RE: FraudWatch Fake courier sites with tracking number
Post 1 of 5
To all of you,
Let me explain how this fake site i.e. http://www.afrolinkscourier.com/ is working. The scammer is giving you one of 20 prefixed tracking numbers. He will create an easy websote with your data. below you can see the source code of the fake tracking nummbers, which I have saved from this site.
function Login(){
var done=0;
var username=document.login.username.value;
username=username.toLowerCase();
if (username=="45332355345") { window.location="result1.htm"; done=1; }
if (username=="64355236465") { window.location="result2.htm"; done=1; }
if (username=="75345325456") { window.location="result3.htm"; done=1; }
if (username=="13244468657") { window.location="result4.htm"; done=1; }
if (username=="26564656536") { window.location="result5.htm"; done=1; }
if (username=="36645632356") { window.location="result6.htm"; done=1; }
if (username=="51293483773") { window.location="result7.htm"; done=1; }
if (username=="52648394038") { window.location="result8.htm"; done=1; }
if (username=="53749048476") { window.location="result9.htm"; done=1; }
if (username=="54847626463") { window.location="result10.htm"; done=1; }
if (username=="55277849293") { window.location="result11.htm"; done=1; }
if (username=="56729408273") { window.location="result12.htm"; done=1; }
if (username=="578478736362") { window.location="result13.htm"; done=1; }
if (username=="585038476638") { window.location="result14.htm"; done=1; }
if (username=="593772684930") { window.location="result15.htm"; done=1; }
if (username=="607883937462") { window.location="result16.htm"; done=1; }
if (username=="610388477369") { window.location="result17.htm"; done=1; }
if (username=="628490503759") { window.location="result18.htm"; done=1; }
if (username=="714645467832") { window.location="result19.htm"; done=1; }
if (username=="726459090235") { window.location="result20.htm"; done=1; }
if (done==0) { window.location="track now.htm "; }
}
// End -->
The scammer will give you the number 45332355345, on the tracking site this number will link you to resultone.htm. Here is your data saved in a html code. He works only with 20 tracking numbers.
He even tries to hide the source code, but there is allway a way to get to it.
So if you guys got any questions about fake couriers or shippment companies just ask me.
Post 2 of 5
Replying to [detronic]: This are the guys, which have benn tricked.
Just copy the url http://www.afrolinkscourier.com/result1.htm and change the number 1 to 2 and so on.
Receivers Address
Via Ettore Pinzani 9
Dicomano
Firenze .50062
Italy
Package Content(s) 3 unit of Nokia N91 and 2 unit of Nokia N80
Current status ON TRANSIT
Shipped Date Delivery date
10-6-2006 13-6-2006
--------------------------------------------------
Tracking #64355236465
Receivers Name: Omar Zepeda
Receivers Address
2008 Perry AVE
Groves, TX 77619.USA
Package Content(s) Motorola L7 10 units
Current status ON TRANSIT
Shipped Date Delivery date
2-6-2006 5-2-2006
---------------------------------------------------
Tracking #75345325456
Receivers Name: Joshua D. Handy
Receivers Address
3662 Crickwood Circle
Indianapolis, IN 46268
USA.
Package Content(s) 22 UNIT OF NOKIA N90
Current status ON TRANSIT
Shipped Date Delivery date
2-6-2006 5-6-2006
----------------------------------------------------
Tracking #13244468657
Receivers Name: Hrachia Vardanyan
Receivers Address
14735 victory blvd apt. 4,Van Nuy.CALIFORNIA.91411.USA
Package Content(s) ONE UNIT OF GOLD NOKIA 8800
Current status ON TRANSIT
Shipped Date Delivery date
2-6-2006 5-6-2006
----------------------------------------------------
Tracking #26564656536
Receivers Address
Royal Road Union park.Mauritius.
Package Content(s) 3 UNIT OF NOKIA N93
Current status ON TRANSIT
Shipped Date Delivery date
8-6-2006 10-6-2006
Post 3 of 5
Replying to [detronic]: His domain Data, maybe FraudWatcher can help.
Active Whois 2.6.4188
Di, 13 Juni 2006 07:11:54 +0100 (Westeuropäische Normalzeit)
Looking for 'http://www.afrolinkscourier.com/result5.htm'
www.afrolinkscourier.com [65.254.254.34] - host alive, connection speed 150ms
---
Domain owner:
Looking for 'afrolinkscourier.com'
Domain zone 'COM' is for commercial purposes
URL for registration of domains: http://www.internic.net/origin.html
Server 'whois.opensrs.net' reply [2366 bytes in raw data]:
Registrant:
Sager
3800 Kelvin Ave
Fort Worth, TX 76133
US
Domain name: AFROLINKSCOURIER.COM
Administrative Contact:
Sager, Duane drichdonleads@yahoo.com
3800 Kelvin Ave
Fort Worth, TX 76133
US
1 800-737-7883
Technical Contact:
Administrator, Domain domreg@fatcow.com
70 Blanchard Road
Burlington, MA 01803
US
+1.8882789780 Fax: +1.7812726550
Registration Service Provider:
FatCow, support@fatcow.com
888-278-9780
Registrar of Record: TUCOWS, INC.
Record last updated on 31-May-2006.
Record expires on 31-May-2007.
Record created on 31-May-2006.
Domain servers in listed order:
NS1.FATCOW.COM 65.254.254.100
NS2.FATCOW.COM 65.254.254.101
Domain status: ACTIVE
The Data in the Tucows Registrar WHOIS database is provided to you by Tucows
for information purposes only, and may be used to assist you in obtaining
information about or related to a domain name's registration record.
Tucows makes this information available "as is," and does not guarantee its
accuracy.
The compilation, repackaging, dissemination or other use of this Data is
expressly prohibited without the prior written consent of Tucows.
Tucows reserves the right to terminate your access to the Tucows WHOIS
database in its sole discretion, including without limitation, for excessive
querying of the WHOIS database or for failure to otherwise abide by this
policy.
Tucows reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by these terms.
NOTE: THE WHOIS DATABASE IS A CONTACT DATABASE ONLY. LACK OF A DOMAIN
RECORD DOES NOT SIGNIFY DOMAIN AVAILABILITY.
---
IP address:
Looking for '65.254.254.34'
Server 'whois.arin.net' reply [741 bytes in raw data]:
OrgName: Endurance International Group, Inc.
OrgID: EIG-12
Address: 70 Blanchard Road
City: Burlington
StateProv: MA
PostalCode: 01803
Country: US
NetRange: 65.254.224.0 - 65.254.255.255
CIDR: 65.254.224.0/19
NetName: BIZLAND-FC03
NetHandle: NET-65-254-224-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.BIZLAND.COM
NameServer: NS2.BIZLAND.COM
Comment:
RegDate: 2004-01-06
Updated: 2005-03-31
OrgTechHandle: KWI15-ARIN
OrgTechName: Witt, Karl
OrgTechPhone: +1-781-852-3316
OrgTechEmail: kwitt@bizland-inc.com
# ARIN WHOIS database, last updated 2006-06-08 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
Post 4 of 5
Replying to [detronic]:
Nice work.
But I reported this site over at aa419.org already, they are trying to get it shut down by contacting the webhost. They noticed that JavaScript login, and someone is also warning the victims in case they have not realised it's a scam yet.
Post 5 of 5
Hi i have the tracking number and i want t know the courier compnay and current status which is coming from uk
Page 1 of 1