A cautionary tale

This is a thread over on triumph675.net where I'm a member.

Beware, London scammers at work.

http://www.triumph675.net/forum/showthread.php?t=18656

[timwilky]

I find it disturbing that anyone can get suckered like that. And most likely by a fellow yank. There is no evidence that any mony/email etc. ever travelled over the pond

[SoulKiss]

Ed, please post the following to the 675 forum.

Hi guys, saw Edski's post on another forum - I have a few observations to make.

1) Looking at the Shipping Co's website I see a West Coast of Scotland Address but a London phone number.

Head Office

Contact Details
Phone: +44 207 983 9146
Fax: +44 207 681 3028
Email: support@otopeni-courier.com

Physical Address
Otopeni Courier Ltd Agencies
7a Mackay Street, KW1 48UQ
Castletown
United Kingdom
Postal Address
Otopeni Courier Ltd Agencies
PO Box 22-046
Castletown
United Kingdom


2) The DNS info linked to above (replicated here) shows a Domain registered through Yahoo in December of last year

Domain Name.......... otopeni-courier.com
Creation Date........ 2007-12-17
Registration Date.... 2007-12-17
Expiry Date.......... 2009-12-17
Organisation Name.... Paul H Rice Jr
Organisation Address. 16287 Suel Circle
Organisation Address.
Organisation Address. Prior Lake
Organisation Address. 55372
Organisation Address. MN
Organisation Address. UNITED STATES
Admin Name........... Paul H Rice Jr
Admin Address........ 16287 Suel Circle
Admin Address........
Admin Address........ Prior Lake
Admin Address........ 55372
Admin Address........ MN
Admin Address........ UNITED STATES
Admin Email.......... otopenicourier@yahoo.com

Admin Phone.......... 1.9529380812
Admin Fax............
Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM

Tech Phone........... 1.6198813096
Tech Fax.............
Name Server.......... yns1.yahoo.com


Name Server.......... yns2.yahoo.com as noted this is likely to be fake, but would have to have been paid somehow - so maybe this info should go to the investigating officer.

3) No-one should approach the London address, it is almost 100% surely fake, as will the Scottish address for the shipping company. The London phone number may be useful in an investigation.


I think that you are never going to see the money, or the bike, which I am sorry to say, but hopefully the above that I have collated together for you from others work and some of my own, will assist in the tracking down of these guys.

David, you're a gem. Thank you!!!!

I've posted a link.

[SoulKiss]

More info to copy over Ed

Ok having read some of the suggestions - heres some more of what I can find out - should have thought of checking some of this earlier - but oh, well its late over here

The server is somewhere in the US, hosted off of a Yahoo connection - I dont know if this means the person used Yahoo as an ISP (Do Yahoo do that in the US?) or whether its just some Yahoo webspace they have.

I have deleted the first hops as they are irrelevant in this - they just show packets traversing the UK to New York

david@sodium:~/torrents$ mtr otopeni-courier.com --report
11. zermelo-so-0-0-0-0.sp.zen.ne
12. zubiri-so-0-0-0-0.ny.zen.net
13. nyiix.bas1-m.nyc.yahoo.com
14. ge-2-0-0.pat1.nyc.yahoo.com
15. so-3-0-0.pat1.dcp.yahoo.com
16. ge-2-1-0-p170.msr2.re1.yahoo
17. ge-1-46.bas-b2.re4.yahoo.com
18. p12w10.geo.re4.yahoo.com

I cant really tell that much from this, I dont know Yahoo's naming scheme, but it is passed to them by my ISP (Zen) at the New York Internet Exchange, then travels cross country.

A Ping of the site url confirms that this is hosted by Yahoo

david@sodium:~/torrents$ ping www.otopeni-courier.com
PING premium12.geo.yahoo9.akadns.net (216.39.58.20 56(84) bytes of data.

Getting back to the physical location - Castletown in Scotland is on the extreme north coast, which is not the easiest place to get to, and I dont think that there would be a big shipping terminal there for worldwide shipping - its just too remote to get loads of container trucks to - there is a shipping route to the Orkney islands from Thurso just to the West, but again I think that is pretty small-time.

Unfortunately Google doesnt have sattelite images of that area but heres an idea of the geography.

http://maps.google.co.uk/maps?f=q&hl...4,4.328613&z=9


Looking at the telephone numbers involved on the website I see they have different area codes

0207 983 (the telephone number) is assigned to Racal Telecomms, so is not tied to a specific area, I can see what I can find out about them tomorrow as I have some friends who work in the telecoms sector. Racal Telecoms was bought by Global Crossing.

0207 681 (the fax number) is assigned to Cable London, which is probably now part of the ex-Telewest network now operated by Virgin Media.

I can see if I can find out more about these numbers in the morning when I get to work.

[yorkie_chris]

Here you have the informations were to make the
transfer Via Western Union ( money transfer ) :

Sounds like some nigerian ******** to me.

Originally Posted by yorkie_chris

Sounds like some nigerian ******** to me.

Erm... based on what? There is no evidence to say who it is, let alone the nationality so maybe you shouldn't point the finger.

The London address given is the exact same address that was used when I had my credit card details cloned. The bought two mobile phones and attempted to have the phones delivered to this address. Carphone Warehouse by default posted them to my address. The police were less than helpful when I reported this. I was getting passed from one police station to another and it seemed no one was interested in the address.

Seeing as how this address has been used again, I'd say they did nothing with it.

We can't touch on the 2nd payment because that are
our terms policy . We are a trustful company with a
lot of satisfied customers .There are no chances to be
scammed by our services. We need the payment for the
tax so we will can release the package at your address
.Here you have the informations were to make the
transfer Via Western Union ( money transfer ) :


Did he not pick up on the extremely bad English in this email?? And suss then?
It is blatantly written by someone who can’t speak good English at all.

[yorkie_chris]

Originally Posted by lukemillar

Erm... based on what? There is no evidence to say who it is, let alone the nationality so maybe you shouldn't point the finger.

Seems a lot of these scams originate from Africa, and its blatantly obvious that the "shipping company" can't speak English properly.