Servers Used For Localsafe.org Scam Now Dead

Archangelwebdesign.info has been shut down and is not mapped to any IP address. Also, the finishlinehosting.com domains:

b8mail.com
safe4mail.org
mail4now.net
mail4time.org
mysafenet.net
safe-local.net
localsafe.org

are dead. They are no longer mapped to IP addresses. Finishlinehosting.com itself is still up, however, with a blank homepage as before.

Correction

I looked at the email messages one more time and I realize that I made a mistake regarding the one of the dates. The email message sent to Ecatel and cli-us.com that mentioned Christopher Lawell was sent on November 17th, not November 18th. So the sites would have been shut down and Chris’s LinkedIn resume would have been hidden on that day, too. I’ve gone ahead and fixed this error in my previous posts. This is the email message that was sent.

MIME-Version: 1.0
Received: by 10.14.119.135 with HTTP; Wed, 17 Nov 2010 12:31:13 -0800 (PST)
Date: Wed, 17 Nov 2010 14:31:13 -0600
Delivered-To: ***@***.com
Message-ID:
Subject: Spam again
From: ****
To: abuse@theplanet.com, abuse@ecatel.net
Cc: finishlinehosting@cli-us.com
Content-Type: multipart/alternative; boundary=0016e65b5e60e9df9f0495458ddc

–0016e65b5e60e9df9f0495458ddc
Content-Type: text/plain; charset=ISO-8859-1

You’ve sent me more of this spam. Shouldn’t these sites be shut down?
They’ve been reported as scam sites by lots of different people over the
past year. These are just some of the reports.


http://www.broadbandreports.com/forum/r23659525-craigslistsafesafeandlocalorg-scam-site-or-not
http://www.siteadvisor.com/sites/safeandlocal.com/msgpage
http://www.siteadvisor.com/sites/localsafe.org/msgpage
http://stopclfraud.blogspot.com/2010/09/heres-cheri-xoxo-again.html?zx=ccd6a1d877c1ffc0

The email address used for sending the messages was starred out. It appears odd that it shows up in the Delivered-To field and not just the From field, but this is nothing unusual. These are the message headers for a copy of a sent message that is given to the sender, not the copy that is delivered to the recipient. Gmail puts the sender’s address in the Delivered-To field in the sender’s copy because this is a copy of the message that was delivered to him by Gmail.

And once again, I’d like to reiterate a very important point. Outside of the email messages sent to the ISPs and cli-us.com and outside one post on this blog on November 17th no mention of Christopher Lawell in connection to the scam was made anywhere until after he hid his personal information. His claim that he hid that information because there was a campaign against him is completely false. It was hidden and the scam sites were shut down when the message above was sent. If he has evidence of this campaign, then let him show it to us.

Reply to Christopher Lawell’s New Comments

1. I see. Then how did you find out about this blog at all? Messages were sent about all this to cli-us.com and to Ecatel. How did the person who brought this blog to your attention find out about it, if not through those email messages?

2. Wrong. They are calm, analytical, they look at the evidence presented, and all that evidence points to you being guilty. They state that it strongly suggests that you are guilty but that that has not been proven yet. You could have straightened things out but you didn’t.

3. Wrong again. Again, you pretend that what was written at broadbandreports.com was some sort of attack on you but it wasn’t. Something like this

That’s less than two months ago. It uses a model, with hints of sex, as a lure.

There is another site “craigslistsafe.safeandlocal.net” with an almost identical page, registered just one month earlier. The main difference is that it uses a different model as a lure.

They want your credit card information.

Personally, I would not have anything to do with the site. I would be concerned that they might really be in the business of stealing credit information. It is wiser to deal only with businesses that have a well established reputation.

doesn’t accuse you of anything. Your name comes up only in the presentation of the registration information. You could have posted a note saying that the site wasn’t actually yours and no one would have bothered you about it.

After reading your letter [it can be found on his website] I thought that I should give you the benefit of the doubt. But after looking at your explanations more closely, we see that they do not explain things well at all. They don’t agree with the facts, or are inconsistent, or are implausible, or incomplete and avoid the real issues.

  1. You say you took down your logo and hid your LinkedIn profile because someone brought to your attention several days ago the campaign against you. The fact is that you hid your personal information on November 17th, at the same time that the scam sites were shut down, which was promptly in response to messages sent to cli-us.com and Ecatel showing that your name had been implicated in all this. There was no campaign against you, as you claim. There was just a post that mentioned you on this blog and some email messages that were sent to ISPs and cli-us.com. I defy you to find any other mention of you being involved with the scam that was made before you hid your personal information. We’re supposed to believe that someone you know came across this blog, told you about it, and you just by chance decided to hide your information at the same time that the scam sites were shut down, which was soon after those email messages were sent, and that you did this because of a “campaign” against you that didn’t exist? Your claims just don’t agree with the facts. 
  2. You totally mischaracterize the nature of the discussion of SafeAndLocal.org at Broadbandreports. No one in that discussion was attacking you at all. The thread is brief and the people that took part in it simply talked about whether or not the site was legitimate. More importantly, the story that you give about your involvement with SafeAndLocal.org makes no sense. You write:…they already were working on a web design so I registered the domain he asked for with my Go Daddy account and set up a hosting account for him. I figured, why not, it’s an easy $20. I was notified at a later date by HostGator (my webhost) that he was violating our terms of service and I promptly canceled his account and refused to refund any money. He hassled me for some time and I blocked him on IM and email and he went away., or so I thought. When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request.

    If you canceled his account when you say you did, then the site would have been dead by the time the thread on Broadbandreports was created; there wouldn’t have been any SafeAndLocal.org for people to discuss. Since you were the one who registered the domain, you controlled it and no one else could have used it. If the thread on Broadbandreports was posted after you terminated your client’s account, then the only way that SafeAndLocal.org would have been still up and running would have been if you had been operating it. Your explanation here is logically inconsistent. It makes no sense.

    If instead you had found out about the TOS violations and had suspended your client’s account after the thread was started (which is not what you say), then you could have simply posted a short note in the thread stating that the site was actually run by one of your clients and that you had terminated his account once it was discovered that it was a scam. There was nothing preventing you from doing that. You were afraid that people would attack you for that? That’s absurd, just like the idea that you had to have the thread deleted.

  3. Concerning the email address finishlinehosting@cli-us.com, you first try to twist the facts and make this an issue about registration information (which is easy to fake) when it is actually an issue concerning SOA records (which are impossible to fake unless you have access to DNS servers). You say that I base my argument that you were involved in the scam on the fact that a cli-us.com address was used for registering the domains. That is wrong. It was not used for registering the domains and I never said that it was. I know that registration data is easy to fake so I wouldn’t jump to any conclusions based upon it. (As a matter of fact, in this case, the registration information for all of the sites involved in the scam was hidden using Whois privacy protection, so it was of no use.) What we’re talking about here are the SOA records, which only a DNS server administrator would have access to. They are not data that any old person can specify when registering a domain. They aren’t even specified when purchasing a domain but afterwards when the website is actually set up and connected to the Internet.Second, if someone wanted to get back at you for suspending his account by using a cli-us.com email address for his scam site, then he would have put that address in the registration information, not the SOA record (which he wouldn’t have even had had access to unless he had access to the DNS server). The registration information is what you see when you do a whois query. The SOA record, on the other hand, is accessed via a different query and it is usually only looked at by system administrators, the general public has no interest in it. Your explanation about how a cli-us.com email address got used for the SOA records is implausible.
  4. Those articles you wrote show that you have a lot of experience spamming Craigslist. Inundating Craigslist with ads is how the people who run these dating verification scam sites very often work. You dismiss the articles by saying that they just formed a brief attempt at article marketing and you ignore their conent. That content says a lot about the sort of business practices you use. Using multiple IP addresses and email addresses to get around Craigslist’s anti-spam safeguards is underhanded and a violation of Craigslist’s TOS. Your explanation here is incomplete and avoids the real issues.

Your explanations don’t explain things at all. They misstate the facts, ignore the facts, are logically inconsistent, or simply implausible. You keep pushing this idea that you ignored everything and hid your personal information because you didn’t want to “fuel the fire”, but I’ve already shown there was no fire to fuel, not on November 17th when you hid your personal information, and not back in January when that thread on Broadbandreports was created. Your name wasn’t mentioned on this blog in regards to the scam until November 17th, and it wasn’t metioned elsewhere until after you hid your personal information. The truth appears to be that you preferred to hide your personal information and ignore everything until you weren’t able to ignore it anymore because certain people found out about it. If you now want to ignore all of the facts presented here once again, go ahead. I don’t plan to tell you anything about myself because I know better than to give out my real name when I investigate Internet fraud. Go to aa419.org or antifraudintl.org and tell the people there how unfair it is that they don’t reveal their real names when they post about scam sites and suspected scammers. They’d laugh at you. In any case, who I am is irrelevant, all that matters are the facts and the facts don’t look good for you.

Some More Questions For Chris Lawell

Chris, up until Friday, the SOA records for the scam sites all listed the email address for their DNS zone administrator as finishlinehosting@cli-us.com. But on Friday, the day that you responded to the allegations made against you, the SOA records for all of these sites except finishlinehosting.com were deleted. Could you explain how that happened?

You can view the DNS records by visiting

http://who.is/nameserver/ns1.finishlinehosting.com/

and clicking on the DNS links in the More Information column in the table.

Also, it is very important to note that we are discussing SOA records here, not registration information. You say in your letter that anyone can use any email address when registering a domain. True, you can pick any fake email address for the registration information and if the registrar or hosting service doesn’t bother to check it out, then it will end up going into the registration databases. But we’re not talking about registration data here, we’re talking about SOA records. These are records that are created by the administrators of DNS servers. You can’t fake this data unless you have access to the DNS server in question. The DNS server would in this case most likely have been controlled by a hosting company or the ISP Ecatel. It appears that it was controlled by Finishline Hosting (which looks like a pretend hosting company), which means that it would have been involved in the scam, too. Again, what do you know about Finishline Hosting?

Regarding this:

The only thing I am guilty of is being naive 3 years ago and writing about posting on CL as an attempt at article marketing.

Article marketing, that’s all? So you weren’t obviously instructing people on how to spam Craigslist?

Craigslist can be tricky to post multiple ads in one day so here are some easy tips to post successfully on Craigslist.

First, it takes a lot of ads posted daily to list build fast.

You should post a minimum of 30-50 a day.

Here is how to post a lot of ads…

You need a way to change your IP address (your connection to the internet that determines where you are located).

You need a lot of subdomains that are setup to forward to your website(s).

You need a lot of email addresses (I use Gmail.com)

I have found that you can post about 10-15 ads with the same IP, email address and subdomain.

Do more than that, and you run the risk of all your ads being deleted.

That is why I use this submission software… CL Autoposter

Using multiple email addresses and multiple IP addresses to avoid having your numerous ads flagged and using automated ad submission software that helps you change your identity, those are tricks to avoid having your spam flagged.

Message to Christopher Lawell

Chris,

Thank you for contacting me. I read your reply at ChristopherLawell.com and there are a few things about it that bother me.

To begin with, you say that no one ever contacted you about the scam sites. Well, we know that at least two complaints were sent about the scam sites to finishlinehosting@cli-us.com, and that there were many complaints sent to Ecatel prior to those complaints, too. The first known complaint sent to this address was sent on November 14th. The complaints were sent to that address at cli-us.com because that was the only business contact address that was then available. No replies to those complaints were ever received. It was only after a further complaint was made on November 17th, one that mentioned that the site SafeAndLocal.org was registered in your name and that finishlinehosting@cli-us.com was the address for the DNS administrator for the recent scam sites, that the scam sites were promptly taken down.

At the same time, on November 17th, just a few hours after this new complaint was made, you removed your company’s logo from your website and hid your LinkedIn profile. There was no campaign against you as you claim, there were just some postings on this blog that mentioned the web pages that linked your name to the scam sites. Read these postings. Do they amount to character assassination? No, they don’t. They plainly present facts that strongly pointed to you being involved in the scams. They leave open and acknowledge that it is possible that the scammer was merely a client of yours or someone else entirely. (And, as a matter of fact, before coming across the cli-us.com address, there was another person that we believed was behind the sites.) The fact that you hid your personal information at the same time that the sites got shut down, along with the fact that the sites did not get shut down until it was revealed that your name was linked to them, was very suspicious, you must admit.

I know that you don’t care to answer any questions about this, but would you be so good as to answer these?

1) Why were there no replies to the messages sent to finishlinehosting@cli-us.com? Is it not a valid email address? If it isn’t, then there should have been an error message sent back from your website. No replies including error messages were ever received, so it must be a valid email address. If it is a valid email address, then what is your relationship with finishlinehosting?

2) As I said, on November 17th, the day that you hid your personal information, the only public postings made on the internet regarding this matter were the ones you see on this blog. They are calm and rational, analytical. You could have easily posted something here regarding the matter. There was no fire for you to fuel. So why didn’t you post anything?

3) Likewise, concerning SafeAndLocal.org, you write

When the complaint showed up on the broadband reports forum, I wrote multiple letters to the admins of that site explaining the situation and asking that the thread be removed, they ignored every request. They are obviously more concerned about freedom of speech even if it is inaccurate and damaging to innocent people than posting accurate content. I didn’t address this on the forum as I felt most people would want to believe the worst and it would only serve to fuel the fire.

However, there was no fire to fuel. There is no complaint in that thread on BroadbandReports.com. The thread was started by someone who wanted some advice. He wasn’t sure that SafeAndLocal.org was a legitimate dating site, and he wanted other people’s help on figuring that out. There was no hostility or any words at all for that matter that were directed to you or about you. As a matter of fact, the way that your name ended up being mentioned was that someone wanted to point out that the site had only been registered a couple months earlier, and he showed this by posting the registration information in its entirety. The discourse in that thread was calm and reasonable; saying that you didn’t just go ahead and post an explanation in it because you didn’t want to fuel the fire makes no sense: there was no fire to fuel. You could have easily just posted a note saying that you had registered the site for a client and that you had terminated that client’s account; there was nothing for you to be afraid of and there was no reason why you would have needed the thread to have been deleted. So could you explain why you didn’t just do that?

I would really like it if you could answer these questions. In your letter you say:

I am going to address your statements this one time. I will not fuel the fire by entering into a debate. 

As I’ve repeatedly said, there is no fire for you to fuel. We can calmly and rationally discuss this matter, so why don’t you want do that? I’d really like to find these scammers, and I’m sure that you’d like to see them brought to justice too seeing as they’ve implicated you in all this. If you give us the information that you have about them, even if it’s old, it could help us track them down. So why don’t you just talk to us and answer the questions that we have? I am sending an email message to chris@cli-us.com informing you of this post and I hope to hear from you again.

P.S. Christopher Lawell posted several comments on this blog. They all said the same thing, “Please read my full response here: http://www.christopherlawell.com”, so I’ve deleted all but one of them. That is the only reason I deleted his comments, because they were redundant.

Report on Christopher Lawell Inc. And Craigslistsafe.localsafe.org Posted At Antifraudintl.org

A report on Christopher Lawell Inc. and the craigslistsafe.localsafe.org scam was posted today by my friend PhilW over at antifraudintl.org. Thank you, Phil, for posting it, and also thank you for all of your assistance on this project. You’ve been a great help!

Update on 11/26: This thread has now been deleted.

Christopher Lawell, Inc.

I’ve done some more investigating of mysafenet.net and localsafe.org and it looks like I’ve found out who’s behind them.

