WOMC: Word of Mouth Connection Scam…
I keep getting these stupid scam/spam emails that say:
Someone has just begun to research your background via our website. This email has been automatically sent to you so as to make you aware that your background is being looked into. The popularity of our website is currently growing at a very rapid rate. If another person begins to research you in the future we will again inform you via email.
Then the Word-Of-Mouth email (sent by their Report Awareness System, aka Connection Awareness System) supplies a link to click on that sends you to a page that says that someone who knows you “very well” has, and is willing to share, information about you with others. To send an anonymous email to this nonexisting person to find out whatever the heck they are supposed to be saying about you, you must fork over a minimum of $19.97 for a one-year subscription to the WOM Connection, or $29.97 for a two-year subscription.
Please, DO NOT fall for this scam! It’s bûllšhìt!
Number Nine in the New York State Consumer Protection Board’s list of the Top Ten Internet headaches is scam websites. The CPB specifically mentions that “all types of scams are attempted on the Internet, including a relatively new website called Word-of-Mouth.org. This website, registered to a company in the Philippines, claims people can file gossip about someone they know using that person’s e-mail address to identify them. Now Word-of-Mouth is sending e-mail messages to try to get people to spend $19.97 to see the gossip that allegedly has been filed about them. CURE: Hit the delete button when you receive this e-mail.”
Some vital information:
- The womc.info domain is registered to Peter Kestler located in Davao City, The Phillipines.
- Other domains include word-of-mouth-connection.com, wordofmouthconnection.com, word-of-mouth.org, womc.net, and wordofmouthconnections.info. There are probably many more.
- Womc.info is hosted in Las Vegas by A+Hosting.
- Word-of-Mouth is listed on the well-known website that exposes frauds and scams, snopes.com. According to snopes, “nobody needs to pay $20 to find out nothing.”
- The WOMC site is “in compliance with all United States laws.” Yet the legal section of the website states that “WordofMouthConnection.com, however, is not covered by any of these laws.”
- The site’s “users are anonymous.” Yet “we cannot ensure that all of your private communications and other personally identifiable information will never be disclosed.”
- Word-of-Mouth claims that “there are no U.S. federal laws governing spam.” They also say that they do not send spam, although they “send an initial unsolicited email”, which they claim is not spam in that there is no commercial aspect. Apparently they are trying to convince you that offering subscriptions to “an online community” is not a commercial endeavor.
- The testimonials are most likely fake. “I searched for Word-of-Mouth Connections on our nanny and was reassured because I found no Word-of-Mouth Connections.” Or what about “I was aghast at the stories [my girlfriend's ex's] told me about her lying, unfaithfulness, and past drug and mental problems. As a result of their input I decided to break off the relationship. WordofMouthConnection.com saved me!” Puuuuhlease!
- The last sentence on their legal page cracks me up the most! WOMC claims that their spam email “is not bulk mail because it is directed at one specific individual.” That’s about as dumb as it gets! All the spam I get is obviously directed to one person, me. That’s why I get it. If it wasn’t directly to me, I wouldn’t get any spam at all!
Do not send $20! Do not click the link! Go directly to the delete button!
UPDATE: I received another one of these emails on 1/12 from womexch.org - RDL
UPDATE: I’ve received dozens more of these emails, most of which I deleted immediately. Now I’m looking at them a bit closer. I received one on 2/7. It was from 209.25.171.75 (peter.wominfo.info), a server hosted at Maxim Computer Systems in Fremont, CA. Next one on 2/8 was from 207.36.180.23 (support.wordofmouthreports.com and peter1.wordofmouthconnections.com), a server at CyberGate/ValueWeb in Ft. Lauderdale, FL. Both directed potential visitors to a URL on s.wominfo.info (peter1.word-of-mouth-connection.com), hosted by A+Hosting/Premia Networks in Las Vegas, NV. This guy is sure spreading it around! Pun intended…
UPDATE: I got another one on 2/8! Sheesh! This one from 216.65.117.86 (support.wordofmouthconnections.net hosted by Maxim/HostCentric in Fremont) directing users to a page on womc.info (64.235.50.54, the same peter1.word-of-mouth-connection.com site hosted in Las Vegas listed above).
UPDATE: Another one on 2/16. From “WOMC SUPPORT” with email address notify.sys@wordofmouthreports.info, title is “Background research being performed on you.” Offending mail server is support.wordofmouthreports.info (207.36.180.112) hosted at CyberGate/ValueWeb in Ft. Lauderdale, FL. Directs (again!) to womc.info (64.235.50.54, hosted in Las Vegas). The marketing pitch on this one was “Someone is looking for people who know you and have experiences and/or opinions to share about you via our website.”
This word of mouth loser has been around for ages. I’m blocking him at these domains:
Word-of-Mouth.Org 550 SPAMMER Email refused since Tue Aug 5 10:29:14 EDT 2003
wordofmouthconnection.com 550 SPAMMER Email refused since Wed Aug 20 08:13:53 EDT 2003
WORDOFMOUTHREPORTS.ORG 550 SPAMMER Email refused since Thu Aug 28 07:34:15 EDT 2003
WORDOFMOUTHCONNECTION.ORG 550 SPAMMER Email refused since Fri Sep 12 07:47:25 EDT 2003
word-of-mouthconnection.org 550 SPAMMER Email refused since Thu Sep 25 10:07:05 EDT 2003
wordofmouthconnection.net 550 SPAMMER Email refused since Sun Sep 28 01:29:44 EDT 2003
Word-of-Mouth-Connection.com 550 SPAMMER Email refused since Sun Sep 28 01:31:35 EDT 2003
Word-of-Mouth-Connection.net 550 SPAMMER Email refused since Sun Sep 28 01:31:45 EDT 2003
wordofmouthinfo.info 550 SPAMMER Email refused since Mon Dec 8 09:04:02 EST 2003
womc.info 550 SPAMMER Email refused since Mon Dec 8 09:04:06 EST 2003
wordofmouthconnection.info 550 SPAMMER Email refused since Tue Dec 23 10:50:12 EST 2003
womc.net 550 SPAMMER Email refused since Sun Sep 28 01:31:17 EDT 2003
womexch.info 550 SPAMMER Email refused since Wed Dec 31 09:37:01 EST 2003
I’ve had these scam artists send me email for a while as well. They keep changing their domain, their userids, etc., so efforts to block them prove to be an ongoing effort. Thanks for your list of domains….The one I got today was from peter.womexch.net (66.132.172.236)
This where mine came from
From: WOMC SUPPORT
Raw Source From awareness_support@wordofmouthconnection.net Wed Jan 21 10:59:49 2004
Return-Path: Received: from peter.wordofmouthconnection.net (66.132.144.86)
by mail19a.dulles19-verio.com (RS ver 1.0.88vs) with SMTP id 3-0428724138
for ; Wed, 21 Jan 2004 11:55:43 -0500 (EST)
Received: (qmail 20537 invoked by uid 48); 21 Jan 2004 13:49:34 -0000
Date: 21 Jan 2004 13:49:34 -0000 Message-ID:
To: olwen@creativebackup.com
Subject: A user is researching you at our website.
From: WOMC SUPPORT
X-Loop-Detect:1 Status:
I was not using my brain and paid the $19.95. About five minutes after paying them, I did a Google search. Then I saw all information alleging that this site was nothing but a scam. So, I wrote them back asking for a refund pointing them to eWeek article and the press release from the NY State Consumer Protection Board. They replied this site is not scam. Nothing about my refund. I wrote a few more times and then they wrote that they provided the service as promised and would not refund my money. Then I did a little research on California Law, which applies to any company selling over the Internet to customers in California. It states that before doing business they must have a return and refund policy and the street address where they conduct business. The disclosure must be made either on the website or via email. They do have a one sentence refund policy, but they do not state their address. So I sent them text of the law and demanded their address. They wrote back and told me they were going to refund my money. They did not provide me with their address. However, I think that the guy behind this site lives in Alameda County in California. On my Visa statement it reads WORDOFMOUTHCONNECT 510-499-6732. This is a Pacific Bell Mobile phone number out of Oakland: Main-Piedmont. I called the number, however it automatically takes you to voicemail. The message is a man’s voice; he says something like Hi, leave a message and I will get back to you. I also did a DBA search in Alameda County. I came a across a company Business Name Word of Mouth, Inc, Owner Word of Mouth, Inc., Date Filed 10/27/2003, document number 339495. I also came across the whois info for wordofmouthconnections.info. This is the current whois info:
Domain ID:D2767522-LRMS
Domain Name:WORDOFMOUTHCONNECTIONS.INFO
Created On:03-Aug-2003 02:36:37 UTC
Last Updated On:13-Dec-2003 06:58:56
UTC Expiration Date:03-Aug-2004 02:36:37
UTC Sponsoring Registrar:R139-LRMS
Status:ACTIVE Status:OK
Registrant ID:C3477158-LRMS
Registrant Name:PETER KESTLER
Registrant Organization:WORD-OF-MOUTH LLP
Registrant Street1:SIVERANO MIRABUENO
Registrant Street2:STO NINO VILLLAGE
Registrant Street3:UPPER PEIDAD, TORIL
Registrant City:DAVAO CITY
Registrant State/Province:DAVAO DEL NORTE
Registrant Postal Code:8000
Registrant Country:PH
Registrant Phone:+6.39185653118
Registrant Email:SUPPORT@WORDOFMOUTHCONNECTION.COM
Admin ID:C3477158-LRMS
Admin Name:PETER KESTLER
Admin Organization:WORD-OF-MOUTH LLP
Admin Street1:SIVERANO MIRABUENO
Admin Street2:STO NINO VILLLAGE
Admin Street3:UPPER PEIDAD, TORIL
Admin City:DAVAO CITY
Admin State/Province:DAVAO DEL NORTE
Admin Postal Code:8000
Admin Country:PH
Admin Phone:+6.39185653118
Admin Email:SUPPORT@WORDOFMOUTHCONNECTION.COM
Billing ID:C3477158-LRMS
Billing Name:PETER KESTLER
Billing Organization:WORD-OF-MOUTH LLP
Billing Street1:SIVERANO MIRABUENO
Billing Street2:STO NINO VILLLAGE
Billing Street3:UPPER PEIDAD, TORIL
Billing City:DAVAO CITY
Billing State/Province:DAVAO DEL NORTE
Billing Postal Code:8000
Billing Country:PH
Billing Phone:+6.39185653118
Billing Email:SUPPORT@WORDOFMOUTHCONNECTION.COM
Tech ID:C3477158-LRMS
Tech Name:PETER KESTLER
Tech Organization:WORD-OF-MOUTH LLP
Tech Street1:SIVERANO MIRABUENO
Tech Street2:STO NINO VILLLAGE
Tech Street3:UPPER PEIDAD, TORIL
Tech City:DAVAO CITY
Tech State/Province:DAVAO DEL NORTE
Tech Postal Code:8000
Tech Country:PH
Tech Phone:+6.39185653118
Tech Email:SUPPORT@WORDOFMOUTHCONNECTION.COM
Name Server:NS1.WOMC.NET
Name Server:NS2.WOMC.NET
However, using google I was able the locate the old whois information on this site.
Domain Name: WORD-OF-MOUTH-CONNECTION.COM
Registrar: TUCOWS, INC.
Whois Server: whois.opensrs.net
Referral
Name Server: NS1.WORDOFMOUTHREPORTS.COM
Name Server: NS2.WORDOFMOUTHREPORTS.COM
Status: ACTIVE
Updated Date: 25-aug-2003
Creation Date: 25-aug-2003
Expiration Date: 25-aug-2004
Domain ID:D2767522-LRMS
Domain Name:WORDOFMOUTHCONNECTIONS.INFO
Created On:03-Aug-2003 02:36:37 UTC
Last Updated On:31-Aug-2003 06:18:08 UTC
Expiration Date:03-Aug-2004 02:36:37 UTC
Sponsoring Registrar:R139-LRMS
Status:ACTIVE Status:OK
Registrant ID:C3477157-LRMS
Registrant Name:KRISTIAN PADBORG
Registrant Organization:WORD-OF-MOUTH LLP
Registrant Street1:1231 40TH ST
Registrant Street2:SUITE 329
Registrant City:EMERYVILLE
Registrant State/Province:CA
Registrant Postal Code:94608
Registrant Country:US
Registrant Phone:+1.5103931276
Registrant Email:KPADBORG@ATTGLOBAL.NET
Admin ID:C3477158-LRMS
Admin Name:PETER KESTLER
Admin Organization:WORD-OF-MOUTH LLP
Admin Street1:SIVERANO MIRABUENO
Admin Street2:STO NINO VILLLAGE
Admin Street3:UPPER PEIDAD, TORIL
Admin City:DAVAO CITY
Admin State/Province:DAVAO DEL NORTE
Admin Postal Code:8000
Admin Country:PH
Admin Phone:+6.39185653118
Admin Email:WORD-OF-MOUTH.ORG@ATTGLOBAL.NET
Billing ID:C3477159-LRMS
Billing Name:PETER KESTLER
Billing Organization:WORD-OF-MOUTH LLP
Billing Street1:SIVERANO MIRABUENO
Billing Street2:STO NINO VILLLAGE
Billing Street3:UPPER PEIDAD, TORIL
Billing City:DAVAO CITY
Billing State/Province:DAVAO DEL NORTE
Billing Postal Code:8000
Billing Country:PH
Billing Phone:+6.39185653118
Billing Email:WORD-OF-MOUTH.ORG@ATTGLOBAL.NET
Tech ID:C3477160-LRMS
Tech Name:PETER KESTLER
Tech Organization:WORD-OF-MOUTH LLP
Tech Street1:SIVERANO MIRABUENO
Tech Street2:STO NINO VILLLAGE
Tech Street3:UPPER PEIDAD, TORIL
Tech City:DAVAO CITY
Tech State/Province:DAVAO DEL NORTE
Tech Postal Code:8000 Tech Country:PH
Tech Phone:+6.39185653118
Tech Email:WORD-OF-MOUTH.ORG@ATTGLOBAL.NET
Name Server:NS2.WORDOFMOUTHREPORTS.COM
Name Server:NS1.WORDOFMOUTHREPORTS.COM
Note the address name Kristian Padborg whose address in in Emeryville, CA, which happens to be located in Alameda County. So could this be the man behind the wordofmouth? So, in summary there is a business DBA Word of Mouth Inc. in Alameda County, CA. There is a wordofmouthconnection phone number 510-499-6732 again originating from Alameda County, CA. We have the following whois information. Kristian Padborg Word-of-Mouth LLP (Similar to Word of Mouth, Inc) 1231 40th St Suite 329 Emeryville, CA 94608 KPADBORG@ATTGLOBAL.NET Phone: 510-393-1276 (this is a Sprint PCS Mobile Number) Again Emeryville is located in Alameda County. I also have the following email address for Kristian: k.padborg@earthlink.net and have the following wordofmouth support email address: womc_support@earthlink.net. I also tried doing a search on Patent information for wordofmouthconnection.com did not have any luck. Maybe, someone else could try.
Thanks for the 411. My gut instinct was that this is a scam, but still, as a contractor I was concerned that someone could be spreading gossip about me. Lucky for me I found Richard’s Rambling’s. Max if you get your refund I’d like to know. Its a pretty good scam. Even though I was 90% sure (before finding this site) that it was playing me, I almost bit. Max is obviousely a pretty sharp guy and he fell for it (Sorry Max). I bet this guy is making a mint. Hopefully the new spam laws will shut him down. It sucks to have a conscience. There no doubt this is a lucritive venture if you dont have any scrupples. Thanks for the info.
I almost bit the first time I saw it, too. I got the first WOMC email at the time that I was being cyberstalked and cyberharassed by someone last year who spent all her free time posting my private information (including a series of hateful lies) all over the Internet. When I saw the WOMC, I almost assumed that it was another place she had spammed. Fortunately, I did my homework BEFORE signing up. - RDL
Just wanted to say thanks for posting this info on the web - it was the first thing I found regarding this scam and I’m glad I read your website so that I didn’t fall for it - keep up the great work!
Dont click on the link, whatever you do, if you do, they’ll keep spamming you about “background checks” or whatever. I hope he tries this on some california lawyer or something, that’d be great to see. Just dont click on the link or they’ll continue to spam you and they change their domain quite often so putting them on your block list is pretty ineffective.
WHOA, this website is getting alot of attention. FYI: It is well-known from over a year ago, that the mastermind behind this website is a man by the name of Richard Garfield out of the Philippines. I know this website from a while back and there was a private investigator who looked into this and posted his findings online. Apparently, Mr. Garfield is trying to hide his identity through the use of several aliases. By the way, I can’t say that I particularly like this website myself, but I cannot see any evidence that it is a scam as so many suggest here.
