Selfxemployed: The Final Piece of the Puzzle

We've already seen that Renniel has admitted that the site ringtonezgalore.net was his. He said over at aa419.org that "If you're wondering, yes, I owned RingtonezGalore.net for PPC purposes." It turns out that on Digg.com there is a submission advertising a ringtone available on the site ringtonezgalore.net.

Notice that the person who submitted the link has the alias selfxemployed. Renniel has a Myspace profile with the URL myspace.com/selfemployedislandboy.

Renniel is self-employed and "islandboy" refers to the fact that he is Filipino. ("Island boy" is a nickname for someone from the Phillipine islands.) The similarity between "selfemployedislandboy" and "selfxemployed" is interesting in itself, but it is when we do a search for selfxemployed that things get really interesting.

The site Blackhatworld.com is one place where we find someone who uses the name selfxemployed. In the thread "My first mashup vid/song", where user mjd2nd asks for advice on a blend that he made, selfxemployed tells us "my whole life once revolved around making blends, but i gave up that part of my life to venture into internet marketing." As many of you already know, Renniel was once a blend DJ and he even stated that DJing was "his true passion".

On May 31st, 2009, selfxemployed started the thread "How much trouble can I get into if ...", where he asks about the legal ramifications of scamming men out of their money by promising them a meet-up with a girl if they purchased a an e-book for her:

I promised horny guys a meet up if they bought me an ebook that i really wanted but the ebook product was mine? For those of you who downloaded the e-whore twister method know what im talking about, but that method promises a cam show. Should i promise that instead of a meet up to avoid any troubles? Isn't this close to theft on false pretenses? Thanks in advance.

The question of the possible danger of getting in trouble for this scam didn't appear to be settled by the replies he got, because four months later, on September 28th, 2009, we find someone calling himself selfxemployed on the site expertlaw.com who started a thread "Scammed By a Girl I Met Online" that asked about a similar situation. But in this case, selfxemployed asks about the situation from the point of view of the victim.

I met a girl online through Match - she said she would meet up with me if I purchased a report for her that she needed for class. I sent her proof that I bought it and I asked her if I could send her the full paper during our meet up and she agreed. Like the idiot I am, I included the transaction id when I sent the proof. Now the girl is having cold feet to meet up. What would you guys consider this? I buy the paper, now she doesn't want to meet up. I suspect she is reaping profits by selling the paper and I may not be the only one. If this were true, would this be considered theft by deception and is there anything I can do? Thanks in advance.

Since this is a legal question, the answer would depend on which state this person is in. He says he is in New Jersey.

I'm in New Jersey. She claimed to be a college student, told me where she was going to school and all. The paper I bought seems to be college material. What if this "girl in need" isn't really a girl at all and if it's some guy making sales off the purchases? I sent proof, I didn't send the full paper and she disappeared. Maybe she got it from someone else? Who knows.

Now, what is the likelihood that someone that was actually taken by this scam just happens to have the same online alias as someone who asks about operating the scam? Which seems more realistic, that these are in fact two different people, or that this other selfxemployed is just the scammer trying to get better advice on what sort of legal recourse his victims would have? I'd say the latter, and I'd also say that seeing as his potential legal trouble depends on which state he lives in, and that he probably wanted the best legal advice possible, that he told the truth about living in New Jersey.

These two selfxemployeds are probably the same person, but we still find yet another one on the site Freelancer.com who not only says that he lives in New Jersey, but also in Jersey City, where Renniel lives.

This one placed an ad on February 7th, 2010, looking for people to promote his adult site by uploading videos to sites like YouPorn and RedTube.

Getting back to the selfxemployed of Blackhatworld.com, we see that on March 28th, 2010 he started a thread "I have my own personal vigilante", where he complained that someone has been getting his sites shut down and wanted advice on what do do about the person.

