amobils.com

[TerranceBoyce]

http://webcache.googleusercontent.com/s ... en&ct=clnk

2006 TOYOTA CV RAV 4 103,000 klm $9,200.00 Fairfield Area Cabramatta West

It's interesting to note that this domain name, which is associated with many fraudulent adverts appearing on Autotrader in the UK, is also appearing on adverts in Australia.

[AlanJones]

Looks like that domain was used previously for car scams - it's on the AA419 database from 2008.

I'll try and get it closed down again.

[TerranceBoyce]

I suspect that it's likely to be one of the Eastern European ones that are fiendishly difficult to shut down, and if you manage it, it only pops up elsewhere.

It might be better to exploit the fact that it acts as a scam 'marker' rather than waste time on it. I know I've used it to track down scams I wouldn't have found otherwise, though I won't miss it if it can be 'killed'.

[AlanJones]

This gang of scammers are also using email addresses on the domain wwause.com in the adverts that they place.

An email to one of the email addresses on the amobils.com or wwause.com domains will result in a response from a gmail account, claiming to be the owner of the car.

The scammers are using the fake site www.escrow-limited.co.uk, which pretends to be an escrow company which holds payments between parties. The site claims to be a UK registered company called Escrow Limited Ltd and to have been in business since 1999. There is no such registered company listed on the Companies House website and the domain was only registered a few days ago to an individual in Australia.

[AlanJones]

Another email address and domain used by the scammer as part of the Escrow registration process [email protected].

Recently registered, with registrants details hidden by privacy protection.

[John Barry]

I love the thought of Escrow Ltd Ltd!!, Also nice that the registrant email addy is escrow-ange.com as most of the sites content has been stolen from the legitimate https://www.escrowangel.com.au/?

And what hasn't been robbed from there has been swiped from the very legit escrow.com. But the topper for me

Headquartered in Rancho Santa Margarita, London, Escrow.com and its operating subsidiaries provide online escrow services that facilitate and accelerate e-commerce by assuring a secure settlement.

Now to getting all these associated domains shut down!

[AlanJones]

Another domain to be added to the party - escrow-itrust.com.

The email address [email protected] is used to send out the bank details for the payments to be made to (they'll be listed later when I've sorted out a sufficient paper trail for them to be reported for fraud).

[AlanJones]

This post serves as a "paper trail" for anyone investigating the bank account that I will be posting at the bottom.

First an enquiry is sent to [email protected] - note the message Id in the header

MIME-Version: 1.0
Received: by 10.96.74.67 with HTTP; Tue, 3 Dec 2013 00:47:23 -0800 (PST)
Date: Tue, 3 Dec 2013 09:47:23 +0100
Delivered-To: XXX
Message-ID: <CAJizjsRJmWuhDBzMjPaPAOieJbCJW4BRLM=[email protected]>
Subject: BMW X5
From: XXX
To: [email protected]
Content-Type: multipart/alternative; boundary=047d7b2e0c9f5866de04ec9d5815

Is it still for sale?

A reply is received from [email protected] (note the matching ID in the In-Reply-To field)

Delivered-To: XXX
Received: by 10.96.74.67 with SMTP id r3csp183786qdv;
Tue, 3 Dec 2013 03:43:58 -0800 (PST)
Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 10.180.94.7 as permitted sender) client-ip=10.180.94.7
Authentication-Results: mr.google.com;
spf=pass (google.com: domain of [email protected] designates 10.180.94.7 as permitted sender) smtp.mail=[email protected];
dkim=pass [email protected]
X-Received: from mr.google.com ([10.180.94.7])
by 10.180.94.7 with SMTP id cy7mr2009992wib.21.1386071037961 (num_hops = 1);
Tue, 03 Dec 2013 03:43:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:in-reply-to:referencesmessage-id:subject:from:to
:content-type;
bh=DTU9g4bZp5zXd68LrtGibtnV4xLtCq9M4zBe4iQ2hig=;
b=gNWbWyspASVcNhjjsFWvU0+NyfXoJshbI1VkYZPlALgr03SCF3g74hRJoLT5OeJSrl
1jBUwGmG64+NB7UmXYNQnPndInyiIDSPN4wvtzsfWJmiYDuR3JcMsY1C/UpHPNZwZbie
JWJd5ARzSu26Ej22qTukvyjuCWmdukDknDllZNHiW8q8vVhMplt5EdUnNU5awxOW0yYw
QgZoHoPLWH60t678Oay4YM/idOkTH5lCXlaogzhjB7aXDQWBHjU6pIYXVMJ2fpHhHyXU
D3lT3VprIfF6hZArRyZr/77GiLciardPv6FUDKw6H0rFfJYcoummu9eduBljL/k9NxGX
vQrQ==
MIME-Version: 1.0
X-Received: by 10.180.94.7 with SMTP id cy7mr2009992wib.21.1386071037955; Tue,
03 Dec 2013 03:43:57 -0800 (PST)
Received: by 10.194.175.7 with HTTP; Tue, 3 Dec 2013 03:43:57 -0800 (PST)
In-Reply-To: <CAJizjsRJmWuhDBzMjPaPAOieJbCJW4BRLM=[email protected]>
References: <CAJizjsRJmWuhDBzMjPaPAOieJbCJW4BRLM=[email protected]>
Date: Tue, 3 Dec 2013 11:43:57 +0000
Message-ID: <CAE5R4iu+NHveJrcUR2goQ3ZTcie-c5gX3pHHVhUkJuDOE0yzLQ@mail.gmail.com>
Subject: Re: BMW X5
From: Lean Ashley <[email protected]>
To: XXX
Content-Type: multipart/alternative; boundary=f46d04440372d9d4bf04ec9fcfa1