No evidence of a scam? Have you read this site and others? New York State Press Release, eWeek Article, Channel 5 Boston
Some other clues: Customer service number is a Pac Bell Cell Phone out of Alameda, California. WordofMouthConnection.com is in violation of California State law by not providing the address on their webiste or via email.
I was so freaked out. I started to research their site and couldn’t find much more information without paying for it. I even setup an account to back into the type of information someone could be searching for and then added a connection that I had information on my e-mail address. I noticed that the first e-mail came from a notification.system@wordofmouthreports.com and the second notice (from me) was from notification.department@wordofmouthconnection.info. This got me thinking that maybe it was a scam and after doing a search on Google and found there were dozens of others just like me who were also freaked and threatened by the e-mail I felt it was my duty to also add some input on the subject. I will probably file a complaint with the Federal Trade Commission because I believe that is an infringement on my privacy. Ok, I’ve vented. [Interesting that I can not find any online complaints that reference a "notification.department" email address, but countless that refer to "notification.system". - RDL]
Max- You sure do seem to be spending a lot of time defaming these guys from wordofmouth. I wonder why you spend so much time? You probably just think that you can get some money out of them through a lawsuit of [sic] something. Anyway, those are interesting articles you have collected. Sorry to point it out though, the assertions made that the site is a scam have absolutely no basis in fact. There is not one piece of evidence. Only pure assertion and some of the arguements [sic] are downright specious. [Defamation is "an intentional false communication" and I do not believe that anyone here making comments against WOMC is making them intentionally false. I publicly challenge the operator of the WOMC website to grant me full free nondestructive (read-only) access to any and all his web and development servers and applications in order to ferret out the truth. I would even honor and sign both a non-compete agreement and a confidentiality agreement specific to the source code and any proprietary information. Per the agreement, the only information I would be allowed to publish or disclose would be related to architecture and methodology, as well as forensic data of specific test cases of my choosing. - RDL]
thanks andrea, or should I say PETER KESTLER
Andrea- No need for me to defame the persons at WordofMouthConnection.com. It has already been done. A quick search on Google you’ll find WordofMouthConnection.com together with the words “Fraud”, “Scam”, and “Buyer Beware”. Could so many people be wrong? Also, I admit that I spend way to much time on this subject. Hey, but it is worth it. Some people are freaked out by these emails! This is sad especially if these emails are bogus. I myself am searching for my biological parents. After receiving the WordofMouth emails, I thought could this be my parents trying to contact me? So, I signed up. I had 5 connections, I contacted all of them multiple times through the anonymous system. I have yet to receive one reply and several weeks have passed. Also, I noted that all the connections state they had recent contact with me. However, the email they used is an email I have not used in over an year and will soon expire. Plus, only my friends and family would have this old email and there would be no need for them to contact me anonymously. I think your right about the Website there does not seem to be anyting illegal about the site. However, I think you should sign up for the service. I myself have a Power User Account and a regular user account. I did a little experiment. About a week ago using my Power User Account I made 2 email connections. In theory I should have received emails to these accounts from WordofMouth that someone was looking into my background. I have yet to receive such emails. I did however receive emails from WordofMouth confirming that these emails were sent. I just tried it out again yesterday, this time using regular account and my Power User account. I created 4 connections with each account with 4 differnt email accounts with 3 differnt domains. I got 8 confirmations saying that these emails had been sent. Well, folks I have yet to receive one email stating that someone was looking into my background. Very Curious! Also, the confirmation emails come directly from A+Hosting of Las Vegas. This company hosts WordofMouthConnectio.com I ask you, should not these supposed emails that people are getting about persons researching their background also originate from the A+Hosting. In fact they do not, they originate from places like Pacfic Bell, CyberGate Inc., and Dialtone Inc. Why keep changing companies? Could be they are violating these companies use policies by sending out SPAM? I was examining one to the WordofMouthConnection emails that was posted on the net.
Folks if you plug in the originating IP 68.124.55.146 into the ARIN WHOIS Database you get:
Search results for: ! NET-68-124-55-144-1
CustName: Knud H Padborg
Address: 268 Bush St. #5000
City: San Francisco
StateProv: CA PostalCode: 94104
Country: US
RegDate: 2003-10-09
Updated: 2003-10-09
Gee, could this be any relation toKristian Padborg. As, you know Kristian was listed as a registrant of the domain name WORDOFMOUTHCONNECTIONS.INFO. This information has changed but can still be easily found on the Internet with Google. So, as of January 16th there is still an association between Padborg and WordofMouthConnection.com.
Don’t forget about the email address womipaypal@sbcglobal.net. Also WOMC is now using Authorize.net for payment processing on their website (with the merchant login ID of “pureimmers7994″)
Also, a suspicious person might notice that Andrea’s ISP changes from Pac Bell DSL in Pleasanton (coincidentally in Alameda County) to a Level 3 Communications dialup in San Francisco. That same suspicious person might make the connection that the first IP address Andrea uses to make a comment on my ramblings is an IP address associated with a “Yasuo Monno”, who has a Japanese first name not uncommon in the Philippines, AND is the same IP adress used to spam the above WOMC message to Max… - RDL
You’ve confused me, Max. Just about everything you include in your note argues very strongly against WOMC, yet in your 3rd paragraph: “However, I think you should sign up for the service. I myself have a Power User Account and a regular user account.” Huh?
My guess is that it’s for testing purposes. I, myself, “signed” up for the useless Power User account for free, utilizing a flaw introduced by the website creator’s abysmally poor coding. Because the website uses the popular authorize.net for merchant transactions AND because any real web developer knows how to submit authorized test requests to the authorize.net service AND the scam website creator has no idea how to create a secure application, I now have a Power User account as a result of simply submitting a test request! Apart from the reassuring message that I am “A Power User”, there appears to be no real benefit. Of course, I’m not about to put in my real email address so that I can get spammed some more… - RDL
I say that these scam artists should be strung up, thank you for having this page of sanity on the net.
Sean- No one should sign up for this service, the sign-up comment was directed towards Andrea who felt there was nothing illegal about the service. Also, RDL was asking about the California law. California Business & Professions Code Section 17538, places several regulations on businesses advertising and making sales over the Internet or other electronic means of communication. Section 17538(d) states that in any transaction involving a buyer located in California, a vendor, before accepting any payment, must disclose to the buyer in writing or by electronic communication (e.g. e-mail or on-screen notice): (1) the vendor’s return and refund policy; (2) the legal name of the vendor; and (3) the complete street address from which the vendor’s business is conducted. Another provision governs the means for disclosing the vendor’s legal name and address by on-screen notice. Try requesting this information from WordofMouthConnnection.com.
I myself have received 3 of these emails! I also responded by email stating how appauled I was that this info could be shared without my permission. I received an email back stating….nothing different from the first. This was about 2 weeks ago. I have been having extreme difficulties with my boss and thought it could be him researching me. I almost paid the $$ to find out for sure. I’m SOOOO glad your website was here to inform me first. Thankyou
Visit google.com and search for word of mouth scam. They are paying per click for advertising on google. If you look to the right of the screen once you have searched you will see a blue box that states “wordofmouthconnection.com” make sure that the link below it is: wordofmouthconnection.com CLICK ON IT! They will have to pay for your click! They want to send out all of this çráp, make them pay for it.
Thought this was interesting: Andea does in fact = Word Of Mouth Inc. I [received] an email recently originating from this service [from] adsl-68-124-72-228.dsl.pltn13.pacbell.net [68.124.72.228]. Notice the IP address? Look familiar? It is because it is the same IP used by “Andrea” in her first message [above] on January 27, 2004 01:14 PM” ARIN WHOIS: Yasuo Monno SBC068124072224031009 Thought this was interesting, ALL SHOULD KNOW ANDREA IS WOMC INC. Oh and btw thank you for posting this site!
Can I cost them multiple nickels if I click the Google link repeatedly? Click - back - click - back - click doesn’t take that much time. I’d be happy to hit them for a dollar everytime I’ve got a bored minute….
Thank you, Richard D. LeCour, for this entry in your blog. It showed up very high on the list when I searched for word-of-mouth-connection.com after receiving one of their scam e-mails. Plus five karma for the public service you have provided.
Good information!! Be careful too … seems that the e-mail address that they began to send these SPAMS to, may have come from Monster.com!! I also wrote the admin indicating that they are onto something .. so may will pay the $20 and get nothing!
