Selfxemployed: The Final Piece of the Puzzle

We've already seen that Renniel has admitted that the site ringtonezgalore.net was his. He said over at aa419.org that "If you're wondering, yes, I owned RingtonezGalore.net for PPC purposes." It turns out that on Digg.com there is a submission advertising a ringtone available on the site ringtonezgalore.net.

Notice that the person who submitted the link has the alias selfxemployed. Renniel has a Myspace profile with the URL myspace.com/selfemployedislandboy.

Renniel is self-employed and "islandboy" refers to the fact that he is Filipino. ("Island boy" is a nickname for someone from the Phillipine islands.) The similarity between "selfemployedislandboy" and "selfxemployed" is interesting in itself, but it is when we do a search for selfxemployed that things get really interesting.

The site Blackhatworld.com is one place where we find someone who uses the name selfxemployed. In the thread "My first mashup vid/song", where user mjd2nd asks for advice on a blend that he made, selfxemployed tells us "my whole life once revolved around making blends, but i gave up that part of my life to venture into internet marketing." As many of you already know, Renniel was once a blend DJ and he even stated that DJing was "his true passion".

On May 31st, 2009, selfxemployed started the thread "How much trouble can I get into if ...", where he asks about the legal ramifications of scamming men out of their money by promising them a meet-up with a girl if they purchased a an e-book for her:

I promised horny guys a meet up if they bought me an ebook that i really wanted but the ebook product was mine? For those of you who downloaded the e-whore twister method know what im talking about, but that method promises a cam show. Should i promise that instead of a meet up to avoid any troubles? Isn't this close to theft on false pretenses? Thanks in advance.

The question of the possible danger of getting in trouble for this scam didn't appear to be settled by the replies he got, because four months later, on September 28th, 2009, we find someone calling himself selfxemployed on the site expertlaw.com who started a thread "Scammed By a Girl I Met Online" that asked about a similar situation. But in this case, selfxemployed asks about the situation from the point of view of the victim.

I met a girl online through Match - she said she would meet up with me if I purchased a report for her that she needed for class. I sent her proof that I bought it and I asked her if I could send her the full paper during our meet up and she agreed. Like the idiot I am, I included the transaction id when I sent the proof. Now the girl is having cold feet to meet up. What would you guys consider this? I buy the paper, now she doesn't want to meet up. I suspect she is reaping profits by selling the paper and I may not be the only one. If this were true, would this be considered theft by deception and is there anything I can do? Thanks in advance.

Since this is a legal question, the answer would depend on which state this person is in. He says he is in New Jersey.

I'm in New Jersey. She claimed to be a college student, told me where she was going to school and all. The paper I bought seems to be college material. What if this "girl in need" isn't really a girl at all and if it's some guy making sales off the purchases? I sent proof, I didn't send the full paper and she disappeared. Maybe she got it from someone else? Who knows.

Now, what is the likelihood that someone that was actually taken by this scam just happens to have the same online alias as someone who asks about operating the scam? Which seems more realistic, that these are in fact two different people, or that this other selfxemployed is just the scammer trying to get better advice on what sort of legal recourse his victims would have? I'd say the latter, and I'd also say that seeing as his potential legal trouble depends on which state he lives in, and that he probably wanted the best legal advice possible, that he told the truth about living in New Jersey.

These two selfxemployeds are probably the same person, but we still find yet another one on the site Freelancer.com who not only says that he lives in New Jersey, but also in Jersey City, where Renniel lives.

This one placed an ad on February 7th, 2010, looking for people to promote his adult site by uploading videos to sites like YouPorn and RedTube.

Getting back to the selfxemployed of Blackhatworld.com, we see that on March 28th, 2010 he started a thread "I have my own personal vigilante", where he complained that someone has been getting his sites shut down and wanted advice on what do do about the person.

Alright for the past two months or so, this guy has been following my ads and replying to them, he then gets my auto-reply which is hosted on a web host and then he contacts my web host with a bunch of spam complaints and gets me shut down. I figured I would stop posting in his city, which worked for a little bit then I guess he found me again and is threatening to shut me down again. I have his IP, but I'm still not sure what to do with it. I don't want to do anything extreme, I just want it so he can never bother me again. Any advice is appreciated.

P.S - Yes, I've dealt with other people that have threatened me before and but this is the only guy that has managed to actually shut down my web host and I have a strong feeling he will continue to do so.

The first time that I had any contact with the person who operates the essay scam was on March 1st. Here was the message with some of the headers.

X-Apparently-To: ***@***.*** via 76.13.12.211; Mon, 01 Mar 2010 21:44:30 -0800
Return-Path: <morality@echo13.my365host.org>
X-Originating-IP: [79.143.184.201]
Received: from 127.0.0.1 (EHLO echo13.my365host.org) (79.143.184.201) by mta177.mail.sp2.yahoo.com with SMTP; Mon, 01 Mar 2010 21:44:29 -0800
Received: from morality by echo13.my365host.org with local (Exim 4.69) (envelope-from <morality@echo13.my365host.org>) id 1NmJyj-00054Y-De for ***@***.***; Mon, 01 Mar 2010 22:44:41 -0600
To: *** <***@***.***>
Subject: RE: Craigslist ad
Date: Mon, 1 Mar 2010 22:45:05 -0600
From: lushizxlauren <lushiizlaurenx@gmail.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1_ae985371202043c6b5a01865271fd84f"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - echo13.my365host.org
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [740 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - echo13.my365host.org
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php
X-Source-Dir: moralityresearchpapers.org:/public_html/gmail

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash (i need someone with paypal), you`ll just get blocked. there are 5 essays on the site below, all i need is 1 (it doesnt matter which one) but all 5 would be great too ;] no one has pulled through yet, so let me know if your down.

HumanMoralityResearch.net // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO lushiizlaurenx+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

The first site of his that I got shut down was moralitytermpapers.tumblr.com. This happened on March 7th.

Date: Sun, 7 Mar 2010 14:07:51 +0000
From: Tumblr Support
To: *****
Message-Id: <4b93b24ea781e_544db231303be@tumblr.assistly.com>
In-Reply-To: <SNT118-W348F5519C524EDC0A051AC4360@phx.gbl>
Subject: Re: Tumblr Scam Site (Case 19162)
Content-Type: text/plain
Content-Transfer-Encoding: Quoted-printable
X-Mailer: Assistly Support Platform
Return-Path: support@tumblr.com
X-OriginalArrivalTime: 07 Mar 2010 14:07:51.0954 (UTC) FILETIME=[9353E720:01CABDFF]

__________________________________
Please reply above this line
------------------------------------------------------

That blog has been suspended.

Marc

--
Tumblr Support
support@tumblr.com

March 28th, when selfxemployed wrote about his sites being shut down, is actually only three weeks after I got the site shut down. He might have said "months" instead of "weeks" by accident, because in a later post on April 8th that he made in someone else's thread called "CL Self Proclaimed Cop", he says that the vigilante has been bothering him for two weeks, not a couple months. He also says that someone posted his ads on a scam forum. My first post about the essay scam was made on March 31st.