Hello there,

I am the seller of the BMW X5 - listed on autotrader. I am very glad you have interest in buying my car.

The car is still available, ro tax and also has a mot, clear hpi, very good condition and all in perfect working order and exterior look great, no accidents. I had to move to Denmark due to my company's decision. I already received a new car from the company. Besides, there are a lot of things which have priority now, so, this car has to go. The price would be £9000.

Due to the fact that I am very busy with my work and I don’t stay too much at home, we left the car to a shipping company so it can be delivered to the new owner. If you are interested, I need the post code of your delivery address so I can calculate the shipping cost ( I agree to support the transportation charges 50-50 if that is suitable for you). or you can come and collect the car.I am ready to deduct £200 ( from the car price) for the plane ticket .

Cheers

The following email is eventually received from [email protected]

Delivered-To: XXX
Received: by 10.96.74.67 with SMTP id r3csp187265qdv;
Tue, 3 Dec 2013 04:37:57 -0800 (PST)
Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 10.180.108.162 as permitted sender) client-ip=10.180.108.162
Authentication-Results: mr.google.com;
spf=pass (google.com: domain of [email protected] designates 10.180.108.162 as permitted sender) smtp.mail=[email protected];
dkim=pass [email protected]
X-Received: from mr.google.com ([10.180.108.162])
by 10.180.108.162 with SMTP id hl2mr2258884wib.56.1386074277268 (num_hops = 1);
Tue, 03 Dec 2013 04:37:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:in-reply-to:referencesmessage-id:subject:from:to
:content-type;
bh=TkSoKi+k8ykbPOkLnECm3IT6NrDdb2GC5rdREaj03OM=;
b=V96cm/6WM/rZMn+1Ghfk4NNPNBFQoQbCxASFwqZAuAun1LwPa4rBEN9NKLVuIfZGZ0
W3EweYrJiqbs8Iz84v4x3jkoeJUxv2yWCwRKLdsfG0gIk/CilvLGbUTZOEx2OhfB/zNk
4ojcRU4eMGgvi5WUKkC+6HPOjdU/o35NL2hZog9lIJUy1x1X6DP+0N0eKCGMyGR9mN43
Ccr+QLARhL5tOxZBnNK2D+kcJMil1nd1NjtXVxEjJsEBoafUckAMAZtNnsBIGcxl+Wsx
wrQyOc57slsIo/RA2A60fGNt4IGfm46f+z/2fN4ynJWSbB+UPlmBcW4ub2qV5Q9cRIA6
Bb2A==
MIME-Version: 1.0
X-Received: by 10.180.108.162 with SMTP id hl2mr2258884wib.56.1386074277264;
Tue, 03 Dec 2013 04:37:57 -0800 (PST)
Received: by 10.194.175.7 with HTTP; Tue, 3 Dec 2013 04:37:57 -0800 (PST)
In-Reply-To: <CAJizjsTrD16SPf5J6v2dWHUZCAfwK+w=2veCEkCxM=[email protected]>
References: <[email protected]>
<CAJizjsR2dc-nBo4e35nabG66qfiN8nEF=[email protected]>
<CAJizjsTrD16SPf5J6v2dWHUZCAfwK+w=2veCEkCxM=[email protected]>
Date: Tue, 3 Dec 2013 12:37:57 +0000
Message-ID: <CAE5R4is3KnoXywtW9smQ6cUAdX83g5URkqpHQAea+auOhNHpaQ@mail.gmail.com>
Subject: Re: bmw x5
From: Lean Ashley <[email protected]>
To: XXX
Content-Type: multipart/alternative; boundary=e89a8f3bac6fedc0f104eca090bc

Hello again ,

I just made a quote with the shipping company and total costs of delivery will be £310.00 , like i said i will pay half from this, and the total price for the car including delivery will be £9155 .
I`ve contacted the Escrow Limited Ltd (http://escrow-limited.co.uk/) regarding this issue and they told me that they could offer to me a program that is created especially for online transactions that protects both of us. They agreed to supervise this deal. You will send the funds to the escrow company and they will keep the money until you receive the vehicle and test it. In this way both buyer and seller are 100% covered during the steps of this transaction. They will hold and insure your money until receipt of the car in good condition.That is how their service is working. As far as the seller concerns, i will be glad to know that Escrow Limited Ltd is in possession of the funds during the delivery period.

