Site logo

     


Advert.
Switch to full style
Report any emails with fake links attempting to steal your ID, and any fake sites used by scammers.
Post a reply

support@agm-express.com

Sat Oct 22, 2016 5:48 am

The scammers are posting adds online selling cars. The victims interested to buy those cars are advised to use the services of an escrow company, called AGM Express.

According to the company site:

AGM Express provides domestic and international shipping & transportation services for classic cars. Our employees and agents are professionals with the knowledge and the experience to get the job done.

We can accompany you when buying or selling your classic car and on your request we can take trustee responsibilities for you.

Our company offers a service called Safe Exchange. This service together with our expertise protects both the buyer and seller in international classic cars transactions!


SAFE EXCHANGE SERVICE DESCRIPTION AND STEPS:

1. BUYER and SELLER agree to terms
Both parties agree to terms of the transaction, which includes a description of the car, sale price, pick-up and delivery address, and any other relevant transaction information.
2. SELLER sends the car with AGM Express
Our company picks-up the car, verifies & inspects the type, condition and authenticity of the car. After that we issue a tracking number to confirm that the car is in our depots, and it is scheduled for departure to the buyer's address upon payment confirmation.
3. BUYER sends the payment to AGM Express
The buyer sends the payment to our company using bank transfer. Upon payment verification, we will ship the car to the buyer's address and will update the tracking information. Delivery times vary by destination from 1 to 8 working days.
4. BUYER receives the car
The car is delivered to the buyer along with our inspection certificate that guarantees the type, condition and authenticity of the car. The Buyer will notify AGM Express within 3 days after the delivery if he accepts or rejects the car.
5. AGM Express pays the SELLER
Once the car is approved and received by the Buyer, together with all the documents, we release the payment to the seller. The transaction is complete!


Contact details:

AGM Express

72 Dolphin Lane
B27 7DE
Birmingham
United Kingdom

Tel: +44 703 6223275
Fax: +44 703 6221276

We provide 24h online support.
You can contact us directly at
support@agm-express.com.


"The transaction is complete!! - it would be if the sellers are real, the cars are real and the shipper is real... which is not the case...

Re: support@agm-express.com

Sat Oct 22, 2016 5:53 am

The sellers:
1. Andreas Brieler Address:7 Marlton Way City:Lancaster Country:UK Zip Number:LA1 5BW; selling a Pontiac Firebird (1969); E-mail: andreas.brieler@gmx.com. His add for selling the car was posted on a Swedish site.

2. Mario Schlorer Address:7 Marlton Way City:Lancaster Country:UK Zip Number:LA1 5BW; selling a Ford Mustang Fastback (1973); E-mail: mario.schlorer@gmx.com.

At least in this case, according to a French forum - http://www.mustangv8.com/fr/ebay-craigl ... yable-!!!/ - he is trying to sell that car since 2014:

The price of the car is 12,750 euros. You can see in the attachment a document with more pictures. Car Location: The car is in excellent condition, no defects or any other mechanical problems. The car can be transmitted to your name with the title. It comes with all the paper: title, bill of sale, registration papers, manuals. Other details: cut, 07/1967, 4736 cm3, 224 hp 165 kW petrol, automatic transmission , 76550 km, 2 doors, 4 seats, green, metallic paint, alloy wheels, power steering, radio, complete restoration in 1999 in the US, import USA (2010), transmission and management has been revised, maintenance booklet, gray card collection, etc. Reason for sale: I worked for a company in Austria. When I was living in Austria I also bought the car. There are two months I moves to a new company, which is situated in Lancaster, UK. I have a good job now, and I plan on staying at the Lancaster for a long time, and driving here with a left steering car can be a complete nightmare. As you know, in England all cars have the right direction and traffic is different. I do not fit quite well, and I want to buy a car with a direction from right to adapt the roads and the rules that apply here. I am in Lancaster and the car is here. The car can be despatched or you can come and take it. Waiting for your reply. Mario Schlorer


After making fun about the price, the French site Admin located the real seller in Austria, thanks to the plates...

3. Uwe Kreissig Address:7 Marlton Way City:Lancaster Country:United Kingdom Postal Code:LA1 5BW; selling Jeep Willys Overland MB (03/1944, VIN no. MB314397) ;E-mail: keros6789@gmail.com.

4. Horsten Lutz Address:7 Marlton Way City:Lancaster Country:United Kingdom Zip Number:LA1 5BW; selling A Mg Td Cabriolet (07/1952, VIN TD14191); E-mail: horsten.l@gmx.com.

5. Robert Bocker Address:89 Wingate Saul Road City:Lancaster Country:UK Zip Number:LA1 5DH; selling a Jaguar E-Type Coupe (1973); E-mail: robert.bocker@gmx.com.

Re: support@agm-express.com

Sat Oct 22, 2016 5:56 am

The buyers are notified by the escrow company:

We confirm that the automobile described by the tracking number is located in our depots in Lancaster, UK. The car comes with certificate, title, bill of sale, history book and registration papers. THE SHIPMENT WILL BE RELEASED ONCE WE HAVE THE PAYMENT CONFIRMATION FROM THE BUYER.


The escrow company:

72 Dolphin Lane
B27 7DE
Birmingham
United Kingdom
- the location is in a residential area, no company located there.

"our depots" in 7 Marlton Way Lancaster United Kingdom LA1 5BW
- the location is another residential area, no company located there.

+447036223275
+447036221276 - universal phone numbers - the numbers can be used anywhere in the world.

In fact the escrow company site is operated by someone in Poland.

Fake site details - http://db.aa419.org/fakebanksview.php?key=117334:
Domain name: agm-express.com
Updated Date: 2016-07-25
Creation Date: 2016-07-25
Registrar Registration Expiration Date: 2017-07-25
Registrar: Bizcn.com,Inc.

Registrant details:
Registrant Name: Marek Kazuewsky
Registrant Organization: NA
Registrant Street: Tamka str, 6 fl 41
Registrant City: Warszawa
Registrant State/Province: Mazowieckie
Registrant Postal Code: 00-920
Registrant Country: pl
Registrant Phone: +351.3129795033
Registrant Fax: +351.3129795033
Registrant Email: marekkazuewsky@gazeta.pl

This is what the fake site is looking like:

agm-expressmain.PNG

Re: Bizcn.com,Inc

Sat Oct 22, 2016 5:58 am

Registrar: Bizcn.com,Inc


The domain Registrar is located in China, while the fake site is active on a Russian IP. About the Registrar, back in 2012: http://www.webhostingtalk.com/showthread.php?t=1165900:

(...) My identity has been stolen by BIZCN domain registrar (or their customer(s)), who is accredited by ICANN. Someone at BIZCN has registered over 50 to 70 domain names (or more) using my name and my address, but they used their own email address and my old (not working) phone/fax number and everyone knows why they do it (so I don't get contacted too soon). (...) My numerous attempts to reach BIZCN ended up in "Jimmy" from BIZCN responding (after numerous no-responses) and promising changes, yet he did very little and I noticed only a handful of domains at the Whois replaced my address with (I am sure) another stolen address/identity. BIZCN is a criminal fraud accredited by ICANN! Then who are ICANN if they accredit criminal domain registrars?"


In the case of agm-express.com, the same email address used to register the domain was used to register 100+ sites from May until September this year...

marekkazuewsky@gazeta.pl

Sun Oct 30, 2016 12:48 am

In the online fraud area - what is generally considered Advance Fee Fraud, the fake sites mentioned in this topic are doing the same type of scams: searching for mules willing to reship goods or money. Few of the fake sites are impersonating delivery / escrow companies. Few are even impersonating eBay.

But that is only the visible part of the iceberg...

The group using the email address marekkazuewsky@gazeta.pl for registering fake sites was very active in the last 10 months. The number of sites registered online in this period of time while using the exact same details was not the same each day; the maximum point happened on a specific day in June when over 80 sites were registered.

All those sites operating under that registration have something else in common, not only the registrant, the registrar, the host and the wrong spelled domain names: they are spreading malware.

According to a recent report from security experts at Cisco, Proofpoint, and independent researchers:

It is about
"malware downloader," a specific type of virus that is specialized in gaining a foothold on a victim's PC, with little features except the ability to bypass antivirus software, gain boot persistence, and download & install other more potent malware. The malware also comes with self-propagation features to spread to nearby computers on the same network (via network shares) or onto plugged-in USB drives."


"Cisco researchers were able to discover that a crook/group using the marekkazuewsky@gazeta.pl address had registered 177 domains, which they used to send the spam flood that spread these new H1N1 versions."


In fact, at the moment of this post, there are registered online 389 domain names using that email address.

The actual wave of fake sites built to spread malware is a follower of the previous one, happened between May and October 2015, when the email address valeryy.mostovenko@gmail.com was used to register 190 domain names.
Post a reply