Staminus and a fake company continued

Today’s response from Staminus:

""I can only ask you to investigate because there are serious doubts this is a legitimate website."

Investigator : a person, persons or entity who is qualified to and tasked with investigation. e.g. Policeman or law enforcement.

Law Enforcement: a body that can investigate and gather evidence to be used in a court of law for prosecutions.

ISP : a company that provides internet services and is generally is unqualified and unlicensed to conduct legal investigations or provide chain of custody for evidence necessary for a trial.

**

Therein lies the source of your problem. Now that I understand, I can probably be of some assistance to you.

Not dissimilar to grabbing a random used car salesman and putting them in charge of designing and building nuclear bombs, you have been focusing on getting the wrong group/individual(s) to do your investigation for you.

I encourage you to contact your local law enforcement office. They are qualified, licensed and certified to conduct legal investigations, collect legal evidence, track chain of custody for said evidence, and then provide said evidence to a prosecutor. If they determine that they require additional information, they will contact us directly via established channels.

By following this procedure, criminals can be investigated, charged, tried and convicted.

By following your procedure, at best, criminals would have their services briefly interrupted while they relocate to another host - possibly even within the same data center / ISP.

I'm glad we were finally able to clarify the challenge you were experiencing and get it resolved for you.

If you need the numbers to any law enforcement, FBI, Homeland security or secret service, please do not hesitate to ask. We will be happy to provide you with appropriate contact information.

Abuse Department
Staminus Communications "

"Dear Staminus,

While I can understand your position, I do disagree with you.

I note that you still have not provided a link to, or copy of your TOS, but I guess that fraud is against your TOS. It generally is for most hosting companies.

I can only ask you to investigate, look into or at least re-examine your side of things, specifically the arrangement that your company has with your customer.

I am asking because you are in a much better position to do so than I am. I can only point to the website and raise with you the doubts over the validity of the statements and claims made on the website that are claimed to be facts. Where I can refute those I have provided sources for my information. You may not choose to recognise the sources I linked to, that is your right, just as it is my right to inform you of abuse that I believe is occurring that is utilising your resources.

In this case as the site claims to be a company in 6 different countries, is hosted in a seventh and the registrant claims to be in an eighth, just which countries Law Enforcement would you suggest I contact? All of them? When I have serious doubts that it would fall under any of their jurisdictions? As I said previously, I am not a victim. Or do you think Law Enforcement would be more willing to hear from yourselves, as after all, you have a financial relationship with your customer and can provide much more information and, in general, be of more assistance to them than I can as an ordinary citizen?

I am all for having getting the police and courts involved in investigating these matters, but the sad fact is that unless they have victims, ie. evidence of a crime having been committed, there is little for them to do. Who exactly is in the better position here to provide this? Myself an ordinary citizen, or the hosting company?

Or, just perhaps, it may be better for everyone for the hosting company to step in before people are defrauded and turned into victims.

Most hosting companies have abuse teams that can recognise fraudulent sites, and suspend them. As you say, briefly interrupting their criminal activity, but it does prevent people falling victim to these fraudsters while they relocate their site.
It also sends a message to the fraudsters to stay away from that hosting company, in effect the more sites hosts suspend the fewer they will have to in future. After all, no hosting company wants to have a reputation for hosting fraudulent sites, do they?

At this point it seems only fair to inform you that I happen to maintain a blog - http://419fraudtoleranthosts.blogspot.com/ and I have posted our exchanges so far.

Kind regards

Rob"

 Staminus' reply:

"but I guess that fraud is against your TOS"

You have not proven fraud. You have implied some form of deception and suggested that I obtain sufficient evidence on my own.

Will you be funding the investigation?

"I can only ask you to investigate"

You can, indeed, ask. But that is not the "only" thing you can do. You could also perform the investigation yourself and obtain proof beyond circumstantial evidence of a violation of our TOS or criminal activity.

