Wednesday, January 26, 2011

Checkmate, Renniel

I'm trying to explore the psychological aspects of it. If I was the scammer, I'd be a complete idiot with those slip ups...

-- Renniel, over at aa419.org



Well, Renniel, the game is up. We now have indisputable proof that you are the scammer.

If you've used Blogger, you might now that it provides you with some statistics about visits to your blog. These statistics are very basic. They don't allow you to see visitors' IP addresses or track an individual's movements. However, you can get free widgets to put on your blogs that do allow you to do these things. For instance, there's the visitor tracker widget provided by TraceMyIP.org. You can sign up for a free account with them and they'll provide you with a JavaScript widget that you place on your blog. If you have multiple blogs, then you'll have multiple widgets, but an individual will maintain a unique identity across all of these blogs. This widget records the IPs of visitors, their browser types, and other information, and puts it into a database. You can then view all this information on their website. The really great thing about it is that it not only records IPs, it also uses cookies to keep track of people. This way, if someone changes his IP, you'll still know who he is when he visits your blogs again because the cookie that was placed on his computer uniquely identifies him.

If there's a particular individual you're interested in, you can tag him and put him in a contacts list. You give him a name and you'll easily be able to view all of his activity by looking him up in your contacts list and clicking a link.

Well, folks, here's what I did. On this blog, I set up a hidden page. It was a standalone page, not a blog post. Furthermore, there were no links to it anywhere on this site, so unless you knew the URL for it you wouldn't be able to see it. I put a TraceMyIP.org tracker on that page and I sent the URL for the page to Renniel via Facebook and I also emailed it to him at djadulesentz@gmail.com. The page is now titled "Does this look familiar?"

I also created another blog, brianaxcore.blogspot.com. "Brianaxcore" is the name of one of the gmail accounts used by the scammer. On this new blog, I also set up a hidden page and put an IP tracker on it. Then I emailed the URL for the page to three of the accounts that the scammer has used: brianaxcore@gmail.com, domerightx@ymail.com, and therighttoprivacypaper@hotmail.com.

Here are the visitor tracking projects I created:



I then monitored the hits for these pages. At 12:26 AM (11:26 AM Eastern time) there was a hit on the hidden page on brianaxcore.blogspot.com. The IP address of the visitor was 98.221.196.186 which belongs to Comcast Cable in Jersey City. I tagged this visitor and gave him the name Renniel Fernandez.



At 1:32 AM (12:32 AM Eastern time) there was a hit on the hidden page on this blog. And can you guess who that visitor was?



And here is a summary of Renniel's browsing activity across both blogs. (Note: I removed the widgets from the pages after I had collected the data I wanted so that no one would be able to get access to the JavaScript code after I made all of this public. Hence no more hits will be recorded. Also, note that it mentions three projects but you only see two. That's because Renniel never visited the third one.)



So, how are you going to explain all of this, Renniel? What sort of story will you come up with this time? Oh, let me guess... the scammer was able to get a remote access trojan installed on your Mac and so he's operating from your computer. Is that it? Or do you have something even more unbelievable to tell us?

Face it, son, you have been beaten. Hell, you were beaten back in May when I tracked you down and found your Facebook account. Even though there was no smoking gun, the way that you behaved when you messaged me convinced me that you were the scammer. It was those subtle things like that first word you said to my "Lauren" profile:



Fake. Why would you immediately say that to her, but not say anything like that at all to the other profile I used to communicate with you, when they were both practically blank, when there was nothing that made either of them appear more genuine than the other?



Because you were playing around. She was your fake identity and you amused yourself by immediately calling her out as a fake. It was obvious to me, even though I couldn't "prove it". And this is just one example of your behavior that indicated but did not prove your guilt. But now, nothing more needs to be proven.

It's time to admit defeat, boy. Are you going to finally come clean, and admit that you're guilty, or are you going to remain stubborn, and continue to lie and embarrass yourself even more?

Tuesday, January 25, 2011

yourrighttoprivacyresearch.blogspot.com

His new scam site is yourrighttoprivacyresearch.blogspot.com.

The Right To Privacy Paper

The Right to Privacy Paper - $47.99
Title: The Right To Privacy

Price: $47.99

Words: 2143

Pages: 7

Delivery: Immediate download via Email


The message he sent along with some of the message headers:

X-Apparently-To: ****** via 98.138.85.150; Mon, 24 Jan 2011 20:55:59 -0800
Return-Path: <domerightx@ymail.com>
X-YahooFilteredBulk: 98.138.90.97
Received-SPF: none (mta1402.mail.mud.yahoo.com: domain of domerightx@ymail.com does not designate permitted sender hosts)
X-Originating-IP: [98.138.90.97]
Authentication-Results: mta1402.mail.mud.yahoo.com from=ymail.com; domainkeys=pass (ok); from=ymail.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO web121403.mail.ne1.yahoo.com) (98.138.90.97) by mta1402.mail.mud.yahoo.com with SMTP; Mon, 24 Jan 2011 20:55:59 -0800
Received: (qmail 98267 invoked by uid 60001); 25 Jan 2011 04:55:58 -0000
Received: from [65.111.177.63] by web121403.mail.ne1.yahoo.com via HTTP; Mon, 24 Jan 2011 20:55:58 PST
X-Mailer: YahooMailClassic/11.4.20 YahooMailWebService/0.8.107.285259
Date: Mon, 24 Jan 2011 20:55:58 -0800 (PST)
From: This sender is DomainKeys verified domerightx <domerightx@ymail.com> Add sender to Contacts
Subject: Re: ******
To: ***** <******>

hey, i have an interesting proposition before we meet up - hope you can handle it. if you are the first guy to send me the research paper below or proof that you bought it, we can meet up at a public place (starbucks or something) and then to my place. im a history major and i need it for one of my classes. whats in it for you? a friend with benefits ;] please dont ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get ignored. no one has pulled through yet, so let me know if your down.