Alright for the past two months or so, this guy has been following my ads and replying to them, he then gets my auto-reply which is hosted on a web host and then he contacts my web host with a bunch of spam complaints and gets me shut down. I figured I would stop posting in his city, which worked for a little bit then I guess he found me again and is threatening to shut me down again. I have his IP, but I'm still not sure what to do with it. I don't want to do anything extreme, I just want it so he can never bother me again. Any advice is appreciated.

P.S - Yes, I've dealt with other people that have threatened me before and but this is the only guy that has managed to actually shut down my web host and I have a strong feeling he will continue to do so.

The first time that I had any contact with the person who operates the essay scam was on March 1st. Here was the message with some of the headers.

X-Apparently-To: ***@***.*** via 76.13.12.211; Mon, 01 Mar 2010 21:44:30 -0800
Return-Path: <morality@echo13.my365host.org>
X-Originating-IP: [79.143.184.201]
Received: from 127.0.0.1 (EHLO echo13.my365host.org) (79.143.184.201) by mta177.mail.sp2.yahoo.com with SMTP; Mon, 01 Mar 2010 21:44:29 -0800
Received: from morality by echo13.my365host.org with local (Exim 4.69) (envelope-from <morality@echo13.my365host.org>) id 1NmJyj-00054Y-De for ***@***.***; Mon, 01 Mar 2010 22:44:41 -0600
To: *** <***@***.***>
Subject: RE: Craigslist ad
Date: Mon, 1 Mar 2010 22:45:05 -0600
From: lushizxlauren <lushiizlaurenx@gmail.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1_ae985371202043c6b5a01865271fd84f"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - echo13.my365host.org
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [740 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - echo13.my365host.org
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php
X-Source-Dir: moralityresearchpapers.org:/public_html/gmail

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash (i need someone with paypal), you`ll just get blocked. there are 5 essays on the site below, all i need is 1 (it doesnt matter which one) but all 5 would be great too ;] no one has pulled through yet, so let me know if your down.

HumanMoralityResearch.net // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO lushiizlaurenx+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

The first site of his that I got shut down was moralitytermpapers.tumblr.com. This happened on March 7th.

Date: Sun, 7 Mar 2010 14:07:51 +0000
From: Tumblr Support
To: *****
Message-Id: <4b93b24ea781e_544db231303be@tumblr.assistly.com>
In-Reply-To: <SNT118-W348F5519C524EDC0A051AC4360@phx.gbl>
Subject: Re: Tumblr Scam Site (Case 19162)
Content-Type: text/plain
Content-Transfer-Encoding: Quoted-printable
X-Mailer: Assistly Support Platform
Return-Path: support@tumblr.com
X-OriginalArrivalTime: 07 Mar 2010 14:07:51.0954 (UTC) FILETIME=[9353E720:01CABDFF]

__________________________________
Please reply above this line
------------------------------------------------------

That blog has been suspended.

Marc

--
Tumblr Support
support@tumblr.com

March 28th, when selfxemployed wrote about his sites being shut down, is actually only three weeks after I got the site shut down. He might have said "months" instead of "weeks" by accident, because in a later post on April 8th that he made in someone else's thread called "CL Self Proclaimed Cop", he says that the vigilante has been bothering him for two weeks, not a couple months. He also says that someone posted his ads on a scam forum. My first post about the essay scam was made on March 31st.

I've been going through the same thing for the past two weeks. This guy just doesn't have anything better to do. I have an autoresponder script hosted on my web host which shows the server info in the headers, so he sends multiple complaints from different emails to my hosts and they shut me down. He even posted my ads on a scam forum, lol. Then when the host would shut me down, he would write me an email taunting me. There's no point of posting his email though for our BHW family to spam because its probably a disposable one. I do have his IP though, we can all send complaints to his ISP My best piece of advice is to just ignore it and keep it moving.

Another thread that selfxemployed started was "[WTB] Verified Indian PayPal account".

This was on April 28th, while his sites were still being shut down. Why would he want a PayPal account in India? Well, people involved in fraud sometimes use foreign PayPal accounts in order to make it easier for them to evade the authorities.

On May 3rd, he posted "[WTH] Host my PHP Autoresponder". He was specifically looking for an offshore hosting service that would ignore complaints about his websites.

