Kinda dodgy

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Jan 11, 2007 2:38 am

Sent this to joker:

"You provide DNS entries to efias.com. You have been previously advised that this site is illegal. By continuing to provide domain name services you are complicit."

I'm off to bed now

Posted: Thu Jan 11, 2007 3:20 am

Scam Patroller wrote:

Gnax have killed it again clapping

If this keeps up, you'll have 20 US flags from that one site Laughing

Posted: Thu Jan 11, 2007 3:34 am

well done SP its like that game u play at arcades sometimes with the hammer Laughing

Posted: Thu Jan 11, 2007 11:16 am

http://forum.aa419.org/viewtopic.php?p=48768#48768
They ARE persistent!

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ Cheers for the link, I see they are now hosted by Galaxyvisions:

Quote:

www.efias.net
$ whois efias.net
$ dig efias.net $ dig www.efias.net => 66.109.25.118, NS: ns1.zlovesche.com.
get title of page => ABOUT US
$ whois 66.109.25.118
66.109.25.118, (reverse ip), ns1.zlovesche.com., Galaxyvisions Inc , [email protected]

Pinged efias.com and got a reply, no site up yet, or maybe they are cloaking it now, I will send an abuse to Galaxyvisions in a minute and let them know what has transpired previously.

Posted: Thu Jan 11, 2007 12:19 pm

Make sure that they know that the whois and site content are identical for all 3 domains (I checked) Wink

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ What Who-Is is the same for what 3 domains? I thought there were only 2 domains, efias.com and aboutfias.com, no?

Posted: Thu Jan 11, 2007 12:24 pm

No dear. The link I gave you was for efias.NET, which was an email only domain on page 1 of this thread. It is now an up and running full blown faker (exact duplicate of efias.com). If you send on it, be sure to change the status in the thread I posted.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

^^^^^ Yeah, I just noticed it was .NET when I pasted their details in to the abuse notification I'm sending Embarassed

Will update the aa419topic when I'm done sending it.

Posted: Thu Jan 11, 2007 12:40 pm

Okie doke. 0445 here and I'm off to bed!

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Abuse has now been sent for www.efias.net here's hoping galaxyvision are as cooperative as the other hosts who have killed them, these lads must be getting pissed off, I am going to send them an email and taunt them Twisted Evil

Posted: Thu Jan 11, 2007 4:27 pm

What's SO special about this fake site? I've not seen the lads go to such lengths SO quickly to keep it's like running.

I'm thinking they must have several REAL victims on the rack and are desperate not to lose them. Sad

Posted: Fri Jan 12, 2007 5:18 am

I've seen this happen a few times before. Some lads just don't know when to say goodbye to their fakes, and have no clue when they've been targeted for termination by someone who actually knows what they are doing and will chase them all over the net, shutting them down wherever they pop up Laughing

As this is a job scam, they probably have all kinds of nice company letterhead and logo tripe that they have paid for, not to mention what they paid the faker maker. A search shows several dead efias domains other than the ones SP has deaded.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

No reply from the webhosts at Galaxyvisions yet, it's only been 1 day though, www.efias.net is still online, I took 2.5 GB of their bandwidth yesterday with a custom vampire page, going to resend my abuse today.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I have not had a reply to my abuse notification sent to galaxyvision at [email protected] 2 days ago, so I have sent another abuse notification reminder to them, and also a fresh notification to the domain registrars at http://www.namebay.com

A complaint has also been sent to Internic/ICANN throught their site here:

http://wdprs.internic.net

Posted: Sat Jan 13, 2007 11:07 pm

Great work, SP.

I seem to be getting nowhere with my complaints.

Posted: Sat Jan 13, 2007 11:41 pm

For what it's worth I've also fired of a couple of complaints.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I have not had a reply from Galaxyvisions, but www.efias.net was not loading for a while so they have killed it, their name servers have changed from the one listed in the databse as Galaxyvisions:

Quote:

NetRange: 66.109.16.0 - 66.109.31.255
CIDR: 66.109.16.0/20
NetName: GALAX-NETBLK-1
NetHandle: NET-66-109-16-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.GALAXYVISIONS.COM
NameServer: NS2.GALAXYVISIONS.COM

A new Who-is lookup now shows as energizedhosting.com as the new webhosts, so galaxyvision have killed them and the lads have rehosted it:

Quote:

Domain Name: EFIAS.NET
Registrar: NAMEBAY
Whois Server: whois.namebay.com
Referral URL: http://www.namebay.com
Name Server: NS1.ENERGIZEDHOSTING.COM
Name Server: NS2.ENERGIZEDHOSTING.COM
Status: ok
Updated Date: 15-jan-2007
Creation Date: 06-mar-2006
Expiration Date: 06-mar-2008

www.efias.net
$ whois efias.net
$ dig efias.net => 205.234.132.158, NS: ns1.energizedhosting.com.
get title of page => ABOUT US
$ whois 205.234.132.158
$ whois NET-205-234-132-0-1
$ whois NET-205-234-128-0-1
205.234.132.158, (reverse ip), ns1.energizedhosting.com., HostForWeb Inc.

New abuse notification has been sent to energizedhosting.com :

Quote:

Your ticket has been submitted to our Abuse department, one of the staff members will review it and reply accordingly. Listed below are details of this ticket, you will need to use the ticket key listed below to update the status of this ticket from web.

Ticket Information:
Ticket ID: APG-21283
Ticket Key: d89274e9
Subject: Known scammer hosting a fake check/fake job scam website on your servers
Department: Abuse

Posted: Mon Jan 15, 2007 7:06 pm

Rodus Longus: The more the merrier, provided the hoster's don't feel like they're getting spammed and the abuse letters aren't all exactly the same, i.e. they appear to come from different independent sources then the hosters will pay more attention.

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

Oh dear, what a shame, www.efias.net is dead again, I had a chat with energizedhosting.com live support after I had reported it to them, they said it wasn't hosted with them, I pointed out that they were at least the named name server, today the site is dead, they said they would pass all the info to their abuse team, who already had the info I sent to them anyway, either they killed the site or the registrar killed the domain, not sure which yet, looks dead, lets hope it's not just a technical blip Smile

:

Quote:

www.efias.net
$ whois efias.net (cached 16.01.07, 12:49:46)
$ dig efias.net (cached 16.01.07, 12:49:47) $ dig www.efias.net (cached 16.01.07, 01:34:21) => ns1.energizedhosting.com., couldn't resolve domain!

ns: ns1.energizedhosting.com., couldn't resolve domain!

[edit]

I think it is the domain registrars who have killed the domain name, sent test emails to efias.net and all bounced:

Quote:

This is an automatically generated Delivery Status Notification

Delivery to the following recipient failed permanently:

[email protected]

Technical details of permanent failure:
PERM_FAILURE: DNS Error: Domain name not found

Quote:

Delivery to the following recipient failed permanently:

[email protected]

Quote:

Delivery to the following recipient failed permanently:

[email protected]

Posted: Tue Jan 16, 2007 4:27 pm

Nice work SP Smile

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

These lads are back again:

www.efias-au.com

They are on the same webhosts as their www.efias.com domain was at energizedhosting.com

I have used my old support ticket to send a fresh abuse notification abou this new domain, and also reported it to Internic/ICANN and the registrars at joker.com

Baiting Guru Joined: 08 Jul 2004 Posts: 11857 Location: UK

I just had a chat with live support at energizedhosting.com, and a couple of minutes later, the www.efias-au.com site is showing as:

Quote:

This Account Has Been Suspended!

Posted: Mon Jan 22, 2007 7:14 pm

^^^^^

Sheer poetry Smile

Master Baiter Joined: 05 Sep 2006 Posts: 170

This is truly a thing of beauty.

I have to imagine the lads are near to pissing themselves by now.....