SCAM WARNING -- easzpay -- www.easzpay.com

[Matthew N. Wright]

I know we all know this is a scam, but it's worth having this resource on the forums and Google's listings to show people who have half the sense  to do some checking up on things before they buy into them.


The owner of easzpay.com has been spamming this forum under dozens of fake accounts, is permabanned, creates another account, process repeats dozens and dozens of times per week.

As shown in this thread, Theymos states:

I don't know why he bothers. His posts usually get nuked pretty quickly. No need for a sticky, IMO.

These are the IPs he's used, if someone wants to try tracking him down:

Code:

1.221.78.82
1.230.127.68
1.234.36.113
1.234.4.166
1.234.45.44
1.234.7.147
1.249.123.196
1.252.226.252
101.66.61.191
108.62.199.13
108.62.199.136
108.62.199.17
108.62.199.19
108.62.199.20
108.62.199.229
108.62.199.23
108.62.199.230
108.62.199.25
108.62.199.28
108.62.199.31
108.62.199.33
108.62.199.36
108.62.199.38
108.62.199.40
108.62.199.43
108.62.199.44
108.62.199.46
108.62.199.48
109.169.66.205
112.2.5.11
112.216.145.91
112.217.232.118
112.220.234.195
113.21.246.42
113.97.240.27
114.108.137.73
115.207.62.169
115.68.21.186
115.68.59.83
116.213.132.18
117.135.140.11
117.135.140.39
117.52.82.63
118.216.255.63
118.32.191.162
118.46.219.200
119.155.21.57
119.30.38.5
119.30.45.34
119.30.45.35
119.30.45.58
119.68.237.117
12.20.60.12
120.193.52.86
120.199.224.88
120.199.228.50
120.40.134.96
120.43.12.157
120.43.12.199
120.43.19.103
121.0.112.199
121.125.74.76
121.153.22.11
121.78.131.214
122.173.181.204
123.143.189.98
123.153.69.201
125.136.130.20
125.140.193.228
125.141.224.71
126.114.231.205
126.15.1.93
14.145.73.155
165.132.224.15
175.210.203.179
180.149.7.204
180.149.7.213
180.211.195.127
180.234.245.49
180.246.107.8
180.67.207.50
180.69.254.158
182.178.204.41
183.2.151.207
183.96.230.24
184.95.41.7
202.201.253.61
203.228.64.162
205.164.3.144
209.73.144.188
210.118.15.190
210.127.210.5
210.222.130.2
210.56.59.179
211.118.151.252
211.154.133.174
211.175.36.125
211.195.108.240
211.196.157.24
211.238.108.115
211.36.8.130
216.172.158.11
216.172.158.13
218.108.89.46
218.200.212.197
218.200.50.68
218.201.241.251
218.203.211.34
218.204.135.206
218.206.231.57
218.206.45.243
218.23.145.60
218.232.109.227
218.234.17.238
218.38.13.37
220.161.103.75
220.161.98.168
220.71.120.215
220.76.56.125
220.90.206.11
220.94.105.71
221.143.48.71
221.145.226.7
221.176.168.29
221.176.189.22
222.100.14.247
222.122.47.254
27.159.234.63
50.117.117.23
50.117.117.25
50.117.117.45
50.117.124.148
50.117.124.150
50.117.124.153
50.117.124.154
50.117.124.155
50.117.124.156
50.117.124.184
50.117.127.169
50.117.127.170
50.117.127.172
50.117.127.173
58.187.95.122
58.49.57.98
58.8.151.70
58.97.209.175
58.97.226.21
59.174.46.17
59.58.148.9
59.58.151.34
59.58.155.251
59.60.122.120
59.60.125.171
59.60.127.241
60.196.35.188
61.235.87.236
66.79.161.239
66.79.161.245
67.60.233.57
69.195.157.41
69.195.157.44
69.195.157.45
69.195.157.53
69.22.174.157
69.46.82.226
70.154.161.78
70.89.136.52
96.226.119.132

Several people from the community have already tried buying Bitcoins from this service just to test it and none to date have received any.

