Bogus Forum Posts


The internet is a powerful medium which allows freedom of expression and, at the same time, privacy. You can post your opinions online, anonymously, say what you want about virtually anything.

But despite the privacy, there are some things you cannot hide. Computer hackers have been traced and tracked after sending viruses half way around the world.

It is possible to detect the place from where it all started, all the way from the country, to the city, to the computer.

In a fraud investigation online, public forum posts about one company were investigated to see if the claims of fraud online were true.

One thread about an infamous modeling company included public criticism of the company, and then it was resisted with the following post.


From: Mari
Email: smgirliegirl@hotmail.com
Date: 1/30/02
Time: 5:51:26 PM
Remote Name: XX.XXX.XXX.XXX

Comments

I decided to allow [name withheld] to promote me on the web- I since have gotten six bookings doing promotional work. Affinity took a good look at me on the website and wants to negotiate a signing. The work for Vibe and Tropicana certainly helped pay the bill.


This glowing testimonial sounds great. But if you do a reverse lookup of the IP number, in this case XX.XXX.XXX.XXX, you will see the address of the person who sent the message. Copy that number and then follow this link:

Arin Whois Database Search

Type in the number, and it says:

[INFO WITHHELD]
[name withheld]
(NETBLK-09041-XX-XXX-XXX-XXX)

Next click on the [name withheld] link. It gives the physical address for the computer address:

[name withheld]
(NETBLK-09041-XX-XXX-XXX-XXX) STREET ADDRESS CITY, STATE ZIP CODE US

That is the physical address of the corporate headquarters of [name withheld].com.

The same thread received another forum post by a different poster name, once again a glowing testimonial from a satisfied customer on Friday, January 25, 2002, just after 5 PM.


[name withheld] and me

From: Aerin F.
Email:
Date: 1/25/02
Time: 5:05:57 PM
Remote Name: XX.XXX.XXX.XXX

Comments

Not only did I get a part in Black Night through the exposure I got from [name withheld], but I also went on and did three episodes on Going to Califorina and three international Heineken commercials. How's that for "Dont' Do It" bs?


Look at the ("Remote Name") number for both posts. They are one and the same. Both posts came from XX.XXX.XXX.XXX. The same computer which posted as "Mari" posted as "Aerin F."

In public forums online different people have complained about posts praising [name withheld].com. After public criticism, there were numerous instances where [name withheld] is praised, the number itself looking suspicious.

These "testimonies" were met with more complaints about [name withheld].com, that they were made not by satisfied customers, but instead fraudulently by [name withheld].com staff.

Others who did not say that asked: "How do we know you are not working for [name withheld].com?"


Since web pages disappear or get renamed suddenly and without notice, screen captures of the public forum posts were made.


But there is more. Note the date and Remote Name for this post in the same forum:

here's my experience

From: Carrie
Email: wiscgirlie@hotmail.com
Date: 1/30/02
Time: 5:54:55 PM
Remote Name: XX.XXX.XXX.XXX

Comments

I sought promotion from [name withheld]. I was on the website for a few months before I was noticed by VIP Talent and IMI Talent. I now have had a few bookings that have paid great. Am I glad to have signed up? Duh.


In the same forum the question was asked: "Maybe the "model type" get the jobs, and the non-model types get scammed??? Anyone have any advice or experience??? Thanks."

Here's another post from the [name withheld].com corporate headquarters.


Re: Q for Laura and Maxann

From: Kallie
Email: kkall78@hotmail.com
Date: 1/30/02
Time: 5:57:45 PM
Remote Name: 65.115.173.130

Comments

I'm in good shape pretty fit. Not model tall at all. The work I'm getting is print and promotional bookings.


Each time the identity of the poster is different but the remote name is the same. In three cases a unique email address was given, in one case no email address was provided, but they all originated from the corporate headquarters of the same company: [name withheld].com.