Anatomy of a Puppy Scam Part 2: The Organization
An Investigation by Tokyo_v2 and wondersmith_rae
The previous edition of Anatomy of a Puppy Scam detailed how the Tiny-Teacup puppy scam works by tricking people into sending money for a puppy that never existed. Additionally, we introduced you to Layla Mandi Tayeb the CEO/Marketing Genius/Author/Dog Breeder. In part 2 we dive into the structure behind Tiny-Teacup dot com and what methods we used to make a connection between accounts and organizations in order to verify our intelligence.
We designed a chart to help explain the data connections between Layla and the numerous domains, social media accounts, and emails we found. Only the main sources of information are included in the chart so we can break them down individually.
Domain chart created in Adobe Indesign
Connecting Layla to Tiny-Teacup
We started this journey with only a collection of scam warnings and a fraudulent website. We needed to be able to connect the two sources through verifiable data. In order to do this, we began researching the Tiny-Teacup domain. Unfortunately, the registrant of Tiny-Teacup had WhoisGuard on their account so no Whois information was available, historical or otherwise. We would need to get this connection through other resources.
We were sure that Layla was connected to the Tiny-Teacup site so we investigated her personal domains including laylamandi dot com using RiskIQ to validate this assumption. Running this scan pulled up the historical whois data prior to 2017 showing it was registered to Layla.onepure@gmail.com as well as the person we call Registrant 1.
Pivoting on the email above and scanning within RiskIQ provided us a long list of domains also registered to layla.onepure@gmail. All of these domains show as being expired, however, we are able to determine a pattern of puppy sales linked to Layla’s email address.
Despite being expired, the Whois data on these domains is still very useful for historical details. Running down this list, we checked each domain and started compiling a report. We found email addresses, physical addresses, phone numbers, and other organizations that were registered to Layla.
Social Media
Alongside the domain search, we began correlating all of the domains with social media accounts. It became apparent that Twitter and Instagram were Layla’s main form of communication via social media across the board. One-at-a-time we searched the domains on Twitter and nearly every time we got a hit.
Using Twitter’s Password reset option on every account, we established partial emails that enabled us to either guess the email or validate it against other domains on the list.
This was a painstaking task, but once we found all of the emails associated with the accounts we ran them through RiskIQ, Intelligence X, and Google once again to see what we could find associated with them. In total, we found 4 Instagram pages, 8 Twitter accounts, 2 LinkedIn pages, 2 Youtube accounts, 1 Skype, and 1 Wechat account. These accounts are a mix of personal and “business” accounts and each one followed one of the other accounts which helped validate their association.
Taking a deeper look at one of the Youtube accounts for Posh Pocket Pups we noticed it has two interesting videos. One is an instructional video on how to make payments, and the other is a testimonial from a happy customer.
Instructional payment video
Happy customer
Using the above still frames we did a reverse image search in Yandex and found pages of matched images. From these images, we determined the videos were made by hired actors who sell a lot of other questionable products and services.
Addresses and Phone Numbers
Addresses:
Through the many complaints online, Whois data, and social media accounts we were able to create a list of addresses forming a pattern. The scams all revolve around 4 locations: Ontario, Dubai, Florida, and California. One address we ran across more than the others was 4281 Express Lane Sarasota FL 34238. A search of Google determined that this location is a freight forwarder used in many other scams. The California addresses tracked to co-working spaces or bars and none were listed as legitimate dog breeding locations. The other addresses we found align with Layla’s history of being born in Canada and moving to Dubai.
Phone Numbers:
Over the course of this investigation, we acquired over 15 phone numbers correlating to Layla and the numerous scam complaints online. Many of the numbers appeared to be burners or no longer in service but we were able to track one directly to Layla using Lampyre. The specific numberappeared in many of the Whois reports as well as scam reports posted online. Although unconfirmed, we assume this was probably her real phone number at one point.
The Accident
Many complaints filed against Tayeb claim that in addition to puppies, that her need for expensive surgery, physical therapy, and a wheelchair is also a scam.
We designed a timeline of photos and situations surrounding her accident to better determine whether her fall could be a part of Layla’s scam or a legitimate tragic event.