I've been going through the same thing for the past two weeks. This guy just doesn't have anything better to do. I have an autoresponder script hosted on my web host which shows the server info in the headers, so he sends multiple complaints from different emails to my hosts and they shut me down. He even posted my ads on a scam forum, lol. Then when the host would shut me down, he would write me an email taunting me. There's no point of posting his email though for our BHW family to spam because its probably a disposable one. I do have his IP though, we can all send complaints to his ISP My best piece of advice is to just ignore it and keep it moving.

Another thread that selfxemployed started was "[WTB] Verified Indian PayPal account".

This was on April 28th, while his sites were still being shut down. Why would he want a PayPal account in India? Well, people involved in fraud sometimes use foreign PayPal accounts in order to make it easier for them to evade the authorities.

On May 3rd, he posted "[WTH] Host my PHP Autoresponder". He was specifically looking for an offshore hosting service that would ignore complaints about his websites.

All of this is interesting enough, but there's even more. There is another selfxemployed. This one is on the site CodingForums.com. Back on May 9th, 2009, he posted the thread "Delayed AutoResponder Errors", where he asked for advice about some problems he was having with the programming language PHP. The errors were in a file on his site that had the path

/home/sandip89/public_html/email/autoresponder.php

The file autoresponder.php is used to generate automatic email responses. It has the same name as the file that was used to generate the first email message I received from the scammer which I showed you earlier.

X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php

The structure of the two paths is similar, with one of the exceptions being that in the forum post, instead of the home directory being named morality, like in the first message, it is named sandip89. Sandip89 was also the name of the account that the scammer had with HostGator, and Sandip is the name of one of Renniel's friends.

Delivered-To: ***@***.***
Received: by 10.229.81.8 with SMTP id v8cs36171qck;
Fri, 12 Mar 2010 08:59:21 -0800 (PST)
Received: by 10.101.209.21 with SMTP id l21mr1269306anq.114.1268413159513;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Return-Path: <sandip89@gator625.hostgator.com>
Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [69.56.236.19])
by mx.google.com with SMTP id 6si2925646gxk.72.2010.03.12.08.59.18;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Received-SPF: pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) client-ip=69.56.236.19;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) smtp.mail=sandip89@gator625.hostgator.com
Received: (qmail 2201 invoked from network); 12 Mar 2010 16:59:27 -0000
Received: from gator625.hostgator.com (174.132.105.226)
by gateway01.websitewelcome.com with SMTP; 12 Mar 2010 16:59:27 -0000
Received: from sandip89 by gator625.hostgator.com with local (Exim 4.69)
(envelope-from <sandip89@gator625.hostgator.com>)
id 1Nq8Cf-0006iC-JM
for ***@***.***; Fri, 12 Mar 2010 10:59:13 -0600
To: *** <***@***.***>
Subject: RE: Your CL Ad
Date: Fri, 12 Mar 2010 10:59:13 -0600
From: aznsensationx <therealaznsensationx@gmail.com>
Message-ID: <bc174ec81efb2c4706b9a8abdeb07b5d@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_bc174ec81efb2c4706b9a8abdeb07b5d"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator625.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32266 32269] / [47 12]
X-AntiAbuse: Sender Address Domain - gator625.hostgator.com


--b1_bc174ec81efb2c4706b9a8abdeb07b5d
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

MoralityEssaysGalore // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy one of the essays (doesnt matter which one), forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

But this is still not all. There is yet another selfxemployed on the site WickedFire.com. On April 6th, 2010 he posted an ad titled "[WTS] Craigslist Personals Lead Service // Up to 1,000 Exclusive Leads".

This is almost identical to the ad that Renniel admits to posting on that very same day over at DigitalPoint.com. The rates offered are the same and the wording and formatting vary just slightly.

On this same site, selfxemployed advertises a delayed autoresponder that he says is perfect for e-whoring (pretending to be a girl online in order to scam men out of their money).

So let's see what he have now. The essential data we have found are:

1. Renniel admits to having owned the site ringtonezgalore.net.


2. Someone using the name selfxemployed promoted ringtonezgalore.net on Digg.


3. There is someone on the site Blackhatworld.com who calls himself selfxemployed who had a passion for being a blend DJ, just like Renniel.


4. This selfxemployed talked about running an e-whoring scam that involved him pretending to be a girl who promises to meet a man if this man would buy an e-book for her first.


5. On the site expertlaw.com, someone called selfxemployed discusses the same scam and states that he lives in New Jersey.


6. On the site Freelancer.com there is a selfxemployed who markets porn and says that he lives in Jersey City, Renniel's town.


7. The selfxemployed on Blackhatworld.com had someone shutting down his scam sites during the same time I was shutting down the essay scam sites. The person who shut down his scam sites posted about them on an anti-fraud forum, just like I posted about the essay scam sites on aa419.org.


8. There is a selfxemployed on CodingForums.com who had a site that used an email autoresponder that was in a directory for an account named sandip89, and sandip89 is the name of one of the HostGator accounts used for the scam. Also, Renniel has a friend named Sandip.


9. On the same day that Renniel posted his ad on DigitalPoint.com offering a Craigslist posting service, a selfxemployed on WickedFire.com also posted an ad for a Craigslist posting service, and except for minor differences it is identical to the one that Renniel posted.


10. This selfxemployed sold an email autoresponder that he said was perfect for e-whoring.

Now, given all of this, and given all of the evidence that was discovered back in May, and the evidence from the past two days, wouldn't you say that there is only one reasonable conclusion for us to make? Does this matter really need to be given any more thought? I don't think so, and I think that we can finally make up our minds and consider this case solved.

Merry Christmas, Renniel!

Renniel Fernandez Admits He Is xlastomohicanx

Well, Renniel has admitted that he is xlastohmohicanx, the guy who promoted KillerRingtones.net, just as did KillerRingtones of Digg. It's interesting that he didn't mention knowing anything about KillerRingtones at all in his posts at aa419.org. You'd think that the name would have rung a bell.

KillerRingtones and xlastomohicanx

Remember the Digg profile for KillerRingtones? This was the Digg profile for someone who calls himself Renniel Fernandez and advertised an iPhone giveaway on FreeShizznet.com, one of the sites used for the scam.




KillerRingtones spent a bit of time promoting the site KillerRingtones.net.




There is also someone on the site bicellphone.com who has promoted KillerRingtones.net. His alias is xlastomohicanx.




On answers.yahoo.com, there is also someone with the alias xlastomohicanx who promoted KillerRingtones.net. He'd reply to questions about where to get ringtones by telling the asker of the question to go to KillerRingtones.net. For example,

Where can i find this as a ringtone?
Where can i find a Family Guy ringtone?
Where can I find a website for ringtones that willnot damage my phone?

And many others.

On October 22nd, 2007, this xlastomohicanx got his license suspenended for thirty days in New Jersey.

My license was suspended by a judge on October 22, 2007 for 30 days. I called the DMV to see if I was allowed to restore it but they said that the municipal court never sent them anything about my license being suspended. So according to the DMV, my license was never suspended. The court DID take my license away from me and I haven't drove for 30 days. I even had to drop out of college because I had no means of transportation. My main concern is that if I call the municipal court and tell them that the DMV never received anything from them that they will suspend my license for ANOTHER 30 days. Are they allowed to do that because if they are, I will be extremely pissed. Thanks in advance.

I wonder who else in New Jersey might have had his license suspended for 30 days on October 22nd, 2007, and ended up having to drop his college classes because of it...

Privacy and Your Rights Research Paper

A sample ad

saturday bj fun - w4m - 27

Do you like deep throat bj? i do something new kind of Bj so let me know if you want a head around your part
i can probably not host but something may be worked out.. bj and possibly more if you are interested

A sample email message with headers:

Delivered-To:***@***.***
Received: by 10.42.213.66 with SMTP id gv2cs49103icb;
Mon, 20 Dec 2010 15:27:10 -0800 (PST)
Received: by 10.236.95.1 with SMTP id o1mr8839984yhf.67.1292887629869;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Return-Path: <authorx@gator1098.hostgator.com>
Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [69.56.159.26])
by mx.google.com with SMTP id i51si9111008yhd.109.2010.12.20.15.27.09;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Received-SPF: pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) client-ip=69.56.159.26;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) smtp.mail=authorx@gator1098.hostgator.com
Received: (qmail 7994 invoked from network); 20 Dec 2010 23:26:21 -0000
Received: from gator1098.hostgator.com (174.120.180.194)
by gateway07.websitewelcome.com with SMTP; 20 Dec 2010 23:26:21 -0000
Received: from authorx by gator1098.hostgator.com with local (Exim 4.69)
(envelope-from <authorx@gator1098.hostgator.com>)
id 1PUp8D-0008Jg-C2
for ***; Mon, 20 Dec 2010 17:27:05 -0600
To: *** <***@***.***>
Subject: ***
Date: Mon, 20 Dec 2010 17:27:04 -0600
From: laurenxlove89 <laurenxlove89@gmail.com>
Message-ID: <1cbe3fffa0c51213a88567c3ff6f475b@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_1cbe3fffa0c51213a88567c3ff6f475b"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1098.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1467 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1098.hostgator.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/authorx/public_html/reply/autoresponder.php
X-Source-Dir: freetrialsgalore.net:/public_html/reply

--b1_1cbe3fffa0c51213a88567c3ff6f475b
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, first off id like to say that im a real person and this is a real proposal. if you want to meet up, i need you to buy the research paper thats below.


Privacy and Rights Paper :: Buy Now!


first guy to send proof wins. i need the paper for my history class because i was instrcuted to write one but was too lazy and busy to. you can just send me proof like a receipt or one paragraph before we actually link up, then you can send me the full paper after we have our fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.

His new blog is privacyandrightspaper.blogspot.com.

Privacy and Your Rights Research Paper

Privacy and Your Rights Paper
Title: Privacy and Your Rights Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download Via Email

The PayPal business name he is using is Term Papers Inc and the email address he is using for his PayPal account is researchpapersgalore@hotmail.com.

Privacy First Research Paper

Here's one of Renniel's new ads:

newyork.craigslist.org/wch/cas/2115314709.html

Ass licking - w4m

Date: 2010-12-15, 10:46PM EST
Reply to: pers-cx5h8-2115314709@craigslist.org

Are you a kinky guy? if not, dont bother replying. i want all my holes satisfied tonight

This is a sample e-mail message including the headers:

Delivered-To: ***@***.***
Received: by 10.220.193.130 with SMTP id du2cs105144vcb;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received: by 10.100.4.13 with SMTP id 13mr4931369and.108.1292477525226;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Return-Path: <onthegoc@gator1294.hostgator.com>
Received: from gateway03.websitewelcome.com ([69.93.87.23])
by mx.google.com with SMTP id a19si4758204ana.7.2010.12.15.21.32.04;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received-SPF: pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) client-ip=69.93.87.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) smtp.mail=onthegoc@gator1294.hostgator.com
Received: (qmail 6321 invoked from network); 16 Dec 2010 05:31:38 -0000
Received: from 173.192.111.10-static.reverse.softlayer.com (HELO gator1294.hostgator.com) (173.192.111.10)
by gateway03.websitewelcome.com with SMTP; 16 Dec 2010 05:31:38 -0000
Received: from onthegoc by gator1294.hostgator.com with local (Exim 4.69)
(envelope-from <onthegoc@gator1294.hostgator.com>)
id 1PT6Rd-0007Cb-KA
for ***@***.***; Wed, 15 Dec 2010 23:32:01 -0600
To: *** <***@***.***>
Subject: ***
Date: Wed, 15 Dec 2010 23:32:01 -0600
From: brianaxcore <brianaxcore@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_b479a860b083f61149c309cb831b4d00"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1294.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1050 1047] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1294.hostgator.com


hey, *** im real and this is a real offer. if you want to link up, i need you to buy me the research paper below.

Privacy First Research Paper For $47.99

first come, first serve. i need it for my history class because i was supposed to write one but was too lazy to. you can just email me proof like a receipt or one paragraph before we actually meet up, then you can send me the full paper after we have fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.

This is the scam site:

privacyfirstresearchpaper.blogspot.com

Privacy First Research Paper
Purchase a research paper based on the history of privacy and the government.

Privacy First Research Paper
Title: Privacy First Research Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download via email

The email address he's using for his PayPal account his historyresearchpapers@hotmail.com.

Against the Bill E-Book

This is the website he's now using for selling the essays:

against-the-bill-ebook.blogspot.com

Against the Bill E-Book

Purchase the E-book of an author's point of view on the Bill.

Against the Bill E-Book :: $47.99
Title: Against the Bill

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate Download Via Email

Here's a sample email message:

Delivered-To: ***@***.***
Received: by 10.231.174.14 with SMTP id r14cs522332ibz;
Wed, 1 Dec 2010 21:23:19 -0800 (PST)
Received: by 10.213.3.66 with SMTP id 2mr261442ebm.82.1291267397933;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Return-Path: <wehostre@semi3.wrzhost.com>
Received: from semi3.wrzhost.com ([217.23.12.85])
by mx.google.com with ESMTP id s18si265192eeh.75.2010.12.01.21.23.17;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Received-SPF: neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) client-ip=217.23.12.85;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) smtp.mail=wehostre@semi3.wrzhost.com
Received: from wehostre by semi3.wrzhost.com with local (Exim 4.69)
(envelope-from <wehostre@semi3.wrzhost.com>)
id 1PO1dS-00087N-KG
for ***@***.***; Thu, 02 Dec 2010 06:23:16 +0100
To: *** <***@***.***>
Subject: ***
Date: Thu, 2 Dec 2010 06:23:14 +0100
From: isexynymphoi <isexynymphoi@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_a3a5bc5871ddd131ee4013ce17e6a1ce"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - semi3.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [875 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - semi3.wrzhost.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/wehostre/public_html/mail/autoresponder.php
X-Source-Dir: wehostreplies.net:/public_html/mail

--b1_a3a5bc5871ddd131ee4013ce17e6a1ce
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i have an interesting proposition before we meet up - hope you can handle it. if you are the first guy to send me the research paper below or proof that you bought it, we can meet up at a public place (starbucks or something) and then to my place. im a history major and i need it for one of my classes. whats in it for you? a friend with benefits ;] please dont ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get ignored. no one has pulled through yet, so let me know if your down.

