WOMC: Word of Mouth Connection Scam…
I keep getting these stupid scam/spam emails that say:
Someone has just begun to research your background via our website. This email has been automatically sent to you so as to make you aware that your background is being looked into. The popularity of our website is currently growing at a very rapid rate. If another person begins to research you in the future we will again inform you via email.
Then the Word-Of-Mouth email (sent by their Report Awareness System, aka Connection Awareness System) supplies a link to click on that sends you to a page that says that someone who knows you “very well” has, and is willing to share, information about you with others. To send an anonymous email to this nonexisting person to find out whatever the heck they are supposed to be saying about you, you must fork over a minimum of $19.97 for a one-year subscription to the WOM Connection, or $29.97 for a two-year subscription.
Please, DO NOT fall for this scam! It’s bûllšhìt!
Number Nine in the New York State Consumer Protection Board’s list of the Top Ten Internet headaches is scam websites. The CPB specifically mentions that “all types of scams are attempted on the Internet, including a relatively new website called Word-of-Mouth.org. This website, registered to a company in the Philippines, claims people can file gossip about someone they know using that person’s e-mail address to identify them. Now Word-of-Mouth is sending e-mail messages to try to get people to spend $19.97 to see the gossip that allegedly has been filed about them. CURE: Hit the delete button when you receive this e-mail.”
Some vital information:
- The womc.info domain is registered to Peter Kestler located in Davao City, The Phillipines.
- Other domains include word-of-mouth-connection.com, wordofmouthconnection.com, word-of-mouth.org, womc.net, and wordofmouthconnections.info. There are probably many more.
- Womc.info is hosted in Las Vegas by A+Hosting.
- Word-of-Mouth is listed on the well-known website that exposes frauds and scams, snopes.com. According to snopes, “nobody needs to pay $20 to find out nothing.”
- The WOMC site is “in compliance with all United States laws.” Yet the legal section of the website states that “WordofMouthConnection.com, however, is not covered by any of these laws.”
- The site’s “users are anonymous.” Yet “we cannot ensure that all of your private communications and other personally identifiable information will never be disclosed.”
- Word-of-Mouth claims that “there are no U.S. federal laws governing spam.” They also say that they do not send spam, although they “send an initial unsolicited email”, which they claim is not spam in that there is no commercial aspect. Apparently they are trying to convince you that offering subscriptions to “an online community” is not a commercial endeavor.
- The testimonials are most likely fake. “I searched for Word-of-Mouth Connections on our nanny and was reassured because I found no Word-of-Mouth Connections.” Or what about “I was aghast at the stories [my girlfriend's ex's] told me about her lying, unfaithfulness, and past drug and mental problems. As a result of their input I decided to break off the relationship. WordofMouthConnection.com saved me!” Puuuuhlease!
- The last sentence on their legal page cracks me up the most! WOMC claims that their spam email “is not bulk mail because it is directed at one specific individual.” That’s about as dumb as it gets! All the spam I get is obviously directed to one person, me. That’s why I get it. If it wasn’t directly to me, I wouldn’t get any spam at all!
Do not send $20! Do not click the link! Go directly to the delete button!
UPDATE: I received another one of these emails on 1/12 from womexch.org - RDL
UPDATE: I’ve received dozens more of these emails, most of which I deleted immediately. Now I’m looking at them a bit closer. I received one on 2/7. It was from 209.25.171.75 (peter.wominfo.info), a server hosted at Maxim Computer Systems in Fremont, CA. Next one on 2/8 was from 207.36.180.23 (support.wordofmouthreports.com and peter1.wordofmouthconnections.com), a server at CyberGate/ValueWeb in Ft. Lauderdale, FL. Both directed potential visitors to a URL on s.wominfo.info (peter1.word-of-mouth-connection.com), hosted by A+Hosting/Premia Networks in Las Vegas, NV. This guy is sure spreading it around! Pun intended…
UPDATE: I got another one on 2/8! Sheesh! This one from 216.65.117.86 (support.wordofmouthconnections.net hosted by Maxim/HostCentric in Fremont) directing users to a page on womc.info (64.235.50.54, the same peter1.word-of-mouth-connection.com site hosted in Las Vegas listed above).
