammers send check for between $5000 - $10,000 in this type of scam, so the victim is left paying back the bank for a long time!

This is the scammers "job description" page on their website explaining the fake job to people:

http://www.efias.com/index.php?page=54

The job description:

Vacancies available now:
Transaction Manager;

You are supposed to transfer money from our partners in your country to our international representatives.

Your objective will be collection of money (via wire transfer, as a rule) and further transfer to international representatives of our company in different companies (via Western Union money transfer, as a rule). To get money you can use your bank account in any bank of your country. If you do not have any, you will have to open one before you start working (you may open several accounts). If you already have your bank account, you can use it to receive money.

To transfer money to international representatives of our company via Western Union money transfer it is enough for you to visit the nearest Western Union centre. To find the address and telephone of the nearest centre, please, visit www.westernunion.com and click "Find Agent Location".

Your salary will depend on the sum of the transactions you will operate. Your profit will make 5% from each transaction you will operate. The sum of one transaction generally does n ot exceed 5, 000.00, so we can easily calculate, that being engaged only 2-3 times a week you will get minimum 2,000.00-2,500.00 per month.

You can read this banking scam webpage where it is explained in full detail how this particular scam works:

http://www.banksafeonline.org.uk/moneymule_explained.html

I am sending a copy of this email to the Police at Interpol http://www.interpol.int on [email protected] for their investigative purposes, as we do with all abuse notifications.

Should any victim wish to sue you for damages to recover lost money because you were knowingly hosting a fraudulent site "after" being notified about them at this time, Interpol can provide evidence that you were aware of their fraudulent nature as of the date of this abuse notification.

The domain is also being reported to Internic/ICANN via their site here:

http://wdprs.internic.net

Please close this scammers domain down before many victims lose money, this particular type of scam is very successful, so they need to be closed down quickly!

Cheers,

Scam Patroller.

Received a standard automated reply:

Quote:

Hello xxxxx,

thank you for your comment

It has been successfully delivered to our support team.

We will answer your inquiry as soon as possible.

If you have further questions regarding this issue, please do always

refer to this ticket id: xxxxxxxxxxx.

Note: Do not answer _this_ mail directly as nobody will ever read this.

Please await our reply

refering your question or use the support page again

(including the ticket id [xxxxxxxxxxx] in your comment).

Regards,

Your Joker Team

Look forward to a non joker reply.

Posted: Sun Jan 07, 2007 9:29 pm

Top job SP, I was thinking about doing something similar but you do it a thousand times better that I can do.

Posted: Sun Jan 07, 2007 10:18 pm

Blimey, that was reshosted quick...the scammers must perceive this little bugger as important.

Top work SP, although I have a funny feeling the registrar will give it "nowt to do with us mate"...

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ Worth a crack though, might catch them on a good day.

I just went went to report them through:

http://wdprs.internic.net

But someone has beaten me to it, after submitting it says:

Quote:

Thank you for helping make Whois data more accurate. A Whois Data Problem Report related to www.efias.com was recently submitted, so no further action is required.

Did anyone here do the report?

www.efias.com seems to be having site problems at the moment aynway, the site says:

Quote:

Fatal error: Unable to connect to database in /home/efiasne/public_html/efias/_admin/_kernel/class/database/database_connect.php on line 31

Posted: Sun Jan 07, 2007 11:30 pm

Nope, although I was seriously tempted to screw his DNS.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I have not heard back from [email protected], but www.aboutfias.com hosted by them is now dead

Still no reply from www.softlayer.com concerning www.efias.com though Evil or Very Mad

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Hmmm, a Who-Is lookup is now telling me www.efias.com is back being hosted on gnax.net again instead of softlayer.com where they rehosted to, can someone double check that for me, please?

Quote:

www.efias.com
207.210.95.194, ns4.maxiehost.com., Global Net Access, LLC , [email protected]

Posted: Wed Jan 10, 2007 6:30 pm

Confirmed.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ Cheers, thought so, I have reposted it on Gnax's forum asking to kill it again, I pinged the domain which also confirmed it:

Quote:

Pinging www.efias.com [207.210.95.194]:

Ping #1: Got reply from 207.210.95.194 in 18ms [TTL=56]
Ping #2: Got reply from 207.210.95.194 in 18ms [TTL=56]
Ping #3: Got reply from 207.210.95.194 in 17ms [TTL=56]
Ping #4: Got reply from 207.210.95.194 in 17ms [TTL=56]

207.210.95.194 = gnax.net

I guess softlayer.com must have killed them then Very Happy

Posted: Wed Jan 10, 2007 8:20 pm

^^^
Nothing like a good game of whack-a-mole with a fake site. The scammers must be going crazy trying to keep ahead of you, SP Laughing

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ I thought softlayer.com were being shits not getting back to me, so I took 2.5GB out of efias.com's bandwidth yesterday and another 0.25 GB today, then realised they were back on Gnax, could have save me vampiring them if softlayer had got back to me saying they booted them, gits Evil or Very Mad

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Gnax have killed it again already, way to go Gnax Thumbs up

Posted: Wed Jan 10, 2007 9:20 pm

^^
I wonder what the record is for the number of times a single site has been killed in a week Wink

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Are these lads stupid, they just rehosted on Gnax again 4 hours after Gnax killed them for a second time Rolling Eyes

, lets take care of this again Mad

Posted: Thu Jan 11, 2007 1:38 am

Well done SP, if you want me to get to work on removing the DNS entries let me know.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ I just posted on Gnax's forum telling them it's back up, and sent their admin a PM pointing him to my topic, hopefully he will kill it quickly again, feel free to do whatever you like to their DNS stuff, what did you have planned?

Posted: Thu Jan 11, 2007 2:02 am

thejoker.com do not subscribe to icann so I'm out of luck with that. The phone number I suspect is bogus, called it and a woman answered, knew nothing about efias.com.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ Thanks OF, worth a try anyway, cheers.

Gnax have killed it again clapping

:

Quote:

Sorry, I could not determine the IP for www.efias.com (error 11004)