Selfxemployed: The Final Piece of the Puzzle

We've already seen that Renniel has admitted that the site ringtonezgalore.net was his. He said over at aa419.org that "If you're wondering, yes, I owned RingtonezGalore.net for PPC purposes." It turns out that on Digg.com there is a submission advertising a ringtone available on the site ringtonezgalore.net.

Notice that the person who submitted the link has the alias selfxemployed. Renniel has a Myspace profile with the URL myspace.com/selfemployedislandboy.

Renniel is self-employed and "islandboy" refers to the fact that he is Filipino. ("Island boy" is a nickname for someone from the Phillipine islands.) The similarity between "selfemployedislandboy" and "selfxemployed" is interesting in itself, but it is when we do a search for selfxemployed that things get really interesting.

The site Blackhatworld.com is one place where we find someone who uses the name selfxemployed. In the thread "My first mashup vid/song", where user mjd2nd asks for advice on a blend that he made, selfxemployed tells us "my whole life once revolved around making blends, but i gave up that part of my life to venture into internet marketing." As many of you already know, Renniel was once a blend DJ and he even stated that DJing was "his true passion".

On May 31st, 2009, selfxemployed started the thread "How much trouble can I get into if ...", where he asks about the legal ramifications of scamming men out of their money by promising them a meet-up with a girl if they purchased a an e-book for her:

I promised horny guys a meet up if they bought me an ebook that i really wanted but the ebook product was mine? For those of you who downloaded the e-whore twister method know what im talking about, but that method promises a cam show. Should i promise that instead of a meet up to avoid any troubles? Isn't this close to theft on false pretenses? Thanks in advance.

The question of the possible danger of getting in trouble for this scam didn't appear to be settled by the replies he got, because four months later, on September 28th, 2009, we find someone calling himself selfxemployed on the site expertlaw.com who started a thread "Scammed By a Girl I Met Online" that asked about a similar situation. But in this case, selfxemployed asks about the situation from the point of view of the victim.

I met a girl online through Match - she said she would meet up with me if I purchased a report for her that she needed for class. I sent her proof that I bought it and I asked her if I could send her the full paper during our meet up and she agreed. Like the idiot I am, I included the transaction id when I sent the proof. Now the girl is having cold feet to meet up. What would you guys consider this? I buy the paper, now she doesn't want to meet up. I suspect she is reaping profits by selling the paper and I may not be the only one. If this were true, would this be considered theft by deception and is there anything I can do? Thanks in advance.

Since this is a legal question, the answer would depend on which state this person is in. He says he is in New Jersey.

I'm in New Jersey. She claimed to be a college student, told me where she was going to school and all. The paper I bought seems to be college material. What if this "girl in need" isn't really a girl at all and if it's some guy making sales off the purchases? I sent proof, I didn't send the full paper and she disappeared. Maybe she got it from someone else? Who knows.

Now, what is the likelihood that someone that was actually taken by this scam just happens to have the same online alias as someone who asks about operating the scam? Which seems more realistic, that these are in fact two different people, or that this other selfxemployed is just the scammer trying to get better advice on what sort of legal recourse his victims would have? I'd say the latter, and I'd also say that seeing as his potential legal trouble depends on which state he lives in, and that he probably wanted the best legal advice possible, that he told the truth about living in New Jersey.

These two selfxemployeds are probably the same person, but we still find yet another one on the site Freelancer.com who not only says that he lives in New Jersey, but also in Jersey City, where Renniel lives.

This one placed an ad on February 7th, 2010, looking for people to promote his adult site by uploading videos to sites like YouPorn and RedTube.

Getting back to the selfxemployed of Blackhatworld.com, we see that on March 28th, 2010 he started a thread "I have my own personal vigilante", where he complained that someone has been getting his sites shut down and wanted advice on what do do about the person.

Alright for the past two months or so, this guy has been following my ads and replying to them, he then gets my auto-reply which is hosted on a web host and then he contacts my web host with a bunch of spam complaints and gets me shut down. I figured I would stop posting in his city, which worked for a little bit then I guess he found me again and is threatening to shut me down again. I have his IP, but I'm still not sure what to do with it. I don't want to do anything extreme, I just want it so he can never bother me again. Any advice is appreciated.

