Fake Courier Service- Right On Time

I hope we get some internet justice!

If you have sent a message to Nancy Viera and gotten a reply, please post the message you sent and the reply, both with complete headers. The domain is using one server (same as the webserver) to receive mail and others to send mail, and we may need evidence for both to kill it.

I got the needed headers and a new fake domain:

Domain Name: AB-RIGHTONTIME.COM
Registry Domain ID: 1987152629_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.ilovewww.com
Registrar URL: http://www.ilovewww.com
Updated Date: 2015-12-14T02:44:50Z
Creation Date: 2015-12-14T02:43:15Z
Registrar Registration Expiration Date: 2016-12-14T02:43:15Z
Registrar: Shinjiru MSC Sdn Bhd
Registrar IANA ID: 1741
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Admin
Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Registrant Street: C/O ID#10760, PO Box 16 Note - Visit PrivacyProtect.org to contact the domain owner/operator Note - Visit PrivacyProtect.org to contact the domain owner/operator
Registrant City: Nobby Beach
Registrant State/Province: Queensland
Registrant Postal Code: QLD 4218
Registrant Country: AU
Registrant Phone: +45.36946676
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

ab-rightontime.com is in the process of being reported for fraud.

What are the chances of getting the money scammed from us back?

Your money is probably gone forever and any one that claims to be able to help you recover your money will just be another scammer that is trying to steal more money from you.

Well thats a bummer , alright as long as we can stop it from happening to other people then that'll do too

Where does it go from here, is the end of the story

ab-rightontime.com is parked, and luxeholiday.net is in mailserver timeout. The scammers will probably invent new domains, which we have to watch out for.

Seems to be now:
On 22/12/15 01:04, "Violet Bailey" <[email protected]> wrote:
>
>> Hi, yes this is the 128GB one.
>>
>> I have found a company called Ready For Parcels that will deliver the
>> iphone to you in the US and allow you to check the iphone before I
>> receive the payment. You will be in control of your money and I will be
>> in control of my iphone.
>> I will use 2 day delivery and I will take care of the shipping fee.
>> Please have a look at their procedure and we will go from there.
>>
>> http://ca-readyforparcels.com/en_langua ... party.html
>>
>> Thanks.

Domain Name: CA-READYFORPARCELS.COM
Registrar: SHINJIRU MSC SDN BHD
Sponsoring Registrar IANA ID: 1741
Whois Server: whois.ilovewww.com
Referral URL: http://www.ilovewww.com
Name Server: NS7.NLKODDOS.COM
Name Server: NS8.NLKODDOS.COM
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Updated Date: 19-dec-2015
Creation Date: 19-dec-2015


Expiration Date: 19-dec-2016
Domain Name: CA-READYFORPARCELS.COM
Registry Domain ID: 1988362589_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.ilovewww.com
Registrar URL: http://www.ilovewww.com
Updated Date: 2015-12-19T10:25:10Z
Creation Date: 2015-12-19T10:22:54Z
Registrar Registration Expiration Date: 2016-12-19T10:22:54Z
Registrar: Shinjiru MSC Sdn Bhd
Registrar IANA ID: 1741
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Admin
Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Registrant Street: C/O ID#10760, PO Box 16 Note - Visit PrivacyProtect.org to contact the domain owner/operator Note - Visit PrivacyProtect.org to contact the domain owner/operator
Registrant City: Nobby Beach
Registrant State/Province: Queensland
Registrant Postal Code: QLD 4218
Registrant Country: AU
Registrant Phone: +45.36946676
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]


The website is in the process of being reported for fraud Mike W

Domain Name: NEDHOLIDAY.COM
Registry Domain ID: 1987868378_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.ilovewww.com
Registrar URL: http://www.ilovewww.com
Updated Date: 2015-12-17T00:43:30Z
Creation Date: 2015-12-17T00:42:34Z
Registrar Registration Expiration Date: 2016-12-17T00:42:34Z
Registrar: Shinjiru MSC Sdn Bhd
Registrar IANA ID: 1741
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Admin
Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Registrant Street: C/O ID#10760, PO Box 16 Note - Visit PrivacyProtect.org to contact the domain owner/operator Note - Visit PrivacyProtect.org to contact the domain owner/operator
Registrant City: Nobby Beach
Registrant State/Province: Queensland
Registrant Postal Code: QLD 4218
Registrant Country: AU
Registrant Phone: +45.36946676
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Please post the complete headers of the email from nedholiday.com. If you sent an email to nedholiday.com and got a response, post both with complete headers.

Header of the CA-Readyforparcels.com Email:

Header Analysis Quick Report<br>Originating IP: 69.16.147.189<br>Originating ISP: Ipvanish<br> City: Phoenix<br>Country of Origin: United States<br>* For a complete report on this email header goto ipTRACKERonline

Header of the Email:

Header Analysis Quick Report<br>Originating IP: 69.16.147.182<br>Originating ISP: Ipvanish<br> City: Phoenix<br>Country of Origin: United States<br>* For a complete report on this email header goto ipTRACKERonline

Please post complete headers and bodies. They look like this:

MIME-Version: 1.0
Received: by 10.28.137.132 with HTTP; Fri, 18 Dec 2015 02:42:36 -0800 (PST)
Date: Fri, 18 Dec 2015 05:42:36 -0500
Delivered-To: фывапролджэ@gmail.com
Message-ID: <CAMUjpjpqB5qvXEHfJeLLuwemo_EBtCfAWGUtpQa9ymU-wWqA5Q@mail.gmail.com>
Subject: Re: the Craigslist 15" MacBook Pro $250
From: Фываячсм Пролджэ <фывапролджэ@gmail.com>
To: [email protected]
Content-Type: multipart/alternative; boundary=001a114b097a340d2c052729ccaf

--001a114b097a340d2c052729ccaf
Content-Type: text/plain; charset=UTF-8

I'm in the Chesapeake Bay and you're in Edmonton. Should I travel to
Edmonton to see the laptop or do you want to ship it to me?

