Livesafetoday.net has been shut down

Livesafetoday.net and all of the other sites that were associated with the fake hosting company Global-host.org

easydatingnet.org
freemail4you.org
global-host.org
myprivatemailbox.net
onesinglesnet.net
safe2day.net
send2mail.org
send3me.net
wktv5newsalerts.com
zmails.org

have been shut down. The ISP for these sites is Ecatel, a company that pretty much ignores complaints. They were shut down on February 8th, soon after the following message was sent to Ecatel.

By the way, it’s clear that the person who owns these sites is Christopher Lawell, the person who owned mysafenet.net and localsafe.org, which were also on Ecatel servers. (http://craigslistdatingscams.blogspot.com/2010/12/christopher-lawell-and.html) Let Mr. Lawell know that he should shut down his current scam sites if he wants to avoid further embarrasment.

Yes, these sites are owned by Chris Lawell a.k.a VegasChris, the man who sells the e-whoring chat bot Miyabot and who ran the scam sites localsafe.org and safeandlocal.org. After he was informed that we knew he owned the sites, he shut them down himself. Ecatel did not suspend his account, because if that had happened, then the sites would still have been up but displaying a message saying that the account had been suspended.

For now we’re not going to publish the evidence that led us to the conclusion that Chris Lawell is the owner of these sites. We’re not interested in helping him become a better scammer, so if he wants to know how we discovered this information, he’ll have to figure that out for himself. Perhaps if he decides to stop remaining silent we’ll provide some details, but he’s obviously never going to do that since the last time he tried defending himself he gave a story which we showed to be false. He prefers to just remain silent and avoid embarrassing himself again.

LiveSafeToday.net

Another dating verification scam site has been discovered. The site is LiveSafeToday.net.

LiveSafeToday.net (Click to enlarge)

See where it says “The SAFEST way to meet people online in [Your location]” in the top right corner of the page? The site uses IP location technology to get your approximate location and display it where [Your location] is. The verification form in the bottom right corner is used to get you to sign up for the porn site DiscreetHoneys.com, not LiveSafeToday.net. It is in a separate frame and the code comes from join.securepaypass.com. Also, notice that in the top left corner there are the words “Craigslist Safe” in big blue letters.

Although it says in the bottom left of the page that they have “successfully verified thousands of users since August, 2008”, The site has only been in existence since December 3, 2010, as you can see by looking it up at who.is.

REGISTRY WHOIS FOR LIVESAFETODAY.NET

Domain Name: livesafetoday.net 
Updated: 3 seconds ago  Refresh 

Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Status: clientTransferProhibited

Expiration Date: 2011-12-03
Creation Date: 2010-12-03
Last Update Date: 2010-12-04

Name Servers:
    ns1.global-host.org
    ns2.global-host.org
See livesafetoday.net DNS Records

The name servers for the site are ns1.global-host.org and ns2.global-host.org and the SOA record for the site shows that the DNS server administrator for its zone is admin@global-host.org.

LIVESAFETODAY.NET SOA RECORD

Name Server ns1.global-host.org
Email admin@global-host.org
Serial Number 2010120803
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

Global-host.org is a fake hosting company. Its home page consists simply of a design template for a hosting company. Another site with this template is rcchost.com. Also, the site global-host.org was just created on November 19th, 2010.

Global-host.org is a fake hosting company.

The IP for LiveSafeToday.net is 93.174.94.138 and the IP for Global-host.org is 93.174.94.133. Both of these IPs are owned by Ecatel.

Correction

I looked at the email messages one more time and I realize that I made a mistake regarding the one of the dates. The email message sent to Ecatel and cli-us.com that mentioned Christopher Lawell was sent on November 17th, not November 18th. So the sites would have been shut down and Chris’s LinkedIn resume would have been hidden on that day, too. I’ve gone ahead and fixed this error in my previous posts. This is the email message that was sent.

MIME-Version: 1.0
Received: by 10.14.119.135 with HTTP; Wed, 17 Nov 2010 12:31:13 -0800 (PST)
Date: Wed, 17 Nov 2010 14:31:13 -0600
Delivered-To: ***@***.com
Message-ID:
Subject: Spam again
From: ****
To: abuse@theplanet.com, abuse@ecatel.net
Cc: finishlinehosting@cli-us.com
Content-Type: multipart/alternative; boundary=0016e65b5e60e9df9f0495458ddc

–0016e65b5e60e9df9f0495458ddc
Content-Type: text/plain; charset=ISO-8859-1

You’ve sent me more of this spam. Shouldn’t these sites be shut down?
They’ve been reported as scam sites by lots of different people over the
past year. These are just some of the reports.