Against The Bill E-Book // Buy It Now for $47.99


so basically, buy the research paper, send me the receipt, we meet up somewhere convenient then go somewhere private, have fun, after our fun is done, you send me the e-book and if you're good, then you'll be hearing from me again. SEND THE PROOF TO isexynymphoi+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

The email address he's using for his PayPal account is ebooksonhistory@hotmail.com.
Using Renniel's name, I sent an email message to this address to tell this guy what I thought of him. I got back a response:

Delivered-To: ***@***.***
Received: by 10.100.45.20 with SMTP id s20cs24918ans;
Thu, 2 Dec 2010 06:20:39 -0800 (PST)
Received: by 10.142.126.14 with SMTP id y14mr320913wfc.132.1291299638460;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Return-Path:
Received: from snt0-omc3-s29.snt0.hotmail.com (snt0-omc3-s29.snt0.hotmail.com [65.55.90.168])
by mx.google.com with ESMTP id g35si1396190qcs.66.2010.12.02.06.20.37;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Received-SPF: pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) client-ip=65.55.90.168;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) smtp.mail=ebooksonhistory@hotmail.com
Received: from SNT142-W14 ([65.55.90.136]) by snt0-omc3-s29.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 2 Dec 2010 06:19:39 -0800
Message-ID:
Return-Path: ebooksonhistory@hotmail.com
Content-Type: multipart/alternative;
boundary="_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_"
X-Originating-IP: [98.221.193.230]
From: Steve Doe
To: <***@***.***>
Subject: RE: You are such an asshole
Date: Thu, 2 Dec 2010 09:19:39 -0500
Importance: Normal
In-Reply-To:
References:
MIME-Version: 1.0
X-OriginalArrivalTime: 02 Dec 2010 14:19:39.0672 (UTC) FILETIME=[F4B19980:01CB922B]

--_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


Aw, the copies are sold out Mr. Fernandez. I'm sorry. You can try
getting a copy from the last two customers listed on the blog. I'll see
you around at "St. Peters".

The header field X-Originating-IP, which is the IP address of the machine from which the message was sent, has the value 98.221.193.230. If you go to cqcounter.com/whois/ and look up this IP you'll see that it is owned by Comcast in Jersey City, NJ, where Renniel lives.

the-act-and-rights-paper.blogspot.com

Another one. Here is the ad:

http://newyork.craigslist.org/que/cas/2027223593.html

Crazy and kinky - w4m

Date: 2010-10-26, 5:15PM EDT
Reply To This Post

Its a deadly combo. want to fck this horny chick from woodside queens? I will def. rock your world so i hope you bring your A-game

Here is the message.

Delivered-To: ***@***.***
Received: by 10.229.249.129 with SMTP id mk1cs90668qcb;
Tue, 26 Oct 2010 15:14:18 -0700 (PDT)
Received: by 10.227.129.146 with SMTP id o18mr7357560wbs.45.1288131257374;
Tue, 26 Oct 2010 15:14:17 -0700 (PDT)
Return-Path: <delayedr@nl5>
Received: from nl5 (nl5.underhost.com [217.23.8.84])
by mx.google.com with ESMTP id f33si14172325wbf.25.2010.10.26.15.14.16;
Tue, 26 Oct 2010 15:14:17 -0700 (PDT)
Received-SPF: neutral (google.com: 217.23.8.84 is neither permitted nor denied by best guess record for domain of delayedr@nl5) client-ip=217.23.8.84;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.8.84 is neither permitted nor denied by best guess record for domain of delayedr@nl5) smtp.mail=delayedr@nl5
Received: from delayedr by nl5 with local (Exim 4.69)
(envelope-from <delayedr@nl5>)
id 1PArrO-0007JC-47
for ***@***.***; Wed, 27 Oct 2010 02:19:14 +0400
To: ***** <***@***.***>
Subject: *****
Date: Wed, 27 Oct 2010 02:19:14 +0400
From: STEPHxNY <cutiiefromnewyork@gmail.com>
Message-ID: <858a974ef196f0aef3819984bfdf3c3c@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_858a974ef196f0aef3819984bfdf3c3c"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - nl5
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [557 553] / [47 12]
X-AntiAbuse: Sender Address Domain - nl5

--b1_858a974ef196f0aef3819984bfdf3c3c
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey **** the name is steph. just looking for fun with someone local but i need a favor first. before i can have any fun, i have to write this history paper first but i've been to lazy and busy with other things. i found a paper that's already pre-written but you need paypal to buy it. i do have paypal but it has a negative balance so i was wondering if you could purchase it for me. here's the link.

Constitutional Rights E-Book - $47.99 Buy Now!


so here's the plan, buy the paper and send me proof you bought it. it can be the receipt or one paragraph or both, which would be better. once i get proof, we can meet up somewhere local and public and talk for a bit until we're both comfortable to go back somewhere private. i can host if you can't, i can also travel. we have some fun when we head to my place or yours, then after you can send me the full paper. if you received this email, that means the offer is still open.

Here is the essay site: the-act-and-rights-paper.blogspot.com

The Act and Your Rights E-Book

Purchase The Act & Your Rights E-Book
Title: The USA Act

Price: $47.99

Pages: 8

Delivery: Instant Email Download

Description: An 8 page E-book that describes how the USA Act has negatively affected our constitutional rights since it's passing. (Buy Now)

His PayPal email address is historyebooksforsale@hotmail.com.

constitutional-rights-paper.blogspot.com

Another one: http://constitutional-rights-paper.blogspot.com

Constitutional Rights & The USA Act E-Book
Title: The USA Act

Price: $46.99

Pages: 8

Delivery: Instant Email Download

Description: The Bush Administration submitted the law to Congress thirteen days after the tragic events that occurred on September 11, 2001. The vicious attacks on the World Trade Center and the Pentagon changed the way the United States government view the freedom given to those living on United States soil. A new philosophy has emerged (Buy Now)

His new PayPal email address: ebooksonsale@hotmail.com.

store.payloadz.com/details/834676-Other-Files-Documents-and-Forms-USA-PA.html

Here is a another site that he is using for the scam: http://store.payloadz.com/details/834676-Other-Files-Documents-and-Forms-USA-PA.html.

