Credit Card Scam Shop (kerten.co.uk)

This one has become so prevalent that I’m starting its own article.

Just one of the many names and stores.
(Click to enlarge image)

Victims: You probably want to approach your bank with “I ordered this item from this website and I didn’t get my items and I can’t reach the retailer.”. Approaching it from a “Someone stole my card details and spent my money” may not cover you because you willingly handed over the details. I’m not an expert on that. Citizens advice may be the best people to speak to. Do not give up. Chase it through to the financial ombudsman if the bank is uncooperative. You may wish to remind your bank about their code of conduct about reimbursing scam victims.
Once you’ve dealt with the payment card issues it is important to also report the fraud to ActionFraud: http://www.actionfraud.police.uk/report-a-fraud-including-online-crime

These scam shops advertise on google under numerous white goods and electronics goods keywords. They often claim to have stock of items that most retailers do not and the price is normally well below the normal price.

Upon purchase you are taken to a slick looking credit card page.

The sites they operate under are:

“Techtop Best Online Store” / “Techtop Ltd.” (techtop.shop – Registered 9th January 2021).

“Larris Best Online Store” / “Larris Retail Limited” (larris.shop – Registered 15th October 2020).

“Kentis Best Online Store” / “Kentis Limited” (kentis.shop – Registered 15th December 2020).

“Rettis Best Online Store” (rettis.shop – Registered 24th January 2021).

“Stargon Online Store” (stargon.shop – Registered 7th January 2021).

“Bennis Online Store” (bennis.shop – Registered 4th February 2021).

global-pay.site and global-payment.site

green-monkey.xyz

10th February 2021 they’ve moved to using checkout.diespay.com (which seems to be related to a potentially legitimate payment processor “begateway.com”).
Other related indicators / information: “rettisshop@yahoo.com” and russian phone number “+794500522551”.

“Techen Best Online Store” (techen.shop – Registered 5th February 2021).

“Ketron Best Online Store” (ketron.shop – Registered 28th March 2021).

“Besten Online Store” (besten.shop – Registered 2nd April 2021).

“Rettop Online Store” (rettop.shop – Registered 6th March 2021).

“Frantis Meilleur Botique En Ligne” (frantis.shop – Registered 23rd March 2021).

“Dextron Best Online Store” (dextron.shop – Registered 27th May 2021).

Also related cloudpayments.services Registered 27th May 2021.

Also related securepay.tinkoff.ru for the back-end card payments using “cargo-rh.com” (CargoRoadhouse, Cargo-roadhouse) merchant account.

Also related api-payments.cc registered 22nd June 2021.

They’ve now moved to using the spoof domain “checkoutdiespay.com” (similar to what seems to be a genuine payment service checkout.diespay.com”). Domain only registered 7th July 2021. (One day ago at time of updating this post).

Payment has moved to “spanish-speaker.com”, what looks like a genuine site but the payment gateway is being used to collect payment for the scam online store. The spanish speaker site then redirects the visitor to a genuine card processor company.

“Retten Best Online Store” (retten.shop – Registered 9th June 2021).

“Zerten Best Prices Every Day” (zerten.co.uk – Registered 12th July 2021).

Fake payment site has been setup on “pay-core.com” (Registered 12th August 2021) which then forwards to try to take payment on tinkoff with the account “euatanov@yandex.com”, “express-trassa.com”, “IP “ATANOV EVGENIY MIKHAYLOVICH””, “+79620033841” which also looks like a fake business.

Fake payment has moved to “pay-alpha.com”.

“KIPSTEN Best Prices Every Day” (kipsten.com – Registered 12th July 2021).
Hosted at “92.119.115.100” but hidden behind cloudflare.
This site seems to be using a checkout system on a fake company “themarketingacademy.biz” (Registered 22nd July 2021) which in turn uses a genuine payment processor “ecommpay.com”.

The fake marketingacademy website seems to be a clone of “londonmcg.co.uk” (also doesn’t look too legitimate itself either!). Whoever set up both had a copy of the website code and database of the original. I suspect whoever made londonmcg stole the code and is using it on the fake marketingacademy site.