The Right to Privacy Paper :: Buy It Now!

so basically, buy the research paper, send me the receipt, we meet up somewhere convenient then go somewhere private, have fun, after our fun is done, you send me the paper and if you're good, then you'll be hearing from me again.

SEND THE PROOF TO domerightx@ymail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!


The e-mail address he's using for his PayPal account is therighttoprivacypaper@hotmail.com.

Saturday, December 25, 2010

Selfxemployed: The Final Piece of the Puzzle

We've already seen that Renniel has admitted that the site ringtonezgalore.net was his. He said over at aa419.org that "If you're wondering, yes, I owned RingtonezGalore.net for PPC purposes." It turns out that on Digg.com there is a submission advertising a ringtone available on the site ringtonezgalore.net.





Notice that the person who submitted the link has the alias selfxemployed. Renniel has a Myspace profile with the URL myspace.com/selfemployedislandboy.





Renniel is self-employed and "islandboy" refers to the fact that he is Filipino. ("Island boy" is a nickname for someone from the Phillipine islands.) The similarity between "selfemployedislandboy" and "selfxemployed" is interesting in itself, but it is when we do a search for selfxemployed that things get really interesting.

The site Blackhatworld.com is one place where we find someone who uses the name selfxemployed. In the thread "My first mashup vid/song", where user mjd2nd asks for advice on a blend that he made, selfxemployed tells us "my whole life once revolved around making blends, but i gave up that part of my life to venture into internet marketing." As many of you already know, Renniel was once a blend DJ and he even stated that DJing was "his true passion".






On May 31st, 2009, selfxemployed started the thread "How much trouble can I get into if ...", where he asks about the legal ramifications of scamming men out of their money by promising them a meet-up with a girl if they purchased a an e-book for her:


I promised horny guys a meet up if they bought me an ebook that i really wanted but the ebook product was mine? For those of you who downloaded the e-whore twister method know what im talking about, but that method promises a cam show. Should i promise that instead of a meet up to avoid any troubles? Isn't this close to theft on false pretenses? Thanks in advance.





The question of the possible danger of getting in trouble for this scam didn't appear to be settled by the replies he got, because four months later, on September 28th, 2009, we find someone calling himself selfxemployed on the site expertlaw.com who started a thread "Scammed By a Girl I Met Online" that asked about a similar situation. But in this case, selfxemployed asks about the situation from the point of view of the victim.

I met a girl online through Match - she said she would meet up with me if I purchased a report for her that she needed for class. I sent her proof that I bought it and I asked her if I could send her the full paper during our meet up and she agreed. Like the idiot I am, I included the transaction id when I sent the proof. Now the girl is having cold feet to meet up. What would you guys consider this? I buy the paper, now she doesn't want to meet up. I suspect she is reaping profits by selling the paper and I may not be the only one. If this were true, would this be considered theft by deception and is there anything I can do? Thanks in advance.





Since this is a legal question, the answer would depend on which state this person is in. He says he is in New Jersey.
I'm in New Jersey. She claimed to be a college student, told me where she was going to school and all. The paper I bought seems to be college material. What if this "girl in need" isn't really a girl at all and if it's some guy making sales off the purchases? I sent proof, I didn't send the full paper and she disappeared. Maybe she got it from someone else? Who knows.





Now, what is the likelihood that someone that was actually taken by this scam just happens to have the same online alias as someone who asks about operating the scam? Which seems more realistic, that these are in fact two different people, or that this other selfxemployed is just the scammer trying to get better advice on what sort of legal recourse his victims would have? I'd say the latter, and I'd also say that seeing as his potential legal trouble depends on which state he lives in, and that he probably wanted the best legal advice possible, that he told the truth about living in New Jersey.

These two selfxemployeds are probably the same person, but we still find yet another one on the site Freelancer.com who not only says that he lives in New Jersey, but also in Jersey City, where Renniel lives.





This one placed an ad on February 7th, 2010, looking for people to promote his adult site by uploading videos to sites like YouPorn and RedTube.

Getting back to the selfxemployed of Blackhatworld.com, we see that on March 28th, 2010 he started a thread "I have my own personal vigilante", where he complained that someone has been getting his sites shut down and wanted advice on what do do about the person.

Alright for the past two months or so, this guy has been following my ads and replying to them, he then gets my auto-reply which is hosted on a web host and then he contacts my web host with a bunch of spam complaints and gets me shut down. I figured I would stop posting in his city, which worked for a little bit then I guess he found me again and is threatening to shut me down again. I have his IP, but I'm still not sure what to do with it. I don't want to do anything extreme, I just want it so he can never bother me again. Any advice is appreciated.

P.S - Yes, I've dealt with other people that have threatened me before and but this is the only guy that has managed to actually shut down my web host and I have a strong feeling he will continue to do so.






The first time that I had any contact with the person who operates the essay scam was on March 1st. Here was the message with some of the headers.

X-Apparently-To: ***@***.*** via 76.13.12.211; Mon, 01 Mar 2010 21:44:30 -0800
Return-Path: <morality@echo13.my365host.org>
X-Originating-IP: [79.143.184.201]
Received: from 127.0.0.1 (EHLO echo13.my365host.org) (79.143.184.201) by mta177.mail.sp2.yahoo.com with SMTP; Mon, 01 Mar 2010 21:44:29 -0800
Received: from morality by echo13.my365host.org with local (Exim 4.69) (envelope-from <morality@echo13.my365host.org>) id 1NmJyj-00054Y-De for ***@***.***; Mon, 01 Mar 2010 22:44:41 -0600
To: *** <***@***.***>
Subject: RE: Craigslist ad
Date: Mon, 1 Mar 2010 22:45:05 -0600
From: lushizxlauren <lushiizlaurenx@gmail.com>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="b1_ae985371202043c6b5a01865271fd84f"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - echo13.my365host.org
X-AntiAbuse: Original Domain - yahoo.com
X-AntiAbuse: Originator/Caller UID/GID - [740 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - echo13.my365host.org
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php
X-Source-Dir: moralityresearchpapers.org:/public_html/gmail

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash (i need someone with paypal), you`ll just get blocked. there are 5 essays on the site below, all i need is 1 (it doesnt matter which one) but all 5 would be great too ;] no one has pulled through yet, so let me know if your down.