I stupidly stupidly paid the $19.95 today to find out who had information on me after receiving one of these emails. I have been stalked on the internet for over four years and I was notified today that someone had “requested” information on me (after being told a year ago that someone had “filed” information on me). So I bit. After I got home from shopping, I decided to search on this company and found your site and the SNOPES info and realized how stupid I’d been. I called my credit card company to do a chargeback explaining that I’d fallen victim to an internet scam and I immediately canceled my credit card account and am awaiting a new card and number.
This is a website aimed at people who are weekend by normal internet harrassment or who are in fear of such. Unfortunately it is the nature of our society that we should fear and believe that someone may be spreading rumors about us and therefor defaming us online. That being said I cannot judge someone for wishing to capitolize on this weekness as that it is all you can do in this day in age. On the other hand I do not believe in spam as a freedom, nor do I feel that I need to open my box daily and see that people are supposedly talking about me online. Hëll I’m a member of Livejournal, I get enough gossip through there to cover my need for drama. anyway, reading these comments it just often makes me wonder why no one attacks the spammers in the way they attack us. Bombard their mail servers, spoof their sites, etc? I know these are unethical approaches but no less ethical than telling someone that someone is researching their background, when that person may be being stalked, lookign for their parents, or even applying for a job in a knowledge-specific industry. Just my thoughts.
Minor interesting note on googling for “word of mouth scam”. Not only did they apparently by the AdWords specifically with “scam” in them, they also require the “of” (a word google specifically says is too common and does not get included in searches). “word mouth” doesn’t get their link.
If you have been receiving spam originating from PacBell ip address(s) owned by Knud H. Padborg Search results for: ! NET-68-124-55-144-1 CustName: Knud H Padborg Address: 268 Bush St. #5000 City: San Francisco StateProv: CA PostalCode: 94104 Country: US RegDate: 2003-10-09 Updated: 2003-10-09 NetRange: 68.124.55.144 - 68.124.55.151 You can send this guy a demand letter asking for money against violating Spam laws. Your next step would be to bring him to Small Claims Court. From AnyWho.com Padborg, Knud H 1614 S Patton Ave San Pedro, CA 90731-3842 (310) 547-9345 From People Finder KNUD H PADBORG Age 66 1614 S PATTON AVE SAN PEDRO, CA 90731 (310) 5479345 KRISTIAN PADBORG Age 34 SAN DIEGO, CA 92138 (858)560 0661
I received one of these ‘alerts’ last week, and investigated the site - not by clicking on a blind link, but by typing the URL into my browser. The first sign of a distinctly fishy odor was that the ‘have information’ links purport to be from a co-worker or someone who ‘knows me well.’ Why would any friend or responsible coworker put your information up to anonymous requests? The second sign is that you can only make an inquiry of these people by spending $19.95 for their Power User account. I thought about firing off a comment on their feedback form, but I determined this was a waste of time, and the concept is a sham. The final sign that this is a scam is the magically changing domain: word-of-mouth-connection to word-of-mouth-info … both offering essentially the same services and the same sales babble as justification. Big hint, people - an employer sure as heck isn’t going to be looking for word-of-mouth via anonymous remailers for hiring recommendations. Might as well consult your Magic 8-Ball.
Hey I just wanted to say thank you to Richard??? (the owner of this website!) I received this email for the first time, and I was totally freaked out!!! Until I searched Google, and found your website! I sent a nasty comment to the website!!! Anyway Thanks!
Have you contacted your credit card company about a refund? You should be able to get the money back based on the site not posting their policies in writing along with the countless posts about the site being a scam. I would definately challenge it; most card companies don’t mind helping out the card holder.
A whie back I was also alerted that there was a connection to me listed (which I was very concerned about,and to a point still am since I had a major fallout with a few ex-roomates last year.) Of course, when I protested the monetary shakedown their response was only “people can do this” yada,yada…..now after reading all of this, I can feel better that I didn’t give a red dime to these scam artists…
This is an old scam- and still at it. They have changed their name, and look, slightly, but it’s the same çráp. I just looked for my e-mail address and there are 5 reports on me. O dear. The end of December- someone is “looking for information?” a few days later, someone writes in they have info on me. Then, a few days later, someone new is looking for info, and a few days later, somoen else is offering info? Who are these people? I don’t know? What kind of relationship do they have with me? Usually it’s “social” or they “decline to state”. Not one person says they are a friend, relative, fellow employee, etc. People- wake up- it’s all a lie, it’s all a ripoff. I have simply blocked this jerk from e-mailing me anything. So, tell him to take a hike, I will use my $20 to go see a movie.
Well this is all just about $20 too late for me. I guess I can feel better and that it was only $20, but I did try the test. (Make a connection to me, different email addy, etc) And lo and behold, never EVER got a message saying that someone was investigating me… Do you think the black hats that always hit micro$oft could hit these folks instead…
Update: A week after deleting my email account (Hey, it was just for the use of a job seek any way… I know I heard that thismight have supurred from a monster harvest) All of a sudden tonight, I think 3 days after removing the account, all of the connections are now gone. All of a sudden no one wants my information or to share information about me because that email is gone… *sigh* what ever shall I do!
Hi all, I just received one of these. Thanks for all the info! I knew it was a scam! I clicked on their ad as you suggested, not the link in my email. They have a spot to remove your email address, is that a good idea, or does it just get you more spam? I love the idea of clicking on their ad to MAKE THEM PAY! I have already done it a few times bringing up a new Explorer each time instead of click, back, click (I’ll try that too!)In fact it should be pretty easy to create an automated process using software that captures your mouse clicks… even if they check ip addresses you could incorporate an ipconfig/release and renew to change your ip address each time! Imagine if all the pìššëd off people created a little process to click their ad 1000’s of times each night while they slept!
Womc aka word of mouth connection and the various other names they use are a spam. I have recieved several of these emails from them. I went to their web site. When I did a search using a junkmail email address, there were several entries claiming to have information of an unspecified nature from people purporting to know me well. However when I did a search typing in my name there were no entries. How can this be someone who allegedly knows me well does not know my name but only a junkmail email address.
I did the same thing- my e-mail address is there, but not my name. By the way, I checked back recently- suddenly the 5 links from people who know me well are gone, today there is only one, and it’s dated yesterday (2/13/2004). Gee, I just seem to come and go from this website.
Richard, thanks very much. I’ve been doing internet date searching and for five minutes really thought I was being researched. Fortunately my brother told me he thought it was a scam. I did create a new email account and put in a thing myself to see what happens. Based on what I’ve seen here I won’t worry about it. Again THANKS!
