Fake banks, couriers, law firms, escrow and other fake sites used in scams.
#60697 by pbn123 Tue Aug 02, 2011 10:10 am
I know these sites are fake, I just need a bit of a hand in getting them taken down:

Yourhotelsbook.com

Bookmeanhotels.com

Roomsrecord.com

Expertrooms.com

Thanks a lot.
Advertisement

#60704 by Katharina Tue Aug 02, 2011 12:35 pm
Website of yourhotelsbook says
© 2000 - 2009 www.YourHotelsBook.com


whois says
Address lookup
canonical name www.yourhotelsbook.com.
aliases
addresses 188.138.76.51
Domain Whois record

Queried whois.internic.net with "dom yourhotelsbook.com"...

Domain Name: YOURHOTELSBOOK.COM
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS1.NTEKNIK.COM
Name Server: NS2.NTEKNIK.COM
Status: clientTransferProhibited
Updated Date: 07-jul-2011
Creation Date: 07-jul-2011
Expiration Date: 07-jul-2012

>>> Last update of whois database: Tue, 02 Aug 2011 16:25:19 UTC <<<

Queried whois.networksolutions.com with "yourhotelsbook.com"...

Registrant:
Onder Turizm
Durak mahallesi dincer sok no 7 /D
usak
usak, usak 64000
TR

Domain Name: YOURHOTELSBOOK.COM

------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------

Administrative Contact, Technical Contact:
Onder Turizm [email protected]
Durak mahallesi dincer sok no 7 /D
usak
usak, usak 64000
TR
00902762338949


Record expires on 07-Jul-2012.
Record created on 07-Jul-2011.
Database last updated on 2-Aug-2011 12:17:17 EDT.

Domain servers in listed order:

NS1.NTEKNIK.COM
NS2.NTEKNIK.COM

Network Whois record

Queried whois.ripe.net with "-B 188.138.76.51"...

% Information related to '188.138.72.0 - 188.138.79.255'

inetnum: 188.138.72.0 - 188.138.79.255
netname: BSB-Service-1
descr: BSB-Service GmbH
country: DE
admin-c: NPA10-RIPE
tech-c: NPA10-RIPE
status: ASSIGNED PA
remarks: **************************************
remarks: * These IPs are static IPs assigned *
remarks: * to customer-servers of BSB Service *
remarks: * For abuse-complaints please use *
remarks: * Abuse-Contact: [email protected] *
remarks: * only. Abuse-Complaints to any *
remarks: * other address will NOT be handled *
remarks: **************************************
mnt-by: INTERGENIA-MNT
source: RIPE
changed: [email protected] 20110630

role: NMC PlusServer AG
address: PlusServer AG
address: Daimlerstr. 9-11
address: 50354 Huerth
phone: +49 1801 119991
fax-no: +49 2233 612-53500
e-mail: [email protected]
abuse-mailbox: [email protected]
remarks:
remarks: ********************************************************
remarks: * PLEASE READ CAREFULLY: *
remarks: * and choose the right addresses for contacting our *
remarks: * staff. *
remarks: * This will fasten up processing your request ! *
remarks: ********************************************************
remarks: * ABUSE-Complaints are only handled at: *
remarks: * [email protected] *
remarks: ********************************************************
remarks: * Auskunftsersuchen gemaess TKG werden nur unter *
remarks: * Fax: +49 2233 612 5150 *
remarks: * bearbeitet! *
remarks: ********************************************************
remarks: * Informational Contact: [email protected] *
remarks: * or http://www.plusserver.de *
remarks: ********************************************************
remarks:
remarks: ********************************************************
remarks: * If you really have a routing-related request or if *
remarks: * you are not able to read you may use the details *
remarks: * below for contacting us *
remarks: * *
remarks: * Phone: +49 1801 119991 *
remarks: * Fax: +49 2233 612-53500 *
remarks: * *
remarks: ********************************************************
remarks:
admin-c: JBPS-RIPE
tech-c: OHPS-RIPE
tech-c: CDPS-RIPE
tech-c: ADPS-RIPE
nic-hdl: NPA10-RIPE
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110329
source: RIPE

