Keeping an eye on the Ultimate-Anonymity spammer scammer and doing everything we can to make him stop spamming.

Wednesday, August 27, 2008

datools.net.tc

Yet another domain used:

datools.net.tc
http://www.google.com/search?q=datools.net.tc

UA Responds

As you can see someone from Ultimate-Anonymity has posted a message for me, here, here, and here.

Here's the message:

Good day,

I am an administrator for Ultimate-Anonymity.com and one of our subscribers brought your blog to my attention.

I have identified the associate responsible for the comment spamming you reference in your blog. We have over 2,000 active associates (resellers) and our associate Terms of Service (TOS) strictly prohibits spamming or network abuse in any way, shape or form.

We have as of late yesterday terminated this associates account and that associate acknowledged early this morning the termination. As such he has forfeited any earnings and said earnings will be donated to the American Red Cross (this is a stipulation clearly stated in our associate program TOS to which each associate agrees). As such, the comment spamming will stop immediately. The associate in question admitted that he watched digg.com and reddit.com and would leave comments with his associate url or use url forwarders to redierct to those urls to direct traffic to those urls.

We are hoping that based on this information and the fact that the comment spamming issue has been resolved that you will delete the blog defaming our character so that no further action will be needed. We take our name quite seriously and will defend it using whatever means are at our disposal. In over 11 years of business with over a half million subscriptions our associate program has been successful however, on occasion a bad apple slips through the cracks that must be dealt with accordingly as this case demonstrated.

I apologize for any inconvenience you may have experienced and wish that you would have contacted us directly with your concerns as this issue could have been resolved much earlier as such abuse simply will not be tolerated.

Regards,

Bill Collins
Cyber Solutions
SupportDesk@Ultimate-Anonymity.com



Do I buy it? No.

1) If it was a reseller doing the spamming, then how does Ultimate-Anonymity.com keep track of what he sells when he advertises (spams) the site directly, and not using some kind of identifier such as for instance ultimate-anonymity.com/ref?=4320 which would allow UA to track his sales and then pay him his commission.

I've asked "Bill Collins" this question. Here's his reply:

Hi there,

I spent some time yesterday checking digg and reddit articles to find the spam comments in question and the ones I found (there were several) lead me right back to a coded associate signup page which is how I was able to identify the associate.

I either suspect by posting our direct url that the associate made an error (he really isnt very bright) or that it was a genuine subscriber just using the url in their in their signature line. I dont subscribe to many blogs but the ones I do participate in, I myself use a url in my signature line and its usually either to a skateboarding or surfing website that I like or even my personal myspace page. Signature links ae not that uncommon and with as many subscribers as we have wouldnt surprise me.

I am watching the digg and reddit articles myself for the last few hours and will continue to do so and have not seen any abuse therefore, I am assuming the problem as solved. We have also taken further measures to ensure the abusing associate is not able to signup for a new associate account as well as suspended his UA access in general by revoking his user ID.

Regards,

Bill Collins
Cyber Solutions

I've not found any of these signup pages he mentions (in red).

The part in orange looks to me like he is trying to downplay it, and even admitting he does do it, and that it's quite common etc etc...

2) If I do a Google search for "Bill Collins" and "Ultimate-Anonymity" I find signs that the spammer JT/JJ/etc etc etc... also has been calling himself Bill Collins (among other names):










http://ccinsider.comedycentral.com/cc_insider/2008/07/jeffrey-tambor.html (Bill Collins)
http://earth2tech.com/2008/05/21/garbage-will-lead-the-biofuel-revolution/ (John Collins)

If I look at who's been visiting this blog I see that the IP 69.69.28.85 just visited a while ago. This is the very same IP that the spammer has been using and that I've mentioned in my first post. See what a Google search for it brings up:

http://www.google.fi/search?q=69.69.28.85

It's very fishy.

Here's a discussion about it on Castle Cops
As you can see someone from Ultimate-Anonymity has posted a message for me, here, here, and here.

Here's the message:

Good day,

I am an administrator for Ultimate-Anonymity.com and one of our subscribers brought your blog to my attention.

