InBoxRevenge KS Forum

Note: This topic was moved from the Tools area to "Fight Spammers" to allow for more general discussion



Domain Name: AVO.NET
Registrar: TPP WHOLESALE PTY LTD.
Whois Server: whois.distributeit.com.au
Referral URL: http://www.tppwholesale.com.au
Name Server: NS1.AVO.NET
Name Server: NS2.AVO.NET
Name Server: NS3.AVO.NET
Name Server: NS4.AVO.NET
Name Server: NS5.AVO.NET
Name Server: NS6.AVO.NET
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 08-nov-2012
Creation Date: 07-oct-1996
Expiration Date: 06-oct-2022

Is there a complaint against avo.net? It looks legitimate. It has all of the correct links for McAfee, Comodo etc.

However, I did notice the dodgy looking 90-day investment plan:

avo.net Spam received
Spammed from an IP in Colombia: 186.144.35.22
From: "Susanna Mcguire" <daverkb@olec.com>
Subject: 3% DAILY PROFIT!!!
Date: Tue, 13 Nov 2012
Body text:

I've been getting hundreds of similar ones in the last few weeks to all my joe-job honeypots (and that's pretty much all spam I have got on the whole lately), so I've been assuming this is a joe-job, considering the domain creation/expiration dates and all those certificates. Not that I'm very fond of what the site looks like after a cursory study, but anyway...

BTW, this site was shortly mentioned earlier elsewhere. There's also a redirector site, avousa.com, which has also been heavily promoted in (joe-job?) spam mails lately.

It would be really nice to know what's actually going on there.

My belief - avo.net was a dormant domain, that came up for renewal, and was taken up by some HYIP-style people.
It changed registrar from ENOM in August to TPP WHOLESALE PTY LTD. some time later

.Domain Name: AVO.NET
.Registrar: ENOM, INC.
.Updated Date: 11-aug-2012

.Domain Name: AVO.NET
.Registrar: TPP WHOLESALE PTY LTD.
.Updated Date: 08-nov-2012

There has been heavy promotion of avo.net over the past 2 months in HYIP hyping forums. It has often bought the top banner ad. They talk of having been hit by DDOS and taking protection measures, and sure enough they are under Prolexic's care, as seen by the DNS and IP addresses. They also had to hastily change to avousa.com.

I am also amazed at the number of valid certificates they have accumulated and display on the front page. Such an over-the-top overkill raises suspicions - "The lady doth protest too much, methinks", But then, nothing really amazes me these days,
If you go to avousa.com you get redirected to https://avousa.com/index.php and then to avo.net anyway.

The web site promises to pay out at 3% per day, and return you the 270% profit and 100% of your initial investment after 90 days. All of the shrill shill plaudits claiming good returns on AVO are dated less than the 90 day period.

From their twitter feed

Aug 10 AVO INC We are pleased to welcome you to the AVO INC official website.

Oct 2 AVO INC was the target of the largest DDoS attack in the history of the Internet. Our site was received around 73,000,000 packets-per-second (PPS) SYN Flood and 118 Gbps UDP attack. In order to protect our site and clients we purchased the highest protection packages available from the all DDoS protection leaders. Finally choose the best option and we moved to Prolexic. It's the same protection provider that Liberty Reserve and most of the international banks use. From today, we guarantee that there will not be any downtime and http://avo.net will be online all the time from all counties.

Nov 1314% Daily Profit For 6 Calendar Days. Read more https://avo.net

I leave it to you to decide. I think that most people will be able to draw some obvious conclusions.

Where are the avo.net site visitors coming from? Taken from the statscrop.com report
Daily Visitors by Country for Avo.net, total 33 countries and 100,800 visitors per day.

ru Russia: 22,075 visitors(21.9%)
id Indonesia: 12,398 visitors(12.3%)
ua Ukraine: 6,854 visitors(6.8%)
pk Pakistan: 4,637 visitors(4.6%)
kz Kazakhstan: 4,133 visitors(4.1%)
br Brazil: 4,032 visitors(4%)
in India: 3,730 visitors(3.7%)
kr South Korea: 3,326 visitors(3.3%)
by Belarus: 3,125 visitors(3.1%)
us United States: 2,923 visitors(2.9%)
...

Does avo.net profess to be running a HYIP operation?
(My emphasis added)

Despite this assertion, hidden in the home page they have placed the HYIP keyword meta tags, designed to attract people to this site when they search on those HYIP keywords:


What other domains do they associate with?

Imbedded in the home page are these:

You're right, the smell of the rat is strong enough.

But somehow I think it's still possible this constant flow of spam is actually coming from one of their equally fishy competitors in the hopes of bringing them down (i.e. making people like us do the dirty work). I think I've never seen one single domain name been spammed this persistently, and I can't really see it being in their best interests. That could also explain those hypothetical DDoS attacks. But who knows -- like you, it's quite hard to surprise me anymore.

Anyway, I won't shed a tear when they'll be made close the shop.

The first one has been judged to be wanting by the registrar, who has placed it on ClientHold

I would like to see how they would explain that the domain they were "forced to change their main domain to" "due to the USA rules on providing international investment services" is suddenly down and they are back to avo.net.

It also seems they are currently having "problems" in paying to investors, who are starting to panic, e.g.: http://www.talkgold.com/forum/showthread.php?t=366328&page=673 . The end is probably — and hopefully — near.

Five months later they are girding up their loins ready to take in a new batch of noobie suckers and greed merchants

AVOUSA-INC.NET
Registrar = GoDaddy

The company web site proudly boasts



You do the trusting, we get your wealth.

Reviews please to http://www.mywot.com/en/scorecard/avousa-inc.net
Previous tracking is at http://www.talkgold.com/forum/r366328-.html and many Google hits on "avousa"

That's not what's there now:


So your initial statement is definitely correct (girding loins and all that... )

SiL

This is the web page I see when I load http://www.avousa-inc.net/