P.S - Yes, I've dealt with other people that have threatened me before and but this is the only guy that has managed to actually shut down my web host and I have a strong feeling he will continue to do so.

The first time that I had any contact with the person who operates the essay scam was on March 1st. Here was the message with some of the headers.

X-Apparently-To: ***@***.*** via 76.13.12.211; Mon, 01 Mar 2010 21:44:30 -0800
Return-Path: <morality@echo13.my365host.org>
X-Originating-IP: [79.143.184.201]
Received: from 127.0.0.1 (EHLO echo13.my365host.org) (79.143.184.201) by mta177.mail.sp2.yahoo.com with SMTP; Mon, 01 Mar 2010 21:44:29 -0800
Received: from morality by echo13.my365host.org with local (Exim 4.69) (envelope-from <morality@echo13.my365host.org>) id 1NmJyj-00054Y-De for ***@***.***; Mon, 01 Mar 2010 22:44:41 -0600
To: *** <***@***.***>
Subject: RE: Craigslist ad
Date: Mon, 1 Mar 2010 22:45:05 -0600
From: lushizxlauren <lushiizlaurenx@gmail.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1_ae985371202043c6b5a01865271fd84f"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - echo13.my365host.org
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [740 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - echo13.my365host.org
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php
X-Source-Dir: moralityresearchpapers.org:/public_html/gmail

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash (i need someone with paypal), you`ll just get blocked. there are 5 essays on the site below, all i need is 1 (it doesnt matter which one) but all 5 would be great too ;] no one has pulled through yet, so let me know if your down.

HumanMoralityResearch.net // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO lushiizlaurenx+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!

The first site of his that I got shut down was moralitytermpapers.tumblr.com. This happened on March 7th.

Date: Sun, 7 Mar 2010 14:07:51 +0000
From: Tumblr Support
To: *****
Message-Id: <4b93b24ea781e_544db231303be@tumblr.assistly.com>
In-Reply-To: <SNT118-W348F5519C524EDC0A051AC4360@phx.gbl>
Subject: Re: Tumblr Scam Site (Case 19162)
Content-Type: text/plain
Content-Transfer-Encoding: Quoted-printable
X-Mailer: Assistly Support Platform
Return-Path: support@tumblr.com
X-OriginalArrivalTime: 07 Mar 2010 14:07:51.0954 (UTC) FILETIME=[9353E720:01CABDFF]

__________________________________
Please reply above this line
------------------------------------------------------

That blog has been suspended.

Marc

--
Tumblr Support
support@tumblr.com

March 28th, when selfxemployed wrote about his sites being shut down, is actually only three weeks after I got the site shut down. He might have said "months" instead of "weeks" by accident, because in a later post on April 8th that he made in someone else's thread called "CL Self Proclaimed Cop", he says that the vigilante has been bothering him for two weeks, not a couple months. He also says that someone posted his ads on a scam forum. My first post about the essay scam was made on March 31st.

I've been going through the same thing for the past two weeks. This guy just doesn't have anything better to do. I have an autoresponder script hosted on my web host which shows the server info in the headers, so he sends multiple complaints from different emails to my hosts and they shut me down. He even posted my ads on a scam forum, lol. Then when the host would shut me down, he would write me an email taunting me. There's no point of posting his email though for our BHW family to spam because its probably a disposable one. I do have his IP though, we can all send complaints to his ISP My best piece of advice is to just ignore it and keep it moving.

Another thread that selfxemployed started was "[WTB] Verified Indian PayPal account".

This was on April 28th, while his sites were still being shut down. Why would he want a PayPal account in India? Well, people involved in fraud sometimes use foreign PayPal accounts in order to make it easier for them to evade the authorities.

On May 3rd, he posted "[WTH] Host my PHP Autoresponder". He was specifically looking for an offshore hosting service that would ignore complaints about his websites.

All of this is interesting enough, but there's even more. There is another selfxemployed. This one is on the site CodingForums.com. Back on May 9th, 2009, he posted the thread "Delayed AutoResponder Errors", where he asked for advice about some problems he was having with the programming language PHP. The errors were in a file on his site that had the path

/home/sandip89/public_html/email/autoresponder.php

The file autoresponder.php is used to generate automatic email responses. It has the same name as the file that was used to generate the first email message I received from the scammer which I showed you earlier.

X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php

The structure of the two paths is similar, with one of the exceptions being that in the forum post, instead of the home directory being named morality, like in the first message, it is named sandip89. Sandip89 was also the name of the account that the scammer had with HostGator, and Sandip is the name of one of Renniel's friends.

Delivered-To: ***@***.***
Received: by 10.229.81.8 with SMTP id v8cs36171qck;
Fri, 12 Mar 2010 08:59:21 -0800 (PST)
Received: by 10.101.209.21 with SMTP id l21mr1269306anq.114.1268413159513;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Return-Path: <sandip89@gator625.hostgator.com>
Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [69.56.236.19])
by mx.google.com with SMTP id 6si2925646gxk.72.2010.03.12.08.59.18;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Received-SPF: pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) client-ip=69.56.236.19;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) smtp.mail=sandip89@gator625.hostgator.com
Received: (qmail 2201 invoked from network); 12 Mar 2010 16:59:27 -0000
Received: from gator625.hostgator.com (174.132.105.226)
by gateway01.websitewelcome.com with SMTP; 12 Mar 2010 16:59:27 -0000
Received: from sandip89 by gator625.hostgator.com with local (Exim 4.69)
(envelope-from <sandip89@gator625.hostgator.com>)
id 1Nq8Cf-0006iC-JM
for ***@***.***; Fri, 12 Mar 2010 10:59:13 -0600
To: *** <***@***.***>
Subject: RE: Your CL Ad
Date: Fri, 12 Mar 2010 10:59:13 -0600
From: aznsensationx <therealaznsensationx@gmail.com>
Message-ID: <bc174ec81efb2c4706b9a8abdeb07b5d@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_bc174ec81efb2c4706b9a8abdeb07b5d"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator625.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32266 32269] / [47 12]
X-AntiAbuse: Sender Address Domain - gator625.hostgator.com


--b1_bc174ec81efb2c4706b9a8abdeb07b5d
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

MoralityEssaysGalore // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy one of the essays (doesnt matter which one), forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

But this is still not all. There is yet another selfxemployed on the site WickedFire.com. On April 6th, 2010 he posted an ad titled "[WTS] Craigslist Personals Lead Service // Up to 1,000 Exclusive Leads".

This is almost identical to the ad that Renniel admits to posting on that very same day over at DigitalPoint.com. The rates offered are the same and the wording and formatting vary just slightly.

On this same site, selfxemployed advertises a delayed autoresponder that he says is perfect for e-whoring (pretending to be a girl online in order to scam men out of their money).

So let's see what he have now. The essential data we have found are:

1. Renniel admits to having owned the site ringtonezgalore.net.


2. Someone using the name selfxemployed promoted ringtonezgalore.net on Digg.


3. There is someone on the site Blackhatworld.com who calls himself selfxemployed who had a passion for being a blend DJ, just like Renniel.


4. This selfxemployed talked about running an e-whoring scam that involved him pretending to be a girl who promises to meet a man if this man would buy an e-book for her first.


5. On the site expertlaw.com, someone called selfxemployed discusses the same scam and states that he lives in New Jersey.


6. On the site Freelancer.com there is a selfxemployed who markets porn and says that he lives in Jersey City, Renniel's town.


7. The selfxemployed on Blackhatworld.com had someone shutting down his scam sites during the same time I was shutting down the essay scam sites. The person who shut down his scam sites posted about them on an anti-fraud forum, just like I posted about the essay scam sites on aa419.org.


8. There is a selfxemployed on CodingForums.com who had a site that used an email autoresponder that was in a directory for an account named sandip89, and sandip89 is the name of one of the HostGator accounts used for the scam. Also, Renniel has a friend named Sandip.


9. On the same day that Renniel posted his ad on DigitalPoint.com offering a Craigslist posting service, a selfxemployed on WickedFire.com also posted an ad for a Craigslist posting service, and except for minor differences it is identical to the one that Renniel posted.


10. This selfxemployed sold an email autoresponder that he said was perfect for e-whoring.

Now, given all of this, and given all of the evidence that was discovered back in May, and the evidence from the past two days, wouldn't you say that there is only one reasonable conclusion for us to make? Does this matter really need to be given any more thought? I don't think so, and I think that we can finally make up our minds and consider this case solved.

Merry Christmas, Renniel!