Sponsored by..

Showing posts with label MLM. Show all posts
Showing posts with label MLM. Show all posts

Monday, 8 November 2010

Massive yourfreeworld.com / downlinegoldmine.com spam run

Sometimes it is difficult to tell if a spam run is a Joe Job, or if the spammer is really a moron.

Over the past few hours, a massive spam run has been caught by several spamtraps and has also been spammed out heaving to spamcop.net email addresses:

From: Rohit Seth - YourFreeWorld <seth@yourfreeworld.com>
Date: 8 November 2010 07:39
Subject: Amazing New MLM Scripts, Mass Mailers, Downline Builders
   
- Hide quoted text -
Check out our amazing range of money making matrix scripts, bulk emailers, safelists, banner ad scripts and downline builders.

Check out our latest additions too by bookmarking our site and checking it often.

Our ingenious affiliate program integrates your ClickBank ID into your affiliate link. So when someone comes to our page and conducts a search for any ClickBank product, YOU can make up to 75% commissions with very little effort!

"Imagine earning commissions hand over fist 24 hours a day, 7 days a week, 365 days of the year -- even while you're sleeping! This is truly a no-effort style affiliate program that maximises multiple income streams."

http://www.yourfreeworld.com

or make monster cash for the holidays by becoming a reseller of our fantastic scripts, it's that simple!

http://www.downlinegoldmine.com

If you are ready to start to MAKE MONEY online, Downlinegoldmine.com is the place to do it! We will give you the keys to build your Downline, to create your own Downline Program and to learn winning techniques so that you can sit back and let the earnings begin!

From the desk of Rohit Seth
Delhi
India

WHOS details are consistent with the message:
  Registrant :
    Name: Rohit kumar Seth
    Organization: Dr. M.Seth & Co.
    Address: S-5,Naveen Shahdara
    City: Delhi
    State: DE
    Postal Code: 110032
    Country: IN
    Phone: +91.0112232
    Fax:
    Email: rolovedeep@yahoo.com


The originating IP is 64.244.62.22 [Point North Networks / XO Communications, US] pointing to two spamvertised sites, downlinegoldmine.com on 72.29.67.174 and yourfreeworld.com on 66.7.201.119  [both at Hostime, Orlando].

Almost all MLMs are some sort of scam, and these are two sites promoting MLMs. But these sites also promote "safe email sendlists", but clearly sending hundreds of spam emails to spamtraps is clearly a poor definition of "safelist".. it's almost as if this activity is deliberately designed to generate spam complaints..

..and here's the thing. There's no evidence linking 64.244.62.22 to the alleged sender, and sending massive amounts of the same email to SpamCop.net addresses is either a massively stupid move, or it could be a deliberate attack on these sites by an unknown party.

In my opinion, both yourfreeworld.com and downlinegoldmine.com look like crappy sites that are worth avoiding. 

Friday, 29 October 2010

Rev2Share.com spam

Following one a day from this almost identical MySuperShares.com spam, this email also appears to be trying to game a "get rich quick" MLM scheme with fake signups.

From: Rev2Share.com <admin@rev2share.com>
Reply-To: admin@rev2share.com
Date: 29 October 2010 05:24
Subject: Welcome to Rev2Share.com!
   
Dear member,

Welcome to Rev2Share.com!
We are pleased that you have decided to join our fast growing community.

You can now login to your account at:
http://www.rev2share.com/login.php
Your Username: 0000_000
Your Password: 0000000

We hope you have a great time at Rev2Share.com.

Administrator
Rev2Share.com

It's not a Joe Job as such, the email originates from 174.122.225.73 which is the same server that Rev2Share.com is hosted on along with a bunch of shabby MLM sites. The domain was registered just days ago, the WHOIS details seem to be accurate:

Domain name: rev2share.com

Registrant Contact:
  
   Dustin Langley ()
  
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Administrative Contact:
  
   Dustin Langley (dustin.langley@gmail.com)
   +1.615347925
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Technical Contact:
  
   Dustin Langley (dustin.langley@gmail.com)
   +1.615347925
   Fax:
   105 southpark circle
   gallatin, TN 37066
   US

Status: Locked

Name Servers:
   ns1.hostingmmt.com
   ns2.hostingmmt.com
  
Creation date: 25 Oct 2010 16:18:00
Expiration date: 25 Oct 2011 11:18:00



The physical address checks out, it would be highly unusual for a deliberate scammer to post their real address (even if most MLMs do turn out to be scams in the end). So it does appear that a third party is involved, using Rev2Share.com's own systems to generate fake signups, either to shut the site down or to game the system for personal profit.



It is probably no coincidence that both Rev2Share.com (hosted on 174.122.225.73) and MySuperShares.com (174.122.14.227) have an almost identical business model that claims to be selling advertising (only on their own sites) but in fact concentrates on getting signups to generate a download instead. When you see a very thin product offering like this with an emphasis on recruiting other people, then that it usually a bad sign.. best to avoid it altogether in my opinion.

Thursday, 28 October 2010

MySuperShares.com spam

In my view, all MLM schemes are almost always scams.. and MySuperShares.com seems to be just another MLM scheme, this time selling "ads" that only seem to display on the MySuperShares.com site. But the real carrot is the promise of downlines if you sign someone else up.. in other words, a thin product offering with a concentration on signing up other members rather than selling a real product.

The scheme itself is based in Australia, and I am no expert in Australian law. So, let's assume that this type of MLM scheme is legal in Australia for now.

Still, this particular email seemed unusually brazen..

From: MySuperShares.com <webmaster@mysupershares.com>
Reply-To: webmaster@mysupershares.com
Date: 28 October 2010 13:30
Subject: MySuperShares.com Confirmation Email
   
Dear 4612_210 4080_759,

Thank you for creating your account with MySuperShares.com.

To activate your account, please click the link below:

http://www.mysupershares.com/confirm.php?username=0000_000&id=00000

Once you have completed this step, you will be able to
login to your account.

Kind regards

Eva Browne-Paterson & Jullieanne Matheson
MySuperShares.com


The originating IP is 174.122.14.226, MySuperShares.com is hosted on 174.122.14.227 (i.e. the next IP address), so it indicates that the mail is genuinely from MySuperShares.com. Let's look at the WHOIS details for that domain:


Registrant:
   EvieB.com
   1 Keswick Island Drive
   Keswick Island, Queensland 4740
   Australia

   Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
   Domain Name: MYSUPERSHARES.COM
      Created on: 13-Oct-10
      Expires on: 13-Oct-11
      Last Updated on: 13-Oct-10

   Administrative Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      EvieB.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      Australia
      411569782      Fax -- 749658019

   Technical Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      EvieB.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      Australia
      411569782      Fax -- 749658019

   Domain servers in listed order:
      NS1.MYFREESAFELIST.COM
      NS2.MYFREESAFELIST.COM


It's unusual for fraudsters to include their real contact details in the WHOIS, in fact everything checks out as being legitimate, it you check out the MLM business model.

There are a few possibilities:
  1. The people running the site are really stupid and think that this is a good way to get signups (rather than getting your site nuked)
  2. Someone is using MySuperShare.com's own system to perform a Joe Job with deliberately false signups.
  3. Someone thinks that they can make money by gaming MySuperShare.com's system with fake signups.
My best bet is that it is the #2 or #3 option, because I really don't think that the site operators are so stupid as to try spamming like this. Does that mean that it is a legitimate programme? Well, put it this way.. do you really think that it is feasible to make money by selling nothing of value?


Update:it does appear that someone is targetting these MLM "get rich quick" sites as another site called Rev2Share.com has also been hit.