Grameen Foundation Imposter Scam

Years ago, I interviewed Muhammad Yunus after hearing about his work providing micro-loans for people in developing countries. His work began in Bangladesh with the founding of Grameen Bank and his example led to the founding of the Grameen Foundation in the United States, whose purpose is to follow Dr. Yunus' example by extending micro-loans to people in the Developing World. Other organizations have also created programs to extend microcredit to impoverished people, such as Kiva.


On April 11, 2011 I received this email, claiming to originate from the Grameen Foundation:
Flag this message

AID NOTIFICATION
From: "Grameen Foundation" gcortes@itoiz.com.ar
To: undisclosed-recipients
Grameen Foundation'Head Office.
1101 15th St. NW, 3rd Floor
Washington, DC 20005'
Toll Free: 1-888-764-3872
Fax: 1 202-628-3880
www.grameenfoundation.org

The Grameen Foundation would like to inform you that you have been chosen by the board of directors as one of the final recipients of a cash Grant/Donation for your own personal, educational, and business development in order to reduce the poverty rate in your Community. The Grameen Foundation was established 1976 by Professor Muhammad Yunus which stand as an individual organization conceived with the objective of human growth, educational, and community development.
To celebrate the new year 35th anniversary program, Grameen Foundation is giving out a yearly donation of 950,000.00 (Nine Hundred And Fifty Thousand Great Britain Pounds) to 10 lucky recipients by which At least 15% of the awarded funds should be used by you to develop a part of your environment. This is a yearly program which is a measure of universal development strategy. You are to contact Rosanna Ramos-Velita, Treasurer(www.grameenfoundation@qatar.io) with your PIN Number (GF.101) in order to redeem your Grant and get more information.
On behalf of the inventor of this great foundation Professor Muhammad Yunus and we the Board of directors of the Grameen Foundation kindly accept our warmest congratulations as you proceed with your project of changes.

Paul Maritz
Chair, Grameen Foundation.

Remembering my interview with Dr Yunus, I immediately recognized the name of the Foundation. I also knew right away that this was a scam. The Grameen Foundation is also aware of this scam, as you can see from this report on their website. The personal finance magazine from India MoneyLife also has an article on this scam.


Apparently, the scammers were feeling some heat from all the attention they were getting, which must have been considerable. Copies of the original scam letter were posted at 419Eater and TheScamBaiter forums, which must have sent a few scambaiters off to deal with the scammer.


Apparently, the heat was a bit too much for the scammer to take or their email account got shutdown and they changed their contact email address. Eight days after sending me the first letter, they sent a second

Aid Notification.
From: "Grameen Foundation" grant@grameenfoundation.org
To: undisclosed-recipients
Grameen Foundation'Head Office.
1101 15th St. NW, 3rd Floor
Washington, DC 20005'
Toll Free: 1-888-764-3872
Fax: 1 202-628-3880
www.grameenfoundation.org
The Grameen Foundation would like to inform you that you have been chosen
by the board of directors as one of the final recipients of a cash
Grant/Donation for your own personal, educational, and business
development in order to reduce the poverty rate in your Community. The
Grameen Foundation was established 1976 by Professor Muhammad Yunus which
stand as an individual organization conceived with the objective of human
growth, educational, and community development.
To celebrate the new year 35th anniversary program, Grameen Foundation is
giving out a yearly donation of 950,000.00 (Nine Hundred And Fifty
Thousand Great Britain Pounds) to 10 lucky recipients by which At least
15% of the awarded funds should be used by you to develop a part of your
environment. This is a yearly program which is a measure of universal
development strategy. You are to contact Rosanna Ramos-Velita,
Treasurer(www.grameenfoundation1@bitscn.net) with your PIN Number (GF.101)
in order to redeem your Grant and get more information.
On behalf of the inventor of this great foundation Professor Muhammad
Yunus and we the Board of directors of the Grameen Foundation kindly
accept our warmest congratulations as you proceed with your project of
changes.
Paul Maritz
Chair, Grameen Foundation.

The scammer apparently got smarter after sending out the first email. Notice how the sender's email address was changed from  gcortes@itoiz.com.ar (an email address based in Argentina) to grant@grameenfoundation.org, in order to appear to actually have been sent from Grameen's offices. Also, the words in the original Subject line were all capitalized (typical for scam letters), but were typed normally in the second.


