Final post on Nigerian scam

[Expat1 971]

Last email, just to send a lil message that we aren't all stupid.

Noticed the domain was created just a few days ago.

customerservice@ubaplc-nigr.com

Domain Name: UBAPLC-NIGR.COM
Registry Domain ID: 1972010947_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iaregistry.com
Registrar URL: www.spiritdomains.com
Updated Date: 2015-10-26T15:50:28Z
Creation Date: 2015-10-26T15:50:25Z
Registrar Registration Expiration Date: 2016-10-26T15:50:25Z
Registrar: THE REGISTRY AT INFO AVENUE
Registrar IANA ID: 123
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Heather Quick
Registrant Organization: N/A
Registrant Street: 1507 Perry Street
Registrant City: RICHMOND
Registrant State/Province: Virginia
Registrant Postal Code: 23224
Registrant Country: US
Registrant Phone: +1.9704566700
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: cashlink306@yahoo.com
Registry Admin ID:
Admin Name: Heather Quick
Admin Organization: N/A
Admin Street: 1507 Perry Street
Admin City: RICHMOND
Admin State/Province: Virginia
Admin Postal Code: 23224
Admin Country: US
Admin Phone: +1.9704566700
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: cashlink306@yahoo.com
Registry Tech ID:
Tech Name: Heather Quick
Tech Organization: N/A
Tech Street: 1507 Perry Street
Tech City: RICHMOND
Tech State/Province: Virginia
Tech Postal Code: 23224
Tech Country: US
Tech Phone: +1.9704566700
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: cashlink306@yahoo.com
Name Server: dns1.spiritdomains.com
Name Server: dns2.spiritdomains.com
Name Server: dns3.spiritdomains.com
Name Server: dns4.spiritdomains.com
DNSSEC:Unsigned
Registrar Abuse Contact Email: abuse@spiritdomains.com
Registrar Abuse Contact Phone: 800-948-0741

ubaplc-nig.com

Domain Name: UBAPLC-NIG.COM
Registry Domain ID: 1965477961_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.tucows.com
Registrar URL: http://tucowsdomains.com
Updated Date: 2015-10-02T13:41:48Z
Creation Date: 2015-10-02T13:41:48Z
Registrar Registration Expiration Date: 2016-10-02T13:41:48Z
Registrar: TUCOWS, INC.
Registrar IANA ID: 69
Registrar Abuse Contact Email: domainabuse@tucows.com
Registrar Abuse Contact Phone: +1.4165350123
Reseller: Vistaprint
Reseller: csadmin@vistaprint.com
Reseller: 866-811-1674
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registry Registrant ID:
Registrant Name: VistaPrint Technologies Ltd
Registrant Organization: VistaPrint Technologies Ltd
Registrant Street: Canon's Court 22 Victoria Street
Registrant City: Hamilton
Registrant State/Province:
Registrant Postal Code: HM12
Registrant Country: BM
Registrant Phone: +1.7816526199
Registrant Phone Ext:
Registrant Fax: +1.7816526096
Registrant Fax Ext:
Registrant Email: csadmin@vistaprint.com
Registry Admin ID:
Admin Name: Domain Administrator
Admin Organization: VistaPrint
Admin Street: 95 Hayden Avenue
Admin City: Lexington
Admin State/Province: MA
Admin Postal Code: 02421
Admin Country: US
Admin Phone: +1.7816526199
Admin Phone Ext:
Admin Fax: +1.7816526096
Admin Fax Ext:
Admin Email: csadmin@vistaprint.com
Registry Tech ID:
Tech Name: Domain Administrator
Tech Organization: Vistaprint
Tech Street: 95 Hayden Ave.
Tech City: Lexington
Tech State/Province: MA
Tech Postal Code: 02421
Tech Country: US
Tech Phone: +1.7816526300
Tech Phone Ext:
Tech Fax: +1.7816526095
Tech Fax Ext:
Tech Email: csadmin@vistaprint.com
Name Server: NS2.VPWEB.COM
Name Server: NS3.VPWEB.COM
Name Server: NS4.VPWEB.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2015-10-02T13:41:48Z <<<

Registration Service Provider:
Vistaprint, csadmin@vistaprint.com
866-811-1674

Have a nice day!