"I am asking because you are in a much better position to do so than I am"

By what method do you arrive at that conclusion? I have the same internet access as you do. And, if you are suggesting that I access the server, drives or data, then you also have the same access to hack the server that you are suggesting I do.

"but the sad fact is that unless they have victims, ie. evidence of a crime having been committed"

That damned US Constitution gets in the way every time, doesn't it. Let's throw out the 'search and seizure' laws. Let's throw out 'innocent until proven guilty'. Let's throw out 'wire tapping' laws. While we're at it, let's just take anyone you suggest behind the barn and shoot them - unless you'd prefer hanging.

In fact, we require the same proof/evidence that law enforcement requires.

You aren't really supporting the notion that services be terminated based on suspicion, are you?

You'd be okay with having someone report a suspicion to your ISP and having them terminate your services based on that suspicion? Really? Or will you, perhaps, suggest that your ISP should spend money investigating you? Will they be looking for evidence to convict or evidence to clear you? Who will pay for that investigation? Will you be okay with them reviewing all of your emails and phone calls? Just how much of an ISP police state are you advocating?

"Who exactly is in the better position here to provide this? Myself an ordinary citizen, or the hosting company?"

None of the above. Law Enforcement is in the best position to investigate and collect information that leads to a conviction.

"Most hosting companies have abuse teams that can recognise fraudulent sites"

We are not a hosting company. We do not provide web hosting services.

We are an ISP

"At this point it seems only fair to inform you that I happen to maintain a blog"

Email communications are private and copyrighted. Publishing them is a criminal offense and can be prosecuted. You have not requested and I have not granted permission to republish my copyrighted and private communications.

Clearly you have now established that you are a criminal.

No further communication is necessary.

Have a great day.

 As Staminus has asked me to stop emailing them on this issue, I will. However, this would have been my response to them.

"Dear Staminus,

In answer to your email,

"You have not proven fraud. You have implied some form of deception and suggested that I obtain sufficient evidence on my own.
Will you be funding the investigation?"

The definition of fraud:
"Fraud is a type of criminal activity, defined as:
'abuse of position, or false representation, or prejudicing someone's rights for personal gain'.
Put simply, fraud is an act of deception intended for personal gain or to cause a loss to another party.

The general criminal offence of fraud can include:

deception whereby someone knowingly makes false representation
or they fail to disclose information
or they abuse a position."

Site claims to be an international company head quartered in the UK. The contact address listed for these headquarters is another countries Embassy. No company has any office in an Embassy. They can afford their own offices.

The company is not registered with Companies House in the UK, despite claiming to be a 150 year old company.

The telephone number for the headquarters is a mobile number, would a long established company really not have a geographic number in their own offices for potential customers to call?

The email address listed for the headquarters is for a suspended domain. The email address used to register this suspended domain does not exist. A whois violation.

"By what method do you arrive at that conclusion? I have the same internet access as you do. And, if you are suggesting that I access the server, drives or data, then you also have the same access to hack the server that you are suggesting I do."

You are at the abuse desk of an ISP. You are providing services for this website, and as such, I would imagine, have better contacts with Law Enforcement and the hosting company for this website than I as an ordinary citizen would have access to. You could simply pass my email to them for them to look at and make a decision on. They may decide that it warrants investigation, although you have made it abundantly clear that you do not.

"That damned US Constitution gets in the way every time, doesn't it. Let's throw out the 'search and seizure' laws. Let's throw out 'innocent until proven guilty'. Let's throw out 'wire tapping' laws. While we're at it, let's just take anyone you suggest behind the barn and shoot them - unless you'd prefer hanging.
In fact, we require the same proof/evidence that law enforcement requires.
You aren't really supporting the notion that services be terminated based on suspicion, are you?
You'd be okay with having someone report a suspicion to your ISP and having them terminate your services based on that suspicion? Really? Or will you, perhaps, suggest that your ISP should spend money investigating you? Will they be looking for evidence to convict or evidence to clear you? Who will pay for that investigation? Will you be okay with them reviewing all of your emails and phone calls? Just how much of an ISP police state are you advocating?"

