Monday, July 30, 2007

Irina... my new love from Russia : Update

When I'm sleeping and not following the rule number 1 - "Follow each little thread until you are certain it leads to nothing" then it's good that others (SiL) are awake.

I told about the email address at freemailserv.net and this is actually not just a free email service as I thought. Freemailserv.net resolves to 64.71.167.123 which belongs to Hurricane Electric, www.he.net, but is assigned to McColo Corp, www.mccolo.com. That is very interesting and good that I got a wake up call to realize this. McColo Corp is as I mentioned in earlier posts about the Marriage agency scam also the company hosting for UALadys.com. That seems like a coincidence to good to be true. I have asked UALadys about this too, but since their last mail where they claimed that an affiliate was behind the spamming, they have been very quite.

If you use google to search for 64.71.167.123 or freemailserv.net you find lot of references to this scam, but what surprised me most was that some of the references involving this IP-Address is as old as june 2006. It seems weird if McColo have received no complaints before about this when I'm able to find so many references.

But I send a complaint to McColo and a copy to Hurricane Electric. I have gotten no answer from them but here 3 hours after I filed the complaint the server is down.

Another help I got today was translation of the russian post that also involved the 85.10.235.211 address and the documentum.ws domain. It turns out it was an advertisement for fake diplomas and certificates, which suddenly makes it seems like documentum.ws is defently not a victim. And only a few hours after sending an email to buy@documentum.ws regarding the relation to the 85.10.235.211 server, then the web site was no longer available.... but I think it may be a coincidence. Jethosting.ru that is hosting documentum.ws is also down, so is ripn.net (WhoIs Service) and rbnet.ru (Russian Backbone Net).

While looking through the background information about this scam I managed to find no less than 4 different photos of passports with Irinas picture on... however she was called Irina on none of those 4 passports. Fake passports seems to fit weel together with fake diplomas and certificates...

www.delphifaq.com/faq/images/5767.jpg
www.delphifaq.com/faq/images/6081.jpg
www.delphifaq.com/faq/images/3332.jpg
www.delphifaq.com/faq/images/9777.jpg

3 comments:

Anonymous said...

Wow. That was a productive day! :)

Keep in mind that most of the domains behind these scams are considered disposable, thrown away once a victim has been reeled in. But now I wonder what will happen with your correspondence with "Irina".

By the way you should consider posting the locations of these passport images of this so-called "lady".

Good research! (Again)

SiL

Anonymous said...

Hehe. :)

Unfortunately that site is temporarily down (something to do with CPU usage. Hmmm...) Too bad because it was reporting these scams as well.

These are all the same passport image as well:

http://www.delphifaq.com/faq/images/4519.jpg
http://www.delphifaq.com/faq/images/4683.jpg
http://www.delphifaq.com/faq/images/4831.jpg
http://www.delphifaq.com/faq/images/4835.jpg
http://www.delphifaq.com/faq/images/4855.jpg
http://www.delphifaq.com/faq/images/4857.jpg
http://www.delphifaq.com/faq/images/4863.jpg
http://www.delphifaq.com/faq/images/4868.jpg
http://www.delphifaq.com/faq/images/4906.jpg
http://www.delphifaq.com/faq/images/4907.jpg
http://www.delphifaq.com/faq/images/4908.jpg
http://www.delphifaq.com/faq/images/4909.jpg
http://www.delphifaq.com/faq/images/6780.jpg
http://www.delphifaq.com/faq/images/6783.jpg
http://www.delphifaq.com/faq/images/7747.jpg
http://www.delphifaq.com/faq/images/7767.jpg
http://www.delphifaq.com/faq/images/7771.jpg
http://www.delphifaq.com/faq/images/7813.jpg

SiL

Just a thought said...

I hate spammers! Dude, those passports must belong to married quadruplets! :) :) :)

I found your very informative site in a link at DPFORUM
My spam thread is here, I hate em too!
spammer thread