I just received one of these emails, which got me wondering just how bad an anonymous rumor could be, but I was extra wary since the message was targetted at an email address which I only use for DNS registrations. A quick web search found this site, thanks folks. The message came from a machine (HELO knud) which is on a subnet (68.124.55.144/29) allocated to: CustName: SBC Private Customer Address: 268 Bush St. Address: Suite 5000 City: San Francisco StateProv: CA PostalCode: 94104 Country: US RegDate: 2003-10-09 Updated: 2004-02-02 Notice how he’s now anonymous. FWIW, here’s the interesting part of the mail headers: —snip— Return-Path: <notification.sys@word-of-mouthconnection.net> Delivered-To: xxx@xxxxxxx.xxx Received: (qmail 9927 invoked from network); 16 Feb 2004 23:34:57 -0000 Received: from adsl-68-124-55-148.dsl.irvnca.pacbell.net (HELO knud) (68.124.55.148) by xxxxxx.xxxx.xxx with SMTP; 16 Feb 2004 23:34:57 -0000 Received: from henning ([127.0.0.1]) by knud with Microsoft SMTPSVC(5.0.2195.6713); Mon, 16 Feb 2004 15:21:24 -0800 Date: Mon, 16 Feb 2004 15:21:24 -0800 From: notification.sys@word-of-mouthconnection.net Subject: A user is researching your background To: xxxxxx@xxxxxxx.xxx Return-Path: notification.sys@word-of-mouthconnection.net Message-ID: <HENNINGVAE377eBZTi200025ed3@knud> X-OriginalArrivalTime: 16 Feb 2004 23:21:24.0759 (UTC) FILETIME=[985E8270:01C3F4E3] —snip— One other snippet: the domain’s name servers, ns1.womc.net (64.235.50.54) and ns2.womc.net (64.235.50.55) are apparently hosted by A+Hosting in Las Vegas, who actually have a real human to complain to: http://ws.arin.net/cgi-bin/whois.pl?queryinput=P%20!%20PN269-ARIN
More information on this scam from the Attorney General’s office: Thank you for contacting the Federal Citizen Information Center. The U.S. Department of Justice, Civil Rights Division, is the primary institution within the Federal government that enforces Federal statutes prohibiting discrimination on the basis of race, sex, disability, religion, or national origin. At its website you will find links to information discussing civil rights and liberties issues, including a list of frequently asked questions and instructions on how to file a discrimination complaint. To learn more, please visit: http://www.usdoj.gov/civilliberties.htm The Civil Rights Division is broken down into sections, each having its own contact information. For a list of those sections, their responsibilities, and a link to their contact page, please visit: http://www.usdoj.gov/crt/mgmtndx.htm. In general, the address you should mail your complaint to is: U.S. Department of Justice, Office of Civil Rights, (Name of Section), 950 Pennsylvania Ave. NW., Washington, DC 20530. If you have questions or would like to talk with a representative of the Civil Rights Division, you can use the following contact information: U.S. Department of Justice, Office of the Assistant Attorney General, Civil Rights Division, 950 Pennsylvania Ave. NW., Washington, DC 20530, Telephone: 1-202-514-2151, Fax: 1-202-514-0293 We also believe your inquiry may be best addressed by an attorney; the staff in our office is not qualified to give legal advice. While there is no Federal agency that provides private legal assistance, the Legal Services Corporation does fund locally based legal aid services to persons in financial need. If you would like to obtain information on the Legal Services Corporation program nearest you, please specify your state and county of residence at: http://www.rin.lsc.gov/rinboard/rguide/pdir1.htm. Should you need to contact the Legal Services Corporation headquarters directly, you may do so by calling 1-202-295-1500 or by writing to: Legal Services Corporation, 750 First St. NE., 10th Fl., Washington, DC 20002-4250, Fax: 1-202-337-6797, Email: info@lsc.gov. You may also access the online request form at: http://www.lsc.gov/contact.asp. If you are not eligible for legal assistance through the Legal Services Corporation, then you may obtain a lawyer referral from the appropriate state bar association. For a directory of state bar associations and their contact information, please visit the link that follows: http://www.usccr.gov/filing/flndx.htm The best source for information on how to report Internet related issues, including viruses, is found at the U.S. Department of Justice Computer Crime and Intellectual Property Section webpage entitled “How to Report Internet-Related Crime.” You may wish to view this information in case some of it applies to your situation. This comprehensive webpage provides access to a large number of agencies where you may report your information based on the type of occurrence. To access this information, please visit: http://www.cybercrime.gov/reporting.htm. If you would like to access information about privacy from the Federal Trade Commission, please visit: http://www.ftc.gov/privacy/index.html We hope you find this information helpful. Regards, Federal Citizen Information Center If you have any further questions about the government, please do not hesitate to call our National Contact Center at 1-800-FED-INFO (1-800-333-4636), Monday through Friday from 8 a.m. to 8 p.m. eastern time, or send us another message through our webform at: http://www.firstgov.gov/feedback/FeedbackForm.jsp Text of Original Message: Attorney General John Ashcroft U.S. Department of Justice 950 Pennsylvania Avenue, NW Washington, DC 20530-0001 Dear Attorney General Ashcroft, Subject: Word-Of-Mouth.INFO Website I logged into my e-mail over a week ago and received an e-mail from the word-of-mouth.info mail server stating that someone has submitted an anonymous report for my e-mail address EMAIL about me. In order to view the report, which was just inquiring for additional information about me, I had to register and login to the site. Now, to remove the report, I need to send an anonymous e-mail to the sender using the word-of-mouth.info Anonymous E-mail tool which is only accessible to “Power Users” of the word-of-mouth.info web site. In order to become a power user you need to pay a 20 dollar annual subscription to use the e-mail service. The site belongs to Richard Garfield, (510) 393-1276. The number rings directly into a cell phone. It is my opinion that this web site violates my civil rights and is collecting, disseminating, and dispensing information about US Citizens who have no recourse to have the information removed with the exception of succumbing to the annual fee. I have attempted to contact Mr. Garfield on several occasions and every time my request to remove the information on his web site has been declined. I have been met with a standard reply stating that they have the right to pass on any information that their site users wish to pass on. While this is common in person, publication and provision of a method for transmission of this information has not been common until now. I believe that Mr. Garfield’s e-mail address is word-of-mouth@sbcglobal.net and I have included that e-mail in the CC field to also send Mr. Garfield a copy of this message. The business is run under what I believe to be false informaiton, leading back to a registration (internet) of Peter Kestler. The site is hosted out of the state of Nevada by A+ Hosting company. Additional information is available upon request, however, in order to make this communicaiton [sic] brief, I have excluded it. I have filed a report with the FTC and the FBI for this activity. In the age of privacy regulations such as HIPAA and Gramm Leach Bliley act, it is amazing to me that anyone could propogate such information legally, or provide the transport for such. It is, in my mind, similar to the transport of pornography or other illegal activities, and a company saying that they do not participate in the activity, they merely drive the criminals to the locations where the crime is comitted. Regards, JALOV cc: Mr. Mike Hatch, Attorney General, State of Minnesota cc: Mr. Brian Sandoval, Attorney General, State of Nevada, Carson City Office, 100 North Carson Street, Carson City, Nevada 89701-4717
I [knew] Kris Padborg from a business relationship we had back in 1997. At that time he worked at in the position of Assistant Director of Marketing at a company called International Business Development in San Diego. He went to Wilson HS in Long Beach, CA. After that I believe he went to Berkeley. His father, Knud Padborg, lives in the SF Bay Area. I believe that Kris is also currently living in the SF Bay Area. I know that he reads this page and is using the information found here to cover his tracks and erase all connections between him and wordofmouthconnection.com. I also know that he will recognize the name ROMY. So Hi Kris!
Thanks to the trails of IP addresses, Max either knows Romy, or IS Romy. Is anybody who they say they are here?
- RDL
This is sOOOO stupid!. I have never seen such abusshit!. This makes history, litterally!. I was informed by one of my sisters that people were talking about me at this website, but I never imagined this! I received several emails from this searcher several months back and I didn’t do anything/nothing about it because I didn’t really care what people were saying about me. I have passed through all the hoops at my sorority and I will graduate in 1.5 anos and I can’t let some small time SLÙT! mess with my flow
Uh, KRISTINA? The name mentioned is KRISTIAN, not KRISTINA. For an English Lit. major, shouldn’t you be able to notice the difference? You might want to work a bit more on your spelling and grammatical structure, too. Plus, knowing that the scum behind the WOMC website likes pretending to be other people, what’s going to make us believe you? I’m not saying you are, but maybe you’re Kristian, or Peter, or whatever name the guy is using today. The IP address you used is for an Earthlink dialup in the San Francisco area, one of the cities that spammer originates from. Or maybe Max got the email address wrong. Who knows? Who cares? If you’re really just some innocent college girl out there somewhere, rest assured that no one’s actually talking about you. If you’re the spammer, then, yes, we’re talking about you. - RDL
Yes this person is the scammer. They are trying to misdirect the search for them. I’ve noticed similar activity on http://wizbangblog.com/archives/000498.php I think jalov has done the most to address this activity. And yes, the only email address I recieve this on is for Monster and Careerbuilder. So I believe that is the source. I only hope this áššhølë hasn’t made enough off this to afford a good lawyer.
They are now using a new domain name to send out their spam BACKGROUND-RESEARCH.INFO Beware!