Even other communities have reports of their scammy behavior.

DO NOT BUY LIBERTY REVERSE MONEY FROM THIS SITE

I ordered some Liberty Reverse money and paid with a credit card through paypal 11 days ago and i haven't got my money on LR
$9,88 LOST
On the order status it says "Processing"...

I've tried to contact them vi chat and mail but on mail they don't answer and on chat I write my problem and then they don't answer


DO NOT BUY LIBERTY REVERSE MONEY FROM THIS SITE

My repeated conversations with the scammers over their own site's help chat have only confirmed suspicions in the beginning and if the price of their bitcoins weren't obvious enough that something is fishy, this non-clickable image should be enough reason to avoid them:



There is no BBB listing for their company, which they list as:

Easzpay inc.
care of Network Solutions
PO Box 459
Drums, PA. US 18222

This is not their address, obviously.

For your entertainment, a chat log with the scammers.

Live Support
7:31 am Todd Bethell said :
Halo?
7:33 am livehelpinc said :
hi
7:33 am livehelpinc said :
what can I do for you
7:34 am Todd Bethell said :
Hi there,
7:35 am Todd Bethell said :
I want make a large purchase of Bitcoins
7:35 am livehelpinc said :
hi
7:35 am Todd Bethell said :
But I do not trust existing store exchanges
7:35 am livehelpinc said :
ok,how many you want to order?
7:35 am Todd Bethell said :
And I have a large amount I want to purchase for our libertarian group,
7:35 am livehelpinc said :
i will check stock for you
7:35 am livehelpinc said :
ok
7:35 am Todd Bethell said :
We meet in New Hampshire every year for a free-range economy meeting, and I believe we will need about 10,000 BTC
7:36 am Todd Bethell said :
How much is that in USD?
7:38 am livehelpinc said :
sorry,we don't have 10000 btc
7:39 am Todd Bethell said :
What is the most you will be able to sell me at your discount prices?
7:39 am livehelpinc said :
it's big amount
7:39 am livehelpinc said :
sorry
7:40 am livehelpinc said :
now we only have 300 btc
7:40 am livehelpinc said :
we can not provide this amount.i am so sorry
7:40 am Todd Bethell said :
I will take 300 first as these prices are just too low to ignore
7:40 am Todd Bethell said :
I can have my secretary wire the funds through a bank wire tonight
7:41 am Todd Bethell said :
For my invoicing records, what is the legal name of your company?
7:41 am livehelpinc said :
every days,we only supply 400 btc
7:42 am livehelpinc said :
sorry,we are not accept bank wire.and it's risk for you
7:43 am Todd Bethell said :
Oh you can only supply 400BTC per day? That isn't so bad. since our organization gets together next Spring I am more than positive I can buy 400BTC per day from you
7:44 am Todd Bethell said :
What is your legal company name for my invoices?
7:45 am livehelpinc said :
our company name easzpay inc.
7:45 am livehelpinc said :
i am so sorry,we minning by ourself.not demand from other
7:45 am Todd Bethell said :
Oh I understand, that makes sense
7:45 am livehelpinc said :
our staff only mining 400btc
7:45 am Todd Bethell said :
Where is easzpay inc. registered?
7:45 am livehelpinc said :
sorry
7:46 am Todd Bethell said :
I cannot find the records at the address on your website
7:46 am Todd Bethell said :
I also don't see any record in the BBB despite your website saying it's accredited by the BBB
7:49 am livehelpinc said :
sorry,it's our copyright department control it,i am just sale servicer,sorry
7:58 am livehelpinc said :
sorry,we are provide service for virtual items.we use secure payment for all customers.we can not provide more about us,sorry

So the next time you see a link trying to sell bitcoins, think twice.

For everyone else who already knows about this, take this as a reflection on the daily spam we see from them and feel free to vent here.

