Playing between registrars

by **firefly** » Sat Oct 28, 2017 7:42 am

The fake site claims to be Sterling Global Delivery.

From the fake site:

Sterling Global Delivery. is a solution driven company providing logistics and transportation services to a variety of customers. Our company commenced operations on July 5, 1983 in New York, USA.

Contact details:

Tel: +1 (917) 979 6360
General Information: support@sterlingglobaldel.com
Customer Service: shipment@sterlingglobaldel.com

+19179796360 - VoIP number

The fake site maker stole the entire site from the real owner, using photoshop to edit their logo on the tuck and operating minor changes for location and contact details.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127980; the registrant uses the privacy protection given by the registrar to hide his location and contact details:
Domain Name: sterlingglobaldel.com
Updated Date: 2017-10-24
Creation Date: 2017-05-22
Registrar Registration Expiration Date: 2018-05-22
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers
Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Administrator

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 7:58 am

Clone of the above reported one, pretending to be also Sterling Global Delivery.

From the fake site:

Sterling Global Delivery. is a solution driven company providing logistics and transportation services to a variety of customers. Our company commenced operations on July 5, 1983 in New York, USA.

Contact details:

Tel: +1 (929) 999-3309
General Information: shipment@sterlingglobdel.com
Customer Service: shipment@sterlingglobdel.com

+19299993309 - VoIP number

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127981:

Domain Name: sterlingglobdel.com
Updated Date: 2017-10-21
Creation Date: 2017-08-16
Registrar Registration Expiration Date: 2018-08-16
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers
Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Robert Taylor
Registrant Organization:
Registrant Street: 4733 Hiney Road
Registrant City: Las Vegas
Registrant State/Province: NV
Registrant Postal Code: 89119
Registrant Country: US
Registrant Phone: +1.7022656564
Registrant Email: taylor_r92@yahoo.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 8:08 am

This time the fake site claims to be Zalige Logistiek Inc.

From the fake site:

Zalige Logistiek Inc. is a solution driven company providing logistics and transportation services to a variety of customers. Our company commenced operations on July 5, 1983 in Anderlecht, Belgium.

Contact details:

Félicien Rops 2222, 1070 Anderlecht, Belgium
+32 258 854 38
support@zaligelogistieks.com

+3225885438
Number billable as geographic number
Country or destination Belgium
City or exchange location Brussel

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127982:

Domain Name: ZALIGELOGISTIEKS.COM
Updated Date: 2017-08-23
Creation Date: 2017-06-23
Registrar Registration Expiration Date: 2018-06-23
Registrar: NetEarth One, Inc.

Registry Registrant ID: Not Available From Registry
Registrant Name: Charles Richer
Registrant Organization: Host Group.
Registrant Street: 3655 St Jean Baptiste St Perce, QC G0L 2L0 QC G0L 2L0
Registrant City: Montreal
Registrant State/Province: Quebec
Registrant Postal Code: G0L 2L0
Registrant Country: CA
Registrant Phone: +1.4187825152
Registrant Email: ba.stuart341@yahoo.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 8:21 am

And again, but as Zhang Min Global Delivery Inc.

From the fake site:

Zhang Min Global Delivery Inc. is a solution driven company providing logistics and transportation services to a variety of customers. Our company commenced operations on July 5, 1983 in Sichuan Sheng, China.

Contact details:

4 Zi Jing Bei Lu ShenXianShu, Wuhou Qu, Chengdu Shi, Sichuan Sheng, China 610041
+86 (211) 796-506
support@zhangminglobal.com

+86211796506
Number billable as geographic number
Country or destination China
City or exchange location Shanghai, SH

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127983:

Domain Name: zhangminglobal.com
Updated Date: 2017-10-26
Creation Date: 2017-06-11
Registrar Registration Expiration Date: 2018-06-11
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers

Registry Registrant ID:
Registrant Name: Network Administrator
Registrant Organization:
Registrant Street: 4940 Cordova Street Vancouver
Registrant City: Vancouver
Registrant State/Province: BC
Registrant Postal Code: V6B 1E1
Registrant Country: CA
Registrant Phone: +1.6045057184
Registrant Email: phinxnetwork@gmail.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 8:32 am

The fake site claimed to be Weatherford International.

