amobils.com

[AlanJones]

Another email only domain -

[email protected]
escrowlimited.co.uk

[AlanJones]

The bank accounts being used (with the fake company names as account holders) are actually in the names of Andrei Razvan Strungareanu and Emanuel Cosoava.

The SANKOOJ mail addie has cropped up again today

http://www.scamwarners.com/forum/viewtopic.php?f=6&t=79007&p=183460#p183460

It even pops up here on auto trader.com.au

2010 VOLKSWAGEN PASSAT 125 TDI HIGHLINE 3C MY10 UPGRADE - $13,800

http://www.autotrader.com.au/cars-for-sale/2010-VOLKSWAGEN-PASSAT-125%20TDI%20HIGHLINE-3C%20MY10%20UPGRADE-ATW3368934/

Nice work on the account names. Playing that sort of game with account names is such an old trick, no bank that doesn't want to become a laughing stock should be duped that way. The problem is that such tricks can actually be used against the bank, but it's probably best that I don't even hint at how it can be done. Holding the account of a criminal is like keeping a tiger as a pet. You're going to get bitten. The bank itself is always going to be the most attractive target.

[AlanJones]

Another one of the scammer's bank accounts:

Delivered-To: XXX
Received: by 10.68.13.103 with SMTP id g7csp20084pbc;
Sat, 7 Dec 2013 11:45:59 -0800 (PST)
X-Received: by 10.180.90.114 with SMTP id bv18mr7880958wib.16.1386445558242;
Sat, 07 Dec 2013 11:45:58 -0800 (PST)
Return-Path: <[email protected]>
Received: from outbound-gw.openxchange.ahost.me (outbound-gw.openxchange.ahost.me. [94.136.40.163])
by mx.google.com with ESMTPS id w7si3789218wie.33.2013.12.07.11.45.57
for XXX
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 07 Dec 2013 11:45:58 -0800 (PST)
Received-SPF: neutral (google.com: 94.136.40.163 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=94.136.40.163;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 94.136.40.163 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from localhost ([127.0.0.1] helo=outbound-gw.openxchange.ahost.me)
by outbound-gw.openxchange.ahost.me with esmtps (TLSv1:RC4-MD5:128)
(Exim 4.72)
(envelope-from <[email protected]>)
id 1VpNp7-00031z-FT; Sat, 07 Dec 2013 19:45:57 +0000
Date: Sat, 7 Dec 2013 19:45:57 +0000 (GMT)
From: Escrow Limited Ltd <[email protected]>
Reply-To: Escrow Limited Ltd <[email protected]>
To: XXX, [email protected]
Message-ID: <1476544955.987486.1386445557424.JavaMail.open-xchange@webmail.123-reg.co.uk>
Subject: Transaction no#: XXX - Transaction title: XXX
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_987485_301898552.1386445557377"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v-
X-Originating-IP: 213.120.146.134

*Escrow Limited Ltd.

Transaction no#: XXX - Transaction title: XXX

Payment Status: Pending

Dear XXX,


We have been contacted by the seller and he informed us that the account which we provided you has some problem's, so we will provide you a new one where you need to make the payment .

Please make the payment now from your online banking :
Beneficiary / Account Name: Alex Dorofan
Sort Code: 20-96-55
Account Number: 131979XX
Bank Name : Barclays

After the payment is done please reply and send us the payment receipt.

We will hold the payment details and the entire amount of money until you send us your confirmation that you are satisfied with the product you received.
As soon as we receive your confirmation we will release the payment details to the seller .

*NOTE It may occur that your e-mail doesn't support HTML language and that is why you haven't received the invoice from us.
Please check your bulk/junk/spam/ messages, the invoice may have ended there because of the ever increasing filters of the e-mails.

[AlanJones]

The latest website used by the scammers is logisticsolutionsltd.co.uk.

Whilst researching logisticsolutionsltd.co.uk, I also found an identical fake website explo-international.co.uk - both have been reported as fraudulent.

I seem to have had an effect on the scammers targeting Autotrader UK and the list of scammer e-mails is a useful resource I'm updating for anyone wanting to make use of it.

I don't imagine that too many people will be looking to buy a car the weekend before Christmas as they wouldn't be able to pick it up and they'll be doing other things, so the coming weekend will be the big one for scammers, and I'll be waiting as I always am.

Though I can pick up the large gang, I don't doubt that there are many 'singleton' scammers operating too, and I'll try to refine my methods to pick them up and I'll cover other ad sites as well, time permitting.

[AlanJones]

Another one of the AutoTrader scammers bank accounts

Delivered-To: XXX
Received: by 10.69.3.68 with SMTP id bu4csp114835pbd;
Sat, 14 Dec 2013 05:29:53 -0800 (PST)
X-Received: by 10.180.96.106 with SMTP id dr10mr6211319wib.27.1387027792346;
Sat, 14 Dec 2013 05:29:52 -0800 (PST)
Return-Path: <[email protected]>
Received: from outbound-gw.openxchange.ahost.me (outbound-gw.openxchange.ahost.me. [94.136.40.163])
by mx.google.com with ESMTPS id fv3si2166950wjb.114.2013.12.14.05.29.51
for XXX
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 14 Dec 2013 05:29:52 -0800 (PST)
Received-SPF: neutral (google.com: 94.136.40.163 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=94.136.40.163;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 94.136.40.163 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from localhost ([127.0.0.1] helo=outbound-gw.openxchange.ahost.me)
by outbound-gw.openxchange.ahost.me with esmtps (TLSv1:RC4-MD5:128)
(Exim 4.72)
(envelope-from <[email protected]>)
id 1VrpHz-0000gI-JW
for XXX; Sat, 14 Dec 2013 13:29:51 +0000
Date: Sat, 14 Dec 2013 13:29:51 +0000 (GMT)
From: "[email protected]" <[email protected]>
Reply-To: "[email protected]" <[email protected]>
To: XXX
Message-ID: <1801246273.1754051.1387027791603.JavaMail.open-xchange@webmail.123-reg.co.uk>
Subject: Transaction Details Invoice Number: 20240
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_1754050_442637991.1387027791549"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v-
X-Originating-IP: 172.163.134.171

Transaction Details Invoice Number: 20240
Invoice for Logistic Solutions Limited, Case ID 20240, between Charlie Olivers,
as Seller, and XXX, as Buyer. Please follow our instructions to
complete the transaction safely.


