Beware New Scammer On Dp...got Scammed Last Night 21 Lll.com

[bgmv]

I am furious, I just got scammed out of 21 LLLL.com Godaddy domains last night on DP. The users name was ASH. Check the profile here, its flawless. Here is the info that was provided for change of registrant:

Michael Stearns
1269 Rinehart Road
Miami
Florida
33179
7864070208
email: [email protected]

He/she claims to have a partner and that their email is:

[email protected]

These are the names that I lost:

LPZT
MXIK
NKXC
NQVG
OGZH
OWXD
PRZJ
PZSN
QHYO
GJCQ GoDaddy 2/18/08---->$59
PQHY GoDaddy 10/31/2008--->$59
PQYT GoDaddy 10/31/2008---->$59
UZRK GoDaddy 8/2/2008---->$59 (live site .ru)
BQPG GoDaddy 7/8/2008---->$84
FOQH GoDaddy 7/16/08----->$175 (Pronouncable)
EBZP GoDaddy 7/08/08----->$89 (Ending P can be "Partners")
DTQG
FJXA
TKZD
HFZR
QPYE

Any help from anyone is greatly appreciated. I already contacted BlowDaddy and GayPal they are absolutely no help. "Nothing we can do on our end"

GreenGambler was also scammed. I need those names, that was my income, I was relying on them to pay my tuition and rent next semester. This sucks.

 

[Len]

Some info I have dug up that I want to share with you guy's!
Take a look at this! http://www.euphro2.com/forum/index.php?showtopic=2249

Go to post by Mushi Sushi on feb 11th and bingo!!

Name: Joyce Chan aka Mushi Sushi
Past Admin/GM Experience: Marshall RO / Nekomimi RO / Affinity RO
Experience: About everything a GM needs to know and experience in the field.

Contact: [email protected]
contact me if you require more information or an assessment .

I believe that hotmail address was one used by
HKSteve http://www.volkdefense.com/?cat=10

I think "SHE" made a mistake by giving her name. I looked up affinity RO and found it is a gamers site (Sound Familiar) Mushi Sushi is an Administrator on the site! Her avatar is definately female but there is absolutely no info on her profile???....Not even an email address! I really believe we are looking for at least one female in all this...maybe the name HKSteve is to make us think we are dealing with a male rather than female. What do you think? Being an administrator on a forum could, although I'm not sure, give her access to passwords..and we know that many people use the same password on every account they possess..Paypal/bank etc. Just a thought.

 

[bgmv]

Some info I have dug up that I want to share with you guy's!
Take a look at this! http://www.euphro2.com/forum/index.p...pic=2249&st=20

Go to post by Mushi Sushi on feb 11th and bingo!!

Name: Joyce Chan aka Mushi Sushi
Past Admin/GM Experience: Marshall RO / Nekomimi RO / Affinity RO
Experience: About everything a GM needs to know and experience in the field.

Contact: [email protected]
contact me if you require more information or an assessment .

I believe that hotmail address was one used by
HKSteve http://www.volkdefense.com/?cat=10

I think "SHE" made a mistake by giving her name. I looked up affinity RO and found it is a gamers site (Sound Familiar) Mushi Sushi is an Administrator on the site! Her avatar is definately female but there is absolutely no info on her profile???....Not even an email address! I really believe we are looking for at least one female in all this...maybe the name HKSteve is to make us think we are dealing with a male rather than female. What do you think? Being an administrator on a forum could, although I'm not sure, give her access to passwords..and we know that many people use the same password on every account they possess..Paypal/bank etc. Just a thought.

For those that dont know HKSTEVE is the person that posted the paypal username and password for [email protected] on desihackerz link above

Also I found this:

Yoshimit + Linksys are the two people who sold to Mehboob. They are the same person. Mehboob paid via paypal to [email protected]. Berserkv@gmail brings up the following handles:
PingKKK- alot in Chinese, cant read it
HKOP- asking specific questions about PayPal http://64.233.169.104/search?q=cach...le?user.id=7696+hkop&hl=en&ct=clnk&cd=1&gl=us

 

[Len]

Just done some more digging and now I believe the following:
hksteve is hkop located in Canada!

Info on hkop - [email protected] AIM- chineseguyx

http://72.14.205.104/search?q=cache.../viewtopic_50503.htm+hkop&hl=en&ct=clnk&cd=45

Posting on d-addicts.com by hkop
hkop
Joined: 09 Jul 2007
Total posts: 7
Gender: Unknown
Posted: Mon Jul 09, 2007 6:21 pm Post subject: Post Rating: 0

important if anybody can read japanese please give me a email or chat want to talk to you, my email is : [email protected]

hkop is a member of euphro2.com as is mushi Sushi!

Getting closer......

 

[CHILLY]

I just got this suspicious Private Message with what appeared to be a Phishing link.

