Holiday Travel Magazine Scam

We are a hotel property owner in Thailand and received the email below. This is an offer to advertise in a magazine called "Holiday Travel Magazine", purportedly in the UK. The site is at:

http://www.holiday-travel-mag.co.uk/index.html

Note that content on the site is stolen from Lonely Planet. There is no such magazine in the UK, and the attempt is to defraud innkeepers for advertising packages in a non-existent publication.

From: "Holiday Travel Magazine" <[email protected]>
Subject: Your hotel / resort
Date: 30 October 2012
To: [snip]
Reply-To: [email protected]

Dear Sir / Madam,

You are the manager or an employee of a hotel / resort in Thailand That’s a reason for us to contact you.

I am Mr Jenkins , sales and promotion manager of Holiday-Travel-Magazine. We will come up with a Thailand special in January 2013. We selected a few hotels / resorts that meet our standards and will offer you the chance to promote your accommodation in our special in January as your region will be covered as well.

We are also happy to accept advertisements from smaller size accommodations; lodges, guest houses, BnB’ s etc.

You can promote your hotel / resort for as little as US$ 99 in our Thailand special.

Holiday Travel Magazine is one of U.K and Europe most flamboyant Travel Magazines.
Since its re-launch in March 2011, Holiday Travel Magazine has defied the conventions that typify other travel magazines – steering away from the cozy and coddled to take a more adventurous and realistic look at the world and how people travel through it. In every issue of the magazine you get the good, the bad and the ugly about travel, told in an honest, sometimes irreverent voice.

Based in The UK, Holiday Travel Magazine is published monthly, and available on newsstands across the UK and Europe. Holiday Travel Magazine is distributed to over 80,500 readers.

For more information about advertising in our magazine please have a look at attached file.
For more information about our magazine please visit our website: www.holiday-travel-mag.co.uk

Looking forward to hearing from you soon.

Yours,

Jim Jenkins

Sales and Promotion Manager
[email protected]
http://www.holiday-travel-mag.co.uk

And just to have a little fun with this one, have a look at their fake website.

http://www.holiday-travel-mag.co.uk/index.html

Now look at this site to see where they obtained their example magazine cover graphic:

http://www.simplypersonalized.com/fake- ... ake-cover/

That's right, it's actually from a page entitled "Fake Magazine Covers", where you can personalise your own fake travel magazine cover!

The website is in the process of being reported for fraud.

Just checked and the site is still online. I do hope someone can take it down soon, as this scam could end up defrauding some unsuspecting innkeepers a lot of money.

For what it's worth, and if it helps anyone with reporting this fraudulent website and getting it shut down, here are the headers that I received in their spam:


Return-path: <[email protected]>
Envelope-to: [snip]
Delivery-date: Wed, 31 Oct 2012
Received: from node-sl2225.smtp.com ([173.193.158.113]:36679)
by kearney.machighway.com with esmtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1TTZ2e-0005Ys-5W
for [email protected]; Wed, 31 Oct 2012 08:13:13 -0600
X-MSFBL: aW5mb0Bzb3Bwb25nLmNvbUAxNzNfMTkzXzE1OF8xMTNAU2VuZEJsYXN0ZXJfOEA=
DKIM-Signature: v=1; a=rsa-sha256; d=smtp.com; s=smtpcomcustomers; c=relaxed/simple;
q=dns/txt; [email protected]; t=1351692765;
h=From:Subject:To:Date:MIME-Version:Content-Type;
bh=7LNSc4qZlaCUFglpd1QYDBLjLSl+t1Es1dbBLnUO3RY=;
b=Ph0z/6GpaaTMYRF6bA3XrYc8/vNAP2snen/03sd2iZknV26TmIJyYjzcweBbQnEV
Paz/Fa40LHoGnp4h9L9P7Vp3R4EzdOlyvegCG7V8q1Fzpm7A60FnorD9bKuTRsVn
7MLrKOccendUc6Wse4iuu/Rq/TsdRxx1H57Hx1aG4cE=;
Received: from [77.249.7.122] ([77.249.7.122:55850] helo=BastiaanPC)
by sl-mta04 (envelope-from <[email protected]>)
(ecelerity 3.3.2.44647 r(44647)) with ESMTPA
id 1C/29-07405-BD131905; Wed, 31 Oct 2012
MIME-Version: 1.0
From: "Holiday Travel Magazine" <[email protected]>
Reply-To: [email protected]
To: [snip]
Subject: Your hotel / resort
Content-Type: multipart/mixed;
boundary="----=_NextPart_001_6F8A_5ED76BDF.572A3492"
X-Mailer: SmartSend.2.0.102
Date: Wed, 31 Oct 2012
Message-ID: <2652203944912315395298@Bastiaan-PC>
X-SMTPCOM-Tracking-Number: 1026d364-ef8f-4719-b461-15c2927ca3a4
X-SMTPCOM-Sender-ID: 68121
X-SMTPCOM-Spam-Policy: SMTP.com is a paid relay service. We do not tolerate UCE of any kind. Please report it ASAP to [email protected]
---------

