Topic: Scam Alert : TimeToBit/timetobit.com Scammed 3.38 BTC - page 4. (Read 15850 times)

I wonder - is there by chance anybody from Sweden, near abouts Gavleborgs Lan, Hudiksvall, in this forum who can help with this in any way - or give some pointers?

I love how the website just keeps counting up/down


Also the main image is stolen

used here

http://pmhis.net/dedicated_servers.php

also

http://www.fnbg.co.uk/business-server-hosting-scotland.html

RIPE allocated that block to a service provider, they can tell yu anymore than all the public info in the ripe database.

You would need the hosting/colo to spill the beans on that hosted IP.

I've sent an email to RIPE pointing them to this thread and asking if they would share any information they have about IP address 95.143.193.61

Try him, probably bit late in the day now.

But could he point to who is ?

Imagining a Phone Call, to +4665010000

"Hello..?"
...
"Do you run bitcoin scams?"
...
"Do you know who Tony is?"
...

From https://apps.db.ripe.net/search/

I entered 95.143.193.61

And got this :

inetnum:         95.143.193.1 - 95.143.194.224
netname:         serverconnect-dedicateserver-net
descr:           Abuse-mailbox: [email protected]
country:         se
admin-c:         PF776-RIPE
tech-c:          PF776-RIPE
status:          ASSIGNED PA
mnt-by:          MNT-SERVERCONNECT
source:          RIPE # Filtered


person:          PAOLO FANTON
address:         SJOTULLSGATAN 16
address:         Hudiksvall
address:         824 50
address:         SWEDEN
phone:           +46 65010000
fax-no:          +46 650601024
nic-hdl:         PF776-RIPE
source:          RIPE # Filtered
mnt-by:          MNT-SERVERCONNECT


route:           95.143.192.0/20
descr:           INTERNETPORT AB -BL
origin:          AS49770
mnt-by:          MNT-SERVERCONNECT
source:          RIPE # Filtered



Information also available here : http://www.tcpiputils.com/browse/ip-address/95.143.193.61

Quite possibly yes - you too have been scammed. 

Looked pretty legit didn't it?  Same here!

Yup - that seems to be the guy running this site.

Somewhere in Sweden.

Possible goes by the name 'Tony'

And he's got all our bitcoins!

I don't know if this means anything but I ran a trace on the IP address here : http://network-tools.com/default.asp?prog=trace&host=95.143.193.61

95.143.193.61 is from Sweden(SE) in region Scandinavia

TraceRoute from Network-Tools.com to 95.143.193.61
Hop   (ms)   (ms)   (ms)           IP Address   Host name
1      Timed out      Timed out      Timed out             -  
2      164      162      149         4.69.146.1    vl-3501-ve-115.csw1.dallas1.level3.net  
3      149      149      149         4.69.151.134    ae-63-63.ebr3.dallas1.level3.net  
4      Timed out      Timed out      Timed out             -  
5      149      149      149         4.69.132.86    ae-2-2.ebr1.washington1.level3.net  
6      155      160      157         4.69.134.138    ae-81-81.csw3.washington1.level3.net  
7      150      150      150         4.69.134.153    ae-82-82.ebr2.washington1.level3.net  
8      Timed out      Timed out      Timed out             -  
9      151      150      150         4.69.143.133    ae-45-45.ebr1.frankfurt1.level3.net  
10      Timed out      Timed out      Timed out             -  
11      148      148      148         4.69.163.9    ae-83-83.ebr3.frankfurt1.level3.net  
12      Timed out      Timed out      Timed out             -  
13      Timed out      Timed out      Timed out             -  
14      150      150      150         4.69.202.34    ae-118-3504.edge3.stockholm2.level3.net  
15      150      150      150         212.73.250.138     -  
16      149      157      149         62.109.44.154     -  
17      150      Timed out      150         62.109.44.158    sejar0001-rc5.ip-only.net  
18      156      150      151         213.132.112.82    sesto0001-rc3.ip-only.net  
19      Timed out      Timed out      Timed out             -  
20      149      149      148         95.143.207.230     -  
21      147      148      147         95.143.193.61     -  
Trace complete

--------------------------------------------------------------------------------

And then ran this http://myip.ms/info/whois/95.143.207.230 based upon the address at Hop number 20 above, the penultimate step in the list which gave this :

Whois IP Live Results for 95.143.207.230 -

IP Location:   Sweden,    Gavleborgs Lan,    Hudiksvall
IP Reverse DNS (Host):   95.143.207.230
IP Owner:    Internetport Sweden Ab
Owner IP Range:   95.143.192.0 - 95.143.207.255    (4,096 ip)    
Other Sites on IP »
Owner Address:   Internetport Sweden Ab, Peter Forslund, Sjotullsgatan 16, 824 50, Hudiksvall, Sweden
Owner Country:   Sweden
Owner Phone:   +4665010000
Owner CIDR:   95.143.192.0/20



--------------------------------------------------------------------------------

95.143.207.230 points to :

https://www.ripe.net/membership/indices/data/se.serverconnect.html

The Réseaux IP Européens Network Coordination Centre (RIPE NCC) is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in its service region.