http://www.broadbandreports.com/forum/r23659525-craigslistsafesafeandlocalorg-scam-site-or-not
http://www.siteadvisor.com/sites/safeandlocal.com/msgpage
http://www.siteadvisor.com/sites/localsafe.org/msgpage
http://stopclfraud.blogspot.com/2010/09/heres-cheri-xoxo-again.html?zx=ccd6a1d877c1ffc0

The email address used for sending the messages was starred out. It appears odd that it shows up in the Delivered-To field and not just the From field, but this is nothing unusual. These are the message headers for a copy of a sent message that is given to the sender, not the copy that is delivered to the recipient. Gmail puts the sender’s address in the Delivered-To field in the sender’s copy because this is a copy of the message that was delivered to him by Gmail.

And once again, I’d like to reiterate a very important point. Outside of the email messages sent to the ISPs and cli-us.com and outside one post on this blog on November 17th no mention of Christopher Lawell in connection to the scam was made anywhere until after he hid his personal information. His claim that he hid that information because there was a campaign against him is completely false. It was hidden and the scam sites were shut down when the message above was sent. If he has evidence of this campaign, then let him show it to us.

Reply to Christopher Lawell’s New Comments

1. I see. Then how did you find out about this blog at all? Messages were sent about all this to cli-us.com and to Ecatel. How did the person who brought this blog to your attention find out about it, if not through those email messages?

2. Wrong. They are calm, analytical, they look at the evidence presented, and all that evidence points to you being guilty. They state that it strongly suggests that you are guilty but that that has not been proven yet. You could have straightened things out but you didn’t.

3. Wrong again. Again, you pretend that what was written at broadbandreports.com was some sort of attack on you but it wasn’t. Something like this

That’s less than two months ago. It uses a model, with hints of sex, as a lure.

There is another site “craigslistsafe.safeandlocal.net” with an almost identical page, registered just one month earlier. The main difference is that it uses a different model as a lure.

They want your credit card information.

Personally, I would not have anything to do with the site. I would be concerned that they might really be in the business of stealing credit information. It is wiser to deal only with businesses that have a well established reputation.

doesn’t accuse you of anything. Your name comes up only in the presentation of the registration information. You could have posted a note saying that the site wasn’t actually yours and no one would have bothered you about it.

After reading your letter [it can be found on his website] I thought that I should give you the benefit of the doubt. But after looking at your explanations more closely, we see that they do not explain things well at all. They don’t agree with the facts, or are inconsistent, or are implausible, or incomplete and avoid the real issues.

  1. You say you took down your logo and hid your LinkedIn profile because someone brought to your attention several days ago the campaign against you. The fact is that you hid your personal information on November 17th, at the same time that the scam sites were shut down, which was promptly in response to messages sent to cli-us.com and Ecatel showing that your name had been implicated in all this. There was no campaign against you, as you claim. There was just a post that mentioned you on this blog and some email messages that were sent to ISPs and cli-us.com. I defy you to find any other mention of you being involved with the scam that was made before you hid your personal information. We’re supposed to believe that someone you know came across this blog, told you about it, and you just by chance decided to hide your information at the same time that the scam sites were shut down, which was soon after those email messages were sent, and that you did this because of a “campaign” against you that didn’t exist? Your claims just don’t agree with the facts. 
  2. You totally mischaracterize the nature of the discussion of SafeAndLocal.org at Broadbandreports. No one in that discussion was attacking you at all. The thread is brief and the people that took part in it simply talked about whether or not the site was legitimate. More importantly, the story that you give about your involvement with SafeAndLocal.org makes no sense. You write:…they already were working on a web design so I registered the domain he asked for with my Go Daddy account and set up a hosting account for him. I figured, why not, it’s an easy $20. I was notified at a later date by HostGator (my webhost) that he was violating our terms of service and I promptly canceled his account and refused to refund any money. He hassled me for some time and I blocked him on IM and email and he went away., or so I thought. When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request.

    If you canceled his account when you say you did, then the site would have been dead by the time the thread on Broadbandreports was created; there wouldn’t have been any SafeAndLocal.org for people to discuss. Since you were the one who registered the domain, you controlled it and no one else could have used it. If the thread on Broadbandreports was posted after you terminated your client’s account, then the only way that SafeAndLocal.org would have been still up and running would have been if you had been operating it. Your explanation here is logically inconsistent. It makes no sense.

    If instead you had found out about the TOS violations and had suspended your client’s account after the thread was started (which is not what you say), then you could have simply posted a short note in the thread stating that the site was actually run by one of your clients and that you had terminated his account once it was discovered that it was a scam. There was nothing preventing you from doing that. You were afraid that people would attack you for that? That’s absurd, just like the idea that you had to have the thread deleted.

  3. Concerning the email address finishlinehosting@cli-us.com, you first try to twist the facts and make this an issue about registration information (which is easy to fake) when it is actually an issue concerning SOA records (which are impossible to fake unless you have access to DNS servers). You say that I base my argument that you were involved in the scam on the fact that a cli-us.com address was used for registering the domains. That is wrong. It was not used for registering the domains and I never said that it was. I know that registration data is easy to fake so I wouldn’t jump to any conclusions based upon it. (As a matter of fact, in this case, the registration information for all of the sites involved in the scam was hidden using Whois privacy protection, so it was of no use.) What we’re talking about here are the SOA records, which only a DNS server administrator would have access to. They are not data that any old person can specify when registering a domain. They aren’t even specified when purchasing a domain but afterwards when the website is actually set up and connected to the Internet.Second, if someone wanted to get back at you for suspending his account by using a cli-us.com email address for his scam site, then he would have put that address in the registration information, not the SOA record (which he wouldn’t have even had had access to unless he had access to the DNS server). The registration information is what you see when you do a whois query. The SOA record, on the other hand, is accessed via a different query and it is usually only looked at by system administrators, the general public has no interest in it. Your explanation about how a cli-us.com email address got used for the SOA records is implausible.
  4. Those articles you wrote show that you have a lot of experience spamming Craigslist. Inundating Craigslist with ads is how the people who run these dating verification scam sites very often work. You dismiss the articles by saying that they just formed a brief attempt at article marketing and you ignore their conent. That content says a lot about the sort of business practices you use. Using multiple IP addresses and email addresses to get around Craigslist’s anti-spam safeguards is underhanded and a violation of Craigslist’s TOS. Your explanation here is incomplete and avoids the real issues.

Your explanations don’t explain things at all. They misstate the facts, ignore the facts, are logically inconsistent, or simply implausible. You keep pushing this idea that you ignored everything and hid your personal information because you didn’t want to “fuel the fire”, but I’ve already shown there was no fire to fuel, not on November 17th when you hid your personal information, and not back in January when that thread on Broadbandreports was created. Your name wasn’t mentioned on this blog in regards to the scam until November 17th, and it wasn’t metioned elsewhere until after you hid your personal information. The truth appears to be that you preferred to hide your personal information and ignore everything until you weren’t able to ignore it anymore because certain people found out about it. If you now want to ignore all of the facts presented here once again, go ahead. I don’t plan to tell you anything about myself because I know better than to give out my real name when I investigate Internet fraud. Go to aa419.org or antifraudintl.org and tell the people there how unfair it is that they don’t reveal their real names when they post about scam sites and suspected scammers. They’d laugh at you. In any case, who I am is irrelevant, all that matters are the facts and the facts don’t look good for you.

Some More Questions For Chris Lawell

Chris, up until Friday, the SOA records for the scam sites all listed the email address for their DNS zone administrator as finishlinehosting@cli-us.com. But on Friday, the day that you responded to the allegations made against you, the SOA records for all of these sites except finishlinehosting.com were deleted. Could you explain how that happened?

You can view the DNS records by visiting

http://who.is/nameserver/ns1.finishlinehosting.com/

and clicking on the DNS links in the More Information column in the table.

Also, it is very important to note that we are discussing SOA records here, not registration information. You say in your letter that anyone can use any email address when registering a domain. True, you can pick any fake email address for the registration information and if the registrar or hosting service doesn’t bother to check it out, then it will end up going into the registration databases. But we’re not talking about registration data here, we’re talking about SOA records. These are records that are created by the administrators of DNS servers. You can’t fake this data unless you have access to the DNS server in question. The DNS server would in this case most likely have been controlled by a hosting company or the ISP Ecatel. It appears that it was controlled by Finishline Hosting (which looks like a pretend hosting company), which means that it would have been involved in the scam, too. Again, what do you know about Finishline Hosting?

Regarding this:

The only thing I am guilty of is being naive 3 years ago and writing about posting on CL as an attempt at article marketing.

Article marketing, that’s all? So you weren’t obviously instructing people on how to spam Craigslist?

Craigslist can be tricky to post multiple ads in one day so here are some easy tips to post successfully on Craigslist.

First, it takes a lot of ads posted daily to list build fast.

You should post a minimum of 30-50 a day.

Here is how to post a lot of ads…

You need a way to change your IP address (your connection to the internet that determines where you are located).

You need a lot of subdomains that are setup to forward to your website(s).

You need a lot of email addresses (I use Gmail.com)

I have found that you can post about 10-15 ads with the same IP, email address and subdomain.

Do more than that, and you run the risk of all your ads being deleted.

That is why I use this submission software… CL Autoposter

Using multiple email addresses and multiple IP addresses to avoid having your numerous ads flagged and using automated ad submission software that helps you change your identity, those are tricks to avoid having your spam flagged.

Message to Christopher Lawell

Chris,

Thank you for contacting me. I read your reply at ChristopherLawell.com and there are a few things about it that bother me.

To begin with, you say that no one ever contacted you about the scam sites. Well, we know that at least two complaints were sent about the scam sites to finishlinehosting@cli-us.com, and that there were many complaints sent to Ecatel prior to those complaints, too. The first known complaint sent to this address was sent on November 14th. The complaints were sent to that address at cli-us.com because that was the only business contact address that was then available. No replies to those complaints were ever received. It was only after a further complaint was made on November 17th, one that mentioned that the site SafeAndLocal.org was registered in your name and that finishlinehosting@cli-us.com was the address for the DNS administrator for the recent scam sites, that the scam sites were promptly taken down.

At the same time, on November 17th, just a few hours after this new complaint was made, you removed your company’s logo from your website and hid your LinkedIn profile. There was no campaign against you as you claim, there were just some postings on this blog that mentioned the web pages that linked your name to the scam sites. Read these postings. Do they amount to character assassination? No, they don’t. They plainly present facts that strongly pointed to you being involved in the scams. They leave open and acknowledge that it is possible that the scammer was merely a client of yours or someone else entirely. (And, as a matter of fact, before coming across the cli-us.com address, there was another person that we believed was behind the sites.) The fact that you hid your personal information at the same time that the sites got shut down, along with the fact that the sites did not get shut down until it was revealed that your name was linked to them, was very suspicious, you must admit.

I know that you don’t care to answer any questions about this, but would you be so good as to answer these?

1) Why were there no replies to the messages sent to finishlinehosting@cli-us.com? Is it not a valid email address? If it isn’t, then there should have been an error message sent back from your website. No replies including error messages were ever received, so it must be a valid email address. If it is a valid email address, then what is your relationship with finishlinehosting?

2) As I said, on November 17th, the day that you hid your personal information, the only public postings made on the internet regarding this matter were the ones you see on this blog. They are calm and rational, analytical. You could have easily posted something here regarding the matter. There was no fire for you to fuel. So why didn’t you post anything?

3) Likewise, concerning SafeAndLocal.org, you write

When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request. They are obviously more concerned about freedom of speech even if it is inaccurate and damaging to innocent people than posting accurate content. I didn’t address this on the forum as I felt most people would want to believe the worst and it would only serve to fuel the fire.

However, there was no fire to fuel. There is no complaint in that thread on BroadbandReports.com. The thread was started by someone who wanted some advice. He wasn’t sure that SafeAndLocal.org was a legitimate dating site, and he wanted other people’s help on figuring that out. There was no hostility or any words at all for that matter that were directed to you or about you. As a matter of fact, the way that your name ended up being mentioned was that someone wanted to point out that the site had only been registered a couple months earlier, and he showed this by posting the registration information in its entirety. The discourse in that thread was calm and reasonable; saying that you didn’t just go ahead and post an explanation in it because you didn’t want to fuel the fire makes no sense: there was no fire to fuel. You could have easily just posted a note saying that you had registered the site for a client and that you had terminated that client’s account; there was nothing for you to be afraid of and there was no reason why you would have needed the thread to have been deleted. So could you explain why you didn’t just do that?

I would really like it if you could answer these questions. In your letter you say:

I am going to address your statements this one time. I will not fuel the fire by entering into a debate. 

As I’ve repeatedly said, there is no fire for you to fuel. We can calmly and rationally discuss this matter, so why don’t you want do that? I’d really like to find these scammers, and I’m sure that you’d like to see them brought to justice too seeing as they’ve implicated you in all this. If you give us the information that you have about them, even if it’s old, it could help us track them down. So why don’t you just talk to us and answer the questions that we have? I am sending an email message to chris@cli-us.com informing you of this post and I hope to hear from you again.

P.S. Christopher Lawell posted several comments on this blog. They all said the same thing, “Please read my full response here: http://www.christopherlawell.com”, so I’ve deleted all but one of them. That is the only reason I deleted his comments, because they were redundant.