% Information related to '188.138.0.0/17AS8972'

route: 188.138.0.0/17
descr: Plusserver AG
origin: AS8972
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110628
source: RIPE

Registration for one year only and only recently despite what the website says sure is fishy. The contact "Administrative Contact, Technical Contact: Onder Turizm [email protected]" is a private free email, despite it is supposed to belong to a travel agency. Do you have any more information?
#60705 by Katharina Tue Aug 02, 2011 12:40 pm
bookmeanhotels seems to be an exact clone.
Address lookup
canonical name www.bookmeanhotels.com.
aliases
addresses 188.138.76.51
Domain Whois record

Queried whois.internic.net with "dom bookmeanhotels.com"...

Domain Name: BOOKMEANHOTELS.COM
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS1.NTEKNIK.COM
Name Server: NS2.NTEKNIK.COM
Status: clientTransferProhibited
Updated Date: 31-jul-2011
Creation Date: 07-jul-2011
Expiration Date: 07-jul-2012

>>> Last update of whois database: Tue, 02 Aug 2011 16:37:41 UTC <<<

Queried whois.networksolutions.com with "bookmeanhotels.com"...

Registrant:
Onder Turizm
Durak mahallesi dincer sok no 7 /D
usak
usak, usak 64000
TR

Domain Name: BOOKMEANHOTELS.COM

------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------

Administrative Contact, Technical Contact:
Onder Turizm [email protected]
Durak mahallesi dincer sok no 7 /D
usak
usak, usak 64000
TR
00902762338949


Record expires on 07-Jul-2012.
Record created on 07-Jul-2011.
Database last updated on 2-Aug-2011 12:29:45 EDT.

Domain servers in listed order:

NS1.NTEKNIK.COM
NS2.NTEKNIK.COM

Network Whois record

Queried whois.ripe.net with "-B 188.138.76.51"...

% Information related to '188.138.72.0 - 188.138.79.255'

inetnum: 188.138.72.0 - 188.138.79.255
netname: BSB-Service-1
descr: BSB-Service GmbH
country: DE
admin-c: NPA10-RIPE
tech-c: NPA10-RIPE
status: ASSIGNED PA
remarks: **************************************
remarks: * These IPs are static IPs assigned *
remarks: * to customer-servers of BSB Service *
remarks: * For abuse-complaints please use *
remarks: * Abuse-Contact: [email protected] *
remarks: * only. Abuse-Complaints to any *
remarks: * other address will NOT be handled *
remarks: **************************************
mnt-by: INTERGENIA-MNT
source: RIPE
changed: [email protected] 20110630

role: NMC PlusServer AG
address: PlusServer AG
address: Daimlerstr. 9-11
address: 50354 Huerth
phone: +49 1801 119991
fax-no: +49 2233 612-53500
e-mail: [email protected]
abuse-mailbox: [email protected]
remarks:
remarks: ********************************************************
remarks: * PLEASE READ CAREFULLY: *
remarks: * and choose the right addresses for contacting our *
remarks: * staff. *
remarks: * This will fasten up processing your request ! *
remarks: ********************************************************
remarks: * ABUSE-Complaints are only handled at: *
remarks: * [email protected] *
remarks: ********************************************************
remarks: * Auskunftsersuchen gemaess TKG werden nur unter *
remarks: * Fax: +49 2233 612 5150 *
remarks: * bearbeitet! *
remarks: ********************************************************
remarks: * Informational Contact: [email protected] *
remarks: * or http://www.plusserver.de *
remarks: ********************************************************
remarks:
remarks: ********************************************************
remarks: * If you really have a routing-related request or if *
remarks: * you are not able to read you may use the details *
remarks: * below for contacting us *
remarks: * *
remarks: * Phone: +49 1801 119991 *
remarks: * Fax: +49 2233 612-53500 *
remarks: * *
remarks: ********************************************************
remarks:
admin-c: JBPS-RIPE
tech-c: OHPS-RIPE
tech-c: CDPS-RIPE
tech-c: ADPS-RIPE
nic-hdl: NPA10-RIPE
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110329
source: RIPE

