Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

IRCO Group - ircogroupltd.com

Report any emails with fake links attempting to steal your ID, and any fake sites used by scammers.

IRCO Group - ircogroupltd.com

Unread postby firefly » Sun May 09, 2021 2:42 am

The fake website was initially created last year in August as Irco Group Ltd Weeds, offering marijuana for sale:

cached.JPG


Contact details used:

14301 E Colfax Ave
Aurora, CO 80011, USA
+1 (413) 384‑6183
info@ircogroupltd.com


+14133846183
Number billable as geographic number
Country or destination United States
City or exchange location Longmeadow, MA
Original network provider* Ctc Communications Corp. - Ma
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: IRCO Group - ircogroupltd.com

Unread postby firefly » Sun May 09, 2021 2:47 am

After a while, the fake website was "adjusted" and is now IRCO Group LTD ( Covid-19 Medication Center).

From the fake website:

Welcome to the IRCO Group LTD (Covid-19 Medication Center). We are proud members of the Wellforce family. We are a health system in California focused on supporting clinicians and helping them focus on what they do best:
care for people. We are excited to offer the COVID-19 vaccines to our community, in partnership with the Cities of the USA. If you meet current Massachusetts and CDC eligibility requirements, please check for appointment availability.

As the coronavirus (COVID-19) pandemic continues to evolve, the Covid-19 Medication Center remains committed to providing the best care possible to patients and ensuring the safety of the entire IRCO Group LTD (Covid-19 Medication Center) community.

If you would like to support Covid-19 Medication Center during this challenging time, we welcome you to make a monetary donation to the Coronavirus Relief Fund.

Your gift will have an immediate and substantial impact on the hospital’s ongoing relief efforts so Covid-19 Medication Center can address a broad range of patient and staff needs. We cannot thank you enough for your consideration.

The Covid-19 Medication Center supports the Nation’s response to the Coronavirus (COVID-19) pandemic through a broad spectrum of tools, materials, and activities. This page presents information relevant to COVID-19; please always visit our COVID-19 web page for the newest resources to help healthcare providers, health system leaders, and policymakers implement practice improvement, health systems research, and data and analytics strategies.


The Covid-19 Medication Center is the lead Federal agency charged with improving the safety, quality, and value of patient care delivered by America’s healthcare system.


What they have to offer? Vaccines:

vaccines.JPG


Wellforce Health System is real, but doesn't include any IRCO Group.

The "company" pretending to be "a health system in California" is operated by fraudsters located in Cameroon.

Same as the marijuana, the contact details were removed as well - the only option for ordering the vaccines they pretend to have is on the website:

checkout.JPG


Bitcoin wallet used in fraud: 1PmCG3GEucMPBV5AiameW9R3pTEyguyNHZ

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=150358.

From the domain name registration:

Domain Name: IRCOGROUPLTD.COM
Updated Date: 2020-08-16
Creation Date: 2020-08-05
Registrar Registration Expiration Date: 2021-08-05
Registrar: Internet Domain Service BS Corp.
Reseller:

Registry Registrant ID: Not disclosed
Registrant Name: Not disclosed Not disclosed
Registrant Organization: CCN&Technologies SARL
Registrant Street: 1525 Rue manguier, 12345
Registrant City: Yaounde
Registrant State/Province:
Registrant Postal Code: 00237
Registrant Country: CM
Registrant Phone: +237.699452593
Registrant Email: 6de71114248c316977561454acae6aad.gdrp@c ... cycorp.com

This is what the fake website looks like:

main.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

covid-19medicationcenter.com

Unread postby firefly » Sun May 09, 2021 3:11 am

There was also another Covid-19 Medication Center active from the fraudulent domain name covid-19medicationcenter.com.

The fake site was created on March 4.

On March 11 it was reported online.

The fake website was still online on March 31. After that, the fraudulent domain was suspended.

Contact details:

Los Angeles, CA 90003
(909) 255-9347
contact@covid-19medicationcenter.com


+19092559347
Number billable as geographic number
Country or destination United States
City or exchange location Redlands, CA
Original network provider* U.s. Telepacific Corp. - Ca

From the domain name registration:

Domain Name: COVID-19MEDICATIONCENTER.COM
Updated Date: 2021-03-04
Creation Date: 2021-03-04
Registrar Registration Expiration Date: 2022-03-04
Registrar: Internet Domain Service BS Corp.
Reseller:
Domain Status: ok

Registry Registrant ID: Not disclosed
Registrant Name: Not disclosed Not disclosed
Registrant Organization: global lead investors
Registrant Street: Douala, Douala
Registrant City: Douala
Registrant State/Province:
Registrant Postal Code: 237
Registrant Country: CM
Registrant Phone: +237.651119712
Registrant Email: 46c69eeb2691d430e064b477ddc70f11.gdrp@c ... cycorp.com

This is what the fake website was looking like:

main.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

inwenco-ab.com

Unread postby firefly » Sun May 09, 2021 4:15 am

Same logo, another fake supplier: Inwenco AB, this time offering medical equipment.