Quad Premium LLLL Domains

BladeMaster

FTNO
GRSO
NHOB

 

[Anthony Sun]

I just got this suspicious Private Message with what appeared to be a Phishing link.

Quad Premium LLLL Domains

BladeMaster

FTNO
GRSO
NHOB

BladeMaster has 100% positive feedback from 10 trades though.

Just out of curiousity, I got the email address of the owner of FTNO.com from WHOIS and had sent him an email for conformation.

We will see what happen.

Anthony

:gn:

 

[bgmv]

Just done some more digging and now I believe the following:
hksteve is hkop located in Canada!

Info on hkop - [email protected] AIM- chineseguyx

http://72.14.205.104/search?q=cache.../viewtopic_50503.htm+hkop&hl=en&ct=clnk&cd=45

Posting on d-addicts.com by hkop
hkop
Joined: 09 Jul 2007
Total posts: 7
Gender: Unknown
Posted: Mon Jul 09, 2007 6:21 pm Post subject: Post Rating: 0

important if anybody can read japanese please give me a email or chat want to talk to you, my email is : [email protected]

hkop is a member of euphro2.com as is mushi Sushi!

Getting closer......

You had the answer the whole time!!! Check the link you posted the IP is in the link, 72.14.205.104. Guess where it leads...drum roll please....Montreal, Canada

http://whatismyipaddress.com/staticpages/index.php/lookup-results

It appears that he/she lives on the Avenue du docteur-Penfield, near the Shriners Hospital...oh I think we got em'

Now guess what major university is located on this street???
MCGILL UNIVERSITY, this completely fits the profile...oh man we are so close right now

 

[Anthony Sun]

This is getting very interesting. I hope you guys can catch the person. Put the person in jail, man!

Anthony

:gn:

 

[myidea]

Scammer is NOT cybershadow, mozilla, Ian, or many of the others people have said. Everyone is pointing fingers. I KNOW the scammer is [email protected] . I have a great idea how to catch him, but I would need an advanced hacker. The hacker would be doing a good deed.

 

[bgmv]

Scammer is NOT cybershadow, mozilla, Ian, or many of the others people have said. Everyone is pointing fingers. I KNOW the scammer is [email protected] . I have a great idea how to catch him, but I would need an advanced hacker. The hacker would be doing a good deed.

How do you KNOW the hacker is idiotenglish?

 

[myidea]

he scammed me

 

[RJ]

Scammer is NOT cybershadow, mozilla, Ian, or many of the others people have said. Everyone is pointing fingers. I KNOW the scammer is [email protected] . I have a great idea how to catch him, but I would need an advanced hacker. The hacker would be doing a good deed.

This was posted by cybershadow/mozilla/Ian btw.

 

[tanujdude91]

DP is full of scammers .
scammers of dp transferred to the domains section after the money xchanges threads got banned .

 

[Len]

This was posted by cybershadow/mozilla/Ian btw.

RJ are you saying cybershadow/mozilla/Ian and myidea are one and the same?

 

[vatsan]

This thing is just so interesting!

 

[Kate]

myidea
Account Suspended

Hmmmm...

 

[Len]

Looks like this whole area is the accomodation blocks for the McGill Uni students
It covers 1100 Av Du Docteur-Penfield, Montreal, QC H3A 1A8 --1460 Av Du Docteur-Penfield, Montreal, QC H3G 1B8
If we had a first name/surname of sorts to go off I could easily track them down! Has anyone ever had a reply from the email address [email protected] ?? I know he has used it elsewhere to communicate.

Ok don't know if I am digging too deep here but this is what I have come up with.
The stolen Domains have primarily been registered in 2 names using the Paypal accounts associated with those names. They are Brian Gordon and Micheal Stearns.
We believe those reponsible live somewhere around the McGill University, Montreal.

I have found that both the names Brian Gordon and Micheal Stearns are also associated with Montreal.....Brian Gordon - 4575 Boul Grand Montreal, QC
Micheal Stearns - 3833 Av Melrose Montreal, QC

These 2 adresses are only 1.8kms (4 minutes walk)apart! And...only 6.6kms and 5.4kms respectively away from the McGill University!!! This is possibly why and how these accounts were used. Details have either been stolen, hacked or obtained by some other illegal method....... My point is I believe that we are very close....very,very close..

 

[bgmv]

Why dont we just ask both Michael Stearns and Brian Gordon where they live?

 

[nielsencl]

FYI - More info on the former myidea can be found here.

 

[Len]

Why dont we just ask both Michael Stearns and Brian Gordon where they live?

Sent an email to Brian Gordon asking the same question.....Just waiting to see if he answers!

 

[dannbkk]

It hasn't happened to me yet touch wood, but I am going to file a complaint to paypal now anyway so that they can put proper actions on domain sellers, so that we can continue to do business through paypal and so that they can provide a better service as us the sellers seemed to be left helpless.

