Re: The Gaiscioch Imposter Key Scam - For Developers

Greetings,

If you are reading this you may have received an email from a bfoley@gaiscioch.org address. This domain is not affiliated with the Gaiscioch Social Gaming Community (gaiscioch.com or gsch.info). This domain was registered by a Guiying Zheng out of China.

Please be sure to check all communications to ensure that they are coming from the "@Gaiscioch.com" domain only.

We are adamantly working on getting the domain shut down for good but this guy will likely appear on another gaiscioch.jerk domain. As Gaiscioch is a no-profit community we do not have the financial support to buy and maintain every possible domain. Being this person is overseas there's not much that law enforcement can do. I deeply apologize for the inconvenience and hope that this matter will be resolved shortly.

Imposter Information

This imposter will typically ask for Game Keys which they then turn around and resale on various key websites. Here is a sample of their typical letter

Fraudulent Email from bfoley@gaiscioch.org

Greetings,

It is nice to e-meet you! I would like to formally request 20 press keys
for your game on Steam. I realize this is more than a usual request, but
we have a large readership and would like to conduct some Team vs Team
games. We like to give a few different perspectives for our reviews and
have multiple reviewers for that purpose (We take a sort of Siskel and
Ebert approach). Reviews will be posted to our official website, our
digital magazine, and on Steam, and you will be provided with links to
them when they are published. We have chosen your game to cover because we
believe it is a game our readers would be interested in.

You can read more about us here. http://www.gaiscioch.org/about/
Gaiscioch press releases & in the news:
http://www.gaiscioch.org/about/press.html
Latest issue of our magazine:
http://issuu.com/gaiscioch/docs/gaiscioch-magazine-issue-6
Demographics: http://www.gaiscioch.org/about/demographics.html


Kind regards,

Benjamin Foley
Founder & Activities Director
http://www.Gaiscioch.org
bfoley@Gaiscioch.org

Whois Lookup:

Domain Name:GAISCIOCH.ORG Domain ID: D177321126-LROR Creation Date: 2015-09-04T21:54:34Z Updated Date: 2015-11-04T03:48:37Z Registry Expiry Date: 2016-09-04T21:54:34Z Sponsoring Registrar:New Dream Network, LLC dba DreamHost Web Hosting (R173-LROR) Sponsoring Registrar IANA ID: 431 WHOIS Server:  Referral URL:  Domain Status: clientTransferProhibited -- http://www.icann.org/epp#clientTransferProhibited Registrant ID:c0669605a0c3761f Registrant Name:Guiying Zheng Registrant Organization:??? Registrant Street: F2 BLdj,5 No.37 Chaoqian Registrant City:Beijing Registrant State/Province:Changping District Registrant Postal Code:102600 Registrant Country:CN Registrant Phone:+10.89721374 Registrant Phone Ext:  Registrant Fax:  Registrant Fax Ext:  Registrant Email:admin@gaiscioch.org Admin ID:c0669605a0c3761f Admin Name:Guiying Zheng Admin Organization:??? Admin Street: F2 BLdj,5 No.37 Chaoqian Admin City:Beijing Admin State/Province:Changping District Admin Postal Code:102600 Admin Country:CN Admin Phone:+10.89721374 Admin Phone Ext:  Admin Fax:  Admin Fax Ext:  Admin Email:admin@gaiscioch.org Tech ID:c0669605a0c3761f Tech Name:Guiying Zheng Tech Organization:??? Tech Street: F2 BLdj,5 No.37 Chaoqian Tech City:Beijing Tech State/Province:Changping District Tech Postal Code:102600 Tech Country:CN Tech Phone:+10.89721374 Tech Phone Ext:  Tech Fax:  Tech Fax Ext:  Tech Email:admin@gaiscioch.org Name Server:NS1.DREAMHOST.COM Name Server:NS2.DREAMHOST.COM Name Server:NS3.DREAMHOST.COM Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  Name Server:  DNSSEC:Unsigned

Contact abuse@dreamhost.com and let them know that the domain is engaging in fraudulent impersonation and identify theft.  If they lock it and take control of it, that dude is shut down... well, for a while, because he will have to buy it back whenever it comes available again.

On the plus side, at least someone didn't hijack your domain and turn it into an Ice Cream recipe page for ~7 years. 