[1715057869]

1715057869

[1715057869]

1715057869

[1715057869]

1715057869

[1715057869]

1715057869

[organofcorti]

7:45 am livehelpinc said :
i am so sorry,we minning by ourself.not demand from other
7:45 am Todd Bethell said :
Oh I understand, that makes sense

Ah, thank you so much for that, Matthew. I can go to bed laughing.

A new meme: someone says something so strange and such a non-sequitur that the mind boggles. The correct response is "Oh I understand, that makes sense".

[John (John K.)]

Thanks for the conclusive writeup, Matthew. 
Now I have a link to save me from explaining in posts like this : https://bitcointalk.org/index.php?topic=89773.0

[Matthew N. Wright]

After much harassment, I got him to "go through his managers" and get a bitcoin address to send -him- bitcoins.

1CovpUiNiuUvsB3srVv2mDx3GWvrX9rfiR

It's a blank wallet he created "just to prove" that he knows how to use Bitcoin, but he admits it is not connected to any other relative wallets so there is no way of seeing if they even have bitcoins to sell, which would not be conclusive but would at least prove they're choosing not to send bitcoins instead of actively just pretending to have them.

Unironically, I told him I was sending a BTC amount to him to confirm it, and not only can he not confirm it, but he did not send it back.

[John (John K.)]

If you Google :

Code:

PO Box 459
Drums, PA. US 18222

You'll see that multiple sites have the exact same registration address like ipad.com. Even Valve reportedly had the same address 

This is probably a lie, but here's some serious research I did.

Anybody who thinks this is by Valve Corporation should read up on the IP address registration (you can learn more about .com ownership by going to WHOIS.GODADDY.COM and typing in a domain URL) and you will find that the domain is owned by a "David Hassen, PO Box 459, Drums, P.A. US 18222". No connection to Big Gabe whatsoever. Except the address, which is the address of Network Solutions, a web hosting service for businesses in Pennsylvania. If you click the HL3 logo in the middle, however, you will find you are taken to "half-life3.com" before being swiftly redirected to "half-life2.com". This domain, (half-life3.com) is owned by "Valve Corporation, PO Box 459, Drums, P.A. US 18222". Why are they the same address? I check out many other domains and was shown different addresses. The circumstances are nerve-wracking.

This could be something...

http://www.giantbomb.com/half-life/62-293/black-aperture/35-529412/

[rjk]

If you Google :

Code:

PO Box 459
Drums, PA. US 18222

You'll see that multiple sites have the exact same registration address like ipad.com. Even Valve reportedly had the same address 

This is probably a lie, but here's some serious research I did.

Anybody who thinks this is by Valve Corporation should read up on the IP address registration (you can learn more about .com ownership by going to WHOIS.GODADDY.COM and typing in a domain URL) and you will find that the domain is owned by a "David Hassen, PO Box 459, Drums, P.A. US 18222". No connection to Big Gabe whatsoever. Except the address, which is the address of Network Solutions, a web hosting service for businesses in Pennsylvania. If you click the HL3 logo in the middle, however, you will find you are taken to "half-life3.com" before being swiftly redirected to "half-life2.com". This domain, (half-life3.com) is owned by "Valve Corporation, PO Box 459, Drums, P.A. US 18222". Why are they the same address? I check out many other domains and was shown different addresses. The circumstances are nerve-wracking.

This could be something...

http://www.giantbomb.com/half-life/62-293/black-aperture/35-529412/

Doh, that address is the one that NetSol uses for private registrations. No lead there.

[John (John K.)]

If you Google :

Code:

PO Box 459
Drums, PA. US 18222

You'll see that multiple sites have the exact same registration address like ipad.com. Even Valve reportedly had the same address 

This is probably a lie, but here's some serious research I did.

Anybody who thinks this is by Valve Corporation should read up on the IP address registration (you can learn more about .com ownership by going to WHOIS.GODADDY.COM and typing in a domain URL) and you will find that the domain is owned by a "David Hassen, PO Box 459, Drums, P.A. US 18222". No connection to Big Gabe whatsoever. Except the address, which is the address of Network Solutions, a web hosting service for businesses in Pennsylvania. If you click the HL3 logo in the middle, however, you will find you are taken to "half-life3.com" before being swiftly redirected to "half-life2.com". This domain, (half-life3.com) is owned by "Valve Corporation, PO Box 459, Drums, P.A. US 18222". Why are they the same address? I check out many other domains and was shown different addresses. The circumstances are nerve-wracking.