Can everyone support this cause and send paypal an email with the following, I have already done so:

"Domain Name sellers left helpless with Chargebacks, Please change your Policy!"

The more of us emailing them with this they well get the picture a bit like having a protest!

 

[GreenGambler]

Looks like this whole area is the accomodation blocks for the McGill Uni students
It covers 1100 Av Du Docteur-Penfield, Montreal, QC H3A 1A8 --1460 Av Du Docteur-Penfield, Montreal, QC H3G 1B8
If we had a first name/surname of sorts to go off I could easily track them down! Has anyone ever had a reply from the email address [email protected] ?? I know he has used it elsewhere to communicate.

Ok don't know if I am digging too deep here but this is what I have come up with.
The stolen Domains have primarily been registered in 2 names using the Paypal accounts associated with those names. They are Brian Gordon and Micheal Stearns.
We believe those reponsible live somewhere around the McGill University, Montreal.

I have found that both the names Brian Gordon and Micheal Stearns are also associated with Montreal.....Brian Gordon - 4575 Boul Grand Montreal, QC
Micheal Stearns - 3833 Av Melrose Montreal, QC

These 2 adresses are only 1.8kms (4 minutes walk)apart! And...only 6.6kms and 5.4kms respectively away from the McGill University!!! This is possibly why and how these accounts were used. Details have either been stolen, hacked or obtained by some other illegal method....... My point is I believe that we are very close....very,very close..

Fantastic info Len.

I think that you are tottally on to something..

Just an FYI.. That is the same person ([email protected]) who stole my names (Zmul.com and GjrF.com) using the PayPal account of Kelly Willhite. But then they reversed the Willhite payment and sent a new payment from the Micheal Sterns PayPal account.

I thought this was suspicious so I replied to the PayPal email that I received telling me that Micheal Sterns sent me a payment.

I sent a message to Msterns on Feb 12th, 11:35pm, via reply to the automated PayPal message, saying:

Hello,

I have received a PayPal payment for $150 from your paypal account for the domain names, Zmul.com and Gjrf.com

I would please like to confirm that you are the person with whome I have made this transaction.

Please reply to this email immedietly so that I can verify the validity of the payment.

Thanks,
Richard

He replied:

Yes im partnered with ash on dp. sorry for the mess

I replied:

Thanks Mike,

I'm just trying to look out for everyone, and my fellow domainers.

Cheers,
Rich

His final reply on Feb. 13th, 12:05am was:

np pleasereply im legit thank you

A few hours later I noticed the payment had been reversed so I sent this on Feb. 13th, 3:37am:

Why did you reverse the payment?

Then on Feb. 13th, 10:46am he sent this:

Payment was reversed by Paypal representatives due to fradulent charges. Any payment received by you under my e-mail is now null void.

I replied:

So did somebody hack into your PayPal account?

I sold 2 domain names to your account, and spoke with someone via this email address, [email protected]. Are you saying that it was not you whom I spoke with last night?

And the final message I received from MSterns84 was:

Definitely wasn't me. Person got into my e-mail account and paypal account.

Maybe this will help a bit.

For a while there I thought that Micheal Sterns and the scammer were the same person but now with your info I am not sure if it is or if it is another case of stolen identity.

 

[bgmv]

Ok, im pretty sure that this link verifies that [email protected], hksteve, once lived in London, Ontario, Canada. It looks like his name is Inhyuk Kim, and he is korean.

http://209.85.207.104/search?q=cach...634356+idiotenglish&hl=en&ct=clnk&cd=12&gl=us

 

[Len]

Ok, im pretty sure that this link verifies that [email protected], hksteve, once lived in London, Ontario, Canada. It looks like his name is Inhyuk Kim, and he is korean.

http://209.85.207.104/search?q=cach...634356+idiotenglish&hl=en&ct=clnk&cd=12&gl=us

Possibility that he was there as a student at Western University. There may still be some correlation here with Mcgill university as both have very similar faculties.

 

[tinner666]

Just wish that after the crimes get reported, the domains would land on a hotsheet somewhere that was always checked so the dungbug couldn't get it hosted or sold anywhere.

 

[Meongtae]

Can I help?

I was reading the thread, as all good newbies should do, and keyed in on the possible "asian hacker/student" thing.
HK might stand for Hong Kong as a lot of Chinese students are in the US. So, check this....
It is a few asian guys together, in a college dorm, at a LAN party.
I'm not saying anyone is guilty of anything, but, gaming and hacking are like peanut butter and jelly for some.
One guy's name is HKSteve.
(and I'm not a bad tracer either)

http://good-times.webshots.com/photo/1224998944062047408gEhIuw

And it sure looks like a dorm room doesnt it?