47 thoughts on “flapstate.com / mdanclub.com / wayizer.com”

1. Thank you for this is a very detailed and useful post and I can confirm the details mentioned above, as after receiving an email from what now seems to be a harvested myspace account to go to flipality.com and check out my picture there, I was intrigued to find out more.

   Sadly your blog did not come up in the top google search results, so I also traced the domain registrars and ended up with bulletinpics, wondering if they are the sourse of all this evil.

   I also found this add on the freelance job board maybe giving an explanation why these URL’s change frequently, but I am not technically advanced enough to fully comprehend all this, let alone really want to.
   text from the add” As many people know, the BulletinPics CAPTCHA project has been very succesful, solving over 250,000 captcha entries per day for several teams earning very good money. We are looking to expand to over one million captchas per day but in order to do this, we need to rotate new domain names to host our images.

   We are now looking for people/companies who own unused .COM domain names. We need to point these domains to our main image server for two weeks per domain.

   For example, if you own 10 unused domains, we would need you to change the DNS so the A record of each domain would point to our captcha server’s IP address. We are willing to pay $1USD (or best lowest bid) to use up to 1000 domains for 2 weeks each. Please let us know if you can provide this type of service.” (http://www.getafreelancer.com/projects/Data-Entry/Domain-Pointing-for-BulletinPics-CAPTCHA.html)

   How this is all legal is beyond me.

2. The trouble is, as long as no one prosecutes them they won’t really care.

   I have reported the issue to MySpace but am not sure what, if anything, they are doing about it. They don’t exactly have the most spotless record on security issues. However, they seem to be doing something, because once you’ve populated the scam forms with junk data and replied “MySpace” to the question of where you got referred to their site, they give you this message:

   ====
   We apologize but MySpace has advised our content partners
   that we may not serve our site’s content to MySpace users.
   If you receive a link to this site from another network
   in the future, please feel free to return.

   Click here to go back to MySpace.
   If you are no longer logged in,
   please type http://www.myspace.com
   directly into your browser.
   ====

   We don’t know if “Adam Arzoomanian” or “Scott Shaw” are the real names of people involved in this scam or not. No one really verifies details in WHOIS records, as long as the credit card payment doesn’t bounce the domain gets registered…

3. This was really informative! Thank you for taking the time to do this. I can usually spot a fake website like this, and I did.
   I just got a message from my cousins myspace account saying my Display pic was all over the site. I go there, but then try to leave. But then I start to fill in information, but before I finish I X’d out completely before sending anything.

   I was curious though, because my myspace display pic had shown up on like the front or something like that on imageshack.us last week, so I was like, “Maybe it happened again?”

   Anyways, very informative and I’m telling everyone I know about this article!

4. Add to that list srcient.com and atomisphere.com being sent to myspace users.

   Thanks for the info.

5. Thanks, Doug! I added those two to the SURBL blacklist as spam sites.

6. I received the same scam pointing to:
   kchangcube.com

   I also found this list of domains apparently registered on 7/14/2008 and checked a few of the ones begining with “kchang” which seemed to all come from the same place.

7. Sorry forgot to provide the link for that list:

   http://domain-daily.com/new/2008-07-14/115.html

8. Thanks, Rick. There’s tons of them amongst the list you pointed me to, including:

   deeblab.com
   deenic.com
   deeopia.com
   deepath.com
   deespace.com
   deesphere.com
   deezoom.com
   dreblab.com
   drebuzz.com
   dreclub.com
   drecube.com
   dreopia.com
   drepad.com
   drepath.com
   drepoint.com
   drevine.com
   drezoom.com
   kchangblab.com
   kchangbuzz.com
   kchangclub.com
   kchangcube.com
   kchangmix.com
   kchangnic.com
   kchangopia.com
   kchangpad.com
   kchangpath.com
   kchangpoint.com
   kchangspace.com
   kchangsphere.com
   kchangvine.com
   kchangzone.com
   kchangzoom.com
   mdanblab.com
   mdanbuzz.com
   mdanclub.com
   mdancube.com
   mdanmix.com
   mdannic.com
   mdanopia.com
   mdanpad.com
   mdanpath.com
   mdanpoint.com
   mdanspace.com
   mdansphere.com
   mdanvine.com
   mdanzone.com
   mdanzoom.com
   queenblab.com
   queenbuzz.com
   queencube.com
   queenmix.com
   queennic.com
   queenopia.com
   queenpad.com
   queenpath.com
   queenpoint.com
   queensphere.com
   queenvine.com
   queenzoom.com
   spinblab.com
   spinopia.com
   spinsphere.com
   spinvine.com

9. and more:

   ubzblab.com
   ubzbuzz.com
   ubzclub.com
   ubzcube.com
   ubzmix.com
   ubznic.com
   ubzopia.com
   ubzpad.com
   ubzpath.com
   ubzpoint.com
   ubzspace.com
   ubzsphere.com
   ubzvine.com
   ubzzone.com
   ubzzoom.com
   uuubzblab.com
   uuubzbuzz.com
   uuubzclub.com
   uuubzcube.com
   uuubzmix.com
   uuubznic.com
   uuubzopia.com
   uuubzpad.com
   uuubzpath.com
   uuubzpoint.com
   uuubzspace.com
   uuubzsphere.com
   uuubzvine.com
   uuubzzone.com
   uuubzzoom.com

10. Dear Sir,
    Thanking you and have a nice day. I am very much interested to join online captcha entry & all kind of data entry project. I have an experience and dedicated a group for performing the job. So i need your help. I promise you that always i give you support as your requirement. Pls give me a chance to join with your job.

    I am waiting for your nice confirmation.
    Best Regards
    Ahsan
    My E-mail:ahsan_0115@yahoo.com
    Office address: 511 West Nakhalpara,
    Tejgaon, Dhaka-1215,Banglagesh.
    Phone: 088-02-8155249
    Cell: 088-01199099949.

11. Dear sir, I am from Bangladesh. I have many experience in captcha entry work. I can give u 15000+ entry per day. If u want more, ok, I am agree. And also agree with ur rate. I am waiting for ur reply.
    My e-mail- rony_fastlife@yahoo.com
    office:- H#47, R#13, Nikunja-2, Dhaka-1229
    Yahoo id- rony_fastlife
    Thank you

12. Thanks for the information. I also got a myspace message saying that my profile pic was “all over” a website. Please add DINALOAD.COM to your list of Adam Arzoomanian websites that ask for your name and your friend’s name. I didn’t go any further than that because it was obvious at that point that the whole thing was a scam. It would not allow me to X out. When I tried it sent a new error message that said that by leaving I was giving them permission to erase the pictures and that I would never get another chance to see them. JERKS. I had to bring up Task Manager and End Task to get out of the website.

    I’m careful. Not exceedingly so, but as an example, this is the second time I’ve written this comment because the first time I went to add a comment to your blog I didn’t include my email address. Before doing so this time I checked out Joe Wein and JWSpamSpy. I’m satisified that it is unlikely that this blog is anything but what it seems to be.

    What I don’t understand, and maybe you can explain this to me, is where the money is in this kind of spam. I have a hard time believing that it is all just some kind of elaborate childish prank. Too much time and money has been put into all of the website registrations for it to be just a bunch of jerks getting a laugh about how big they can make this joke. Who is making money and how? Are they selling the email list information? It just doesn’t seem to make any sense to me. Do you know?

    Confused and mad,

    Leeland

13. I can only guess how exactly they will monetize this scam. The possibilities are virtually endless.

    For instance, recently there has been an upsurge of non-419 spam (such as pill spam) sent from Hotmail and AOL accounts, which would be possible with thousands of phished passwords of users of such accounts. So these people could sell access to email accounts to spammers. By using existing accounts of known people they will be whitelisted in numerous spam filters.

    They could also simply sell the address lists (phished accounts + all addresses in the online address books) to spammers. I’m not sure what the going rate is. As long as the spammers pay more for the addresses than the scammers pay for CAPTCHA solving it will be profitable.

    Last but not least, they could trawl the mail archives in the phished accounts to find information for accessing other resources, for example, information about Amazon.com or other online purchases, or emails about online banking.

    Scammers have been doing specific phishing formats for breaking into Amazon.com accounts, because electronics fraudulently purchased there can be resold for cash.

    The possibilities in this scam are really only limited by the scammers’ imagination and their criminal energy.