[X Factor 1,112]

Sweet.

[Expat1 971]

Bagged two of their domains. Had 'em shut down.

[X Factor 1,112]

Just received this in my junk folder--------------------------------------Email Header: Your Paypal Account has been limited due an unusual activity until we hear from youFrom:  PayPal Account Service & Maintenances (service5@imperialboathouse.com)---(notice the real email address is not from Paypal)Dear Member, Your PayPal account has been limited because we've noticed significant changes in your account activity. As your payment pocessor, we need to understand the sutuation better. What's going on? This account limitation will affect your ability to: 1. Send money2. Withdraw money3. Receive money What to do next Please log in to your PayPal account and provide the requested information through the Resolution Center. Resolution center link :http://bit.ly/1M92LEF Thank ypu for your understanding and cooperation. If you need further assistance, please click Contact at the bottom of any PayPal page. Sincerely, PayPal

-----------------------------------------------------------------------------------------------------------

Expat1 I wish I had the time to do what you did on your Nigerian scam

Edited November 6, 2015 by X Factor

[ready4ONE 5,400]

Just received this in my junk folder--------------------------------------Email Header: Your Paypal Account has been limited due an unusual activity until we hear from youFrom:  PayPal Account Service & Maintenances (service5@imperialboathouse.com)---(notice the real email address is not from Paypal)Dear Member, Your PayPal account has been limited because we've noticed significant changes in your account activity. As your payment pocessor, we need to understand the sutuation better. What's going on? This account limitation will affect your ability to: 1. Send money2. Withdraw money3. Receive money What to do next Please log in to your PayPal account and provide the requested information through the Resolution Center. Resolution center link :http://bit.ly/1M92LEFThank ypu for your understanding and cooperation. If you need further assistance, please click Contact at the bottom of any PayPal page. Sincerely, PayPal 

-----------------------------------------------------------------------------------------------------------

Expat1 I wish I had the time to do what you did on your Nigerian scam

No man, that email is legit, you need to fix your PayPal account pronto!

[X Factor 1,112]

No man, that email is legit, you need to fix your PayPal account pronto!

O.k. I should reply and say that I am worried about the $75,000 in the account and what would be the best way to protect it. (of course I don't have that amount).

[Expat1 971]

Update:

Turns out Heather Quick has (22, count 'em 22) other domain websites. Ran a reverse WhoIs and bought the info on all of 'em for 99 bucks.

One by one, I'm getting them shut down too.

It's Saudi. The two things we have here are (1) time and (2) money.

When I'm done contacting these domain registrars and after they shut down as many as possible I'm turning the whole mess over to the FBI. Turns out you don't have to succeed in ripping someone off, you just have to try, and whoever this is appears to be (1) in the US and (2) have a whole network of these scams going.

[Expat1 971]

Just received this in my junk folder--------------------------------------Email Header: Your Paypal Account has been limited due an unusual activity until we hear from youFrom:  PayPal Account Service & Maintenances (service5@imperialboathouse.com)---(notice the real email address is not from Paypal)Dear Member, Your PayPal account has been limited because we've noticed significant changes in your account activity. As your payment pocessor, we need to understand the sutuation better. What's going on? This account limitation will affect your ability to: 1. Send money2. Withdraw money3. Receive money What to do next Please log in to your PayPal account and provide the requested information through the Resolution Center. Resolution center link :http://bit.ly/1M92LEF Thank ypu for your understanding and cooperation. If you need further assistance, please click Contact at the bottom of any PayPal page. Sincerely, PayPal

-----------------------------------------------------------------------------------------------------------

Expat1 I wish I had the time to do what you did on your Nigerian scam

You do have time. Do NOT click the link, but get the dot.com domain from the sender email address at the top, run a free WhoIs, and get the information on the domain. There will be a contact number (see above) and an email address that you can forward the email to. Takes 5 minutes.