Domain Name:BACKGROUND-RESEARCH.INFO
Created On:10-Feb-2004 01:13:03 UTC
Last Updated On:26-Feb-2004 20:12:32 UTC
Expiration Date:10-Feb-2005 01:13:03 UTC
Sponsoring Registrar:R139-LRMS
Status:ACTIVE Status:OK
Registrant ID:C4364326-LRMS
Registrant Name:ANDREW FEINBERG
Registrant Organization:WORDOFMOUTHRESEARCH.COM
Registrant Street1:9805 DUPONT AVE SOUTH
Registrant City:BLOOMINGTON
Registrant State/Province:MN
Registrant Postal Code:55431
Registrant Country:US Registrant Phone:+1.9528851917
Registrant Email:A.FEINBERG@WORDOFMOUTHRESEARCH.COM
Admin ID:C4364326-LRMS
Admin Name:ANDREW FEINBERG
Admin Organization:WORDOFMOUTHRESEARCH.COM
Admin Street1:9805 DUPONT AVE SOUTH
Admin City:BLOOMINGTON
Admin State/Province:MN
Admin Postal Code:55431
Admin Country:US
Admin Phone:+1.9528851917
Admin Email:A.FEINBERG@WORDOFMOUTHRESEARCH.COM
Name Server:NS1.WOMC.NET
Name Server:NS2.WOMC.NET
Isn’t it ironic that the guy who set out to scam people by playing on the fears of ‘word of mouth’ is now prey to such practice? haha Fortunately (but just barely!), I didn’t subscribe to the WOMC. I came oh-so close to doing so, but at the last second said “to hëll with it. If peeps are talking about me, they’re talking about me.” Great website RDL! I just googled WOMC because I couldn’t remember the name of the site and I wanted to see how it was doing so to speak. Lo and behold here you are! For those of you who did lose your $20 or $30: It’s not your fault - it is/was a slick site. Be thankful whomever is running it only took advantage of loopholes, and is not maliciously using the information provided him - i.e., using your credit cards to drain your bank accounts. …let’s be careful out there! sig
YOU BOZOS BETTER GET A LIFE AND GET MY NAME OFF OF THIS WEBSITE. MY PARENTS, IN A STROKE OF BRILLIANCE, SPELLED MY NAME “KRISTIAN” (I THINK THEY MAY HAVE BEEN HOPING FOR A BOY..BUT THAT IS ALWAYS SPELLED WITH A ‘CH’). I GO BY KRISTINA, BECAUSE I AM DEFINATELY A GIRL. NOTICE THAT MY EMAIL ADDY IS THE SAME AS THE ONE YOU IDIOTS HAVE POSTED ALL OF THIS WEBSITE AND OTHERS THAT I AM GOING TO POST THIS SAME LANGUAGE TO. SOME BÍTÇH IS MESSING WITH ME AND IT LOOKS LIKE SHE GOES BY THE NAME OF MAX!!! …. NICE TRY MANDY…COULDN’T YOU HAVE THOUGHT A BETTER NAME TO USE THAN MAX??? IT SOUNDS SO FAKE. I HAVE NEVER EVEN MET OR HEARD FO SOMEONE NAMED MAX….OR MAYBE THAT’S SHORT FOR MAXI PAD…WHICH IS WHAT YOUR BREATH SMELLS LIKE!!
I must have received 10 or more of these junk e-mails; at first I thought it was a virus (I suppose it is, of a sort), but then they kept coming, so I looked up the site, which looked fake, so I just assumed it was some kind of scam. I didn’t even get to the place where it asked for scrill — that would have been a dead give-away. I don’t know how to research this: here’s the header in the e-mail I got(with my e-mail add. replaced by _): Return-Path: X-Original-To: ________@sdcc13.ucsd.edu Delivered-To: ________@sdcc13.ucsd.edu Received: from localhost (localhost [127.0.0.1]) by sdcc13.ucsd.edu (Postfix) with ESMTP id 8D9DB6CF2 for ; Mon, 8 Mar 2004 20:54:43 -0800 (PST) Received: from mailbox6.ucsd.edu (mailbox6.ucsd.edu [132.239.1.58]) by sdcc13.ucsd.edu (Postfix) with ESMTP id 2DF606CF1 for ; Mon, 8 Mar 2004 20:54:43 -0800 (PST) Received: from support.researchpeople.net (host138.hostcentric.com [209.25.160.138] (may be forged)) by mailbox6.ucsd.edu (8.12.10/8.12.9) with ESMTP id i294sfqE096027 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 8 Mar 2004 20:54:41 -0800 (PST) Received: (qmail 27128 invoked by uid 48); 9 Mar 2004 01:52:38 -0000 Date: 9 Mar 2004 01:52:38 -0000 Message-ID: To: _______@ucsd.edu Subject: Research re: ________@ucsd.edu From: WordofMouth Research X-Spam-Level: Level X-Spamscanner: mailbox6.ucsd.edu (v1.4 Mar 2 2004 11:47:57, 0.6/5.0 2.63) X-MailScanner: PASSED (v1.2.8 87098 i294sfqE096027 mailbox6.ucsd.edu) —- The link this e-mail gave to click on was: http://wordexch.info/pass.php?a=search&b=5&c=________@ucsd.edu I usually don’t get that much spam, so I’m not sure how my e-mail address got on this guy’s list. I hope you guys can do something with the information in the header.
More header info. I got rid of the stuff that looked extraneous. I’m at a workstation at UCSD. —- Return-Path: Received: from KINDPERSON (adsl-68-124-41-68.dsl.snfc21.pacbell.net [68.124.41.68]) by mailbox4.ucsd.edu (8.12.10/8.12.9) with ESMTP id i2C4B7TV003741 Received: from munich ([127.0.0.1]) by KINDPERSON with Microsoft SMTPSVC(5.0.2195.6713); Thu, 11 Mar 2004 20:10:44 -0800 Date: Thu, 11 Mar 2004 20:10:44 -0800 From: ALERTSYSTEM@RESEARCHINGPEOPLE.BIZ
Ray, Search results for: 68.124.41.68 OrgName: Pac Bell Internet Services OrgID: PACB Address: 208 Bush St. #5000 City: San Ramon StateProv: CA PostalCode: 94104 Country: US NetRange: 68.120.0.0 - 68.127.255.255 CIDR: 68.120.0.0/13 NetName: PBI-NET-10 NetHandle: NET-68-120-0-0-1 Parent: NET-68-0-0-0-0 NetType: Direct Allocation NameServer: NS1.PBI.NET NameServer: NS2.PBI.NET Comment: Comment: Contact IPAdmin-PBI@sbcis.sbc.com for general IP support. Comment: Contact support@pacbell.net for technical support issues. Comment: Contact abuse@pacbell.net for policy abuse issues. RegDate: 2003-03-07 Updated: 2003-11-21 TechHandle: PIA2-ORG-ARIN TechName: IPAdmin-PBI TechPhone: +1-866-937-3664 TechEmail: IPAdmin-PBI@sbcis.sbc.com OrgAbuseHandle: APB2-ARIN OrgAbuseName: Abuse - Pacific Bell OrgAbusePhone: +1-866-937-3664 OrgAbuseEmail: abuse@pacbell.net OrgNOCHandle: SPBI-ARIN OrgNOCName: Support - Pacific Bell Internet OrgNOCPhone: +1-866-937-3664 OrgNOCEmail: support@pacbell.net OrgTechHandle: PIA2-ORG-ARIN OrgTechName: IPAdmin-PBI OrgTechPhone: +1-866-937-3664 OrgTechEmail: IPAdmin-PBI@sbcis.sbc.com # ARIN WHOIS database, last updated 2004-03-19 19:15 # Enter ? for additional hints on searching ARIN’s WHOIS database.
Ray, Search results for: 68.124.41.68 OrgName: Pac Bell Internet Services OrgID: PACB Address: 208 Bush St. #5000 City: San Ramon StateProv: CA PostalCode: 94104 Country: US NetRange: 68.120.0.0 - 68.127.255.255 CIDR: 68.120.0.0/13 NetName: PBI-NET-10 NetHandle: NET-68-120-0-0-1 Parent: NET-68-0-0-0-0 NetType: Direct Allocation NameServer: NS1.PBI.NET NameServer: NS2.PBI.NET Comment: Comment: Contact IPAdmin-PBI@sbcis.sbc.com for general IP support. Comment: Contact support@pacbell.net for technical support issues. Comment: Contact abuse@pacbell.net for policy abuse issues. RegDate: 2003-03-07 Updated: 2003-11-21 TechHandle: PIA2-ORG-ARIN TechName: IPAdmin-PBI TechPhone: +1-866-937-3664 TechEmail: IPAdmin-PBI@sbcis.sbc.com OrgAbuseHandle: APB2-ARIN OrgAbuseName: Abuse - Pacific Bell OrgAbusePhone: +1-866-937-3664 OrgAbuseEmail: abuse@pacbell.net OrgNOCHandle: SPBI-ARIN OrgNOCName: Support - Pacific Bell Internet OrgNOCPhone: +1-866-937-3664 OrgNOCEmail: support@pacbell.net OrgTechHandle: PIA2-ORG-ARIN OrgTechName: IPAdmin-PBI OrgTechPhone: +1-866-937-3664 OrgTechEmail: IPAdmin-PBI@sbcis.sbc.com # ARIN WHOIS database, last updated 2004-03-19 19:15 # Enter ? for additional hints on searching ARIN’s WHOIS database.
