Realdates.org

We’ve received another message from Amy of Cooldates.org. This time she’s sent us a link to Realdates.org. At the moment, the page at Realdates.org just has a frame that loads content from AdultFriendFinder. The scammer is trying to earn commissions from promoting that site.

Hey. I’d like to meet you.

I found this website and am on there because theres no cost. Not even a cc. Anyhow, if you want to meetup, get ahold of me once you have signed up. Send me your screen name and I’ll add you.

Here it is: http://www.realdates.org All my details are on there. I hope you’ll get back with me soon.

amy Hugs

Sent from my Blackberry® Wireless Device

The ISP for Realdates.org is FortressITX. If you get a scam message promoting this site, send a complaint to abuse@fortressitx.com. You should also send complaints to the ISPs being used for sending the messages. Here are the headers for this particular message.

Delivered-To: *****
Received: by 10.150.134.1 with SMTP id h1cs257305ybd;
Fri, 29 Apr 2011 07:08:35 -0700 (PDT)
Received: by 10.150.63.12 with SMTP id l12mr158272yba.120.1304086114912;
Fri, 29 Apr 2011 07:08:34 -0700 (PDT)
Return-Path:
Received: from transam.websitewelcome.com (transam.websitewelcome.com [174.122.175.66])
by mx.google.com with ESMTPS id t16si1944213ybe.16.2011.04.29.07.08.34
(version=TLSv1/SSLv3 cipher=OTHER);
Fri, 29 Apr 2011 07:08:34 -0700 (PDT)

Received-SPF: neutral (google.com: 174.122.175.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) client-ip=174.122.175.66;
Authentication-Results: mx.google.com; spf=neutral (google.com: 174.122.175.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) smtp.mail=amy.lewis2333@gmail.com
Received: from [74.117.59.214] (port=2789 helo=zap-server)
by transam.websitewelcome.com with esmtpa (Exim 4.69)
(envelope-from )
id 1QFoMz-0008AO-Pq
for *****; Fri, 29 Apr 2011 09:08:33 -0500

MIME-Version: 1.0
Date: Fri, 29 Apr 2011 07:08:06 -0700
Message-ID:
X-Priority: 3 (Normal)
Subject: *****
Reply-To: amy.lewis2333@gmail.com
From: “Amy”
To: “*****”
Content-Type: multipart/alternative;
boundary=”—–_chilkat_ee1_896a_391d4019.1d15d999_.ALT”
In-Reply-To: BANLkTikfOSqJ1owwvdVPG2Wodc2TDSe3Zw@mail.gmail.com
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – transam.websitewelcome.com
X-AntiAbuse: Original Domain – gmail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – gmail.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (zap-server) [74.117.59.214]:2789

The “Received:” headers show that the message was routed through a server with the IP address 74.117.59.214 and the server transam.websitewelcome.com (174.122.175.66). The ISP for the first one is Psychz.net and the ISP for the second is ThePlanet.com, so complaints about this particular message should be sent to abuse@psychz.net and abuse@theplanet.com.

Please note: the servers used for sending any spam for Realdates.org that you yourself received might be different, so be sure to check the headers and identify the servers from the “Received:” headers before sending any complaints. You can look up the ISP for an IP address at cqcounter.com/whois/.

Cooldates.org, Safebootycall.org and Safergirls.org

Here are some messages from Amy of Cooldates.org, another CraigsSecure scam site that was just created a few days ago. This is yet another fake verification site that asks you for your credit card information and uses it to sign you up for the porn site SexxxxMatch.com. If you look at the page source for Cooldates.org, you will see that all it does is use a frame to get content from another site, Safergirls.org. Scammers often use multiple domains for a scam site in this way.

Yes I am an actual person. haha. I hope you are too.

I just wanted to say I’m not interested in any long term commitments, just some sexual activity with a capable person.

Here is a picture. I hope you like it. I would prefer not to share too much information that is personal until I get to know you. I hope you understand. Explain more about yourself..

Hi, glad to see you replied.

Here’s additional information on me, I’m completely clean. you have to be also, protection is required.

you can find me on my page, since I don’t want the risk of some body I know to see my email with all of this stuff. This is my personal page: http://www.cooldates.org

Hit me up with a private message saying when you’re free, and if you want to get to know eachother better at your place or my place, or in another place you have in mind. The site will require login and needs your credit card to verify you are legal. Well, speak with you today I hope once I get back

Let’s look at the headers for the second message. Here they are, with the recipient’s name and email address removed. Look at the parts that are highlighted.

Delivered-To: *****
Received: by 10.150.134.1 with SMTP id h1cs217972ybd;
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)
Received: by 10.236.182.197 with SMTP id o45mr4437364yhm.330.1304001219652;
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)
Return-Path:
Received: from tiguan.websitewelcome.com (tiguan.websitewelcome.com [174.120.5.66])
by mx.google.com with ESMTPS id 22si6055883yhl.249.2011.04.28.07.33.39
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 28 Apr 2011 07:33:39 -0700 (PDT)

Received-SPF: neutral (google.com: 174.120.5.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) client-ip=174.120.5.66;
Authentication-Results: mx.google.com; spf=neutral (google.com: 174.120.5.66 is neither permitted nor denied by domain of amy.lewis2333@gmail.com) smtp.mail=amy.lewis2333@gmail.com
Received: from [74.117.59.214] (port=1512 helo=zap-server)
by tiguan.websitewelcome.com with esmtpa (Exim 4.69)
(envelope-from )
id 1QFSHi-0004Xi-9u
for *****; Thu, 28 Apr 2011 09:33:38 -0500

MIME-Version: 1.0
Date: Thu, 28 Apr 2011 07:33:10 -0700
Message-ID:
X-Priority: 3 (Normal)
Subject: *****
Reply-To: amy.lewis2333@gmail.com
From: “amy”
To: “*****”
Content-Type: multipart/alternative;
boundary=”—–_chilkat_46d_7fe4_005a4654.a044ceca_.ALT”
In-Reply-To: BANLkTikfOSqJ1owwvdVPG2Wodc2TDSe3Zw@mail.gmail.com
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – tiguan.websitewelcome.com
X-AntiAbuse: Original Domain – gmail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – gmail.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (zap-server) [74.117.59.214]:1512

The sections highlighted in red and blue are the “Received:” headers. These headers, along with the “X-” headers at the bottom are the most useful ones for determining who actually sent the message. They show the various servers and email accounts that were used for sending it. Even though the sender’s address is a Gmail address, the message was routed through two other servers before it got to the Gmail server.

The “Received:” headers should be read from bottom to top. The first of them, highlighted in blue, shows that the message was first sent from a machine with the IP address 74.117.59.214 to tiguan.websitewelcome.com. Above this we have an “Authentication-Results:” header and a “Received-SPF:” header, neither of which concern us. The second of the “Received:” headers, highlighted in red, shows that the message was then sent from tiguan.websitewelcome.com (IP 174.120.5.66) to mx.google.com. So the scammer routed the message through two machines before it was received by Gmail.

Now that we know the IP addresses of the servers that were used for sending this message, we can look up the ISPs for those servers and send them complaints. A good site for looking up this information is cqcounter.com/whois/. (Note: The site CQCounter is picky about this URL. It requires that you include that very last slash in the URL, otherwise it can’t find the page.)

Using this site, we see that the ISP for 74.117.59.214 is Psychz.net and that the ISP for tiguan.websitewelcome.com (174.120.5.66) is ThePlanet.com. The email addresses to which you should send complaints then are abuse@psychz.net and abuse@theplanet.com.

UPDATE 5/18/11
Someone has reported another site being used for this scam: Safebootycall.org. Just like Cooldates.org, Safebootycall.org loads its content from Safergirls.org in a frame. The ISP for Safebootycall.org is Netelligent. If you receive a scam email asking you to visit this site, then send a complaint to abuse@netelligent.ca. Also send a complaint to the ISP that was used for sending you the scam email. To learn how to do this, read our instructions on sending complaints to ISPs..

UPDATE 5/10/11
Beasafedate.org is also being used for the scam. It loads its contents from Safergirls.org, just like the other sites mentioned.

Casualmeetup.com

“Kayla B” is promoting Casualmeetup.com, another fake dating site.

Click to enlarge

This is one of the messages she’s sending out using the email address sweetpeppy1@gmail.com:

hey again,

you sound pretty cool and i’m definitely interested in meeting up with you.. i gotta work tomorrow and will get home around 3-4 and it would be awesome to meet up after that.. we can grab a drink and see how we connect.. to get my number just go to http://www.casualmeetup.com and look up
“sexcbebe5940” .. my number will be right on the first page.. they never charge you or anything, they just verify to make sure you aren’t a rapist or anything, you know a girl can never be too careful

As usual, you’re told that this is a free verification service that Kayla B (who doesn’t exist, of course) would like you to use before she meets you. After you fill out the first sign up form, you get taken to this page at join.securepaypass.com:

Click to enlarge

Here is the fine print on the page. It’s not visible in the above picture but can be found near the bottom of the page.

(**) Your free access to http://www.discreethoneys.com includes $1.25 for 1 day trial to xxxboobs4u.com. To avoid being charged a monthly fee, simply cancel your memberships to xxxboobs4u.com before the trial period ends. If you remain a member beyond the trial period, your membership will renew at $49.81/month respectively, or then applicable rate until cancelled. Your free access to http://www.discreethoneys.com remains active even if you cancel your xxxboobs4u.com membership.
(+) Your FREE VIP bonus membership includes $38.97 for 30 days trial membership to megasitearchive.com and $1.00 for 5 days trial membership to justporno.com, renewing at $38.97/month and $39.99/month respectively, until cancelled.

So, once again, there is no verification service, this site Casualmeetup.com is a scam used to fool you into signing up for porn sites. In this case those porn sites are discreethoneys.com and xxxboobs4u.com. If you’re tired of receiving this sort of crap and would like to see this site shut down, then forward the email message you received to abuse@savvis.net. Be sure to let Savvis know that Casualmeetup.com has been confirmed to be a scam site and send them a link to this post.

UPDATE 5/4/11
We’ve received another message promoting this site. This one was sent using the address michsanch@gmail.com. This email address was also used for the Kayla B. scam reported in January .

hey again,

you sound pretty cool and i’m definitely interested in meeting up with you.. i gotta work tomorrow and will get home around 3-4 and it would be awesome to meet up after that.. we can grab a drink and see how we connect.. to get my number just go to http://www.casualmeetup.com/1 and look up
“sexcbebe5940” .. my number will be right on the first page.. they never charge you or anything, they just verify to make sure you aren’t a rapist or anything, you know a girl can never be too careful

UPDATE 5/8/11: The email address sweetpeppytwo@gmail.com is also being used for this scam.

Clistsafe.com

Clistsafe.com is a clone of Clsafe.com, a site we’ve already reported. This site does not provide any sort of dating verification service, it has no members, and there are no people on it to meet. It is a scam used to fool you into signing up for the porn site SexxxxMatch.com. After you fill out the sign-up form on Clistsafe.com, you get taken to a page on secure.i-promotions.net:

Click to enlarge

This is the fine print on the order form above:

+ You are entitled to free lifetime access as a basic member without any charge or further participation. Additionally, free premium access* will be granted at no charge provided you complete an online profile and confirm your information within two days, otherwise this membership will recur monthly at 39USD until cancelled.

Clistsafe.com is hosted by LeaseWeb. Forward any scam messages you receive for that site to abuse@leaseweb.com and make sure to mention that Clistsafe.com is known to be a scam site. Be sure to include a copy of the message headers.

UPDATE, 4/25: One of the fake identities used for this scam is Vicky Lattore and her profile page on the site is http://www.clistsafe.com/profiles/vickyyy1/
Another of the fake identities is Diana Richardson who has this profile
http://clistsafe.com/profiles/dia99

Clsafe.com

The site Clsafe.org that was shut down has been replaced with Clsafe.com. One of the fake names being used in the scam messages is Diana Richardson.

Clsafe.com is hosted by LeaseWeb. Forward any scam messages you receive for that site to abuse@leaseweb.com and make sure to mention that Clsafe.com is known to be a scam site. Be sure to include a copy of the message headers.

UPDATE 4/25: Another name being used for this scam is Vicky Lattore. See the comments below.

Craigssafedating.com

Thanks to EJA for letting us know that yet another site has been created for the Jeni Saten scam. The site is Craigssafedating.com.



Craigssafedating.com is being hosted by Leaseweb.com. If you’d like to help get this site shut down, then forward the messages you received from Jeni/Jenni/Jenn along with the message headers to abuse@leaseweb.com. Instructions for finding email message headers are available at spamheaders.com. In your message, be sure to explain that craigssafedating.com is a known scam site. It might also help to provide links to these posts:

https://craigslistscams.wordpress.com/2011/04/03/craigssafedating-com
https://craigslistscams.wordpress.com/2011/01/21/craigslistdatesafely-com
https://craigslistscams.wordpress.com/2011/02/07/craigslist-date-safe-org