Topic: Scam Alert : TimeToBit/timetobit.com Scammed 3.38 BTC (Read 15911 times)

Any news on this? It seems the BTC address isn't in use anymore?

As it seems to be connected to the LTCGear (hack) also...

Here's another one (100 BTC):
https://bitcointalk.org/index.php?topic=791367.0;all

Not sure how it is all connected but that addy.... 1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL   is involved in this mornings localbitcoins theft

What is happening is someone owns locolbiticoins.co m <------------ don't go there

But it is the first link on google.  If you log in from there, someone is watching so they immediately see your user name, password and your 2FA so they immediately sign in on the real site and robbing the entire lbc wallet then the coins are going to 1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL

Any info would be very helpful.

Here we can see the scammers at Black Arrow posting in a thread about adding a time-lock feature to the Bitcoin protocol. In it they claim their BTC was stolen and sent to the following address:



We suspect this is just an excuse to embezzle our money and that the convicted Romanian internet fraud artist Alexandru Ion Sovu (CEO of BA and the clown behind the BCT user blackarrow) is still in control of our BTC and the 1fsVc address.

If it's the case that 1fsVc doesn't belong to Alex then karma's a bitch motherfucker.

the question is how did someone even give 3.38 bitcoin.. to this site..

Recently my 1.05 BTC were stolen in BITTREX.

The end address of the wallet that were sent BTC (1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL)

Recalling that this happened after I use the BOT Quatloo trader.

I remember not I enabled the API KEY to make withdrawals and still managed to break into my account to sell all the coins and had to withdraw my BTC.

Sorry my english.

can everyone interested about some news about this address contact me via pm here? will send some new info

I lost 748.75 bitcoins on the 23rd of September 2014, most of which ended up at 1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL. I'm very interested to know who controls it. I suspect the hack resulted from the bash bug. Attack vectors could be from using the public wifi of Puri Dewa Bharata Hotel & Villas in Legian, Bali, Indonesia or an employee at Blizzard slipping in code into the update, as coins were moved very shortly after updating StarCraft II.

My set up was Bitcoin-QT unencrypted on Mac OS X 10.9.4.

https://blockchain.info/tx/7c67634b40d85ae08a6300a0f8613455d5d687772f9b982a11597418d805dd3d

Yes, I probably should have used cold storage or multi-sig. Facepalm.

What is this address where it ended up 1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL?

Well, I can clear this up right now: All those reviews were posted by me, the same day I posted the scam alert, here on this forum. 

After getting no replies from the site support, and happening to note reviews are getting posted to the home page unfiltered, I posted these using random first name-last name-email combinations, and a set of around 6 reviews, just to see if they would react..

If there's a link with India, please check on the following:

Anstele.com, registred by Prashant Powle, Mumbai India, +91.919322607034, [email protected]

This was hosted on the same server as TimeToBit:
192.64.118.151    -> server1.timetobit.com (ns1.timetobit.com)   

Not a lead, just a curiosity, from the spidering results I found the pending reviews (https://www.timetobit.com/starreviews/34eayghzrtdj56rtjsh/). Apparently the review system approval mechanism was unprotected. There are 157 pending reviews, all of which state the site is a scam. They seem to have be spammed since there is a lot of repetition on the review text and they were all done on the same day. Follows some examples:

- Leave immediately, and do not get scammed like I did.  No one answers support, no payout
- Do not throw your bitcoins down the drain of TimeToBit.  Once payment is received, they stop responding, and there are no payouts
- I made a terrible mistake joining TimeToBit, one of the biggest bitcoin scam ever.  Please do not lose your money too.  No payouts, no support
- (...)

Screenshot of the webpage http://i.cubeupload.com/m2AfU0.png

EDIT: Google Cache cached the page with some of the "it's a scam" reviews http://webcache.googleusercontent.com/search?q=cache%3Awww.timetobit.com&btnG=

Perhaps be carefull with what you download here. (not saying it's bad, i've no idea)

About the site, it's likely build by a freelancer since there are a lot of jobposts mentioning this:
Build a website similar to the following: Cloudhashing.com timetobit.com bitvestllc.com use weebly to build the site setup SEO etc.

https://www.google.nl/webhp?sourceid=chrome-instant&rlz=1C1DVCB_enNL430NL539&ion=1&espv=2&ie=UTF-8#q=Build+a+website+similar+to+the+following%3A+Cloudhashing.com+timetobit.com+bitvestllc.com+use+weebly+to+build+the+site+setup+SEO+etc.

