Banner advertisement request scam

vast · Dec 28, 2011

Got the following email a day ago:

From: Maxence Leclerc [email protected]

Hi,

We are looking for new advertisement platforms and we are interested in your site www.*********.com.
Is it possible to place banner on your site on a fee basis?

Best regards,

Maxence Leclerc

The first alerts I saw were the whois privacy turned on for nami-agency.com domain and its very recent registration. However, I didn't see any risks for me at that moment and I decided to give it a try, so I replied to that guy with a few questions regarding their advertisements. Then I've received the following:

Hello,

Thanks for reply to our proposal!

I represent Nami Agency. At the moment we are preparing an advertising campaign for Lacoste Company (it is a French company producing clothes, footwear, perfumery etc.) We already have designed banners for the campaign, they are the following sizes: 160x600, 240x400, 300x250, 336x280, 468x60, 728x90.
What can be your price for one banner (banner should appear at ALL pages of your site) of abovementioned sizes (please specify the place for the banner – top, bottom, left, right)? Please mention a normal link for banner, without javascript code and set prices in US dollars per month.

Best regards,

Maxence Leclerc.
site: www.nami-agency.com
e-mail: [email protected]
phone: + (0)9 78 62 68 47

OK, I replied with my price and the position/size of the banner. Got the following then:

Hi!

Thanks for reply to our proposal!
We like your price.
To pass to the banner control system follow the link http://webmaster.nami-agency.com
To enter use the following data:

login: www.*********.com
password: *********

You should install and activate the plugin in order to display advertisement. Before making payment, advertiser must approve location of the banner. The banner will be shown on your site when you add special code to your web- address (for example: http://www.*********.com/?adv_test=1. It means, that visitors will see the banner only if it is approved and payment made.

To get installation instruction for your site type pass to: http://docs.nami-agency.com/wp_install
To activate your site you have to enter the code: *********

What way of payment is suitable for you?

Best regards,

Maxence Leclerc.
site: www.nami-agency.com
e-mail: [email protected]
phone: + (0)9 78 62 68 47

I googled a bit and found the similar emails reported as scam on some other forums, the different names and sites were used though. I emailed him with the links that I've found and called him a scammer. Haven't heard from him after that.

It is clear now that this guy continuously builds out new sites for his scam activities and uses the same scheme all over again. I'm thankful to those people who have already reported that earlier. I guess he has a nice "plugin" 8-X. So, take care!

Ms Domainer · Dec 28, 2011

*

And if you place those banners on your site, you risk getting your domain/site confiscated and shut down due to Trademark infringement and other nefarious activities.

I ignore all such requests.

*

https · Dec 30, 2011

hey vast,
thanks for posting this.
i have been corresponding with this same person Maxence Leclerc mleclerc @ nami-agency.com for the past 2 days.
he approached me via one of my wordpress blogs. it sounded weird to me that someone was willing to put a lacoste banner on a site that was barely getting 5 uniques a day. this was a test blog i had installed to do some stuff on!
so from the get go, i had my reservations. but i went along with this person because he/she seemed like a legitimate ad/media company.
he told the exact same things he told u. he definitely has a script and he follows it to the letter! so i told him what sizes i could put on my site and quoted him a price. he didnt even try to negotiate. he just said. we like your price! and started giving me instructions on how to get this ad banner and some plugin to put on my site so the ad will go live, blah, blah, blah. seemed weird but still gave him the benefit of the doubt. so i copied the url to the site he gave me to login: docs.nami-agency.com/wp_install and as soon as i was about to input the login details he gave me, something spoke to me and i paused. i ended up pasting the url in google search. and your post was the only result on the google page. i was like oh my god. this mo'f*cker (oops can i curse on this forum?) was going to hack the heck out of my server! so needless to say, i am not going to that url to enter the login info he gave me. webmasters beware! now gotta get some sleep.. ciao!

notlikeyou · Dec 30, 2011

HTTPS...take that login link out of your post, if something is fishy it's not a good idea to link out to it!

mis_chiff · Dec 30, 2011

notlikeyou said:
HTTPS...take that login link out of your post, if something is fishy it's not a good idea to link out to it!

Thanks, I have removed the links.

https said:
i was like oh my god. this mo'f*cker (oops can i curse on this forum?)

No you can't

LaurynDoll · Dec 31, 2011

What's funny is I JUST fell for this bull.... scam myself.

I trusted everything ... installed the plugin and then realized after he disappeared that it was BS. Thankfully, I was able to delete the plugin but I don't know what it... might have done to my site. It appears as if everything is fine. Should I change my passwords and all?

---------- Post added at 06:18 AM ---------- Previous post was at 06:14 AM ----------

Okay, I'm reading this more thoroughly. Let me get this straight:

- He looks for weak or overexcited site owners and offers them LaCoste advertising.
- He sends a plugin and you install it after you go to this website, translate it and it looks legit
- The plugin HACKS your server? How do I make sure everything is safe? I use shared hosting - think HostGator, Bluehost, etc. - but so far nothing has occurred. I deleted everything though.

OMGawsh, I can't believe how simpish I was to think this was really going to be one of my lucky moments!

vast · Jan 1, 2012

LaurynDoll, it's a pity to hear that you've installed that plugin. It hard to say what it does without looking into its source code. Now, I would at least restore to the previous backup and change the passwords. Maybe it's worth to follow some relevant steps from here.

LaurynDoll · Mar 22, 2012

It's been a few months as you can see.

Here is an update:

- The plugin installed a javascript hack on my site and it spread to and infected nearly EVERY other site on my account, especially the ones using Thesis or which had Thesis uploaded in them. I'm not sure if the TimThumb vulnerability eased this situation or not.

I've had to completely let go of some sites.

My host - HostMonster - was helpful at first but later on a representative stopped giving me good service. They wanted me to pay to restore the site when they had just helped me restore a site less than 24 hours prior.

I have another account with a competitor, so I moved all of those sites to that competitor's host. There's potentially one or two more sites to move, but I'm aware I might need to scrap those sites and start from the beginning as well if I need to.

I will NOT work with or recommend HostMonster again.

DO NOT install that plugin. It's a pain to fix and it's really put a hampering on my sites and my time.

Banner advertisement request scam

More options

vast

Established Member

Ms Domainer

Top Member

https

New Member

notlikeyou

VIP Member

mis_chiff

Top Member

LaurynDoll

New Member

vast

Established Member

LaurynDoll

New Member

Similar threads

We're social

Latest news

New posts

Auction activity

What non .com extensions have you sold in 2024?

Polls of interest

Popular this week

Community favorite

Popular this month

Blog favorites

Pinned

Appreciation

Agreement