UPDATE: Another one on 2/16. From “WOMC SUPPORT” with email address notify.sys@wordofmouthreports.info, title is “Background research being performed on you.” Offending mail server is support.wordofmouthreports.info (207.36.180.112) hosted at CyberGate/ValueWeb in Ft. Lauderdale, FL. Directs (again!) to womc.info (64.235.50.54, hosted in Las Vegas). The marketing pitch on this one was “Someone is looking for people who know you and have experiences and/or opinions to share about you via our website.”
I just received one of these emails, which got me wondering just how bad an anonymous rumor could be, but I was extra wary since the message was targetted at an email address which I only use for DNS registrations. A quick web search found this site, thanks folks. The message came from a machine (HELO knud) which is on a subnet (68.124.55.144/29) allocated to: CustName: SBC Private Customer Address: 268 Bush St. Address: Suite 5000 City: San Francisco StateProv: CA PostalCode: 94104 Country: US RegDate: 2003-10-09 Updated: 2004-02-02 Notice how he’s now anonymous. FWIW, here’s the interesting part of the mail headers: —snip— Return-Path: <notification.sys@word-of-mouthconnection.net> Delivered-To: xxx@xxxxxxx.xxx Received: (qmail 9927 invoked from network); 16 Feb 2004 23:34:57 -0000 Received: from adsl-68-124-55-148.dsl.irvnca.pacbell.net (HELO knud) (68.124.55.148) by xxxxxx.xxxx.xxx with SMTP; 16 Feb 2004 23:34:57 -0000 Received: from henning ([127.0.0.1]) by knud with Microsoft SMTPSVC(5.0.2195.6713); Mon, 16 Feb 2004 15:21:24 -0800 Date: Mon, 16 Feb 2004 15:21:24 -0800 From: notification.sys@word-of-mouthconnection.net Subject: A user is researching your background To: xxxxxx@xxxxxxx.xxx Return-Path: notification.sys@word-of-mouthconnection.net Message-ID: <HENNINGVAE377eBZTi200025ed3@knud> X-OriginalArrivalTime: 16 Feb 2004 23:21:24.0759 (UTC) FILETIME=[985E8270:01C3F4E3] —snip— One other snippet: the domain’s name servers, ns1.womc.net (64.235.50.54) and ns2.womc.net (64.235.50.55) are apparently hosted by A+Hosting in Las Vegas, who actually have a real human to complain to: http://ws.arin.net/cgi-bin/whois.pl?queryinput=P%20!%20PN269-ARIN
More information on this scam from the Attorney General’s office: Thank you for contacting the Federal Citizen Information Center. The U.S. Department of Justice, Civil Rights Division, is the primary institution within the Federal government that enforces Federal statutes prohibiting discrimination on the basis of race, sex, disability, religion, or national origin. At its website you will find links to information discussing civil rights and liberties issues, including a list of frequently asked questions and instructions on how to file a discrimination complaint. To learn more, please visit: http://www.usdoj.gov/civilliberties.htm The Civil Rights Division is broken down into sections, each having its own contact information. For a list of those sections, their responsibilities, and a link to their contact page, please visit: http://www.usdoj.gov/crt/mgmtndx.htm. In general, the address you should mail your complaint to is: U.S. Department of Justice, Office of Civil Rights, (Name of Section), 950 Pennsylvania Ave. NW., Washington, DC 20530. If you have questions or would like to talk with a representative of the Civil Rights Division, you can use the following contact information: U.S. Department of Justice, Office of the Assistant Attorney General, Civil Rights Division, 950 Pennsylvania Ave. NW., Washington, DC 20530, Telephone: 1-202-514-2151, Fax: 1-202-514-0293 We also believe your inquiry may be best addressed by an attorney; the staff in our office is not qualified to give legal advice. While there is no Federal agency that provides private legal assistance, the Legal Services Corporation does fund locally based legal aid services to persons in financial need. If you would like to obtain information on the Legal Services Corporation program nearest you, please specify your state and county of residence at: http://www.rin.lsc.gov/rinboard/rguide/pdir1.htm. Should you need to contact the Legal Services Corporation headquarters directly, you may do so by calling 1-202-295-1500 or by writing to: Legal Services Corporation, 750 First St. NE., 10th Fl., Washington, DC 20002-4250, Fax: 1-202-337-6797, Email: info@lsc.gov. You may also access the online request form at: http://www.lsc.gov/contact.asp. If you are not eligible for legal assistance through the Legal Services Corporation, then you may obtain a lawyer referral from the appropriate state bar association. For a directory of state bar associations and their contact information, please visit the link that