Scammer? Need Techno wiz help

[FieroBUZZ]

Adam tried a 'work at home' deal and evidently got scammed out of a small signup fee.  Details are a return email with a password and username, but the domain page seems to be locked.  Get a 'you are not authorized' message, further stating my i.p. is on a banned list from the domain in question.

What can I find out?
Richard Sampson                (www.NationalRefundCentre.com)
Dartmouth, NS

Email came from 209.213.121.224

Gary

[Gizmo]

WHOIS Record For
nationalrefundcentre.com 
 
Certified Offer Service - Make an offer on this domain
SSL Certificates - Make this site secure
Site Confirm Seals - Become a trusted Web Site 
   The data contained in GoDaddy.com, Inc.'s WhoIs database,
while believed by the company to be reliable, is provided "as is"
with no guarantee or warranties regarding its accuracy.  This
information is provided for the sole purpose of assisting you
in obtaining information about domain name registration records.
Any use of this data for any other purpose is expressly forbidden without the prior written
permission of GoDaddy.com, Inc.  By submitting an inquiry,
you agree to these terms of usage and limitations of warranty.  In particular,
you agree not to use this data to allow, enable, or otherwise make possible,
dissemination or collection of this data, in part or in its entirety, for any
purpose, such as the transmission of unsolicited advertising and
and solicitations of any kind, including spam.  You further agree
not to use this data to enable high volume, automated or robotic electronic
processes designed to collect or compile this data for any purpose,
including mining this data for your own personal or commercial purposes.

Please note: the registrant of the domain name is specified
in the "registrant" field.  In most cases, GoDaddy.com, Inc.
is not the registrant of domain names listed in this database.


Registrant:
   Domains by Proxy, Inc.
   DomainsByProxy.com
   15111 N. Hayden Rd., Ste 160, PMB 353
   Scottsdale, Arizona 85260
   United States

   Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
   Domain Name: NATIONALREFUNDCENTRE.COM
      Created on: 29-May-06
      Expires on: 29-May-08
      Last Updated on: 30-May-06

   Administrative Contact:
      Private, Registration  NATIONALREFUNDCENTRE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599      Fax -- (480) 624-2599

   Technical Contact:
      Private, Registration  NATIONALREFUNDCENTRE.COM@domainsbyproxy.com
      Domains by Proxy, Inc.
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599      Fax -- (480) 624-2599

   Domain servers in listed order:
      DNS1.REGISTEREDSITE.COM
      DNS2.REGISTEREDSITE.COM
      DNS3.REGISTEREDSITE.COM

 
   The previous information has been obtained either directly from the registrant or a registrar of the domain name other than Network Solutions. Network Solutions, therefore, does not guarantee its accuracy or completeness. 
   
     Show underlying registry data for this record 
     
 

Current Registrar: GO DADDY SOFTWARE, INC. 
IP Address: 216.150.29.248  (ARIN & RIPE IP search) 
IP Location: US(UNITED STATES)-GEORGIA-SNELLVILLE 
Lock Status: REGISTRAR-LOCK 
DMOZ  no listings 
Y! Directory:  see listings 
Web Site Title: GET PAID DAILY 
Data as of: 14-Jun-2005 

[Gizmo]

The site came up here...

[Gizmo]

WHOIS results for 216.150.29.248
Generated by www.DNSstuff.com
Location: United States [City: Snellville, Georgia]

NOTE: More information appears to be available at ASNAD3-ARIN.


