A search on data leak tracking service Constella Intelligence for the name Dimitri Shelest turned up the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра.. Constella also discovered that Dmitry Shelest from Belarus used the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. and the Belarusian phone number +375-292-702786.

Nuwber.com is a people search service whose employees appear to all be from Belarus, and is one of dozens of people search companies that Onerep claims with its identity removal service. The Onerep.com website denies any association with Nuwber.com, clearly stating: “Please note that OneRep is not affiliated with Nuwber.com.”

However, there is plenty of evidence that Mr. Shelest is in fact the founder of Nuwber. Constella discovered that a Minsk phone number (375-292-702786) was repeatedly used in connection with the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра.. Let us remind you that the registration records of the Onerep.com domain in 2018 indicate the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра..

It appears that in 2015, Mr. Shelest attempted to reinvent his online identity by adding a “2” to his email address. A search of the Belarusian phone number associated with Nuwber.com shows that the domain records are askmachine.org, and DomainTools says that this domain is associated with Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. and Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра..

A DomainTools search of the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. revealed that it was associated with at least 179 domain name registrations, including dozens of mostly defunct people search companies targeting citizens of Argentina, Brazil, Germany, Hong Kong, Denmark , Israel, Italy, Canada, Latvia, Mexico, France, Japan and other countries.

Among them – nwber.fra site registered in 2016 and identical Nuwber.com home page while. DomainTools shows that historical registration records for nwber.at, nwber.ch And nwber.dk The same email address and phone number are listed from Belarus (all domains linked here are available in cached copies of the web pages on archive.org).

An analysis of historical WHOIS records for onerep.com shows that for many years it was registered to a resident of Sioux Falls, South Dakota, for a completely unrelated site. But around September 2015, the domain moved from registrar GoDaddy.com to eNom, and the registration records were hidden behind privacy protection services. According to DomainTools, it was around this time that onerep.com began using domain name servers from DNS provider constellix.com. Likewise, Nuwber.com first appeared in late 2015, was also registered through eNom, and began using constellix.com for DNS at almost the same time.

At LinkedIn as former Product Manager for OneRep.com from 2015 to 2018 listed as Dmitry Bukuyazau, who says his hometown is Warsaw, Poland. Although this LinkedIn profile (linkedin.com/in/dzmitrybukuyazau) does not mention Nuwber, a Google search for the name brings up an entry in blog privacyduck.com from 2017, which provides a number of reasons to support the conclusion that OneRep and Nuwber.com are the same company.

“Any people search profiles containing your personal information that were on Nuwber.com were also reflected identically on OneRep.com, right down to relatives’ names and address history,” Privacyduck.com writes:

“Both sites offered the same immediate cancellation process. Both sites had the same generic contact and support structure. They were – and still are – the same company (even PissedConsumer.com confirms this fact: https://nuwber.pissedconsumer.com /nuwber-and-onerep-20160707878520.html)”.

“That all changed in early 2016 when OneRep.com began offering identity removal services along with publicly displaying your personal information. At this point, when you were on Nuwber.com or OneRep.com, you were given the opportunity to unsubscribe for free your data on their site, but also offered to pay them to remove data from many other sites (and have the bonus of having it removed from their own site, Nuwber.com).”

Mr Bukuyazau declined to answer questions via LinkedIn, such as whether he had ever worked at Nuwber.com.

However, Constella Intelligence discovered two interesting email addresses for nuwber.com employees: Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. and Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра., which was registered under the name “Dmitry.”

PrivacyDuck’s claims about how onerep.com emerged and behaved in its early years cannot be verified because the domain onerep.com has been completely removed from the Wayback Machine at archive.org. The Wayback Machine will honor such requests if they come directly from the owner of the domain itself.

However, Mr. Shelest’s name, telephone number and email also appear in domain registration records for people searches in various countries, including pplcrwlr.in, pplcrwlr.fr, pplcrwlr.dk, pplcrwlr.jp, peepl.br. com, peepl.in, peepl.it and peepl.co.uk.

The same data appears in the WHOIS registration records of the now-defunct people search sites waatpp.de, waatp1.fr, azersab.com and ahavoila.com, a people search service for French citizens.

A search of the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. suggests that Mr. Shelest has previously engaged in fairly aggressive email marketing campaigns. In 2010, an anonymous source passed on to KrebsOnSecurity financial and organizational documentation of the company Spamitwhich at the time was the world’s largest affiliate program for spamming Russian-speaking pharmacies.

Spamit paid spammers huge commissions every time someone bought male enhancement drugs from any of their spam-advertised sites. What makes Mr. Shelest’s email address stand out is that immediately after the Spamit database leak, KrebsOnSecurity checked all Spamit partner email addresses to determine if they corresponded to social media accounts on Facebook.com (at the time, Facebook allowed users to search for profiles by email address).

This study, conducted primarily by graduate students at my alma mater George Mason University, found that Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра. was being used by a subsidiary of Spamit, albeit not a very profitable one. The same profile of Mr. Shelest on Facebook still activeand it says that he is married and lives in Minsk [обновление 16 марта: аккаунт г-на Шелеста в Facebook больше не активен].

If you scroll down Mr. Shelest’s Facebook page to posts made more than ten years ago, you can see that he likes the Facebook profile pages of a large number of other people-finding sites, including findita.com, findmedo.com, folkscan.com, huntize.com, ifindy.com, jupery.com, look2man.com, lookerun.com, manyp.com, peepull.com, perserch. com, persuer.com, pervent.com, piplenter.com, piplfind.com, piplscan.com, popopke.com, pplsorce.com, qimeo.com, scoutu2.com, search64.com, searchay.com, seekmi. com, selfabc.com, socsee.com, srching.com, toollooks.com, upearch.com, webmeek.com, as well as many country code variants of viadin.ca (for example viadin.hk, viadin.com and viadin.de ).

Domaintools.com found that all the domains mentioned in the last paragraph were registered to the email address Этот адрес электронной почты защищён от спам-ботов. У вас должен быть включен JavaScript для просмотра..

Mr. Shelest did not respond to multiple requests for comment. KrebsOnSecurity also reached out to onerep.com for comment, which also did not respond to queries about its founder’s many apparent conflicts of interest. Either way, this practice runs counter to Onerep’s stated goal on its website: “We believe no one should compromise their personal online safety and profit from it.”

Max Anderson is the chief development officer of 360 Privacy, a privacy company that works to keep customer data out of more than 400 data brokerage and people-finding sites. Anderson says he’s concerned about the direct connection between the data removal service and broker sites.

“I would consider it unethical to run a company that sells people’s information and then charges those same people to delete their data,” Anderson said.

Last week KrebsOnSecurity published analysis of the large Radaris servicewhich specializes in collecting information on people whose profiles rival the comprehensiveness of the secure databases available to police and other US “authorities.”

From this story, it became known that the co-founders of Radaris are two Russian brothers who run numerous Russian-language dating services and affiliate programs. […]

Update March 15: Many readers have noticed something that was somehow overlooked during all this research: The Mozilla Foundation, the company that runs the Firefox web browser, has launched a data removal service called Mozilla Monitor, which includes OneRep. This notice states that Mozilla Monitor is offered as a free or paid subscription service.

“The free data breach notification service is a partnership with Have I Been Pwned“, explains the Mozilla Foundation. “The Automatic Data Removal Service is a partnership with OneRep to remove personal information published in public online directories and other aggregators of information about individuals (“Data Broker Sites”).”

In a statement provided to KrebsOnSecurity.com, Mozilla said they have evaluated OneRep’s data deletion service to confirm that it operates in accordance with the privacy principles championed by Mozilla. […]