republican-creole
Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Spam, Scam and Phishbusters » Trouble Bubble LLC Collegeville?
Search Topic:
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
[Phish Tracker] Phishing vs ...not phishing »
« [Phishing] McAfee Phish ?  
AuthorAll Replies

MGD
Premium,MVM
join:2002-07-31
Fort Lauderdale, FL

reply to Spectral
Pluto, Digital Age, and da-support.com

Click for full size
Exhibit 1
Click for full size
Exhibit 2
Click for full size
Exhibit 3
More on:
Connecting Pluto, Digital Age, and now da-support.com together

After reading the excellent investigative post on the other D.A. thread by the folks from DIGITAL AGE PRODUCTS, this part caught my attention:
.........-- If you check your statement it says something like: Digital Age 8885298 Cyprus (all card holders who have called or e-mailed us have a similar number on their statement). MasterCard has informed us the full telephone number is 888-529-9842. THIS IS NOT DIGITAL AGE PRODUCTS’ TELEPHONE NUMBER. If you call this number, there will be a voicemail that will direct you to a web site: »www.da-support.com. FOR YOUR OWN SAFTEY, DO NOT FILL OUT ANY INFORMATION ON THIS WEB SITE......

DAP have uncovered the real phone number for Digital Age, and the subsequent telephone instruction to fill out a form at »www.da-support.com in order to receive a credit for the fraudulent charges. In order to continue to assemble the pieces of the puzzle, and to sustain the conclusion in the previous post that this is a long running continuation of the Pluto scam, we need a connection that ties da-support.com back to Digital Age »www.diage.com. That appears to be a difficult task since da-support.com's registration is cloaked, and hides behind Network Solutions. On the other hand the diage.com registration uses info@diage.com as a contact, and an address in Wyoming. They also have different hosting and DNS.

Registrant:
IRS Ltd
ATTN: DA-SUPPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447

Domain Name: DA-SUPPORT.COM

Administrative Contact :
IRS Ltd
a43c49qm9cj@networksolutionsprivateregistration.com
ATTN: DA-SUPPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
Phone: 570-708-8780

Record expires on 13-Jun-2006
Record created on 13-Jun-2005
Database last updated on 13-Jun-2005

Domain servers in listed order: Manage DNS

NS2.NETNATION.COM 204.174.223.31
NS1.NETNATION.COM 204.174.223.1


Well the only clue there is that "IRS Ltd" is most likely a UK name. An examination of www.da-support.com reveals another clue. There is a SSL cert on the server the was issued to www.musicsay.com. I can't take a shot of it as the site is down currently. However, whois.sc confirms the SSL Cert see [Exhibit 1]. Now lets have a look at the musicsay.com registration [Exhibit 2]:

Registrant:
IRS Ltd ---------------> LOOK
CASTLE ACRE ROAD
SWAFFHAM, NORFOLK PE37 7HS
UK

Domain Name: MUSICSAY.COM

Administrative Contact , Technical Contact :
IRS Ltd
alex@diage.com ---------------> LOOK
CASTLE ACRE ROAD
SWAFFHAM, NORFOLK PE37 7HS
UK
Phone: 1234567890

Record expires on 26-Apr-2006
Record created on 26-Apr-2005
Database last updated on 26-Apr-2005

Domain servers in listed order: Manage DNS

NS1.NETNATION.COM 204.174.223.1
NS2.NETNATION.COM 204.174.223.31


Well!! a diage.com contact address, and the same IRS Ltd as da-support.com, except now we have the complete UK address. The UK companies search listing is only open M to F, however, I suspect that this is a hijacked name based on the listing at UK Data [Exhibit 3]. IRS Ltd is also classified in listings as "Sign Manufacture & Repair". Diage.com also used a UK company name Ruby Services Ltd during the EU card fraud last year. I also believe that someone traced Pluto Data as a UK company in that thread.

It appears that even with Kip patterson See Profile and others bringing the Pluto scam to the attention of mainstream media, we have heard little since of any law enforcement action. It now appears that this global criminal enterprise continues to feed from the fraud loss trough, that the banking system is willing to tolerate at consumers expense. They appear to be able to morph from one card scam to another and between countries, with little fear of being apprehended.

MGD

brmorris
Premium
join:2002-12-09
Irwin, PA
MGD,

Thank you for lending your expertise in this investigation! I am working hard to try to get this issue noticed and your work will certainly help.

The posts will take me a while to digest, but are excellent!
Thread is
Forums » Up and Running » Security » Spam, Scam and Phishbusters[Phish Tracker] Phishing vs ...not phishing »
« [Phishing] McAfee Phish ?  


Sunday, 08-Nov 23:44:53 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [156] Cable Uncapper Faces Criminal Charges
· [140] AT&T Sues Verizon Over 3G Ads
· [112] Why Run Fiber When You Can Run Ads That Pretend You Do?
· [108] Comcast Is Simply Getting Huge
· [93] Apple Cooking Up New $30 A Month TV Service?
· [83] Bits Of ACTA Agreement Leaking Out
· [80] Will 'Three Strikes' Come To The United States?
· [78] Verizon To Double Smartphone ETFs?
· [77] Verizon: Droid Tethering Will Cost $30 Extra
· [73] Comcast, NBC Deal Almost Complete
Most people now reading
· [NFL] Week 9 Games Thread [Sports Chat]
· [WIN7] Which Services in Win 7 Have You Turned Off? [Microsoft Help]
· Hit and run [General Questions]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· My cat is reluctant to exercise. [General Questions]
· [ Classes] Druid tanking: rotation and glyphs [World of Warcraft]
· Voxox Unlimited US/Canada for $2.45 or World $12.95 a month [VOIP Tech Chat]
· Windows 7 boot manager editing questions [Microsoft Help]
· Divorce advice... [General Questions]
· [How to] Install Asterisk on an Asus WL-520GU router [VOIP Tech Chat]