716-650-4793

1-716-650-4793 used as a fax number for a FAKE domain name expiring email SPAMMING SCAM
Norton flags as SPAMMER
FROM: domainnotices8320.com  notices@domainnotices8320.com

FROM TEXT BODY:
Attn: XXXX
As a courtesy to domain name holders, we are sending you this notification for your business Domain name search engine registration. This letter is to inform you that it's time to send in your registration and save.

Failure to complete your Domain name search engine registration by the expiration date may result in cancellation of this offer making it difficult for your customers to locate you on the web.

THEY ARE SO STUPID, as they ask to fax credit card numbers, details & authorization !!!!

SCAM

Sends spam email illegally to owners of Internet domains soliciting them to move registration to their domain for the outrageous price of $75 for a year when the going rate is about $12.

Subject: Domain Notification: [your name here] This is your Final Notice of Domain Listing - [your domain here].

Subject implies your domain registration is expiring. "Final Notice" is 100% deceptive and bogus.

Notices are sent to domain owners from the company they are currently registered with, not this worthless scammer.

FEAR - "Your domain is expiring....FINAL NOTICE".
And Solution - "Quickly fax your credit card number to this number and for just $75 your dire, horrible situation will at last be over".... but act quickly!

Examine in bound spam email
and determine it originated from IP 184.95.51.250

184.95.51.250 is owned by:
SECURED SERVERS LLC
2353 W University Bldg A
Tempe, AZ, 85281
Agent for Service: MARCUS A BOHN

They rent out 184.95.51.250 and are ultimately responsible for SPAM spewing from their hardware.  

Many different entities may rent and share 184.95.51.250, any one of which could be our above SCAM spammer.

Doing a ping -a 184.95.51.250 does reveal a renter's name, perhaps the primary name associated with 184.95.51.250 but is inconclusive. anxieties1.paisperu.com

Do a reverse IP search ( www.ip-adress.com/reverse_ip ) indicates only one NAME associated with 184.95.51.250


anxieties1.paisperu.com

Registered to:
Roberto Daniel Paz Molleda
Company: Mercaperu.Com
Lima - Peru
Phone: +51.199305440
Fax: +51.5115312046
informes@mercaperu.com

High probability spam originated from above.

Tracing the RESPOND TO fax # 716-650-4793
(FAX your credit card info here....)

Whitepages Reverse phone.
Most likely that is not a cell number.
Much more likely its a VoIP number landing in area code 716 but transmitted from there to any internet location in the world

What might yield more info would be to place a call to that number using a VoiP softphone on your computer and having a peek at the packets using wireshark.org That would likely reveal the approximate location of the recipient (country and perhaps more.)

If its Roberto Daniel Paz Molleda, he uses GoDaddy for his own registration (anxieties1.paisperu.com), likely taking the $12 or so fee GoDaddy charges and marking it up to $75 using his email scam to promote.

Spammer's use of WhoIs information to spam is illegal.

Yup notified the abuse email for
SECURED SERVERS LLC
2353 W University Bldg A
Tempe, AZ, 85281

I received an email at work from Domain Services (notices@domainnotices8320.com) stating that it was time to renew our Domain Name registration.  Had a fax number in the body of 716-650-4793 stating that I needed to complete the information and fax to that number.  The first sentence in the email is:

"As a courtesy to domain name holders, we are sending you this notification for your business Domain name search engine registration. This letter is to inform you that it's time to send in your registration and save."

Never heard of this company so had to do a little research.

Scam. Email spam for domain registration renewal (at ridiculous price) gave this phone number to fax to. Guess they are tired of replacing email accounts that get shut down for spamming!

Business calls itself "DS", which appears to stand for "Domain Service". DS 3501 Jack Northrop Ave. Suite #F9238 Hawthorne, CA 90250 USA

...and a little further investigation reveals their address to be a "Shipito" warehouse (http://www.shipito.com/). It's a place that offers mailboxes (that's the "suite" number) with a forwarding service that sends letters and packages on to the box owner's *real* address, wherever that may be. It's a good services for small businesses... and for scammers trying to hide their true location from law enforcement.

And more: The BBB gives "Domain Service" an "F" rating. http://www.bbb.org/losangelessiliconvalley/bu ... horne-ca-256701

According to a complaint at complaints.com (http://www.complaints.com/2014-11-28/internet ... 1556308958.html) they claim to have a web site at domainnotices6500.com — of course, like all crooks they have their domain registration anonymized. Perhaps they've taken the site down because there's no web site for that domain. No DNS even.

Oh, and my spam came from 104.156.55.130 (hivelocity.net) Obviously they have to change providers often as they're probably sending a lot of spam and get booted on a regular basis.