Sponsored by..

Showing posts with label MLM. Show all posts
Showing posts with label MLM. Show all posts

Monday 8 November 2010

Massive yourfreeworld.com / downlinegoldmine.com spam run

Sometimes it is difficult to tell if a spam run is a Joe Job, or if the spammer is really a moron.

Over the past few hours, a massive spam run has been caught by several spamtraps and has also been spammed out heaving to spamcop.net email addresses:

From: Rohit Seth - YourFreeWorld <seth@yourfreeworld.com>
Date: 8 November 2010 07:39
Subject: Amazing New MLM Scripts, Mass Mailers, Downline Builders
- Hide quoted text -
Check out our amazing range of money making matrix scripts, bulk emailers, safelists, banner ad scripts and downline builders.

Check out our latest additions too by bookmarking our site and checking it often.

Our ingenious affiliate program integrates your ClickBank ID into your affiliate link. So when someone comes to our page and conducts a search for any ClickBank product, YOU can make up to 75% commissions with very little effort!

"Imagine earning commissions hand over fist 24 hours a day, 7 days a week, 365 days of the year -- even while you're sleeping! This is truly a no-effort style affiliate program that maximises multiple income streams."


or make monster cash for the holidays by becoming a reseller of our fantastic scripts, it's that simple!


If you are ready to start to MAKE MONEY online, Downlinegoldmine.com is the place to do it! We will give you the keys to build your Downline, to create your own Downline Program and to learn winning techniques so that you can sit back and let the earnings begin!

From the desk of Rohit Seth

WHOS details are consistent with the message:
  Registrant :
    Name: Rohit kumar Seth
    Organization: Dr. M.Seth & Co.
    Address: S-5,Naveen Shahdara
    City: Delhi
    State: DE
    Postal Code: 110032
    Country: IN
    Phone: +91.0112232
    Email: rolovedeep@yahoo.com

The originating IP is [Point North Networks / XO Communications, US] pointing to two spamvertised sites, downlinegoldmine.com on and yourfreeworld.com on  [both at Hostime, Orlando].

Almost all MLMs are some sort of scam, and these are two sites promoting MLMs. But these sites also promote "safe email sendlists", but clearly sending hundreds of spam emails to spamtraps is clearly a poor definition of "safelist".. it's almost as if this activity is deliberately designed to generate spam complaints..

..and here's the thing. There's no evidence linking to the alleged sender, and sending massive amounts of the same email to SpamCop.net addresses is either a massively stupid move, or it could be a deliberate attack on these sites by an unknown party.

In my opinion, both yourfreeworld.com and downlinegoldmine.com look like crappy sites that are worth avoiding. 

Friday 29 October 2010

Rev2Share.com spam

Following one a day from this almost identical MySuperShares.com spam, this email also appears to be trying to game a "get rich quick" MLM scheme with fake signups.

From: Rev2Share.com <admin@rev2share.com>
Reply-To: admin@rev2share.com
Date: 29 October 2010 05:24
Subject: Welcome to Rev2Share.com!
Dear member,

Welcome to Rev2Share.com!
We are pleased that you have decided to join our fast growing community.

You can now login to your account at:
Your Username: 0000_000
Your Password: 0000000

We hope you have a great time at Rev2Share.com.


It's not a Joe Job as such, the email originates from which is the same server that Rev2Share.com is hosted on along with a bunch of shabby MLM sites. The domain was registered just days ago, the WHOIS details seem to be accurate:

Domain name: rev2share.com

Registrant Contact:
   Dustin Langley ()
   105 southpark circle
   gallatin, TN 37066

Administrative Contact:
   Dustin Langley (dustin.langley@gmail.com)
   105 southpark circle
   gallatin, TN 37066

Technical Contact:
   Dustin Langley (dustin.langley@gmail.com)
   105 southpark circle
   gallatin, TN 37066

Status: Locked

Name Servers:
Creation date: 25 Oct 2010 16:18:00
Expiration date: 25 Oct 2011 11:18:00

The physical address checks out, it would be highly unusual for a deliberate scammer to post their real address (even if most MLMs do turn out to be scams in the end). So it does appear that a third party is involved, using Rev2Share.com's own systems to generate fake signups, either to shut the site down or to game the system for personal profit.

It is probably no coincidence that both Rev2Share.com (hosted on and MySuperShares.com ( have an almost identical business model that claims to be selling advertising (only on their own sites) but in fact concentrates on getting signups to generate a download instead. When you see a very thin product offering like this with an emphasis on recruiting other people, then that it usually a bad sign.. best to avoid it altogether in my opinion.

Thursday 28 October 2010

MySuperShares.com spam

In my view, all MLM schemes are almost always scams.. and MySuperShares.com seems to be just another MLM scheme, this time selling "ads" that only seem to display on the MySuperShares.com site. But the real carrot is the promise of downlines if you sign someone else up.. in other words, a thin product offering with a concentration on signing up other members rather than selling a real product.

The scheme itself is based in Australia, and I am no expert in Australian law. So, let's assume that this type of MLM scheme is legal in Australia for now.

Still, this particular email seemed unusually brazen..

From: MySuperShares.com <webmaster@mysupershares.com>
Reply-To: webmaster@mysupershares.com
Date: 28 October 2010 13:30
Subject: MySuperShares.com Confirmation Email
Dear 4612_210 4080_759,

Thank you for creating your account with MySuperShares.com.

To activate your account, please click the link below:


Once you have completed this step, you will be able to
login to your account.

Kind regards

Eva Browne-Paterson & Jullieanne Matheson

The originating IP is, MySuperShares.com is hosted on (i.e. the next IP address), so it indicates that the mail is genuinely from MySuperShares.com. Let's look at the WHOIS details for that domain:

   1 Keswick Island Drive
   Keswick Island, Queensland 4740

   Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
      Created on: 13-Oct-10
      Expires on: 13-Oct-11
      Last Updated on: 13-Oct-10

   Administrative Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      411569782      Fax -- 749658019

   Technical Contact:
      Browne-Paterson, Eva  evieb@evieb.com
      1 Keswick Island Drive
      Keswick Island, Queensland 4740
      411569782      Fax -- 749658019

   Domain servers in listed order:

It's unusual for fraudsters to include their real contact details in the WHOIS, in fact everything checks out as being legitimate, it you check out the MLM business model.

There are a few possibilities:
  1. The people running the site are really stupid and think that this is a good way to get signups (rather than getting your site nuked)
  2. Someone is using MySuperShare.com's own system to perform a Joe Job with deliberately false signups.
  3. Someone thinks that they can make money by gaming MySuperShare.com's system with fake signups.
My best bet is that it is the #2 or #3 option, because I really don't think that the site operators are so stupid as to try spamming like this. Does that mean that it is a legitimate programme? Well, put it this way.. do you really think that it is feasible to make money by selling nothing of value?

Update:it does appear that someone is targetting these MLM "get rich quick" sites as another site called Rev2Share.com has also been hit.