If it's a yahoo address (like the first Nigerian president email I got with a yahoo address) you're hosed and can't do anything. I did not get anything I could use until they started using email addresses that were domain-linked and that's how I tracked down who it was and who the domain registrar was that registered their website.

Like VJ, if the domain licensor? registrar? allows a domain to be used in criminal activity they can be liable if it continues after they know about it. So, they simply shut it down, which makes the scammer / phisher have to pay for a new one.

The two companies I talked to, after I described what I got, laughed and said not problem, open and shut, and they would be no way involved in anything like that.

The free report you get is above and has a lot of information.

Happy hunting.

[X Factor 1,112]

You do have time. Do NOT click the link, but get the dot.com domain from the sender email address at the top, run a free WhoIs, and get the information on the domain. There will be a contact number (see above) and an email address that you can forward the email to. Takes 5 minutes.

If it's a yahoo address (like the first Nigerian president email I got with a yahoo address) you're hosed and can't do anything. I did not get anything I could use until they started using email addresses that were domain-linked and that's how I tracked down who it was and who the domain registrar was that registered their website.

Like VJ, if the domain licensor? registrar? allows a domain to be used in criminal activity they can be liable if it continues after they know about it. So, they simply shut it down, which makes the scammer / phisher have to pay for a new one.

The two companies I talked to, after I described what I got, laughed and said not problem, open and shut, and they would be no way involved in anything like that.

The free report you get is above and has a lot of information.

Happy hunting.

The domain they are using is service5@imperialboathouse.com.

Imperialboathouse.com registry whois Updated 1 second ago - Refresh

Domain Name: IMPERIALBOATHOUSE.COM

Registrar: GODADDY.COM, LLC

Sponsoring Registrar IANA ID: 146

Whois Server: whois.godaddy.com

Referral URL: http://registrar.godaddy.com

Name Server: NS135.DNSEVER.COM

Name Server: NS141.DNSEVER.COM

Name Server: NS163.DNSEVER.COM

Name Server: NS231.DNSEVER.COM

Name Server: NS259.DNSEVER.COM

Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited

Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited

Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited

Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited

Updated Date: 14-oct-2015

Creation Date: 13-oct-2003

Expiration Date: 13-oct-2016

imperialboathouse.com registrar whois Updated 1 second ago

Domain Name: IMPERIALBOATHOUSE.COM

Registry Domain ID: 104984063_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.godaddy.com

Registrar URL: http://www.godaddy.com

Update Date: 2015-10-14T13:04:17Z

Creation Date: 2003-10-13T18:05:13Z

Registrar Registration Expiration Date: 2016-10-13T18:05:13Z

Registrar: GoDaddy.com, LLC

Registrar IANA ID: 146

Registrar Abuse Contact Email: @godaddy.com

Registrar Abuse Contact Phone: +1.4806242505

Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited

Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited

Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited

Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited

Registry Registrant ID:

Registrant Name: Warathep Samranthiwawan

Registrant Organization: Queen's Park Hotel Group Co.,LTD.

Registrant Street: 199 Sukhumvit Soi.22

Registrant City: Klongtaoy

Registrant State/Province: Bangkok

Registrant Postal Code: 10110

Registrant Country: Thailand

Registrant Phone: 022619000

Registrant Phone Ext:

Registrant Fax: 0226195467

Registrant Fax Ext:

Registrant Email: @imperialhotels.com

Registry Admin ID:

Admin Name: Warathep Samranthiwawan

Admin Organization: Queen's Park Hotel Group Co.,LTD.