You will be given a 5 days inspection period from the day you receive the car at home( i will ship it to your address insured for full value to you ). If you decide to keep the car, then you will have to authorize Escrow Limited Ltd to release the funds to me, and the transaction is complete. If the vehicle is not as describe perfect interior,exterior,mechanical condition ), you will be able to send the vehicle back through the same shipping company ( return postage at my expense ), and ask Escrow Limited Ltd to return the money to you.

If you wish to purchase it and agree to these terms i will need you to register on their website and give me your email which you used to register to start the transaction.
Here is me phone number: 07866166107

Kind regards

Going to the website mentioned (http://www.escrow-limited.co.uk) and registering results in the following email being received (note the domain and account in the Return-Path).

Delivered-To: XXX
Received: by 10.96.74.67 with SMTP id r3csp213763qdv;
Tue, 3 Dec 2013 10:38:19 -0800 (PST)
X-Received: by 10.180.108.42 with SMTP id hh10mr3788310wib.15.1386095899002;
Tue, 03 Dec 2013 10:38:19 -0800 (PST)
Return-Path: <[email protected]>
Received: from VVPS-512342.home (vvps-512342.dailyvps.co.uk. [195.234.11.206])
by mx.google.com with ESMTP id h3si31465971wjw.0.2013.12.03.10.38.17
for XXX;
Tue, 03 Dec 2013 10:38:17 -0800 (PST)
Received-SPF: neutral (google.com: 195.234.11.206 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=195.234.11.206;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 195.234.11.206 is neither permitted nor denied by best guess record for domain of [email protected]) smtp.mail=[email protected]
Received: from vvps-512342 ([127.0.0.1]) by home with MailEnable ESMTP; Tue, 3 Dec 2013 18:37:44 +0000
Date: Tue, 03 Dec 2013 18:37:44 +0000
Subject: Escrow Angel Ltd.:Payment Invoice #:XXX
To: XXX
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: [email protected]
Message-ID: <A19A91C5211D4D3B9E8EE62FC4524EAB.MAI@home>

Payment instructions

Vehicle transaction
Transaction #: XXX
Transaction title: BMW X5 xDrive30d SE 5dr Auto 3.0
Buyer: XXX
Seller: Lean Ashley
Item transaction
I would like to pay via:
Bank Transfer
Payment method details
Payment instructions
Beneficiary / Account Name : A R Strungareanu Limited Ltd
Account Address : 274A Kingsbury Rd London NW9 0BY, UK ?
Account Number : 705936XX
Sort Code : 20-29-41
Swiftbic : BARCGB22
Bank Name : Barclays
Bank Address : 505-507 Kingsbury Rd London NW9 9EG, UK ?
Reference No : XXX


Amount: GBP 9,155.00
Shipping Cost: GBP 1.00
Escrow Angel Ltd. fee: GBP 24.95
Total: GBP 9180.95

When transfering the funds, please follow these instructions:
1. Ensure that the amount to be transferred is in GBP - (British Pound)
2. Ensure that all bank fees are charged to the REMITTER (NOT the Beneficiary)
3. Ensure that you enter the Ref number in the "Description" field (or similar field provided by your bank) so that we can identify your payment

The company name A R Strungareanu Limited Ltd given as the account holder does not appear on the Companies House register of Limited companies, so is probably not the real name of the account holder.

[AlanJones]

Another domain being used by these scammers is london09.com.

A search on Google shows that in the past, it has been used for phishing attempts and also ebay scams.

[AlanJones]

A lot of the scammer's domains appear to have suffered accidents overnight .

Their latest attempt at an escrow site is www.limited-escrow.com, but it probably won't be around for long.

[AlanJones]

Looks like the scammer is now getting desparate after so many of his websites have disappeared so quickly - he has given up registering domains for his fake escrow site and is just directing victims to the IP address, which is 91.223.16.118.

[TerranceBoyce]

It will be very effective applying a 'full court press' on him, with different strands of the operation facing mishaps and exposure. I've had the day out so I can now give a full week of undivided attention to this group and I can follow up on some of the leads I picked up from his mistakes.