follows: http://www.usccr.gov/filing/flndx.htm The best source for information on how to report Internet related issues, including viruses, is found at the U.S. Department of Justice Computer Crime and Intellectual Property Section webpage entitled “How to Report Internet-Related Crime.” You may wish to view this information in case some of it applies to your situation. This comprehensive webpage provides access to a large number of agencies where you may report your information based on the type of occurrence. To access this information, please visit: http://www.cybercrime.gov/reporting.htm. If you would like to access information about privacy from the Federal Trade Commission, please visit: http://www.ftc.gov/privacy/index.html We hope you find this information helpful. Regards, Federal Citizen Information Center If you have any further questions about the government, please do not hesitate to call our National Contact Center at 1-800-FED-INFO (1-800-333-4636), Monday through Friday from 8 a.m. to 8 p.m. eastern time, or send us another message through our webform at: http://www.firstgov.gov/feedback/FeedbackForm.jsp Text of Original Message: Attorney General John Ashcroft U.S. Department of Justice 950 Pennsylvania Avenue, NW Washington, DC 20530-0001 Dear Attorney General Ashcroft, Subject: Word-Of-Mouth.INFO Website I logged into my e-mail over a week ago and received an e-mail from the word-of-mouth.info mail server stating that someone has submitted an anonymous report for my e-mail address EMAIL about me. In order to view the report, which was just inquiring for additional information about me, I had to register and login to the site. Now, to remove the report, I need to send an anonymous e-mail to the sender using the word-of-mouth.info Anonymous E-mail tool which is only accessible to “Power Users” of the word-of-mouth.info web site. In order to become a power user you need to pay a 20 dollar annual subscription to use the e-mail service. The site belongs to Richard Garfield, (510) 393-1276. The number rings directly into a cell phone. It is my opinion that this web site violates my civil rights and is collecting, disseminating, and dispensing information about US Citizens who have no recourse to have the information removed with the exception of succumbing to the annual fee. I have attempted to contact Mr. Garfield on several occasions and every time my request to remove the information on his web site has been declined. I have been met with a standard reply stating that they have the right to pass on any information that their site users wish to pass on. While this is common in person, publication and provision of a method for transmission of this information has not been common until now. I believe that Mr. Garfield’s e-mail address is word-of-mouth@sbcglobal.net and I have included that e-mail in the CC field to also send Mr. Garfield a copy of this message. The business is run under what I believe to be false informaiton, leading back to a registration (internet) of Peter Kestler. The site is hosted out of the state of Nevada by A+ Hosting company. Additional information is available upon request, however, in order to make this communicaiton [sic] brief, I have excluded it. I have filed a report with the FTC and the FBI for this activity. In the age of privacy regulations such as HIPAA and Gramm Leach Bliley act, it is amazing to me that anyone could propogate such information legally, or provide the transport for such. It is, in my mind, similar to the transport of pornography or other illegal activities, and a company saying that they do not participate in the activity, they merely drive the criminals to the locations where the crime is comitted. Regards, JALOV cc: Mr. Mike Hatch, Attorney General, State of Minnesota cc: Mr. Brian Sandoval, Attorney General, State of Nevada, Carson City Office, 100 North Carson Street, Carson City, Nevada 89701-4717
I [knew] Kris Padborg from a business relationship we had back in 1997. At that time he worked at in the position of Assistant Director of Marketing at a company called International Business Development in San Diego. He went to Wilson HS in Long Beach, CA. After that I believe he went to Berkeley. His father, Knud Padborg, lives in the SF Bay Area. I believe that Kris is also currently living in the SF Bay Area. I know that he reads this page and is using the information found here to cover his tracks and erase all connections between him and wordofmouthconnection.com. I also know that he will recognize the name ROMY. So Hi Kris!
Thanks to the trails of IP addresses, Max either knows Romy, or IS Romy. Is anybody who they say they are here?