HumanMoralityResearch.net // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO lushiizlaurenx+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!


The first site of his that I got shut down was moralitytermpapers.tumblr.com. This happened on March 7th.

Date: Sun, 7 Mar 2010 14:07:51 +0000
From: Tumblr Support
To: *****
Message-Id: <4b93b24ea781e_544db231303be@tumblr.assistly.com>
In-Reply-To: <SNT118-W348F5519C524EDC0A051AC4360@phx.gbl>
Subject: Re: Tumblr Scam Site (Case 19162)
Content-Type: text/plain
Content-Transfer-Encoding: Quoted-printable
X-Mailer: Assistly Support Platform
Return-Path: support@tumblr.com
X-OriginalArrivalTime: 07 Mar 2010 14:07:51.0954 (UTC) FILETIME=[9353E720:01CABDFF]

__________________________________
Please reply above this line
------------------------------------------------------

That blog has been suspended.

Marc

--
Tumblr Support
support@tumblr.com

March 28th, when selfxemployed wrote about his sites being shut down, is actually only three weeks after I got the site shut down. He might have said "months" instead of "weeks" by accident, because in a later post on April 8th that he made in someone else's thread called "CL Self Proclaimed Cop", he says that the vigilante has been bothering him for two weeks, not a couple months. He also says that someone posted his ads on a scam forum. My first post about the essay scam was made on March 31st.

I've been going through the same thing for the past two weeks. This guy just doesn't have anything better to do. I have an autoresponder script hosted on my web host which shows the server info in the headers, so he sends multiple complaints from different emails to my hosts and they shut me down. He even posted my ads on a scam forum, lol. Then when the host would shut me down, he would write me an email taunting me. There's no point of posting his email though for our BHW family to spam because its probably a disposable one. I do have his IP though, we can all send complaints to his ISP My best piece of advice is to just ignore it and keep it moving.





Another thread that selfxemployed started was "[WTB] Verified Indian PayPal account".




This was on April 28th, while his sites were still being shut down. Why would he want a PayPal account in India? Well, people involved in fraud sometimes use foreign PayPal accounts in order to make it easier for them to evade the authorities.

On May 3rd, he posted "[WTH] Host my PHP Autoresponder". He was specifically looking for an offshore hosting service that would ignore complaints about his websites.





All of this is interesting enough, but there's even more. There is another selfxemployed. This one is on the site CodingForums.com. Back on May 9th, 2009, he posted the thread "Delayed AutoResponder Errors", where he asked for advice about some problems he was having with the programming language PHP. The errors were in a file on his site that had the path


/home/sandip89/public_html/email/autoresponder.php





The file autoresponder.php is used to generate automatic email responses. It has the same name as the file that was used to generate the first email message I received from the scammer which I showed you earlier.


X-Source-Args: /usr/bin/php -q /home/morality/public_html/gmail/autoresponder.php


The structure of the two paths is similar, with one of the exceptions being that in the forum post, instead of the home directory being named morality, like in the first message, it is named sandip89. Sandip89 was also the name of the account that the scammer had with HostGator, and Sandip is the name of one of Renniel's friends.


Delivered-To: ***@***.***
Received: by 10.229.81.8 with SMTP id v8cs36171qck;
Fri, 12 Mar 2010 08:59:21 -0800 (PST)
Received: by 10.101.209.21 with SMTP id l21mr1269306anq.114.1268413159513;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Return-Path: <sandip89@gator625.hostgator.com>
Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [69.56.236.19])
by mx.google.com with SMTP id 6si2925646gxk.72.2010.03.12.08.59.18;
Fri, 12 Mar 2010 08:59:19 -0800 (PST)
Received-SPF: pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) client-ip=69.56.236.19;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandip89@gator625.hostgator.com designates 69.56.236.19 as permitted sender) smtp.mail=sandip89@gator625.hostgator.com
Received: (qmail 2201 invoked from network); 12 Mar 2010 16:59:27 -0000
Received: from gator625.hostgator.com (174.132.105.226)
by gateway01.websitewelcome.com with SMTP; 12 Mar 2010 16:59:27 -0000
Received: from sandip89 by gator625.hostgator.com with local (Exim 4.69)
(envelope-from <sandip89@gator625.hostgator.com>)
id 1Nq8Cf-0006iC-JM
for ***@***.***; Fri, 12 Mar 2010 10:59:13 -0600
To: *** <***@***.***>
Subject: RE: Your CL Ad
Date: Fri, 12 Mar 2010 10:59:13 -0600
From: aznsensationx <therealaznsensationx@gmail.com>
Message-ID: <bc174ec81efb2c4706b9a8abdeb07b5d@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_bc174ec81efb2c4706b9a8abdeb07b5d"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator625.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32266 32269] / [47 12]
X-AntiAbuse: Sender Address Domain - gator625.hostgator.com


--b1_bc174ec81efb2c4706b9a8abdeb07b5d
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the one of the essaya or all below or proof that you have it, we can meet at a public place and then to my apartment. im a psych major and i need it for the spring quarter. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

MoralityEssaysGalore // $37.99

so let me outline this for you just in case i didnt make it clear enough. you buy one of the essays (doesnt matter which one), forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL essay in my inbox, then done. if your good, then we will repeat steps 6-7.




But this is still not all. There is yet another selfxemployed on the site WickedFire.com. On April 6th, 2010 he posted an ad titled "[WTS] Craigslist Personals Lead Service // Up to 1,000 Exclusive Leads".





This is almost identical to the ad that Renniel admits to posting on that very same day over at DigitalPoint.com. The rates offered are the same and the wording and formatting vary just slightly.




On this same site, selfxemployed advertises a delayed autoresponder that he says is perfect for e-whoring (pretending to be a girl online in order to scam men out of their money).





So let's see what he have now. The essential data we have found are:

  1. Renniel admits to having owned the site ringtonezgalore.net.

  2. Someone using the name selfxemployed promoted ringtonezgalore.net on Digg.

  3. There is someone on the site Blackhatworld.com who calls himself selfxemployed who had a passion for being a blend DJ, just like Renniel.

  4. This selfxemployed talked about running an e-whoring scam that involved him pretending to be a girl who promises to meet a man if this man would buy an e-book for her first.

  5. On the site expertlaw.com, someone called selfxemployed discusses the same scam and states that he lives in New Jersey.

  6. On the site Freelancer.com there is a selfxemployed who markets porn and says that he lives in Jersey City, Renniel's town.

  7. The selfxemployed on Blackhatworld.com had someone shutting down his scam sites during the same time I was shutting down the essay scam sites. The person who shut down his scam sites posted about them on an anti-fraud forum, just like I posted about the essay scam sites on aa419.org.

  8. There is a selfxemployed on CodingForums.com who had a site that used an email autoresponder that was in a directory for an account named sandip89, and sandip89 is the name of one of the HostGator accounts used for the scam. Also, Renniel has a friend named Sandip.

  9. On the same day that Renniel posted his ad on DigitalPoint.com offering a Craigslist posting service, a selfxemployed on WickedFire.com also posted an ad for a Craigslist posting service, and except for minor differences it is identical to the one that Renniel posted.

  10. This selfxemployed sold an email autoresponder that he said was perfect for e-whoring.

Now, given all of this, and given all of the evidence that was discovered back in May, and the evidence from the past two days, wouldn't you say that there is only one reasonable conclusion for us to make? Does this matter really need to be given any more thought? I don't think so, and I think that we can finally make up our minds and consider this case solved.

Merry Christmas, Renniel!

Renniel Fernandez Admits He Is xlastomohicanx

Well, Renniel has admitted that he is xlastohmohicanx, the guy who promoted KillerRingtones.net, just as did KillerRingtones of Digg. It's interesting that he didn't mention knowing anything about KillerRingtones at all in his posts at aa419.org. You'd think that the name would have rung a bell.

Thursday, December 23, 2010

KillerRingtones and xlastomohicanx

Remember the Digg profile for KillerRingtones? This was the Digg profile for someone who calls himself Renniel Fernandez and advertised an iPhone giveaway on FreeShizznet.com, one of the sites used for the scam.




KillerRingtones spent a bit of time promoting the site KillerRingtones.net.




There is also someone on the site bicellphone.com who has promoted KillerRingtones.net. His alias is xlastomohicanx.




On answers.yahoo.com, there is also someone with the alias xlastomohicanx who promoted KillerRingtones.net. He'd reply to questions about where to get ringtones by telling the asker of the question to go to KillerRingtones.net. For example,

Where can i find this as a ringtone?
Where can i find a Family Guy ringtone?
Where can I find a website for ringtones that willnot damage my phone?

And many others.

On October 22nd, 2007, this xlastomohicanx got his license suspenended for thirty days in New Jersey.


My license was suspended by a judge on October 22, 2007 for 30 days. I called the DMV to see if I was allowed to restore it but they said that the municipal court never sent them anything about my license being suspended. So according to the DMV, my license was never suspended. The court DID take my license away from me and I haven't drove for 30 days. I even had to drop out of college because I had no means of transportation. My main concern is that if I call the municipal court and tell them that the DMV never received anything from them that they will suspend my license for ANOTHER 30 days. Are they allowed to do that because if they are, I will be extremely pissed. Thanks in advance.





I wonder who else in New Jersey might have had his license suspended for 30 days on October 22nd, 2007, and ended up having to drop his college classes because of it...

Monday, December 20, 2010

Privacy and Your Rights Research Paper

A sample ad

saturday bj fun - w4m - 27

Do you like deep throat bj? i do something new kind of Bj so let me know if you want a head around your part
i can probably not host but something may be worked out.. bj and possibly more if you are interested


A sample email message with headers:

Delivered-To:***@***.***
Received: by 10.42.213.66 with SMTP id gv2cs49103icb;
Mon, 20 Dec 2010 15:27:10 -0800 (PST)
Received: by 10.236.95.1 with SMTP id o1mr8839984yhf.67.1292887629869;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Return-Path: <authorx@gator1098.hostgator.com>
Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [69.56.159.26])
by mx.google.com with SMTP id i51si9111008yhd.109.2010.12.20.15.27.09;
Mon, 20 Dec 2010 15:27:09 -0800 (PST)
Received-SPF: pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) client-ip=69.56.159.26;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of authorx@gator1098.hostgator.com designates 69.56.159.26 as permitted sender) smtp.mail=authorx@gator1098.hostgator.com
Received: (qmail 7994 invoked from network); 20 Dec 2010 23:26:21 -0000
Received: from gator1098.hostgator.com (174.120.180.194)
by gateway07.websitewelcome.com with SMTP; 20 Dec 2010 23:26:21 -0000
Received: from authorx by gator1098.hostgator.com with local (Exim 4.69)
(envelope-from <authorx@gator1098.hostgator.com>)
id 1PUp8D-0008Jg-C2
for ***; Mon, 20 Dec 2010 17:27:05 -0600
To: *** <***@***.***>
Subject: ***
Date: Mon, 20 Dec 2010 17:27:04 -0600
From: laurenxlove89 <laurenxlove89@gmail.com>
Message-ID: <1cbe3fffa0c51213a88567c3ff6f475b@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_1cbe3fffa0c51213a88567c3ff6f475b"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1098.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1467 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1098.hostgator.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/authorx/public_html/reply/autoresponder.php
X-Source-Dir: freetrialsgalore.net:/public_html/reply

--b1_1cbe3fffa0c51213a88567c3ff6f475b
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, first off id like to say that im a real person and this is a real proposal. if you want to meet up, i need you to buy the research paper thats below.


