Each Scammer makes mistakes. Even if they invest a little bit into their scam they are making mistakes. So Gaby Anderson with stanfordonlinecourses.com is making mistakes.
His first mistake is his profile picture. He uses the profile picture of a photo model, which gets found at Google on 436 search pages. The original picture gets found at questmarketing.org. He has used this profile picture on his profile at LinkedIn and Facebook [2016-02-25: Link removed as the Facebook profile under https://www.facebook.com/ganderson84?fref=nf already not exists]. He deleted already the picture from his LinkedIn profile.
The Stanford University has no reason to hide their domain registration by using a proxy service, They are proud about their name and they are even hosting their servers and services by themselves. Their online courses are hosted at http://online.stanford.edu/ This gets shown if we take a look at the domain registry data for stanford.edu:
Domain Name: STANFORD.EDU
Registrant:
Stanford University
The Board of Trustees of the Leland Stanford Junior University
241 Panama Street, Pine Hall, Room 115
Stanford, CA 94305-4122
UNITED STATES
Administrative Contact:
Domain Admin
Stanford University
241 Panama Street Pine Hall, Room 115
Stanford, CA 94305-4122
UNITED STATES
(650) 723-4328
sunet-admin@stanford.edu
Technical Contact:
Domain Admin
Stanford University
241 Panama Street Pine Hall, Room 115
Stanford, CA 94305-4122
UNITED STATES
(650) 723-4328
sunet-admin@stanford.edu
Name Servers:
ARGUS.STANFORD.EDU 171.64.7.115, 2607:f6d0:0:9113::ab40:773
AVALLONE.STANFORD.EDU 171.64.7.88, 2607:f6d0:0:9116::ab40:758
ATALANTE.STANFORD.EDU 171.64.7.61, 2607:f6d0:0:d32::ab40:73d
Domain record activated: 04-Oct-1985
Domain record last updated: 23-Mar-2015
Domain expires: 31-Jul-2016
Their name is their trademark. Such an university will not hire telemarketers for promotion their online education.
If we take a look at Gaby Andersons domain stanfordonlinecourses.com, then we see that the register data are hidden behind a proxy service and the nameserver are not the same like from stanford.edu, Additional has been the domain created on January 6, 2015. The domain is now 4 months old:
Domain Name: STANFORDONLINECOURSES.COM
Registry Domain ID: 1894354618_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: [link removed] Date: 2015-01-06T15:28:52Z
Creation Date: 2015-01-06T15:28:52Z
Registrar Registration Expiration Date: 2016-01-06T15:28:52Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Phone: +1.480-624-2505
Domain Status: clientTransferProhibited [link removed] Status: clientUpdateProhibited [link removed] Status: clientRenewProhibited [link removed] Status: clientDeleteProhibited [link removed] Registrant ID:
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
Registrant Street: 14747 N Northsight Blvd Suite 111, PMB 309
Registrant City: Scottsdale
Registrant State/Province: Arizona
Registrant Postal Code: 85260
Registrant Country: United States
Registrant Phone: +1.4806242599
Registrant Phone Ext:
Registrant Fax: +1.4806242598
Registrant Fax Ext:
Registry Admin ID:
Admin Name: Registration Private
Admin Organization: Domains By Proxy, LLC
Admin Street: DomainsByProxy.com
Admin Street: 14747 N Northsight Blvd Suite 111, PMB 309
Admin City: Scottsdale
Admin State/Province: Arizona
Admin Postal Code: 85260
Admin Country: United States
Admin Phone: +1.4806242599
Admin Phone Ext:
Admin Fax: +1.4806242598
Admin Fax Ext:
Registry Tech ID:
Tech Name: Registration Private
Tech Organization: Domains By Proxy, LLC
Tech Street: DomainsByProxy.com
Tech Street: 14747 N Northsight Blvd Suite 111, PMB 309
Tech City: Scottsdale
Tech State/Province: Arizona
Tech Postal Code: 85260
Tech Country: United States
Tech Phone: +1.4806242599
Tech Phone Ext:
Tech Fax: +1.4806242598
Tech Fax Ext:
Name Server: NS51.DOMAINCONTROL.COM
Name Server: NS52.DOMAINCONTROL.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: [link removed] update of WHOIS database: 2015-05-06T22:00:00Z
As we know that scammer are lazy gets the website http://www.stanfordonlinecourses.com [2016-02-25: Link removed as the domain standfordonlinecourses.com already not exists] forwarded to https://lagunita.stanford.edu.
Let's take a look at Gaby Andersons offer in Facebook:
-Inbound / Outbound EDU Campaign-
Hourly Rate: $20/hour/agent
Payment Cycle: Weekly
Program Description: Take a call from students who's interested enrolling in college
Leads: Included
Dialer: Included
Voip: Included
We prefer centers in Philippines!
For more info you can contact me at:
Email : ganderson@stanfordonlinecourses.com
Skype : stanford.ganderson
You can expect, that nobody from USA will outsource for $20/hour/agent. Nobody likes to pay more then absolute necessary. In the campaign detail description is even written: $20.00/hour with $3.00/hour increase after 3 months of service. For this money nobody will hire an offshore call center. He can have it for the same price in the USA too.
As written in the announcement the scammer is preferring call centers from the Philippines. I got forwarded a Skype communication from Gaby Anderson:
Hello Mr.Anderson
[5/21/2015 10:55:34 PM] Hamza Ali Khan: Do you still have that inbound campaign?
[4:01:02 AM] Gaby Anderson: Yes
[4:01:30 AM] Hamza Ali Khan: Can you send me the details to my email please?
[4:01:40 AM] Hamza Ali Khan: hamzaalikhan7@gmail.com
[4:01:47 AM] *** ***
[4:08:27 AM] Hamza Ali Khan: Great!
[4:09:29 AM] Hamza Ali Khan: So are you hiring on individual basis or call centers only?
[4:09:51 AM] Gaby Anderson: CAllCenter
[4:09:58 AM] Hamza Ali Khan: Wonderful!
[4:10:14 AM] Hamza Ali Khan: Please visit our site for the company profile smile emoticon
[4:10:26 AM] Hamza Ali Khan:
[4:12:05 AM] Hamza Ali Khan: we have been working with a number of overseas clients for last 8 years.
[4:15:03 AM] Hamza Ali Khan: Let me know what will be the process moving forward.
[4:16:44 AM] Gaby Anderson: Let me Tell you Directly before i pass you to my campaign manager CALLCENTER IN INDIA BANGLADESH PAKISTAN we require them to have a safety deposit with us justy to be sure they would comply to the job
Exactly here is the scam. A safety deposit has to receive the center and not the broker. The center is doing the work. The broker or the client has no risk especially if the provide the phone system and VoIP minutes. In this case they are able to stop a center even without any notice. For this the safety deposit is nothing else than a big SCAM.
A IP-check of his Skype connection locates him today at 10:15am Philippines time with the IP address 49.145.213.188. The geolocation shows that he is operating with his fraud from Manila and is using the provider PLDT.
Whois information:
% [whois.apnic.net]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
% Information related to '49.145.128.0 - 49.145.255.255'
inetnum: 49.145.128.0 - 49.145.255.255
netname: Consumer_DSL
country: PH
descr: PLDT_BNKHME60I01_DHCP
descr: This space has been assigned as DYNAMIC
admin-c: NA185-AP
tech-c: RA328-AP
status: ASSIGNED NON-PORTABLE
changed: removed email address 20130424
mnt-by: PHIX-NOC-AP
mnt-irt: IRT-PLDT-PH
source: APNIC
irt: IRT-PLDT-PH
address: Philippine Long Distance Telephone Company
address: 6/F Innolab Building
address: Boni Avenue, Mandaluyong City
+address: Philippines
e-mail: removed email address
abuse-mailbox: removed email address
admin-c: AR238-AP
tech-c: NA185-AP
auth: # Filtered
mnt-by: PHIX-NOC-AP
changed: removed email address 20101117
changed: removed email address 20101126
source: APNIC
person: Nilo Agir
nic-hdl: NA185-AP
e-mail: removed email address
address: 6/F Innolab Building, Boni Avenue, Mandaluyong City
phone: +632-584-1045
country: PH
changed: removed email address 20080526
changed: removed email address 20110427
mnt-by: PHIX-NOC-AP
source: APNIC
person: Rolando M. Araw Jr
nic-hdl: RA328-AP
e-mail: removed email address
address: 3/F MGO Bldg, dela Rosa St, Makati, MM, Phils
phone: +632-836-2569
country: PH
changed: removed email address 20101117
mnt-by: PHIX-NOC-AP
source: APNIC
% This query was served by the APNIC Whois Service version 1.69.1-APNICv1r0 (UNDEFINED)
Conclusion: The scammer Gaby Anderson with his domain stanfordonlinecourses.com is misusing the good name of the Stanford University for his fraud action. He does everything to hide his identity. I hope the police will catch him soon and stop his fraud.
Facebook profile Gaby Anderson.pdf (628.57 kb)
LinkedIn profile Gaby Anderson.pdf (3.64 mb)
SOC-Call-Center-Requirements.pdf (316.97 kb)