Suspected Scam: www.globaltrans.addr.com

[ragamuffin]

On Sept 28, 2006 I noticed a classified ad at http://montreal.kijiji.com (I live near Montreal) for a MacPro Quad Xeon with a 30" Cinema Display for $1500!! If you know anything about computers, you know that's a ridiculously low price. I contacted the seller (freddyneda@hotmail.com, Frederik Martin Gomez) and asked for a phone number that I could call before I came to see the equipment, assuming he was in Montreal. He replied and said unfortunately he was "from England" and I should register with the following third party service in order to protect each other throughout the transaction:

http://www.globaltrans.addr.com

I thought perhaps since he's from England he mistakenly put 1500 dollars instead of 1500 pounds, but he said no, 1500 dollars is the manufacturer's price and he got it right from the manufacturer, but he's now closing his business and has to sell everything. That just didn't sound plausible.

The wording on the site is very realistic, but the headings, titles, company names, etc., are TOO *spam* sounding. I couldn't find any WHOIS info for this site. The address and phone number do exist, although the phone number is a personal one according to http://www.numberingplans.com.

I did a "View Source" in the browser and there was almost exlusive reference to a web site called http://www.european-deals.com. The WHOIS info lists the registrant as Click Consulting Ltd. with an address in Nassau, Bahamas (which Google Maps couldn't find) and the telephone number was from Hong Kong. Tellingly, the record was created on Sept 29 (the day after I saw the ad), for a duration of one year!!

I'm pretty sure this is a scam.

[peg]

in db => http://escrow-fraud.com/fraud_data.php?id=2172

Additionally, I think the references to european-deals.com is only as an attribute to other tags. If you notice all references are preceeded by and quoted with tppabs="http://european-deals.com/xxxxxx.xxxx" (or similar to that).

The tppabs is apparently put in by an application called Teleport Pro and is not recognized by html (as any official html tag or attribute). Since http://european-deals.com is now shut down, I believe that it was a fraud site (at one time) and that scammer just COPIED the files (in their entirety) to the new site. However, they are just too lazy to modify the files and remove this text. Since it's not recognized html, it generally doesn't cause a problem, and it's easy for them to move the site and get it up quickly (to start scamming quickly).

[ragamuffin]

Great! Thank you. It's exactly the one. Good to know it's there to help others avoid disaster.

I'm surprised the scammers would try to resurrect the domain european-deals.com on Sept 29 if it was already shut down once.

I noticed the tppabs and figured it was like you said, laziness to remove code fragments. Helpful nonetheless! :-)