All of this is interesting enough, but there's even more. There is another selfxemployed. This one is on the site CodingForums.com. Back on May 9th, 2009, he posted the thread "Delayed AutoResponder Errors", where he asked for advice about some problems he was having with the programming language PHP. The errors were in a file on his site that had the path

/home/sandip89/public_html/email/autoresponder.php

The file autoresponder.php is used to generate automatic email responses. It has the same name as the file that was used to generate the first email message I received from the scammer which I showed you earlier.

X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php

The structure of the two paths is similar, with one of the exceptions being that in the forum post, instead of the home directory being named morality, like in the first message, it is named sandip89. Sandip89 was also the name of the account that the scammer had with HostGator, and Sandip is the name of one of Renniel's friends.

Delivered-To: ***@***.***
Received: by 10.229.81.8 with SMTP id v8cs36171qck;
Fri, 12 Mar 2010 08:59:21 -0800 (PST)
Received: by 10.101.209.21 with SMTP id l21mr1269306anq.114.1268413159513;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Return-Path: <sandip89@gator625.hostgator.com>
Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [69.56.236.19])
by mx.google.com with SMTP id 6si2925646gxk.72.2010.03.12.08.59.18;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Received-SPF: pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) client-ip=69.56.236.19;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) smtp.mail=sandip89@gator625.hostgator.com
Received: (qmail 2201 invoked from network); 12 Mar 2010 16:59:27 -0000
Received: from gator625.hostgator.com (174.132.105.226)
by gateway01.websitewelcome.com with SMTP; 12 Mar 2010 16:59:27 -0000
Received: from sandip89 by gator625.hostgator.com with local (Exim 4.69)
(envelope-from <sandip89@gator625.hostgator.com>)
id 1Nq8Cf-0006iC-JM
for ***@***.***; Fri, 12 Mar 2010 10:59:13 -0600
To: *** <***@***.***>
Subject: RE: Your CL Ad
Date: Fri, 12 Mar 2010 10:59:13 -0600
From: aznsensationx <therealaznsensationx@gmail.com>
Message-ID: <bc174ec81efb2c4706b9a8abdeb07b5d@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_bc174ec81efb2c4706b9a8abdeb07b5d"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator625.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32266 32269] / [47 12]
X-AntiAbuse: Sender Address Domain - gator625.hostgator.com


--b1_bc174ec81efb2c4706b9a8abdeb07b5d
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

MoralityEssaysGalore // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy one of the essays (doesnt matter which one), forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

But this is still not all. There is yet another selfxemployed on the site WickedFire.com. On April 6th, 2010 he posted an ad titled "[WTS] Craigslist Personals Lead Service // Up to 1,000 Exclusive Leads".

This is almost identical to the ad that Renniel admits to posting on that very same day over at DigitalPoint.com. The rates offered are the same and the wording and formatting vary just slightly.

On this same site, selfxemployed advertises a delayed autoresponder that he says is perfect for e-whoring (pretending to be a girl online in order to scam men out of their money).

So let's see what he have now. The essential data we have found are:

1. Renniel admits to having owned the site ringtonezgalore.net.


2. Someone using the name selfxemployed promoted ringtonezgalore.net on Digg.


3. There is someone on the site Blackhatworld.com who calls himself selfxemployed who had a passion for being a blend DJ, just like Renniel.


4. This selfxemployed talked about running an e-whoring scam that involved him pretending to be a girl who promises to meet a man if this man would buy an e-book for her first.


5. On the site expertlaw.com, someone called selfxemployed discusses the same scam and states that he lives in New Jersey.


6. On the site Freelancer.com there is a selfxemployed who markets porn and says that he lives in Jersey City, Renniel's town.


7. The selfxemployed on Blackhatworld.com had someone shutting down his scam sites during the same time I was shutting down the essay scam sites. The person who shut down his scam sites posted about them on an anti-fraud forum, just like I posted about the essay scam sites on aa419.org.


