http://air-export.uv.ro/ - LETTER TO SEND - CLOSED

[peg]

Ok, this seems to be the latest for scammers. They use hosts that only provide a Sub-Domain such as http://uv.ro (xhost.ro) and http://3x.ro. So when you do a WHOIS you only get their information (on the hoster) and not that of the fraudulent site (the only real information there is the Creation date, everything else is likely forged).

Anyway, I have composed the firsrt of the letters (posted) that I hope all will send to the host to help them identify a fraud site.

Letter:


Dear Sir/Ma'am:

You are receiving this email because you are either directly or indirectly linked with a fraudulent site hosted at http://air-export.uv.ro/

This particular site (although apparently incomplete at the time of writing) is using a known fraudulent layout. This particular layout has been used well over 50 times (we stopped counting at around 35) as can be seen in our gallery area at http://escrow-fraud.com/images/sites/Layout2 .

The website itself resolves to 64.111.196.20

Please be diligent in removing this fraudulent website. Additionally, although, we understand that you provide "Free" web hosting, there may have been fees paid in registering the domain. If these fees were collected by your company, you may also find that they were paid for with fraudulent or stolen credit cards and Identities.

Thank you for your co-operation in this matter. Please feel free to visit http://escrow-fraud.com for more information about fraudulent sites.

Sincerely

Sign an appropriate name

This email shoudl be sent to the following addresses.

Addresses associated with WHOIS of uv.ro
abuz@xhost.ro, domain-admin@listserv.rnc.ro, istoica@yahoo.com, flore@rnc.ro, dan@rotld.ro, danp@rnc.ro

Addresses associated with whois of ip 64.111.196.20 (which is where http://air-export.uv.ro/ resolves to)
support@isprime.com, noc@isprime.com, abuse@isprime.com

Please copy and paste the text into a new email and send it to each of the addresses above. The goal obviously is that the hosts will get the point that they are hosting a fraud site and ultimately may shut them down sooner.

Once we (someone) notices that the site is shut down, then we can add a message in here saying so. The topic will then be changed to indicate it (to avoid sending email about sites already closed.

[peg]

Bravo - Site closed quickly:

Hi,

Thanks for bringing this incident to our attention.
Account name: air-export.uv.ro has been terminated effective immediately.

If i can be of further service please don't hesitate to contact me.