borrownow.net

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Dec 26, 2013 6:09 am

I found this site in a loan scam email. It starts out with a tiny URL

http://bit.ly/1fhEKvU

It then redirects for a split second to

crochetcandee.com/wp-content/uploads/2013/04/tmp.php

It ends up at this fake loan site:

http://borrownow.net/?aid=689

Please KILL
+++++++++++++++++++++++++++++++++++++++

http://borrownow.net/?aid=689

BorrowNow.net

IP address: 37.9.53.238

Quote:

Registrar: ENOM, INC.
Referrer: http://www.enom.com
Created: 2013-11-15
Updated: 2013-11-15
Expires: 2014-11-15
Status: clientTransferProhibited
Name Server: dns1.registrar-servers.com
Name Server: dns2.registrar-servers.com
Name Server: dns3.registrar-servers.com
Name Server: dns4.registrar-servers.com
Name Server: dns5.registrar-servers.com

Quote:

Domain Name: BORROWNOW.NET
Registry Domain ID: 1835567528_DOMAIN_NET-VRSN
Creation Date:

2013-11-15 14:36:00Z
Registrar Registration Expiration Date: 2014-11-15 14:36:00Z
Registrar: ENOM,

INC.
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone:

+1.4252744500
Reseller: NAMECHEAP.COM
Domain Status: clientTransferProhibited
Registry Registrant

ID:
Registrant Name: WHOISGUARD PROTECTED
Registrant Organization: WHOISGUARD, INC.
Registrant

Street: P.O. BOX 0823-03411
Registrant City: PANAMA
Registrant State/Province: PANAMA
Registrant

Postal Code: NA
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone

Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email:

[email protected]
Registry Admin ID:
Admin Name: WHOISGUARD

PROTECTED
Admin Organization: WHOISGUARD, INC.
Admin Street: P.O. BOX 0823-03411
Admin City:

PANAMA
Admin State/Province: PANAMA
Admin Postal Code: NA
Admin Country: PA
Admin Phone:

+507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email:

[email protected]
Registry Tech ID:
Tech Name: WHOISGUARD

PROTECTED
Tech Organization: WHOISGUARD, INC.
Tech Street: P.O. BOX 0823-03411
Tech City:

PANAMA
Tech State/Province: PANAMA
Tech Postal Code: NA
Tech Country: PA
Tech Phone:

+507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email:

[email protected]
Name Server: DNS1.REGISTRAR-SERVERS.COM
Name

Server: DNS2.REGISTRAR-SERVERS.COM
Name Server: DNS3.REGISTRAR-SERVERS.COM
Name Server:

DNS4.REGISTRAR-SERVERS.COM
Name Server: DNS5.REGISTRAR-SERVERS.COM
DNSSEC: unSigned
Last update of

WHOIS database: 2013-11-15 06:36:39Z

The data in this whois database is provided to you for

information
purposes only, that is, to assist you in obtaining information about or
related to a

domain name registration record. We make this information
available "as is," and do not guarantee

its accuracy. By submitting a
whois query, you agree that you will use this data only for

lawful
purposes and that, under no circumstances will you use this data to: (1)
enable high volume,

automated, electronic processes that stress or load
this whois database system providing you this

information; or (2) allow,
enable, or otherwise support the transmission of mass

unsolicited,
commercial advertising or solicitations via direct mail, electronic
mail, or by

telephone. The compilation, repackaging, dissemination or
other use of this data is expressly

prohibited without prior written
consent from us.

We reserve the right to modify these terms at any

time. By submitting
this query, you agree to abide by these terms.
Version 6.3 4/3/2002

ipTRACKERonline.com wrote:

Header Analysis Quick Report Originating IP: 54.206.5.192 Originating ISP: Amazon.com City: Sydney Country of Origin: Australia * For a complete report on this email header goto ipTRACKERonline

Quote:

Delivered-To: <snipped>
Received: by 10.227.64.193 with SMTP id f1csp414312wbi;
Wed, 25 Dec 2013 14:51:58 -0800 (PST)
X-Received: by 10.60.63.102 with SMTP id f6mr6644oes.76.1388011918036;
Wed, 25 Dec 2013 14:51:58 -0800 (PST)
Return-Path: <[email protected]>
Received: from gateway07.websitewelcome.com ([69.56.159.26])
by mx.google.com with ESMTP id r7si22045811oem.84.2013.12.25.14.51.57
for <snipped>;
Wed, 25 Dec 2013 14:51:57 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 69.56.159.26 as permitted sender) client-ip=69.56.159.26;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 69.56.159.26 as permitted sender) [email protected]
Received: by gateway07.websitewelcome.com (Postfix, from userid 5007)
id 636F141F93B69; Wed, 25 Dec 2013 16:51:57 -0600 (CST)
Received: from ham07.websitewelcome.com (unknown [192.185.0.198])
by gateway07.websitewelcome.com (Postfix) with ESMTP id 525F341F93B49
for <snipped>; Wed, 25 Dec 2013 16:51:57 -0600 (CST)
Received: by ham07.websitewelcome.com (Postfix, from userid 500)
id 389B0460002; Wed, 25 Dec 2013 16:51:57 -0600 (CST)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
ham07.websitewelcome.com
X-Spam-Flag2999: NO
X-Spam-Level2999:
X-Spam-Status2999: "No, score=-2.5 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD
autolearn=ham version=3.3.1
Received: from terracan.websitewelcome.com (terracan.websitewelcome.com [192.185.82.154])
by ham07.websitewelcome.com (Postfix) with ESMTP id E56F5460002
for <snipped>; Wed, 25 Dec 2013 16:51:56 -0600 (CST)
Received: from babyrome by terracan.websitewelcome.com with local (Exim 4.80)
(envelope-from <[email protected]>)
id 1VvxIy-0003yJ-GD
for <snipped>; Wed, 25 Dec 2013 16:51:56 -0600
To: <snipped>
Subject: Fill out 3 minutes Form and Get Business loan!
X-PHP-Script: babyromeoshop24.info/wp-content/plugins/inc/thumb.php for 54.206.5.192
From: Elias <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Wed, 25 Dec 2013 16:51:56 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - terracan.websitewelcome.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [4909 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - terracan.websitewelcome.com
X-BWhitelist: no
X-Source-IP:
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/babyrome/public_html/wp-content/plugins/inc/thumb.php
X-Source-Dir: babyromeoshop24.info:/public_html/wp-content/plugins/inc
X-Source-Sender:
X-Source-Auth: babyrome
X-Email-Count: 61
X-Source-Cap: YmFieXJvbWU7bnJvY2htYW47dGVycmFjYW4ud2Vic2l0ZXdlbGNvbWUuY29t

Quote:

Congratulations, we were able to match you with a loaner!
If you were previously turned down by other loaners, we believe this site may be able to help you find the money that you need.
Many of our client have received industrial loan company through them.

So don't delay... click on the following link to visit Fast Loan Search and let them help you get the car loan that you are looking for:

http://bit.ly/1fhEKvU
(This shortened link our site)

Happy Holidays !

Jaden Miller VP,
Communications
16045 Coastal Highway Lewes, DE 19905.
Don't want to receive any more emails from us? Send a letter to our e-mail [email protected]

Posted: Fri Dec 27, 2013 7:51 am

Can be reported. We don't DB loan sites.

Posted: Fri Dec 27, 2013 6:10 pm

This is a nasty Vlad phishing site.

Reported to eNom.

Posted: Sat Dec 28, 2013 9:38 pm

Besides the phishing this site passed the information on to other "loan" companies and all claim that I have been approved for a loan.

Marking n/a so this can be moved Misc scams.