Having a list of the photos he's using together with e-mail addies and car descriptions will act as a useful reference tool for potential victims and 'baiters and put pressure on the fraudster to complicate his methods and tactics. I have no preference as to what he decides to do, I can cope with either. If he reacts then I'll know that I can influence what he does.

Working a scam on this scale has to be by definition predictable and operating to a plan, so working it out only takes time and I have plenty of that. Any new domains he sets up I'll pick up and record automatically as part of my current working process. When I have spare time I'll look across at ebay.

[AlanJones]

The scammer now appears to be using the domain escrowlimited.com as his fake Escrow company website.

[TerranceBoyce]

I have a general idea of the scammer's current working process as regards fraudulent postings on Autotrader.

Currently he's making his posts in the evening or early night. I can pick them up easily, but I don't have to report each one, just a selection. Autotrader appear to be unlinking them from the dealer search feature promptly so that they become virtually invisible on the site, though I can still pick them up and record details for a short time. That means that the fraudulent adverts are only actually visible, at best overnight, which is when I can record details of the photos and e-mail addies that the scammer is using. By recording these details, it makes the scams much less effective if anyone ever sees them and puts pressure on the scammer to have to waste much more effort producing new photo shopped pictures and new mail boxes, and monitoring and handling them all.

I should be able to refine what I'm doing to make it quicker and less time consuming to pick them up, report and record them. The scammer has to decide if it achieves anything to spend his time producing more mail boxes and photo shopped pictures.

[AlanJones]

More new bank details provided by the scammer

Delivered-To: XXX
Received: by 10.96.74.67 with SMTP id r3csp341863qdv;
Thu, 5 Dec 2013 04:51:31 -0800 (PST)
X-Received: by 10.194.119.132 with SMTP id ku4mr16999051wjb.51.1386247891196;
Thu, 05 Dec 2013 04:51:31 -0800 (PST)
Return-Path: <[email protected]>
Received: from webmail01.hostvue.com (webmail01.hostvue.com. [195.26.90.76])
by mx.google.com with ESMTPS id b5si1016218wik.81.2013.12.05.04.51.30
for <XXX>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Thu, 05 Dec 2013 04:51:31 -0800 (PST)
Received-SPF: neutral (google.com: 195.26.90.76 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=195.26.90.76;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 195.26.90.76 is neither permitted nor denied by best guess record for domain of [email protected]) smtp.mail=[email protected]
Received: from apache by webmail01.hostvue.com with local (Exim 4.72)
(envelope-from <[email protected]>)
id 1VoYOw-0002kl-KI
for XXX; Thu, 05 Dec 2013 12:51:30 +0000
Received: from 37.235.55.33
(SquirrelMail authenticated user [email protected])
by webmail.daily.co.uk with HTTP;
Thu, 5 Dec 2013 12:51:30 -0000
Message-ID: <[email protected]>
Date: Thu, 5 Dec 2013 12:51:30 -0000
Subject: Transaction no#: XXX - Transaction title: XXX
5dr Auto 3.0
From: "Eescrow Limited Ltd" <[email protected]>
To: XXX
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.22
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20131205125130_38843"
X-Priority: 3 (Normal)
Importance: Normal

Dear XXX,

XXX ask us to send you the payment invoice , please see the
file attached and follow our instruction to complete the transaction.
We are sorry but our website is under maintenance issues.

For any question please contact directly us at: [email protected]
Thank You,



--
Copyright © 1999-2013 Escrow Limited Ltd, Inc. All rights reserved

Attached to the email was a PDF with the following content

*Escrow Limited Ltd.

Transaction no#: XXX - Transaction title: XXX

Payment Status: Pending



Dear XXX,



Attention: Please read the following information carefully on how to make the payment!



Recommended. 1. Online bank transfer to our bank account using the following reference number XXX.

2. You can go to a Barclays Branch and make the deposit in our Bank Account using the reference

number XXX.

It is not recommended to make the payment from your local Branch because you will pay an high commission.

Our Bank Details:

Beneficiary / Account Name : E Cosoava Limited Ltd

Account Address : 36 Grange Court, Birse Crescent, Willesden, NW10 1SH, United Kingdom ?

Account Number : 130531XX

Sort Code : 20-91-79

Swiftbic : BARCGB22

Bank Name : Barclays

Bank Address : 6 Church street, Rickmansworth, WD3 1BT, United Kingdom ?

Reference No : XXX

We will hold the payment details and the entire amount of money until you send us your confirmation that you are

satisfied with the product you received.

As soon as we receive your confirmation we will release the payment details to the seller .



*NOTE It may occur that your e-mail doesn't support HTML language and that is why you haven't received the

invoice from us.

Please check your bulk/junk/spam/ messages, the invoice may have ended there because of the ever increasing

filters of the e-mails.

Thank you,