Accident Timeline created in Adobe Indesign
In an attempt to confirm details about her fall and subsequent paralyzation, we began by geolocating the spot of her accident. On Dec 13, 2012, a Twitter user posted to Layla’s Twitter account asking if her injuries were the result of a car accident. Layla responded that she fell from a balcony and posted a photo.
Using Yandex, we performed a reverse image search on this photo and found similar listings for Little Eden Bungalows in Thailand.
A Google image search of “Little Eden Bungalows Thailand” quickly led us to the photo below. When we compare the images side-by-side there are quite a few similarities indicating that this is, in fact, the correct location.
Post about Layla’s accident
Layla in the hospital for her accident
On April 5th, 2016 Layla made a post on Twitter that mentioned her travel to India for “treatment” for her spinal injuries.
On February 10, 2017, she posted about being left in her wheelchair on board a flight from Vancouver to Beirut.
The consistent timeline, along with the recent tags on Instagram of her in a wheelchair indicates that her injuries are most likely not a scam. We cannot, however, confirm that fact or whether the large amounts of money she requested on crowdfunding campaigns are legitimate.
Registrant 1 and the Mystery Reviewers
Despite their affiliations to Layla, we cannot definitively associate this person with the puppy scams. For this reason, we have decided not to name them in this article but we will illustrate how they fit into the puzzle.
This person is listed as registering laylamandi.com which does not appear to be a scam site. Upon further investigation using people search sites, however, we find that R1’s address is listed as 4281 Express Lane Sarasota FL 34238. Since this address is used in many of the other scams we proceeded to look further into R1.
Using their name, we tracked down all of R1’s social media accounts including Twitter and found that they were following both Layla and PoshPocketPups. If R1 was unaware of the scams involving dogs I find this to be an odd coincidence.
Mystery Reviewers
Running Spiderfoot HX on Tiny-Teacup provided a ton of information about the domain, including scraping the names of the reviewers from the page.
We wanted to see if these reviewers were real people so we grabbed one of the names Ahmad Alami and looked into the connections that Spiderfoot provided for this person.
The profile was made up of mostly social media accounts with some website accounts like Reddit mixed in. This seemed fairly normal until we looked deeper into any one of these accounts and found that Ahmad Alami appears to be a bot. There is a distinct possibility that any of these accounts could be a false positive and a different Ahmad Alami but none of them had any real content associated with them.
One Pure Beauty
Another avenue we explored during the investigation was Layla’s business One Pure Beauty. One Pure is marketed as a halal beauty company based in Dubai run by her and a man named Suhail Scott Tayeb. Scott seems fairly unassuming and he works in Real Estate, acting, and investing.
When Layla moved to Dubai and converted to Islam she took the last name of Tayeb, therefore, we believe they could have bee married in Dubai.
We didn’t find any verifiable scam activity when searching through Scott’s history, however, it bears mentioning that we did find he is followed by poshpocketpups on Twitter.
Final Thoughts
On August 14, 2017, a Press Release published in Digital Journal mentions the sale of Posh Pocket Pups to a Dubai woman named Dana Farmer. According to Wikipedia, “Digital Journal is a Canadian Internet news service that blends professional contributions with user-submitted content”. Due to the nature of Digital Journal’s business, at this time we are uncertain of the legitimacy of this article or the sale of Posh Pocket Pups in 2017.
The evidence found throughout our investigation, however, illustrates a direct correlation between Layla Mandi Tayeb, PoshPocketPups, and Tiny-Teacup. We show numerous accounts of how the scam has played out in real life as well as people saying they spoke directly with a “Layla Tayeb”. Sadly, due to the methods of money transfer and the scam crossing over several countries, it will be extremely difficult for law enforcement to hold Layla accountable for her actions. One way we can fight scammers like Layla is by spreading awareness and educating consumers on how to spot a scam. We can also prevent scams by helping to educate consumers on using safe online buying practices.
Currently, there appears to be no concrete law or regulation in the U.S. for the sale and purchase of dogs and puppies online, aside from any law pertaining to a signed puppy sales agreement. It is currently legal to sell a puppy or litter of puppies online with very little oversight. If an individual within Canada wants to import a puppy from another country, they will require a commercial import license from the Canadian Food Inspection Agency.
There are some other useful ways to prevent being scammed when buying a puppy online, the USDA does maintain a list of active, licensed breeders within the US and the site ipata.org has an updated list of active pet scams.