Pandora at www.soez a scam?

[Cheriew]

I recently ordered 2 charms for my daughter at what I thot was the Pandora store.
But, the confirmation email came from http://www.soez.ca. The charge went on my credit card March 14 the same day I placed my order. However, now that I realize it came from soez not Pandora, I see there is no phone number under contact us. The email I sent was returned and the so called live chat does not work. They emailed me a confirmation number for my order and state still sitting at pending. That was on March 14 and I ave recd nothing since then. There is no way to contact them. I've googled and googled this soez and find nothing. I'm sure I was duped, but wondered if u would happen to know anything?
The site is called Pandora jewlery with a web address of http://www.soez.ca

Thank you very much.

[Justin]

Sorry to say it is a fake website. That website was created just a couple weeks ago. Call your credit card company and report it as a fraudulent charge.

Domain name: soez.ca
Domain status: registered
Creation date: 2015/03/09
Expiry date: 2016/03/09
Updated date: 2015/03/14
DNSSEC: Unsigned

[Bryon Williams]

Report the fraud to your Credit Card company. See if they will reimburse you. You will also want to get a new account number. The scammer may have phished your details.

The site was registered 10 days ago for one year using Public Domain Registry. All signs of a scam.

Domain name: soez.ca
Domain status: registered
Creation date: 2015/03/09
Expiry date: 2016/03/09
Updated date: 2015/03/14
DNSSEC: Unsigned

Registrar:
Name: PublicDomainRegistry.com Inc
Number: 3059041

[Cheriew]

Thanks Justin. I just called my cc company. Do I need to worry they have my email address? I know I shouldn't have used my regular home one, another mistake! I usually am very careful when ordering online. Other than checking that web address, how do you know it's legit or not?

[Justin]

It's not the end of the world they have your email address more than likely it will just lead to some spam.

If a site looks suspicious Google it first. You can also check the registration info like what I posted at https://www.whois.net

There's a lot of info there that may not make sense but most important is what I posted. Scammers often only register sites for one year (usually the domain sellers minimum). Sites will often be fairly recently registered these sites get shut down pretty quick.

[AlanJones]

In addition to the recent and short-term registration that Bryon and Justin mentioned, legitimate businesses will have full physical contact details on their website (not just an email address or form to fill in) - in many countries this is a legal requirement for eCommerce websites. Although, having the details isn't a sign of legitimacy, not having them is a sure fire sign of a scam.

[Cheriew]

Thank you all for your help and advice. I have cancelled my cc. Now I am receiving another email, but from another email address

Your Order #Pca201852879 (placed on March 14, 2015)
=============================
please wait, your parcel is on the way.

[email protected]

Should I wait before putting thru the dispute with with cc company?

[Justin]

No go ahead and report the fraudulent charge so you get your money back. I'd call them and ask about all your recent charges as they may have used your card number for several transactions.

[vonpaso xlura]

onlinesaleok.com was registered on 2014-01-16 by hidden, then extended a year later for two years, and has no website. Don't believe it when it says your parcel is on its way. Please post the complete headers of the email from onlinesaleok.com so that we can kill it.

[vonpaso xlura]

soez.ca is in the process of being reported for fraud. In the process of checking it, I tried https://www.soez.ca and got a different site, fadhits.com. I'm not sure if Fadhits is scammy, but its registration is dodgy:

Registrant Name: Lakeshia Henry
Registrant Organization: wei hongli
Registrant Street: 505 Brookside lane
Registrant City: Balch Springs
Registrant State/Province: Texas
Registrant Postal Code: 75180
Registrant Country: US
Registrant Phone : 0013232759886
Registrant Phone Ext:
Registrant Fax: 0013232759886
Registrant Fax Ext:
Registrant Email: [email protected]

1-323-275-9886 is in California, not Texas, and no one living in California or Texas would write two zeros at the start of the phone number.

[HillBilly]

VX, you went to httpS:// site..... not http://

apparently it is a redirect for the secure portion of the soez.ca site, but an invalid certificate regardless. I'd bet they're both scams...

[Cheriew]