8. There is a selfxemployed on CodingForums.com who had a site that used an email autoresponder that was in a directory for an account named sandip89, and sandip89 is the name of one of the HostGator accounts used for the scam. Also, Renniel has a friend named Sandip.


9. On the same day that Renniel posted his ad on DigitalPoint.com offering a Craigslist posting service, a selfxemployed on WickedFire.com also posted an ad for a Craigslist posting service, and except for minor differences it is identical to the one that Renniel posted.


10. This selfxemployed sold an email autoresponder that he said was perfect for e-whoring.

Now, given all of this, and given all of the evidence that was discovered back in May, and the evidence from the past two days, wouldn't you say that there is only one reasonable conclusion for us to make? Does this matter really need to be given any more thought? I don't think so, and I think that we can finally make up our minds and consider this case solved.

Merry Christmas, Renniel!

Renniel Fernandez Admits He Is xlastomohicanx

Well, Renniel has admitted that he is xlastohmohicanx, the guy who promoted KillerRingtones.net, just as did KillerRingtones of Digg. It's interesting that he didn't mention knowing anything about KillerRingtones at all in his posts at aa419.org. You'd think that the name would have rung a bell.

KillerRingtones and xlastomohicanx

Remember the Digg profile for KillerRingtones? This was the Digg profile for someone who calls himself Renniel Fernandez and advertised an iPhone giveaway on FreeShizznet.com, one of the sites used for the scam.




KillerRingtones spent a bit of time promoting the site KillerRingtones.net.




There is also someone on the site bicellphone.com who has promoted KillerRingtones.net. His alias is xlastomohicanx.




On answers.yahoo.com, there is also someone with the alias xlastomohicanx who promoted KillerRingtones.net. He'd reply to questions about where to get ringtones by telling the asker of the question to go to KillerRingtones.net. For example,

Where can i find this as a ringtone?
Where can i find a Family Guy ringtone?
Where can I find a website for ringtones that willnot damage my phone?

And many others.

On October 22nd, 2007, this xlastomohicanx got his license suspenended for thirty days in New Jersey.

My license was suspended by a judge on October 22, 2007 for 30 days. I called the DMV to see if I was allowed to restore it but they said that the municipal court never sent them anything about my license being suspended. So according to the DMV, my license was never suspended. The court DID take my license away from me and I haven't drove for 30 days. I even had to drop out of college because I had no means of transportation. My main concern is that if I call the municipal court and tell them that the DMV never received anything from them that they will suspend my license for ANOTHER 30 days. Are they allowed to do that because if they are, I will be extremely pissed. Thanks in advance.

I wonder who else in New Jersey might have had his license suspended for 30 days on October 22nd, 2007, and ended up having to drop his college classes because of it...

Privacy and Your Rights Research Paper

A sample ad

saturday bj fun - w4m - 27

Do you like deep throat bj? i do something new kind of Bj so let me know if you want a head around your part
i can probably not host but something may be worked out.. bj and possibly more if you are interested

A sample email message with headers:

Delivered-To:***@***.***
Received: by 10.42.213.66 with SMTP id gv2cs49103icb;
Mon, 20 Dec 2010 15:27:10 -0800 (PST)
Received: by 10.236.95.1 with SMTP id o1mr8839984yhf.67.1292887629869;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Return-Path: <authorx@gator1098.hostgator.com>
Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [69.56.159.26])
by mx.google.com with SMTP id i51si9111008yhd.109.2010.12.20.15.27.09;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Received-SPF: pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) client-ip=69.56.159.26;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) smtp.mail=authorx@gator1098.hostgator.com
Received: (qmail 7994 invoked from network); 20 Dec 2010 23:26:21 -0000
Received: from gator1098.hostgator.com (174.120.180.194)
by gateway07.websitewelcome.com with SMTP; 20 Dec 2010 23:26:21 -0000
Received: from authorx by gator1098.hostgator.com with local (Exim 4.69)
(envelope-from <authorx@gator1098.hostgator.com>)
id 1PUp8D-0008Jg-C2
for ***; Mon, 20 Dec 2010 17:27:05 -0600
To: *** <***@***.***>
Subject: ***
Date: Mon, 20 Dec 2010 17:27:04 -0600
From: laurenxlove89 <laurenxlove89@gmail.com>
Message-ID: <1cbe3fffa0c51213a88567c3ff6f475b@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_1cbe3fffa0c51213a88567c3ff6f475b"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1098.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1467 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1098.hostgator.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/authorx/public_html/reply/autoresponder.php
X-Source-Dir: freetrialsgalore.net:/public_html/reply