I was wrong, the chat functionality isn't custom made.

sorry i was being a fool, just when it said your IP thought it was showing requesting IP (ie you)

No. It might have been used while registering timetobit.com.

It's probably a proxy. 

so that IP you posted is yours?

117.214.24.177 you located in india?

Your browser:   Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
Your ipadress:   117.214.24.177
Google pagerank:   No data av
Thumbnail:   
Dmoz Description:   
Dmoz Category:   
Alexa Links:   1
Alexa Rank:   3825324
Alexa Reach:   4739792
Alexa country   rank
Whois:   
Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Domain Name: TIMETOBIT.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.TIMETOBIT.COM
   Name Server: NS2.TIMETOBIT.COM
   Status: ok
   Updated Date: 20-jun-2014
   Creation Date: 20-jun-2014
   Expiration Date: 20-jun-2015

>>> Last update of whois database: Mon, 18 Aug 2014 18:52:49 UTC <<<


Domain Name: TIMETOBIT.COM
Registry Domain ID: 1863693159_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-06-20 15:05:55Z
Creation Date: 2014-06-20 22:05:00Z
Registrar Registration Expiration Date: 2015-06-20 22:05:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4252744500
Reseller: NAMECHEAP.COM
Domain Status: ok
Registry Registrant ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:
Admin Name: WHOISGUARD PROTECTED
Admin Organization: WHOISGUARD, INC.
Admin Street: P.O. BOX 0823-03411
Admin City: PANAMA
Admin State/Province: PANAMA
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID:
Tech Name: WHOISGUARD PROTECTED
Tech Organization: WHOISGUARD, INC.
Tech Street: P.O. BOX 0823-03411
Tech City: PANAMA
Tech State/Province: PANAMA
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: [email protected]
Name Server: NS1.TIMETOBIT.COM
Name Server: NS2.TIMETOBIT.COM
DNSSEC: unSigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
Last update of WHOIS database: 2014-06-20 15:05:55Z

can you dump the output of

http://mail.knows.nl/index.php?url=timetobit.com

I cant view blocked due to previous malware on that site.

found new IP, through http://mail.knows.nl/index.php?url=timetobit.com:

Your ipadress: 117.214.24.177

https://who.is/whois-ip/ip-address/117.214.24.177

No, as per http://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml

I have also been following a lead. I have made a local copy of the website (right before the site went down). The live chat functionality used in TimeToBit seems to be custom made because there isn't any copyright on it (javascripts, stylesheets, etc.) and there is a very limited set of sites using it (read, indexed by Google). I'm trying to find out who has developed the other sites and see if there is any match from what we already know.

The site archive can be downloaded here, http://www49.zippyshare.com/v/13484773/file.html You will need Burpsuite to open the file (http://portswigger.net/burp/download.html < free version will suffice). In Burpsuite, click "File" > "Restore State".

Translate this in english (posted 20 june in India):
https://sangkrit.net/hindi/%E0%A4%85%E0%A4%AC-%E0%A4%AC%E0%A4%BF%E0%A4%9F%E0%A4%95%E0%A5%8D%E0%A4%B5%E0%A4%BE%E0%A4%87%E0%A4%A8-%E0%A4%96%E0%A4%A8%E0%A4%A8-%E0%A4%A0%E0%A5%87%E0%A4%95%E0%A5%87-%E0%A4%AA%E0%A4%B0-%E0%A4%91/#more-79303

The entry on OpenCompany.co.uk shows "Bernhard Wellington" is the company director.  However, further search with the name did not lead to any more information than that shown in the page (https://www.opencompany.co.uk/company/SC480808/timetobit-limited)

There are some leads to be followed:

* if you lost BTC, please report to your local police department. They can get court orders to get information from Namecheap, Enom inc any other party involved.

* Opencompany.co.uk.
He has registred his timetobit company there, probably using false information but still. Im in contact with them. It might be worth it buying the 1 pound extra information document and post here.
 
* Avanta. He supposedly hired office space here, it's at 93-95 Hanover Street, Edinburgh as listed in the company registration. They have a telephone number and emailadress.
http://www.avanta.co.uk/UK/offices/business-centres-edinburgh

* Tonys-iMac.local.
This is where support email contacts came from (email headers). Some google searched lead me to Tony Horrocks, tonyhrx on twitter, who went to Edinburg and who published CiviCRM Cookbook with $Tonys-iMac.local (bash) in there. He owns web development company http://fabriko.co.uk. But be careful, its a very loose lead, so first find out before you take any action. The information might also be about multiple Tony Horrocks, I really don't know.