And here is the whois registration information for the site:


Domain name:
holiday-travel-mag.co.uk

Registrant:
Bastiaan de Groot

Registrant type:
UK Individual

Registrant's address:
Jacob Ruisdaelstraat 25
Gelderland
4003KH
Netherlands

Registrar:
Internet.bs Corp. t/a Internet.bs Corp. [Tag = INTERNET-BS]
URL: http://www.internetbs.net

Relevant dates:
Registered on: 23-Jan-2012
Expiry date: 23-Jan-2014
Last updated: 27-Feb-2012

Registration status:
Registered until expiry date.

Name servers:
ns400.dimedns.com
ns401.dimedns.com


I wonder if this "Bastian de Groot" is responsible for any other scam/fraud sites?

The scammer is now using a free email service to continue the scam

[email protected]

Dear Rxxxxx,

Due to a sever error all incoming emails sent to me yesterday till now didn't come through.
I kindly ask you to reply to me on this email address: [email protected] (also in CC)

We try to fix everything ASAP.

Looking forward to hearing from you soon.

Jim Jenkins

Advertising Manager
[email protected]

This same scam has resurfaced. Here is the scam spam that we received today:

Sarah Harris <[email protected]>
To:[email protected]
Reply-To: [email protected]
Return-Path: <[email protected]>
Envelope-To: [email protected]
Delivery-Date: Mon, 25 Feb 2013 05:21:54 -0700
Received: from 118-177.sl.smtp.com ([192.40.177.118]:22924) by xxx.com with esmtp (Exim 4.80) (envelope-from <[email protected]>) id 1U9x42-0007Gu-Fi [email protected]; Mon, 25 Feb 2013 05:21:54 -0700
Received: from [77.249.7.122] ([77.249.7.122:51418] helo=BastiaanPC) by sl-mta03 (envelope-from <[email protected]>) (ecelerity 3.3.2.44647 r(44647)) with ESMTPA id E72-C575B215; Mon, 25 Feb 2013 12:21:50 +0000

Dear Hotel Owner / Manager,

First of all let me introduce myself. I am Sarah Harris and responsible for sales and marketing for Hot Destinations Magazine.

Hot Destinations Magazine quickly became a ‘must-read’ publication in the market and is widely spread across 95.000 readers in Europe.

In April we’ll come up with a beautiful Thailand special. We carefully selected a few hotels and resorts that meet our standards and therefore we will give you the first opportunity to advertise your hotel / resort in this special against special rates.
(starting at $89 for a quarter page advertisement)

Enclosed the Rate Card with more information and prices.

Also we invite you to visit our website which give you a better idea of the magazine and It’s contents.
www.hot-destinations.com

Please review the enclosed material and I hope to hearing from you soon.

Yours sincerely,

Sarah Harris


Sales and Marketing Manager
[email protected]

-------

As with the previous scam, the "magazine" content is stolen from elsewhere, including Lonely Planet (the Rio De Janeiro text), and of course any simple google search with turn that up.

hot-destinations.com domain info, and it looks like they have tried to obscure themselves this time:

Registration Service Provided By: KVCHOSTING.COM LLC

Domain Name: HOT-DESTINATIONS.COM

Registration Date: 08-Jan-2013
Expiration Date: 08-Jan-2014

Status:LOCKED

Name Servers:
ns1019.kvchosting.com
ns1020.kvchosting.com

Registrant Contact Details:
PrivacyProtect.org
Domain Admin ()
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Administrative Contact Details:
PrivacyProtect.org
Domain Admin ()
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Technical Contact Details:
PrivacyProtect.org
Domain Admin ()
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Billing Contact Details:
PrivacyProtect.org
Domain Admin ()
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Originating IP address for the scammer's email is again in the Netherlands:

77.249.7.122


organisation: ORG-CB6-RIPE
org-name: UPC Broadband Operations B.V.
org-type: LIR
address: UPC Broadband Operations B.V. Boeing Avenue 101 1119PE Schiphol Rijk
Netherlands
phone: +31 20 7788200
fax-no: +31 20 7788203
mnt-ref: CHELLO-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
admin-c: SB666-RIPE
admin-c: HMCB1-RIPE
admin-c: MS2509-RIPE
source: RIPE # Filtered

role: Hostmaster Liberty Global
address: Liberty Global Europe
address: Boeing Avenue 53
address: 1119 PE Schiphol Rijk
address: Netherlands
phone: +31 20 7788200
fax-no: +31 20 7788203
admin-c: SB666-RIPE
admin-c: SVS4-RIPE
tech-c: SB666-RIPE
tech-c: SVS4-RIPE
nic-hdl: LGI-RIPE
mnt-by: MNT-LGI
source: RIPE # Filtered

route: 77.248.0.0/15
descr: UPC NL
origin: AS6830
mnt-by: AS6830-MNT
source: RIPE # Filtered

The hot-destinations.com fraud site now says "account suspended". One more down!

This same perpetrator is back again! Here is their latest email and fraud site:

-----
Dear hotel owner / manager,

First of all let me introduce myself. I am Cindy Walker, sales and promotion manager of PURE Travel.

Pure Travel Magazine would like to invite you to advertise with us as we will launch a beautiful Thailand special in July.
Your city and region will also be covered in a 4-5 page story. Therefore we are addressing you to invite you to participate as an Advertiser in our magazine with special rates for this issue only.

You can promote your hotel / resort for as little as US$ 89 in our Thailand special.

We can create the artwork for you in case you don’t have an advertisement ready. (at no charge at all)

Pure Travel Magazine is a full size, full colour, high quality publication that many readers over the past years have come to rely on as one of their favourite travel magazines.

For more information about advertising have a look at the attached Rate Card.
Our website www.pure-travel-magazine.com provides much more information about the magazine including a preview of the magazine in PDF.

Thank you for your time spent reading this letter and the enclosed Rate Card. I look forward to hearing from you soon.

Yours,

Cindy Walker

Sales and Promotion Manager of PURE Travel
[email protected]
-----

Same scam, different fake magazine: pure-travel-magazine, hosted by volume drive.com this time.

Domain Whois record

Queried whois.internic.net with "dom pure-travel-magazine.com"...

Domain Name: PURE-TRAVEL-MAGAZINE.COM
Registrar: CLOUD GROUP LIMITED
Whois Server: whois.hostingservicesinc.net
Referral URL: http://www.resell.biz
Name Server: NS10.CBAHOST.NET
Name Server: NS9.CBAHOST.NET
Status: clientTransferProhibited
Updated Date: 04-mar-2013
Creation Date: 04-mar-2013
Expiration Date: 04-mar-2014

>>> Last update of whois database: Wed, 08 May 2013 06:13:03 UTC <<<
Queried whois.hostingservicesinc.net with "pure-travel-magazine.com"...

Registration Service Provided By: CBAHOST

Domain Name: PURE-TRAVEL-MAGAZINE.COM

Registration Date: 05-Mar-2013
Expiration Date: 05-Mar-2014

Status:LOCKED
Note: This Domain Name is currently Locked.
This feature is provided to protect against fraudulent acquisition of the domain name,
as in this status the domain name cannot be transferred or modified.

Name Servers:
ns10.cbahost.net
ns9.cbahost.net


Registrant Contact Details:
PrivacyProtect.org
Domain Admin ([email protected])
ID#10760, PO Box 16
Note - Visit PrivacyProtect.org to contact the domain owner/operator
Nobby Beach
Queensland,QLD 4218
AU
Tel. +45.36946676

Interestingly, the originating IP for this fake pure-travel-magazine spam is exactly the same as their last fake magazine scam spam: 77.249.7.122

If he managed to pick up your details it tends to suggest that your current advertising is sufficient.

A self-defeating scam.

UK newspaper and magazine publishing and distribution figures are readily available to view online.

From what I can see there are no major travel publications, probably because people will either get a travel brochure or look at an online site for reports on different destinations and hotels.

if it were real the cost would be much higher but they're hoping that the amount is small enough that someone will pay out without doing too much checking.

Yes, but this must be an exception...just look at what they say in their "Pure Travel Magazine" website!

Based in The UK, Traveler Magazine s published monthly, and available on newsstands across the UK and Europe. PURE Travel Magazine is distributed to over 80500 readers.