First of all, localsafe.org, mysafenet.net, and several other servers share the name server ns1.finishlinehosting.com:

 SAMPLE OF DOMAINS USING NS1.FINISHLINEHOSTING.COM

Domain Registrar Create Date Expire Date More Information
finishlinehosting.com INTERNET.BS CORP. 2010-06-21 2011-06-21 DNS
localsafe.org Internet.bs Corp. (R1601-LROR) 2010-03-18 04:31:32 2011-03-18 04:31:32 DNS
mail4now.net INTERNET.BS CORP. 2010-03-18 2011-03-18 DNS
mail4time.org Internet.bs Corp. (R1601-LROR) 2010-10-29 04:42:25 2011-10-29 04:42:25 DNS
mysafenet.net INTERNET.BS CORP. 2010-11-01 2011-11-01 DNS
safe-local.net INTERNET.BS CORP. 2010-03-18 2011-03-18 DNS

Safe-local.net is another server that is used for the scam. It redirects to craigslistsafe.localsafe.org. Mail4now.net and mail4time.org are servers that are used for for sending spam for mysafenet.net and safe-local.net. Since these sites all share the same name server and they were all used for the scam, it’s a good bet that they are all owned by the same person.

A useful piece of information about a website is its SOA record. This record contains the e-mail address of the person responsible for administering the domain’s zone. The SOA record for mysafenet.net is this:

MYSAFENET.NET SOA RECORD

Name Server ns1.finishlinehosting.com
Email blank@cli-us.com
Serial Number 2010110101
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

The e-mail address of the zone administrator is an address at cli-us.com, which is a website for Christopher Lawell, Inc.

Given its name, we’d assume that finishlinehosting.com would be the website for the hosting company used by these sites, but instead it’s a blank website. Let’s look at the SOA record for finishlinehosting.com:

FINISHLINEHOSTING.COM SOA RECORD

Name Server ns1.finishlinehosting.com
Email finishlinehosting@cli-us.com
Serial Number 2010081305
Refresh 1 day
Retry 2 hours
Expiry 41 days 16 hours
Minimum 1 day

The e-mail address of the zone administrator for this site is also an address at cli-us.com. So who is this Christopher Lawell?

Googling “Christopher Lawell” brings up a number of interesting pages. For instance there’s the LinkedIn profile of a Christopher Lawell in the Las Vegas, NV area who is a partner at Clearline Media and president of both http://www.350dollarwebsites.com and Christopher Lawell, Inc. When we Google

“Christopher Lawell” craigslist

we find some articles where he gives tips on spamming Craigslist. For instance:

http://www.articlepros.com/online_business/More-In-Internet-and-Online-Business/article-94976.html
http://make-money-online12.blogspot.com/2008/02/how-to-post-on-craigslist.html.

Doing some more searching for his name shows that it has been linked to other verification scam sites. For instance, there is this thread on broadbandreports.com:

http://www.broadbandreports.com/forum/r23659525-craigslistsafesafeandlocalorg-scam-site-or-not

The Christopher Lawell discussed in this thread had an address in Henderson, NV, which is a suburb of Las Vegas, and he was listed as the owner of craigslistsafe.safeandlocal.org, a verification scam site that is no longer active:

Domain ID:D157651283-LROR
Domain Name:SAFEANDLOCAL.ORG
Created On:21-Nov-2009 16:02:05 UTC
Last Updated On:21-Nov-2009 16:02:08 UTC
Expiration Date:21-Nov-2010 16:02:05 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:CR29951201
Registrant Name:Christopher Lawell
Registrant Street1:318 Canyon River Court
Registrant Street2:
Registrant Street3:
Registrant City:Henderson
Registrant State/Province:Nevada
Registrant Postal Code:89012
Registrant Country:US
Registrant Phone:+1.7023358990

(The current registration information is different because the registrant acquired whois privacy protection to hide his identity.)

Not only is the name of this site very similar to craigslistsafe.localsafe.org, but SafeAndLocal.org is what is shown for the title of the page on craigslistsafe.localsafe.org:

(Click the image to see it in full size). This could be because when the current site was created, the person who set it up used a copy of the HTML for the old site and forgot to change the page’s title.