--b1_1cbe3fffa0c51213a88567c3ff6f475b
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, first off id like to say that im a real person and this is a real proposal. if you want to meet up, i need you to buy the research paper thats below.


Privacy and Rights Paper :: Buy Now!


first guy to send proof wins. i need the paper for my history class because i was instrcuted to write one but was too lazy and busy to. you can just send me proof like a receipt or one paragraph before we actually link up, then you can send me the full paper after we have our fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.

His new blog is privacyandrightspaper.blogspot.com.

Privacy and Your Rights Research Paper

Privacy and Your Rights Paper
Title: Privacy and Your Rights Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download Via Email

The PayPal business name he is using is Term Papers Inc and the email address he is using for his PayPal account is researchpapersgalore@hotmail.com.

Privacy First Research Paper

Here's one of Renniel's new ads:

newyork.craigslist.org/wch/cas/2115314709.html

Ass licking - w4m

Date: 2010-12-15, 10:46PM EST
Reply to: pers-cx5h8-2115314709@craigslist.org

Are you a kinky guy? if not, dont bother replying. i want all my holes satisfied tonight

This is a sample e-mail message including the headers:

Delivered-To: ***@***.***
Received: by 10.220.193.130 with SMTP id du2cs105144vcb;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received: by 10.100.4.13 with SMTP id 13mr4931369and.108.1292477525226;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Return-Path: <onthegoc@gator1294.hostgator.com>
Received: from gateway03.websitewelcome.com ([69.93.87.23])
by mx.google.com with SMTP id a19si4758204ana.7.2010.12.15.21.32.04;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received-SPF: pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) client-ip=69.93.87.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) smtp.mail=onthegoc@gator1294.hostgator.com
Received: (qmail 6321 invoked from network); 16 Dec 2010 05:31:38 -0000
Received: from 173.192.111.10-static.reverse.softlayer.com (HELO gator1294.hostgator.com) (173.192.111.10)
by gateway03.websitewelcome.com with SMTP; 16 Dec 2010 05:31:38 -0000
Received: from onthegoc by gator1294.hostgator.com with local (Exim 4.69)
(envelope-from <onthegoc@gator1294.hostgator.com>)
id 1PT6Rd-0007Cb-KA
for ***@***.***; Wed, 15 Dec 2010 23:32:01 -0600
To: *** <***@***.***>
Subject: ***
Date: Wed, 15 Dec 2010 23:32:01 -0600
From: brianaxcore <brianaxcore@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_b479a860b083f61149c309cb831b4d00"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1294.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1050 1047] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1294.hostgator.com


hey, *** im real and this is a real offer. if you want to link up, i need you to buy me the research paper below.

Privacy First Research Paper For $47.99

first come, first serve. i need it for my history class because i was supposed to write one but was too lazy to. you can just email me proof like a receipt or one paragraph before we actually meet up, then you can send me the full paper after we have fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.

This is the scam site:

privacyfirstresearchpaper.blogspot.com

Privacy First Research Paper
Purchase a research paper based on the history of privacy and the government.

Privacy First Research Paper
Title: Privacy First Research Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download via email

The email address he's using for his PayPal account his historyresearchpapers@hotmail.com.

Against the Bill E-Book

This is the website he's now using for selling the essays:

against-the-bill-ebook.blogspot.com

Against the Bill E-Book

Purchase the E-book of an author's point of view on the Bill.