Thank you again. Yes, please shut those s*ckers down with my pleasure! I hope this is what you need. I had a hard time time this on ipad and tried to copy and paste from my w8 which isn't too user friendly either.
x-store-info:SmXCjkY1Un5L3qlTmewTw2528Vzv4BD3O7sA89/ZDmti9NIOfl7ESqJqPOZKlKrJMZ+1P3kx53c6n7Y4RjTlQwS4UBKrmbiQf5MsB50A//WVLW80t3p+bZHpfvqwL3A3+h/7b1+Bmpk=
Authentication-Results: hotmail.com; spf=temperror (sender IP is 69.168.103.61) smtp.mailfrom=[email protected]; dkim=none header.d=onlinesaleok.com; x-hmca=none header.id=[email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MTtsPTE7YT0xO0Q9MDtHRD0wO1NDTD0w
X-Message-Info: SYIGCxALW9OLwHw3hkdnx0I6FUDqipyJ6YnKuYJrAmtQnCOI+3SNJSpD6J72h2RGNmiycnZz4bFVMHH7d0u3rjdkS75lvsIzzRUeuaCHr4XNqD/18ktq4Vm/BWVpDD+qvb33Yb7xMC77KYmV+jesBuhiHfeRs0PwzbCeBsFMU5YgZMBmCuQzeWpuuDrmrZJ7aDieqKaq+AR+iUs/zWEPW8cqgAkwIy64S+Ckp2kvdu4=
Received: from mx.mymts.net ([69.168.103.61]) by BAY004-PAMC2F2.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Fri, 20 Mar 2015 10:20:54 -0700
Return-Path: <[email protected]>
x-binding: premig.mymts.net
X_CMAE_Category: , ,
X-CNFS-Analysis: v=2.1 cv=KPVODT1o c=1 sm=1 tr=0 a=IpI4vi5p+vHplZWl6YPSQg==:117 a=IpI4vi5p+vHplZWl6YPSQg==:17 a=K-v-2zaBAAAA:8 a=jPJDawAOAc8A:10 a=X59dXY-DAAAA:8 a=6Wo7EV89uf0A:10 a=ugHOSBfCn_59-7-FkpgA:9 a=QEXdDO2ut3YA:10 a=EeLJKq1j3Kp6RpiuomsA:9 a=_W_S_7VecoQA:10 a=6YDiXO0Z-fcA:10 a=p_sMNrRov9AA:10 a=U_S3d76m-4kA:10
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Received: from [123.126.65.59] ([123.126.65.59:58991] helo=m65059.126.com)
by mx.mymts.net (envelope-from <[email protected]>)
(ecelerity 3.6.6.45965 r(Core:3.6.6.0)) with ESMTP
id 73/36-24803-9E65C055; Fri, 20 Mar 2015 13:20:52 -0400
Message-ID: <550C56E8.06352B.01287>
Subject: =?utf-8?B?amV3ZWxyeSDoh6rliqjlm57lpI06IFJlOiBQY2EyMDE4NTI4Nzk=?=
References: <[email protected]>
<[email protected]>
From: [email protected]
Content-Type: Multipart/Alternative;
boundary="------------Boundary-00=_GITIXYWS4VIBH42JDL51"
In-Reply-To: <[email protected]>
Date: Fri, 20 Mar 2015 12:20:29 -0500

MIME-Version: 1.0
X-CM-TRANSID: O9OowAA3x3zhVgxVPvALAA--.0S3.re
X-CM-SenderInfo: pmhzvzlu16005olqv25doh0yoofrz/
Delivered-To: [email protected]
Errors-to: [email protected]
X-OriginalArrivalTime: 20 Mar 2015 17:20:54.0539 (UTC) FILETIME=[38C05DB0:01D06332]


--------------Boundary-00=_GITIXYWS4VIBH42JDL51
Content-Type: Text/Plain;
charset="utf-8"
Content-Transfer-Encoding: base64

5pys6YKu5Lu25Li6SFRNTOagvOW8j++8jOivt+WIh+aNouWIsEhUTUzmmL7npLrpobXpnaLjgIIN
Cg==

--------------Boundary-00=_GITIXYWS4VIBH42JDL51
Content-Type: Text/HTML;
charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PWdiMjMxMiIgLz4NCjxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250
ZW50PSIiIC8+DQo8bWV0YSBuYW1lPSJEZXNjcmlwdGlvbiIgY29udGVudD0iIiAvPg0KPHRpdGxl
PjwvdGl0bGU+DQo8L2hlYWQ+DQoNCjxib2R5Pg0KPHByZT4NCjxkaXY+PGZvbnQgc2l6ZT0iMiI+
RGVhciBjdXN0b21lcu+8jDxiciAvPndlIGFyZSZuYnNwOyBoYXZpbmcgb3VyIHdlZWtlbmRzLCB3
aGVuIHdlIGNvbWUgYmFjayx3ZSB3aWxsIHJlcGx5IHlvdSBhc2FwLCB0aGFuayB5b3UuPGJyIC8+
PC9mb250PjwvZGl2PjxwPjxmb250IGZhY2U9Ium7keS9kyIgc2l6ZT0iMiI+PGJyIC8+PC9mb250
PjwvcD4NCjwvcHJlPg0KPC9ib2R5Pg0KPC9odG1sPg==

--------------Boundary-00=_GITIXYWS4VIBH42JDL51--

[vonpaso xlura]

I checked https because there are McAfee and Verisign seals at the bottom of the page. It came up with a certificate error, saying that the certificate for soez.ca belongs to fadhits.com, to which it redirected me. http://soez.ca brings up the fake Pandora site.

The headers do not show the mail passing through onlinesaleok's MX, but PDR has been notified anyway.

[Cheriew]

I just received another email today with another email address for tracking. This email came from the same [email protected] address.

Dear C..........
Your order has been shipped, the package tracking number is EA091999403CN. You can check your order logistics information from the website below.
Tracking website:http://www.ems.com.cn/english.html
The specific delivery time will vary according to your choice of shipping methods. Generally speaking, the period for delivery is 3-15 working days.
Please feel free to contact us if you have any problem. For faster service please reply directly to this email.
Best Wishes, thank you!
.................................................

I don't know... Do u think it's really coming?

[HillBilly]

I just received another email today with another email address for tracking. This email came from the same [email protected] address.

Tracking website: http://www.ems.com.cn/english.html
The specific delivery time will vary according to your choice of shipping methods. Generally speaking, the period for delivery is 3-15 working days.
Please feel free to contact us if you have any problem. For faster service please reply directly to this email.
Best Wishes, thank you!
.................................................

I don't know... Do u think it's really coming?

No, it is not coming. There is no tracking # in there specific to your package to begin with. Unless they gave you a tracking # and you edited it out of your post ( which would have been OK, if you did that). But most people would just XXX out the #'s of the tracking #....

They are just stringing you along hoping to buy time so that you will go past the 28 day limit on reversing the CC charges. If they can make it past those 28 days, you have no recourse at all for any of your money back. Be sure to stay on the CC company and make sure your money is refunded pronto.

You should ask your CC company to re-issue you another card with different #'s and code on it now that that card has likely been compromised by a fake website, too.