The Evidence

This is pretty much a repost of my explanation posted at aa419.org.

First, look at the registration information for the scam sites again:

GMAILDELAYEDREPLY.NET
Registrant:
Josh Fernandez
206 Marin Blvd
Jersey City, New Jersey 07302
United States

Administrative Contact:
Fernandez, Josh sales@svrhost.com
206 Marin Blvd
Jersey City, New Jersey 07302
United States
(551) 697-9370

MORALITYRESEARCHPAPERS.ORG
Registrant Name: Marc Fernandez (joshuaxxcore@gmail.com)
Registrant Street1: 175 Audubon Ave
Registrant Street2:
Registrant Street3:
Registrant City: Jersey City
Registrant State/Province: New Jersey
Registrant Postal Code: 07305
Registrant Country: US
Registrant Phone: +1. 551 697 9370

MORALITYTERMPAPERS.COM
Registrant:
Josh Fernandez (joshuaxxcore@gmail.com)
134 Audubon Ave
Jersey City
NJ,07302
US
Tel. +1.5515550319

The registrant addresses are fake but they are all in Jersey City and the names Josh Fernandez and Marc Fernandez are used.

Another of the sites that was used for the scam was freeshizznet.com. If you search for “freeshizznet.com”, you find a page entitled “YouTube – Free 3G iPhone Secret”. The URL for it is:

http://www.youtube.com/watch?v=Z0eXFmW9xv8

If you click the link you’ll find a video posted by someone who uses the name ringtonezgalore. The current version of the page does not reference freeshizznet.com, but Google's cached copy of that page does. Here is the old description of the video, which is in Google’s cache:

ringtonezgalore — November 24, 2008 — Step 1. Go to http://FreeShizznet.com/iPhone
Step 2. Enter Email
Step 3. Fill out Personal info
Step 4. Fill out 3 Surveys
Step 5. Receive 3G iPhone in 1-2 Weeks!

So freeshizznet.com, owned by the scammer, was also used for some sort of iPhone promotion.

Here is another video posted by ringtonezgalore:

http://www.youtube.com/watch?v=AGCZe6DDJx4

The description of the video:

ringtonezgalore — September 03, 2009 — Get this Forever Ringtone by Drake Ft. Lil Wayne, Kanye West & Eminem to your phone by going to www.RockinRingtones.info - Takes less than 30 seconds! Get it while this song is hot.

The whois information for RockinRingtones.info is still available:

ROCKINRINGTONES.INFO
Registrant Name:Gerry Toledo
Registrant Organization:GToledo PPC
Registrant Street1:1153 Kennedy Blvd
Registrant Street2:
Registrant Street3:
Registrant City:Jersey City
Registrant State/Province:New Jersey
Registrant Postal Code:07304
Registrant Country:US
Registrant Phone:+1.2019939007
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: gtoledoppc@gmail.com

Another Jersey City address, but this time the last name isn’t Fernandez. It’s also interesting that a business name is used this time. The PPC stands for pay-per-click.

More searching for freeshizznet.com brings up another posting of this iPhone promotion on Digg.com:

http://digg.com/apple/How_to_Get_a_Free_Apple_3G_iPhone

The person who posted this has the alias KillerRingTones. In addition to posting this iPhone promotion he posted a lot of the same ringtone promotions as ringtonezgalore. His Digg profile gives his name as Renniel Fernandez.

Now, if you search for ringtonezgalore, you’ll eventually find a MySpace profile for www.ringtonezgalore.net. The site www.ringtonezgalore.net is no longer active and the MySpace profile has been deleted. However, the profile is still in Google’s cache. Here’s the link to the cached page:

http://webcache.googleusercontent.com/search?q=cache:rpK2AtOmDgoJ:www.myspace.com/djadulesentz+ringtonezgalore.net&cd=1&hl=en&ct=clnk&gl=us

Notice that the URL for this MySpace profile is http://www.myspace.com/djadulesentz. Also, the profile states that this person is 20 years old and lives in New Jersey. Search for djadulesentz and you find a lot of pages in rap music and DJ forums for a New Jersey DJ who is now 20 years old and has called himself variously djadulesentz, DJ Adulesentz, DJ Adules Entz, DJxADULESENTZ, and also used to go by the names of DJ Artillary and xARTILLARYx. His birthday is August 16th, 1989:

http://www.crazypellas.net/happy-birthday-110/happy-birthday-to-xartillaryx-on-16-08-2006-a-17802/
http://mail.rapworlds.com/forums/member.php?u=29733