Knowing that scammers utilize more than one email address while conducting their scams, I sent a reply to the email from one of my extra accounts to see what sort of reply I would get. I received this

You Are Welcome To The Grameen Foundation‏.

From: "Grameen Foundation" www.grameenfoundation1@bitscn.net
To:

Grameen Foundation'Head Office.
1101 15th St. NW, 3rd Floor
Washington, DC 20005'
Toll Free: 1-888-764-3872
Fax: 1 202-628-3880
www.grameenfoundation.org
Good day to you’ I am Rosanna Ramos-Velita, Treasurer. At Grameen Foundation, our goal is simple – we want to see poor people, especially the poorest and those living in harder to reach areas, have access to micro-finance and technology and as a result of access to these services, move themselves out of poverty.  We envision a world where the poor have broken the generational chain of poverty and lead lives of respect, dignity and opportunity. Grameen Foundation, a nonprofit organization which was founded in 1997 by friends of Grameen Bank to help micro-finance practitioners and spread the Grameen philosophy worldwide. We are a leader in the fight against poverty in Sub Saharan Africa, Asia, Middle East/North Africa, and the Americas. Our cutting-edge programs and resources have helped millions of poor people, mostly women and children, improve their lives.Grant Donation  has been given out in different institution from various social standard   for years’ which was awarded by the foundation in their favour  and  the development of  their precise community.
Note that your country is not the only country that is benefiting from this donation. Beneficiaries have been chosen from countries from all continents. The idea of this donation is that within ten years from now, there will be notable richness among many unusual people around the world. This will give many people the opportunity to get their lives to a stage where they had always wanted also note that beneficiaries email addresses were selected randomly from over 100,000 internet websites and a shop's cash invoice around your area in which you might have purchased something from).
Based on the random selection exercise of internet websites and millions of supermarket cash invoices worldwide, you were selected among the lucky recipients to receive the award sum of £950,000.00 (Nine Hundred and Fifty Thousand Great Britain Pounds) as charity donations/aid.
Alliance & Leicester Bank Plc UK
Carlton Park, Narborough
Leicester, LE19 0AL
Phone:  +4470457 96435 and +4470111 96845
Website: www.alliance-leicester.co.uk
Email: webstephen@alliance-leicestter.co.uk
Your Grant has been forwarded to our payment bank for immediate release to you. You are required to contact our payment bank with your valid information (NAME, ADDRESS, OCCUPATION, AGE, SEX, and PHONE NUMBER) to the above address for qualification documentation and official processing of your claims.
Congratulation and God bless.
Rosanna Ramos-Velita, Treasurer' Grameen Foundation

If you didn't notice it, the scammer is using the name of a legitimate bank as a cover. That is the real website for the bank in the United Kingdom. However, notice that in the contact email address, there is an extra T added to the name "Leicester", so it is spelled "Leicestter". If a real bank was involved in a scam, it could cost them their license, so I don't think that Alliance Leicester has any involvement in this whatsoever. I sent a quick note to the reply address and received this

Thanks for Contacting The Alliance Leicester Bank plc®‏‏‏‏‏‏.

From: "Alliance Leicester Bank Plc" webstephen@alliance-leicestter.co.uk
To:
 
Alliance & Leicester
Alliance Leicester Bank plc® Transferring To The Santander Group
Customer Service Center
Carlton Park, Narborough
Leicester, LE19 0AL
.Enquiry for customer in the UK ? Call 0844 800 9000
Complaint? Call 0844 561 9790
.Enquiry for customers out side UK ? +4470457 96435
Complaint? Call +4470111 96845
ONWARD TRANSFER- £950,000.00 (Nine ight Hundred And Fifty Thousand Great Britain Pounds)
 