Warning on the real company site the scammers were impersonating:

Weatherford International has been made aware of reports of fraudulent offer letters being sent via email by unauthorized persons/groups falsely using Weatherford’s name and logo in an effort to solicit fees from prospective candidates.

These emails and offer letters often appear legitimate and include job description, salary, and benefit details. Prospective candidates are instructed by fraudsters to pay them fees for the immigration and visa application/processing.

Be Advised - These offers are FRAUDULENT and do not come from Weatherford. Weatherford International and its affiliates will NEVER request payment or seek fees from candidates under any circumstances during the recruitment and onboarding processes.

How to Protect Yourself

You should NEVER reply or respond to any email address that does not end in weatherford.com.
The only way to apply for a job at Weatherford is through the company web site.
You should NEVER pay anyone to get a job offer from Weatherford.
We highly recommend that you do not respond to unsolicited business deals and/or offers from people with whom you are unfamiliar with. Weatherford does not make unsolicited job offers to any prospective candidate(s).
If you are unsure about an email correspondence or offer letter from a person or entity claiming to be Weatherford, please contact us using the link here. Contact us
If you are approached, contacted and/or receive an employment offer from Weatherford International that you believe is fraudulent, you are encouraged to contact your local police/law enforcement authority immediately.

From the fake site details:

Domain Name: weather-ford.com
Updated Date: 2017-10-27
Creation Date: 2016-10-27
Registrar Registration Expiration Date: 2017-10-27
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers
Domain Status: clientHold
Registry Registrant ID:
Registrant Name: Michael Hardy
Registrant Organization:
Registrant Street: 1521 Islington Ave
Registrant City: Toronto
Registrant State/Province: ON
Registrant Postal Code: M8V 3B6
Registrant Country: CA
Registrant Phone: +1.6138136007
Registrant Email: boehm.j@yahoo.com

by **firefly** » Sat Oct 28, 2017 8:40 am

The fake site claims to be Sutrock Energy. The fake site is used in job scams.

Sutrock Energy.- has confidently grown and developed with high resolve and determination as a natural response to market demand supporting Sutrock Energy Group construction and heavy fabrication activities and operational requirements providing integrated engineered supply solutions and specialized technical services, predominantly in the Oil & Gas, Petrochemicals, Power, Utilities, Desalination and Mining industries.

Contact details:

CORPORATE OFFICE:
Address: 3883 Kilpatrick Dr, Bossier City, LA 71112,
United States.
Phone.: +1-(318) 239 - 4868
Corporate E-mail:info@sutrock.com

COLORADO OFFICE:
Address: W 9th St Greeley, CO 80634 ,
United States.
Phone.: +1-(720) 623 - 1697
Branch E-mail:info.colorado@sutrock.com

+13182394868 / +17206231697 - VoIP numbers

The recruitment is done on LinkedIn by someone pretending to be:

Gregory Gray
Senior Publicist officer for sutrock Energy. at Sutrock Energy
Ponte Vedra Beach, FloridaÄmter & Behörden
Sutrock Energy, sut
Before: SHEAFLINE (S.U.T.) LIMITED
Education:
Coventry University
Master of Philosophy - MPhil, Engineering/Industrial Management
Oxford Brookes University
Master's degree, Engineering
Experience: Senior Recuitement officer for sutrock Energy.

Picture used:

: gregorygray.jpg (7.52 KiB) Viewed 5565 times

If that picture looks familiar it's maybe because images from the same gallery are massive abused in military romance scams since years. Few examples here: https://www.scamsurvivors.com/forum/vie ... 11&t=46591

From the fake site details:

Domain Name: SUTROCK.COM
Updated Date: 2017-04-26
Creation Date: 2015-04-25
Registrar Registration Expiration Date: 2018-04-25
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registry Registrant ID: Not Available From Registry
Registrant Name: Roderick Murphy
Registrant Organization: Global Hub Systems
Registrant Street: 2578 Walkers Ridge Way Bensenville, IL 60106
Registrant City: Bensenville
Registrant State/Province: IL
Registrant Postal Code: 60106
Registrant Country: US
Registrant Phone: +1.6302591886
Registrant Email: technicalupgrade293@gmail.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 8:51 am

The fake site claims to be Ulster Bank Limited.

Contact details:

+44 (151)329-2107
info@ulst-ionline.com

+441513292107
Number billable as geographic number
Country or destination United Kingdom
City or exchange location Liverpool
Original network provider* aql Wholesale Limited

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127986:

Domain Name: ulst-ionline.com
Updated Date: 2017-10-27
Creation Date: 2017-08-16
Registrar Registration Expiration Date: 2018-08-16
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers
Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Robert Taylor
Registrant Organization:
Registrant Street: 4733 Hiney Road
Registrant City: Las Vegas
Registrant State/Province: NV
Registrant Postal Code: 89119
Registrant Country: US
Registrant Phone: +1.7022656564
Registrant Email: taylor_r92@yahoo.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 9:05 am

Another fake site impersonating the same Ulster Bank Limited.

Contact details:

+44 792- 452- 4821
inquiries@ulst-online.com

+447924524821
Number billable as mobile number
Country or destination United Kingdom
Original network provider* Cloud9 Communications Limited

The phone number is reported online since 2011 for being used in various types of scam.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127987:

Domain Name: ULST-ONLINE.COM
Updated Date: 2017-09-27
Creation Date: 2015-09-27
Registrar Registration Expiration Date: 2018-09-27
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Roderick Murphy
Registrant Organization: Global Hub Systems
Registrant Street: 2578 Walkers Ridge Way Bensenville, IL 60106
Registrant City: Bensenville
Registrant State/Province: IL
Registrant Postal Code: 60106
Registrant Country: US
Registrant Phone: +1.6302591886
Registrant Email: technicalupgrade293@gmail.com

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 9:17 am

And another fake site impersonating the same Ulster Bank Limited.

Contact details:

+44 704 - 560 - 0900
info@ulsteonline.com

+447045600900 - is already reported on our forum, while being used with another fake bank impersonating Barclays in a romance scam: https://www.scamsurvivors.com/forum/vie ... 11&t=61448.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127988; the registrant uses the privacy protection given by the registrar to hide his location and contact details:

Domain Name: ulsteonline.com
Updated Date: 2017-10-21
Creation Date: 2017-05-22
Registrar Registration Expiration Date: 2018-05-22
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers
Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Administrator

This is what the fake site looks like:

by **firefly** » Sat Oct 28, 2017 9:28 am

And another one...

Contact details:

+44 704 - 207 - 1941
info@ulstonline.com

+447042071941 - universal phone number

From the fake site details - https://db.aa419.org/fakebanksview.php?key=127989 :

Domain Name: ulstonline.com
Updated Date: 2017-10-25
Creation Date: 2017-05-15
Registrar Registration Expiration Date: 2018-05-15
Registrar: NameSilo, LLC
Reseller: Hostfrica Servers

Registry Registrant ID:
Registrant Name: Lantex Network
Registrant Organization:
Registrant Street: 2754 Horner Ave Toronto
Registrant City: Toronto
Registrant State/Province: ON
Registrant Postal Code: M8W 4Y4
Registrant Country: CA
Registrant Phone: +1.4169130619
Registrant Email: lantexnetwork@gmail.com

This is what the fake site looks like:

Who is online