Monday, January 28, 2013

BestBuyGold.net Textspammer

People have reported receiving spam via text on their cellphones which tells them that they won a gift card and directing them to visit bestbuygold.net.
"Thanks for your recent entry into out contest! You were victorious. Please enter 8747 at www.BestBuyGold.net to claim"
Going to the site, I was redirected to http://111.123.180.9/bb// which looks like every other scam site posing as one offering you a Best Buy gift card. Nothing special about it.

I decided to try a WHOIS search and discovered this:
DOMAIN: BESTBUYGOLD.NET
RSP: KalyHost
URL: http://www.kalyhost.com/
created-date: 2013-01-28 16:10:10
updated-date: 2013-01-28 16:21:44
registration-expiration-date: 2014-01-28 16:10:10
owner-organization:
owner-name: James Louis
owner-street: 4948 West Easy Brook Lane
owner-city: Portland
owner-state:
owner-zip: 44839
owner-country: US
owner-phone: +1.4938839920
owner-fax:
owner-email: jameslouisx2013@gmail.com
admin-organization:
admin-name: James Louis
admin-street: 4948 West Easy Brook Lane
admin-city: Portland
admin-state:
admin-zip: 44839
admin-country: US
admin-phone: +1.4938839920
admin-fax:
admin-email: jameslouisx2013@gmail.com
tech-organization:
tech-name: James Louis
tech-street: 4948 West Easy Brook Lane
tech-city: Portland
tech-state:
tech-zip: 44839
tech-country: US
tech-phone: +1.4938839920
tech-fax:
tech-email: jameslouisx2013@gmail.com
billing-organization:
billing-name: James Louis
billing-street: 4948 West Easy Brook Lane
billing-city: Portland
billing-state:
billing-zip: 44839
billing-country: US
billing-phone: +1.4938839920
billing-fax:
billing-email: jameslouisx2013@gmail.com
nameserver: ns1.xta.net 69.64.54.41
nameserver: ns2.xta.net 50.97.137.60
From what I have seen, the email address jameslouisx2013@gmail.com is associated with no other websites. The site is registered through Kalyhost, so I will be reporting this site to them as soon as I am done writing this blog. The server belongs to Softlayer and they will be getting an email from me soon.

The site BestBuyGold.net is simply a redirect to http://111.123.180.9/bb// and I discovered this site is registered in China. Of course, this is no surprise, since every Best Buy scam site I have blogged about comes from there.

Other websites that serve as a redirect include:
  • BestBuySurprise.biz
  • bestbuysurprise.com
  • bestbuysurprise.mobi
  • bestbuygiveaways.mobi
Websites that are no longer online include
  • bestbuysurprise.net
  • bestbuycashcards.net
  • bestbuypromotion.net
It makes me wonder if the Chinese have nothing else to do, aside from attempting to scam Americans.

Another link maing the rounds is bestbuybonus.net but that site is apparently down. However, the spammers haven't gotten the message and continue to textspam people.

If you enter any four-digit number in the box, it again redirects you to another site. This one is freegiftcardworld, an anonymously-registered site with its domain IP out of the Netherlands, but with servers located in the USA and the United Kingdom.

Duane Browning

Post a Comment