Tag Archive: NJ

Massive Spam Hit for Centurion Wealth Circle Pyramid Scheme

Massive Spam Hit

Willie R

Centurion Wealth Circle Spam Deluge

Centurion Wealth Circle Spam Deluge

Over the weekend, I received over 600 spams from someone called Willie R (with a number appended to the name) to my gmail account which I now use for my spam-trapping on an old email address that I use for registrations and the like…  See the screenshot of one page above!

Centurion Wealth Circle

On checking out a sample I found that most point back to Centurion Wealth Circle with a small array of other dubious links included.  The spams I got had almost identical formats (except for differing ‘from’ addresses).  The differences were in a couple of links.  These are the two spam  types:

Type 1: Includes Link to AutoXten.com

CWC Spam Type 1

CWC Spam Type 1

Type 2: Includes Link to TextAdBrokers.com

CWC Spam Type 2

CWC Spam Type 2

The amazing thing taken straight from http://textadbrokers.com/?premier1 is the spelling mistake for their prime selling point!  Under the headline “What is TextAdBrokers?” we see:

TAB was created as the premier Partner for marketing and distribution For the newly created contextual advertising Platform hitcralwer.com

hitcralwer.com (or HitCrawler.com) has already spawned a long chain on Scam.com that starts with a scam warning, then features server outages, lawyer warnings, lawyer bebunkings and various personal threats and revelations about the contributors.  For me, this is all very entertaining stuff, but the key facts for me are that;

  1. I have been heavily spammed, all links tending to the same source and all pointers pointing to the same destination(s).
  2. TAB’s own blurb can’t even spell correctly!

From that, you’ll gather which side of the honesty fence I think this lot come from…!

Willie R Burke kindly leaves his address in one spam type as “41 Merker Dr, Edison, NJ 08837”.  This ties in with the WHOIS of the source.  However, I don’t see why I should have to follow THEIR suggestion to stop the spam coming from them.  After all, I have over 600! The suggestion is not everywhere, but only on some of the pointers.

Five domains are in nearly every spam, (from those that I checked in my deluge.)

These are;

  1. http://vd.autoxten.com
    • –  Under their earnings disclaimer, they claim “that AutoXTen is not a get rich quick scheme but is a business” and that “all customers are essentially purchasing advertising”….?
  2. http://www.centurionwealthcircle.com/?register
    •  – considering the deluge I just got, their spam policy takes some beating!  e.g. “Unsolicited commercial email (UCE), while regarded as legal in some jurisdictions, is regarded as spam by most Internet service providers (ISPs), and may not be used to promote CWC”.  Larry Harper, take note!  I am not prepared to wade through 600 email headers just to prove that your spam policy works…  You do it.  Start with the source.  YOU!
    • Pyramid Details

      CWC Pyramid Details

      CWC

      Their business model is based on buying “tokens”, keeping them as a “portfolio” or something for a bit, and then cashing in 50% of the “investment” at some ill-defined “maturity” point.  Although they claim otherwise, this is classic pyramid scheme technology.  They make clear the exponential growth that potentially exists in their own blurb, and ONLY pyramid schemes promise exponential growth.

  3. http://www.makemoneyonline-free.org/
    • – here I find out that I “have been invited to join ClixSense by robbie1201”.  Oh really!  Thanks for nowt robbie.  It’s a site called “ClikSense, advertising that pays” but the domain name remains the same.  On their user agreement, point 10, Spam Policy, they helpfully remind Robbie and Willie R that “Spamming is a federal crime. Any member caught Spamming will not only have their account terminated immediately and lose any past, present and future earnings, but shall also be held liable for spamming as we shall cooperate with any authorities and investigations that may arise from the spamming incident. ClixSense may fine your account up to $5 per spam email reported from you email address.”    I don’t think they were listening!
  4. http://www.homebasedtelesalesjobs.com/

The registrant of  http://infinityleadsystem.com/ is;

E.C.I.
5802 Bob Bullock C1 Unit 328C-195
Laredo, TX 78041-8813
US

However, the server is located in Quebec, Canada!

Why this should be so when so may sites (like mine here) are served from the massive data centres in the US (like Texas, say!) is beyond me.  But I find the Canadian connection strangely comforting.

Conclusion

It stinks.  From the initial deluge to burrowing through the various “systems”; it stinks.  Leave it well alone folks.  Any business of note should NOT  be resorting to Spam for new business.  The scale of this spam deluge emphasises the non-credibility of these charlatans much more than their cheesy website offering ever could.

The fact that most domains were hidden “for privacy” plus the fact that the websites are almost incomprehensible as they struggle to disguise their real motives and modus operandi are just bonuses!

Related Posts:

Comments are closed

More Info on Eurosoftware (EuroSoftMarket dot con)

Last month, I made a posting called Spoofed Emails Make Me Look Like Dodgy Software Saleman …. I’m now beginning to see the bigger picture after I followed through the initial investigation after receiving another email spam today.  My interest was piqued because the spam was very different but the final web page destination was not!