OrgName:    Interland, Inc.
OrgID:      INTD
Address:    101 Marietta Street
City:       Atlanta
StateProv:  GA
PostalCode: 30039
Country:    US

NetRange:   216.150.0.0 - 216.150.31.255
CIDR:       216.150.0.0/19
NetName:    HOSTCENTRIC-NETBLK-4
NetHandle:  NET-216-150-0-0-1
Parent:     NET-216-0-0-0-0
NetType:    Direct Allocation
NameServer: NS.DIALTONEINTERNET.NET
NameServer: NS2.DIALTONEINTERNET.NET
Comment:   
RegDate:   
Updated:    2004-07-14

OrgAbuseHandle: ABUSE579-ARIN
OrgAbuseName:   ABUSE
OrgAbusePhone:  +1-404-260-8434
OrgAbuseEmail:  abuse@interland.com

OrgTechHandle: ASNAD3-ARIN
OrgTechName:   ASNADMIN
OrgTechPhone:  +1-404-260-8434
OrgTechEmail:  asnadmin@interland.com

# ARIN WHOIS database, last updated 2006-07-25 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
 

[Gizmo]

WHOIS results for 209.213.121.224
Generated by www.DNSstuff.com
Location: United States [City: Keene, New Hampshire]

NOTE: More information appears to be available at ZZ1355-ARIN.

Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).


OrgName:    Interland, Inc.
OrgID:      INTD
Address:    101 Marietta Street
City:       Atlanta
StateProv:  GA
PostalCode: 30039
Country:    US

NetRange:   209.213.96.0 - 209.213.127.255
CIDR:       209.213.96.0/19
NetName:    HOSTCENTRIC-NETBLK-5
NetHandle:  NET-209-213-96-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation
NameServer: NS.DIALTONEINTERNET.NET
NameServer: NS2.DIALTONEINTERNET.NET
Comment:   
RegDate:   
Updated:    2005-01-11

RTechHandle: ZZ1355-ARIN
RTechName:   arin coordinator
RTechPhone:  +1-800-640-4629
RTechEmail:  arin-swip@maxim.net

OrgAbuseHandle: ABUSE579-ARIN
OrgAbuseName:   ABUSE
OrgAbusePhone:  +1-404-260-8434
OrgAbuseEmail:  abuse@interland.com

OrgTechHandle: ASNAD3-ARIN
OrgTechName:   ASNADMIN
OrgTechPhone:  +1-404-260-8434
OrgTechEmail:  asnadmin@interland.com

# ARIN WHOIS database, last updated 2006-07-25 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

 

[FieroBUZZ]

Gee, sounds promising...... 

Sampson is a common Cape Breton name.  A quick search gave one Richard in Weymouth (near Halifax) and one in Pondville.  Pondville coincidently is not far from my in-laws.  May warrant a visit in a big truck....    May be father and son although if the guy is scamming he may not be that easy to find.


Does NS.DIALTONEINTERNET.NET indicate Nova Scotia?  or just a letter coincidence?

Also is the abuse part where you send complaints?

[FieroBUZZ]

Afraid it's all gibberish (no offence) to me.  I assume the domain is a branch of a US operation and computer traffic is routed thru them.

[Gizmo]

Not hitting anything solid.  Thought it would be interesting to see where that domain and ips originated.

[FieroBUZZ]

Adam tried at the library and could not access the site there either. He sent an email , but it may turn up undelivered.  The first one he tried here died right away.

[dguy]

Does NS.DIALTONEINTERNET.NET indicate Nova Scotia?  or just a letter coincidence?

Just a letter coincidence in this case.  With respect to core network/Internet services, "NS" is an abbreviation commonly used to identify a name server (Internet equivalent of a telephone book).

Since it appears that the e-mail originated from a domain other than that which the web site is running under, try contacting the "abuse" address at the server from which the e-mail originated from, abuse@interland.com.  In addition to explaining the situation, attach a complete (include all that gibberish in the header) copy of the e-mail which came back to Adam.  Mask out the user id & password if you like...

You may get somewhere, you may not.     Competent mail server administrators generally don't like scammers piping crap through their systems...



P.s.  Most of those make-money-at-home-on-the-internet "jobs," are just pyramid and/or chain schemes.  e.g. if you send me $29.95, I'll send you information describing how to make money from the comfort of your easy chair.  The document(s) you receive later are quite often instructions on how to set up and publicize a web site which, strangely enough, offers information to others on how to get rich doing not very much, all for the low, low price of...   

Tell Adam to look up the acronym TNSTAAFL.