Hello - for those of you who did get scammed by the jerks at WordOfMouth, file a complaint with your credit card company, sighting internet fraud as the issue. Depending on your credit card co., they may refund your money. Even if they do not, the transaction gateway used by WordOfMouth will eventually drop them due to the number of complaints they are gathering.
I gave this loser money before I found this site. Grr!!! Well, he/she/whatever is accepting PayPal and the $20 is for a 3 month subscription. I filed with PayPal to get my money back and here’s some info I rec’d from them: Transaction Date: Mar. 29, 2004 Transaction Amount: -$19.97 USD Case Number: XX-XXX-XXX-XXX Seller’s Name: Mirasol Mirabueno Seller’s Email: wordofmouthresearch@earthlink.net
Well, good news! They refunded me. So if you pay via PayPal, I guess they won’t fight a refund request.
ok, max, what do I do with this info? e-mail pacbell and complain? here’s another one: Return-Path: Received: from localhost (localhost [127.0.0.1]) by sdcc13.ucsd.edu (Postfix) with ESMTP id A25636D16 … Received: from mailbox5.ucsd.edu (mailbox5.ucsd.edu [132.239.1.57]) by sdcc13.ucsd.edu (Postfix) with ESMTP id 61EE26CF6 … Received: from knud (adsl-68-124-55-145.dsl.irvnca.pacbell.net [68.124.55.145]) by mailbox5.ucsd.edu (8.13.0.Alpha0/8.13.0.Alpha0) with ESMTP id i352wIj1024328 … Received: from NEWYORK ([127.0.0.1]) by knud with Microsoft SMTPSVC(5.0.2195.6713); … From: research_dept@researchpeople.biz
Well, in 1969-70 I worked in an office in San Pedro with a woman who was married to one Knud Padborg. They had a SON, Christian or Kristian (I don’t remember which, and it may have been spelled -aan.) She left her husband after a few years and eventually remarried and had another son named Patrick. I haven’t seen or heard from her in about 19 years. Kristian would have been born in about 1970, and Patrick in about 1984. Knud taught German at Long Beach CC and remained in their old apartment in San Pedro for years. I lost track of him long ago, but remember that I always felt uncomfortable around him because even though his wife, my friend, was a stunning beauty, he always came on to any other women around. Seemed somewhat… sleazy. So maybe this IS the same guy.
Richard, somewhat off topic: I found this page after “Margaret” posted her spam at my blog in a thread about fax spams. I saw a link to your posting there, but couldn’t read it because these morons CHARGE to read *free* speech! That site is a bigger ripoff than wordofmouth, what do you think they do with the phone numbers and addresses they collect? Fortunately, the link to this page was free, and I’ve been getting those mails from wordofmouth too and so I checked this out. It really is NOT a mass mailing if they really only mail people to let them know that someone is looking for info. I also mail people unsolicited once I start publicizing their activities, usually a couple times, before and after posting their scummy business practices. I think it’s appropriate to let the subjects of publications know and to give them a chance to set the record straight. Of course wordofmouth has a different concept because you can’t find out what people say about you unless you pretend to be someone else. That’s IF the person who supposedly has info or wants info is a real person and not just fake to get you to subscribe. I can’t imagine CHARGING the subjects of my documentaries to access what bad things I have to say about them.
Seems a very similar scam is in operation from a different (unrelated) company called “Share Your Experiences” at the following domains: shareyourexperiences.com shareyourexperiences.net shyex.com shyex.org shyex.net share-your-experiences.org (blank site, domain only seems to be used for outgoing emails) …and probably more variations of similar domain names, although only some of them seem to have “www” records set up for their domains, with a few just being straight “http://sh(whatever)” Interestingly enough, this site has a properly issued security certificate from RSA Data Security, which I guess just goes to show that even evil scammers can buy a “trustworthy” certificate. They encrypt all pages sent to you, thus furthering the idea that the site is “secure”. Sure it’s “secure” (as in nobody is going to read the data transmitted between the server and yourself en-route), but it’s the activities of the site’s owners that are most definitely not trustworthy. They’ve spammed me twice in the last day and somehow SpamAssassin didn’t kill their mails, which in my book is grounds for military action!! This company (although only one of their domains) is mentioned on the Snopes.com page.
We got a new one. support_dept@find-the-truth.org knud (adsl-68-124-55-149.dsl.irvnca.pacbell.net [68.124.55.149])
I received the following: From SUPPORT@SHAREYOUREXP.US Tue May 4 18:56:42 2004 Return-Path: Received: from xxxxx(xxxxx [xxxxx]) by xxxxx(8.12.9p2/8.12.9) with SMTP id i44NubYu057902 for ; Tue, 4 May 2004 18:56:42 -0500 (CDT) (envelope-from SUPPORT@SHAREYOUREXP.US) Received: from xxxxx([xxxxx]) by xxxxx(NAVGW 2.5.1.13) with SMTP id M2004050418595930294 for ; Tue, 04 May 2004 18:59:59 -0500 Received: from thunder (adsl-67-121-155-151.dsl.pltn13.pacbell.net [67.121.155.1 51]) by xxxxx(8.12.9/8.11.3) with ESMTP id i44NuQce061321 for ; Tue, 4 May 2004 18:56:36 -0500 (CDT) (envelope-from SUPPORT@SHAREYOUREXP.US) Received: from thunder ([127.0.0.1]) by thunder with Microsoft SMTPSVC(5.0.2195. 6713); Tue, 4 May 2004 16:56:11 -0700 Date: Tue, 04 May 2004 16:56:11 -0800 From: SUPPORT@SHAREYOUREXP.US Subject: Somone is sharing experiences about you. To: xxxxx Message-ID: X-OriginalArrivalTime: 04 May 2004 23:56:11.0843 (UTC) FILETIME=[6096C130:01C432 33] Status: RO X-Status: X-Keywords: X-UID: 3087 ******This is not commercial email.****** Someone has just begun the process of sharing opinions and experiences about you via our website. This email message is not spam. If this email message was delivered to your spam or bulk email folder please not ify your ISP or spam filtering company regarding this mistake on their part. You may view the posting here: http://8.shyexp.com/exec/1.php?a=search&b=5&c=xxx%xxxxx If you prefer not to be notified by our website in the future when postings are mode about you, just add your email address to our Do Not Email List. Our website will never send email to an address that appears on our Do Not Email List. To add to Do Not Email List click here: http://3.shyex.com/exec/1.php?a=donotemail&b=xxxxx Sincerely, SYEC Support Department
Add BACKGROUNDRESEARCH.US to the list…Got this today: —- Return-Path: -SUPPORT@BACKGROUNDRESEARCH.US- Received: from phoenix (adsl-68-124-55-145.dsl.irvnca.pacbell.net [68.124.55.145]) by xxxxxxxx (xxx/xxx) with ESMTP id xxxxxxxx for -xx@xxxxx.xxxx-; Thu, 6 May 2004 17:4x:xx -0×00 (xDT) Received: from PHOENIX ([127.0.0.1]) by phoenix with Microsoft SMTPSVC(5.0.2195.6713); Thu, 6 May 2004 14:4x:xx -0×00 Date: Thu, 06 May 2004 14:4x:xx -0×00 From: SUPPORT@BACKGROUNDRESEARCH.US Subject: Someone is investigating your background To: xxxxxx@xxxxx.xxxxxx Message-ID: -PHOENIX-deleted-@phoenix- X-OriginalArrivalTime: 06 May 2004 2x:4x:xx.xx (UTC) FILETIME=[blah:blah] THIS EMAIL IS AUTOMATED, BUT IT IS NOT SPAM. A user has just begun the process of researching your background via our website. This user is using our website to meet people who know you and have experiences and opinions to share about you. This email was automatically sent to you to make you aware of the fact that your background is being looked into. We are trying to build a community that fosters interaction between each and every individual possible. Our mission is to help connect people with one another, wherever they are, to share their experiences, give advice and provide information. To view the section of our website that references you use this link: http://d.wordexch.com/pass.php?a=search&b=5&c=xxxxxx%40xxxxx.xxxxx Our world is one of increasing internationalization, mobility of labor, immigration and upward mobility in the workforce. As a result, towns and neighborhoods where everyone knows each other are increasingly rare. It is increasingly less common for a person to work at the ame company for their entire life, or to even live in the same city or town. In life today we are exposed to and meet a greater variety of people, and with the advent of the Internet we can meet people far outside of our geographical area of residence. To add yourself to our Do Not Email List use this link. http://g.wordexch.biz/pass.php?a=donotemail&b=xxxxxx%40xxx.xxx WHY DO PEOPLE USE THIS SITE? Our website is an online community that connects people who share common contacts, and helps them start a conversation that can lead to better and more informed decisions. For example, if you are thinking about which mechanic to trust your car to, you can come to this site, submit a search on the mechanic or his business and see if anyone else has dealt with him in the past. What you’ll find will be either a positive or negative experience. Either way, you get a real sense of reassurance from being able to talk to someone who purchased his services in the past. Regards, WOM Support Department —- And the accompanying log entry: May 6 17:4x:xx xxxxxxxxxxx sendmail[5608]: -smtp id-: from=-SUPPORT@BACKGROUNDRESEARCH.US-, size=2462, class=0, nrcpts=1, msgid=-PHOENIX-deleted-@phoenix-, proto=ESMTP, daemon=MTA, relay=adsl-68-124-55-145.dsl.irvnca.pacbell.net [68.124.55.145]
and funny…the guy has a snazzy new web site design…gee, I wonder where he got that idea from…so, what’s up? I mean seriously, if anyone wanted to bother to do anything, what the hëll do we do? Irritate Pacbell? I don’t get it. It’s obviously a scam, it’s obviously illegal, hecka people know this, yet nothing is happening. What’s-his-face sent the letter before and it sounded like he got the run-around. But there should be some simple, easy way of shutting such a web site down…someone with more ‘net savvy, speak up, because I’m all for the rule of law prevailing. Also I believe dirty scumbags should go to prison.