- RDL
This is sOOOO stupid!. I have never seen such abusshit!. This makes history, litterally!. I was informed by one of my sisters that people were talking about me at this website, but I never imagined this! I received several emails from this searcher several months back and I didn’t do anything/nothing about it because I didn’t really care what people were saying about me. I have passed through all the hoops at my sorority and I will graduate in 1.5 anos and I can’t let some small time SLÙT! mess with my flow
Uh, KRISTINA? The name mentioned is KRISTIAN, not KRISTINA. For an English Lit. major, shouldn’t you be able to notice the difference? You might want to work a bit more on your spelling and grammatical structure, too. Plus, knowing that the scum behind the WOMC website likes pretending to be other people, what’s going to make us believe you? I’m not saying you are, but maybe you’re Kristian, or Peter, or whatever name the guy is using today. The IP address you used is for an Earthlink dialup in the San Francisco area, one of the cities that spammer originates from. Or maybe Max got the email address wrong. Who knows? Who cares? If you’re really just some innocent college girl out there somewhere, rest assured that no one’s actually talking about you. If you’re the spammer, then, yes, we’re talking about you. - RDL
Yes this person is the scammer. They are trying to misdirect the search for them. I’ve noticed similar activity on http://wizbangblog.com/archives/000498.php I think jalov has done the most to address this activity. And yes, the only email address I recieve this on is for Monster and Careerbuilder. So I believe that is the source. I only hope this áššhølë hasn’t made enough off this to afford a good lawyer.
They are now using a new domain name to send out their spam BACKGROUND-RESEARCH.INFO Beware!
Domain Name:BACKGROUND-RESEARCH.INFO
Created On:10-Feb-2004 01:13:03 UTC
Last Updated On:26-Feb-2004 20:12:32 UTC
Expiration Date:10-Feb-2005 01:13:03 UTC
Sponsoring Registrar:R139-LRMS
Status:ACTIVE Status:OK
Registrant ID:C4364326-LRMS
Registrant Name:ANDREW FEINBERG
Registrant Organization:WORDOFMOUTHRESEARCH.COM
Registrant Street1:9805 DUPONT AVE SOUTH
Registrant City:BLOOMINGTON
Registrant State/Province:MN
Registrant Postal Code:55431
Registrant Country:US Registrant Phone:+1.9528851917
Registrant Email:A.FEINBERG@WORDOFMOUTHRESEARCH.COM
Admin ID:C4364326-LRMS
Admin Name:ANDREW FEINBERG
Admin Organization:WORDOFMOUTHRESEARCH.COM
Admin Street1:9805 DUPONT AVE SOUTH
Admin City:BLOOMINGTON
Admin State/Province:MN
Admin Postal Code:55431
Admin Country:US
Admin Phone:+1.9528851917
Admin Email:A.FEINBERG@WORDOFMOUTHRESEARCH.COM
Name Server:NS1.WOMC.NET
Name Server:NS2.WOMC.NET
Isn’t it ironic that the guy who set out to scam people by playing on the fears of ‘word of mouth’ is now prey to such practice? haha Fortunately (but just barely!), I didn’t subscribe to the WOMC. I came oh-so close to doing so, but at the last second said “to hëll with it. If peeps are talking about me, they’re talking about me.” Great website RDL! I just googled WOMC because I couldn’t remember the name of the site and I wanted to see how it was doing so to speak. Lo and behold here you are! For those of you who did lose your $20 or $30: It’s not your fault - it is/was a slick site. Be thankful whomever is running it only took advantage of loopholes, and is not maliciously using the information provided him - i.e., using your credit cards to drain your bank accounts. …let’s be careful out there! sig
YOU BOZOS BETTER GET A LIFE AND GET MY NAME OFF OF THIS WEBSITE. MY PARENTS, IN A STROKE OF BRILLIANCE, SPELLED MY NAME “KRISTIAN” (I THINK THEY MAY HAVE BEEN HOPING FOR A BOY..BUT THAT IS ALWAYS SPELLED WITH A ‘CH’). I GO BY KRISTINA, BECAUSE I AM DEFINATELY A GIRL. NOTICE THAT MY EMAIL ADDY IS THE SAME AS THE ONE YOU IDIOTS HAVE POSTED ALL OF THIS WEBSITE AND OTHERS THAT I AM GOING TO POST THIS SAME LANGUAGE TO. SOME BÍTÇH IS MESSING WITH ME AND IT LOOKS LIKE SHE GOES BY THE NAME OF MAX!!! …. NICE TRY MANDY…COULDN’T YOU HAVE THOUGHT A BETTER NAME TO USE THAN MAX??? IT SOUNDS SO FAKE. I HAVE NEVER EVEN MET OR HEARD FO SOMEONE NAMED MAX….OR MAYBE THAT’S SHORT FOR MAXI PAD…WHICH IS WHAT YOUR BREATH SMELLS LIKE!!