I have identified the associate responsible for the comment spamming you reference in your blog. We have over 2,000 active associates (resellers) and our associate Terms of Service (TOS) strictly prohibits spamming or network abuse in any way, shape or form.

We have as of late yesterday terminated this associates account and that associate acknowledged early this morning the termination. As such he has forfeited any earnings and said earnings will be donated to the American Red Cross (this is a stipulation clearly stated in our associate program TOS to which each associate agrees). As such, the comment spamming will stop immediately. The associate in question admitted that he watched digg.com and reddit.com and would leave comments with his associate url or use url forwarders to redierct to those urls to direct traffic to those urls.

We are hoping that based on this information and the fact that the comment spamming issue has been resolved that you will delete the blog defaming our character so that no further action will be needed. We take our name quite seriously and will defend it using whatever means are at our disposal. In over 11 years of business with over a half million subscriptions our associate program has been successful however, on occasion a bad apple slips through the cracks that must be dealt with accordingly as this case demonstrated.

I apologize for any inconvenience you may have experienced and wish that you would have contacted us directly with your concerns as this issue could have been resolved much earlier as such abuse simply will not be tolerated.

Regards,

Bill Collins
Cyber Solutions
SupportDesk@Ultimate-Anonymity.com



Do I buy it? No.

1) If it was a reseller doing the spamming, then how does Ultimate-Anonymity.com keep track of what he sells when he advertises (spams) the site directly, and not using some kind of identifier such as for instance ultimate-anonymity.com/ref?=4320 which would allow UA to track his sales and then pay him his commission. I've asked "Bill Collins" this question but not received a reply yet.

2) If I do a Google search for "Bill Collins" and "Ultimate-Anonymity" I find signs that the spammer JT/JJ/etc etc etc... also has been calling himself Bill Collins (among other names):










http://ccinsider.comedycentral.com/cc_insider/2008/07/jeffrey-tambor.html (Bill Collins)
http://earth2tech.com/2008/05/21/garbage-will-lead-the-biofuel-revolution/ (John Collins)

3) If I look at who's been visiting this blog I see that the IP 69.69.28.85 just visited a while ago. This is the very same IP I mention in my first post. See what a Google search for it brings up:

Tuesday, August 26, 2008

Ultimate-Anonymity spamming usenet

He's also been spamming usenet.

Here's someone commeting about him in 2005:

">> The SCAM Spam Ultimate Anonymity DAILY inflicts this Usenet Abuse
>> on hundreds of Usenet newsgroups with lots of non-commercial NGs
>> being Usenet abused two, three & four times on a SINGLE day."

http://newsgroups.derkeiler.com/Archive/Alt/alt.fan.howard-stern/2005-11/msg00653.html

New URLS:

The spammer just keeps spamming.


I would never buy a product from a suspicious and dishonest company like this.

Here are some new URLs that he is spamming.
http://www.useurl.us/17n
http://www.crypted.de.tc/
http://s184554097.onlinehome.us/ua

Wednesday, August 20, 2008

New Mirror

Now he's using a new mirror:-

decrypt.net.tc

hosted at: http://www.smartdots.com/contact/?LANG=US


http://www.google.com/search?q=decrypt.net.tc

Monday, August 18, 2008

http://www.northbridgesucks.com/ua

Today the spammer started spamming (1, 2) a new site (same Ultimate-Anonymity content) at http://www.northbridgesucks.com/ua . At the moment through the URL-forwarding service www.useurl.us (www.useurl.us/126).

The site is hosted at http://1and1.com/

$ whois northbridgesucks.com
[Querying whois.internic.net]
[Redirected to whois.schlund.info]
[Querying whois.schlund.info]
[whois.schlund.info]


domain: northbridgesucks.com
created: 06-Nov-2006
last-changed: 19-Sep-2007
registration-expiration: 06-Nov-2008

nserver: ns51.1and1.com 74.208.2.8
nserver: ns52.1and1.com 74.208.3.7

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Oneandone
registrant-lastname: Private Registration
registrant-organization: 1&1 Internet, Inc. - http://1and1.com/contact
registrant-street1: 701 Lee Road, Suite 300
registrant-street2: ATTN: northbridgesucks.com
registrant-pcode: 19087
registrant-state: PA
registrant-city: Chesterbrook
registrant-ccode: US
registrant-phone: +1.8772064254
registrant-email: proxy494017@1and1-private-registration.com

admin-c-firstname: Oneandone
admin-c-lastname: Private Registration
admin-c-organization: 1&1 Internet, Inc. - http://1and1.com/contact
admin-c-street1: 701 Lee Road, Suite 300
admin-c-street2: ATTN: northbridgesucks.com
admin-c-pcode: 19087
admin-c-state: PA
admin-c-city: Chesterbrook
admin-c-ccode: US
admin-c-phone: +1.8772064254
admin-c-email: proxy494017@1and1-private-registration.com

tech-c-firstname: Oneandone
tech-c-lastname: Private Registration
tech-c-organization: 1&1 Internet, Inc. - http://1and1.com/contact
tech-c-street1: 701 Lee Road, Suite 300
tech-c-street2: ATTN: northbridgesucks.com
tech-c-pcode: 19087
tech-c-state: PA
tech-c-city: Chesterbrook
tech-c-ccode: US
tech-c-phone: +1.8772064254
tech-c-email: proxy494017@1and1-private-registration.com

bill-c-firstname: Oneandone
bill-c-lastname: Private Registration
bill-c-organization: 1&1 Internet, Inc. - http://1and1.com/contact
bill-c-street1: 701 Lee Road, Suite 300
bill-c-street2: ATTN: northbridgesucks.com
bill-c-pcode: 19087
bill-c-state: PA
bill-c-city: Chesterbrook
bill-c-ccode: US
bill-c-phone: +1.8772064254
bill-c-email: proxy494017@1and1-private-registration.com

Data on Ultimate-Anonymity.com

Ultimate-Anonymity.com is one of the most annoying spammers on the net right now.

His modus operandi is to visit popular articles featured on social-news sites such as Digg.com and Reddit.com and add a quick superficial comment to the article along with an URL to his site, either directly to Ultimate-Anonymity.com or to a mirror/via a URL-redirection service.

Visit these Google searches to see some of this spam:

http://www.google.com/search?q=ultimate-anonymity.com

http://www.google.com/search?q=privacy-center.net

http://www.google.com/search?q=fireme.to/udi

http://www.google.com/search?q=an0n.mirrorz.com (shut down)

http://www.google.com/search?q=anondo.alturl.com


Known Aliases:

JT, maybe stands for John Thomas. aka John Roberts, aka RedFoxOne, aka JummyDoDrop, aka Johny Frost, aka doswheeler, aka JoshTwoLittle, aka JimMcDish, aka JJ....

Known IPs:

69.69.28.85

Site-aliases:

www.Privacy-Center.net (same contents, hosted on a different server)

http://www.northbridgesucks.com/ua/ (same contents, hosted on a different server)

www.FireMe.To/udi (url redirection)

www.an0n.mirrorz.com (url redirection)

www.anondo.alturl.com (url redirection)

www.useurl.us/126

www.useurl.us/12m


Address: (according to http://www.aboutus.org/Ultimate-Anonymity.com)

13750 W Colonial Dr Suite 350-252
Winter garden, FL 34787 US

+1 863 402-1608,
Fax: +1 863-402-1608


This site has the same physical address/telephone number:

http://www.personfinders.org/

See http://shurl.org/CWBrh for more info ( real names?)


Reddit profiles:

http://www.reddit.com/user/JoshTwolittle

http://www.reddit.com/user/Juppylolo/


Take action:

His site Ultimate-Anonymity.com is hosted at midphase.com - mail support@midphase.com)

Another one: privacy-center.net is hosted at routhost.com - mail abuse@routhost.com

Yet another one: http://www.northbridgesucks.com/ua is hosted at oneandone.net - mail abuse@oneandone.net

http://forum3.midphasetalk.com/showthread.php?p=37364#post37364

AbuseDept@ShortURL.com (very helpful abuse department)

http://www.siteadvisor.com/sites/ultimate-anonymity.com

http://www.mywot.com/en/scorecard/ultimate-anonymity.com