“Optitech Best Online Store” (optitech.shop – Registered 27th July 2021).
This site attempts to send PayPal payment to “bier.arielle@yahoo.com”.
Hosted at “92.119.115.100” but hidden behind cloudflare.

“Wirsten Best Prices Every Day” (wirsten.co.uk – Registered 3rd September 2021).
Hosted on the same CloudFlare account as zerten.co.uk and kipsten.com.

“Lotren Best Prices Every Day” (lotren.co.uk – Registered 29th September 2021).

Also related “bepaid-processing.info” domain being used as a fake card payment screen. Registered 8th December 2021.

“Hintech Best Prices Every Day” (hintech.co.uk – Registered 11th January 2022).

Also related “skill-market.pro” and “cloud-processing.info”.

“Kerten Best Prices Every Day” (kerten.co.uk – Registered 8th February 2022).

“UAETECH Best Prices Every Day” (uaetech.shop – Registered 5th April 2022).

“TECHERT Best Prices Every Day” (techert.co.uk – Registered 24th January 2022).

Also related fake payment gateway / human based credit card relaying “cardpanel”: hxxp://payture.icu/admin/ maybe with a Russian developer named “cosmocoder.site”

I’ve a long history of tracking electronics good scam websites (The 2015 to 2019 saga is here)… and the 2020 follow up is here.

Other technical notes: A strange development version of the site is on 185.219.83.120 as of 26th August 2021.

Older technical notes:
Hosted on 45.88.76.214 but hidden behind cloudflare. Payments appear to be partially sent via websockets to “kufar-dostavka.me”.

global-pay.site – just sends your card details to the scammer in Russia via chat service telegram (mikhartamonov1990, Михаил Артамонов, global-pay.site andreysafonov70@ya.ru)

This entry was posted in Uncategorized. Bookmark the permalink.

8 Responses to Credit Card Scam Shop (kerten.co.uk)

  1. Pingback: Electronics goods scam, 2020 version | thecomputerperson

  2. Ian Lloyd says:

    My 18yo son ordered a laptop from convincing site rettis. Online debit card payment authorised but when checking his bank account he saw that four payments were pending (£700+ for a £230 payment). Barclays contacted, they said contact merchant. Phoned number on rettis site went to voicemail so left a message. Also replied to their order confirmation email, saying refund the additional money taken. Card payment still pending so Barclays are saying wait til payments have gone out of the account and appear on the statement, put in a ‘claim’ via the Barclays app. So waiting for now. I showed son the site after finding it via a google search for a specific laptop so I feel responsible and will cover his loss. Now I’m the victim and I’m pissed off!!

  3. Make sure it is reported to actionfraud. The banks have such a poor response to this but Barclays, over the years, is by far the worst I’ve ever had dealings with. Regularly 30+ minute hold times to speak to anyone.

  4. Andrew says:

    I got suckered in just a day after the Ketron.shop site went live. It all seemed so legit, even with emails back and forth – but no phone number to call which is not unusual for on-line outlets, in itself. Ive waited and waited by the mail box until reality slowly dawned – Ive been scammed. Good job boys!

  5. Northerner says:

    Thanks for the warning. Thought the price was low (2/3 normal price) and had e-mail asking about item if it was reconditoned etc bounced back – became suspicious – found your website. Saved £132, Very grateful,

  6. Exactly why I wrote the page! I am very happy it helped. Shame that I do see many victims on trustpilot and other sites.

  7. Terry says:

    Thank You, Thank You, Thank You.
    I saw this TV on their website which was about £200 cheaper than Currys are doing.
    So I went to Currys to price match the TV. They were a little concerned about how big the price difference was and said that they could not beat it. So I went home and looked up the company and found your website. The rest is history THANKYOU SAVED ME £700.

  8. I’m very happy it helped you. I wish more people researched before buying from a website they’ve never heard of.

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s