It pointed to http://formarnione.com/ which, if it’s still going, is the same as http://lierkaser.com/ from last month.  The website is registered like so:

Domain Name: FORMARNIONE.COM
Reseller…………..: PlanetDomain
Created on…………: 8 Nov 2008 07:02:16 EST
Expires on…………: 8 Nov 2009 07:02:16 EST
Record last updated on: 8 Nov 2008 07:02:16 EST
Status…………….: ACTIVE
Owner, Administrative Contact, Technical Contact, Billing Contact:
Joan Vairo (ID00391833)
11 Bay Point Drive
Toms River, NJ 08753
United States
Phone: +1.2127734859
Email:

You can find it on google maps here:
View Larger Map

Further fishing, took me to this forum post on FraudWatchers, say, and to this very informative website which everyone should bookmark immediately! http://spamtrackers.eu/wiki/index.php?title=Main_Page

A host of highly informative stuff is in the root http://spamtrackers.eu but for now, let’s go here to:

Eurosoftware_1_.jpg

…. which is all about the very problem I’m poking with my metaphorical stick.

Today’s site, formarnione, isn’t listed, which is hardly surprising when you read all the information.  A key bit is the link to Leo Kuvayev who has been responsible for a shed-load of nasties for years.

Leo_Kuvayev_1_.jpgWhack his name into Google.  Bizarrely, for someone so nefarious, he has less online pictures than a mafioso!  There are 4 identical ones, all on spock.com, but whether that’s him or not – he just looks too nice and smiley for words!

Anyway, I’ve done a few spamtracker suggestions, including using the wacky little tool called “The Complainerator”   :-D    It’s quirky, but works!  Now let’s see if our friends in the Far East at http://59.63.157.213/ actually do anything.

EuroSoftMarketSecurity

EuroMarketSoftware security details! n.b. Firefox address bar NOT green!

The forged software website, http://eurosoftmarket.com/  stays mostly constant because the “secure” purchase area is sub-domained off like https://secure.eurosoftmarket.com/!  What you make of the security is your business.  I just know that Firefox doesn’t go green, even though there is some sort of certificate…  Check the (wide, I know) picture.

But I tell you, the funniest thing about the whole shebang, is right at the very bottom, next to the “money back policy” and “terms and conditions”, they have the audacity to put the following phrase:

© Euro Software LCC`2005-2008

Ha Ha Ha Ha Ha Ha

Related Posts:

Example of Sustained Spam Comment Attacks on a single WordPress Posting

Strangely post on October 26th, 2008
Posted in Internet Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,

Now I may like to think I’m a literary genius but I am realistic enough to realise I’m not! So what happened was that I got lots of notional referrals sequentially on one post, all trying to comment at the same time! Then after a few minutes the same would happen to another posting – for days!

Take this one, http://strangelyperfect.tv/325/mucca-chucka/ The story of McCartney and his ex-wife is long dead, but suddenly loads of “people” wanted to comment on my particular post.

From 19:44 to 19:54 on one day I had these attempts on /wp-comments-post.php using the address http://strangelyperfect.tv/325/mucca-chucka/, the ugly permalink version.

One other commonality, was that they all came from computers running Windows XP and IE6.0! This is the start of a manual list

  • 19:54:14 c-66-176-114-144.hsd1.fl.comcast.net
  • 19:54:10 190-78-43-192.dyn.dsl.cantv.net

Then I decided that this dump of 40 hits onto the page processed in Microsoft Access on my PC, is a bit easier to do.   ;-) The timestamps show the hits at about 4 seconds apart on average, looking at them.

timestamp ip urlrequested referrer
1224810158 67.168.82.8 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877459 78.52.135.239 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877469 64.93.242.160 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877479 200.90.100.101 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877483 74.195.96.97 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877488 67.240.194.136 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877495 201.234.158.190 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877501 24.18.48.87 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877507 201.210.84.20 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877511 75.64.151.10 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877531 87.11.187.128 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877729 213.65.154.50 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877733 74.197.59.195 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877739 64.193.76.17 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877745 76.113.136.159 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877767 216.254.234.100 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877774 80.218.206.15 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877779 89.39.196.67 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877783 91.184.221.107 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877789 24.181.255.167 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877821 67.84.15.157 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877826 207.255.50.176 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877829 68.118.187.171 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877834 85.201.103.17 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877840 18.111.37.183 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877921 220.55.152.45 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877926 89.178.98.12 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877931 213.114.192.69 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877939 98.176.13.130 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877942 72.228.20.201 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224877999 68.191.158.23 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878003 93.156.138.228 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878006 99.236.181.12 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878011 69.14.134.227 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878020 74.192.226.71 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878043 208.101.109.213 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878046 24.100.17.186 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878050 190.78.43.192 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878054 66.176.114.144 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/
1224878062 62.123.4.141 /wp-comments-post.php http://strangelyperfect.tv/325/mucca-chucka/

Sample WHOIS data:

  • 62.123.4.141  Italy ISP
  • 66.176.114.144  Comcast NJ ISP
  • 190.78.43.192  Venezuela ISP
  • 24.100.17.186  New Wave Comms ISP
  • 208.101.109.213  Ontario ISP
  • 74.192.226.71  Texas ISP

I imagine they are all going to be the same sort of thing…

So somewhere, hiding in these big-brand ISPs are little PCs that all at once, all of a sudden, all wanted to post a comment on a posting that I did months ago!

Yeah right. :-?

In Buddhism there are no co-incidences.

Related Posts:

© 2007-2017 Strangely Perfect All Rights Reserved -- Copyright notice by me