The scammers stole the name and location of a reputable welding company in Sweden.

From the fake website:

Based in Sundsvall, Sweden Inwenco-ab.com is an online surgical supply store founded with the mission of procuring and distributing the highest quality, brand name medical equipment and supplies at reasonable prices.


In the United States, Canada, Europe, Asia and Australia, our standard shipping fee is $19.99 for all orders $199.99 and less. Orders $200.00 and more, with standard size and standard weight products, have free shipping.


Contact details:

Rosenborgsgatan 15 A 85238 Sundsvall, Sweden
+46 76 692 32 81
info@inwenco-ab.com


+46766923281
Number billable as mobile number
Country or destination Sweden

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=150361.

From the domain name registration:

Domain Name: INWENCO-AB.COM
Updated Date: 2021-02-09
Creation Date: 2021-02-09
Registrar Registration Expiration Date: 2022-02-09
Registrar: Internet Domain Service BS Corp.
Reseller:
Domain Status: ok

Registry Registrant ID: Not disclosed
Registrant Name: Not disclosed Not disclosed
Registrant Organization: global lead investors
Registrant Street: Douala, Douala
Registrant City: Douala
Registrant State/Province:
Registrant Postal Code: 237
Registrant Country: CM
Registrant Phone: Not disclosed
Registrant Email: 46c69eeb2691d430e064b477ddc70f11.gdrp@c ... cycorp.com

This is what the fake website looks like:

main.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: info@ircogroupltd.com

Unread postby firefly » Mon May 10, 2021 6:32 pm

Email received:

Dear xxx,

Thank you for your inquiry.

We are a supplier of approved Covid 19 Vaccines. We currently have over 25 000 vials of Pfizer Vaccines in stock, with a protection rate of 95%. One week after the second dose is administered, the Pfizer-BioNTech vaccine will be 95 percent effective in preventing symptomatic COVID-19 and severe outcomes related to it.

Our primary concern is to establish a long-term business environment with our buyers, as such, we offer top-quality products and prompt delivery.

- PACKAGING = xxx Vials of Pfizer Vaccine
- PRODUCT TYPE: PFIZER Covid 19 VACCINE= 95% Protection rate
- PRICE = $50 per Vial of pfizer Covid 19 Vaccine:
xxx Vials of Pfizer covid 19 vaccines= $xxx
DELIVERY TIME: 5-8 days

PAYMENT METHOD: Western Union, Worldremit, Moneygram, Bitcoin, Zelle, Bank Transfer

N/B. If you choose to pay with bitcoin, you will get a 20% discount when making your payment. This means you will be required to pay: $xxx for xxx vials of the Pfizer covid 19 vaccines instead of $xxx.

To pay with bitcoin, You need to send your payment to the following bitcoin address: 1PmCG3GEucMPBV5AiameW9R3pTEyguyNHZ

If you are not familiar with bitcoin and you need help on how to go about bitcoin payment, please kindly follow the simple instruction guide below:

Here is a simple guide on how to make your bitcoin payment using your credit/debit card:

We accept credit/debit card payments by bitcoin. Please follow the steps below to make your payment. Send your bitcoin payment to the following bitcoin address:

Click on the link https: // buy.moonpay.io and

select currency as Bitcoins (BTC)
Write the amount you wish to pay
Select “buy now” (it will ask for wallet ID)
Copy and paste this wallet I’d: 1PmCG3GEucMPBV5AiameW9R3pTEyguyNHZ
Click on buy now
Enter your email (A confirmation will be sent to your email)
Fill in the verification code to continue
Agree to terms and policies and continue
Fill in first name last name date of birth
Take continue
You fill in your address and card details and you are good to go.

After making your payment, send us your delivery address and contact information. Your order should reach you within 8 days

Please let us know if you need any help

Regards

Jennifer V. Lowman
Sales Manager | IRCO Group
M: +1 (219) 401-3093
P: +1 (219) 401-3093
Baytown, TX 77520, United States
www. ircogroupltd.com
IRCO Group Limited-Covid-19 Medication Center

IMPORTANT: The contents of this email and any attachments are confidential. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.


Header:

Return-Path: <info@ircogroupltd.com>
Received: from beorn.ccntechnologies.us (beorn.ccntechnologies.us. [161.97.86.172])
Received: from localhost ([127.0.0.1]:39538 helo=beorn.ccntechnologies.us) by beorn.ccntechnologies.us with esmtpa (Exim 4.94.2) (envelope-from <info@ircogroupltd.com>) id 1lfgIC-00GSt4-VL
Date: Sun, 09 May 2021 12:04:08 +0200
From: IRCO Group-Covid-19 Medication Center <info@ircogroupltd.com>
To:
Subject: Re: Inquiry for Pfizer vaccine
In-Reply-To: <6gmve3Dg2tfTKS1wde8Y9YfdnKQm2lYqdZKCOsN1jY@ircogroupltd.com>
References: <6gmve3Dg2tfTKS1wde8Y9YfdnKQm2lYqdZKCOsN1jY@ircogroupltd.com>
User-Agent: Roundcube Webmail/1.4.11
Message-ID: <3ad6b1ef92f50a95c1be1f468646f5c5@ircogroupltd.com>

+12194013093
Number billable as geographic number
Country or destination United States
City or exchange location Cedar Lake, IN
Original network provider* Bandwidth.com Clec, Llc - In
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Intercontinental Cargo - intercontinentalcargo.com

Unread postby firefly » Mon May 10, 2021 6:38 pm

The same contact phone number +12194013093 was also used online by a fake delivery company pretending to be Intercontinental Cargo, active from the domain name intercontinentalcargo.com.

The fake courier was registered in August 2020 and the contact details were edited few times - this March the number shown on the website was the same as the one used by the fake supplier promising to deliver Corona vaccines.

From the fake website:

Founded in 1981 as a messenger company in the United States, Intercontinental Cargo has grown into a multi-Million-dollar corporation by clearly focusing on the goal of enabling commerce around the globe. Today, Intercontinental Cargo is a global company with one of the most recognized and admired brands in the world. We have become one of the world’s largest package delivery company and a leading global provider of specialized transportation and logistics services.


Initial contact details:

Head Office USA: 500 Griswold St, Detroit, MI 48226, United States
Belgium: Veldstraat 728500, kortrijk. Belgium
Austria: Lendpl. 248020 Gra, Austria
Czech Repubic: Horni 82700 30, Ostrava-jih
New zealand: 75 Beach Street, Queenstown 9300, New zealand
United Kingdom: Plough Yardshoreditch, London, UK
info@intercontinentalcargo.com
8045521412


+18045521412
Number billable as geographic number
Country or destination United States
City or exchange location Fife, VA
Original network provider* Bandwidth.com Clec, Llc - Va

Phone number and email address used until in March 2021:

cached.JPG




+12194013093 - same as above

Actual phone number used:

+12489340532
Number billable as mobile number
Country or destination United States
City or exchange location Pontiac, MI
Original network provider* New Cingular Wireless Pcs, Llc - Il

The company allegedly "founded in 1981" is active online since last year. USA seems to be in the Cameroon...

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145959.

From the domain name registration:

Domain Name: INTERCONTINENTALCARGO.COM
Updated Date: 2020-08-17
Creation Date: 2020-08-17
Registrar Registration Expiration Date: 2021-08-17
Registrar: Internet Domain Service BS Corp.
Reseller:
Domain Status: ok
Registry Registrant ID:
Registrant Name: Not disclosed Not disclosed
Registrant Organization: CCN&Technologies SARL
Registrant Street: 1525 Rue manguier, 12345
Registrant City: Yaounde
Registrant State/Province:
Registrant Postal Code: 00237
Registrant Country: CM
Registrant Phone: +237.699452593
Registrant Email: 6de71114248c316977561454acae6aad.gdrp@c ... cycorp.com

This is what the fake website looks like:

main.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

trustoursltd.com

Unread postby firefly » Mon May 10, 2021 6:42 pm

The same phone number +12194013093 was also used until April on yet another fake site pretending to be selling guns, named Trust Tour Weapons and using the fraudulent domain name trustoursltd.com:

cached1.JPG


WhatsApp: +1 (219) 401-3093
Email: info@trustoursltd.com


In the meantime, the fake website changed its offer from guns to drugs, becoming Xanax Academy while using the same contact details:

contact1.JPG


From the fake website:

Xanax Academy is a privately owned company that deals with the retailing of xanax products. Xanax is manufactured and marketed by Pfizer. Our connection gives us the opportunity to buy xanax in bulk and reselling to individual consumers and other retailers. Our existence is grounded in our commitment to fund programs that provide public benefit, advance medical care and improve patient outcomes.

(...)
Today, Xanax Academy serves more than 100+ markets and has a network of 9 dedicated manufacturing sites bringing quality and reliability.


