It went to the team email, not a lm.
My guess would be that they make a new code for each conference. Easy enough to come up with a word that looks legit and tack a number onto it, harder to come up with an event description (and maybe even event-specific images) that look legit. Iâd put a $20 on the farming conference mentioned above having the code âfarm23â.
Theyâre definitely looking for people/orgs that are likely to attend specific events, otherwise it wouldnât have the conference date/location, but itâs unlikely they sought out FIRST Champs as a target. They probably just found the event info through press releases or the convention center schedule.
To do some OSINT of my own:
Exhibitors Hub, LLC (the websiteâs operator) is a registered LLC (in May 2021). Unfortunately in Delaware, so good luck finding any more info on them that way.
The associated phone number is also found on another website: expoplanners.net/contact
There is a different phone number on the Expo Planners site which has reports of being a convention center room booking scam that go back to August 2021, for a variety of different shows/expo centers.
A fun quote from the Expo Planners site:
As we understand that there are tens of travel agencies out there, we promise your experience with expo planners will be different, as our clientsâ satisfaction always comes first.
Tens? Thatâs a lot! Or⌠waitâŚ
Anyway, searching âAs we understand that there are tens of travel agencies out thereâ on Google brings me to another similar site: expo-key.com
The address on the Expo Key site is a Registered Agent service in Wyoming, so that doesnât help much. They list Expo Key, LLC in their privacy policy, registered in Florida in April 2022. The owner is listed as âKarim Mohamed Aliâ with an address that leads to an apartment in Dubai, specifically a complex that appears to only house airline staff for Emirates Airlines (the relationship to travel is odd).
The address leads me to yet another similar expo booking type website (uaebusinesstravel.com) and a âglobal online marketing and digital advertising firmâ (ehbsolution.com) that lists a US address of a different registered agent firm, but⌠also in Wyoming?
UAE Business Travel claims to be âone of the largest Travel Management Companies (TMC) in United stateâ. First we have âtensâ of travel agencies, and now only a single âUnited stateâ, lol.
EHB Solutions has a LinkedIn page (with a few associated employees): EHB Solutions LLC | LinkedIn
The phone number for Expo Key brings me to another expo booking site: exhibitsandhotelbooking.com
Exhibits and Hotel Booking lists the same Wyoming Registered Agent address as Expo Key (but not EHB Solutions). Exhibits and Hotel Booking also uses the acronym EHBâŚ
From some digging on LinkedIn, EHB Solutions appears to have connections to Egypt. Searching a quote from Expo Key (âpremium corporate travel agency, with high quality experienced travel.â) brings me to another bookings site (quick-bookings.com). The Quick Bookings site lists an address that is the same as the Registered Agent that Expo Key LLC lists in their Florida registration (not the Wyoming registered agent on the Expo Key website). Like Expo Key LLC, Quick Bookings LLC is registered in Florida (in March 2022), but the address is in Egypt this time. The names for Quick Bookings LLC are âKamel Mohamed Saifalnasr Kamel Adbullatifâ and âZiad Salehâ.
Both Expo Key LLC and Quick Bookings LLC were filed by an âauthorized representativeâ named Ed Tsuji.
More on Ed Tsuji
As far as I can tell, Ed (Edward) Tsuji was a lawyer, but resigned from practicing law in 2002 after pleading guilty in federal court to âunlawfully structuring transactions with financial institutions in 1996 to evade Internal Revenue Service currency reporting requirementsâ. It appears that heâs recently taken to acting as an âAuthorized Representativeâ for people registering LLCs in various states as an affiliate or employee of MyCompanyWorks, an Incorporator and Registered Agent company. While the court case is interesting, Ed Tsuji is affiliated with hundreds of filings, many from seemingly legitimate businesses.
Based on some googling, âZiad Salehâ may be a pseudonym or alternate name. I found âZiad Arafatâ on LinkedIn, claiming to be CEO of EHB Solutions. Previously their name was hidden for me on the âemployeesâ tab for the EHB LinkedIn page, but I was able to access the profile directly after finding it on google.
He lists his previous employer as âOtrix Hotel Bookingâ which is on a lot of scam lists for conferences 1, 2, 3. The Otrix website (otrixhotelbooking.com/otrix-book-bright) is suspiciously similar to the Exhibits and Hotel Booking website (exhibitsandhotelbooking.com/index.php/book-bright). Another website from those lists (expohousingsolution.com) provides the same Wyoming address as EHB Solutions.
The person that claims to be the current CEO of Otrix on LinkedIn also lists âOn Time Solutions LLCâ, Conventioneers, and âehsâ (probably expohousingsolution.com from above). Conventioneers LLC (conventioneers.us) is on many âconvention housing scam warningâ lists (like Otrix) and is registered in Florida.
