Anyone here speak Russian?

Kyle Uchitel has updated his Facebook profile again. Now he has a Russian name, Дед Мороз Учитель, that appears to mean something like “Professor Santa Claus”.

Дед Мороз
http://en.wiktionary.org/wiki/Учитель

Alex Vasser has also updated his Facebook profile with a Russian name, Крокодил Гена. which is the name of a fictional character that translates into English as Crocodile Gena.

Is this any cause for suspicion?

Discussion of emailrelatedservice.com and AVKY Inc at aa419.org

There was a thread posted over at aa419.org concerning emailrelatedservice.com and AVKY Inc. The thread is currently not available. Alex Vasser posted in it using the alias dartnight. He had a discussion with Philw wherein he made some statements denying that he, Kyle, and AVKY Inc owned emailrelatedservice.com and the scam sites hosted on it. He also said that he contacted HostGator and 1&1 about the sites and he related what he says the hosting services told him. Since we feel that his side of the story is important, we are posting his discussion with Philw of aa419.org here. At the end of this post are links to screen shots from Google’s cached copy of the page that will show that we are posting Alex’s and Phil’s actual words. The times given are GMT.

dartnight
Thu Jan 27, 2011 12:54 am

Hello Phil

I received a phone call today from someone that started talking to me about something I did not understand. After a couple minutes they told me they found my number on this site and some blog. I spent the last couple hours trying to figure out what is going on. Both me and my friend kyle were really shocked to see all this info on us. I called 1and1 and all their departments other then technical are closed so I have to talk to someone tomorrow. This is indeed our company and correct information, BUT we are not associated with these websites. We will be following up with that domain provider trying to figure out whats going on and how we can get these people taken down. So far they have atleast temporary closed the domain down until we call tomorrow and figure this out with the correct department. We do not know how our company and names got involved in this but you bet that we are taking this seriously and will be trying to find out. The good news is we have checked all our credit cards and no unauthorized charges have been found. So all the information they had about us atleast did not include credit info. Kyle’s credit card did get replaced for a breach in a merchant database(or something along those lines), but that was atleast a year ago so not sure how this would have to do with it. Thank you for finding this and bringing this to light.I would appreciate if you could take down some of our personal info and possibly guide me on who I need to contact other then 1and1 to get this resolved. I have messaged you my email

dartnight
Thu Jan 27, 2011 12:55 am

Seems like I do not know how to message you here, but do not want to post my email on here, so if you can message me please do.

Philw
Thu Jan 27, 2011 4:38 pm

Alex,

I’m not sure who you are referring to when you say domain provider. Are you talking about HostGator? You can send a complaint to them at security@hostgator.com. They also have other support options.

For the domains that are using your personal and company information, in addition to contacting 1&1 you should file a complaint on the Internic website and you can also try contacting the registrar.

http://wdprs.internic.net/
http://registrar.schlund.info

Please let us know what HostGator and 1&1 have to say about all of this.

dartnight
Thu Jan 27, 2011 8:21 pm

Phil,

Ok I contacted hostgator and they told me the hosting and domain has been taken down and they are investigating. They took the issue seriously and didn’t just blow me off but when I tried to get more information from them about the owner of the sites they wouldnt tell me. They said I would need a court order to find information about payee and such. They basically just gave me the run around saying they are conducting their own investigation from prior complaints. Also they did tell me who its publicly registered to and it doesn’t seem like its me, its some other address which sounded fake and the last name vanner and not mine. So I left it at that.

I tried calling 1and1 again today and receive a “because of Philadelphia weather, our office are currently closed, try again tomorrow”. Thats what it said yesterday. I will be calling again tomorrow, but am slightly discouraged after during further reading. According to some websites I read, unless a court order is issued companies are not allowed to disclose anything. So atleast they already took down the site’s and when I get a hold of them hopefully they can help remove our names from there and clear our names and company of this mess. If not I will be submitting to that internic site you linked for me(but I am not sure what the second link is to or what to do with it).

Can you remove our personal information as well please, its hard enough trying to get this sorted out, all while receiving phone calls/facebook messages and such. Thanks again for pointing this out, never thought all that identity theft garbage they advertise on the radio would hit so close to home. We are just happy that its not our financial data i suppose.

Philw
Thu Jan 27, 2011 10:59 pm

Well, emailrelatedservice.com was not suspended by HostGator. The people who own it are just hiding their content. If the site were suspended, you’d always be automatically redirected to HostGator’s suspended page whenever you try to access any content on the site. That doesn’t happen. It’s still possible to see the default website page, for instance.

