Monday, January 28, 2013

BestBuyGold.net Textspammer

People have reported receiving spam via text on their cellphones which tells them that they won a gift card and directing them to visit bestbuygold.net.
"Thanks for your recent entry into out contest! You were victorious. Please enter 8747 at www.BestBuyGold.net to claim"
Going to the site, I was redirected to http://111.123.180.9/bb// which looks like every other scam site posing as one offering you a Best Buy gift card. Nothing special about it.

I decided to try a WHOIS search and discovered this:
DOMAIN: BESTBUYGOLD.NET
RSP: KalyHost
URL: http://www.kalyhost.com/
created-date: 2013-01-28 16:10:10
updated-date: 2013-01-28 16:21:44
registration-expiration-date: 2014-01-28 16:10:10
owner-organization:
owner-name: James Louis
owner-street: 4948 West Easy Brook Lane
owner-city: Portland
owner-state:
owner-zip: 44839
owner-country: US
owner-phone: +1.4938839920
owner-fax:
owner-email: jameslouisx2013@gmail.com
admin-organization:
admin-name: James Louis
admin-street: 4948 West Easy Brook Lane
admin-city: Portland
admin-state:
admin-zip: 44839
admin-country: US
admin-phone: +1.4938839920
admin-fax:
admin-email: jameslouisx2013@gmail.com
tech-organization:
tech-name: James Louis
tech-street: 4948 West Easy Brook Lane
tech-city: Portland
tech-state:
tech-zip: 44839
tech-country: US
tech-phone: +1.4938839920
tech-fax:
tech-email: jameslouisx2013@gmail.com
billing-organization:
billing-name: James Louis
billing-street: 4948 West Easy Brook Lane
billing-city: Portland
billing-state:
billing-zip: 44839
billing-country: US
billing-phone: +1.4938839920
billing-fax:
billing-email: jameslouisx2013@gmail.com
nameserver: ns1.xta.net 69.64.54.41
nameserver: ns2.xta.net 50.97.137.60
From what I have seen, the email address jameslouisx2013@gmail.com is associated with no other websites. The site is registered through Kalyhost, so I will be reporting this site to them as soon as I am done writing this blog. The server belongs to Softlayer and they will be getting an email from me soon.

The site BestBuyGold.net is simply a redirect to http://111.123.180.9/bb// and I discovered this site is registered in China. Of course, this is no surprise, since every Best Buy scam site I have blogged about comes from there.

Other websites that serve as a redirect include:
  • BestBuySurprise.biz
  • bestbuysurprise.com
  • bestbuysurprise.mobi
  • bestbuygiveaways.mobi
Websites that are no longer online include
  • bestbuysurprise.net
  • bestbuycashcards.net
  • bestbuypromotion.net
It makes me wonder if the Chinese have nothing else to do, aside from attempting to scam Americans.

Another link maing the rounds is bestbuybonus.net but that site is apparently down. However, the spammers haven't gotten the message and continue to textspam people.

If you enter any four-digit number in the box, it again redirects you to another site. This one is freegiftcardworld, an anonymously-registered site with its domain IP out of the Netherlands, but with servers located in the USA and the United Kingdom.

Duane Browning

5 comments:

Anonymous said...

I received one today also from "amendnodq511@bestbuygold.net I knew it would be a scam! Thanks for the info and reporting it

Anonymous said...

I have written the Server and Host about this. I encourage everyone to do the same, to put a stop to this! Thank you for the info, Duane!

Eric said...

I recently received a txt making the claim that I have won first place prize. Being skeptical I did a search and found your blog. Lots of great info through out your blog. I appreciate the time, effort and heart it took to share.

Mahalo!

Anonymous said...

i have received two in the last two days, I figured it was a scam! One asked me to put in my birthday, I ignored them both!!! Thanks for the warnings!!!

Anonymous said...

I have received 4 texts in the last week from all you have listed. I "hopefully" have them blocked now. Bad enough to get these scams, but at 3:30 in the morning is very frustating! Thank you for the blog and reporting them!!!