Not at all. I think you misunderstand me. I am saying please look at the website in question, look at the links I have provided and come to your own conclusion as to whether this is a website that you want your company associated with. If it is, fine. Feel free to ignore me. I am asking if what I have said has raised no doubts in your mind as whether you would be happy to engage this companies services or not.

""Who exactly is in the better position here to provide this? Myself an ordinary citizen, or the hosting company?"None of the above. Law Enforcement is in the best position to investigate and collect information that leads to a conviction."

Again, you misunderstand me. I agree LE is in the best position to investigate, however I also believe that you would be able to provide them with better leads than I could.

""Most hosting companies have abuse teams that can recognise fraudulent sites"

We are not a hosting company. We do not provide web hosting services.

We are an ISP"

Again, you could simply pass my email to the hosting company and let them make their own decision.

""At this point it seems only fair to inform you that I happen to maintain a blog"

Email communications are private and copyrighted. Publishing them is a criminal offense and can be prosecuted. You have not requested and I have not granted permission to republish my copyrighted and private communications.

Clearly you have now established that you are a criminal."

Actually, I believe that I would be covered by fair use. You are sending emails in your capacity as a representative of Staminus, who I am conversing with over their providing services to a domain I believe to be fraudulent, I am attempting to demonstrate why and your responses to my emails, it is for those reading to make up their own minds. If you didn't want these emails made public, perhaps you should reconsider what you are saying before you send them."

Update 09/05/15: panwestafricasec.net is currently offline, hopefully for good.

Edis and a money mule recruiting website

This conversation was passed to me by some associates, and I am reproducing it here as an example of how some hosts can react to being informed that criminals are abusing their services. You'd think that they'd appreciate being told of such violations, and most are. Sometimes, however, things can take on a strange twist. This was Edis' reponse over a fake employment site being used to recruit money mules, which they hosted. (Note: any editing done by myself has been placed inside <> brackets.)

"Hello,

I have doubts that this violates any laws in Italy (where this server is hosted) and Austria (where we are based), please obtain a court order for shutdown (or a credible person that sends us the abuse - You, from a <free email address> without any signature, are *not* credible.)

(It might violate US laws but No, we will not accept *any* US court orders, we obviously do not care about your funny US laws in Europe.)

Mit freundlichen Grüßen / Yours sincerely

--
EDIS GmbH"

"Wow!

A bit unexpected. Is it your website?

It is a fake company trying to lure gullible/desperate people into helping criminals to launder money.

If you don't care about that then that is your problem.

Regards"

"Considering that we are one of the largest hosting providers in multiple EU countries and the largest one in Austria... no, it is obviously a customer, simple as that.

However, unlike the US laws work different here - We don't take websites down when we get some mail from an unknwon source, from a free mail provider with no signature or anything (and no proof either for anything), this is plain and simple illegal as you have no authority over us and we have no authority to shut a customer down for this sort of abuse (there is an EU abuse template for a reason.).

You should also note that we as provider are never liable in Europe for any content (German: Providerprivileg, see German Telemediengesetz §8 and Austrian ecommerce §116 ) unless we ignore a court order - So i want one from you for it, what is the problem with that?
If it is illegal it should be easy for you to get one or simply report it to the police and have them do it, i really don't see your problem unless you have something to hide or lie to us. "

"Dear <Edis>
Let's not get over excited.

I do not expect you to take my word for it - which is why I provide the evidence in the form of an abuse report and ask you to investigate.

I am not an arm of Big Brother. I work as a volunteer with www.scamwarners.com to identify, warn about, and try to shut down criminal run sites taking advantage of people's niaivity/greed/stupidity.

If I thought that reporting a site to the police would help I would do so. But I certainly do not have the resources to get court orders etc.