For more info send us an email at: [email protected]

...oh wait, it's called "Traveler Magazine"? I thought it was Pure Travel Magazine.

http://www.pure-travel-magazine.com/magazine.html

Just to follow up, I have filed a ticket with the company hosting the Pure Travel Magazine scam site. They replied and assured that the account would be terminated. That didn't happen, so I filed a follow-up. No reply, and trhe site is still apparently hosted on volumedrive.com Guess that shows how much volumedrive favours cash flow over taking action scammers and copyright violators. Hopefully, anyone considering paying for an advert at the fictitious "Pure Travel Magazine" will google them and see this thread before they send money to the scammers.

Domain Whois record

Queried whois.internic.net with "dom pure-travel-magazine.com"...

Domain Name: PURE-TRAVEL-MAGAZINE.COM
Registrar: CLOUD GROUP LIMITED
Whois Server: whois.hostingservicesinc.net
Referral URL: http://www.resell.biz
Name Server: NS10.CBAHOST.NET
Name Server: NS9.CBAHOST.NET
Status: clientTransferProhibited
Updated Date: 04-mar-2013
Creation Date: 04-mar-2013
Expiration Date: 04-mar-2014


Queried whois.arin.net with "n 173.242.125.181"...

NetRange: 173.242.112.0 - 173.242.127.255
CIDR: 173.242.112.0/20
OriginAS: AS46664
NetName: VOLUMEDRIVE
NetHandle: NET-173-242-112-0-1
Parent: NET-173-0-0-0-0
NetType: Direct Allocation
Comment: http://www.volumedrive.com
RegDate: 2010-05-06
Updated: 2012-03-02
Ref: http://whois.arin.net/rest/net/NET-173-242-112-0-1

OrgName: VolumeDrive
OrgId: VOLUM-2
Address: 1143 Northern Blvd
City: Clarks Summit
StateProv: PA
PostalCode: 18411
Country: US
RegDate: 2008-08-26
Updated: 2011-09-24
Ref: http://whois.arin.net/rest/org/VOLUM-2

OrgAbuseHandle: VOLUM1-ARIN
OrgAbuseName: VolumeDrive POC
OrgAbusePhone: +1-862-266-1083
OrgAbuseEmail: [email protected]
OrgAbuseRef: http://whois.arin.net/rest/poc/VOLUM1-ARIN

OrgTechHandle: VOLUM1-ARIN
OrgTechName: VolumeDrive POC
OrgTechPhone: +1-862-266-1083
OrgTechEmail: [email protected]
OrgTechRef: http://whois.arin.net/rest/poc/VOLUM1-ARIN

RTechHandle: VOLUM1-ARIN

The perps are at it again, with a new fake site after having been shut down twice before. This time it is Asia Travel Magazine ( http://www.asia-travel-magazine.com ), hosted by burst.net

The scam email reads like this, just the same as the last ones:

Dear Sir/ Madam,


We are the publishers of ASIA Traveller, one of World’s most flamboyant travel magazines, with over 110.500 copies distributed 6 times a year!

In October we launch our Thailand special with more than 30 pages dedicated to Thailand.
We also will write about your area!
Therefore we are addressing you to invite you to participate as an Advertiser in our magazine with special rates for this issue only.

Advertisers get a free link to their websites in our monthly newsletter.

Advertising rates starts at $89 only for a 1/4 page advertisement.

We are also happy to accept advertisements from smaller size accommodations; lodges, guest houses, BnB’ s etc.

Asia Traveller is a leading international magazine focusing on Asian travel destinations, wildlife and nature. With subscribers in over 15 countries, Asia Traveller has been bringing the world's most exciting continent to traveller's door steps since 2010.

For more information about advertising have a look at the attached Rate Card.
Our website http://www.asia-travel-magazine.com for more information about the magazine.

Thank you for your time and looking forward to hearing from you soon.

Yours sincerely,

Sandra Miller

Advertising Manager
[email protected]

And a rate card is attached.

Site was registered this week.

Privacy Protection now removed

asia-travel-magazine.com
Registrant Contact Details:
N/A
Bastiaan de Groot ([email protected])
Jacob Ruisdaelstraat 25
Tiel
Gelderland,4003KH
NL
Tel. +31.31652718686

pure-travel-magazine.com
Registrant Contact Details:
N/A
Bastiaan de Groot ([email protected])
Jacob Ruisdaelstraat 25
Tiel
Gelderland,4003KH
NL
Tel. +31.31652718686