14. Adam Arzoomanian is at Spin Nightclub in Las Vegas.

    Google search “Sanford Wallace” aka DJ MASTERWEB and Spin Las Vegas.

    Adam Arzoomanian is at Spin, Sanford Wallace is at Spin.

15. Hi MJP10,

    thanks for the research!

    A couple of weeks ago I came across a list of top 10 spammers that mentioned “Spamford” Wallace is now working as a DJ in Vegas and the same thought occurred to me, but didn’t have the time to verify it then.

    I have added an update to the main article above.

16. Joe-

    Thanks for posting all of this info. This morning, due to too much curiosity, I fell victim to the uuubzpad.com site. I gave them my secondary e-mail account, not my personal, primary one. However, the password I gave was false. Aside from selling my address, am I still at a great risk if they don’t have my Actual password for the account? I went ahead and posted a link to this blog on the Facebook discussion page about Scam/Spammers–I hope you don’t mind!

    -Lea

17. Hey I did the same thing as Lea for the kchangvine crap. I never use the email which I gave out and I did not put in a real password. I have the same question as her.

18. friends-to-friends-only.com (208.73.210.50):

    Domain Name: FRIENDS-TO-FRIENDS-ONLY.COM

    Registrant [1405632]:
    Adam Arzoomanian bulletinpics@gmail.com
    375 E Harmon
    Las Vegas
    NV
    89109
    US

    IP 208.73.210.50 is listed on SpamHaus SBL as being as being assigned to, under the control of, or providing service to a known professional spam operation run by Spencer Wiggins, who is on their “Register Of Known Spam Operations (ROKSO)”.

    ROKSO spammers are the worst of the lot.

19. Lea and Carly,

    if your actual password is different from the one you gave, you’re probably reasonably safe (other than maybe getting more spam at your email account).

20. 🙂 Hi there!

    Thank you for posting all of this. It’s really good information to have, and I hope people see it before they get phished.

    They have two more domain names– Atomisphere.com, and Friends-to-Friends.com that I know of.

    They hacked my friend’s Facebook and used it to post a message on my wall that said, “did uu know ur default image is displayyed on atomisphere.com” using precisely that attrocious grammar, so I knew it wasn’t my friend.

    I decided to find out what the site was so I could warn her, and it gave me the same page and prompts you’ve displayed here, along with a message when I tried to leave that said, “WARNING: If you leave now you may NEVER get to see the photos your friend reserved for you.” (Along with a lot of other stuff.)

    These phishing sites are pathetic! And they’re getting so lazy too; like those e-mails I receive all of the time that have specific subjects, but the messages say qedtfhjyjhjkhjkhghjg.

    Thank you so much for your blog. Keep up the good work! 🙂

21. Pingback: The No-Name Blog » Blog Archive » Let Freedom Ring

22. add “what is cyanzoom”
    “what is queenpath”

    cyanzoom.com
    queenpath.com

23. I have a question, what is the best action to take if you do fall victim to one of these sites? I friend of mine went to the site and filled out the first part with email and password and then phone #. Any info would be helpful!

24. Joe, just wanted to add my sincere thanks to the list of the grateful. It was pretty obvious off the bat that this was a phishing scam, but the investigative work you’ve done and documented here is highly commendable.

    Just to add my experience to the documentation, I was sent this message from a friend’s hacked Facebook account:

    “heyy do you realize your face book pictre is alll over uuubzvine.com”

    The uuubzvine.com link brought me to “friends-to-friends-only.com,” where everything else played out exactly as you’ve described (popups about a picture being uploaded, fill in your FULL name, etc). Pretty scummy.

    Anyway, thanks again. Rock on.

25. add Brightium.com to your list of Adam Arzoomanian sites.

    This is evil.

26. Pingback: Facebook “Virus” — ubzcode.com | Veritrope

27. IF you don’t log in with your email address or password are you safe??? I went to cyanzoom.com and just x’d out but I was wondering am I at risk still???

28. Thanks for all the great info. My husband got a message this morning at 3:14am stating “did you realize that your profile picture is all over cyanzoom.com” from one of his friends. I went to investigate this and we ALMOST fell victim to it. I decided to research it and found your website. I’m marking this as a favorite. Thanks for putting up this great information! We really appreciate the time you took into researching it.

29. Some one has notified me that my default pic from facebook is on this website and I was wondering how to find it and remove it.

30. I was notified from a friend that my default from my facebook profile was on this website. I have no idea of how to find it or remove it. Can someone walk me thr this

31. I got this dam bug on my facebook account and it sent a copy of the message i clicked to over 400 friends. Is there anything other than changing your password that needs to be done??

32. a friend told me my profile pic was here!WHATS GOIN ON?IS THS A SCAM OR WHTS GOIN ON

33. This scam is really traveling through Facebook. My friend was sent the message: “Did you know your profile picture is all over queenbuzz.com?” We both came close to falling for it. It took some Google digging to find your page to figure out what was going on. Thank you for your lucid and comprehensive research and explanation.

34. Hello, I am Adam Arzoomanian. I am real and have nothing to due with any of this. I seperated from Spin 6 months before any of this started. I would guess that my name was used by someone who had my info and a grudge!! Wow could it be someone with a history of internet SCAM’S!!!! I am a good man and businessman with a clean record and good history.

35. Hello Adam,

    if you did not register the domains that have been registered using your name then you can report them to the registrars and have them deleted for fraudulent WHOIS data.

    According to this blog here:

    http://garwarner.blogspot.com/2008/11/facebook-users-beware.html

    there are 491 of these domains.

36. Let me add that I would actually be quite surprized if in any phishing scam the perpetrator used his own real name for registering the domains.

37. Pingback: The “new shopping new life” spam

38. This is the REAL Adam Arzoomanian. HOW dare the press call me a CYBER CRIMINAL I am a victim of identity theft and Dont even own a computer!! Sanford Wallace is a covicted criminal . I have never been charged nor convicted of any crime!!! He Stole my identity and has destroyed my reputation. I need help fighting this because I have neither the ability not the resoures to do ANY of what i have been alleged to have done.What makes more sense? Someone with no formal computer training or criminal history with a unblemished history in property, resort and nightclub management was a MASTERMIND of and elaberate world wide computer scam. Or the SPAM king stole his identity and did it without his consent or knowledge? MMM use your head people I have been destroyed by this man. I cant even take care of my stage three cancer ridden wife becasue I cant get a job. If by some chance some kind good person out there can help me to clear my name I would be greatfull. Thank you joew i will try that

39. Been receiving emails stating picture all over site. The two sites that i remember are
    crimsonblab.com and drezoom.com
    Has any of my personal information been compromised or facebook account been altered because of these?

40. Hope that Adam Arzoomanian can get help in clearing his name. Identity theft is such a huge problem in so many areas. Has anyone been able to give him advice? I don’t know what to tell him, but hope that someone out there can help. It’s really bad when anyone can do this to anyone!!

41. I know adam arzoomanian personaly he does work at above mentioned resort as for the night club i think they run that there to accross the street from the hard rock the nameslips my mind. I do know for fact that this adamarzoomanian is way to busy a man and makesway too much income to try and scam any body This is a federal offense he should get a lawyer the source shouldnt be hard to trace
    Best Reguards,
    Angie

42. @Angie,

    unlike you I don’t know Adam Arzoomanian personally, but I doubt anyone with the criminal energy to run this kind of scam would be using his own name for registering the domains, certainly not after spammer Sanford Wallace was sentenced to pay $230 million to MySpace for scams like that.

    Using his own name would be like mailing the MySpace and Facebook legal departments and asking to be sued.

    We can conclude Adam Arzoomanian can not be the scammer. He is an innocent victim in this scam. The criminal must be someone else who was abusing his name. I hope whoever did this to Adam Arzoomanian will get his just deserts.

43. I will testify to your character i think it may help

44. I will testify to your character i think it may help If you wantmeto try and help contact me

45. but u understandabley dont leave your contact info but I do see u check on the site txt email me angelica.barron@ymail.com I will “Testify to knowing you seeing you work at alexis park ur character and that you had very litl commputer knowledge when I met you Hope I can help

46. Here’s an interesting article on Sanford Wallace and his phishing operation against MySpace and Facebook users:

    Spammer ordered to pay Facebook $711 million
    http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2009/10/30/BUSO1AD0KI.DTL&type=tech

47. Pingback: Facebook "Virus" — ubzcode.com | Veritrope