When we look at all of this evidence, though it hasn’t been proven for certain, it does appear that this Christopher Lawell is the owner of the current scam sites, too.

ArchangelWebDesign.info

ArchangelWebDesign.info is being used for sending out email messages for the Cheri Craigslist dating scam. The spam is coming from the subdomain arc.archangelwebdesign.info, as you can see from the headers of a sample fraudulent email message below.

Delivered-To: ***@***.***
Received: by 10.151.15.8 with SMTP id s8cs74788ybi;
Thu, 11 Nov 2010 19:43:18 -0800 (PST)
Received: by 10.150.189.2 with SMTP id m2mr3084169ybf.48.1289533397732;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Return-Path:
Received: from arc.archangelwebdesign.info ([174.122.133.9])
by mx.google.com with ESMTP id l55si6539186yhd.141.2010.11.11.19.43.16;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received-SPF: fail (google.com: domain of pers-p5gm3-2052632382@craigslist.org does not designate 174.122.133.9 as permitted sender) client-ip=174.122.133.9;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of pers-p5gm3-2052632382@craigslist.org does not designate 174.122.133.9 as permitted sender) smtp.mail=pers-p5gm3-2052632382@craigslist.org
Received: from [69.25.188.179] (helo=3e414603b1a244c)
by arc.archangelwebdesign.info with esmtpa (Exim 4.69)
(envelope-from )
id 1PGkXi-0004kH-VS
for ***@***.***; Thu, 11 Nov 2010 21:43:15 -0600
MIME-Version: 1.0
Date: Thu, 11 Nov 2010 19:43:15 -0800
Message-ID:
X-Priority: 3 (Normal)
Subject: RE: criagslist
Reply-To: pers-p5gm3-2052632382@craigslist.org
From: “meee ;)”
To: “***”
Content-Type: multipart/alternative;
boundary=”—–_chilkat_cf1_4bd0_4a664414.d03cbf62_.ALT”
In-Reply-To: AANLkTi=osGdv+pi325ZdDM7SVJopt1gzODnVHATgRPVQ@mail.gmail.com
X-Mailer: Microsoft Outlook, Build 10.0.6822
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – arc.archangelwebdesign.info
X-AntiAbuse: Original Domain – gmail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – craigslist.org

Hey Babe, hehe you seem to be my kind of guy.

thanks for the reply. Totally honestly, i just want some no strings action today or tomorrow. You into that?

You ever do this? I’ve a couple times b4. Everytime I think about hooking up with no strings I get really horny but a little worried. I don’t want to meet some underage kid or something.

I’m a pretty upfront person so let me just lay this out before we go any further. This is a NSA thing with nothing else. I just got out of a relationship and am not looking for a guy to hold me back.

If you are good with that then there is one more thing I have for you. I am getting a lot of emails from HS kids and creepy guys out there so i am requiring everyone to register for my peace of mind. Its no cost but I promise if you do this, Ill make it worth your while and will be more open to whatever you want to do. If you dont want to do this then i am afraid we can’t go any further because it wont be any fun for me being stressed and afraid of you the whole time.

If you want to meet me still then just go here [Here there was a link to mysafenet.net. Do not visit that site!]. You can find my profile and contact information there.

I’m looking forward to seeing you

Call me at the number on there.

Bye for now

Cheri

The reason that this is a scam is because the person that is supposedly sending the messages doesn’t exist. The messages are actually being sent by someone who makes money from directing you to the dating sites that you are being asked to join. These scammers like to call this “affiliate marketing”, but it is fraud.

Other servers that have been used for sending these scam messages are:

mail4time.org
mail4now.net
safe4mail.org
b8mail.com

The Cheri Scam: Craigslistsafe.localsafe.org

If you get messages like the ones below, do not click on the links in the messages. The sites that are linked to in the messages, mysafenet.net and safe-local.net, redirect you to craigslistsafe.localsafe.org, which is a fake site used to trick you into signing up for yet another fake dating site. How do we know craigslistsafe.localsafe.org is not a real dating site? First of all, that sign-in form at the top of the page (click the picture to enlarge it):

It does nothing. If you put in a random user name and password and click the login button, you don’t get logged in to the site and you don’t get an error message as you’d expect to get from a random user name and pasword. The form doesn’t do anything, it is just a fake form put on the page to make the site look real.

There is also a sign-up form in the bottom right of the page. Its appearance varies based upon which other site is being promoted. Here is one of the forms you may see:

This form is actually a sign-up form for another site. It is contained in an iframe that loads content from that other site. For instance, if you look at the page source you might see an iframe like this defined:

<iframe marginheight=”50marginwidth=”0name=”iFramesrc=”http://xxxl.hornywivesonline.com/signup/signup.php?nats=MzguOC4xMy40NC44LjAuMC4wLjA&step=2frameborder=”0height=”1150scrolling=”nowidth=”700“>

In this case, the iframe loads content from xxl.hornywivesonline.com and the scammer is trying to get you to sign up for that site.

Also, sometimes the people that send you these messages make money just from directing traffic to these fake dating sites. We don’t want to help them stay in business, so don’t click on the links in the messages at all.

Here are some sample scam messages:

Hey Babe, hehe you seem to be my kind of guy.

thanks for the reply. Totally honestly, i just want some no strings action today or tomorrow. You into that?

You ever do this? I’ve a couple times b4. Everytime I think about hooking up with no strings I get really horny but a little worried. I don’t want to meet some underage kid or something.

I’m a pretty upfront person so let me just lay this out before we go any further. This is a NSA thing with nothing else. I just got out of a relationship and am not looking for a guy to hold me back.

If you are good with that then there is one more thing I have for you. I am getting a lot of emails from HS kids and creepy guys out there so i am requiring everyone to register for my peace of mind. Its no cost but I promise if you do this, Ill make it worth your while and will be more open to whatever you want to do. If you dont want to do this then i am afraid we can’t go any further because it wont be any fun for me being stressed and afraid of you the whole time.

If you want to meet me still then just go here go here. You can find my profile and contact information there.

I’m looking forward to seeing you

Call me at the number on there.

Bye for now

Cheri

Here is another message that “Cheri” sends.

Hiya

I never heard back from you. I must be nuts to do this, but your email caught my attention. I really want to meet you if you are still game. I hope the verification thing didnt scare you away but it really only takes a minute and i promise you won’t be dissapointed! Here is the link again in case you are still interested in meeting. http://mysafenet.net/cheri382

After you register, call me ASAP I’m making plans for tonight. My number is on there.

I hope to hear from you soon. :)

Cheri

And yet another.

Hey

I owe you an apology. I just found out that site I sent you to tries to charge people and it wasn’t supposed too. I was just trying to do something to stay safe and feel a little better about meeting you. Someone just told me that it isn’t free like they said it was and I paid $150 to sign up to use it… :(

Well, i still want to meet you if you aren’t too upset with me. If you are, I understand. i would like to get together sometime, maybe chat on the net a bit first then meet in a public place or something. i’d feel more comfortable that way.

I joined a site that IS free for you to join. They don’t even ask for a card or anything. Only an email so you can verify your registration. I have pictures on there, there is free video chat etc. It would just make me feel more safe to meet you and have some in between contact 1st you know?

Here it is, check it out and you will see that I have checked things out this time and it is free. I hope you’ll contact me there. Here is the link, and my username is “letsplay” so you can contact me there.

http://www.mysafenet.net/letsplay

Hope I see you soon,

Cheri

The person who sends these messages also sends messages for a “Brandi”. These are the URLs used for her profile:

http://mysafenet.net/brandi318
http://mysafenet.net/brandi382

And here are some of the other URLs used for this scam.

http://mysafenet.net/letsplay
http://mysafenet.net/letsplaynow
http://mysafenet.net/cheri318
http://safe-local.net/ready2playyyy