Also, my little buddy DJ Adulesentz informed me that when you call 1&1 you receive no message about the office being closed due to the weather. I confirmed this myself.

dartnight
Thu Jan 27, 2011 11:03 pm

Hmmm, looks like Ill have to call them again. Always the run around

As for 1and1, please try and call them and you will see… You have to go through the steps to be transferred to the correct departments. Ince you hear a dial, you will be transferred to an answering machine with that message. Or if you talk to technical support, ask them….

dartnight
Fri Jan 28, 2011 6:50 pm

How are you reaching that page, I do not see it when I go to that link. Hostgator will not go further then say they are doing their own investigation.

Why are you deliberately avoiding responses to me asking to take down our information, we shouldn’t be punished for something that is not our doing especially when we are the victim of this situation as well. Doing all we can to clear this up, but the effectiveness of the domain/hosting company response to this shouldn’t have anything to do with us.

Philw
Fri Jan 28, 2011 10:32 pm

More changes have taken place. Emailrelateservice.com no longer resolves to an IP address and some of the registration information for the sites has changed.

Domain name: emailrelatedservice.com

Registrant Contact:

don divenchenzo ()

Fax:
750 w scottsdale rd
tempe, fl 85254
US

domain: safelyhookup.com
created: 09-Aug-2009
last-changed: 28-Jan-2011
registration-expiration: 09-Aug-2011

nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 135 W Baseline Rd
registrant-pcode: 85283
registrant-state: AZ
registrant-city: Tempe
registrant-ccode: US
registrant-phone: +1.3342344323
registrant-email: avkyinc@gmail.com

domain: securemeetup.com
created: 12-Aug-2009
last-changed: 28-Jan-2011
registration-expiration: 12-Aug-2011

nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 135 W Baseline Rd
registrant-pcode: 85283
registrant-state: AZ
registrant-city: Tempe
registrant-ccode: US
registrant-phone: +1.3342344323
registrant-email: avkyinc@gmail.com

For emailrelatedservice.com there is a new registrant name (Don Divenchenzo) and a fake Florida address. For safelyhookup.com and securemeetup.com there is a new Tempe address and an Alabama phone number.

Alex, regarding your personal and corporate data, I am going to leave the registration information that was reported by the whois servers since that was what was on record. I will remove the Facebook screen shots even though there is nothing in them that is really private or that should cause you any embarrassment. I will leave the rest of the information up unless a site administrator asks me to remove it because I believe that it is still an open question as to whether AVKY Inc, you and Kyle, actually own these sites. The circumstances here are rather suspicious. The registration information for the sites has your corporate information and a registrant name similar to yours that looks like a deliberate alteration of your real name. When Kyle discovered that this information was posted here he changed his Facebook name and hid all of his personal information. The site emailrelatedservice.com was not suspended as you said it was, and I think that it is very unlikely that HostGator would go ahead and say that it was suspended when it wasn’t. I’ve dealt with them many times in the past and they do not appear to be the sort of company that would lie about something like this. As a matter of fact, I know that the people who run emailrelateservice.com were busy hiding their content a couple nights ago. At first they moved the content into a directory called ztemp. For a while I was still able to view the content in that directory, but then its permissions where changed so I couldn’t access it.

I’m sure that they noticed my activitiy on their site because they then tried to change things so that you would always see a blank page regardless of the path in the URL. However, they didn’t or couldn’t get this to work completely and it was still possible to view the default website page. Now they have made these changes to the registration information and they have changed the DNS information so that emailrelatedservice.com no longer resolves to an IP.

None of this proves that AVKY Inc owns these sites, of course, and I am not going to make any claims like that or argue about it at all because the information here is inconclusive. I will simply state that it is an open question and no one should take what is presented here as proof that AVKY owns these sites. I will also say to anyone who has had their money taken by these scams that they should not contact you or Kyle or AVKY Inc. It has not been shown who owns these sites and it would not be right to send complaints to either of you or your company. Victims of these scams should instead send complaints to the hosting companies, www.ic3.gov, their banks or credit card companies, and also contact their local police.

Screen shots of the conversation:

Part 1
Part 2
Part 3
Part 4
Part 5
Part 6

Emailrelatedservice.com is down

Emailrelatedservice.com no longer resolves to an IP address and the sites listed on January 22nd all appear to be dead. Some of the registration information for the sites has changed.

