Sunday, August 26, 2012

Text Spammers Using Domains By Proxy

Messages like this one are making the rounds
You are a winner. You were chosen to receive a free gift. Go to hhtp:// and tell us where to ship your gift.
 Doing a WHOIS search reveals that sites mentioned in these messages are registered under Domains By Proxy in order to prevent their victims from determining their real names and locations.

However, Domains By Proxy has an anti-spam policy which, while it doesn't mention text messaging specifically, it does already cover spamming chatrooms or instant messaging programs with links to a site. So, I think they could take action if people began reporting spam being sent to them via text messages.

The following sites have been identified as being registered to Domains By Proxy and having been mentioned in text spam messages
I will add more links to the list as I become aware of them.

To report spam sent to your cellphone with these links, you can do it several ways:
Make sure you mention that you received it on your cellphone by text message and include the entire text of the message you received;

I sent a report myself to Domains By Proxy and will post their reply in an update of this blogpost at a later time.

Duane Browning

Nick Brown Is Back in Action

The following text or something similar has been going-around
dear customer,your $1000 wal-mart gift card is standing by! Claim now by using approval code:give1000 Visit:http://GIFTCARD6'com 2end reply stop
 As noted in a previous post, Walmart does not advertise by sending text messages to random people. So, any "offer" made in these messages are fraudelant and attempts to get your personal information.

The link provided GIFTCARD6.COM and this website is registered to
ivan pereyra
Fax: +1.5555555555
118 Norwood Avenue
Port Jefferson Station, NY 11776 US

A websearch indicates that this is a single-family home, rather than a virtual office as seen in previous textspammers I've written about. Curiously, the email address for the domain's owner is which is also the contact email for other domains and I will include the registrants' addresses
(WHOIS Domain privacy engaged)
website no longer active
Nick Brown
244 5th avenue
new york, ny 10001 US
website appears inactive
Nick Brown
244 5th avenue ste 292j
new york, ny 10001 US
Email contact on website
Nick Brown
7454 lancaster pike #797
Hockessin, DE 19707 US
Email contact on website 

The address 244 5th Avenue in New York City appears to be a virtual office. So, letters of complaints can easily be ignored, if the recipient wishes. 

Nick is an old target of peoples' ire. Over 50 websites are registered to a "Nick Brown", though I cannot verify that these are all the same individual. Simply using the email address given above, the Nick Brown in-question seems to keep the actual number of domains he owns down to a small number, typically three or so.

The website GIFTCARD6.COM redirects to this website and here is a screenshot
If you scroll to the bottom, you'll see a Contact link where you can supposedly send an email to the site's owners. They even include a mailing address that I found interesting
Level 6, Pentagon P-2
Pune, MH 411013

The mailing address is in India, not the United States. Seems that Nick has decided to outsource.So much for keeping jobs in the "Good Ole US of A". Maybe Nick works for Bain Capital part-time.

Duane Browning