Qualification Numbers (L-222-6747)
This is to acknowledge the receipt of the order from the Grameen Foundation, in respect with the provision act of decree 114 of the 1999 constitution; I am directed to inform you that your payment verification and confirmations is correct. Therefore, we are happy to inform you that arrangements have been concluded to effect your payment immediately and we also thank you for contacting the Alliance & Leicester Bank in receipt of your email containing your contacts/personal information for processing of your Grameen Foundation Grant claims of £950,000.00 (Nine Hundred And Fifty Thousand Great Britain Pounds).
In view to this development you are here by invited to our bank head office in (Leicester UK) to claim your funds and get it registered with the (Bank of England) at the bellow address.
Alliance & Leicester Bank Plc UK
Carlton Park, Narborough              
Leicester, LE19 0AL
Phone:  ++4470457 96435 and +4470111 96845 
Website: www.alliance-leicester.co.uk
Email: webstephen@alliance-leicestter.co.uk
PLEASE NOTE THAT YOU ARE TO CHANGE YOUR PASS WORD TO YOUR MAIL BOX IN ORDER TO SAFE GUILD THE PROCESS OF THIS TRANSACTION.
Your prompt response to this mail is highly needed to avoid delay in concluding this transaction.

Yours faithfully,
Mr.Webster Stephen,
Customers Care Department
Alliance Leicester Bank (U.K) ®
Alliance & Leicester is now part of the Santander Group, one of the world's largest banks.

The individual who created alliance-leicestter.co.uk may be a resident of the United Kingdom, according to the website registration

Domain name:        alliance-leicestter.co.uk
    Registrant:        michael baxter
    Registrant type:        UK Individual
    Registrant's address:        27 little london        Towcester        01        NN12 8UP        United Kingdom
    Registrar:        Melbourne IT t/a Internet Names Worldwide [Tag = MELBOURNE-IT]        URL: http://www.melbourneit.com.au/contacts
    Relevant dates:        Registered on: 09-Oct-2010        Renewal date:  09-Oct-2012        Last updated:  09-Oct-2010
    Registration status:        Registered until renewal date.
    Name servers:        ns1.officelive.com        ns2.officelive.com

This could create serious legal problems for this person, if the registration information is accurate. Going back to the second scam letter I received, I decided to do a WHOIS search on bitscn.net

Domain name: bitscn.net
Registrant Contact:   Whois Privacy Protection Service   Whois Agent    +86.05922577888 fax: +86.05922577111   No. 61 Wanghai Road, Xiamen Software Park   xiamen fujian 361008   china
Administrative Contact:   Whois Agent    +86.05922577888 fax: +86.05922577111   No. 61 Wanghai Road, Xiamen Software Park   xiamen fujian 361008   china
Technical Contact:   Whois Agent    +86.05922577888 fax: +86.05922577111   No. 61 Wanghai Road, Xiamen Software Park   xiamen fujian 361008   china
Billing Contact:   Whois Agent    +86.05922577888 fax: +86.05922577111   No. 61 Wanghai Road, Xiamen Software Park   xiamen fujian 361008   china
DNS:ns1.4everdns.comns2.4everdns.com
Created: 2006-04-07Expires: 2012-04-07

This China-based site provides email services powered by Microsoft Live. Scammers operating out of China has used Microsoft services in the past, as did the scammer offering the Hawaiian Electric job I wrote about months ago. BITSCN does show-up on a list of sites not to be trusted, according to McAfee. The first email address from domain qatar.io is similar to this. However, the IP address for BITSCN is from China, while QATAR.IO is from San Diego, California. The QATAR.IO address was shutdown either by the scammer or by the domain itself, so I doubt if QATAR.IO is an accessory to the scam.


As far as IP addresses being used by the scammers, 

1. The first scam letter came from Monte Grande, Argentina;
2. The second scam letter came from Galdar, Spain;
3. The third (received after my reply) came from Lagos, Nigeria;
4. The fourth (claiming to come from Alliance-Leicester) also came from Lagos, Nigeria

I suspect that the first two letters were sent by members of a gang, possibly using proxies, while the leaders of the gang are based out of Nigeria.

Duane Browning

Smog Art Gallery Job Offer Scam

This is just a recycled version of the Justin Art Gallery scam I wrote about earlier.


This time, it's the "Smog Art Gallery" (I love this name) and they've posted ads all over the place, except in Hawaii. I guess the fact that several people wrote to me and expressed their gratitude for the previous post made the scammer realize that posting in Hawaii was simply a bad idea, unless they wanted to have themselves exposed as frauds.


I was bored last night and did a search for "We are looking for individuals (Male/Female) Start Making $1,300 Weekday P/T" and found several ads [1] [2] [3] and other places too numerous to mention.


Links 2 and 3 featured the name "Marcus Reese" and link 3 included a phone number 206-666-4849, which is a cellphone, of course.


To see if the Justin Art Gallery scam was alive and well, I sent an email about the "job" and received this reply 

Re: Reply to your Classified Ad #4283971
From: "Marcus Reese" marcusreese67@yahoo.com
To: me 

Smog Int'l
63 CM Recto,Manila
Philippines.
Reflecting Natures Beauty!
http://www.smogartgalary.com/

Hello,
Thanks for getting back to me regarding the Delivery Position.However, I am Marcus Reese a Branch Manager of Smog Art Galary and I have been given the task of setting up Smog Art Galary in the United States to further expand and also meet the high demands of our numerous customers in the United States.More so, I will be arriving on the 25th of April 2011 and you can have the Delivery Application below filled out and sent to me by email so we can have it added to the company's data base.More so, the start of date as a Delivery Agent will be on the 27th of April 2011 and you are to work from Mondays through Fridays while you take the weekend off.Your weekly pay will be $1,300.You can also call me on my cell phone +639159275768......dial as typed

Introduction to Smog Art Galary

Smog Art Galary Furniture was established by Samuel Moore and Olivarez Grante in 2001. Originally setting up their workshop in an unassuming Recto side street the pair lovingly created quirky, brightly colored bookcases, charming cupboards and chests made from bits and pieces reclaimed from skips or foraged from the tip. A style developed that was reminiscent of early Australian or depression furniture crafted from need and ingenuity. They honed their skill, with Molly the dog standing sentinel and usually one or two small children scrambling in the wood shavings.

They catered to a very local clientele, trading directly from the side door around which the first makeshift ‘shop front’ evolved. From here the business has grown to incorporate a large Molino Street frontage. The “two men” swinging above the door remain a recognizable part of the landscape. Gone however are the days when Samuel and Olivarez would lock up shop and amble around the corner to the Black Cat for lunch. Nowadays, although the boys have staff, they still make all custom furniture in Manila themselves and we are all far too busy to down tools for too long. Well… you must however understand that the morning and afternoon tea tradition stands firm . If you happen to be passing the workshop door around the hours of 10 or 4 you may just catch a few ‘pearls’ emanating about anything from why Molly retrieves sandpaper from the bin, or the cultural implications of reality TV to (very vocally) the outcome of the cricket!

Challenges we face

The audience for exhibitions of contemporary art and furniture has increased widely during the last 5 years as general awareness and interest in contemporary art has developed both in the Philippines and abroad, thus making us one of the world's Interactive Art Gallery and now we are face with a challenge of keeping up with our numerous clients in the United States as they sometimes prefer making payments by cashier's check or money order, that's why we are in search of Representatives in the United States that will act as an aid between us and our numerous customers in the United States.We would be happy to receive your resume if you are interested in working for Smog Art Galary as one of our Representative in the United States.More so, Vacancy for the position of a Driver/Delivery Personnel is now available for an Immediate Appointment with a weekly pay of $1,300

Nevertheless, the Van will be provided by the Gallery before your 1st Assignment.More so, you are also to act as Smog Art Galary Payment Representative by receiving payment from our customers in the United States in Cashier's Check ,money order or bank draft.

JOB DESCRIPTION:
You will be making deliveries of our Art Collections bought by our customers to different locations with a Van that will be provided to you.More so, you are to receive the payment for each art works purchased as our Delivery/Payment Representative and have it sent to our Accounts Officer and I hope you can handle this....
BENEFIT IS AS FOLLOWS:
* The averagely income is about $5,200 Monthly depending on your Efficiency.
* No form of investments from you....
* This job takes only 4-6 hours per day....
* You do not pay any form of taxes as it will be paid by the Gallery.
* Weekends will be your days off
* Good Retirement Plan and Health Assurance
Kindly Have the Delivery Application filled out and sent back to me if you are interested in working for Smog Art Galary as our Delivery and Payment Representative so we can have it added to the company's date base. you can find out more about Smog Art Galary at http://www.smogartgalary.com/

