Authorized Software Resellers aka Online Store

c۞g
Posts: 21225
Joined: Mon Jan 05, 2009 4:02 am

Authorized Software Resellers aka Online Store

Post by c۞g » Thu Dec 17, 2009 10:53 pm

Authorized Software Resellers aka © [2009] Online Store

Image

Spamtrackers wiki: http://spamtrackers.eu/wiki/index.php/Cheap_OEM_Software

PHISH / Scam
Identity Theft / Credit card abuse
FAKE online software reseller seeking personal identifiable informatin for plausible abuse. People, do you really think you are going to get Adobe products for $50 ?


LISTED IN BLACKLIST!
2 days, threat score 4, suspicious
Project Honeypot
b.barracudacentral.org
sbl.spamhaus.org
spam.dnsbl.sorbs.net
dnsbl-2.uceprotect.net
dnsbl-3.uceprotect.net
korea.services.net
sbl-xbl.spamhaus.org

List of domains/hosts

121.127.81.18
124.217.210.245
accountingsoftwarecheap.com
alphabuyworld.com
bestgiftsdirect.com
bestzipgetsoftware.com
bigsoftware.org
cheapwesterncatch.net
cheapxmasobtain.net
cheapxmassite.net
cheapxmasworld.net
coldsoftwarelow.net
greaticelow.net
greatsnowsoftwarelow.net
greatvalueline.com
greatwinteracquire.net
greatwinterpurchase.net
greatxmasget.net
greatxmassoftwarecheap.com
greatzipcode.com
helponcode.net
helponsoftware.net
highpricewar.com
hostmaster.bigsoftware.org
hostmaster.thexmaspurchase.net
hostmaster.xmassoftwarefree.com
icesoftwareminimum.net
inexpensivexmasget.net
keeponsoftwareonline.net
listbuywebworld.com
lowcostgiftstore.com
lowprostoredirect.com
managementsoftwarebuy.net
myzipsoftware.com
netzipsoftware.com
neverwinterbuy.net
neverwintercheap.net
ns1.alphabuyworld.com
ns1.bestgetrid.com
ns1.bigsoftware.org
ns1.thexmaspurchase.net
ns1.xmassoftwarefree.com
ns2.alphabuyworld.com
ns2.bestgetrid.com
ns2.bigsoftware.org
ns2.thexmaspurchase.net
ns2.xmassoftwarefree.com
olympicwinterbuy.net
olympicwintercheap.net
onzipsoftware.com
preserveonsoftware.net
protectedmarket.com
rescueonsoftware.net
savelivesprogram.net
savemycode.net
savenowprogram.net
saveonpackage.net
saveyourhomeprogram.net
securebuyproguide.com
skiwinterbuy.net
snowdowndirect.net
snowproplow.net
snowskiingminimum.net
snowskiingsoftwaresite.net
snowsoftwarelowdirect.net
softwarelow.net
softwarewinter.net
softwarewinterthrifty.net
supersavesoftware.net
supersnowsoftwarelow.net
superxmasget.net
superxmassoftwarecheap.com
superzipgetsoftware.com
thesnowminimum.net
thexmasacquire.net
thexmasinexpensive.com
thexmaspurchase.net
thexmasthrifty.com
thexmasvalue.com
thezipapp.com
thezipprogram.com
winterbreakworld.net
winterbuydirect.net
winterbuyonline.net
winterbuysite.net
wintercheaponline.net
wintercheapsite.net
xmasgiftssoftwareonline.net
xmasinexpensiveonline.com
xmaslightsacquire.net
xmaslightssoftwareworld.com
xmassoftwareacquire.net
xmassoftwarecheapdirect.com
xmassoftwarecheapguide.com
xmassoftwarecheapworld.com
xmassoftwarefree.com
xmassoftwareinexpensive.com
xmassoftwarethrifty.com
xmassoftwarethriftydirect.com
xmassoftwarethriftyonline.com
xmassoftwarevalue.com
xmassoftwarevalueonline.com
xmasvalueguide.com
yourzipgetsoftware.com
zipappdirect.com

phantazm
Posts: 4906
Joined: Thu Jan 03, 2008 1:46 pm

Done

Post by phantazm » Thu Dec 17, 2009 11:16 pm

Thanks for the digging...

Athlonite
Posts: 1198
Joined: Tue Oct 07, 2008 11:31 am

Rated

Post by Athlonite » Fri Dec 18, 2009 3:22 am

and commented. Always at work I see.
Thanks g7w.

Athlonite.


Your help is always needed.

