VegasChris of CLI in Henderson

Christopher Lawell said in his explanation that he has “not posted on Craigslist more than 1 ad per month (probably longer) in years.” Could this be because he hires others to post for him? On the site there is a user who goes by the name of VegasChris. His profile states that he is with the company CLI in Henderson. He has posted some interesting ads.

On 1/14/2010, he posted an ad looking for a CL, BP and other classified sites poster.

Want an experienced poster for Backpage and Craigslist. MUST be experienced and able to successfully post on both sites.

Will compensate based off responses. Starting at $75 per 1k, will pay more based off the quality of conversions.

Posts are for NSA (W4M) ad category. You must provide ad content and forward replies to specific email address I provide in real time.

Will test work with a daily payout. Would like to escalate to a regular weekly order with successful traffic.

Being able to drive traffic from additional classified sites a plus.

He later posted a similar ad on 1/19/2010. Earlier, he was looking to buy 5000 Hotmail accounts, and the last ad he posted was for a ghost writer for articles about iGaming, the industry in which Chris Lawell says he does his internet marketing business.

There’s another VegasChris on the web who places ads for Craigslist posters, VegasChris of He used to use the name AnitaJohnson. This old version of his MMD profile is still in Google’s cache. To see that this is an old version of VegasChris’ profile, hover over the link labelled Find All Posts and look at the browser status bar. You’ll see that the userid for the profile is 61348, the same as the userid for VegasChris. (Click the image to enlarge it.)

When you click on the link to InCorp Entity Structuring in the cached profile’s signature, you are taken to, a company in Henderson, Nevada.

So this VegasChris also has a Henderson, Nevada connection and could very well be the same person as the other one.

On 4/26/2010, the MMD VegasChris posted the thread Looking for a craigslist poster.

I am looking to buy CL posting service or W4M lead provider in real time and exclusive.

Contact me via pm.

On 11/16/2009, he posted Looking for a CL poster.

Need a poster for adult content on CL.

Let me know what you charge. Would be willing to spend $200 a day (or more) for the right traffic.

Will start immediately.

On 11/3/2009, he posted Looking for a reliable poster on CL.

I am looking to hire a regular CL poster.

Can be creative when it comes to compensation. Would consider pay per post or JV per sale.

dating in W4M section. Possibly other areas.

Please pm me for discussion.

What both of these guys (and they’re probably the same person) are doing here is hiring people to spam the dating sections of Craigslist with fake ads. This is done to promote real dating sites, or to promote fake dating sites used to trick people into signing up for porn sites, and sometimes to promote just plain upfront porn sites.

Servers Used For Scam Now Dead has been shut down and is not mapped to any IP address. Also, the domains:

are dead. They are no longer mapped to IP addresses. itself is still up, however, with a blank homepage as before.


I looked at the email messages one more time and I realize that I made a mistake regarding the one of the dates. The email message sent to Ecatel and that mentioned Christopher Lawell was sent on November 17th, not November 18th. So the sites would have been shut down and Chris’s LinkedIn resume would have been hidden on that day, too. I’ve gone ahead and fixed this error in my previous posts. This is the email message that was sent.

MIME-Version: 1.0
Received: by with HTTP; Wed, 17 Nov 2010 12:31:13 -0800 (PST)
Date: Wed, 17 Nov 2010 14:31:13 -0600
Delivered-To: ***@***.com
Subject: Spam again
From: ****
Content-Type: multipart/alternative; boundary=0016e65b5e60e9df9f0495458ddc

Content-Type: text/plain; charset=ISO-8859-1

You’ve sent me more of this spam. Shouldn’t these sites be shut down?
They’ve been reported as scam sites by lots of different people over the
past year. These are just some of the reports.

The email address used for sending the messages was starred out. It appears odd that it shows up in the Delivered-To field and not just the From field, but this is nothing unusual. These are the message headers for a copy of a sent message that is given to the sender, not the copy that is delivered to the recipient. Gmail puts the sender’s address in the Delivered-To field in the sender’s copy because this is a copy of the message that was delivered to him by Gmail.

And once again, I’d like to reiterate a very important point. Outside of the email messages sent to the ISPs and and outside one post on this blog on November 17th no mention of Christopher Lawell in connection to the scam was made anywhere until after he hid his personal information. His claim that he hid that information because there was a campaign against him is completely false. It was hidden and the scam sites were shut down when the message above was sent. If he has evidence of this campaign, then let him show it to us.

Reply to Christopher Lawell’s New Comments

1. I see. Then how did you find out about this blog at all? Messages were sent about all this to and to Ecatel. How did the person who brought this blog to your attention find out about it, if not through those email messages?

2. Wrong. They are calm, analytical, they look at the evidence presented, and all that evidence points to you being guilty. They state that it strongly suggests that you are guilty but that that has not been proven yet. You could have straightened things out but you didn’t.

3. Wrong again. Again, you pretend that what was written at was some sort of attack on you but it wasn’t. Something like this

That’s less than two months ago. It uses a model, with hints of sex, as a lure.

There is another site “” with an almost identical page, registered just one month earlier. The main difference is that it uses a different model as a lure.

They want your credit card information.

Personally, I would not have anything to do with the site. I would be concerned that they might really be in the business of stealing credit information. It is wiser to deal only with businesses that have a well established reputation.

doesn’t accuse you of anything. Your name comes up only in the presentation of the registration information. You could have posted a note saying that the site wasn’t actually yours and no one would have bothered you about it.

After reading your letter [it can be found on his website] I thought that I should give you the benefit of the doubt. But after looking at your explanations more closely, we see that they do not explain things well at all. They don’t agree with the facts, or are inconsistent, or are implausible, or incomplete and avoid the real issues.

  1. You say you took down your logo and hid your LinkedIn profile because someone brought to your attention several days ago the campaign against you. The fact is that you hid your personal information on November 17th, at the same time that the scam sites were shut down, which was promptly in response to messages sent to and Ecatel showing that your name had been implicated in all this. There was no campaign against you, as you claim. There was just a post that mentioned you on this blog and some email messages that were sent to ISPs and I defy you to find any other mention of you being involved with the scam that was made before you hid your personal information. We’re supposed to believe that someone you know came across this blog, told you about it, and you just by chance decided to hide your information at the same time that the scam sites were shut down, which was soon after those email messages were sent, and that you did this because of a “campaign” against you that didn’t exist? Your claims just don’t agree with the facts. 
  2. You totally mischaracterize the nature of the discussion of at Broadbandreports. No one in that discussion was attacking you at all. The thread is brief and the people that took part in it simply talked about whether or not the site was legitimate. More importantly, the story that you give about your involvement with makes no sense. You write:…they already were working on a web design so I registered the domain he asked for with my Go Daddy account and set up a hosting account for him. I figured, why not, it’s an easy $20. I was notified at a later date by HostGator (my webhost) that he was violating our terms of service and I promptly canceled his account and refused to refund any money. He hassled me for some time and I blocked him on IM and email and he went away., or so I thought. When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request.

    If you canceled his account when you say you did, then the site would have been dead by the time the thread on Broadbandreports was created; there wouldn’t have been any for people to discuss. Since you were the one who registered the domain, you controlled it and no one else could have used it. If the thread on Broadbandreports was posted after you terminated your client’s account, then the only way that would have been still up and running would have been if you had been operating it. Your explanation here is logically inconsistent. It makes no sense.

    If instead you had found out about the TOS violations and had suspended your client’s account after the thread was started (which is not what you say), then you could have simply posted a short note in the thread stating that the site was actually run by one of your clients and that you had terminated his account once it was discovered that it was a scam. There was nothing preventing you from doing that. You were afraid that people would attack you for that? That’s absurd, just like the idea that you had to have the thread deleted.

  3. Concerning the email address, you first try to twist the facts and make this an issue about registration information (which is easy to fake) when it is actually an issue concerning SOA records (which are impossible to fake unless you have access to DNS servers). You say that I base my argument that you were involved in the scam on the fact that a address was used for registering the domains. That is wrong. It was not used for registering the domains and I never said that it was. I know that registration data is easy to fake so I wouldn’t jump to any conclusions based upon it. (As a matter of fact, in this case, the registration information for all of the sites involved in the scam was hidden using Whois privacy protection, so it was of no use.) What we’re talking about here are the SOA records, which only a DNS server administrator would have access to. They are not data that any old person can specify when registering a domain. They aren’t even specified when purchasing a domain but afterwards when the website is actually set up and connected to the Internet.Second, if someone wanted to get back at you for suspending his account by using a email address for his scam site, then he would have put that address in the registration information, not the SOA record (which he wouldn’t have even had had access to unless he had access to the DNS server). The registration information is what you see when you do a whois query. The SOA record, on the other hand, is accessed via a different query and it is usually only looked at by system administrators, the general public has no interest in it. Your explanation about how a email address got used for the SOA records is implausible.
  4. Those articles you wrote show that you have a lot of experience spamming Craigslist. Inundating Craigslist with ads is how the people who run these dating verification scam sites very often work. You dismiss the articles by saying that they just formed a brief attempt at article marketing and you ignore their conent. That content says a lot about the sort of business practices you use. Using multiple IP addresses and email addresses to get around Craigslist’s anti-spam safeguards is underhanded and a violation of Craigslist’s TOS. Your explanation here is incomplete and avoids the real issues.

Your explanations don’t explain things at all. They misstate the facts, ignore the facts, are logically inconsistent, or simply implausible. You keep pushing this idea that you ignored everything and hid your personal information because you didn’t want to “fuel the fire”, but I’ve already shown there was no fire to fuel, not on November 17th when you hid your personal information, and not back in January when that thread on Broadbandreports was created. Your name wasn’t mentioned on this blog in regards to the scam until November 17th, and it wasn’t metioned elsewhere until after you hid your personal information. The truth appears to be that you preferred to hide your personal information and ignore everything until you weren’t able to ignore it anymore because certain people found out about it. If you now want to ignore all of the facts presented here once again, go ahead. I don’t plan to tell you anything about myself because I know better than to give out my real name when I investigate Internet fraud. Go to or and tell the people there how unfair it is that they don’t reveal their real names when they post about scam sites and suspected scammers. They’d laugh at you. In any case, who I am is irrelevant, all that matters are the facts and the facts don’t look good for you.

Some More Questions For Chris Lawell

Chris, up until Friday, the SOA records for the scam sites all listed the email address for their DNS zone administrator as But on Friday, the day that you responded to the allegations made against you, the SOA records for all of these sites except were deleted. Could you explain how that happened?

You can view the DNS records by visiting

and clicking on the DNS links in the More Information column in the table.

Also, it is very important to note that we are discussing SOA records here, not registration information. You say in your letter that anyone can use any email address when registering a domain. True, you can pick any fake email address for the registration information and if the registrar or hosting service doesn’t bother to check it out, then it will end up going into the registration databases. But we’re not talking about registration data here, we’re talking about SOA records. These are records that are created by the administrators of DNS servers. You can’t fake this data unless you have access to the DNS server in question. The DNS server would in this case most likely have been controlled by a hosting company or the ISP Ecatel. It appears that it was controlled by Finishline Hosting (which looks like a pretend hosting company), which means that it would have been involved in the scam, too. Again, what do you know about Finishline Hosting?

Regarding this:

The only thing I am guilty of is being naive 3 years ago and writing about posting on CL as an attempt at article marketing.

Article marketing, that’s all? So you weren’t obviously instructing people on how to spam Craigslist?

Craigslist can be tricky to post multiple ads in one day so here are some easy tips to post successfully on Craigslist.

First, it takes a lot of ads posted daily to list build fast.

You should post a minimum of 30-50 a day.

Here is how to post a lot of ads…

You need a way to change your IP address (your connection to the internet that determines where you are located).

You need a lot of subdomains that are setup to forward to your website(s).

You need a lot of email addresses (I use

I have found that you can post about 10-15 ads with the same IP, email address and subdomain.

Do more than that, and you run the risk of all your ads being deleted.

That is why I use this submission software… CL Autoposter

Using multiple email addresses and multiple IP addresses to avoid having your numerous ads flagged and using automated ad submission software that helps you change your identity, those are tricks to avoid having your spam flagged.

Message to Christopher Lawell


Thank you for contacting me. I read your reply at and there are a few things about it that bother me.

To begin with, you say that no one ever contacted you about the scam sites. Well, we know that at least two complaints were sent about the scam sites to, and that there were many complaints sent to Ecatel prior to those complaints, too. The first known complaint sent to this address was sent on November 14th. The complaints were sent to that address at because that was the only business contact address that was then available. No replies to those complaints were ever received. It was only after a further complaint was made on November 17th, one that mentioned that the site was registered in your name and that was the address for the DNS administrator for the recent scam sites, that the scam sites were promptly taken down.

At the same time, on November 17th, just a few hours after this new complaint was made, you removed your company’s logo from your website and hid your LinkedIn profile. There was no campaign against you as you claim, there were just some postings on this blog that mentioned the web pages that linked your name to the scam sites. Read these postings. Do they amount to character assassination? No, they don’t. They plainly present facts that strongly pointed to you being involved in the scams. They leave open and acknowledge that it is possible that the scammer was merely a client of yours or someone else entirely. (And, as a matter of fact, before coming across the address, there was another person that we believed was behind the sites.) The fact that you hid your personal information at the same time that the sites got shut down, along with the fact that the sites did not get shut down until it was revealed that your name was linked to them, was very suspicious, you must admit.

I know that you don’t care to answer any questions about this, but would you be so good as to answer these?

1) Why were there no replies to the messages sent to Is it not a valid email address? If it isn’t, then there should have been an error message sent back from your website. No replies including error messages were ever received, so it must be a valid email address. If it is a valid email address, then what is your relationship with finishlinehosting?

2) As I said, on November 17th, the day that you hid your personal information, the only public postings made on the internet regarding this matter were the ones you see on this blog. They are calm and rational, analytical. You could have easily posted something here regarding the matter. There was no fire for you to fuel. So why didn’t you post anything?

3) Likewise, concerning, you write

When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request. They are obviously more concerned about freedom of speech even if it is inaccurate and damaging to innocent people than posting accurate content. I didn’t address this on the forum as I felt most people would want to believe the worst and it would only serve to fuel the fire.

However, there was no fire to fuel. There is no complaint in that thread on The thread was started by someone who wanted some advice. He wasn’t sure that was a legitimate dating site, and he wanted other people’s help on figuring that out. There was no hostility or any words at all for that matter that were directed to you or about you. As a matter of fact, the way that your name ended up being mentioned was that someone wanted to point out that the site had only been registered a couple months earlier, and he showed this by posting the registration information in its entirety. The discourse in that thread was calm and reasonable; saying that you didn’t just go ahead and post an explanation in it because you didn’t want to fuel the fire makes no sense: there was no fire to fuel. You could have easily just posted a note saying that you had registered the site for a client and that you had terminated that client’s account; there was nothing for you to be afraid of and there was no reason why you would have needed the thread to have been deleted. So could you explain why you didn’t just do that?

I would really like it if you could answer these questions. In your letter you say:

I am going to address your statements this one time. I will not fuel the fire by entering into a debate. 