Фываячсм

Delivered-To: фывапролджэ@gmail.com
Received: by 10.28.96.193 with SMTP id u184csp1232401wmb;
Fri, 18 Dec 2015 14:36:57 -0800 (PST)
X-Received: by 10.194.133.5 with SMTP id oy5mr7616954wjb.32.1450478217199;
Fri, 18 Dec 2015 14:36:57 -0800 (PST)
Return-Path: <[email protected]>
Received: from mout.kundenserver.de (mout.kundenserver.de. [212.227.17.24])
by mx.google.com with ESMTPS id ql6si28968547wjc.192.2015.12.18.14.36.56
for <фывапролджэ@gmail.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 18 Dec 2015 14:36:57 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 212.227.17.24 as permitted sender) client-ip=212.227.17.24;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 212.227.17.24 as permitted sender) [email protected]
Received: from [172.20.27.76] ([69.16.147.13]) by mrelayeu.kundenserver.de
(mreue104) with ESMTPA (Nemesis) id 0MQ5lz-1a6V0e16nb-005E8c for
<фывапролджэ@gmail.com>; Fri, 18 Dec 2015 23:36:56 +0100
Subject: Re: the Craigslist 15" MacBook Pro $250
To: Фываячсм Пролджэ <фывапролджэ@gmail.com>
References: <CAMUjpjpqB5qvXEHfJeLLuwemo_EBtCfAWGUtpQa9ymU-wWqA5Q@mail.gmail.com>
From: Nancy Viera <[email protected]>
Message-ID: <[email protected]>
Date: Fri, 18 Dec 2015 15:36:49 -0700
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101
Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <CAMUjpjpqB5qvXEHfJeLLuwemo_EBtCfAWGUtpQa9ymU-wWqA5Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:5DOsuknuUWUGJYOKXY3jiFbr7low2scLRl85dtigKB5ZT0os9Lc
yAy3Vp8hMkKiStNJFZX/1cWLYkL5bwYi9ZM/wwIq86rGmi3teFuzDFnlfRbsPjbVEQ3jU+p
Jjby9baanNL5ySdum46OrE0v1XNPt0XP7fje7qufdxN2pf6mwaSyt3SSBD3MJuDopjpCYUG
egpgyTjexPqV1oojqUujQ==
X-UI-Out-Filterresults: notjunk:1;V01:K0:oz2pg8mltNc=:U5OyGo5YV6hEr2ALi/k6GX
LloDEWgvYhnABSUziv9y6LdjySuGALTCeWbY8QHIZIlW1j7fcJ+mKVHiC4MIJSOiVrePMvUwR
asJaxmtFdWyMMc1RT4wVXN4BaFdmawRzChoQcw280zZ5y0pcwQv1AiZ70U1mQPhBwWDXt8+FR
CXEN//pkgpF9+SFcRjsW1veQeyo0fSXWi9bdOFi6YWv3Pm3+KXyQ6EIJAqyRV3YTEaabMGB4o
CIrWlzyO0S98GD0aKMX7o0cJcyyKrLnBck2IN1KzfCGDiYTUxkjGvpDziMSHCBPjfXCvwIwL/
C7MzX9DN8Kche+FdVxp0QAQ64Cfc1bTvQYME36mU+IJqDeY0GeyPZL2eHsTwHRqYriG2/PfC2
BWnTI7HyKBASiGp0TA56Gsv8uGes8tRfCLhb6Evmu2gw6Ldq2EuX1o1bCCZTI/gzNsYUsvbXE
CcIkAu4MHu/M7F9dwZS3j8+rnLtmZAsRXUg8OdAloUa7jwPU2LEA/XvtvjZJW11SPpt2B/lLy
nkjaakDKJDol/evj4E6BcxYOQov11idPc21WWz5ln4TKfAM4vWjiUd8ESpFSK0CZchnyXxqfr
vWNmXsUP4R58dX7domPXdIeIaYTQJy98+5yIFDeXgd+mI3In4oojMmwwLr5QIZYsp5aX/MhFw
O1UMz9OI16UMYGDy/DNtkcHtbieqILlBbD2pRJgtNyEAs/UL3RgBnjGFf3nXJZVRrdN+Ct2Um
iZvO/HHNVr6/8k0w

Hi,

I have found a company called Right On Time that will deliver the Mac to
you in the US and allow you to check the Mac before I receive the
payment. You will be in control of your money and I will be in control
of my Mac.
I will use 2 day delivery and I will take care of the shipping fee.
Please have a look at their procedure and we will go from there.

http://ab-rightontime.com/en_language.i ... party.html

Thanks.

Guess they haven't been caught yet or atleast punished, such a shame

Ned Holiday at http://nedholiday.com used for scam emails (above)



Website stolen from the legitimate Sanditz Travel Management at http://www.sanditz.com

Ned Holiday is a full-service, travel management company with an extensive range of services. Built on integrity, we are an award-winning company recognized for providing outstanding service and value to our customers. We are a growing, dynamic organization comprised of a team of experienced travel professionals.
Our company has been providing corporate, vacation, group and meeting planning services and value since 1960. We are an American Express Travel Representative office. We are proud to support numerous local and regional organizations.
We are active members of recognized and respected industry validating associations such as The American Society of Travel Agents (ASTA), Cruise Lines International Association (CLIA), The Airlines Reporting Corporation (ARC), and The International Airlines Travel Agent Network (IATAN).

Only contact details: [email protected]