February 05, 2005

online-replica-store.com sucks!

It has been a few weeks since I reported about simply-rx.com. Lots of people posted comments saying they were ripped off. I decided to check if several of the redirected domains (those that point any subdomain to the sucky site) were still up, and they are--except that they now all point to online-replica-store.com.

A quick search on Google will tell you that this is just another scam by the same people. The domain was registered by another fine Spanish citizen:

domain:       online-replica-store.com
status:       production
owner:        Sanchez Gonzalez
email:        gruco99@rodrun.com
address:      San Roque 889
city:         Castiblanco
state:        --
postal-code:  41230
country:      ES
admin-c:      gruco99@rodrun.com#0
tech-c:       gruco99@rodrun.com#0
billing-c:    gruco99@rodrun.com#0
nserver:      ns1.dns889.com 203.98.159.136
nserver:      ns2.dns889.com 203.98.159.136
registrar:    JORE-1
created:      2004-12-17 10:56:45 UTC JORE-1
modified:     2005-01-23 17:10:37 UTC JORE-1
expires:      2005-12-17 05:56:45 UTC 
source:       joker.com

Looks like a bogus name to me, as both "Sanchez" and "Gonzalez" are usually last names.

A few of the domains redirecting to the site are:

A few other domains at Wooho (raoy.com, mejc.com, etc.) are not responding right now. I wonder if Wooho is doing something about this or if they're just having technical difficulties.

The "modus operandi" for these scammers is the usual: design a professionally looking site (probably by just stealing the layout from an honest site), list products that are not readily available (cheap medicine, fake watches, sex toys) due to grey market concerns, charge about half the price of regular grey market items, and PROFIT! I wouldn't be surprised to hear that the credit card charges point back to India or China even if the site is in English. That makes it a lot more difficult for credit card companies to get their money back. Of course customers should get their chargeback even if the CC company never seems a dime back from these scammers.

What really made me mad about these guys this time is that they spammed _all_ of the GNU mailing lists (glibc, a2ps, smalltalk, chess, etc.). Do they _really_ think that Free Software / Open Source people fall for this kind of scam? I'd think that their 0.01% sales over advertisement must come from people who are using the Net for the first time or something like that. I mean, they don't even post contact information on the site. Or list a company name. It's just a pretty site with _no credentials_ whatsoever.

So there you go, same gang, new site, beware.

Updated: [6-Feb-05] Added repllca.com.

Posted by jdrowell at 10:25 PM | Comments (23)

January 10, 2005

simply-rx.com sucks!

simply-rx.com is the first entry in my new category, "This Sucks!". Everyone knows that I just _hate_ spam (uh, I said the "H" word, sue me!), and some spammers are just a lot more annoying than others. So to the proud owner of simply-rx.com, let me just say: YOU SUCK!

It's impossible to know for sure if any of the information collected by registars about the domains they get paid to register is true, but for whatever it's worth, here's some interesting info.

simply-rx.com

::Registrant::

Name      : Francisco Sneed
Email     : admin@simply-rx.com
Address   : La Mina No. 55, Cantabria
Zipcode   : 39478
Nation    : ES
Tel       : +34-942589889

This guy apparently hires some teenage punk to send all different kinds of spam using various methods. These spam messages point to bogus domains, which redirect (and presumably even account for - wow, spam affiliates!!!) back to simply-rx.com. Here are some of these bogus domains:

iazy.com
domain:       iazy.com
status:       lock
owner:        Mohammad Khan
email:        admin@taiwanmedialtd.com
address:      Kizilelma Caddesi No
address:      Findikzade
city:         Istanbul

Try visiting "http://Mohammad-eats-shit-for-breakfast.iazy.com" to see where you end up :)

Domain Name: NEATA.COM
Domain Status: LOCK
Registrar: Wooho T&C Co., Ltd. d/b/a RGNames.com
Referral URL: http://www.RGNames.com

Domain Registration Date....: 2004-11-04 GMT.
Domain Expiration Date......: 2005-11-04 GMT.
Domain Last Updated Date....: 2004-12-24 08:23:40 GMT.

Registrant:
    bee aa
    588, Seocho-dong, Seocho-gu
    Seoul,  137070
    KR

Surely "Bee Aa" is a real name!

Domain Name: KEEJ.COM
Domain Status: LOCK
Registrar: Wooho T&C Co., Ltd. d/b/a RGNames.com
Referral URL: http://www.RGNames.com

Domain Registration Date....: 2004-11-04 GMT.
Domain Expiration Date......: 2005-11-04 GMT.
Domain Last Updated Date....: 2004-12-24 08:23:40 GMT.

Registrant:
    bee aa
    588, Seocho-dong, Seocho-gu
    Seoul,  137070
    KR

Wooho corporation was really busy on Nov-11-04 :D. Goes to show that this information is pretty recent. I'm sure there are hundreds of others. Maybe spamhaus already has a lead on this guy, I surely hope so.

Feel free to block all the domains listed above, there's no chance in hell you'll ever get any legitimate email from them.

Peace.

Edited on 2005-01-13: Removed links, to prevent simply-rx from increasing its PageRank™. Duh! :P

Posted by jdrowell at 09:44 AM | Comments (84)