As I’ve repeatedly said, there is no fire for you to fuel. We can calmly and rationally discuss this matter, so why don’t you want do that? I’d really like to find these scammers, and I’m sure that you’d like to see them brought to justice too seeing as they’ve implicated you in all this. If you give us the information that you have about them, even if it’s old, it could help us track them down. So why don’t you just talk to us and answer the questions that we have? I am sending an email message to informing you of this post and I hope to hear from you again.

P.S. Christopher Lawell posted several comments on this blog. They all said the same thing, “Please read my full response here:”, so I’ve deleted all but one of them. That is the only reason I deleted his comments, because they were redundant.

Report on Christopher Lawell Inc. And Posted At

A report on Christopher Lawell Inc. and the scam was posted today by my friend PhilW over at Thank you, Phil, for posting it, and also thank you for all of your assistance on this project. You’ve been a great help!

Update on 11/26: This thread has now been deleted.

Account Suspended?

Complaints were sent to Ecatel, the ISP for the scam sites, and also to Now,,,, and all of the other sites used for the scam that were in the zone administered by have been taken down. When you look at these sites now you see a page that says either “This Account Has Been Suspended” or “This Account Has Been Suspended by Finishline Hosting”. However, one of the sites that was used for sending the spam,, is still up. This site is not in a zone administered by and it doesn’t use an IP provided by Ecatel, as the other sites did. It has an IP of, which is provided by Complaints were sent to about this site but the site remains active.

So have the scammer’s sites really been shut down? Did Finishline Hosting suspend their customer’s account? I don’t believe that this is the case. I think that this Finishline Hosting isn’t a real hosting company but a front that was created to hide the scammer’s identity. First of all, the site is blank, it has no content and doesn’t offer any services. When I search for information about this company, I find nothing. There is a company in Joplin, MO with a similar name. It’s called Finish Line Hosting (three words instead of two) and its website is, but it does not appear to be related to at all.

Second, there is the fact that the zone administrator for the sites at Ecatel had an email address at, not at, so the administrator would be someone at Christopher Lawell, Inc.

Third, has undergone a facelift. A couple days ago it featured the logo for Christopher Lawell, Inc:

but now that logo is gone and the home page of the website is completely blank.

Finally, Christopher Lawell’s LinkedIn profile

has been hidden from public view.

I get the feeling that someone is trying to cover his tracks.

Christopher Lawell, Inc.

I’ve done some more investigating of and and it looks like I’ve found out who’s behind them.

First of all,,, and several other servers share the name server


Domain Registrar Create Date Expire Date More Information INTERNET.BS CORP. 2010-06-21 2011-06-21 DNS Corp. (R1601-LROR) 2010-03-18 04:31:32 2011-03-18 04:31:32 DNS INTERNET.BS CORP. 2010-03-18 2011-03-18 DNS Corp. (R1601-LROR) 2010-10-29 04:42:25 2011-10-29 04:42:25 DNS INTERNET.BS CORP. 2010-11-01 2011-11-01 DNS INTERNET.BS CORP. 2010-03-18 2011-03-18 DNS is another server that is used for the scam. It redirects to and are servers that are used for for sending spam for and Since these sites all share the same name server and they were all used for the scam, it’s a good bet that they are all owned by the same person.

A useful piece of information about a website is its SOA record. This record contains the e-mail address of the person responsible for administering the domain’s zone. The SOA record for is this:


Name Server
Serial Number 2010110101
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

The e-mail address of the zone administrator is an address at, which is a website for Christopher Lawell, Inc.

Given its name, we’d assume that would be the website for the hosting company used by these sites, but instead it’s a blank website. Let’s look at the SOA record for


Name Server
Serial Number 2010081305
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

The e-mail address of the zone administrator for this site is also an address at So who is this Christopher Lawell?

Googling “Christopher Lawell” brings up a number of interesting pages. For instance there’s the LinkedIn profile of a Christopher Lawell in the Las Vegas, NV area who is a partner at Clearline Media and president of both and Christopher Lawell, Inc. When we Google

“Christopher Lawell” craigslist

we find some articles where he gives tips on spamming Craigslist. For instance:

Doing some more searching for his name shows that it has been linked to other verification scam sites. For instance, there is this thread on

The Christopher Lawell discussed in this thread had an address in Henderson, NV, which is a suburb of Las Vegas, and he was listed as the owner of, a verification scam site that is no longer active:

Domain ID:D157651283-LROR
Created On:21-Nov-2009 16:02:05 UTC
Last Updated On:21-Nov-2009 16:02:08 UTC
Expiration Date:21-Nov-2010 16:02:05 UTC
Sponsoring, Inc. (R91-LROR)
Registrant ID:CR29951201
Registrant Name:Christopher Lawell
Registrant Street1:318 Canyon River Court
Registrant Street2:
Registrant Street3:
Registrant City:Henderson
Registrant State/Province:Nevada
Registrant Postal Code:89012
Registrant Country:US
Registrant Phone:+1.7023358990

(The current registration information is different because the registrant acquired whois privacy protection to hide his identity.)

Not only is the name of this site very similar to, but is what is shown for the title of the page on

(Click the image to see it in full size). This could be because when the current site was created, the person who set it up used a copy of the HTML for the old site and forgot to change the page’s title.

When we look at all of this evidence, though it hasn’t been proven for certain, it does appear that this Christopher Lawell is the owner of the current scam sites, too. is being used for sending out email messages for the Cheri Craigslist dating scam. The spam is coming from the subdomain, as you can see from the headers of a sample fraudulent email message below.

Delivered-To: ***@***.***
Received: by with SMTP id s8cs74788ybi;
Thu, 11 Nov 2010 19:43:18 -0800 (PST)
Received: by with SMTP id m2mr3084169ybf.48.1289533397732;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received: from ([])
by with ESMTP id l55si6539186yhd.141.2010.;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received-SPF: fail ( domain of does not designate as permitted sender) client-ip=;
Authentication-Results:; spf=hardfail ( domain of does not designate as permitted sender)
Received: from [] (helo=3e414603b1a244c)
by with esmtpa (Exim 4.69)
(envelope-from )
id 1PGkXi-0004kH-VS
for ***@***.***; Thu, 11 Nov 2010 21:43:15 -0600
MIME-Version: 1.0
Date: Thu, 11 Nov 2010 19:43:15 -0800
X-Priority: 3 (Normal)
Subject: RE: criagslist
From: “meee ;)”
To: “***”
Content-Type: multipart/alternative;
X-Mailer: Microsoft Outlook, Build 10.0.6822
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname –
X-AntiAbuse: Original Domain –
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain –

Hey Babe, hehe you seem to be my kind of guy.

thanks for the reply. Totally honestly, i just want some no strings action today or tomorrow. You into that?

You ever do this? I’ve a couple times b4. Everytime I think about hooking up with no strings I get really horny but a little worried. I don’t want to meet some underage kid or something.

I’m a pretty upfront person so let me just lay this out before we go any further. This is a NSA thing with nothing else. I just got out of a relationship and am not looking for a guy to hold me back.

If you are good with that then there is one more thing I have for you. I am getting a lot of emails from HS kids and creepy guys out there so i am requiring everyone to register for my peace of mind. Its no cost but I promise if you do this, Ill make it worth your while and will be more open to whatever you want to do. If you dont want to do this then i am afraid we can’t go any further because it wont be any fun for me being stressed and afraid of you the whole time.

If you want to meet me still then just go here [Here there was a link to Do not visit that site!]. You can find my profile and contact information there.

I’m looking forward to seeing you

Call me at the number on there.

Bye for now


The reason that this is a scam is because the person that is supposedly sending the messages doesn’t exist. The messages are actually being sent by someone who makes money from directing you to the dating sites that you are being asked to join. These scammers like to call this “affiliate marketing”, but it is fraud.

Other servers that have been used for sending these scam messages are: