Livesafetoday.net has been shut down

Livesafetoday.net and all of the other sites that were associated with the fake hosting company Global-host.org

easydatingnet.org
freemail4you.org
global-host.org
myprivatemailbox.net
onesinglesnet.net
safe2day.net
send2mail.org
send3me.net
wktv5newsalerts.com
zmails.org

have been shut down. The ISP for these sites is Ecatel, a company that pretty much ignores complaints. They were shut down on February 8th, soon after the following message was sent to Ecatel.

By the way, it’s clear that the person who owns these sites is Christopher Lawell, the person who owned mysafenet.net and localsafe.org, which were also on Ecatel servers. (http://craigslistdatingscams.blogspot.com/2010/12/christopher-lawell-and.html) Let Mr. Lawell know that he should shut down his current scam sites if he wants to avoid further embarrasment.

Yes, these sites are owned by Chris Lawell a.k.a VegasChris, the man who sells the e-whoring chat bot Miyabot and who ran the scam sites localsafe.org and safeandlocal.org. After he was informed that we knew he owned the sites, he shut them down himself. Ecatel did not suspend his account, because if that had happened, then the sites would still have been up but displaying a message saying that the account had been suspended.

For now we’re not going to publish the evidence that led us to the conclusion that Chris Lawell is the owner of these sites. We’re not interested in helping him become a better scammer, so if he wants to know how we discovered this information, he’ll have to figure that out for himself. Perhaps if he decides to stop remaining silent we’ll provide some details, but he’s obviously never going to do that since the last time he tried defending himself he gave a story which we showed to be false. He prefers to just remain silent and avoid embarrassing himself again.

Asaferdate.org (Livesafetoday.net)

Recently, someone received this cryptic message from Chelette Dullen (cheletterfiw@hotmail.com) in response to a m4w ad that he placed on Craigslist.

length into self Theyf

That was it. Being curious, he replied to her and he then received this message from Hilde Hearst (hildehearst217@yahoo.com) along with a photo.

Hey there. We are a very fun couple looking for some fun with a bi guy :) Race is no big to us, we are both caucasian, but we welcome everyone :) I am 32 and he is 22, so anyone in that age range is welcome :)

 

So he played along and sent a message to amy@zmails.org. He got a reply from “~ amy :-)” (phylabespectacledfa@gmail.com) asking him to visit asaferdate.org.

Hey, Im very happy ur for real! I have had a horrible time meeting some one normal to hookup with. You appear to be the kind of guy i’d really love to get to know.

I’m trying to arrange a NSA arrangement. I assume that is what you are here for also. I don’t do this often, but having recently gotten out of a 5 year relationship.

If you’re interested in meeting with me, I have only got one requirement. I had a really scary experience with a guy once so I am requiring you to register here for my peace of mind. Theres no cost and it will just ensure I can enjoy my time with you and not be nervous when we meet. I just want to have good time and if you can’t do this for me, then it won’t be any fun and I’d appreciate it if you just didn’t contact me back.

If this sounds good to you, just go here:
http://asaferdate.org Fill out a username and send me your profile details. I can then private message you to make plans. My contact info is on there along with some photos and even a video message I made.

I hope to meet you soon. Im really excited to meet someone new.

Amy

This site, like safenetdate.com which was reported here on February 2nd, has just a frame that loads a page from the fake dating site Livesafetoday.net which was reported here on December 1st. It’s the same page, as a matter of fact: livesafetoday.net/id-amy1102.

UPDATE 2/7/11
Livesafetoday.net and zmails.org both have IPs administered by Ecatel. If you’d like to help get these sites shut down, then send a complaint to abuse@ecatel.net. Forward them the message you received along with the message headers.

Asaferdate.org has an IP administered by Netelligent. To get that site shut down, send a complaint to abuse@netelligent.ca. Forward them the message you received along with the message headers.

Instructions on how to view message headers are available at spamheaders.com.

Messages from Amy of Livesafetoday.net and Safenetdate.com

A report on the fake dating site Livesafetoday.net was posted on December 21st, 2010. Here are some sample messages you receive from “Amy” who supposedly has a profile on that site.

Delivered-To: **********
Received: by 10.229.25.15 with SMTP id x15cs294686qcb;
Tue, 1 Feb 2011 19:10:29 -0800 (PST)
Received: by 10.204.71.141 with SMTP id h13mr7580074bkj.180.1296616228078;
Tue, 01 Feb 2011 19:10:28 -0800 (PST)
Return-Path:
Received: from mailout-eu.gmx.com (mailout-eu.gmx.com [213.165.64.42])
by mx.google.com with SMTP id j10si51971927bka.45.2011.02.01.19.10.27;
Tue, 01 Feb 2011 19:10:28 -0800 (PST)
Received-SPF: pass (google.com: domain of ilene62024@gmx.us designates 213.165.64.42 as permitted sender) client-ip=213.165.64.42;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of ilene62024@gmx.us designates 213.165.64.42 as permitted sender) smtp.mail=ilene62024@gmx.us
Received: (qmail invoked by alias); 02 Feb 2011 03:10:25 -0000
Received: from NSG-Static-074.33.72.182.airtel.in (EHLO hf4fi488ce) [182.72.33.74]
by mail.gmx.com (mp-eu001) with SMTP; 02 Feb 2011 04:10:25 +0100
X-Authenticated: #70993414
X-Provags-ID: V01U2FsdGVkX1/FL4cmNALFb4BOIqAZqU/GY4+gHB9Aq6Mbfi+G3v
TtHDDLdQWr3ogX
MIME-Version: 1.0
Date: Tue, 01 Feb 2011 19:09:57 -0800
X-Priority: 3 (Normal)
Content-Transfer-Encoding: quoted-printable
Subject: Re:
Content-Type: text/plain
From: “Amy”
To: “*****”
X-Mailer: Opera/6.05 (Windows 2000;
U) [fi]
Message-ID:
X-Y-GMX-Trusted: 0

Hey,

I am very excited ur not fake! I’ve had the hardest time finding some body normal to meet. You appear to be the kind of guy I would really like to get to know.
i am trying to find a no strings arrangement. I assume that is what you are looking for as well as. I don’t do this much, but having recently gotten out of a 3 year relationship.

If ur interested in meeting with me, I only have one requirement. I had a kinda scary situation with a guy once so i am requiring you to register here for my peace of mind. Theres no cost and it will just make sure I can enjoy my time with you and not be concerned when we hookup. I just want to have some fun and if you can’t do this for me, then I won’t have any fun and I’d appreciate it if you just didn’t contact me again.

If this sounds reasonable to you, just go here:

http://n2z7321z.safenetdate.com

Fill out a username and send me your profile info. I can then private message you to make plans. My contact info is on there along with some photos and even a video message I made.
I hope to see you soon. i am really excited to meet some body new.

amy

Delivered-To: **********
Received: by 10.151.109.12 with SMTP id l12cs178937ybm;
Tue, 1 Feb 2011 20:11:01 -0800 (PST)
Received: by 10.42.230.1 with SMTP id jk1mr10734117icb.67.1296619861152;
Tue, 01 Feb 2011 20:11:01 -0800 (PST)
Return-Path:
Received: from mailout-us.gmx.com (mailout-us.gmx.com [74.208.5.67])
by mx.google.com with SMTP id s15si54910icd.22.2011.02.01.20.11.00;
Tue, 01 Feb 2011 20:11:01 -0800 (PST)
Received-SPF: pass (google.com: domain of osgood610@gmx.com designates 74.208.5.67 as permitted sender) client-ip=74.208.5.67;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of osgood610@gmx.com designates 74.208.5.67 as permitted sender) smtp.mail=osgood610@gmx.com
Received: (qmail invoked by alias); 02 Feb 2011 04:10:58 -0000
Received: from 109-227-255-123.nts.su (EHLO hf4fi488ce) [109.227.255.123]
by mail.gmx.com (mp-us005) with SMTP; 01 Feb 2011 23:10:58 -0500
X-Authenticated: #70989690
X-Provags-ID: V01U2FsdGVkX18ocH0a2QYo6GsCNVLXcrI6qVl0XSCBNd2CU6pED8
06lLxYB8o+yybZ
MIME-Version: 1.0
Date: Tue, 01 Feb 2011 20:09:56 -0800
X-Priority: 3 (Normal)
Content-Transfer-Encoding: quoted-printable
Subject: Re:
Content-Type: text/plain
From: “Amy”
To: “**********”
X-Mailer: Mozilla 4.7 [en]C-CCK-MCD NSCPCD47 (Win98;
I)
Message-ID:
X-Y-GMX-Trusted: 0

Hi,

I’m really glad ur real! I’ve had a really hard time finding some body normal to meet. You appear to be the kind of guy I would love to get to know.
I am trying to arrange a friends with benefits arrangement. I take it that is what you are looking for also. I don’t do this often, but having recently gotten out of a 4 year relationship.

If ur still interested in meeting with me, I only have one requirement. I had a very scary situation with a guy once so I am requiring you to register here for my peace of mind. There’s no cost and it will just ensure I can enjoy my time with you and not be concerned when we see each other. I just want to have some fun and if you won’t do this for me, then I won’t have any fun and I’d appreciate it if you just didn’t contact me again.

If this sounds acceptable to you, just go here:

http://x6f8865y.safenetdate.com

Fill out a profile and send me your profile info. I can then private message you to make plans. My contact info is on there along with some photos and even a video message I made.
I hope to meet you soon. I am really excited to meet some body new.

amy

Notice a couple things here. The links in the messages are not to livesafetoday.net but to subdomains of safenetdate.com:

x6f8865y.safenetdate.com
n2z7321z.safenetdate.com

The subdomain is probably an automatically generated random string of characters used to identify the site’s visitors and maybe to make it harder to find information on the site by searching the web. Right now, if you search for safenetdate.com on Google you get results. But at right this moment as I’m typing this you find no results for x6f8865y.safenetdate.com. Having a new, random string of characters added to the beginning of the domain name prevents people from getting any search results when they search for the full domain name stated in the email because there will be no web pages out there about safenetdate.com that contain that random text. This prevents people from finding reports that safenetdate.com is a scam.

Once you visit safenetdate.com or one of the subdomains you are actually viewing the site livesafetoday.net. All that safenetdate.com consists of is some rudimentary HTML with a frame that loads a page from that other site. In both of the examples above, the content comes from livesafetoday.net/id-amy1102/.

LiveSafeToday.net

Another dating verification scam site has been discovered. The site is LiveSafeToday.net.

LiveSafeToday.net (Click to enlarge)

See where it says “The SAFEST way to meet people online in [Your location]” in the top right corner of the page? The site uses IP location technology to get your approximate location and display it where [Your location] is. The verification form in the bottom right corner is used to get you to sign up for the porn site DiscreetHoneys.com, not LiveSafeToday.net. It is in a separate frame and the code comes from join.securepaypass.com. Also, notice that in the top left corner there are the words “Craigslist Safe” in big blue letters.

Although it says in the bottom left of the page that they have “successfully verified thousands of users since August, 2008”, The site has only been in existence since December 3, 2010, as you can see by looking it up at who.is.

REGISTRY WHOIS FOR LIVESAFETODAY.NET

Domain Name: livesafetoday.net 
Updated: 3 seconds ago  Refresh 

Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Status: clientTransferProhibited

Expiration Date: 2011-12-03
Creation Date: 2010-12-03
Last Update Date: 2010-12-04

Name Servers:
    ns1.global-host.org
    ns2.global-host.org
See livesafetoday.net DNS Records

The name servers for the site are ns1.global-host.org and ns2.global-host.org and the SOA record for the site shows that the DNS server administrator for its zone is admin@global-host.org.

LIVESAFETODAY.NET SOA RECORD

Name Server ns1.global-host.org
Email admin@global-host.org
Serial Number 2010120803
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

Global-host.org is a fake hosting company. Its home page consists simply of a design template for a hosting company. Another site with this template is rcchost.com. Also, the site global-host.org was just created on November 19th, 2010.

Global-host.org is a fake hosting company.

The IP for LiveSafeToday.net is 93.174.94.138 and the IP for Global-host.org is 93.174.94.133. Both of these IPs are owned by Ecatel.