TheBonobo4
Posts: 152
Joined: Sat Nov 07, 2009 2:56 pm

Commented on all. Thanks

Post by TheBonobo4 » Tue Dec 22, 2009 7:03 pm

Commented on all. Thanks g7w.

Platinum Level Member of the WOT Community.

boussagues
Posts: 12
Joined: Wed Mar 10, 2010 10:34 am

Here are some more

Post by boussagues » Wed Mar 10, 2010 10:34 am

codealertdirect.com/
warehotel.com
allsoftwaredirect.com
codewaydirect.com

boussagues
Posts: 12
Joined: Wed Mar 10, 2010 10:34 am

His name is Alex Notkins -

Post by boussagues » Wed Mar 10, 2010 10:54 am

At the moment he is using cs@downloadshelp.net for his emails it is registered to Alex Notkins and he has another 504 domains

The spamtrackers report says:

name: Alex Notkins
mail: alex@softwarebudget.net tel: +1.9120192873
org: N/A

address: 3617 Santana Beach
city: Miami
,province: Florida
,country: US
postcode: 10938
(That postal code is not a valid zip code for any location in the US, the phone number (912) 019-2873 could not exist because 019- is not a valid US local prefix, and the US Postal Service report that there is no 3617 Santana Beach in Miami, FL.)

See:

http://www.spamtrackers.eu/wiki/index.p ... M_Software

Jazspeak
Posts: 7295
Joined: Fri Oct 17, 2008 4:20 pm

Alex Notkins

Post by Jazspeak » Wed Mar 10, 2010 11:41 am

It is probably not his or her real name either. Has anybody in the US reported this individual to the Police and /or FBI? Whoever this person is, he or she would appear to be engaged in some sort of fraud, which is a criminal offence in the US.

Whilst it is good that WOT members expose this type of fraud to other WOT users, it would be better if this sort of information were to be sent to the Law Enforcement bods so that the fraudsters can be brought to book.

boussagues
Posts: 12
Joined: Wed Mar 10, 2010 10:34 am

Alex Notkins

Post by boussagues » Wed Mar 10, 2010 4:59 pm

This is not his real name and the scam is based in Russia, ask me how I know. My wife was caught out on this and the payments went to Riga.

His real name is thought to be Leo Kuvayev

Leonid Aleksandorowitsch Kuvayev was born on 13 May 1972. He is the older brother of three younger sisters. He attended the Massachusetts Institute of Technology (MIT), where he had a special interest in Artificial Intelligence.
From his Spamhaus record:
Russian/American spammer, a spin-off or occasional partner with Alan Ralsky, Igabromiv, Lindsay and also the P/A/Y gang.
Does "OEM CD" pirated software spam, child and animal porn spam, porn payment collection, pharma/pills, phishing, and others. Does his own DNS, possibly does DNS for other spammers. Buys bulletproof hosting wherever he can get it. Noted for enormous numbers of domains (bogus registration info, of course), often rotating every three hours in the spam to avoid URIBL filters. Mails via proxies using the usual spamwares, sometimes from his own (leased) servers. Noted for having "fresh" peas, meaning he is very close to the botnet masters collecting new, unlisted, zombie IPs. Was part of Sun Network spamhaus on MCI, gets BP hosting in Brazil, China, Russia, etc.


The dirty IP addresses are the same -
NS1.ENCATGPC.COM has address 211.244.22.30
NS2.ENCATGPC.COM has address 222.179.185.89.

I have given the details to the BSA to see if they can trace him.

boussagues
Posts: 12
Joined: Wed Mar 10, 2010 10:34 am

Registrar

Post by boussagues » Wed Mar 10, 2010 5:24 pm

Here is the info:

REGISTRANT CONTACT INFO
Protected Domain Services -
Customer ID: NCR-1278519 (warehotel.com)
Customer ID: NCR-1278289 (codealertdirect.com)
Customer ID: NCR-1278288 (allsoftwaredirect.com)
Customer ID: NCR-1278293 (codewaydirect.com)

125 Rampart Way
Suite 300
Denver
CO
80230
US
Phone: +1.7202492374

I live in France so I will leave it up to you guys in the US to pursue if you wish

boussagues
Posts: 12
Joined: Wed Mar 10, 2010 10:34 am

Software download site

Post by boussagues » Wed Mar 10, 2010 8:18 pm

The software is downloaded from:
securedownloadzone.com

The reverse pointer is downloadshelp.net

Domain Name: SECUREDOWNLOADZONE.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: ok
Updated Date: 08-feb-2010
Creation Date: 04-feb-2009
Expiration Date: 04-feb-2011

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests