Fake Affiliate Impersonating WagerHome.com, TheRx.com
Beware pay per head agents! Gambling911.com has been informed that a fake affiliate with no relationship to pay per head site WagerHome.com is emailing agents pretending to represent this company.
“Here is list of sites that they use that are not with us- there main site perhead.co, which they are obviously trying to act like they are part of perhead.com also,” the Wagerhome.com rep advised G911 Monday.
Below is an email the scammers have been sending out-and on top of it they are using an email newsletter@therx.com.
“We contacted them and they are saying it is someone spamming and its not them- we have them (therx.com) looking into this.”
Dear Agents,
This is the pay per head service for this NFL season. They offer loads of features at a fraction of the price.
Their service and staff speak for them selves, Try one week free!
These are the sites that come up on Digg.com reverse IP check:
These are the sites that come up on Digg.com reverse IP check:
Here is how they impersonated therx.com apparently:
Website ip hosted on racsa colocation is [196.40.84.43/ezbm.ag ]
Email Ip hosted on bluehost.com is [208.65.203.94/server1.reddotforum.com]
EMAIL HEADERS BELOW (replace our domain and sender with xxx.com)
They try to impersonate newsletter@therx.com, they even send the Antiabuse header from them
MIME-Version: 1.0
Received: from mail.xxx.com (127.0.0.1)
with Microsoft SMTP Server id 14.2.247.3; Mon, 19 Aug 2013 16:29:26 -0400
Received: from server1.reddotforum.com ([208.65.203.94]) by mail.xxx.com
over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Mon, 19 Aug 2013 16:29:25 -0400
Received: from [186.177.88.31] (helo=127.0.0.1) by server1.reddotforum.com with esmtpa (Exim 4.69)
(envelope-from <newsletter@therx.com>) id0003w7-EC for xxx@xxx.com; Mon, 19 Aug 2013 16:29:24 -0400
From: THERX PERHEAD <newsletter@therx.com>
To: YYY<xxx@xxx.com>
Subject: Recommended PerHead This NFL
Date: Mon, 19 Aug 2013 14:24:57 -0700
Organization: TheRX Forum
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.reddotforum.com
X-AntiAbuse: Original Domain - xxx.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - therx.com
Return-Path: newsletter@therx.com
Message-ID: <MX0NTY9agv0000056d@mail.xxx.com>
X-OriginalArrivalTime: 19 Aug 2013 20:29:26.0021 (UTC) FILETIME=[CC280B50:01CE9D1A]
X-MS-Exchange-Organization-AuthSource: xxx.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: therx.com
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (SRV-EXCHANGE-01.cog.local: newsletter@therx.com does not designate permitted sender hosts)
Players, as always, need to exercise caution when dealing with pay per head companies.
- Chris Costigan, Gambling911.com Publisher
