Blog for hpHosts, and whatever else I feel like writing about ....

Tuesday, 19 January 2010

Yet another phishing campaign: + Netelligent + +

I received a rather surprising e-mail earlier. Surprising because it was sent to an e-mail address I used specifically for registering on the website a few years ago, and not an address I'd published anywhere (and nope, I'd not given them permission to give it to anyone else).

This particular e-mail is shown to the left, but in short, advertises, which leads to and (SSL certificate for is provided by GoDaddy). These sites are all not surprisingly, involved in fraud.

The people and sites responsible for this are; (lives at, AS18403
FPT-AS-AP FPT Telecom Company 66-68 Vo Van Tan Ho Chi Minh City Vietnam) (lives at, FastHosts)

Name Server:
Name Server:
Creation Date: 2010.01.17
Updated Date: 2010.01.17
Expiration Date: 2011.01.17


Registrant ID: RNCV48A-RU
Registrant Name: Kevin Stubbs
Registrant Organization: Kevin Stubbs
Registrant Street1: 23 Bringston Rd
Registrant City: Lancers
Registrant State: Cheshire
Registrant Postal Code: SM2 7LS
Registrant Country: GB

Administrative, Technical Contact
Contact ID: RNCV48A-RU
Contact Name: Kevin Stubbs
Contact Organization: Kevin Stubbs
Contact Street1: 23 Bringston Rd
Contact City: Lancers
Contact State: Cheshire
Contact Postal Code: SM2 7LS
Contact Country: GB
Contact Phone: +44 645 8393820
Contact E-mail:

Registrar: ANO Regional Network Information Center dba RU-CENTER

Oh and yes, the WhoIs details are fake (for starters, 0645 isn't a valid UK dialing code, it was changed to 0845 years ago)

Name Server:
Name Server:
Creation Date: 2010.01.03
Updated Date: 2010.01.04
Expiration Date: 2011.01.03


Registrant ID: LXHHBQO-RU
Registrant Name: Laurie Harford
Registrant Organization: Laurie Harford
Registrant Street1: 72 Sunshine Rd
Registrant City: Torquay
Registrant Postal Code: TQ2 6AM
Registrant Country: GB

Administrative, Technical Contact
Contact Name: Laurie Harford
Contact Organization: Laurie Harford
Contact Street1: 72 Sunshine Rd
Contact City: Torquay
Contact Postal Code: TQ2 6AM
Contact Country: GB
Contact Phone: +44 7976776382
Contact E-mail:

Registrar: ANO Regional Network Information Center dba RU-CENTER

The phone number listed here is valid, and belongs to an Orange Telecom customer (I'd have called it if it weren't 04:00).

A lovely little list of domains they are also the owners of are;

These are all hosted at And who owns this IP? Why, our old friends Netelligent of course.

Other connected domains include; (AS14280 NETNATION Communications Inc.) (AS32613
IWEB-AS iWeb Technologies Inc.) (AS15418
FASTHOSTS-INTERNET Fasthosts Internet Ltd. Gloucester, UK.)

What's funny of course, is Netelligent recently wanted to convince us they were simply victims, and they'd killed off the criminals on their network. Wonder how they're going to explain this one huh? Especially given the history of the particular /24 in question (previously used by US based XLMarketing, who weren't exactly known for legit marketing methods)

/update 14:28 20-01-2010

I called the mobile number for, and not surprisingly, the number no longer exists.


Conrad Longmore said...

Sounds familiar. Did you notice the "Affiliate" link at the bottom takes you to, the page at lists these so-called merhants.

Now, was originally (Google it) owned by "Three W Networks Ltd" (Google *that*) who appears to be registered in the Bahamas (although that's probably just a nameplate).

MysteryFCM said...

I'd missed the link. Cheers for the heads up :o)

richard said...

I had the adobe email today, but not with any fancy graphics. Header said it had come from, similar whois
email to

rod.mcinnes said...

There's now a fraud with a very similar web layout, but updated software "versions" in an e-mail from (ostensibly) "" linking to The domain contact is a Tommy Anderson at 273 Parkway, Miami, FL. This address is on a large fenced off vacant block without road access. It links through for payment for the "free" upgrade to