Best Regards,
Marcus Reese
Smog Int'l
63 CM Recto,Manila
Philippines.
Reflecting Natures Beauty!
http://www.smogartgalary.com/

Delivery Application:
Contact Details:
First Name:
Last Name:
License Class:
Address Line:
City:
State:
Zip code:
Telephone:
Mobile:
Email:
2 Years Employment History (Most recent first)
Employer's name and any further details that may aid your application
Employer’s Full Name (1):
Start Date (1):
End Date (1):
Start Date (2):
End Date (2):
Employer’s Full Name (2):
Start Date (1):
End Date (1):

I visited the website via the link they gave and there really is a site. Not a well-designed one, but a site nonetheless. A definite improvement over the Justin Art Gallery scam, even if these morons don't know how to spell "gallery" correctly. I think that these are the same people who ran the first scam I wrote about, since they are using the same phone number.


But, much of the old scam is apparent in the new one 1) placing Want Ads anywhere and everywhere, 2) lack of identifiable information in the actual ad itself, beyond a name and cellphone number and 3) requesting copious amounts of information to be sent via email.


I did a WHOIS search to discover the owner of their website. One might think that the site would be registered in the Philippines, since the "galary" is supposed to be there? Right?


Nope. Wrong. It's registered in the United States of America.


Registrant:
Patricia Markie
98 Thompson Road
Avon, CT 06001 US
Phone: (646) 673-7229
Email mercury3t@yahoo.com


So, there are a few differences between this scam and the first, but not many. The scammers have also been active posting fake ads offering to sell a house in Manhattan while using the same phone number. They also ran a fake job offer scam under the name "Duncan Art Gallery".


As for the Philippines-based phone number, it is a mobile phone registered with Global Telecom. I went to their website in an attempt to report this number's connection to possible  illegal activities in the United States and I was promptly disconnected from the chat server when I told them why I was contacting them. I'm not sure if it was deliberate or just a malfunctioning server.


So, there you go: the latest update on this group of scammers from the Philippines.


Duane Browning

GIFT50.COM Spammer/Telemarketer

(This blogpost has been extensively rewritten to include new information about this spammer and how to report them to the appropriate agencies)

*******UPDATE FOR 11 SEPTEMBER 2011*******

The website GIFT50.COM is now dead.

*******IMPORTANT UPDATE*******

It has recently been discovered that the registered owner of gift50.com, Nick Brown, is the official contact for a company called Best World Media (bestworldmedia.com).

This corporation is a lead generation company. They harvest customer information and sell it to their clients.

If you want to fight back against this textspammer, you may report them to the Federal Trade Commission (FTC), the Federal Communications Commission (FCC) and the  New York Better Business Bureau.

If you want to contact Nick Brown directly, here is the contact information given on the website:

BestWorldMedia.com
244 Fifth avenue
Suite 292
New York, NY 10010

PHONE: (646) 338-8558

E-MAIL: nick.brown@bestworldmedia.com

*******IMPORTANT UPDATE*******

If you receive a text message that tells you to claim your "free Walmart gift card" at GIFT50.com and you actually try going to that site, you will be redirected to this address
http://track.brandnewprizes.com/SplashPage.aspx?g=827b5f1edb144c97a95fa974fb054569&nm=014havx2mqx0&s=gift50&se=04 (this link is now dead and only a line of text is displayed saying "You have requested a non-existent page.")
Here is one version of the spam texts being received

Congratulations! You've been choosen to recieve a $1,000 Wal-Mart Gift Card! Use appoval code: Giveme visit:GIFT50.COM

I really don't know if you really get a gift card or you just have your name added to a list to be sold to other marketing companies, so I can't be any kind of judge on the veracity of the spammers' claims. I sent an email to Walmart to see if this activity is something they have sanctioned. This is the response I received from Walmart's Corporate Offices:

Thank you for your message.
Dear Duane,
Thank you for your recent inquiry regarding a potential telemarketing scam.  Walmart does not call or solicit customers to offer shopping cards, shopping sprees, or membership discounts in return for bank account, credit card, or personal information; nor would we solicit the customers with these incentives for them to take surveys.  Also, Walmart currently does not employ mystery shoppers and any company that claims to be affiliated with Walmart for this type of program may be part of a telemarketing scam.  Some telemarketers and internet ad companies use the Walmart name to engage the interest of the customer.
You may report the solicitation to the Federal Trade Commission (FTC) at www.ftc.gov or at 1-877-FTC-HELP (382-4357).  The FTC maintains a telemarketing complaint database called the "Consumer Sentinel" which is available to hundreds of law enforcement agencies in the U.S.  The more concerns the FTC receives and logs, the more likely it is that some law enforcement agencies will get involved.
Customers should also report the solicitation to the Consumer Fraud Division of the Attorney General's office in their state or to the Better Business Bureau.  The contact information for these organizations is located in the front of your local phone book.
Sincerely,

Walmart Customer Care

GIFT50.COM (dead) is was (LOL!) owned by the same person who owns owned MONEY500.COM (ownership apparently transferred), MONEY600.COM (dead), LAPTOP55.COM (dead) and over 100 other domains.

Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
   
Domain name: gift50.com
Registrant Contact:

   Nick Brown ()

   Fax:
   244 5th avenue
   ste 282j
   new york, NY 10001
   US
Administrative Contact:

   Nick Brown ()
   +1.6463388558
   Fax: +1.5555555555
   244 5th avenue
   ste 282j
   new york, NY 10001
   US
Technical Contact:

   Nick Brown ()
   +1.6463388558  (appears to be a cellphone, registered to T-Mobile)
   Fax: +1.5555555555
   244 5th avenue
   ste 282j
   new york, NY 10001
   US
Status: Locked
Name Servers:
   dns1.name-services.com
   dns2.name-services.com
   dns3.name-services.com
   dns4.name-services.com
   dns5.name-services.com
  
Creation date: 02 Feb 2011 22:33:00
Expiration date: 02 Feb 2012 17:33:00

Current status of domains known to have been registered to this person

AidTest.info (unsubscribe page displays)

bestworldmedia.com (active)

Gift90.com (active)

giftcard2.com (active)

Money600.com (dead)

outsidecathin.info (unsubscribe page displays)

ViewMyNewsCore.com (dead)

AidPeril.info (unsubscribe page displays)

ScatHin.info (unsubscribe page displays)

BareAid.info (unsubscribe page displays)

EastAid.info (unsubscribe page displays)

AquiVed.info (unsubscribe page displays)

MONEY500.COM (active)

LAPTOP55.COM (dead)

If you want to file complaints against this guy, send your email to support@namecheap.com. Tell them that you received the message via text message on your cellphone and include the complete text message that you received. If you received more than one text message, tell them that too and also mention if you have to pay for any texts you receive on your cellphone plan.

The (646) 338-8558 phone number given has been called by some one who read this blogpost (see comments section) and the people answering claimed to have no knowledge of GIFT50.COM, so I advise against calling them, as an innocent party may be involved. The owner of the website may have either entered a false number in their registration or has since changed their number to avoid complaints from people angry over being textspammed.

I found this link and this one mentioning that GIFT50.COM was slated for deletion on October 29, 2009 so, this website was purchased or renewed by the current owner in the past two years.

Phone numbers associated with GIFT50.COM

202-403-1171

203-736-7859

205-835-7576

207-299-3922

207-629-7627

210-324-9517

213-210-4098

213-447-9721

216-776-8628

218-535-5039

240-237-0891

251-253-2246

269-282-2617

281-954-1565

310-736-0903

319-671-2457

323-203-6170

325-513-9367

334-333-9575

337-784-1012

401-440-3856

404-429-6733

404-431-3279

404-452-0259

404-791-6913

407-486-6455

409-273-2891

419-378-4595

469-563-4512

480-274-3055

501-266-4125

503-836-2154

505-307-8276

507-841-8659

509-494-4402

513-435-4781

518-536-4148

520-238-2876

615-649-2642

615-681-6505

619-587-4426

641-232-0019

646-248-2717

701-403-2104

702-292-9294

703-314-4402

704-961-8439

803-217-0351

806-471-1293

813-720-5028

832-331-1612

860-634-1798

860-771-0749

860-830-4781

913-426-3107

917-261-0006

Several toll-free numbers appear to be linked to these textspammers:

866-571-8731

866-898-6147

877-774-5339

888-408-1754

Since the above search result indicates a possible link between these toll-free numbers and the text spammer, it is a temptation to call these numbers from a convenient payphone (to avoid the people answering from getting your home number and adding it to their database) to make a complaint about being spammed on your cellphone. If enough people were to call, it would cost them some money and they might stop, depending on if their scam was making them more money than it was costing. If I was a mean person, I'd be sorely tempted to call each of these numbers from a payphone, several times a day to complain. If I was a particularly nasty person, I'd call them several times an hour, every hour of my waking day, everyday of the week, for a whole month to get my point across.

But, that would be exceptionally cruel of me to do and would probably cost them a lot of money.

To continue...

The link I gave in the first paragraph is from BRANDNEWPRIZES.COM and is registered to:

I Marketing Survey Stop
Robert Celsi
100 Congress Avenue
Suite  2000
Austin, Texas,78701
Telephone: 866-852-1603
Email IMarketingSurveyStop@yahoo.ca

Domains known to be registered to this person

Freenewprizes.com

Wincoolgifts.com

Freenewgifts.com

Socialsurveygiveaways.com

WinCoolRewards.com

GIFTDELIVERYNOTICE.COM

DAILYDEALDELIGHTS.COM

Socialsurveygiveaways.com

WinCoolRewards.com

WinfreeNewPrizes.com

If you want to complain about this website to their domain service,

Registration Service Provided By: DYNAMIC DOLPHIN, INC, Contact: +1.7208723477

From I Marketing Survey Stop's website, I collected this contact information, which matches the above information from their website registration, except for the email address and no telephone number is included:

iMarketingSurveyStop.com

ATTN: CUSTOMER CARE

I Marketing Survey Stop

100 Congress AvenueSuite 2000

Austin TX

Email: Support@iMarketingSurveyStop.com

The address 100 Congress Avenue #2000 may be a virtual office for this company, since several other businesses claim this address as their own, mostly law firms. I personally sent a complaint email to both email addresses given for I Marketing Survey Stop and did not receive a reply or even an acknowledgement that my message had been received.

So, since GIFT50.COM links to his website, you can call him on his toll-free number to voice your displeasure over being spammed on your cellphone. You can also contact him via his website at this link to make a complaint about being spammed, though I strongly advise that you not enter your regular email address in the form, to prevent it from possibly being placed into their own mailing list.

The owner of BRANDNEWPRIZES is a full participant in this venture and not a purely innocent party. If you read the Official Gift Offer Rules for redemption of the Free $1,000 Walmart Gift Card, you'll see that you must participate in surveys for a period of time in order to claim your "free gift card". Compare this to what Walmart actually says in their reply to me

...nor would we solicit the customers with these incentives for them to take surveys.

So, I would suggest that you should follow Walmart's advice in handling these text spam messages.

I would like to extend my sincere thanks to Walmart for their speedy reply to my message and to my readers who have  notified me of new phone numbers associated with this spammer.

Duane Browning

At Least He Stopped Using SMS

Our buddy, Basil Al-Haddad is now known as Geoffrey Owen and he has decided to stop using text messaging and use emails, like most of the other scammers out there.


The advantage to his using email, instead of SMS is that recipients no longer are forced to read his messages and those people who have limits on the number of texts we can send or receive before they have to pay for them no longer will lose money because some lazy jerk is running a scam. He's also stopped using O2 email and is now using Microsoft Live.


This is his new email address geowen@live.co.uk


This is the email he's been sending out lately:

Hello,

I am quite aware of the impact strange e-mails like mine do have onpersons especially when they are unsolicited for, I must therefore apologize for intruding.

However, I am getting in touch with you as regards the assets of a client (deceased) who you share the same family name. He served as a contractor for Jiyeh Power Station Lebanon until the power station was bombed by the Israeli air force during the Israel-Lebanon conflict in2006 (leading to his death).

I am Geoffrey Owen. I work as an investment adviser for an assets management firm. It is our responsibility to locate the family of the deceased and pass on the assets by intestate succession. I advise you to contact me ASAP seeing that the assets are about to be confiscated to the Her Majesty Treasury if nobody comes forward for it.