sorry. that prior msg. was from me. I’m on a workstation at school right now.
how about someone filing a complaint with the government against this guy? I have gotten numerous messages from this character as well. when I tried the url http://www.BACKGROUNDRESEARCH.US in my browser, nothing came up. in any case, I wouldn’t give this character a nickel!
Hello everyone. We too had many problems with this loser. Not anymore - we filed litigation for spam email in an Iowa court. It’s now pending against: Andrew Feinberg 9805 DuPont Ave South, STE 400 Bloomington, MN 55431 USA Phone: (651)649-4404 You can do the same. Check the laws in your local area. Don’t let the madness continue!
I was so happy to have found this! I have been pìššëd off for weeks over the notification from w.o.m.r. and I have e-mailed just about every privacy and news organization in the states to scream that I have been violated. I never joined, just got pìššëd that a coffee clatch site like that could have existed. But I love all you guys for exposing it! I have never been so happy to hear that something is a scam in my life!
Thank you for the public service, I’ve been getting about 5 emails a day from this wretch of a human. I had a hunch the share your experiences site was a scam and this confirmed it.
Funny that I received one of these emails this evening about 3 hours after I updated my Monster.com profile. I did fall for it! However, due to problems with my PayPal account I was not able to pay the $19.97 to them (Thank you PayPal!!) I then searched the web and found you guys, I dont understand all this IP address stuff, but looks like you guys have done your research and well too!! KUDOS to YOU!! Thank you for saving me $20 Rich! I can tell you one thing…I will definately delete my Monter.com profile now.
Thanks for the info on these scammers. I just got one of these extortion emails so I did a google search on WordOfMouthResearch. For future reference, the scam email directed to me cam from 69.108.157.9 and a whois returned:
69.108.157.9 = [adsl-69-108-157-9.dsl.irvnca.pacbell.net ] Pac Bell Internet Services PBI-NET-0803 (NET-69-104-0-0-1) 69.104.0.0 - 69.111.255.255 SBC Private customer SBC06910815700028040511150750 NET-69-108-157-0-1
69.108.157.0 - 69.108.157.15
Thanks again!
I got an e-mail from shareyourexperience.com at my office. As I am in a community non-profit role, I will admit to being concerned about such a site and the ability for just anyone to “share business information” about me through a “personal reference” type effort. I just did a search this evening on the site. I did click into their link from the office, but when I saw the “pay up front” request I thought it might be a scam and I had better research it some firt. Thanks for posting this information. I was glad to hear that my instincts were correct. Appreciate your time on this.
Thanks for posting this. God bless Google! I got one today from “Share Your Experiences” and wanted to add yet another domain name to everyone’s block list for future çráp from them: sharingopinions.us The WHOIS info for this domain shows the following:
Registrant: SHAREYOUREXPERIENCES.COM 2711 CENTERVILLE ROAD SUITE 120 WILMINGTON, Delaware 19808 United States
Registered through: LuckyRegister
Domain Name: SHARINGOPINIONS.US
Created on: 23-Jun-04
Expires on: 22-Jun-05
Last Updated on: 22-Jul-04
Administrative Contact: TORREY, JOHN JOHN.TORREY@SHAREYOUREXPERIENCES.COM SHAREYOUREXPERIENCES.COM 2711 CENTERVILLE ROAD SUITE 120 WILMINGTON, Delaware 19808 United States 5162148365
Technical Contact: TORREY, JOHN JOHN.TORREY@SHAREYOUREXPERIENCES.COM SHAREYOUREXPERIENCES.COM 2711 CENTERVILLE ROAD SUITE 120 WILMINGTON, Delaware 19808 United States 5162148365
Domain servers in listed order:
SCRATCHY.SHAREYOUREXPERIENCES.COM
NS1.SHAREYOUREXPERIENCES2.COM
NS1.SHARINGEXPERIENCE.US
Here is the header and body of an e-mail I received o August 8, 2004 from: Viewing Full Header - View message Return-Path: Received: from host20.host20-server.com (root@localhost) by .ca (8.11.6/8.11.6) with ESMTP id i789kAg23072 for ; Sun, 8 Aug 2004 05:46:18 -0400 Subject: One of our members is looking for opinions about: sales@cybertime.ca From: Experience Posting Date: Sun, August 8, 2004 4:45 am To: sales@cybertime.ca Cc: ########Submission About You######## A member is trying to share Opinions and Experiences about you via our website. The purpose of this email is to inform you that a submission has been made about you at our website. This is email is not commercial in nature. If this email message was delivered to your spam or bulk email folder please notify your ISP or spam filtering company regarding this mistake on their part. To view this submission use this link: http://share2.info/lx.php?a=search&b=5&c= ShareYourExperiences.com, as the name suggests, is a place where members can meet each other for the purpose of sharing the experiences they have had with people and businesses. IMPORTANT - To add this email address to our Do Not Email List click here: http://6.share4.info/lx.php?a=donotemail&b=.ca Sincerely, SYEC Support X-ClientAddr: 216.117.177.162 Received: from mail.sharingopinion.org (nameservices.net [216.117.177.162] (may be forged)) by host20.host20-server.com (8.11.6/8.11.6) with ESMTP id i789jlq23033 for >; Sun, 8 Aug 2004 05:46:10 -0400 Received: from mail.sharingopinion.org (localhost.localdomain [127.0.0.1]) by mail.sharingopinion.org (8.12.8/8.12.8) with ESMTP id i788j559028331 for >; Sun, 8 Aug 2004 04:45:05 -0400 Received: (from apache@localhost) by mail.sharingopinion.org (8.12.8/8.12.8/Submit) id i788j5VD028330; Sun, 8 Aug 2004 04:45:05 -0400 Date: Sun, 8 Aug 2004 04:45:05 -0400 Message-Id: To: Subject: One of our members is looking for opinions about: .ca From: Experience Posting
Our Web site, Shareyourexperiences.com, is absolutely not a scam as some irresponsible slanderers assert. Shareyourexperiences.com is a valuable research tool, and our team has worked hard to create a legitimate, and highly useful, resource. My name is John Torrey, and as the chief executive officer of Shareyourexperiences.com I feel the need to issue this response to defend our product, and assure our users that they are contributing to a valuable meeting place for people around the world. Our accusers, while not even providing one verifiable piece of evidence to support their claims, suggest that Shareyourexperiences.com is a scam. Unfortunately, a lot of people have taken their word as gospel, and have not bothered to check the truth. In fact, that is the purpose of Shareyourexperiences.com - to introduce people to one another who can share common experiences (both positive and negative) so that everyone can make more informed decisions. The root of the problem, it seems, is our site’s similarity to another, Wordofmouthresearch.com. A quick search on the Internet shows that the s