usa-research-paper.blogspot.com

He has a new site, usa-research-paper.blogspot.com

The USA Act Research Paper
Title: The USA Act

Price: $46.99

Pages: 8

Delivery: Instant Email Download

Description: By the time the bill was signed into law, Daschle and Leahy supported the bill. Whether fear was the influence that changed their minds or a sudden change of heart, the fact of the matter is the bill was rushed into law by a government (Buy Now)

The email address he is using for his Paypal account is cheappapersgalorex@hotmail.com. The business name is still Term Papers Inc. Here is a new sample email message with headers:

Delivered-To: ***@***.com
Received: by 10.231.79.19 with SMTP id n19cs183333ibk;
Thu, 21 Oct 2010 13:36:18 -0700 (PDT)
Received: by 10.150.11.20 with SMTP id 20mr4082846ybk.63.1287693377291;
Thu, 21 Oct 2010 13:36:17 -0700 (PDT)
Return-Path:
Received: from gateway02.websitewelcome.com (gateway02.websitewelcome.com [67.18.53.20])
by mx.google.com with SMTP id w24si21397506ybk.65.2010.10.21.13.36.16;
Thu, 21 Oct 2010 13:36:17 -0700 (PDT)
Received-SPF: pass (google.com: domain of mauricec@gator1083.hostgator.com designates 67.18.53.20 as permitted sender) client-ip=67.18.53.20;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of mauricec@gator1083.hostgator.com designates 67.18.53.20 as permitted sender) smtp.mail=mauricec@gator1083.hostgator.com
Received: (qmail 977 invoked from network); 21 Oct 2010 20:36:16 -0000
Received: from gator1083.hostgator.com (174.120.170.130)
by gateway02.websitewelcome.com with SMTP; 21 Oct 2010 20:36:16 -0000
Received: from mauricec by gator1083.hostgator.com with local (Exim 4.69)
(envelope-from )
id 1P91s5-0002VB-PC
for ***@***.com; Thu, 21 Oct 2010 15:36:21 -0500
To: *** <***@***.com>
Subject: ***
Date: Thu, 21 Oct 2010 15:36:21 -0500
From: orallyxtalentedchick <orallyxtalentedchick@gmail.com>
Message-ID: <4ae73ef9e3480302040daaf8acfbd842@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_4ae73ef9e3480302040daaf8acfbd842"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1083.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1361 1359] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1083.hostgator.com

--b1_4ae73ef9e3480302040daaf8acfbd842
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit


From: orallyxtalentedchick <orallyxtalentedchick@gmail.com>
Date: Thu, Oct 21, 2010 at 3:36 PM
Subject: ***
To: *** <***@***.com>


hey ***, i need a quick favor first before we get together - hope you can handle it. if your the first guy to send me the essay below or proof that you have it, we can meet at a public place and then to my apartment. im a history major and i need it for fall class. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get blocked. no one has pulled through yet, so let me know if your down.

The USA Act Research Paper - $46.99 Purchase Now!

so let me summarize this for you just in case i didnt make it crystal clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL paper in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO orallyxtalentedchick+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

------------

Another email address that he uses for this scam is talentedorallyxchick@gmail.com.

Craigslist Ad and Email Message

Here is one of the Craigslist ads placed for the scam:

http://newyork.craigslist.org/stn/cas/1863787691.html

Latina from Staten Island - w4m

---

Date: 2010-07-26, 11:26AM EDT

---

ever had good puerto rican pussy? well now's your chance. get in touch for details

Here is a typical reply you get when you respond to the ad:

hey *****, first things first, YES im real. i need a huge favor before we meet up though. i have a term paper due for my online summer class but i dont have the time or the want to write one, so i found a term paper online to purchase. the link is below. buy it, then send me proof you bought it, then we can meet up. if your down for this, send proof ASAP. the first guy that sends proof will be my next FWB.

USA PA Paper - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here is another typical reply you get when you respond to the ad:

hey *****, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the paper below or proof that you have it, we can meet at a public place and then to my apartment. im a history major and i need it for my online class. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

The USA PA E-Book - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here are some message headers:

Delivered-To: *****@*****.com
Received: by 10.231.154.131 with SMTP id o3cs277222ibw;
Tue, 27 Jul 2010 21:44:04 -0700 (PDT)
Received: by 10.101.189.8 with SMTP id r8mr10892584anp.53.1280292243318;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Return-Path: <delayedr@serverhk.wrzhost.com>
Received: from serverhk.wrzhost.com ([91.207.192.103])
by mx.google.com with ESMTP id g29si13920081ann.159.2010.07.27.21.44.02;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Received-SPF: neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) client-ip=91.207.192.103;
Authentication-Results: mx.google.com; spf=neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) smtp.mail=delayedr@serverhk.wrzhost.com
Received: from delayedr by serverhk.wrzhost.com with local (Exim 4.69)
(envelope-from <delayedr@serverhk.wrzhost.com>)
id 1OdyUr-00066b-MK
for *****@*****.com; Wed, 28 Jul 2010 12:44:01 +0800
To: ***** <*****@*****.com>
Subject: RE: Your Personals Ad
Date: Wed, 28 Jul 2010 12:44:01 +0800
From: hotteztxcoed <hotteztxcoed@gmail.com>
Message-ID: <38440f402990cc744cf52e6edf2264e6@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_38440f402990cc744cf52e6edf2264e6"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - serverhk.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [720 717] / [47 12]
X-AntiAbuse: Sender Address Domain - serverhk.wrzhost.com

So he's using WRZHost again. Let's see if they close his account quickly this time instead of tolerating his scam for a while as they did in the past.

Oh, and here are some of the photos that are sent along with the email message. I edited out the bottom part of the second photo since it contains nudity.

usaact-termpaper.blogspot.com

The last site I reported, usaacttermpaper.blogspot.com, was taken down, but a new site has been put up:

http://usaact-termpaper.blogspot.com/

The USA Act Paper

The USA PA E-Book - $45.99
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without ... (Buy Now for Whole Version)

Pages: 8

Delivery: Immediate via Email

The company name used for the PayPal page is still Term Papers Inc and the email address for the PayPal account is again usapaebook@hotmail.com.

By the way, these two sites have been removed:

thepatriotacttermpaper.blogspot.com
patriot-act-paper.blogspot.com

usaacttermpaper.blogspot.com

Another scam site:

http://usaacttermpaper.blogspot.com

The USA Act Paper

The USA PA E-Book - $45.99
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without...

usa-act-paper.blogspot.com

Yet another Patriot Act essay scam blog:

http://usa-act-paper.blogspot.com/

Another Patriot Act E-Book Scam Blog

http://the-usa-pa-ebook.blogspot.com/

Buy the USA PA E-Book
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without ... (Buy Now for Whole Version)

The email address used for the PayPal account this time is usapaebook@hotmail.com.

Another Patriot Act Paper Site

http://usa-pa-ebok.blogspot.com/

And he's changed the email address for his PayPal account again. Now it's greatarticlesforsale@gmail.com. The business name he uses is still Term Papers Inc.

More Patriot Act Paper Sites

Here are more sites that are used for the Patriot Act paper scam.

http://thepatriotact-e-book.blogspot.com/
http://patriot-act-paper.blogspot.com/
http://patriot-act-term-paper.blogspot.com/

The new e-mail address that Renniel uses for his PayPal account is affordableessays@gmail.com. I was able to confirm that the PayPal account used for this scam is the same PayPal account that Renniel used for the morality essay scam sites.

The Patriot Act Paper

It looks like Renniel is at it again. But instead of asking the victim to buy a morality term paper, this time he asks him to buy a Patriot Act paper. Someone reported getting taken by the scam over at aa419.org:

Unfortunately I found this page too late and got taken. Here is the new site where he posts his papers.

http://thepatriotacttermpaper.blogspot.com/

What can we do about this ahole?

The Evidence

This is pretty much a repost of my explanation posted at aa419.org.

First, look at the registration information for the scam sites again:

GMAILDELAYEDREPLY.NET
Registrant:
Josh Fernandez
206 Marin Blvd
Jersey City, New Jersey 07302
United States

Administrative Contact:
Fernandez, Josh sales@svrhost.com
206 Marin Blvd
Jersey City, New Jersey 07302
United States
(551) 697-9370

MORALITYRESEARCHPAPERS.ORG
Registrant Name: Marc Fernandez (joshuaxxcore@gmail.com)
Registrant Street1: 175 Audubon Ave
Registrant Street2:
Registrant Street3:
Registrant City: Jersey City
Registrant State/Province: New Jersey
Registrant Postal Code: 07305
Registrant Country: US
Registrant Phone: +1. 551 697 9370

MORALITYTERMPAPERS.COM
Registrant:
Josh Fernandez (joshuaxxcore@gmail.com)
134 Audubon Ave
Jersey City
NJ,07302
US
Tel. +1.5515550319

The registrant addresses are fake but they are all in Jersey City and the names Josh Fernandez and Marc Fernandez are used.

Another of the sites that was used for the scam was freeshizznet.com. If you search for “freeshizznet.com”, you find a page entitled “YouTube – Free 3G iPhone Secret”. The URL for it is:

http://www.youtube.com/watch?v=Z0eXFmW9xv8

If you click the link you’ll find a video posted by someone who uses the name ringtonezgalore. The current version of the page does not reference freeshizznet.com, but Google's cached copy of that page does. Here is the old description of the video, which is in Google’s cache:

ringtonezgalore — November 24, 2008 — Step 1. Go to http://FreeShizznet.com/iPhone
Step 2. Enter Email
Step 3. Fill out Personal info
Step 4. Fill out 3 Surveys
Step 5. Receive 3G iPhone in 1-2 Weeks!

So freeshizznet.com, owned by the scammer, was also used for some sort of iPhone promotion.

Here is another video posted by ringtonezgalore:

http://www.youtube.com/watch?v=AGCZe6DDJx4

The description of the video:

ringtonezgalore — September 03, 2009 — Get this Forever Ringtone by Drake Ft. Lil Wayne, Kanye West & Eminem to your phone by going to www.RockinRingtones.info - Takes less than 30 seconds! Get it while this song is hot.

The whois information for RockinRingtones.info is still available:

ROCKINRINGTONES.INFO
Registrant Name:Gerry Toledo
Registrant Organization:GToledo PPC
Registrant Street1:1153 Kennedy Blvd
Registrant Street2:
Registrant Street3:
Registrant City:Jersey City
Registrant State/Province:New Jersey
Registrant Postal Code:07304
Registrant Country:US
Registrant Phone:+1.2019939007
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: gtoledoppc@gmail.com

Another Jersey City address, but this time the last name isn’t Fernandez. It’s also interesting that a business name is used this time. The PPC stands for pay-per-click.

More searching for freeshizznet.com brings up another posting of this iPhone promotion on Digg.com:

http://digg.com/apple/How_to_Get_a_Free_Apple_3G_iPhone

The person who posted this has the alias KillerRingTones. In addition to posting this iPhone promotion he posted a lot of the same ringtone promotions as ringtonezgalore. His Digg profile gives his name as Renniel Fernandez.

Now, if you search for ringtonezgalore, you’ll eventually find a MySpace profile for www.ringtonezgalore.net. The site www.ringtonezgalore.net is no longer active and the MySpace profile has been deleted. However, the profile is still in Google’s cache. Here’s the link to the cached page:

http://webcache.googleusercontent.com/search?q=cache:rpK2AtOmDgoJ:www.myspace.com/djadulesentz+ringtonezgalore.net&cd=1&hl=en&ct=clnk&gl=us

Notice that the URL for this MySpace profile is http://www.myspace.com/djadulesentz. Also, the profile states that this person is 20 years old and lives in New Jersey. Search for djadulesentz and you find a lot of pages in rap music and DJ forums for a New Jersey DJ who is now 20 years old and has called himself variously djadulesentz, DJ Adulesentz, DJ Adules Entz, DJxADULESENTZ, and also used to go by the names of DJ Artillary and xARTILLARYx. His birthday is August 16th, 1989:

http://www.crazypellas.net/happy-birthday-110/happy-birthday-to-xartillaryx-on-16-08-2006-a-17802/
http://mail.rapworlds.com/forums/member.php?u=29733

DJxADULESENTZ used to have websites called dj-artillary.com and djadulesentz.com. These websites weren’t just used to promote his mixtapes, he also made money from them through affiliate advertising programs. He’d offer free ringtones and make money through ads being placed on his sites. When you search for DJxADULESENTZ, you find these pages where he is asking for advice on monetizing his website:

http://www.webmaster-talk.com/monetization/135940-monetizing-a-dj-website.html
http://forums.digitalpoint.com/showthread.php?t=167073

A few years after these posts asking for advice on monetizing his website, we find that he has graduated to selling his own Craigslist posting service, where he specializes in placing ads in the casual encounters section:

http://forums.digitalpoint.com/showthread.php?t=1758844

Craigslist Personals Posting Service // Up to 1,000 Exclusive Leads

Hey DP, I am now offering services to post in CLs Personals section. Most of the leads will be coming from Casual Encounters section. I can forward you up to 1,000 EXCLUSIVE leads per day.

We also find a DJxADULESENTZ on g35driver.com who is Filipino-American and lives in Jersey City:

http://g35driver.com/forums/lounge-off-topic/141975-filipino-pacific-islander-2.html#post1763652


The fact that he is Filipino is noteworthy, because many of the ads placed for the scam described the girl Lauren as a “hot Filipina”, “hawt Filipina”, or “Filipina hawtie”. The scammer also used a picture of a Filipina in his email messages.

Getting back to RockinRingtones.info and Gerry Toledo, when I searched MySpace and Facebook for a Gerry Toledo in Jersey City I found these results:

http://www.myspace.com/aboybata
http://www.facebook.com/people/Gerry-Toledo/678904971

Gerry is also a 20 year old Filipino-American in Jersey City. So is he then DJxADULESENTZ? Well, when I looked at the comments on Gerry’s MySpace page I saw that his birthday is on June 30th, not August 16th. That bothered me. I found it very unlikely that if he were DJxADULESENTZ that he would have used a fake birth date in his profiles years ago before he was running his scam. There doesn’t seem to be much reason for doing something like that, so I continued searching.

Some more searching for xARTILLARYx brought up this profile on OSCommerce.com:

http://forums.oscommerce.com/user/95528-xartillaryx/

Here is part of the profile:

Group: Community Member
Active Posts: 0 (0 per day)
Joined: 26-January 06
Profile Views: 6
Last Active: Jan 26 2006 03:05 AM

Age: Age Unknown
Birthday: Birthday Unknown
Real Name: Marc Fernandez

So xARTILLARYx/DJxADULESENTZ was using the name Marc Fernandez over four years ago, a few years before he began this scam. That makes it more likely that this is his real name, but we don’t know that yet. Plus, there's also the fact that the name Renniel Fernandez, not Marc Fernandez, was used for the Digg profile that posted the iPhone and ringtone promotions three years ago.

Looking up the phone numbers used for the registrations provides more useful information. When I looked up the number (551) 697-9370 used for moralityresearchpapers.org and gmaildelayedreply.net, I was told that it is owned by a Maril Fernandez in Hudson County, NJ. I didn’t find a Maril Fernandez in New Jersey, but I did find a Marilou B. Fernandez in Jersey City, which is in Hudson County. She is Filipina-American and has a Facebook profile:

http://www.facebook.com/mariloufernandez

One of her children is named Renniel Marc.

When I looked up the number (201) 993-9007 used by "Gerry Toledo" and his pay-per-click business GToledo PPC, I found that it is owned by a Renniel Fernandez, some of whose possible relatives were identified as being Marilou Fernandez and her other children. So apparently the scammer is actually Renniel Fernandez, Renniel sometimes hides his identity using his middle name Marc, and Josh Fernandez and Gerry Toledo are two of his aliases. But this can't be a definite conclusion yet because it remains possible that the scammer stole the identity of Renniel Fernandez.

So I had to find out more about Renniel in order to determine if he actually is DJxADULESENTZ. At first I was not able to find a MySpace or Facebook profile or any other information about him. But I kept at it and I discovered that he actually does have a Facebook profile. It doesn't show up in Facebook search results, but it is possible to find it by browsing his friends' friends lists. For example, if you scroll through Gerry Toledo’s Facebook friends list until you get to the R’s, you’ll see Renniel's profile:

http://www.facebook.com/profile.php?id=574199433

You need to be logged in to Facebook to be able to view it. Renniel has now hidden his birthday, but when I viewed his profile a couple days ago his birthday was still visible and was given as August 16th. He belongs to a Facebook group for G35 owners and he is the brother of Chell-Eh Fernandez, who is the daughter of Marilou Fernandez.

I showed in my previous post that Renniel acknowledged that he is DJxADULESENTZ. The other evidence I've discovered points to DJxADULESENTZ being the scammer. Hence, Renniel Fernandez is the scammer, Gerry Toledo is a friend of his whose name he stole for his pay-per-click business, and Josh Fernandez was an alias, probably taken from the Filipino DJ of that name.

Renniel Fernandez

His name isn't Marc Fernandez, it's Renniel Marc Fernandez. In his public life, when he's not scamming people or doing affiliate marketing on the Web, he just calls himself Renniel Fernandez. He's a 20 year old Filipino-American college student living in Jersey City, NJ. He was born on August 16th, 1989. Here is his mother's Facebook profile:

http://www.facebook.com/mariloufernandez

He also has his own Facebook profile, but it doesn't show up in Facebook search results. You should be able to see it by logging in to Facebook and clicking on the link. I sent him a friend request and had this conversation with him before he blocked me:

Renniel, May 20 at 12:10am
hey, who's this? you do aff. marketing?

Me, May 20 at 12:25am
Nope. I track down scammers.

Renniel, May 20 at 12:27am
oh ok? lol.

Me, May 20 at 12:29am
Yeah. here's an example:

http://forum.aa419.org/viewtopic.php?t=42646

And here's some more info on that case:

http://humanmoralityresearchessay.blogspot.com/2010/05/djxadulesentz.html

Renniel, May 20 at 12:33am

i'm not really sure what to make of all this? lol. except those are my DJ names from 3-4 years ago.

http://www.datpiff.com/DJ_Artillary_Artillary_Blends_3.m1213.html

Me, May 20 at 12:35am

Yeah, I've come across all of that. You're not good at covering your tracks.

Renniel, May 20 at 12:36am

covering my tracks for what?

Me, May 20 at 12:39am

YAWN! Any interesting conversations going on? This one has gotten boring already. Know where I can find some Filipina hawties?

Renniel, May 20 at 12:40am

lol, yea this girl lauren fernandez, which is you i'm assuming?

Me, May 20 at 12:42am

Who's Lauren Fernandez? You got a link to her FB profile?

Renniel, May 20 at 12:42am

http://www.facebook.com/?ref=logo#!/profile.php?id=100001123830806

Me, May 20 at 12:44am

Nice... I'll send her a message

Renniel, May 20 at 12:46am

lol, alright. i mean, i'd tell you to listen to my mixtapes but you don't look like the type that's into rap music.

Me, May 20 at 12:46am

WTF? She'll only meet me if I buy a term paper for her on some website?! That sounds like a scam.

Renniel, May 20 at 12:47am

alright, you're weird.

So he's acknowledged that he's DJxADULESENTZ. The other evidence I have shows that DJxADULESENTZ was the owner of the scam sites. Hence, Renniel Fernandez is the scammer.

UPDATE: This evidence has now been posted.

The Website Registration Information

Here is the website registration information for some of the sites that were used for the scam.


moralitytermpapers.com
Administrative Contact:
Josh Fernandez (joshuaxxcore@gmail.com)
134 Audubon Ave
Jersey City
NJ,07302
US
Tel. +1. 551 555 0319


gmaildelayedreply.net
Administrative Contact:
Fernandez, Josh (sales@svrhost.com)
206 Marin Blvd
Jersey City, New Jersey 07302
United States
(551) 697-9370


moralityresearchpapers.org
Registrant ID: CR39467555
Registrant Name: Marc Fernandez (joshuaxxcore@gmail.com)
Registrant Street1: 175 Audubon Ave
Registrant Street2:
Registrant Street3:
Registrant City: Jersey City
Registrant State/Province: New Jersey
Registrant Postal Code: 07305
Registrant Country: US
Registrant Phone: +1. 551 697 9370


As I mentioned in my previous post, one of the aliases that the scammer has used is xARTILLARYx. Theere is a user profile for xARTILLARYx on the site OSCommerce.com:

http://forums.oscommerce.com/user/95528-xartillaryx/

Here is some of the content of that page:

Group: Community Member
Active Posts: 0 (0 per day)
Joined: 26-January 06
Profile Views: 6
Last Active: Jan 26 2006 03:05 AM

Age: Age Unknown
Birthday: Birthday Unknown
Real Name: Marc Fernandez

Interesting...

DJxADULESENTZ

Well, I've found some more information on the scammer. I've discovered a number of other websites that he has operated and aliases and email addresses that he has used. The alias that I know he has been using recently is DJxADULESENTZ.


Websites
dj-artillary.com
djadulesentz.com
ringtonezgalore.net
rockinringtones.info
myspace.com/djadulesentz

These websites are all defunct. You can view some of the content of the MySpace profile by doing a Google site search

site:myspace.com/djadulesentz

and looking at the results in Google's cache. Some of the content of the other sites is available from the Internet Archive Wayback Machine.


Aliases
DJ Artillary
DJ Adulesentz
DJ Adules Entz
xARTILLARYx
DJAdulesentz
DJxADULESENTZ
ringtonezgalore

Searching Google for DJxADULESENTZ brings up many results, including these:

http://g35driver.com/forums/members/47726-djxadulesentz.html
http://forums.digitalpoint.com/member.php?u=45033

You need to register with DigitalPoint in order to be able to view the DigitalPoint profile. However, you don't need to register in order to view threads on the site. Search for

site:forums.digitalpoint.com djxadulesentz

and you'll see all of his activity, which includes this thread:

http://forums.digitalpoint.com/showthread.php?t=1758844

where he advertises a Craigslist posting service, in which he says "Hey DP, I am now offering services to post in CLs Personals section. Most of the leads will be coming from Casual Encounters section."

Searching for ringtonezgalore brings up this result:

youtube.com/user/ringtonezgalore


Email Addresses
xartillaryx@hotmail.com
cheapbusinessessays@gmail.com
cheapessaysinc@gmail.com
cheapessaysincx@gmail.com
joshuaxxcore@gmail.com
gtoledoppc@gmail.com


Regarding the site rockinringtones.info, here is the registrant information:

Registrant ID:CR2553194
Registrant Name:Gerry Toledo
Registrant Organization:GToledo PPC
Registrant Street1:1153 Kennedy Blvd
Registrant Street2:
Registrant Street3:
Registrant City:Jersey City
Registrant State/Province:New Jersey
Registrant Postal Code:07304
Registrant Country:US
Registrant Phone:+1.2019939007
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: gtoledoppc@gmail.com

The address is fake since there is no 1153 Kennedy Blvd in Jersey City. That address is in Union City, NJ, which is next to Jersey City.

prime-essays-galore.blogspot.com

Moved yet again:

prime-essays-galore.blogspot.com

prime-essays.blogspot.com

Now he's moved on to prime-essays.blogspot.com:

hey ****, can you do me a favor before we meet up? i need this essay for class but i havent had the time to write it so i found one online that i could buy. you can buy one essay for $38 or buy all five for $55 with paypal. here's the link.

PrimeEssays - Essays starting at $37.99

so basically, buy one of the papers, i prefer the human and morality one but the package would be great too. email me proof you purchased it with a paragraph or receipt, i make sure it's real, we meet up in a public place, get comfortable then head somewhere private (i can host if you cant), we have our fun, then after we have our fun, you can send me the full essay. let me know if your down, first come first serve so email the proof to my email.

Yet Another Scam Site

The previous scam site, thepapersale.tumblr.com, was killed by Tumblr. Now he's moved his scam to cheapessays.tumblr.com.

He's using the email address canthandlethisx@gmail.com now. Here's the message text.

hey before we hook up can you do me a favor? i need this essay for class but my paypal doesnt work. i just need proof you bought it like a receipt or a paragraph then we can meet up. let me know if you can do that for me . the essay is $37 but if you can afford it, you can buy all 5 for $55. the link to the essays is below, id prefer the path to human morality essay or all of them if you can.

CheapEssays - Affordable Essays starting at $37.99

Another Scam Site

http://thepapersale.tumblr.com/

Lately he has been setting up these scam sites on Tumblr. If you find one of them, just email support@tumblr.com and notify them of it and they will take down the site.

Also, it would be a good idea for you to notify PayPal that he is using his PayPal account for this scam.

Another Sample Scam Message

X-Apparently-To: ***@***.*** via 98.136.183.59; Tue, 27 Apr 2010 08:43:10 -0700
Return-Path:
X-YMailISG: cVAMjI4WLDuspuaNkcTVxr6y8gIw9nhO5GZonIdO6JoxyAodHlwPtJHr.LKhnylIILpb4ZD3ZsvOqLQyHqeKyjBRQmOpKBZBBR6Mrr_uBA5kWVieXIsNi4Gs5P_FOVi4C729ky7yaBNlJlu9UxOChK.cEWSTZMJWKNHZG_D54lWU9.KQZhabrEZC8y1QkAEW8rMr6cUwqGK_Tbk5Sm4PLJj6RNpch1wLK0GBPKeRwrQ.G4Rf.1ZhYPtQt.XfEVp4RnVR8tXHU8GzFQLWnPFAaHR91e6TunlpkLFiIeQ4
X-Originating-IP: [93.190.137.170]
Authentication-Results: mta1047.mail.sp2.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO global.underhostnetworks.com) (93.190.137.170) by mta1047.mail.sp2.yahoo.com with SMTP; Tue, 27 Apr 2010 08:43:09 -0700
Received: from hostedre by global.underhostnetworks.com with local (Exim 4.69) (envelope-from ) id 1O6mwA-0001Z8-LG for ***@***.com; Tue, 27 Apr 2010 17:43:02 +0200
To: *** <***@***.***>
Subject:
Date: Tue, 27 Apr 2010 17:43:02 +0200
From: oLUSHiZo olushizo@gmail.com
Message-ID: <0d80dd0dc49884408b4919c4997a13e2@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1_0d80dd0dc49884408b4919c4997a13e2"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - global.underhostnetworks.com
X-AntiAbuse: Original Domain - ***
X-AntiAbuse: Originator/Caller UID/GID - [641 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - global.underhostnetworks.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/hostedre/public_html/gmail/autoresponder.php
X-Source-Dir: hostedreplies.com:/public_html/gmail
Content-Length: 1116723
.

hey ***, i need a favor before we meet up. the only way i'll meet up with you is if you purchase one of the papers below and send me proof you bought it. you can send me a sample of the essay, then can meet up somewhere public and get to know each other then head somewhere private like my place or yours. i need this essay for class and its really important. without it, i cant play. whats in it for you? a friend with certain benefits. no one bought it yet so you still have time to send me proof. dont offer me cash or to meet up in person first, i need someone who has paypal and i want proof first.
EssaysForSale // Affordable Essays Starting at $37.99!
let me sum it up, buy one of the essays, i'd prefer the path to human morality one or ALL of them would be great if you can afford it =). send me a sample of the essay or the receipt, we go somewhere public for a little bit to talk then head somewhere private, we have our fun, then after we have our fun, you send me the full essay. if your performance is good the first time, we can meet up again without any essay purchasing lol.