I patiently await your response. I can be reached at 011 (44) 787 2282424 or +(44) 787 228 2424 for further discussion

I appeal for your tolerance if my message is contrary to your moral ethics. Thank you.

Yours Faithfully,

Geoffrey Owen.

He really seems to like those two phone numbers, which are the same one he used in the text spam period.

Thus, our friend joins the legions of scammers who litter our inboxes with their scam letters. This, of course, can easily be ignored, as opposed to the text spamming.




Duane Browning

Yet Another Text Spammer (Part Two)

Here is the original post on the topic of this text spammer.


Until recently, the email address where you were supposed to send your personal information - market.dir@o2.co.uk - did not respond to inquiries. Only the original contact email - 4882@o2.co.uk - replied to any questions.


However, that has changed with a name and a new phone number added to this story. Several days ago, a friend sent an email to market.dir@o2.co.uk with a question regarding sending his details and received a reply from a person using the name Basil Al-Haddad. "Basil" also gave a new phone number by which he could be contacted: 
 011 (44) 787-228-2424 which is also a number from the United Kingdom.

Basil Al-Haddad

Marketing Director

TELEFONICA O2 UK LIMITED

260 Bath Road Slough Berkshire SL1 4DX

England, United Kingdom.

Phone: 011 (44) 787-228 -2424

Email: market.dir@o2.co.uk

According to information I received, this new number is a cellphone. If this number is correct, you can SMS this person via one of these addresses

• 07872282424@mmail.co.uk
• 07872282424@o2.co.uk
• 07872282424@mmsc.mms.o2.co.uk

Due to my ignorance of dialing phone numbers in the UK, these addresses may not be entirely accurate. So, be careful.

Once again, an IP trace was done and surprisingly the result was the same as the email received from 4882@o2.co.uk in that the IP was out of the USA. So, my initial assumption of a ringleader being in the UK was incorrect. Either that or they are using a proxy, but I had always thought that a proxy would give a different IP every time you used it.


Examining the headers of both emails, I found this in the first

Return-Path: info3@telefonicamail.net

and this in the second

Return-Path: veunit@telefonicamail.net

I didn't think much of it, at first. But, curiosity got hold of me and I did a WHOIS on telefonicamail.net and received this result

WHOIS information for telefonicamail.net :[Querying whois.verisign-grs.com]
[Redirected to whois.melbourneit.com]
[Querying whois.melbourneit.com]
[whois.melbourneit.com]
Domain Name.......... telefonicamail.net
Creation Date........ 2010-04-29
Registration Date.... 2010-04-29
Expiry Date.......... 2011-04-29
Organisation Name.... John Russell
Organisation Address. PO Box 61359
Organisation Address.
Organisation Address. Sunnyvale
Organisation Address. 94088
Organisation Address. CA
Organisation Address. US
Admin Name........... Admin PrivateRegContact
Admin Address........ PO Box 61359
Admin Address........ registered post accepted only
Admin Address........ Sunnyvale
Admin Address........ 94088
Admin Address........ CA
Admin Address........ US
Admin Email.......... contact@myprivateregistration.com
Admin Phone.......... +1.5105952002
Admin Fax............
Tech Name............ TECH PrivateRegContact
Tech Address......... PO Box 61359
Tech Address......... registered post accepted only
Tech Address......... Sunnyvale
Tech Address......... 94088
Tech Address......... CA
Tech Address......... US
Tech Email........... contact@myprivateregistration.com
Tech Phone........... +1.5105952002
Tech Fax.............
Name Server.......... ns1.officelive.com
Name Server.......... ns2.officelive.com

Doing a reverse WHOIS reveals that "John Russell" owns hundreds of other domains. However, it would cost me a lot of money to find-out which domains they are and I do not care about it that much to spend money on this. So, it seems that "John Russell" is behind this whole thing.


Other email addresses used in the past with this scam:

• veunit@o2.co.uk
• inquiry@o2.co.uk
• query1@o2.co.uk
• info@o2mobile-uk.com

I'm sure that I could find more addresses, if I was inclined to keep looking.

Apparently, the scam got started in Nigeria with these text messages being sent out randomly with all correspondences being done by email. The addition of real telephone/fax numbers shows that it is possible they have confederates in the UK working as part of the scam.

Duane Browning