Domain name: emailrelatedservice.com

Registrant Contact:

don divenchenzo ()

Fax:
750 w scottsdale rd
tempe, fl 85254
US

domain: safelyhookup.com
created: 09-Aug-2009
last-changed: 28-Jan-2011
registration-expiration: 09-Aug-2011

nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 135 W Baseline Rd
registrant-pcode: 85283
registrant-state: AZ
registrant-city: Tempe
registrant-ccode: US
registrant-phone: +1.3342344323
registrant-email: avkyinc@gmail.com

domain: securemeetup.com
created: 12-Aug-2009
last-changed: 28-Jan-2011
registration-expiration: 12-Aug-2011

nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 135 W Baseline Rd
registrant-pcode: 85283
registrant-state: AZ
registrant-city: Tempe
registrant-ccode: US
registrant-phone: +1.3342344323
registrant-email: avkyinc@gmail.com

For emailrelatedservice.com there is a new registrant name (Don Divenchenzo) and a fake Florida address. For safelyhookup.com and securemeetup.com there is a new Tempe address and Aleksandr Vasser’s phone number was replaced with an Alabama phone number.

Emailrelatedservice.com and AVKY Inc. (Update)

Well, there have been some interesting developments in this case. Complaints were sent to both HostGator, who host emailrelatedservice.com, and 1&1, who host the sites in the long list of emailrelatedservice.com scam sites. HostGator said that they are investigating the matter but 1&1 still have not responded. Some of the sites in that long list above are no longer active. For instance:

http://safecoupleconnect.com/
http://safecouplesconnect.com
http://safelyhookup.com
http://securemeetup.com

But emailrelatedservice.com is still up and you can still view their content there:

http://emailrelatedservice.com/SafeCoupleConnect
http://emailrelatedservice.com/SafeCouplesConnect
http://emailrelatedservice.com/SafelyHookup
http://emailrelatedservice.com/SecureMeetup

Another change is that Kyle Uchitel has updated his Facebook profile. He hid his friends list and all of his personal information and he even changed his name to Kyle Uch.

Hmm…

Securemeetup.com and Safecouplesconnect.com

Here are sample fraudulent email messages that are sent out to promote these sites. Some of the headers are included. Note that the senders’ addresses are at the same domain, longtermwax.com, which is privately registered with 1and1.com. The sites being plugged are also privately registered with 1and1.com. The server emailrelatedservice.com is being used to host the content of these two sites. Emailrelatedservice.com is hosted by HostGator. If you receive an email message asking you to visit any of these sites, forward the message to security@hosgtator.com and abuse@1and1.com along with the message headers. Be sure to explain to HostGator that the site you visited gets its content from emailrelatedservice.com. Also explain to both hosting companies the circumstances under which you received the message (e.g., you replied to an ad on Craigslist, it was a reply to an ad you posted on Craigslist, etc.). Instructions on how to find the message headers can be found at spamheaders.com.

A sample email message promoting securemeetup.com

X-Complaints-To: abuse@dnsExit.com
X-SPAM: Please report Spam to abuse@dnsExit.com
By service at http://www.dnsExit.com/Direct.sv?cmd=mailRelay
Accounts will be suspended immediately if convicted Spam
Date: Mon, 24 Jan 2011 08:40:23 -0700
From: Tom Rozenberg
To: ******
Subject: Re: please help my wife out…
MIME-Version: 1.0
Content-Type: text/plain

hi thanks for replying to my ad. my name is tom and basically i am doing this for my wife of 15 years. I was recently injured in an accident, and can no longer ‘be’ with my wife the way we used to. I am in desperate need to do anything to help her out and her happiness is of utmost importance to me. Since we are both in an open relationship now she is looking for someone to come over and have ‘fun’ with on a weekly basis. I will not be there when you come over, so no worries regarding that.

we have enrolled to an online profile so my wife can chat with you online and on the phone prior to meeting with you to make sure the terms are ok. this is both for our and your safety. please do the same and email me back with your ID so I can forward it to my wife so she can talk to you. i appreciate you helping her out and i think it will improve the marriage for both of us. looking foward to hearing from you soon

securemeetup.com/profile=4222

tom

A sample message promoting safecouplesconnect.com.