% Information related to '188.138.0.0/17AS8972'

route: 188.138.0.0/17
descr: Plusserver AG
origin: AS8972
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110628
source: RIPE

#60707 by Katharina Tue Aug 02, 2011 12:52 pm
Roomsrecord.com

IP adress same as above.
Address lookup
canonical name http://www.roomsrecord.com.
aliases
addresses 188.138.72.50
Domain Whois record

Queried whois.internic.net with "dom roomsrecord.com"...

Domain Name: ROOMSRECORD.COM
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS43.WORLDNIC.COM
Name Server: NS44.WORLDNIC.COM
Status: clientTransferProhibited
Updated Date: 19-jul-2011
Creation Date: 18-jul-2011
Expiration Date: 18-jul-2012

>>> Last update of whois database: Tue, 02 Aug 2011 16:48:20 UTC <<<

Queried whois.networksolutions.com with "roomsrecord.com"...

Registrant:
Efenaz Turizm Seyahat Acentasi
ATTN ROOMSRECORD.COM
care of Network Solutions
PO Box 459
Drums, PA. US 18222


Domain Name: ROOMSRECORD.COM

------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------

Administrative Contact, Technical Contact:
Efenaz Turizm Seyahat Acentasi [email protected]
ATTN ROOMSRECORD.COM
care of Network Solutions
PO Box 459
Drums, PA 18222
US
570-708-8780


Record expires on 18-Jul-2012.
Record created on 18-Jul-2011.
Database last updated on 2-Aug-2011 12:40:45 EDT.

Domain servers in listed order:

NS43.WORLDNIC.COM 205.178.190.22
NS44.WORLDNIC.COM 206.188.198.22

This listing is a Network Solutions Private Registration. Mail
correspondence to this address must be sent via USPS Express Mail(TM) or
USPS Certified Mail(R); all other mail will not be processed. Be sure to
include the registrant's domain name in the address.

Network Whois record

Queried whois.ripe.net with "-B 188.138.72.50"...

% Information related to '188.138.72.0 - 188.138.79.255'

inetnum: 188.138.72.0 - 188.138.79.255
netname: BSB-Service-1
descr: BSB-Service GmbH
country: DE
admin-c: NPA10-RIPE
tech-c: NPA10-RIPE
status: ASSIGNED PA
remarks: **************************************
remarks: * These IPs are static IPs assigned *
remarks: * to customer-servers of BSB Service *
remarks: * For abuse-complaints please use *
remarks: * Abuse-Contact: [email protected] *
remarks: * only. Abuse-Complaints to any *
remarks: * other address will NOT be handled *
remarks: **************************************
mnt-by: INTERGENIA-MNT
source: RIPE
changed: [email protected] 20110630

role: NMC PlusServer AG
address: PlusServer AG
address: Daimlerstr. 9-11
address: 50354 Huerth
phone: +49 1801 119991
fax-no: +49 2233 612-53500
e-mail: [email protected]
abuse-mailbox: [email protected]
remarks:
remarks: ********************************************************
remarks: * PLEASE READ CAREFULLY: *
remarks: * and choose the right addresses for contacting our *
remarks: * staff. *
remarks: * This will fasten up processing your request ! *
remarks: ********************************************************
remarks: * ABUSE-Complaints are only handled at: *
remarks: * [email protected] *
remarks: ********************************************************
remarks: * Auskunftsersuchen gemaess TKG werden nur unter *
remarks: * Fax: +49 2233 612 5150 *
remarks: * bearbeitet! *
remarks: ********************************************************
remarks: * Informational Contact: [email protected] *
remarks: * or http://www.plusserver.de *
remarks: ********************************************************
remarks:
remarks: ********************************************************
remarks: * If you really have a routing-related request or if *
remarks: * you are not able to read you may use the details *
remarks: * below for contacting us *
remarks: * *
remarks: * Phone: +49 1801 119991 *
remarks: * Fax: +49 2233 612-53500 *
remarks: * *
remarks: ********************************************************
remarks:
admin-c: JBPS-RIPE
tech-c: OHPS-RIPE
tech-c: CDPS-RIPE
tech-c: ADPS-RIPE
nic-hdl: NPA10-RIPE
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110329
source: RIPE

% Information related to '188.138.0.0/17AS8972'

route: 188.138.0.0/17
descr: Plusserver AG
origin: AS8972
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110628
source: RIPE

Last edited by Katharina on Tue Aug 02, 2011 1:12 pm, edited 1 time in total.
#60708 by Katharina Tue Aug 02, 2011 12:58 pm
Address lookup
canonical name http://www.expertrooms.com.
aliases
addresses 188.138.72.50
Domain Whois record

Queried whois.internic.net with "dom expertrooms.com"...

Domain Name: EXPERTROOMS.COM
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS39.WORLDNIC.COM
Name Server: NS40.WORLDNIC.COM
Status: clientTransferProhibited
Updated Date: 19-jul-2011
Creation Date: 18-jul-2011
Expiration Date: 18-jul-2012

>>> Last update of whois database: Tue, 02 Aug 2011 16:55:24 UTC <<<

Queried whois.networksolutions.com with "expertrooms.com"...

Registrant:
Efenaz Turizm Seyahat Acentasi
ATTN EXPERTROOMS.COM
care of Network Solutions
PO Box 459
Drums, PA. US 18222


Domain Name: EXPERTROOMS.COM

------------------------------------------------------------------------
Promote your business to millions of viewers for only $1 a month
Learn how you can get an Enhanced Business Listing here for your domain name.
Learn more at http://www.NetworkSolutions.com/
------------------------------------------------------------------------

Administrative Contact, Technical Contact:
Efenaz Turizm Seyahat Acentasi [email protected]
ATTN EXPERTROOMS.COM
care of Network Solutions
PO Box 459
Drums, PA 18222
US
570-708-8780


Record expires on 18-Jul-2012.
Record created on 18-Jul-2011.
Database last updated on 2-Aug-2011 12:51:48 EDT.

Domain servers in listed order:

NS39.WORLDNIC.COM 205.178.190.20
NS40.WORLDNIC.COM 206.188.198.20

This listing is a Network Solutions Private Registration. Mail
correspondence to this address must be sent via USPS Express Mail(TM) or
USPS Certified Mail(R); all other mail will not be processed. Be sure to
include the registrant's domain name in the address.

Network Whois record

Queried whois.ripe.net with "-B 188.138.72.50"...

% Information related to '188.138.72.0 - 188.138.79.255'

inetnum: 188.138.72.0 - 188.138.79.255
netname: BSB-Service-1
descr: BSB-Service GmbH
country: DE
admin-c: NPA10-RIPE
tech-c: NPA10-RIPE
status: ASSIGNED PA
remarks: **************************************
remarks: * These IPs are static IPs assigned *
remarks: * to customer-servers of BSB Service *
remarks: * For abuse-complaints please use *
remarks: * Abuse-Contact: [email protected] *
remarks: * only. Abuse-Complaints to any *
remarks: * other address will NOT be handled *
remarks: **************************************
mnt-by: INTERGENIA-MNT
source: RIPE
changed: [email protected] 20110630

role: NMC PlusServer AG
address: PlusServer AG
address: Daimlerstr. 9-11
address: 50354 Huerth
phone: +49 1801 119991
fax-no: +49 2233 612-53500
e-mail: [email protected]
abuse-mailbox: [email protected]
remarks:
remarks: ********************************************************
remarks: * PLEASE READ CAREFULLY: *
remarks: * and choose the right addresses for contacting our *
remarks: * staff. *
remarks: * This will fasten up processing your request ! *
remarks: ********************************************************
remarks: * ABUSE-Complaints are only handled at: *
remarks: * [email protected] *
remarks: ********************************************************
remarks: * Auskunftsersuchen gemaess TKG werden nur unter *
remarks: * Fax: +49 2233 612 5150 *
remarks: * bearbeitet! *
remarks: ********************************************************
remarks: * Informational Contact: [email protected] *
remarks: * or http://www.plusserver.de *
remarks: ********************************************************
remarks:
remarks: ********************************************************
remarks: * If you really have a routing-related request or if *
remarks: * you are not able to read you may use the details *
remarks: * below for contacting us *
remarks: * *
remarks: * Phone: +49 1801 119991 *
remarks: * Fax: +49 2233 612-53500 *
remarks: * *
remarks: ********************************************************
remarks:
admin-c: JBPS-RIPE
tech-c: OHPS-RIPE
tech-c: CDPS-RIPE
tech-c: ADPS-RIPE
nic-hdl: NPA10-RIPE
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110329
source: RIPE

% Information related to '188.138.0.0/17AS8972'

route: 188.138.0.0/17
descr: Plusserver AG
origin: AS8972
mnt-by: INTERGENIA-MNT
changed: [email protected] 20110628
source: RIPE

No surprise here. IP address same as above.
#60709 by Katharina Tue Aug 02, 2011 1:04 pm
Now I've taken a quote from Bookmeanhotels - About Us
BookMeAnHotels.com has specialised in selling hotel accommodation online since 2001.
We have over 60,000 hotels listed on our website located all over the World offering you the best possible rate in the fastest possible time. Because of the large number of hotel reservations we process daily, we are able to get very good hotel rates. We offer discounted internet rates for all internet users. To secure your reservation at these low rates, we require up-front credit card payment. This will ensure that you have a room when you arrive at your destination.

and compared it to About us of Expert Rooms:
ExpertRooms.com has specialised in selling hotel accommodation online since 2001.

We have over 50.000+ hotels listed on our website located all over the World offering you the best possible rate in the fastest possible time. Because of the large number of hotel reservations we process daily, we are able to get very good hotel rates. We offer discounted internet rates for all internet users. To secure your reservation at these low rates, we require up-front credit card payment. This will ensure that you have a room when you arrive at your destination.


To our mods:
I've made several posts to guarantee easy reading; feel free to join them if you like.
#60710 by Katharina Tue Aug 02, 2011 1:07 pm
So, to make a long story short, you are right, the websites are extremely fishy. If you want help to investigate and get the sites closed, please contact our moderator Michael via PM. Our moderators' names are green.
#60729 by Michael Tue Aug 02, 2011 5:08 pm
These websites are most definately fake and only exist with one purpose - credit card phishing. Stay far away.

This looks like it's going to be a can of worms and we'll definately look into it.

Account inactive - messages are not being monitored
#61626 by Tarien Wed Aug 10, 2011 6:28 am
I think i've fwll into the trap :( :( :( of yourhotelsbook.com


pbn123 wrote:I know these sites are fake, I just need a bit of a hand in getting them taken down:

Yourhotelsbook.com

Bookmeanhotels.com

Roomsrecord.com

Expertrooms.com

Thanks a lot.
#61646 by Katharina Wed Aug 10, 2011 10:24 am
Welcome Tarien,
I'm so sorry you've lost money!
There is a - very slight :( - chance you might get your money back if you have paid by credit card or bank transfer.
In this case, your need to contact your bank or credit card company and ask them to recall your transfer. But you need proof, so don't delete your email correspondence with the scammer.
#63622 by Etranger Wed Aug 24, 2011 9:50 am
Another website they have used recently is mybookingcentrals.com

Creditcard payments are conversed in Turkish liras under the name Onder Turizm Otel Reze or Ufuk Turkey, Istanbul. They will try to use your credit card details for buying things in Tukey. First they try to find oud if your credit card is still working by making a booking of 1 eurocent and immediately after that they try to buy someting big, in my case at a Turkish garage.
#64047 by pbn123 Sat Aug 27, 2011 3:23 pm
Katharina, they don't get their victims from emails, but by placing ads on travel-related websites.

Who is online

Users browsing this forum: No registered users and 22 guests