* What IP address did he use on this bitcointalk forum and bitcointa.lk?

* Anstele.com, hosted on the same server as time to bit:
192.64.118.151    -> server1.timetobit.com (ns1.timetobit.com)   (anstele.com, Prashant Powle, hosted on namecheap, domain by godaddy).
Whois information: Prashant Powle, Bhave House, Kale Marg, Bailbazar, Kurla West, Mumbai India, +91.919322607034, [email protected])
Seems unrelated, but it's the only other party who hosted on the same server.

But to get real answers, you need to get the phone and call call call

LXBGMiners, it is possible. Nothing is untraceable in this world.

Some Blockchain research on the scam:

I think most of the BTC is now here (last transaction just 2 hours ago, so he's busy moving the money  ):
https://blockchain.info/nl/address/1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL

It was previously on:
https://blockchain.info/nl/address/1JvAoBTTgF36Xj7gJkpfcNHsBA8tMSyfHb

This transaction for example, has five btc 0.47704704 payments, which was the price for the 150GH/s server that day.
https://blockchain.info/nl/tx/023f860b63e21e839cbd02bfefea238650df1e18e73abc68153c72bdaf6faa83

An interesting graph of the received payments:
https://blockchain.info/nl/charts/received-per-day?timespan=60days&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=1JvAoBTTgF36Xj7gJkpfcNHsBA8tMSyfHb

Whois means nothing to me private or not the whois can be faked using fake name etc

Indeed, the web site not responding. Below is the WHOIS DNS registry data for the domain.  Of course, it's a private.

   Domain Name: TIMETOBIT.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.TIMETOBIT.COM
   Name Server: NS2.TIMETOBIT.COM
   Status: ok
   Updated Date: 20-jun-2014
   Creation Date: 20-jun-2014
   Expiration Date: 20-jun-2015

Domain Name: TIMETOBIT.COM
Registry Domain ID: 1863693159_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-06-20 15:05:55Z
Creation Date: 2014-06-20 22:05:00Z
Registrar Registration Expiration Date: 2015-06-20 22:05:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4252744500
Reseller: NAMECHEAP.COM
Domain Status: ok
Registry Registrant ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:
Admin Name: WHOISGUARD PROTECTED
Admin Organization: WHOISGUARD, INC.
Admin Street: P.O. BOX 0823-03411
Admin City: PANAMA
Admin State/Province: PANAMA
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID:
Tech Name: WHOISGUARD PROTECTED
Tech Organization: WHOISGUARD, INC.
Tech Street: P.O. BOX 0823-03411
Tech City: PANAMA
Tech State/Province: PANAMA
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: [email protected]
Name Server: NS1.TIMETOBIT.COM
Name Server: NS2.TIMETOBIT.COM
DNSSEC: unSigned

I really doubt anyone will get a refund for it since the website is gone and you paid via bitcoins i am sorry for the scammed ppl

I got about $3.00 worth of payments before the payments got stuck in "pending" and the site disappeared. Quite the ROI right there. -_-

Their website hasn't been accessible since last night either.

Yes it was a scam, wave bye bye to your "investment"

Their website is down today and  I have not been paid since the 15th of August.

http://corporatedir.com/company/ans-telecom-immovations-private-limited

just use the same host it would seem.

Hi @,

I'll try to start a legal procedure asap. I'll have to wait for a few answers from authorities fighting against cyber crime.
Even if it will lead to anything, I'll try it.
I have made a request at cases.lu whom have transmitted my request to circl.lu
Depending on their answer ... we will see!

Checked one of these here:

http://sameip.net/ip192.64.118.152

finding:
Total: 3 domains hosted at 192.64.118.152
anstele.com
ns2.anstele.com
timetobit.com

checked anstele.com here: http://whois.domaintools.com/anstele.com
finding:
Domain Name: ANSTELE.COM
Registrar URL: http://www.godaddy.com
Registrant Name: Prashant Powle
Registrant Organization: Prashant Powle
Name Server: NS1.ANSTELE.COM
Name Server: NS2.ANSTELE.COM

I don't see relation between anstele and timetobit except for the 3 domains hosted on same IP.

Unfortunately, no I didn't I checked their address in Google Maps, and matched with http://www.avanta.co.uk/. BTCCat also arrived to the same conclusion (https://bitcointalksearch.org/topic/m.8423412.)

In fact: Were I running such a company I would make it abundantly clear up front on my website it welcomes any and all such Queries and could even provide the necessary information WITH links for a potential customer to VALIDATE for themselves !

If I was to contemplate ever doing this again I'd now have to not only check their Domain Record information against what's on their website (as far as possible) making sure to quiz the 'company' about any discrepancies BUT ALSO, and just as importantly IMO, run diagnostics on their email header information just to be certain!

Gosh, seriously ? Yes, emphatically Yes 100%

You've spoken to them yourself then ?

BTW just curious

Yes, the site is down, as I had expected it would be sooner or later.  The 'legit' company registration was probably a clever cover or decoy tactic.

I am concerned that this could form the template for a series of scams in the near future. 

A 'legit' company suddenly appears, starts to offers freebies and generates interest on forums, has a fairly well designed and legit-looking website. 
Accepts payment only by bitcoin, then, one day, 'poofff'... gone, just like that.  Too late, by the time you realise everything was just a cover for a clever scam!

I think, at least partly, it is the unique nature of bitcoin transactions makes such a scam possible. 

Hereafter, I would be extremely careful dealing with a site that "accepts payment only by bitcoin"!

Some more info, two IP addresses:

- 192.64.118.151
- 192.64.118.152

These servers are registered as ns1.timetobit.com and ns2.timetobit.com respectively in the whois. From the e-Mail headers we can also get server1.timetobit.com (same IP as ns1.timetobit.com). Couldn't find any running service on those servers though.

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

Looks as timetobit site is taken down now.

I also have a mining plan at bitcoincloudservices which works perfectly until now ...
Started 1. of July and payout are accurate ever day.
I even got contacted by e-mail an even called by phone when I wanted to change my payout address.

this mining plan works well for one month an a half now ... even respecting the rise of difficulty

for this company you can find on the internet site an address, a phone number and so on ...

if anyone is interested here is my referral URL: https://www.bitcoincloudservices.com/?ref=2249

so far, I'll not invest in any other mining plan until ROI starts for the one I have! :-)

I'll keep you informed about that one as well!

No problem BTCat, one always needs to be carefull when it comes to internet communication.

For your info, I already send an e-mail to www.cases.lu and asked how to handle this and what do to ...
I'll keep you informed!

Regards,

Hi LXBGMiners,

Sorry about your loss and for probably having been right at your first posts in the plan-give-away section. I gave you some doubt over this but I wanted to stay objective.

Around 8 aug. my payments (for 150 ghs) were "pending" for 3 days after which it got paid for 3 days all at once and it continued until 15th. It's still possible that payments will be made but the longer it takes the less likely it becomes. Also having seen their listed address on a possible virtual office space raised doubts for them being legit.  

If and/or when this is a confirmed scam I hope the people behind it get caught. At least good to see forensic brings up some info's.

Goodluck.  

ps also found some review here of Timetobit:
http://btcworldnews.com/bitcoin-mining-for-beginners-part-i-cloud-mining/

Thanks mlnoone, I'll keep everybody informed if I get more information!

Good luck to you LXBGMiners - I hope your investigations will lead to at least some positive result!

Hi mlnoone,

I'm trying to invesitgate, www.cases.lu what can be done in such a case!
I'll keep this tread informed about what they'll tell me!

Dear LXBGMiners,

I found these instructions on the RIPE site:



You might consider using the above format to write a convincing email to [email protected], requesting help from him to give leads for recovering the loss - that is, unless you have already done it!

Dear LXBGMiners,

Very sorry to hear about the huge loss you have incurred.
 
I am wondering of the scammer's evil genius to have made this really clever scam. I am sure there are may more who have already fallen prey.

I think there is nothing much that can be done, but write to [email protected] reporting abuse form the IP address 95.143.193.61, though I have no idea what he could do.

If there are any Swedish contacts, I wonder - could we push for an official investigation or legal proceedings?

Hi guys,

I'm the 'idiot' who invested into a 10TH/s plan (more or less 23BTC) ...
is there a way I can help?
I found the same IP (95.143.193.61) and all the same information already mentioned in these posts!