âOn Time Solutions LLCâ (ontimesl.com) claims to be an Egyptian call/telemarketing center. It is registered in Florida as On Time Booking LLC (filed by Ed TsujiâŚ), so it may also be a hotel booking scam. On Time Booking LLC is registered to this person, who I also found on LinkedIn as the Owner. They have some very âethicalâ marketing on their website, like âEgyptâs labor laws also provide the legal flexibility that will enable Customer Services Representatives to operate on a 24 X 7 basisâ.
This whole thing appears to be a scam ring based in Egypt that creates a ton of shell companies using similar websites. Occasionally they file in different states, or donât file an LLC at all. Many of them are interconnected, but there are some fractures in the web. This is very similar to how many telemarking scam organizations operate, like tech support scammers. Lots of shell companies, sometimes a real office, many connections between different parts of the web of lies. Itâs basically a patented formula.
The âconvention center housing scamâ industry appears to be thriving, judging by the number of conventions that publish a list of scam companies. At minimum, theyâre pulling in enough money that Otrix can afford a real office with branding on the glass.
There are some other leads along the way that I skipped, and Iâm sure I could uncover a lot more if I put more effort into it. Iâm happy enough with finding some of the leaders of parts of the ring.
As a side lesson for the kiddos here:
Iâm not an expert at gathering OSINT, and I was still able to find this much about the people running this scam, just starting from a seemingly nondescript website with no substantial information. Keep your information off the internet. Nothing is anonymous. A determined actor can find the connections, and they donât have to be an expert.
20 Likes
This got sent to our general contact email address, not an email address thatâs in TIMS or in any FIRST system.
If I had to guess this list was probably a FRC Team general contact list someone had composed at some point.
I have reported the email to FIRST IT as well as Mailchimp and Jotform, and the domain to GoDaddy (The Registrar).
For anyone here who received this email, Mark it as âPhishingâ (Under the 3 dot menu in Gmail) and mark as spam.
This will help any future emails get flagged in the meantime.
1 Like
At least they are trying 
1 Like
Given that I had signed up to be alerted when championship housing opened (on the FIRST site) a few days ago, I was expecting this email from FIRST so it could have got me, except that the prices were so high that there is no way we would have booked through them.
However, it went to the team email address, which gets forwarded to me and a couple of students. I marked it as a phishing attempt in gmail.
The promo codes the best part of this email
I just got this email from exhibitorshub. Kudos to this scammer, they are putting in some serious work here! The email and website are well done.
4 Likes
I never received an email but did just get a voicemail on the Google Voice number we use on our teamâs website. They referenced the Championship and to call about booking reservations.
Our young team received the email yesterday, so they are still at it.
Itâs not just emails. High-Pressure phone call scams have begun.
Just heard from a local FRC Mentor - he got a phone call from someone that âHousing is open, itâs almost full, you need to hurry and put down a $5,000.00 deposit on hotel rooms RIGHT NOW!â
Thank goodness he didnât - he called me instead.
Iâve sent him a link to this thread, hopefully he can post details (and possibly warn FIRST).
1 Like
We also got a call about Houston hotels for âThe First Showâ lol
Watch out if they send you this image. Lesson learned to be vigilant.
This image is what they tried to get me to fill out for 5000.00 and the salesperson is named Zoe at False High Pressure First Robotics Reservations site E-HUB. Their number is below.
530-927-5803. Frustrating waste of time.
1 Like
Wow. Iâm so sad to see that this scam has reached so many and morphed into new channels. In 20+ years, this is definitely a new one for me. Stay vigilant!
2 Likes
It looks like these scam domain are registered with:
We can report the scam abuse with this form:
https://cp.enom.com//help/abusepolicy.aspx
Who knows if the registrar will actually take down the sites but I should at least create some headaches for the scammers. We can also report the phone numbers used here:
https://consumercomplaints.fcc.gov/hc/en-us/requests/new?ticket_form_id=39744
We can also report to mailchimp where applicable:
1 Like
Maybe FIRST should send out a notification to lead mentors to let them know this scam is going around? I would hate for a team to fall victim to it.
5 Likes
I was about to come here and post the same thing.
FIRST needs to send a warning announcement to all teams about this immediately.
This could cause serious issues with teams should they fall victim.
-Glenn
9 Likes
Unfortunately, that isnât actually the number they are calling from. Like any âgoodâ foreign scam company, they are spoofing their phone numbers. It seems they are a cut above because theyâre spoofing their number to match the phone number of small organizations, probably in the hopes that it will come up positive on your caller ID.
I just sent a request to HQ to look into this (with a link to this thread) and to warn all teams to ignore this fraudulent effortâŚ
1 Like
The last Team Blast email (which I received about 2.5 hours ago) warned about suspicious housing emails and identified the correct housing partner.
1 Like