DJxADULESENTZ used to have websites called dj-artillary.com and djadulesentz.com. These websites weren’t just used to promote his mixtapes, he also made money from them through affiliate advertising programs. He’d offer free ringtones and make money through ads being placed on his sites. When you search for DJxADULESENTZ, you find these pages where he is asking for advice on monetizing his website:

http://www.webmaster-talk.com/monetization/135940-monetizing-a-dj-website.html
http://forums.digitalpoint.com/showthread.php?t=167073

A few years after these posts asking for advice on monetizing his website, we find that he has graduated to selling his own Craigslist posting service, where he specializes in placing ads in the casual encounters section:

http://forums.digitalpoint.com/showthread.php?t=1758844

Craigslist Personals Posting Service // Up to 1,000 Exclusive Leads

Hey DP, I am now offering services to post in CLs Personals section. Most of the leads will be coming from Casual Encounters section. I can forward you up to 1,000 EXCLUSIVE leads per day.

We also find a DJxADULESENTZ on g35driver.com who is Filipino-American and lives in Jersey City:

http://g35driver.com/forums/lounge-off-topic/141975-filipino-pacific-islander-2.html#post1763652


The fact that he is Filipino is noteworthy, because many of the ads placed for the scam described the girl Lauren as a “hot Filipina”, “hawt Filipina”, or “Filipina hawtie”. The scammer also used a picture of a Filipina in his email messages.

Getting back to RockinRingtones.info and Gerry Toledo, when I searched MySpace and Facebook for a Gerry Toledo in Jersey City I found these results:

http://www.myspace.com/aboybata
http://www.facebook.com/people/Gerry-Toledo/678904971

Gerry is also a 20 year old Filipino-American in Jersey City. So is he then DJxADULESENTZ? Well, when I looked at the comments on Gerry’s MySpace page I saw that his birthday is on June 30th, not August 16th. That bothered me. I found it very unlikely that if he were DJxADULESENTZ that he would have used a fake birth date in his profiles years ago before he was running his scam. There doesn’t seem to be much reason for doing something like that, so I continued searching.

Some more searching for xARTILLARYx brought up this profile on OSCommerce.com:

http://forums.oscommerce.com/user/95528-xartillaryx/

Here is part of the profile:

Group: Community Member
Active Posts: 0 (0 per day)
Joined: 26-January 06
Profile Views: 6
Last Active: Jan 26 2006 03:05 AM

Age: Age Unknown
Birthday: Birthday Unknown
Real Name: Marc Fernandez

So xARTILLARYx/DJxADULESENTZ was using the name Marc Fernandez over four years ago, a few years before he began this scam. That makes it more likely that this is his real name, but we don’t know that yet. Plus, there's also the fact that the name Renniel Fernandez, not Marc Fernandez, was used for the Digg profile that posted the iPhone and ringtone promotions three years ago.

Looking up the phone numbers used for the registrations provides more useful information. When I looked up the number (551) 697-9370 used for moralityresearchpapers.org and gmaildelayedreply.net, I was told that it is owned by a Maril Fernandez in Hudson County, NJ. I didn’t find a Maril Fernandez in New Jersey, but I did find a Marilou B. Fernandez in Jersey City, which is in Hudson County. She is Filipina-American and has a Facebook profile:

http://www.facebook.com/mariloufernandez

One of her children is named Renniel Marc.

When I looked up the number (201) 993-9007 used by "Gerry Toledo" and his pay-per-click business GToledo PPC, I found that it is owned by a Renniel Fernandez, some of whose possible relatives were identified as being Marilou Fernandez and her other children. So apparently the scammer is actually Renniel Fernandez, Renniel sometimes hides his identity using his middle name Marc, and Josh Fernandez and Gerry Toledo are two of his aliases. But this can't be a definite conclusion yet because it remains possible that the scammer stole the identity of Renniel Fernandez.

So I had to find out more about Renniel in order to determine if he actually is DJxADULESENTZ. At first I was not able to find a MySpace or Facebook profile or any other information about him. But I kept at it and I discovered that he actually does have a Facebook profile. It doesn't show up in Facebook search results, but it is possible to find it by browsing his friends' friends lists. For example, if you scroll through Gerry Toledo’s Facebook friends list until you get to the R’s, you’ll see Renniel's profile:

http://www.facebook.com/profile.php?id=574199433

You need to be logged in to Facebook to be able to view it. Renniel has now hidden his birthday, but when I viewed his profile a couple days ago his birthday was still visible and was given as August 16th. He belongs to a Facebook group for G35 owners and he is the brother of Chell-Eh Fernandez, who is the daughter of Marilou Fernandez.

I showed in my previous post that Renniel acknowledged that he is DJxADULESENTZ. The other evidence I've discovered points to DJxADULESENTZ being the scammer. Hence, Renniel Fernandez is the scammer, Gerry Toledo is a friend of his whose name he stole for his pay-per-click business, and Josh Fernandez was an alias, probably taken from the Filipino DJ of that name.