After a domain name closed a website because of a potential scam, the website popped up again.<\/p>\n
A search of the latest iteration of the questionable website connects the originators of the site to several international scams, ranging from a fake investment scheme to a romance scam.<\/p>\n
In our article, Gone phishing: Business owner almost scammed by fake government tender<\/em><\/a>, amaBhungane reported how the website sanetexhygiene.co.za was closed after a businesswoman reported it to its domain registry.<\/p>\n A domain search showed that the \u201cco.za\u201d website was last updated on 17 April 2020, and the website host removed the site before 20 April.<\/p>\n However, by 18 April, a new site was formed: sanetexhygiene.com. The latest site<\/a> had all the trappings of the former site<\/a> \u2013 the same appearance, wording, telephone numbers and industrial sanitiser machine for sale.<\/p>\n The DX610M sanitiser machine \u2013 put out for tender via a bogus health department request for quotation \u2013 does not exist beyond these two South African websites.<\/p>\n The websites had, in effect, renamed and repackaged the US-based Protexus Electrostatic Sprayer which, when used with Purtabs disinfecting tablet, meets Environmental Protection Agency criteria for use against SARS-CoV-2 [see here<\/a> and here<\/a>], the virus that causes Covid-19.<\/p>\n Perhaps to remove suspicion that the two websites share the same creators, minor changes were made on the new website to differentiate it from the older one.<\/p>\n Click on the Evidence docket for access to the website information we used in this story.<\/em><\/strong><\/p><\/blockquote>\n The difference between the \u201cco.za\u201d and \u201c.com\u201d was the new domain name, which led to the establishment of a new email address and a new physical address. A Google Maps search showed the original \u201cco.za\u201d site as being located in a warehouse in Cape Town, with the new site located in an industrial area in George.<\/p>\n To connect the dots between this scam and others, amaBhungane used the information it had from a web domain search for both companies which included a location and an international Panama-based number.<\/p>\n This is what we found:<\/p>\n On 13 November 2019, Scampolice Group<\/a>, a website which exposes so-called 419 scams,\u00a0 <\/span>reported how one George Ryg Wilson (also known as Scales Wilson) masqueraded as a US military veteran and targeted women through Facebook using a parcel delivery scam.<\/p>\n The scam saw Wilson contact women and ask them to fork out hundreds of euros in customs fees for parcels he was meant to receive. The parcels were allegedly expensively packaged and required special regulation fees such as VAT and \u201csynthetic fees\u201d.<\/p>\n For the parcel to be released, the women would be required to send money to Efosa Lincoln Amadin via Madrid-based Liberbank SA.<\/p>\n What links the sale of sanitiser machines in South Africa to the romance scam in the US is a cellphone number, +507.8365503, used to create the websites.<\/p>\n Like this story? Be an amaB Supporter<\/a> <\/span>to help us do more. Sign up for our newsletter<\/a><\/span> to get more.<\/em><\/p>\n The same telephone number is connected to a porn site, Hot Movs, based in Belize, Central America, and to a scam targeting the clients of financial institution Wells Fargo through the company afktpp.com.<\/p>\n Along with LatinMail, Helpwyz, Deana Labilliere and Angellist, these sites have a phone number, a location and a domain registry in common.<\/p>\n However, further investigation will be needed to link the scams definitively.<\/p>\nThe other scams<\/h5>\n