From the RIPE Facebook page:
So when I entered 95.143.193.61 in the Abuse Contact Finder, the email address that came up was:

Abuse Contact Finder (95.143.193.61)

Email-Contact
 [email protected]

This contact can be used to report abuse.

I am sending an email to Peter, thank you odlal for helping to lead upto this!

There's always RIPE NCC's Facebook and Twitter pages to contact them through :

https://www.facebook.com/ripencc/info

https://twitter.com/RIPE_NCC

I can't imagine them NOT having heard of this sort of thing going on before today through THEIR network !

BTW how on Earth did you make that connection ?

Almost !

Timetobit appear to skip past CoinTerra's use of section : 16. Dispute Resolution And Binding Arbitration

and they also don't have an end section about a "PAYMENT PLAN AGREEMENT" like CoinTerra do.

--- VERY SIMILAR THOUGH ---

Checked out the site betarigs.com, it looks rather ok, their discussion thread on this forum also does not indicate any specific accusations regarding scamming activity...  

Paolo Fanton looks like a tech contact.

I'm just wondering now how many bitcoins the creep 'Tony' could have collected by now through his fake cloud mining contracts.. I hope he catches no more fish from this site, but the open and irreversible nature of bitcoin transactions make such scams a constant threat.

Has been a hard lesson to learn!

check this

https://www.timetobit.com/terms-of-use

compare to

http://mining.cointerra.com/sales-agreement/

copy pasta.

Sure - but surely they must've heard from UNHAPPY people before today about what seems to be happening right under their noses ? Don't they have a (legal) responsibility to sort it out ?

The [email protected] and also Paolo are just tech contacts at the hosting company.

Paolo Fanton also comes up here

http://blogs.msmvps.com/spywaresucks/2010/05/29/alert-please-treat-tuned-ads-tunedads-com-barkley-davis-advertising-barkleydavis-com-awemedia-awemedia-net-and-moksly-digital-ad/

From FOUR years ago and to do with Malware !

Looks like Timetobit may not be the only Scam running through there :

http://www.janvanriebeeck.redskillz.nl/index.php?url=betarigs.com

The above link came up in a Google Search : https://www.google.co.uk/?gws_rd=ssl#q=PAOLO+FANTON+sweden+email&safe=off

I would not now be surprised if Paolo Fanton is purely a fictitious name ...

I wonder - is there by chance anybody from Sweden, near abouts Gavleborgs Lan, Hudiksvall, in this forum who can help with this in any way - or give some pointers?

I love how the website just keeps counting up/down


Also the main image is stolen

used here

http://pmhis.net/dedicated_servers.php

also

http://www.fnbg.co.uk/business-server-hosting-scotland.html

RIPE allocated that block to a service provider, they can tell yu anymore than all the public info in the ripe database.

You would need the hosting/colo to spill the beans on that hosted IP.

I've sent an email to RIPE pointing them to this thread and asking if they would share any information they have about IP address 95.143.193.61

Try him, probably bit late in the day now.

But could he point to who is ?

Imagining a Phone Call, to +4665010000

"Hello..?"
...
"Do you run bitcoin scams?"
...
"Do you know who Tony is?"
...

From https://apps.db.ripe.net/search/

I entered 95.143.193.61

And got this :

inetnum:         95.143.193.1 - 95.143.194.224
netname:         serverconnect-dedicateserver-net
descr:           Abuse-mailbox: [email protected]
country:         se
admin-c:         PF776-RIPE
tech-c:          PF776-RIPE
status:          ASSIGNED PA
mnt-by:          MNT-SERVERCONNECT
source:          RIPE # Filtered


person:          PAOLO FANTON
address:         SJOTULLSGATAN 16
address:         Hudiksvall
address:         824 50
address:         SWEDEN
phone:           +46 65010000
fax-no:          +46 650601024
nic-hdl:         PF776-RIPE
source:          RIPE # Filtered
mnt-by:          MNT-SERVERCONNECT


route:           95.143.192.0/20
descr:           INTERNETPORT AB -BL
origin:          AS49770
mnt-by:          MNT-SERVERCONNECT
source:          RIPE # Filtered



Information also available here : http://www.tcpiputils.com/browse/ip-address/95.143.193.61

Quite possibly yes - you too have been scammed. 

Looked pretty legit didn't it?  Same here!

Yup - that seems to be the guy running this site.

Somewhere in Sweden.

Possible goes by the name 'Tony'

And he's got all our bitcoins!