This could be something...

http://www.giantbomb.com/half-life/62-293/black-aperture/35-529412/

Doh, that address is the one that NetSol uses for private registrations. No lead there.

Oops, just did a whois for the site and turned out entirely different addresses:

Code:

Registrant (?)
Easy Pay
Gibbet street Halifax West Yorkshire
Londen
1215
West Yorkshire
GREAT BRITAIN (UK)

Code:

Admin Contact (?)
Easy Pay
Gibbet street Halifax West Yorkshire
Londen
565852
West Yorkshire
GREAT BRITAIN (UK)
easzpay@yahoo.com
+1.1553448233

Code:

Tech Contact (?)
easzpay tech
Gibbet street Halifax West Yorkshire
Londen
1215
West Yorkshire
GREAT BRITAIN (UK)
domain.tech@yahoo-inc.com
+1.34435436

Code:

Name Servers (?)
YNS1.YAHOO.COM
YNS2.YAHOO.COM
Registrar (?)
MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Status (?)
clientTransferProhibited
Updated Date (?)
2012-05-08

[John (John K.)]

I suppose the only true information would be contained in the last codebox I've quoted, so the scammers would be living in Australia.
Any hope in sending a complaint to http://www.melbourneit.com.au/ ?

[Gladamas]

Man I'm glad the moderators are on top of this.

[organofcorti]

i am so sorry,we minning by ourself.not demand from other
7:45 am Todd Bethell said :
Oh I understand, that makes sense
7:45 am livehelpinc said :
our staff only mining 400btc

That should have stopped me the first time around. The network only produces 144 blocks per day. They must have very efficient "minners" in order to mine more blocks than the network produces. Either that or they have enough hashrate to triple difficulty every difficulty period.

[John (John K.)]

Doing some backtrace, I've determined that this site is hosted on : server02.usjusthost.com ,
with the IP as : 108.163.231.98

Unsurprisingly, there's around 60 sites with the same IP:

Code:

5151hj.com (linkback)5177gm.com (linkback)bbs.campusfr.com (linkback)cheapoakleysunglassesonsales.com (linkback)dg928.com (linkback)spammer (linkback)ebuysilver.com (linkback)fake-sunglassesshop.net (linkback)gwedt.com (linkback)jn721.com (linkback)jnq18.com (linkback)lz778.com (linkback)onlinegamewar.com (linkback)sdjnq8.com (linkback)sneakerisabelmarant.com (linkback)sz928.com (linkback)www.2wl.org (linkback)www.air-maxbwpascher.com (linkback)www.air-maxtnfrance.com (linkback)www.bagsmulberryoutlet.com (linkback)www.bridalprom.co (linkback)www.celinebagscheap.com (linkback)www.cheapluxurybagsoutlet.com (linkback)www.cheapoakleysunglassesonsales.com (linkback)www.christianlouboutin-topshop.com (linkback)www.chunxiao.info (linkback)www.dg717.com (linkback)www.discountsnapbackshat.com (linkback)www.dl728.com (linkback)www.spammer (linkback)www.ebuysilver.com (linkback)www.flashcharms.com (linkback)www.gamecardbuy.com (linkback)www.gianmarcolorenzipumpssale.com (linkback)www.gogostores.info (linkback)www.heb721.com (linkback)www.helloneweraonline.info (linkback)www.hf771.com (linkback)www.humatefertilizers.com (linkback)www.jn721.com (linkback)www.jxhqjd.com (linkback)www.kicsoco.com (linkback)www.lz778.com (linkback)www.metal-parts.org (linkback)www.mygogostore.info (linkback)www.mysunglassesmvp.info (linkback)www.nikespascher.com (linkback)www.plastic-parts.org (linkback)www.pursebagsoutlet.com (linkback)www.qd721.com (linkback)www.qd728.com (linkback)www.sjz721.com (linkback)www.steeljewelrypandora.com (linkback)www.sz928.com (linkback)www.takeke.com (linkback)www.ty721.com (linkback)www.wz717.com (linkback)www.xa721.com (linkback)www.yslukshoes.uk.com (linkback)wz717.com (linkback)