Privacy and Rights Paper :: Buy Now!


first guy to send proof wins. i need the paper for my history class because i was instrcuted to write one but was too lazy and busy to. you can just send me proof like a receipt or one paragraph before we actually link up, then you can send me the full paper after we have our fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.


His new blog is privacyandrightspaper.blogspot.com.

Privacy and Your Rights Research Paper



Privacy and Your Rights Paper
Title: Privacy and Your Rights Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download Via Email


The PayPal business name he is using is Term Papers Inc and the email address he is using for his PayPal account is researchpapersgalore@hotmail.com.

Wednesday, December 15, 2010

Privacy First Research Paper

Here's one of Renniel's new ads:

newyork.craigslist.org/wch/cas/2115314709.html

Ass licking - w4m

Date: 2010-12-15, 10:46PM EST
Reply to: pers-cx5h8-2115314709@craigslist.org

Are you a kinky guy? if not, dont bother replying. i want all my holes satisfied tonight


This is a sample e-mail message including the headers:

Delivered-To: ***@***.***
Received: by 10.220.193.130 with SMTP id du2cs105144vcb;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received: by 10.100.4.13 with SMTP id 13mr4931369and.108.1292477525226;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Return-Path: <onthegoc@gator1294.hostgator.com>
Received: from gateway03.websitewelcome.com ([69.93.87.23])
by mx.google.com with SMTP id a19si4758204ana.7.2010.12.15.21.32.04;
Wed, 15 Dec 2010 21:32:05 -0800 (PST)
Received-SPF: pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) client-ip=69.93.87.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of onthegoc@gator1294.hostgator.com designates 69.93.87.23 as permitted sender) smtp.mail=onthegoc@gator1294.hostgator.com
Received: (qmail 6321 invoked from network); 16 Dec 2010 05:31:38 -0000
Received: from 173.192.111.10-static.reverse.softlayer.com (HELO gator1294.hostgator.com) (173.192.111.10)
by gateway03.websitewelcome.com with SMTP; 16 Dec 2010 05:31:38 -0000
Received: from onthegoc by gator1294.hostgator.com with local (Exim 4.69)
(envelope-from <onthegoc@gator1294.hostgator.com>)
id 1PT6Rd-0007Cb-KA
for ***@***.***; Wed, 15 Dec 2010 23:32:01 -0600
To: *** <***@***.***>
Subject: ***
Date: Wed, 15 Dec 2010 23:32:01 -0600
From: brianaxcore <brianaxcore@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_b479a860b083f61149c309cb831b4d00"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1294.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1050 1047] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1294.hostgator.com


hey, *** im real and this is a real offer. if you want to link up, i need you to buy me the research paper below.

Privacy First Research Paper For $47.99

first come, first serve. i need it for my history class because i was supposed to write one but was too lazy to. you can just email me proof like a receipt or one paragraph before we actually meet up, then you can send me the full paper after we have fun. dont offer me cash because i need someone with paypal. NO PROOF, NO MEET UP.


This is the scam site:

privacyfirstresearchpaper.blogspot.com

Privacy First Research Paper
Purchase a research paper based on the history of privacy and the government.

Privacy First Research Paper
Title: Privacy First Research Paper

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate download via email


The email address he's using for his PayPal account his historyresearchpapers@hotmail.com.

Thursday, December 2, 2010

Against the Bill E-Book

This is the website he's now using for selling the essays:

against-the-bill-ebook.blogspot.com

Against the Bill E-Book

Purchase the E-book of an author's point of view on the Bill.

Against the Bill E-Book :: $47.99
Title: Against the Bill

Price: $47.99

Word Count: 2,142

Pages: 8

Delivery: Immediate Download Via Email


Here's a sample email message:
Delivered-To: ***@***.***
Received: by 10.231.174.14 with SMTP id r14cs522332ibz;
Wed, 1 Dec 2010 21:23:19 -0800 (PST)
Received: by 10.213.3.66 with SMTP id 2mr261442ebm.82.1291267397933;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Return-Path: <wehostre@semi3.wrzhost.com>
Received: from semi3.wrzhost.com ([217.23.12.85])
by mx.google.com with ESMTP id s18si265192eeh.75.2010.12.01.21.23.17;
Wed, 01 Dec 2010 21:23:17 -0800 (PST)
Received-SPF: neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) client-ip=217.23.12.85;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.12.85 is neither permitted nor denied by best guess record for domain of wehostre@semi3.wrzhost.com) smtp.mail=wehostre@semi3.wrzhost.com
Received: from wehostre by semi3.wrzhost.com with local (Exim 4.69)
(envelope-from <wehostre@semi3.wrzhost.com>)
id 1PO1dS-00087N-KG
for ***@***.***; Thu, 02 Dec 2010 06:23:16 +0100
To: *** <***@***.***>
Subject: ***
Date: Thu, 2 Dec 2010 06:23:14 +0100
From: isexynymphoi <isexynymphoi@gmail.com>
Message-ID:
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_a3a5bc5871ddd131ee4013ce17e6a1ce"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - semi3.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [875 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - semi3.wrzhost.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php -q /home/wehostre/public_html/mail/autoresponder.php
X-Source-Dir: wehostreplies.net:/public_html/mail

--b1_a3a5bc5871ddd131ee4013ce17e6a1ce
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey ***, i have an interesting proposition before we meet up - hope you can handle it. if you are the first guy to send me the research paper below or proof that you bought it, we can meet up at a public place (starbucks or something) and then to my place. im a history major and i need it for one of my classes. whats in it for you? a friend with benefits ;] please dont ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get ignored. no one has pulled through yet, so let me know if your down.

Against The Bill E-Book // Buy It Now for $47.99


so basically, buy the research paper, send me the receipt, we meet up somewhere convenient then go somewhere private, have fun, after our fun is done, you send me the e-book and if you're good, then you'll be hearing from me again. SEND THE PROOF TO isexynymphoi+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!


The email address he's using for his PayPal account is ebooksonhistory@hotmail.com.
Using Renniel's name, I sent an email message to this address to tell this guy what I thought of him. I got back a response:

Delivered-To: ***@***.***
Received: by 10.100.45.20 with SMTP id s20cs24918ans;
Thu, 2 Dec 2010 06:20:39 -0800 (PST)
Received: by 10.142.126.14 with SMTP id y14mr320913wfc.132.1291299638460;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Return-Path:
Received: from snt0-omc3-s29.snt0.hotmail.com (snt0-omc3-s29.snt0.hotmail.com [65.55.90.168])
by mx.google.com with ESMTP id g35si1396190qcs.66.2010.12.02.06.20.37;
Thu, 02 Dec 2010 06:20:38 -0800 (PST)
Received-SPF: pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) client-ip=65.55.90.168;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ebooksonhistory@hotmail.com designates 65.55.90.168 as permitted sender) smtp.mail=ebooksonhistory@hotmail.com
Received: from SNT142-W14 ([65.55.90.136]) by snt0-omc3-s29.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 2 Dec 2010 06:19:39 -0800
Message-ID:
Return-Path: ebooksonhistory@hotmail.com
Content-Type: multipart/alternative;
boundary="_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_"
X-Originating-IP: [98.221.193.230]
From: Steve Doe
To: <***@***.***>
Subject: RE: You are such an asshole
Date: Thu, 2 Dec 2010 09:19:39 -0500
Importance: Normal
In-Reply-To:
References:
MIME-Version: 1.0
X-OriginalArrivalTime: 02 Dec 2010 14:19:39.0672 (UTC) FILETIME=[F4B19980:01CB922B]

--_3c4de0b0-5f0b-4dc0-abd8-54cacff6c95c_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


Aw, the copies are sold out Mr. Fernandez. I'm sorry. You can try
getting a copy from the last two customers listed on the blog. I'll see
you around at "St. Peters".


The header field X-Originating-IP, which is the IP address of the machine from which the message was sent, has the value 98.221.193.230. If you go to cqcounter.com/whois/ and look up this IP you'll see that it is owned by Comcast in Jersey City, NJ, where Renniel lives.

Tuesday, October 26, 2010

the-act-and-rights-paper.blogspot.com

Another one. Here is the ad:

http://newyork.craigslist.org/que/cas/2027223593.html

Crazy and kinky - w4m

Date: 2010-10-26, 5:15PM EDT
Reply To This Post

Its a deadly combo. want to fck this horny chick from woodside queens? I will def. rock your world so i hope you bring your A-game


Here is the message.

Delivered-To: ***@***.***
Received: by 10.229.249.129 with SMTP id mk1cs90668qcb;
Tue, 26 Oct 2010 15:14:18 -0700 (PDT)
Received: by 10.227.129.146 with SMTP id o18mr7357560wbs.45.1288131257374;
Tue, 26 Oct 2010 15:14:17 -0700 (PDT)
Return-Path: <delayedr@nl5>
Received: from nl5 (nl5.underhost.com [217.23.8.84])
by mx.google.com with ESMTP id f33si14172325wbf.25.2010.10.26.15.14.16;
Tue, 26 Oct 2010 15:14:17 -0700 (PDT)
Received-SPF: neutral (google.com: 217.23.8.84 is neither permitted nor denied by best guess record for domain of delayedr@nl5) client-ip=217.23.8.84;
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.23.8.84 is neither permitted nor denied by best guess record for domain of delayedr@nl5) smtp.mail=delayedr@nl5
Received: from delayedr by nl5 with local (Exim 4.69)
(envelope-from <delayedr@nl5>)
id 1PArrO-0007JC-47
for ***@***.***; Wed, 27 Oct 2010 02:19:14 +0400
To: ***** <***@***.***>
Subject: *****
Date: Wed, 27 Oct 2010 02:19:14 +0400
From: STEPHxNY <cutiiefromnewyork@gmail.com>
Message-ID: <858a974ef196f0aef3819984bfdf3c3c@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_858a974ef196f0aef3819984bfdf3c3c"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - nl5
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [557 553] / [47 12]
X-AntiAbuse: Sender Address Domain - nl5

--b1_858a974ef196f0aef3819984bfdf3c3c
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit

hey **** the name is steph. just looking for fun with someone local but i need a favor first. before i can have any fun, i have to write this history paper first but i've been to lazy and busy with other things. i found a paper that's already pre-written but you need paypal to buy it. i do have paypal but it has a negative balance so i was wondering if you could purchase it for me. here's the link.

Constitutional Rights E-Book - $47.99 Buy Now!


so here's the plan, buy the paper and send me proof you bought it. it can be the receipt or one paragraph or both, which would be better. once i get proof, we can meet up somewhere local and public and talk for a bit until we're both comfortable to go back somewhere private. i can host if you can't, i can also travel. we have some fun when we head to my place or yours, then after you can send me the full paper. if you received this email, that means the offer is still open.



Here is the essay site: the-act-and-rights-paper.blogspot.com

The Act and Your Rights E-Book

Purchase The Act & Your Rights E-Book
Title: The USA Act

Price: $47.99

Pages: 8

Delivery: Instant Email Download

Description: An 8 page E-book that describes how the USA Act has negatively affected our constitutional rights since it's passing. (Buy Now)


His PayPal email address is historyebooksforsale@hotmail.com.

Monday, October 25, 2010

constitutional-rights-paper.blogspot.com

Another one: http://constitutional-rights-paper.blogspot.com
Constitutional Rights & The USA Act E-Book
Title: The USA Act

Price: $46.99

Pages: 8

Delivery: Instant Email Download

Description: The Bush Administration submitted the law to Congress thirteen days after the tragic events that occurred on September 11, 2001. The vicious attacks on the World Trade Center and the Pentagon changed the way the United States government view the freedom given to those living on United States soil. A new philosophy has emerged (Buy Now)


His new PayPal email address: ebooksonsale@hotmail.com.

Thursday, October 21, 2010

store.payloadz.com/details/834676-Other-Files-Documents-and-Forms-USA-PA.html

Here is a another site that he is using for the scam: http://store.payloadz.com/details/834676-Other-Files-Documents-and-Forms-USA-PA.html.

usa-research-paper.blogspot.com

He has a new site, usa-research-paper.blogspot.com
The USA Act Research Paper
Title: The USA Act

Price: $46.99

Pages: 8

Delivery: Instant Email Download

Description: By the time the bill was signed into law, Daschle and Leahy supported the bill. Whether fear was the influence that changed their minds or a sudden change of heart, the fact of the matter is the bill was rushed into law by a government (Buy Now)

The email address he is using for his Paypal account is cheappapersgalorex@hotmail.com. The business name is still Term Papers Inc. Here is a new sample email message with headers:

Delivered-To: ***@***.com
Received: by 10.231.79.19 with SMTP id n19cs183333ibk;
Thu, 21 Oct 2010 13:36:18 -0700 (PDT)
Received: by 10.150.11.20 with SMTP id 20mr4082846ybk.63.1287693377291;
Thu, 21 Oct 2010 13:36:17 -0700 (PDT)
Return-Path:
Received: from gateway02.websitewelcome.com (gateway02.websitewelcome.com [67.18.53.20])
by mx.google.com with SMTP id w24si21397506ybk.65.2010.10.21.13.36.16;
Thu, 21 Oct 2010 13:36:17 -0700 (PDT)
Received-SPF: pass (google.com: domain of mauricec@gator1083.hostgator.com designates 67.18.53.20 as permitted sender) client-ip=67.18.53.20;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of mauricec@gator1083.hostgator.com designates 67.18.53.20 as permitted sender) smtp.mail=mauricec@gator1083.hostgator.com
Received: (qmail 977 invoked from network); 21 Oct 2010 20:36:16 -0000
Received: from gator1083.hostgator.com (174.120.170.130)
by gateway02.websitewelcome.com with SMTP; 21 Oct 2010 20:36:16 -0000
Received: from mauricec by gator1083.hostgator.com with local (Exim 4.69)
(envelope-from )
id 1P91s5-0002VB-PC
for ***@***.com; Thu, 21 Oct 2010 15:36:21 -0500
To: *** <***@***.com>
Subject: ***
Date: Thu, 21 Oct 2010 15:36:21 -0500
From: orallyxtalentedchick <orallyxtalentedchick@gmail.com>
Message-ID: <4ae73ef9e3480302040daaf8acfbd842@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_4ae73ef9e3480302040daaf8acfbd842"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator1083.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [1361 1359] / [47 12]
X-AntiAbuse: Sender Address Domain - gator1083.hostgator.com

--b1_4ae73ef9e3480302040daaf8acfbd842
Content-Type: text/html; charset = "iso-8859-1"
Content-Transfer-Encoding: 8bit


From: orallyxtalentedchick <orallyxtalentedchick@gmail.com>
Date: Thu, Oct 21, 2010 at 3:36 PM
Subject: ***
To: *** <***@***.com>


hey ***, i need a quick favor first before we get together - hope you can handle it. if your the first guy to send me the essay below or proof that you have it, we can meet at a public place and then to my apartment. im a history major and i need it for fall class. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it or offer me cash [im not a prostitute], you`ll just get blocked. no one has pulled through yet, so let me know if your down.

The USA Act Research Paper - $46.99 Purchase Now!

so let me summarize this for you just in case i didnt make it crystal clear enough. you buy the essay, forward me the paypal receipt or a paragraph, i verify that the proof is legit, we meet up somewhere public, get to know eachother, head somewhere private, do what i do best ;], i go home expecting the FULL paper in my inbox, then done. if your good, then we will repeat steps 6-7.

SEND THE PROOF TO orallyxtalentedchick+proof@gmail.com - IF YOU RECEIVED THIS MESSAGE, THAT MEANS THE OFFER STILL STANDS!


------------

Another email address that he uses for this scam is talentedorallyxchick@gmail.com.

Tuesday, July 27, 2010

Craigslist Ad and Email Message

Here is one of the Craigslist ads placed for the scam:

http://newyork.craigslist.org/stn/cas/1863787691.html

Latina from Staten Island - w4m


Date: 2010-07-26, 11:26AM EDT


ever had good puerto rican pussy? well now's your chance. get in touch for details

Here is a typical reply you get when you respond to the ad:
hey *****, first things first, YES im real. i need a huge favor before we meet up though. i have a term paper due for my online summer class but i dont have the time or the want to write one, so i found a term paper online to purchase. the link is below. buy it, then send me proof you bought it, then we can meet up. if your down for this, send proof ASAP. the first guy that sends proof will be my next FWB.

USA PA Paper - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here is another typical reply you get when you respond to the ad:
hey *****, i need a quick favor first before we meet up - hope you can handle it. if your the first guy to send me the paper below or proof that you have it, we can meet at a public place and then to my apartment. im a history major and i need it for my online class. whats in it for you? a friend with a lot of benefits ;] except for financial ones [obviously]. dont bother to ask me to meet up first THEN buy it, you`ll just get blocked. no one has pulled through yet, so let me know if your down.

The USA PA E-Book - $45.99!

alright so basically purchase the term paper, email me the paypal receipt or the first paragraph paragraph, then we meet up somewhere public, talk for a bit, head somewhere private like my place or yours, do what i do best ;], i go home expecting the FULL term paper in my inbox, then done. if your good, then we will repeat steps 6-7. im not going to respond unless its proof. if you received this email, that means the offer still stands.

Here are some message headers:
Delivered-To: *****@*****.com
Received: by 10.231.154.131 with SMTP id o3cs277222ibw;
Tue, 27 Jul 2010 21:44:04 -0700 (PDT)
Received: by 10.101.189.8 with SMTP id r8mr10892584anp.53.1280292243318;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Return-Path: <delayedr@serverhk.wrzhost.com>
Received: from serverhk.wrzhost.com ([91.207.192.103])
by mx.google.com with ESMTP id g29si13920081ann.159.2010.07.27.21.44.02;
Tue, 27 Jul 2010 21:44:03 -0700 (PDT)
Received-SPF: neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) client-ip=91.207.192.103;
Authentication-Results: mx.google.com; spf=neutral (google.com: 91.207.192.103 is neither permitted nor denied by best guess record for domain of delayedr@serverhk.wrzhost.com) smtp.mail=delayedr@serverhk.wrzhost.com
Received: from delayedr by serverhk.wrzhost.com with local (Exim 4.69)
(envelope-from <delayedr@serverhk.wrzhost.com>)
id 1OdyUr-00066b-MK
for *****@*****.com; Wed, 28 Jul 2010 12:44:01 +0800
To: ***** <*****@*****.com>
Subject: RE: Your Personals Ad
Date: Wed, 28 Jul 2010 12:44:01 +0800
From: hotteztxcoed <hotteztxcoed@gmail.com>
Message-ID: <38440f402990cc744cf52e6edf2264e6@localhost.localdomain>
X-Priority: 3
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version 2.0.0 rc3]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="b1_38440f402990cc744cf52e6edf2264e6"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - serverhk.wrzhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [720 717] / [47 12]
X-AntiAbuse: Sender Address Domain - serverhk.wrzhost.com

So he's using WRZHost again. Let's see if they close his account quickly this time instead of tolerating his scam for a while as they did in the past.

Oh, and here are some of the photos that are sent along with the email message. I edited out the bottom part of the second photo since it contains nudity.



Monday, July 26, 2010

usaact-termpaper.blogspot.com

The last site I reported, usaacttermpaper.blogspot.com, was taken down, but a new site has been put up:

http://usaact-termpaper.blogspot.com/
The USA Act Paper

The USA PA E-Book - $45.99
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without ... (Buy Now for Whole Version)

Pages: 8

Delivery: Immediate via Email


The company name used for the PayPal page is still Term Papers Inc and the email address for the PayPal account is again usapaebook@hotmail.com.

By the way, these two sites have been removed:

thepatriotacttermpaper.blogspot.com
patriot-act-paper.blogspot.com

Friday, July 23, 2010

usaacttermpaper.blogspot.com

Another scam site:

http://usaacttermpaper.blogspot.com
The USA Act Paper

The USA PA E-Book - $45.99
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without...

Thursday, July 22, 2010

Wednesday, July 21, 2010

Another Patriot Act E-Book Scam Blog

http://the-usa-pa-ebook.blogspot.com/
Buy the USA PA E-Book
Title: The USA PA

Price: $45.99

Description: On October 6th, 2001, the USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) Act was signed into law by President George W. Bush. The purpose of the Patriot Act is to prevent future terrorist attacks on the United States and other countries abroad by allowing law enforcement agencies access to personal information so they can investigate and act upon potential threats. This info can be accessed without ... (Buy Now for Whole Version)

The email address used for the PayPal account this time is usapaebook@hotmail.com.

Sunday, July 18, 2010

Another Patriot Act Paper Site

http://usa-pa-ebok.blogspot.com/

And he's changed the email address for his PayPal account again. Now it's greatarticlesforsale@gmail.com. The business name he uses is still Term Papers Inc.

More Patriot Act Paper Sites

Here are more sites that are used for the Patriot Act paper scam.

http://thepatriotact-e-book.blogspot.com/
http://patriot-act-paper.blogspot.com/
http://patriot-act-term-paper.blogspot.com/

The new e-mail address that Renniel uses for his PayPal account is affordableessays@gmail.com. I was able to confirm that the PayPal account used for this scam is the same PayPal account that Renniel used for the morality essay scam sites.

Saturday, July 17, 2010

The Patriot Act Paper

It looks like Renniel is at it again. But instead of asking the victim to buy a morality term paper, this time he asks him to buy a Patriot Act paper. Someone reported getting taken by the scam over at aa419.org:
Unfortunately I found this page too late and got taken. Here is the new site where he posts his papers.

http://thepatriotacttermpaper.blogspot.com/

What can we do about this ahole?
Security Changes in the US Research Paper Purchase Now $47.99!,US Security Changes Research Paper :: $47.99,US Changes After 9/11 Research Paper : Buy It Now $47.99!