The victims ordering from the fake website will receive the same Bitcoin wallet also reported above, given to pay for Corona vaccines: 1PmCG3GEucMPBV5AiameW9R3pTEyguyNHZ:

checkout1.JPG


Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=150374.

From the domain name registration:

Domain Name: TRUSTOURSLTD.COM
Updated Date: 2020-08-16
Creation Date: 2020-08-05
Registrar Registration Expiration Date: 2021-08-05
Registrar: Internet Domain Service BS Corp.
Reseller:

Registry Registrant ID: Not disclosed
Registrant Name: Not disclosed Not disclosed
Registrant Organization: CCN&Technologies SARL
Registrant Street: 1525 Rue manguier, 12345
Registrant City: Yaounde
Registrant Postal Code: 00237
Registrant Country: CM
Registrant Phone: +237.699452593
6de71114248c316977561454acae6aad.gdrp@c ... cycorp.com

This is what the fake website looks like:

main1.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

weedcally.com

Unread postby firefly » Mon May 10, 2021 6:55 pm

And again, the same phone number is used by a fake pharma pretending to sell medical marijuana:

contact2.JPG


When it was initially created, the fake website was using different contact details:

old.JPG


2201 W Temple St, Los Angeles, CA 90026, United States
+1 (515) 6087660
info@weedcally.com


+15156087660
Number billable as mobile number
Country or destination United States
City or exchange location Des Moines, IA
Original network provider* 365 Wireless, Llc

From the fake website:

We are not just your regular online cannabis dispensary, but rather, an institution. Founded on the belief that everyone should have access to medical and recreational marijuana, we provide only the best, most premium marijuana strains, concentrates, and edibles as well as the highest quality accessories. For us, marijuana is more than a business, it represents every principle we hold dear. The founders of Weedcally and their friends have been at the very forefront of the legalization movement, and this is why we strive hard to ensure that our customers receive nothing but the best.

(...)
A combined experience of 12 years in the industry, not only brokering top quality marijuana but also struggling for its legalization, means that no one else can come close. This experience is the driving force behind our network, ensuring that we stock and supply only the best product from producers worldwide. When ordering from us, you can rest easy in the knowledge that your weed has been carefully curated and graded by the best, most experienced team in the industry. After all, no one else can boast of 12 years of expertise.


Contact details:

Los Angeles, CA 90015,USA
+12194013093
info@weedcally.com


"After all, no one else can boast of 12 years of expertise" - anyone can, if they are scammers... the fake pharma was created a year ago.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145963.

From the domain name registration:

Domain Name: WEEDCALLY.COM
Updated Date: 2020-08-16
Creation Date: 2020-05-26
Registrar Registration Expiration Date: 2021-05-26
Registrar: Internet Domain Service BS Corp.
Reseller:

Domain Status: ok
Registry Registrant ID: Not disclosed
Registrant Name: Not disclosed Not disclosed
Registrant Organization: CCN&Technologies SARL
Registrant Street: 1525 Rue manguier, 12345
Registrant City: Yaounde
Registrant Postal Code: 00237
Registrant Country: CM
Registrant Phone: Not disclosed
Registrant Email: 6de71114248c316977561454acae6aad.gdrp@c ... cycorp.com

This is what the fake website looks like:

main2.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: info@ircogroupltd.com

Unread postby firefly » Mon May 10, 2021 7:07 pm

Email received from the fake supplier offering Corona vaccines for sale:

Hello,
Thanks for getting back to us. Please kindly use the following bank details to make your payment:

Bank name: first century bank
Address: 525 Federal Street Bluefield, WV-Bluefield, USA
Routing number: 061120084
Account number: 401893888xxxx
Beneficiary name: F. H.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: info@ircogroupltd.com

Unread postby firefly » Tue May 11, 2021 8:11 pm

Email received:

Dear xxx, thank you for your inquiry.

We usually ship boxes with vaccines via companies such as UPS and FedEx to locations around Europe. You will get a tracking number as soon as we register your package for delivery.
The company also plans to use a distribution center in Pleasant Prairie, Wisconsin.
What You Need To Know
Our vaccines will go out in specially-designed containers that contain two layers of dry ice and a temperature monitor
The boxes will be shipped by UPS and FedEx and monitored with multiple GPS tracking devices
Vaccine kits will be shipped out, and the vaccine doses could be shipped within 24 hours of FDA authorization
If you have more questions about our services, please kindly let us know. We look forward to hearing from you.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70851
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Next

Return to Fake sites/Phishing sites.

Who is online

Users browsing this forum: No registered users and 12 guests