Invoice Number: 20240
Item: 2013 FORD FOCUS ZETEC TDCI TURBO DIESEL - REG:FP13LHR
Price: 5,700.00 GBP
Shipping: Included
Total Deposit Required: 5,700.00 GBP
Inspection Period: 10 days
Status: Awaiting Payment

Buyer Details: Seller Details:
Name: XXX
Address: XXX
Name: Charlie Olivers
Address: Europaradets Plass 1, Oslo N-0154, Norway
Payment Instructions: Where to send the payment
Payment must be submitted through a bank account wire transfer to one of our
Logistic Solutions Limited Center Agent in charge of your transaction. The
Logistic Solutions Limited Financing Center Agent will secure the payment until
the buyer receives the item,inspects and accepts it. If the buyer will reject
the item, the agent will refund the payment in full and arrange collection of
the item from the buyer within three (3) business days.
How to complete the payment:
1. You can transfer from your online banking or transfer from any branch to our
agent`s account.
2.For a fast process we recommend you to find any NatWest Bank branch and make a
direct deposit or bank transfer to our agent's bank account. (we will clear the
payment faster and start the shipping) The payment has to be sent to the
following bank account:

Agent Account Name: Linard Nerio
Bank Name: NatWest Bank
Bank Sort Code: 60-20-24
Bank Account Number: 38638444


Send the payment according to invoice payment details.
Contact Logistic Solutions Limited by replying to this e-mail with the following
payment information:
1. Sender's Name and address
2. Scanned receipt of the wire transfer
3. Amount Sent

Important Notice:
Logistic Solutions Limited will secure the payment until the Buyer receives,
inspects and accepts the vehicle. For security reasons please do not release the
payment details to the Seller or any other unauthorized person. All the
transaction, payment and personal information is considered confidential and
will not be released under any circumstances. Buyer receives the merchandise and
has ten(10)business days to inspect it. If it is complete and as described, the
buyer should accept the merchandise. If he refuses the merchandise the Seller
will be responsible of shipping back the vehicle.After the inspection period is
over, the Buyer must contact Logistic Solutions Limited with the result of the
inspection. If the buyer refuses the merchandise, the payment will be refunded
to the Buyer.If the merchandise is accepted, Logistic Solutions Limited submits
the payment directly to the Seller within three(3) business days.
Payment Invoice #:20240
Invoice Date: 13/12/2013
Total Deposit required: 5,700.00 GBP

--
Copyright (c) 2008-2013 Logistic Solutions Limited. All Rights Reserved.
Logistic Solutions Limited is a company registered in England.
Company number: 02687988.
Registered Office: c/o C/O ACAX, SUITE 24
BURLINGTON HOUSE
369 WELLINGBOROUGH ROAD
NORTHAMPTON
ENGLAND
NN1 4EU
http://www.logistic-solutionsltd.co.uk

The following domains have been setup in Australia over the past few days/weeks for motor vehicle/farm equipment online auction scams.:

CREEWSE.COM
email addresses used on ebay today -
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

GMAILAU.COM
email addresses used on ebay today -
[email protected]
[email protected]
[email protected]
[email protected]
email addresses used on ebay over past few days-
[email protected]
[email protected]
[email protected]

OPTUSAUS.COM
email addresses used on ebay over past few days-
[email protected]
[email protected]
[email protected]
[email protected]

Baiting has drawn out the email address of '[email protected]' using the name Martin Muller

A similar operation is being conducted with the following addresses but we have not as yet confirmed any definite connection to the above:

[email protected]

[email protected]
[email protected]
[email protected]
[email protected]

[email protected] also uses [email protected] and [email protected]

[email protected]

There have also been 14 similar fraudulent listings placed on Gumtree and 1 on Trading Post Online in the past fortnight, but we regret we did not record the addresses used.

Welcome to Scamwarners John Deere Scam.

It's hardly surprising that this organised criminal gang have moved their attention to Australia. They've been extremely active in Europe basing their crimes on money mule accounts set up with UK banks mostly. Without those 'money mule' accounts the fraud doesn't work. I would presume that they'd open bank accounts in Australia as I can't imagine it being an easy sell to buyers to transfer money to the UK, though I'd be interested whether or not this can be confirmed.

The gangs have appeared to be based mainly in Eastern Europe and Romania and, as regards agricultural and construction machinery, the victims have often been located in other Eastern European countries with the seller impersonating UK companies. European websites advertising machinery for sale have become so overwhelmed with fraudulent adverts that they serve no useful purpose. Many car websites have gone the same way with one major UK site having between 100 and 200 scam adverts posted daily. This appears to have stopped just recently and I have not known why. This may signal a switch of resources to focus on websites dealing with new parts of the world because more people have become aware of the frauds in the UK. Certainly some of the names you mention have become familiar to us here.

If it is coming your way in Australia it will be a major threat to buyers, consumers, companies, other sellers and websites. Victims have been baffled to discover how easy it is for fraudsters to post their scam adverts and then launder the stolen money with the police and authorities helpless to counter the threat. Not only do consumers and farmers/construction companies suffer but also the genuine companies trying to sell machinery and vehicles.