Scam Alert : TimeToBit/timetobit.com Scammed 3.38 BTC

[BTCat]

Looks as timetobit site is taken down now.

[serializingme]

Some more info, two IP addresses:

- 192.64.118.151
- 192.64.118.152

These servers are registered as ns1.timetobit.com and ns2.timetobit.com respectively in the whois. From the e-Mail headers we can also get server1.timetobit.com (same IP as ns1.timetobit.com). Couldn't find any running service on those servers though.

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

[mlnoone]

Yes, the site is down, as I had expected it would be sooner or later.  The 'legit' company registration was probably a clever cover or decoy tactic.

I am concerned that this could form the template for a series of scams in the near future. 

A 'legit' company suddenly appears, starts to offers freebies and generates interest on forums, has a fairly well designed and legit-looking website. 
Accepts payment only by bitcoin, then, one day, 'poofff'... gone, just like that.  Too late, by the time you realise everything was just a cover for a clever scam!

I think, at least partly, it is the unique nature of bitcoin transactions makes such a scam possible. 

Hereafter, I would be extremely careful dealing with a site that "accepts payment only by bitcoin"!

[odlal]

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

You've spoken to them yourself then ?

BTW just curious

[odlal]

Yes, the site is down, as I had expected it would be sooner or later.  The 'legit' company registration was probably a clever cover or decoy tactic.

I am concerned that this could form the template for a series of scams in the near future.  

A 'legit' company suddenly appears, starts to offers freebies and generates interest on forums, has a fairly well designed and legit-looking website.  
Accepts payment only by bitcoin, then, one day, 'poofff'... gone, just like that.  Too late, by the time you realise everything was just a cover for a clever scam!

I think, at least partly, it is the unique nature of bitcoin transactions makes such a scam possible.  

Hereafter, I would be extremely careful dealing with a site that "accepts payment only by bitcoin"!

If I was to contemplate ever doing this again I'd now have to not only check their Domain Record information against what's on their website (as far as possible) making sure to quiz the 'company' about any discrepancies BUT ALSO, and just as importantly IMO, run diagnostics on their email header information just to be certain!

Gosh, seriously ? Yes, emphatically Yes 100%

[odlal]

Yes, the site is down, as I had expected it would be sooner or later.  The 'legit' company registration was probably a clever cover or decoy tactic.

I am concerned that this could form the template for a series of scams in the near future.  

A 'legit' company suddenly appears, starts to offers freebies and generates interest on forums, has a fairly well designed and legit-looking website.  
Accepts payment only by bitcoin, then, one day, 'poofff'... gone, just like that.  Too late, by the time you realise everything was just a cover for a clever scam!

I think, at least partly, it is the unique nature of bitcoin transactions makes such a scam possible.  

Hereafter, I would be extremely careful dealing with a site that "accepts payment only by bitcoin"!

If I was to contemplate ever doing this again I'd now have to not only check their Domain Record information against what's on their website (as far as possible) making sure to quiz the 'company' about any discrepancies BUT ALSO, and just as importantly IMO, run diagnostics on their email header information just to be certain !

Gosh, seriously ? Yes, emphatically Yes 100%

In fact: Were I running such a company I would make it abundantly clear up front on my website it welcomes any and all such Queries and could even provide the necessary information WITH links for a potential customer to VALIDATE for themselves !

[serializingme]

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

You've spoken to them yourself then ?

BTW just curious

Unfortunately, no I didn't I checked their address in Google Maps, and matched with http://www.avanta.co.uk/. BTCCat also arrived to the same conclusion (https://bitcointalk.org/index.php?topic=744692.msg8423412#msg8423412.)

[BTCat]

Some more info, two IP addresses:

- 192.64.118.151
- 192.64.118.152

These servers are registered as ns1.timetobit.com and ns2.timetobit.com respectively in the whois. From the e-Mail headers we can also get server1.timetobit.com (same IP as ns1.timetobit.com). Couldn't find any running service on those servers though.

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

Checked one of these here:

http://sameip.net/ip192.64.118.152

finding:
Total: 3 domains hosted at 192.64.118.152
anstele.com
ns2.anstele.com
timetobit.com

checked anstele.com here: http://whois.domaintools.com/anstele.com
finding:
Domain Name: ANSTELE.COM
Registrar URL: http://www.godaddy.com
Registrant Name: Prashant Powle
Registrant Organization: Prashant Powle
Name Server: NS1.ANSTELE.COM
Name Server: NS2.ANSTELE.COM

I don't see relation between anstele and timetobit except for the 3 domains hosted on same IP.

[LXBGMiners]

Hi @,

I'll try to start a legal procedure asap. I'll have to wait for a few answers from authorities fighting against cyber crime.
Even if it will lead to anything, I'll try it.
I have made a request at cases.lu whom have transmitted my request to circl.lu
Depending on their answer ... we will see!

[dekodoge]

Some more info, two IP addresses:

- 192.64.118.151
- 192.64.118.152

These servers are registered as ns1.timetobit.com and ns2.timetobit.com respectively in the whois. From the e-Mail headers we can also get server1.timetobit.com (same IP as ns1.timetobit.com). Couldn't find any running service on those servers though.

The address used in the company registration belongs to a company that basically provides a mail box "routing service", so that you can register a "legit" company without revealing your identity. Pretty much used for offshore companies.

Checked one of these here:

http://sameip.net/ip192.64.118.152

finding:
Total: 3 domains hosted at 192.64.118.152
anstele.com
ns2.anstele.com
timetobit.com

checked anstele.com here: http://whois.domaintools.com/anstele.com
finding:
Domain Name: ANSTELE.COM
Registrar URL: http://www.godaddy.com
Registrant Name: Prashant Powle
Registrant Organization: Prashant Powle
Name Server: NS1.ANSTELE.COM
Name Server: NS2.ANSTELE.COM

I don't see relation between anstele and timetobit except for the 3 domains hosted on same IP.

http://corporatedir.com/company/ans-telecom-immovations-private-limited

just use the same host it would seem.