I don't know if this means anything but I ran a trace on the IP address here : http://network-tools.com/default.asp?prog=trace&host=95.143.193.61

95.143.193.61 is from Sweden(SE) in region Scandinavia

TraceRoute from Network-Tools.com to 95.143.193.61
Hop   (ms)   (ms)   (ms)           IP Address   Host name
1      Timed out      Timed out      Timed out             -  
2      164      162      149         4.69.146.1    vl-3501-ve-115.csw1.dallas1.level3.net  
3      149      149      149         4.69.151.134    ae-63-63.ebr3.dallas1.level3.net  
4      Timed out      Timed out      Timed out             -  
5      149      149      149         4.69.132.86    ae-2-2.ebr1.washington1.level3.net  
6      155      160      157         4.69.134.138    ae-81-81.csw3.washington1.level3.net  
7      150      150      150         4.69.134.153    ae-82-82.ebr2.washington1.level3.net  
8      Timed out      Timed out      Timed out             -  
9      151      150      150         4.69.143.133    ae-45-45.ebr1.frankfurt1.level3.net  
10      Timed out      Timed out      Timed out             -  
11      148      148      148         4.69.163.9    ae-83-83.ebr3.frankfurt1.level3.net  
12      Timed out      Timed out      Timed out             -  
13      Timed out      Timed out      Timed out             -  
14      150      150      150         4.69.202.34    ae-118-3504.edge3.stockholm2.level3.net  
15      150      150      150         212.73.250.138     -  
16      149      157      149         62.109.44.154     -  
17      150      Timed out      150         62.109.44.158    sejar0001-rc5.ip-only.net  
18      156      150      151         213.132.112.82    sesto0001-rc3.ip-only.net  
19      Timed out      Timed out      Timed out             -  
20      149      149      148         95.143.207.230     -  
21      147      148      147         95.143.193.61     -  
Trace complete

--------------------------------------------------------------------------------

And then ran this http://myip.ms/info/whois/95.143.207.230 based upon the address at Hop number 20 above, the penultimate step in the list which gave this :

Whois IP Live Results for 95.143.207.230 -

IP Location:   Sweden,    Gavleborgs Lan,    Hudiksvall
IP Reverse DNS (Host):   95.143.207.230
IP Owner:    Internetport Sweden Ab
Owner IP Range:   95.143.192.0 - 95.143.207.255    (4,096 ip)    
Other Sites on IP »
Owner Address:   Internetport Sweden Ab, Peter Forslund, Sjotullsgatan 16, 824 50, Hudiksvall, Sweden
Owner Country:   Sweden
Owner Phone:   +4665010000
Owner CIDR:   95.143.192.0/20



--------------------------------------------------------------------------------

95.143.207.230 points to :

https://www.ripe.net/membership/indices/data/se.serverconnect.html

The Réseaux IP Européens Network Coordination Centre (RIPE NCC) is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in its service region.

The most prominent activity of the RIPE NCC is to act as the Regional Internet Registry (RIR) providing global Internet resources and related services (IPv4, IPv6 and AS Number resources) to members in the RIPE NCC service region.

Internetport Sweden AB
Internetport Sweden AB
Sjotullsgatan 16
824 50 HUDIKSVALL
SWEDEN
phone:   +4665010000
fax:  +46650601024
e-mail:  peter (at) serverconnect (dot) se
Areas serviced:   SE

it seems that the IP in the email is listed as a peer here.


not sure that that means if anything.


Also

I've got 4 payments still "pending". Wondering if I've been scammed too.

So we have a name


Doh it see its been mentioned already

Thanks again, I had tried tracing the email using the header - and it was located as sent from Sweden:

IP address :   
95.143.193.61

IP number :   1603256637
Country :   Sweden  flag
Region:   
City (Estimate) :   
Latitude :   62° 0' North
Longitude :   15° 0' East
Time Zone :   W. Europe Daylight Time
GMT Offset :   02:00:00


I can now see Sweden mentioned in the Lunamine thread also.  Is something going on there!?