Admin Street: 199 Sukhumvit Soi.22

Admin City: Klongtaoy

Admin State/Province: Bangkok

Admin Postal Code: 10110

Admin Country: Thailand

Admin Phone: 022619000

Admin Phone Ext:

Admin Fax: 0226195467

Admin Fax Ext:

Admin Email: @imperialhotels.com

Registry Tech ID:

Tech Name: Warathep Samranthiwawan

Tech Organization: Queen's Park Hotel Group Co.,LTD.

Tech Street: 199 Sukhumvit Soi.22

Tech City: Klongtaoy

Tech State/Province: Bangkok

Tech Postal Code: 10110

Tech Country: Thailand

Tech Phone: 022619000

Tech Phone Ext:

Tech Fax: 0226195467

Tech Fax Ext:

Tech Email: @imperialhotels.com

Name Server: NS135.DNSEVER.COM

Name Server: NS141.DNSEVER.COM

Name Server: NS163.DNSEVER.COM

Name Server: NS231.DNSEVER.COM

Name Server: NS259.DNSEVER.COM

DNSSEC: unsigned

URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

>>> Last update of WHOIS database: 2015-11-07T02:00:00Z <<<

---------------------------------------------------------------------------------------------

Looks like they are operating from Thailand. The Name: Warathep Samranthiwawan

Now to report him at abuse@godaddy.com

[Expat1 971]

Registrant Name: Warathep Samranthiwawan
Registrant Organization: Queen's Park Hotel Group Co.,LTD.
Registrant Street: 199 Sukhumvit Soi.22
Registrant City: Klongtaoy
Registrant State/Province: Bangkok
Registrant Postal Code: 10110
Registrant Country: Thailand
Registrant Phone: 022619000

That's your boy. He's the one who paid for the site.

http://www.imperialhotels.com/default-en.html

Using this company email to do it. Wonder how they would feel about it. There is a "file a complaint" or "send a comment" section on that hotel website, wonder what they would do if you copied and pasted the email you received and the website registration.

Go get him.

Edited November 7, 2015 by Expat1

[Expat1 971]

Here's the exact place

[X Factor 1,112]

I made a complaint to the hotel. I also sent the following email to abuse@godaddy.com and legal@godaddy.com

To Godaddy legal department.

Warathep Samranthiwawan has been creating fake websites to rob people using warathep@imperialhotels.com and service5@imperialboathouse.com. He has created fake websites that looks like Paypal.

https://phaiyphal.com/webapps/ba2f2/home. Also http://bit.ly/1M92LEF.

The domain imperialboathouse.com and PHAIYPHAL.COM are registered with Godaddy.

Godaddy.com is the domain licensor and/or registrar. If Godaddy continues to allow these domains to be used in criminal activity you could be liable if it continues to operate after you know about it. There are possible many other websites registered under this person. Another individual who was using a website to defraud people had 22 domains registered. So it is likely that Warathep Samranthiwawan has many other domains registered with Godaddy with the intent to defraud.

I am reporting this to the FBI. This person is trying to scam people.

Sincerely,

XXXXXX

------------------------------------------------------------------------------

I will know if Godaddy responded to my email if I see those websites shut down.

Edited November 8, 2015 by X Factor

[X Factor 1,112]

I sent an email to spoof@paypal.com. I also called Godaddy.com. They will be shutting these domains shortly.

[Expat1 971]

I sent an email to spoof@paypal.com. I also called Godaddy.com. They will be shutting these domains shortly.

Good work. See? It's fun!

[X Factor 1,112]

Yep its fun when you get results. Both websites have been shut down. Here is the message when you click on the websites

"Reported Web Forgery!

This web page at phaiyphal.com has been reported as a web forgery and has been blocked based on your security preferences.

Web forgeries are designed to trick you into revealing personal or financial information by imitating sources you may trust.

Entering any information on this web page may result in identity theft or other fraud."