[LeastMostWanted]

Their website is down today and  I have not been paid since the 15th of August.

[dekodoge]

Their website is down today and  I have not been paid since the 15th of August.

Yes it was a scam, wave bye bye to your "investment"

[kirk202]

Their website hasn't been accessible since last night either.

[neil95]

I got about $3.00 worth of payments before the payments got stuck in "pending" and the site disappeared. Quite the ROI right there. -_-

[Milkcookie]

I really doubt anyone will get a refund for it since the website is gone and you paid via bitcoins i am sorry for the scammed ppl

[mrhiggins]

Indeed, the web site not responding. Below is the WHOIS DNS registry data for the domain.  Of course, it's a private.

   Domain Name: TIMETOBIT.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.TIMETOBIT.COM
   Name Server: NS2.TIMETOBIT.COM
   Status: ok
   Updated Date: 20-jun-2014
   Creation Date: 20-jun-2014
   Expiration Date: 20-jun-2015

Domain Name: TIMETOBIT.COM
Registry Domain ID: 1863693159_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.enom.com
Registrar URL: www.enom.com
Updated Date: 2014-06-20 15:05:55Z
Creation Date: 2014-06-20 22:05:00Z
Registrar Registration Expiration Date: 2015-06-20 22:05:00Z
Registrar: ENOM, INC.
Registrar IANA ID: 48
Registrar Abuse Contact Email: abuse@enom.com
Registrar Abuse Contact Phone: +1.4252744500
Reseller: NAMECHEAP.COM
Domain Status: ok
Registry Registrant ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant Postal Code: 00000
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: 5E4C19DA260C486B955F398E601C7807.PROTECT@WHOISGUARD.COM
Registry Admin ID:
Admin Name: WHOISGUARD PROTECTED
Admin Organization: WHOISGUARD, INC.
Admin Street: P.O. BOX 0823-03411
Admin City: PANAMA
Admin State/Province: PANAMA
Admin Postal Code: 00000
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: 5E4C19DA260C486B955F398E601C7807.PROTECT@WHOISGUARD.COM
Registry Tech ID:
Tech Name: WHOISGUARD PROTECTED
Tech Organization: WHOISGUARD, INC.
Tech Street: P.O. BOX 0823-03411
Tech City: PANAMA
Tech State/Province: PANAMA
Tech Postal Code: 00000
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: 5E4C19DA260C486B955F398E601C7807.PROTECT@WHOISGUARD.COM
Name Server: NS1.TIMETOBIT.COM
Name Server: NS2.TIMETOBIT.COM
DNSSEC: unSigned

[Milkcookie]

Whois means nothing to me private or not the whois can be faked using fake name etc

[Nistrim]

Some Blockchain research on the scam:

I think most of the BTC is now here (last transaction just 2 hours ago, so he's busy moving the money  ):
https://blockchain.info/nl/address/1FsVcdeHbpvUVT3gjeuVR2ZSDnpcsJMsLL

It was previously on:
https://blockchain.info/nl/address/1JvAoBTTgF36Xj7gJkpfcNHsBA8tMSyfHb

This transaction for example, has five btc 0.47704704 payments, which was the price for the 150GH/s server that day.
https://blockchain.info/nl/tx/023f860b63e21e839cbd02bfefea238650df1e18e73abc68153c72bdaf6faa83

An interesting graph of the received payments:
https://blockchain.info/nl/charts/received-per-day?timespan=60days&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=1JvAoBTTgF36Xj7gJkpfcNHsBA8tMSyfHb

[jdruiter]

There are some leads to be followed:

* if you lost BTC, please report to your local police department. They can get court orders to get information from Namecheap, Enom inc any other party involved.

* Opencompany.co.uk.
He has registred his timetobit company there, probably using false information but still. Im in contact with them. It might be worth it buying the 1 pound extra information document and post here.
 
* Avanta. He supposedly hired office space here, it's at 93-95 Hanover Street, Edinburgh as listed in the company registration. They have a telephone number and emailadress.
http://www.avanta.co.uk/UK/offices/business-centres-edinburgh

* Tonys-iMac.local.
This is where support email contacts came from (email headers). Some google searched lead me to Tony Horrocks, tonyhrx on twitter, who went to Edinburg and who published CiviCRM Cookbook with $Tonys-iMac.local (bash) in there. He owns web development company http://fabriko.co.uk. But be careful, its a very loose lead, so first find out before you take any action. The information might also be about multiple Tony Horrocks, I really don't know.

* What IP address did he use on this bitcointalk forum and bitcointa.lk?

* Anstele.com, hosted on the same server as time to bit:
192.64.118.151    -> server1.timetobit.com (ns1.timetobit.com)   (anstele.com, Prashant Powle, hosted on namecheap, domain by godaddy).
Whois information: Prashant Powle, Bhave House, Kale Marg, Bailbazar, Kurla West, Mumbai India, +91.919322607034, ppowle@yahoo.com)
Seems unrelated, but it's the only other party who hosted on the same server.

But to get real answers, you need to get the phone and call call call

LXBGMiners, it is possible. Nothing is untraceable in this world.

[mlnoone]

The entry on OpenCompany.co.uk shows "Bernhard Wellington" is the company director.  However, further search with the name did not lead to any more information than that shown in the page (https://www.opencompany.co.uk/company/SC480808/timetobit-limited)