These are the headers, if any one would like to examine them further:

Received: from [95.143.193.61] (port=56958 helo=Tonys-iMac.local)

So  'Claire | Sales' was writing from "Tony's iMac", from a Swedish IP, on behalf of TimeToBit - in Scotland?!

ping www.timetobit.com

Pinging timetobit.com [192.64.118.152] with 32 bytes of data:
Reply from 192.64.118.152: bytes=32 time=145ms TTL=46
Reply from 192.64.118.152: bytes=32 time=145ms TTL=46
Reply from 192.64.118.152: bytes=32 time=146ms TTL=46
Reply from 192.64.118.152: bytes=32 time=147ms TTL=46

Ping statistics for 192.64.118.152:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 145ms, Maximum = 147ms, Average = 145ms

-------------------------------------------------------------

http://tejji.com/ip/ip-to-location.aspx?ip=192.64.118.152

Geographic Location & Characteristics
IP address :   192.64.118.152

IP number :   3225450136
Country :   United States  flag
Region:   California
City (Estimate) :   Los Angeles
Latitude :   34° 2' North
Longitude :   118° 26' West
Time Zone :   Pacific Daylight Time
GMT Offset :   -07:00:00
Lookup IPs :   192.64.118.*
Lookup IPv6 :   0000:0000:0000:0000:0000:ffff:c040:*
IPv6 (Short) :   ::ffff:c040:7698
IPv6 (Long) :   0000:0000:0000:0000:0000:ffff:c040:7698

-------------------------------------------------------------

http://www.ip-tracker.org/check/internet-speed.php?ip=192.64.118.152

IP Address:      192.64.118.152
Hostname:      anstele.com
ISP:            Namecheap
Organization:   Namecheap

Perhaps you could have a look at the "Headers" of your latest email from "Claire" because it'll contain some IP addresses which can be looked up for a physical location here : http://tejji.com/ip/ip-to-location.aspx?ip=46.228.38.200

EDIT : For example have a look at this message regarding Lunamine and their email headers : https://bitcointalksearch.org/topic/m.8354422

EDIT2: If you're able to post here a REDACTED copy of the email header I'm sure there's some Network Techy type people who could look into this a bit further

Thanks a lot for finding their information, I too had found their entry on opencompany.com, indicating their legality.

However:

• they do not mention a phone number on their site
• the 'Live Chat' always offline,
• they have disappeared from this forum and twitter.

I actually managed to get an email reply from them, it was sent from a time zone corresponding to Sweden, when I sent them the link of an earlier scam accusation from this very forum (https://bitcointa.lk/threads/timetobit-free-mining-plan-giveaways-round-2.336005/page-6), posing as a new user who is considering buying a contract:


This was the last communication I received from them.  

They never responded when I wrote from the email ID I used to sign up - a few minutes later on the same day that I got this reply.

From : https://www.opencompany.co.uk/company/SC480808/timetobit-limited

Company Name:      Timetobit Limited
Company Number:   SC480808
Registered Address:   93-95 Hanover Street, Edinburgh, EH2 1DJ

----------------------------------------------------------------------------

From : Companies House search at http://wck2.companieshouse.gov.uk//wcframe?name=accessCompanyInfo

Current Appointments
Number of current appointments: 1

DIRECTOR:         WELLINGTON, BERNHARD    

Appointed:         25/06/2014   
Date of Birth:      03/05/1979
Nationality:         BRITISH   

No. of Appointments:   1   

Address:         93-95 HANOVER ST., EDINBURGH, UNITED KINGDOM, EH2 1DJ   

Country/State of Residence:   UNITED KINGDOM   

----------------------------------------------------------------------------

From : http://www.avanta.co.uk/UK/offices/business-centres-edinburgh

Business Centre Edinburgh

93-95 Hanover Street, Edinburgh, UK EH2 1DJ

Avanta’s Hanover Street Business Centre is situated in the heart of Edinburgh’s historic New Town, just a few moment’s walk from Princes Street. Behind the elegant Georgian façade you will find a highly equipped, contemporary business centre that provides the ideal office let in Edinburgh.

Telephone: +44 (0)870 875 1921

----------------------------------------------------------------------------

Give them a call perhaps because they do seem to be a legally setup company ?

What happened::
I ordered a 'cloud mining contract'  for 1 TH/s for 3.38btc on 15/8/2014 from this site, but they payouts remain as pending and the customer support does not respond to email, and their 'Live Chat' is always offline.

Scammers Profile Link: https://bitcointalksearch.org/user/timetobit-348062

Reference Link: http://www.timetobit.com
Amount Scammed:3.38btc
Payment Method: bitcoin
Proof of Payment: https://blockchain.info/tx/5a7de5462f40e24b9b74b1d07c3427cec89791378392c2b5213d45f1ad018337
Additional Notes: Do not buy cloud mining contracts from timetobit.com