The most prominent activity of the RIPE NCC is to act as the Regional Internet Registry (RIR) providing global Internet resources and related services (IPv4, IPv6 and AS Number resources) to members in the RIPE NCC service region.

Internetport Sweden AB
Internetport Sweden AB
Sjotullsgatan 16
824 50 HUDIKSVALL
SWEDEN
phone:   +4665010000
fax:  +46650601024
e-mail:  peter (at) serverconnect (dot) se
Areas serviced:   SE

it seems that the IP in the email is listed as a peer here.


not sure that that means if anything.


Also

I've got 4 payments still "pending". Wondering if I've been scammed too.

So we have a name


Doh it see its been mentioned already

Thanks again, I had tried tracing the email using the header - and it was located as sent from Sweden:

IP address :   
95.143.193.61

IP number :   1603256637
Country :   Sweden  flag
Region:   
City (Estimate) :   
Latitude :   62° 0' North
Longitude :   15° 0' East
Time Zone :   W. Europe Daylight Time
GMT Offset :   02:00:00


I can now see Sweden mentioned in the Lunamine thread also.  Is something going on there!?

These are the headers, if any one would like to examine them further:

Received: from [95.143.193.61] (port=56958 helo=Tonys-iMac.local)

So  'Claire | Sales' was writing from "Tony's iMac", from a Swedish IP, on behalf of TimeToBit - in Scotland?!

ping www.timetobit.com

Pinging timetobit.com [192.64.118.152] with 32 bytes of data:
Reply from 192.64.118.152: bytes=32 time=145ms TTL=46
Reply from 192.64.118.152: bytes=32 time=145ms TTL=46
Reply from 192.64.118.152: bytes=32 time=146ms TTL=46
Reply from 192.64.118.152: bytes=32 time=147ms TTL=46

Ping statistics for 192.64.118.152:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 145ms, Maximum = 147ms, Average = 145ms

-------------------------------------------------------------

http://tejji.com/ip/ip-to-location.aspx?ip=192.64.118.152

Geographic Location & Characteristics
IP address :   192.64.118.152

IP number :   3225450136
Country :   United States  flag
Region:   California
City (Estimate) :   Los Angeles
Latitude :   34° 2' North
Longitude :   118° 26' West
Time Zone :   Pacific Daylight Time
GMT Offset :   -07:00:00
Lookup IPs :   192.64.118.*
Lookup IPv6 :   0000:0000:0000:0000:0000:ffff:c040:*
IPv6 (Short) :   ::ffff:c040:7698
IPv6 (Long) :   0000:0000:0000:0000:0000:ffff:c040:7698

-------------------------------------------------------------

http://www.ip-tracker.org/check/internet-speed.php?ip=192.64.118.152

IP Address:      192.64.118.152
Hostname:      anstele.com
ISP:            Namecheap
Organization:   Namecheap

Perhaps you could have a look at the "Headers" of your latest email from "Claire" because it'll contain some IP addresses which can be looked up for a physical location here : http://tejji.com/ip/ip-to-location.aspx?ip=46.228.38.200

EDIT : For example have a look at this message regarding Lunamine and their email headers : https://bitcointalksearch.org/topic/m.8354422

EDIT2: If you're able to post here a REDACTED copy of the email header I'm sure there's some Network Techy type people who could look into this a bit further

Thanks a lot for finding their information, I too had found their entry on opencompany.com, indicating their legality.

However:

• they do not mention a phone number on their site
• the 'Live Chat' always offline,
• they have disappeared from this forum and twitter.

I actually managed to get an email reply from them, it was sent from a time zone corresponding to Sweden, when I sent them the link of an earlier scam accusation from this very forum (https://bitcointa.lk/threads/timetobit-free-mining-plan-giveaways-round-2.336005/page-6), posing as a new user who is considering buying a contract:


This was the last communication I received from them.  

They never responded when I wrote from the email ID I used to sign up - a few minutes later on the same day that I got this reply.

From : https://www.opencompany.co.uk/company/SC480808/timetobit-limited

Company Name:      Timetobit Limited
Company Number:   SC480808
Registered Address:   93-95 Hanover Street, Edinburgh, EH2 1DJ

----------------------------------------------------------------------------

From : Companies House search at http://wck2.companieshouse.gov.uk//wcframe?name=accessCompanyInfo

Current Appointments
Number of current appointments: 1

DIRECTOR:         WELLINGTON, BERNHARD    

Appointed:         25/06/2014   
Date of Birth:      03/05/1979
Nationality:         BRITISH   

No. of Appointments:   1   

Address:         93-95 HANOVER ST., EDINBURGH, UNITED KINGDOM, EH2 1DJ   

Country/State of Residence:   UNITED KINGDOM   

----------------------------------------------------------------------------

From : http://www.avanta.co.uk/UK/offices/business-centres-edinburgh

Business Centre Edinburgh

93-95 Hanover Street, Edinburgh, UK EH2 1DJ

Avanta’s Hanover Street Business Centre is situated in the heart of Edinburgh’s historic New Town, just a few moment’s walk from Princes Street. Behind the elegant Georgian façade you will find a highly equipped, contemporary business centre that provides the ideal office let in Edinburgh.

Telephone: +44 (0)870 875 1921

----------------------------------------------------------------------------

Give them a call perhaps because they do seem to be a legally setup company ?