Most registrars and hosts consider and respond to evidence in abuse reports
A few actually seem proud of supporting criminals

So good luck to you and your great big hosting provider
Best wishes"

"Again, what ressources?
You just report it to them, you don't have to pay anything - you don't even have to state a name or any personal data to them.
Don't tell me they don't take this serious - I work daily with Austrian police and Europol in money laundry cases (they happen to use a lot of VPN providers) and they are always well informed and interested

It's certainly nice what you do, this however does not change that i still have zero proof of illegal activity under _EU_ law (let me just for completion add again that we do not care a single % about US laws).

I see your text which might be right, i see a website which might be full of lies (which would not be illegal, even for financial advise) or criminal or a normal website...
It is not my job, no - not even my RIGHT, to judge if this site is illegal or not - that's why i want a court order.
You need to understand that you can go to JAIL here for shutting down customers without the correct reponse time to abuse and without specific proof as you disturb his business - Once we judge the decision is final, no matter if good or bad.
So we simply go the legal, easy and better way and let courts handle it while we enjoy our protection."

"Dear <Edis>,

Calm down. Keep things in proportion - speak to your supervisor. You are ranting like an idiot. You would spend your time better investigating sites rather than arguing with me.

Read the abuse report. Look at the job description for "Financial Agent" and the associated FAQ. See the same template on Bobbear from 4 years ago. If you don't recognise money mule then you are in the wrong job.

The registrant will have given false details, possibly paid for hosting with a stolen credit card, and will not complain if the domain is suspended. Don't hide behind the law, it makes you a moron.

Or is it more fun arguing than doing your job?"

"There is no supervisor for me, i *AM* the highest person for this already...
And yes, thanks, i know what money mules do - I also know perfectly fine how this industry works, what their income is, money laundry operations involving stolen bank accounts and Cyprus/Panama corporations, the persons behind it like Flyman in St. Petersburg, the companies they use... all nothing new.
As said, we deal often with police and europol.

I gave you enough hints now, so here it is clear: This site is *MONITORED BY EUROPOL* - Even if i WANTED i CANNOT DO ANYTHING without a court order. "

 At this point a second associate stepped in to assist.

"Hello,

It appears that your web contact form is not working.
A colleague of mine submitted an abuse report concerning a fraudulent domain hosted by Edis.at,

She was concerned that your abuse department representative, a Mr [name removed to protect the guilty], was being over protective of a clearly fraudulent domain and might be under some pressure from the criminal owners of the domain.

I copy her abuse report below and ask that you treat the matter sensitively.

Kind regards"

"Hello,

we will deal with this case tomorrow morning, anyway be assured there's no pressure from anyone to keep specific domains/services up and running, we just to need to give our client the chance to remove the content.

Yours sincerely
[Boss]
EDIS GmbH"

The final email from Edis Abuse to the first associate.

"Hello,

It should be noted that i actually HAVE verified this with a lawyer and this website is perfectly legal under Italian laws where it is hosted (not due to laws FOR it, but there don't exist any laws AGAINST it), the VPS was suspended (in fact, by myself, look at the other mail) for a similar, but non visible illegal matter.

Also, i am the head of abuse here - So please stop complaining.

Mit freundlichen Grüßen / Yours sincerely
[Abuse contact]"

The website was finally suspended.

"Go get a court order" or "report it to the police" is a common response from hosting providers and registrars alike. It's understandable, no one wants to be responsible for disrupting a legitimate website. However, when it comes to fraudulent sites, there are a number of problems, the first of which is the global nature of the internet. There is no internet police or court system, establishing which jurisdiction in which you would need to file such a claim is often beset with difficulties. The police there may not have the resources, or be interested in investigating without victims in their country. There is the time and expense required in order to get your court order, during which the website is still operating and ensnaring victims. Finally, once you have said court order and issue it to the hosting company and registrar, they may or may not recognise it's validity, because they may not even be in the same country, or the site will simply move to a different hosting company or reappear with a new registration, requiring the process to start over again.