A simple arin.net whois turns up:

Code:

NetRange:       108.163.192.0 - 108.163.255.255
CIDR:           108.163.192.0/18
OriginAS:       AS32475
NetName:        SINGLEHOP
NetHandle:      NET-108-163-192-0-1
Parent:         NET-108-0-0-0-0
NetType:        Direct Allocation
RegDate:        2011-11-15
Updated:        2012-03-02
Ref:            http://whois.arin.net/rest/net/NET-108-163-192-0-1

OrgName:        SingleHop, Inc.
OrgId:          SINGL-8
Address:        621 W. Randolph St.
Address:        3rd Floor
City:           Chicago
StateProv:      IL
PostalCode:     60661
Country:        US
RegDate:        2007-03-07
Updated:        2010-03-23
Comment:        http://www.singlehop.com/
Ref:            http://whois.arin.net/rest/org/SINGL-8

ReferralServer: rwhois://rwhois.singlehop.net:4321

OrgNOCHandle: NETWO1546-ARIN
OrgNOCName:   Network Operations
OrgNOCPhone:  +1-866-817-2811 
OrgNOCEmail:  netops@singlehop.com
OrgNOCRef:    http://whois.arin.net/rest/poc/NETWO1546-ARIN

OrgAbuseHandle: ABUSE2492-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-866-817-2811 
OrgAbuseEmail:  abuse@singlehop.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE2492-ARIN

OrgTechHandle: NETWO1546-ARIN
OrgTechName:   Network Operations
OrgTechPhone:  +1-866-817-2811 
OrgTechEmail:  netops@singlehop.com
OrgTechRef:    http://whois.arin.net/rest/poc/NETWO1546-ARIN

Hence, their ISP is SingleHop.com .  Any hope in sending a complaint to that?
By the way, usjusthost.com is owned by a Chinese - that probably explains the scammer's lack of command of English.

Code:

Domain name: usjusthost.com

Registrant Contact:
   Domain Privacy
   Domain Privacy ()
   
   Fax: 
   A2 Segensworth Business Centre
   Segensworth Road
   Fareham, Hampshire PO15 5RQ
   GB

Administrative Contact:
   Shijie Zhao
   Shijie Zhao ()
   +1.5846592658
   Fax: +1.5846592658
   Haerbingongchengdaxue
   Haerbin, Heilongjiang 150001
   US

Technical Contact:
   Just Host
   Domain Manager ()
   +1.8887557585
   Fax: 
   919 East Jefferson Blvd.
   Phoenix, AZ 85034
   US

Status: Locked

Name Servers:
   ns1.usjusthost.com
   ns2.usjusthost.com
   
Creation date: 07 May 2011 15:32:00
Expiration date: 07 May 2013 10:32:00

[mc_lovin]

yup he posted like 38 threads on bitcointrading.com..  i bought 2 coins off them and they never delivered in a week or so and I had multiple people on the forum complain as well.  at least we can reverse the paypal transactions!!!

PATHETIC scam attempt, but lovely website, must say.

edit: and thanks theymos for that IP list.. man that's a lotta IP's to ban.. are they tor addresses?

[Stephen Gornick]

Bookend to this thread.

Easzpay got shut down, so now the operator appears to have moved on ...  MtGax (seriously!)

 - http://bitcointalk.org/index.php?topic=98251.0

[Vod]

I'm glad to see these kinds of things are being exposed!

[Phinnaeus Gage]

Let me get this straight, Matthew. You easily connected the dots on this one scam, but reject the dot connecting I preformed. I didn't even color outside the lines that time. What gives?

~Bruno~