The human morality essay scam has been operating on Craigslist lately. It involves someone claiming to be a girl named Lauren who promises to meet up with a man if he first purchases a term paper for her on a website.
The response that you get when you reply to one of these ads is automatically generated, and it contains a link to humanmoralityresearch.net, which automatically redirects you to moralitytermpapers.org, where you are supposed to purchase an essay for the girl. This morality term papers scam site was previously hosted at moralitytermpapers.com. It appears to be a legitimate site that sells research papers, but it can easily be shown that it is part of a scam operation. First of all there are the ads and the replies that you get when you respond to the ads:
http://newyork.craigslist.org/lgi/cas/1670414965.html
http://newyork.craigslist.org/brk/cas/1670384594.html
http://newyork.craigslist.org/brx/cas/1666772100.html
http://newyork.craigslist.org/que/cas/1676532325.html
http://newyork.craigslist.org/brk/cas/1676528002.html
http://newyork.craigslist.org/mnh/cas/1666164354.html
http://newyork.craigslist.org/mnh/cas/1676526148.html
Here is a typical response:
Delivered-To: xxxxxx@gmail.com
Received: by 10.229.11.144 with SMTP id t16cs24810qct;
Fri, 26 Mar 2010 21:45:27 -0700 (PDT)
Received: by 10.223.143.21 with SMTP id s21mr1839835fau.51.1269665125338;
Fri, 26 Mar 2010 21:45:25 -0700 (PDT)
Return-Path:
Received: from servernl2.wrzhost.com ([217.23.6.58])
by mx.google.com with ESMTP id 8si3916588fxm.25.2010.03.26.21.45.24;
Fri, 26 Mar 2010 21:45:25 -0700 (PDT)
Received-SPF: neutral (google.com: 217.23.6.58 is neither permitted nor denied by best guess record for domain of gmaildel@servernl2.wrzhost.com) client-ip=217.23.6.58;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.6.58 is neither permitted nor denied by best guess record for domain of gmaildel@servernl2.wrzhost.com) smtp.mail=gmaildel@servernl2.wrzhost.com
Received: from gmaildel by servernl2.wrzhost.com with local (Exim 4.69)
(envelope-from
id 1NvNti-0006Pu-PQ
for xxxxxx@gmail.com; Sat, 27 Mar 2010 05:45:22 +0100
To: xxx xxx
Subject: RE: i need a quick favor before we meet up ..
Date: Sat, 27 Mar 2010 05:45:22 +0100
From: ohsoolushiz
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_ad0e611dad3cf962d937e5e9e70d8247"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - servernl2.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [622 622] / [47 12]
X-AntiAbuse: Sender Address Domain - servernl2.wrzhost.com
--b1_ad0e611dad3cf962d937e5e9e70d8247
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit
hey xxx, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash, you`ll just get blocked. no one has pulled through yet, so let me know if your down. <p></p>
<p><a href="http://www.humanmoralityresearch.net/" target="_blank">Morality Term Papers - Your Source for Affordable Morality Papers!</a></p>
<p>so let me outline this for you just in case i didnt make it clear enough. you buy one of the essays (doesnt matter which one), forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7. email the proof to ohsoolushiz+proof@gmail.com, first come first serve!
Next, when you search the Web for "moralitytermpapers.com" and "humanmoralityresearch.net", you get some interesting results. When you do this search on Google:
site:moralitytermpapers.com
you see in the search results this item
http://moralitytermpapers.com/gmail/template1.txt
This page is no longer accessible so you cannot see it when you click on the link. But you can see the CACHED copy of the page, and you can see that it is the template used for automatically generating the email messages used for the fraud.
When you search for this on Google:
"humanmoralityresearch.net"
one of the results is this:
gmaildelayedreply.net/gmail/template1.txt
Which is the same template. Also, you can use Google's cache to view this file and some of the other files used for the human morality research scam. The scammer moved this part of his operation to this server hosted by WRZHost to make it harder for people to find him and also to provide a ridiculous legal excuse for his activities. He claims that he is only trying to direct traffic to the term papers site. Ha!
The morality term papers scam is not new. It has been in operation off and on since at least late 2009. This scam was operating on different Web sites that were shut down once the hosting services were contacted. It operated on
http://moralitytermpapers.tumblr.com (a blog on tumblr.com)
http://www.moralityresearchpapers.org/ (hosted by my365host.com)
http://freeshizznet.com (hosted by hostgator.com)
and different email addresses were used instead of ohsoolushiz@gmail.com and ohsoolushiz+proof@gmail.com The ones that I know of are
therealaznsensationx@gmail.com
therealaznsensationx+proof@gmail.com
lushizlaurenx@gmail.com
lushizlaurenx+proof@gmail.com
lushiizlaurenx@gmail.com
lushiizlaurenx+proof@gmail.com
lushizxlauren@gmail.com
lushizxlauren+proof@gmail.com
laurenizseductive@gmail.com
laurenizseductive+proof@gmail.com
laurenizseductivex@gmail.com
laurenizseductivex+proof@gmail.com
hotteztxchick+proof@gmail.com
hotteztxchick@gmail.com
Also, this person used a myspace profile to try to convice people that he was actually this girl Lauren:
http://www.myspace.com/laurenizseductive
No comments:
Post a Comment