(that happened to me)

Oh we did sek, we even had Konlyth (Big Business Attorney) send several cease and desist letters. No action has was taken so i filed a complaint from ICANN and im waiting for a reply.

That said even if that domain is taken dow what stops them from using any other domain the same way. I cant possibly afford 100+ different domains. The only way we defeat this is through educating developers about key phishing scams.

Atm most of them companies seem to be targeted from steam between sep 20th and oct 10th. Havent found any out of that range but so far 8 companies have come forward and i suspect there were a lot more being every email is identical. This was a mass mailing.

Any way to send this to the Steam devs, or to Steam itself to give them a heads up? It sounds like you might have that already covered, however.

Ok, good, so you did file a complaint with ICANN.  That's the next best step, play the ID theft/fraud angle and that you've contacted Dreamhost several times with no response.

Personally, I'd also get the FBI involved, contact the State Department re:contacting the Chinese Consulate (angle being keeping pressure on combating Chinese cyber-crime, which is currently a hot-topic)

This is serious, I didn't realize it was this serious.  This is a crime.  People can paint whatever white-wash they want over it, "oh it's not that bad, just some game keys", but it's a lot more than that.  They (the bad guys) do this because it's very hard to fight against, hence the reason why fighting against Chinese cyber-crime is a hot-topic with the State Department right now.  Many businesses are affected by similar crimes, its not just some little "fan-fic" non-profit community of gamers like us. 

For example, in just this one instance, several gaming companies, both large and small, were scammed out of digital product.  It wasn't really a huge loss for them, but it adds up for the criminals.  Not to mention the bad relationships it creates between legitimate press organizations that are small and trying to grow, like the GSCH Magazine.

Honestly though, after writing this and thinking about what I wrote, the best way to combat this kind of crime from our level is to work on building better developer relationships, so when something comes across their inbox that looks... "odd", they will think of contacting us directly, rather than just replying.

I mean I would still do what I stated earlier, it is a crime so "See something, say something.", but rather than spend further time outside of making those complaint contacts, I'd focus on making relationships with developers.

Question: Seeing that gaiscioch is a non profit, Is there a location (thinking paypal/google wallet/etc) where the members can donate toward the cause of acquiring and maintaining these side domains, so they don't fall into the wrong hands in the future? 

Apologies if this seems like a silly question, as I'm new, but I know I'd be game to help in this regard, and i'm sure that many members would be. 

if you'd like I can ask my buddy who works for the government if he could do something about this guys internet capability.

Myzron,

the problem is there are literally hundreds of them now. with the launch of the new ones there's limitless possibilities. We would spend thousands every year to maintain that. It's simply not feasible for a community like ours. And we are not Non-profit. We are not trying to make a profit but we are not a registered non-profit organization. We're a hobby and I claim it on my personal taxes. There is a donate button on the bottom right if you feel so inclined but it's not required or expected. I put it there after arm twisting from a lot of our members. 

I actually checked out dreamhost and the imposter URL too.  For one he doesn't dare have page show up under the main URL.  It is still listed as unavailable as a domain you can buy.  Then the fun of domain names there are only like 10 different ones for .whatever Dream Networks lists but they hae the caveat of "and more!" on there.  URL naming has far more capabilities than it ever did before and the days of simple .com and .orgs, etc. is GONE!

Technology advances are cool, but it definitely leads to both good and bad.  It all depends on what the people do with the tools.  All things happen based on human decisions, not the tool's fault.

Fog, 

Thanks for the reply.

I see your point, I just did a quick domain search, with one registrar, and got almost two dozen options. 

Well so much for wishful thinking, i guess this whole internet thing is really gonna take off someday...

Yea, there are a crap ton of domain suffixes now.  That's why, when I regained control of my brand's domains, I just keep waelwulfas.com and waelwulfas.org since they're the main ones, and that's all.  Yea, the .net, .info and .biz domains are nice to have, but really not necessary. 

One could argue .org isn't necessary, but if you run an organization, it's something that someone can easily use to spoof your organization's identity... as exampled with this case.

When it comes down to it though, at some point, its on the companies to check to see if a contact is bogus or not.  Phishing is not just a problem on a personal level, companies get it too, (if not more) and developers should not just throw free keys at anyone claiming to be someone that they've heard of, without doing some checking first. 

If they don't, then they certainly have no reasonable grounds to hold the legitimate folks responsible.