• METRO Cash Carry (metro-credit.biz, 2005-07-14)
  
• "Arkolaptops.com / Arco-laptops.com" [2004-11-23]
  
• "skytech-computers.com / skytech-inc.com" [2005-01-21]
  
• "pc-homebiz.com" [2004-12-19]
  

"metro-credit.biz", "syktech-computers.com", "skytech-inc.com", "pc-homebiz.com", "trade-stone.com" and "lescaro.com" are websites set up by criminals who take orders for non-existent computers and defraud buyers who send them cash. Payments by Western Union (the preferred mode of payment in these scams) are untraceable. The websites are register with fake details. Domain "arkolaptops.com" may be part of the same scam. There are many similarites.

The spam evidence:

From: "Luke Delgado" <edouard@absolutemotion.com>
To: <emailaddress>
Sent: Thursday, 20 January, 2005 23:40
Subject: Looking for cheap high-quality notebook?__1007


Hi Gladys :)
http://www.skytech-computers.com/index.htm
reqards,
Annalise Vega

Received: from dyn-83-157-176-192.ppp.tiscali.fr
 (dyn-83-157-176-192.ppp.tiscali.fr [83.157.176.192])
	by lime.pobox.com (Postfix) with SMTP id 5F5C4108E7A
	for <emailaddress>; Thu, 20 Jan 2005 13:17:00 -0500 (EST)
Message-ID: <651c01c4fefd$10580bae$d16ff744@absolutemotion.com>
From: Luke Delgado 
To: emailaddress
Subject:
 =?iso-8859-1?B?TG9va2luZyBmb3IgY2hlYXAgaGlnaC1xdWFsaXR5IG5vdGVib29rP19fMTAwNw==?=
Date: Thu, 20 Jan 2005 14:40:21 +0000
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----=_NextPart_000_0000_87392201.632D8701"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-SpamScore: 1.438
	tests= DATE_IN_PAST_03_06 EXTRA_MPART_TYPE

What's wrong with this picture?

• The business advertised via spam, a red flag as far as ethics are concerned. It was sent from a DSL account in France.
• The head office is supposed to be in Latvia (an EU member). However, the only phone or fax numbers listed on their website (http://www.skytech-computers.com/contacts.htm) are supposed to be for the Moscow office.
• The domain is registered to a bogus streed address in Germany
• Even though their website claims that Skytech Computers is a 10 year old company, the domain skytech-computers.com was only registered on 2005-01-13, just one week before the spam was sent.
• The company offers free shipping worldwide. This is not economically viable, if they actually ship anything and the goods are not stolen merchandise.
• The company offers a worldwide warranty with with onsite support. Excuse me? Are they going to send support engineers to Falluja? Sounds too good to be true.

Domain Name : skytech-computers.com

::Registrant::
	Name      : Skytech Computers
	Email     : reg@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Administrative Contact::
	Name      : Skytech Computers
	Email     : adm@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Technical Contact::
	Name      : Skytech Computers
	Email     : tech@skytech-computers.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Name Servers::
	dns1.skytech-computers.com
	dns2.skytech-computers.com

::Dates & Status::
	Created Date   2005-01-13 06:52:09 EST
	Updated Date   2005-01-13 06:52:09 EST
	Valid Date     2006-01-13 06:52:09 EST
	Status         ACTIVE

Domain Name : skytech-inc.com

::Registrant::
	Name      : Skytech Inc.
	Email     : reg@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Administrative Contact::
	Name      : Skytech Inc.
	Email     : adm@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Technical Contact::
	Name      : Skytech Inc.
	Email     : tech@bp-dns.com
	Address   : Wandersmann str., A66
	Zipcode   : 65205
	Nation    : DE
	Tel       : +0611-718300
	Fax       : +0611-718300

::Name Servers::
	dns1.skytech-inc.com
	dns2.skytech-inc.com

::Dates & Status::
	Created Date   2005-01-21 11:14:18 EST
	Updated Date   2005-01-21 11:14:18 EST
	Valid Date     2006-01-21 11:14:18 EST
	Status         ACTIVE

METRO Cash Carry (metro-credit.biz)

This scam site is a re-run of the "SkyTech Inc" (sky-t.biz) and "Tradestone Corporation" (pc-home.biz) scams. It was advertised via another website (cpucat.com), which in turn was advertised in fake online service signup emails.

The domain "metro-credit.biz" is recently registered (2005-07-14) using a probably fake address in the USA, even though the company claims to be based in Moscow, Russia and to have been founded in 1994.

Payment is by Western Union only, which should be a read flag for any online store, as it provides absolutely no protection for the buyer. The "secured by Thawte" button on the home page doesn't work. Even though it says "click to verify" it isn't a hyperlink. When opening the website using an SSL connection it uses a certificate issued to a different website (mmm1911.dulles19-verio.com). In other words, the site pretends to have valid security certificates, but it's all fake.

Contact details from the website:

Head office address

METRO Cash Carry
Moscow
RUSSIA
Toll Free Phone: +1 (888) 820-5401
International Phone: +1 (973) 582-3765
Fax: +1 (973) 556-1087
E-Mail: Contact@metro-credit.biz


Postal address

METRO Cash Carry
P.O. Box 104
Moscow
RUSSIA 293045

WHOIS details for domain "metro-credit.biz":

Request: metro-credit.biz
connected to whois.neulevel.biz [209.173.53.169:43] ... 
Domain Name:                                 METRO-CREDIT.BIZ
Domain ID:                                   D10363505-BIZ
Sponsoring Registrar:                        IHOLDINGS.COM, INC. D/B/A DOTREGISTRAR.COM
Sponsoring Registrar IANA ID:                121
Domain Status:                               clientTransferProhibited
Registrant ID:                               1219629-R
Registrant Name:                             wanda henson
Registrant Address1:                         120 mill knob mtn
Registrant City:                             otto
Registrant State/Province:                   US
Registrant Postal Code:                      28763
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +00.1919640853
Registrant Email:                            Wannhelssink@aol.com
Administrative Contact ID:                   1219629-A
Administrative Contact Name:                 henson wanda
Administrative Contact Address1:             120 mill knob mtn
Administrative Contact City:                 otto
Administrative Contact State/Province:       US
Administrative Contact Postal Code:          28763
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +00.1919640853
Administrative Contact Email:                Wannhelssink@aol.com
Billing Contact ID:                          1219629-B
Billing Contact Name:                        wanda henson
Billing Contact Address1:                    120 mill knob mtn
Billing Contact City:                        otto
Billing Contact State/Province:              US
Billing Contact Postal Code:                 28763
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +00.1919640853
Billing Contact Email:                       Wannhelssink@aol.com
Technical Contact ID:                        1219629-T
Technical Contact Name:                      wanda henson
Technical Contact Address1:                  120 mill knob mtn
Technical Contact City:                      otto
Technical Contact State/Province:            US
Technical Contact Postal Code:               28763
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +00.1919640853
Technical Contact Email:                     Wannhelssink@aol.com
Name Server:                                 NS1.EURODNS.COM
Name Server:                                 NS2.EURODNS.COM
Created by Registrar:                        IHOLDINGS.COM, INC. D/B/A DOTREGISTRAR.COM
Last Updated by Registrar:                   IHOLDINGS.COM, INC. D/B/A DOTREGISTRAR.COM
Domain Registration Date:                    Thu Jul 14 05:50:57 GMT 2005
Domain Expiration Date:                      Fri Jul 13 23:59:59 GMT 2007
Domain Last Updated Date:                    Thu Jul 14 06:02:17 GMT 2005