Delivered-To: *******
X-Complaints-To: abuse@dnsExit.com
X-SPAM: Please report Spam to abuse@dnsExit.com
By service at http://www.dnsExit.com/Direct.sv?cmd=mailRelay
Accounts will be suspended immediately if convicted Spam
Date: Sun, 23 Jan 2011 15:27:51 -0700
From: Nicole Giovanni
To: *******
Subject: Re: cl couple 4 m meetup
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=”———-F6FE13910AD86BF”

————F6FE13910AD86BF
Content-Type: text/plain

Hi this is Nicole, thanks for responding to our cl ad. As previously stated in the ad, my boyfriend likes to watch me perform with another guy and gets really turned on by it all – and if it is ok with you, he usually wants to join. We have gone through this site to facilitate our hookups. We usually book a hotel room at the place shown on our page. Please go through the free hookup service we use to get connected to us. Can’t wait to have you in me ;)

safecouplesconnect.com

nicole

UPDATE 1/25
We received another message from Nicole today. Now she’s asking us to visit another of the emailrelatedservice.com sites, fucksafely.com.

From: Nicole Giovanni
To: ********************
Subject: Re:Re: cl couple meetup
MIME-Version: 1.0
Content-Type: text/plain

hey I was looking at the site that I gave you a few days ago and realized that it wants a credit card to verify!
I think that’s un-needed and silly to do that so I found a better place that only requires your email to get in
touch with us. Sorry for the hassle, hopefully you can join us still ;0

we are still free the rest of the week and wanna meet up so come to my site and meet up with us now

http://fucksafely.com/nicole341/?bK3=2vnRc
nicole

When you visiting the URL in the message you are automatically redirected to the dating site Mate1.com. The scammers here are making money from directing traffic to that site.

Emailrelatedservice.com and AVKY Inc

The server emailrelatedservice.com is being used to host the content of numerous confirmed or suspected scam sites. Emailrelatedservice.com is hosted by HostGator and the domains that get their content from it are hosted by 1&1 Hosting. If you receive an email message asking you to visit any of these sites, forward the message to security@hosgtator.com and abuse@1and1.com along with the message headers. Be sure to explain to HostGator that the site you visited gets its content from emailrelatedservice.com. Also explain to both hosting companies the circumstances under which you received the message (e.g., you replied to an ad on Craigslist, it was a reply to an ad you posted on Craigslist, etc.). Instructions on how to find the message headers can be found at spamheaders.com.

http://annatsfreecam.com
http://ashleysfreecams.com
http://freecindycam.com
http://fucksafely.com
http://hannahsbestmassage.com
http://hannahsmassage.com
http://jqdproductions.com
http://jill4secretary.com
http://job-verify.com/ (suspected)
http://joshsfreecam.com
http://kimstsblogcam.com
http://kinkymeetup.com
http://www.layerproductions.com
http://www.lindseyspage.com
http://localtrannyhookup.com
http://mysafehookup.com
http://naughtymade4u.com
http://nsocdatabase.com
http://nursepleasure.com
http://parlorbyrachel.com
http://pornorecruiter.com
http://postnumbers.com
http://rachelpleasures.com
http://rachelsparlor.com
http://rachelsparlor4u.com
http://safecoupleconnect.com
http://safecouplesconnect.com
http://safegaymeetup.com
http://safelyconnectcouples.com
http://safelyhookup.com
http://safelymeetme.com
http://securemeetup.com
http://sexymaid4u.com
http://stacyshomepage.com
http://swingeasynow.com
http://tanyasfunpage.com
http://tinashaircuts.com
http://tinashcuts.com
http://topcitypleasures.com
http://trannyrubs.com
http://trannyproductions.com
http://vzyproductions.com

These sites all load their content from that emailrelatedservice.com in a frame. They are mostly fake dating sites that actually sign you up for porn sites, but some are variations on that scam. Rachelsparlor4u.com is supposed to be a site run by a massage therapist who is offering free massages for new clients. Ads are placed on Backpage advertising this special offer. When you reply to one, you get a response like this:

From: Rachel Henry [mailto:rachel@noreasontogoduh.com]
To: *****
Subject: Re: backpage response: providing no charge massage aro

thank you for the interest in my new special…with this economy i have been trying to acquire new customers by first giving away a few free massages.

I have been practising massage therapy since 2008, and no session is ever the same. My work is always changing

I do strive for a a perfect massage any way you like it to keep you happy, even if you want a happy ending and will make sure to take care of you well.

To speed up the process of me seeing you, and due to an overwhelming response so far, so go through my booking form below and send me a message to let me know when you are done to see me for free!

rachelsparlor4u.com

Job-verify.com appears to be a fake job search site, probably used for harvesting peoples’ personal information, but this hasn’t been confirmed.