Against the Bill E-Book :: $47.99
Title: Against the Bill

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate Download Via Email

Here's a sample email message:

Delivered-To: ***@***.***
Received: by 10.231.174.14 with SMTP id r14cs522332ibz;
Wed, 1 Dec 2010 21:23:19 -0800 (PST)
Received: by 10.213.3.66 with SMTP id 2mr261442ebm.82.1291267397933;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Return-Path: <wehostre@semi3.wrzhost.com>
Received: from semi3.wrzhost.com ([217.23.12.85])
by mx.google.com with ESMTP id s18si265192eeh.75.2010.12.01.21.23.17;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Received-SPF: neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) client-ip=217.23.12.85;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) smtp.mail=wehostre@semi3.wrzhost.com
Received: from wehostre by semi3.wrzhost.com with local (Exim 4.69)
(envelope-from <wehostre@semi3.wrzhost.com>)
id 1PO1dS-00087N-KG
for ***@***.***; Thu, 02 Dec 2010 06:23:16 +0100
To: *** <***@***.***>
Subject: ***
Date: Thu, 2 Dec 2010 06:23:14 +0100
From: isexynymphoi <isexynymphoi@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_a3a5bc5871ddd131ee4013ce17e6a1ce"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - semi3.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [875 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - semi3.wrzhost.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/wehostre/public_html/mail/autoresponder.php
X-Source-Dir: wehostreplies.net:/public_html/mail

--b1_a3a5bc5871ddd131ee4013ce17e6a1ce
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i have an interesting proposition before we meet up - hope you can handle it. if you are the first guy to send me the research paper below or proof that you bought it, we can meet up at a public place (starbucks or something) and then to my place. im a history major and i need it for one of my classes. whats in it for you? a friend with benefits ;] please dont ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get ignored. no one has pulled through yet, so let me know if your down.

Against The Bill E-Book // Buy It Now for $47.99


so basically, buy the research paper, send me the receipt, we meet up somewhere convenient then go somewhere private, have fun, after our fun is done, you send me the e-book and if you're good, then you'll be hearing from me again. SEND THE PROOF TO isexynymphoi+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

The email address he's using for his PayPal account is ebooksonhistory@hotmail.com.
Using Renniel's name, I sent an email message to this address to tell this guy what I thought of him. I got back a response:

Delivered-To: ***@***.***
Received: by 10.100.45.20 with SMTP id s20cs24918ans;
Thu, 2 Dec 2010 06:20:39 -0800 (PST)
Received: by 10.142.126.14 with SMTP id y14mr320913wfc.132.1291299638460;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Return-Path:
Received: from snt0-omc3-s29.snt0.hotmail.com (snt0-omc3-s29.snt0.hotmail.com [65.55.90.168])
by mx.google.com with ESMTP id g35si1396190qcs.66.2010.12.02.06.20.37;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Received-SPF: pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) client-ip=65.55.90.168;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) smtp.mail=ebooksonhistory@hotmail.com
Received: from SNT142-W14 ([65.55.90.136]) by snt0-omc3-s29.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 2 Dec 2010 06:19:39 -0800
Message-ID:
Return-Path: ebooksonhistory@hotmail.com
Content-Type: multipart/alternative;
boundary="_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_"
X-Originating-IP: [98.221.193.230]
From: Steve Doe
To: <***@***.***>
Subject: RE: You are such an asshole
Date: Thu, 2 Dec 2010 09:19:39 -0500
Importance: Normal
In-Reply-To:
References:
MIME-Version: 1.0
X-OriginalArrivalTime: 02 Dec 2010 14:19:39.0672 (UTC) FILETIME=[F4B19980:01CB922B]

--_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


Aw, the copies are sold out Mr. Fernandez. I'm sorry. You can try
getting a copy from the last two customers listed on the blog. I'll see
you around at "St. Peters".

The header field X-Originating-IP, which is the IP address of the machine from which the message was sent, has the value 98.221.193.230. If you go to cqcounter.com/whois/ and look up this IP you'll see that it is owned by Comcast in Jersey City, NJ, where Renniel lives.