Nsocdatabase.com is supposed to be the National Sex Offender and Criminal Organization Database. The way it works is that you receive a message from a girl who wants you to go to the site and verify you’re not a criminal before she meets you. She gives you her member ID for the site. When you enter it there and click the “Check Now!” button, a message pops up saying that she’s been verified and that now you should verify yourself. At the same time, a form appears for you to fill out. The form is loaded from a porn site. Here is some of the code for the click event for the button, which is contained in the home page of the site. This code shows that the site is not querying a database to verify people, but simply displays data embedded in the web page itself. It also shows that the form displayed when it’s your turn to verify yourself comes from a porn site.

if(memID==’2938457′){

var pop3=”http://www.freeteenpass.com/exit/pjs.php?popup=1&revid=247753&opt=&adtr=”;

var include_file = document.createElement(‘script’);

include_file.language = ‘javascript';

include_file.src = pop3;

gName=”Mandy Korsikova”;

sexFM=”female”;

nameID.innerHTML=gName;

sexID.innerHTML=sexFM;

iBox.showURL(‘#inner_content’);

document.getElementById(“joinPage”).style.display = “block”;

test=1;

joinPage.innerHTML='<table border=”0″ width=”500″ bgcolor=”#CC9999″>
<tbody>
<tr>
<td bgcolor=”#CC9999″>
<div><a href=”FPB.php”>FPB.php</a>’+'<a href=”http://www.freeteenpass.com/?revid=247753&track=NSOCD”>http://www.freeteenpass.com/?revid=247753&track=NSOCD</a&gt;';var phone=”723″;

}

The registration information for emailrelatedservice.com.

Domain name: emailrelatedservice.comRegistrant Contact:

Alex Vanner ()

Fax:
750 w scottsdale rd
tempe, 85254
US

Administrative Contact:
Hostgator.com
Brent Oxley (@hostgator.com)
+1.7135745287
Fax: +1.11
11251 Northwest Fwy suite 400
Houston, TX 77092
US

Most of the sites in the list are registered with privacy protection, but a few aren’t.

domain: safelyhookup.com
created: 09-Aug-2009
last-changed: 03-Dec-2010
registration-expiration: 09-Aug-2011

nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 20100 N 78th Pl
registrant-street2: #2044
registrant-pcode: 85255
registrant-state: AZ
registrant-city: Scottsdale
registrant-ccode: US
registrant-phone: +1.4407257446
registrant-email: avkyinc@gmail.com

domain: securemeetup.com
created: 12-Aug-2009
last-changed: 03-Dec-2010
registration-expiration: 12-Aug-2011nserver: ns57.1and1.com 74.208.2.9
nserver: ns58.1and1.com 74.208.3.8

status: CLIENT-TRANSFER-PROHIBITED

registrant-firstname: Aleksandr
registrant-lastname: Vanner
registrant-street1: 20100 N 78th Pl
registrant-street2: #2044
registrant-pcode: 85255
registrant-state: AZ
registrant-city: Scottsdale
registrant-ccode: US
registrant-phone: +1.4407257446
registrant-email: avkyinc@gmail.com

At the moment, it is still possible to see the registrant information for some of the privacy protected ones on sitetrail.com, probably because the protection was just recently added and this is cached registration data.

Safecouplesconect.com registration information. (Click to enlarge.)
Localtrannyhookup.com registration information. (Click to enlarge.)

The registration email address is avkyinc@gmail.com and the names used for registering these sites are Alex Vanner and Aleksandr Vanner. This Alex Vanner supposedly lives in the Phoenix area and he has an Ohio phone number. When I researched the phone number 440-725-7446, I found that it is owned not by an Aleksandr Vanner, but an Aleksandr Vasser. The Arizona Corporation Commission lists Alex as the Vice President of the company AVKY Inc which has an address in Scottsdale, Arizona, but whose state of domicile is Ohio. The address 20100 N 78th Pl #2044 is used for four of the above registrations, and this is also the corporate address for AVKY Inc:

http://starpas.azcc.gov/scripts/cgiip.exe/WService=wsbroker1/names-detail.p?name-id=F14121615&type=CORPORATION

The business type for AVKY Inc is given as “COMPUTER ADV”, and its corporate application states its purpose as “sell advertisements on the internet”. The director, president, and CEO of the company is listed as Kyle Uchitel. On Facebook, I found a Kyle Uchitel in Arizona who is attending ASU and who says his main job is internet advertising.

Kyle Uchitel (Click to enlarge.)

In the bottom left corner of the above picture, you can see that one of his friends is Alex Vasser, who lives in Scottsdale, AZ.

Alex Vasser (Click to enlarge.)

So these two guys are probably the owners of AVKY Inc. But are they also the actual owners of the scam sites, or is someone else using their personal and corporate data? That is still an open question.

Follow

Get every new post delivered to your Inbox.

Join 70 other followers