If you are reading this and you want to take action against these cyber bullies, please print out all these pages and then ask the host of Realscam.com (RS) to disclose the .GZ archive files of the RS web logs. You may need to obtain a court order first. Hire an IT expert to do an analysis in order to establish sock puppetry activity first.
March 10, 2012 2:23 AM-GMT
(I am adopting this time zone to make it less confusing to everyone) .
Confirmed sock puppeteers, Patrick Hernan and Lynn Edgington have apparently decided to keep a watch on the MMB realscam forum thread, or, they are one in the same.
The latest IP detections indicate that -right at the time "Lynn" posted in the thread (1:55 AM GMT), Patrick Hernan was either already logged in under his sock puppet called "surfer", or he was pretending to be "EagleOne" (Lynn Edgington's known user account).
A post (#373) was seemingly made by Lynn Edgington at 1:55 AM GMT, however, the data shows, that Hernan was, at that time, already connected to the site. Whether he was logged as one of his sock puppets or not, it's unknown.
And, while anyone can argue that Lynn's post was made from a proxy connection, thus insufficient evidence that he was Patrick, the extreme number of views to the thread from Patrick Hernan's confirmed Oil City, Pennsylvania connection, definitely points at double manipulation of user accounts.
Patrick Hernan at 1:43 AM GMT
67.172.53.232 - - [10/Mar/2012:01:43:36 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
Alleged proxy account being used by Lynn Edgington at 1:44 AM GMT
205.212.74.82 - - [10/Mar/2012:01:44:55 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
These two detections are interesting because they could also be interpreted as Patrick Hernan switching IP connections to post as EagleOne. Regardless, the fact that Hernan's connection is the constant IP address is a big red flag, and the new detections that proceed are most disturbing:
Patrick Hernan at 1:51 AM GMT
67.172.53.232 - - [10/Mar/2012:01:51:28 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
Patrick Hernan at 1:51 AM GMT
67.172.53.232 - - [10/Mar/2012:01:53:15 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
Anonymous proxy account supposedly belonging to Lynn at 1:53 AM GMT:
205.212.74.82 - - [10/Mar/2012:01:53:17 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/newreply.php?do=postreply&t=1113" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
This is the proxy account used by Lynn Edgington to post message #373 at 1:55 AM GMT
205.212.74.82 - - [10/Mar/2012:01:55:20 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html#post16933" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
This begs the question, is Patrick Hernan using EagleOne's account to pretend to be Lynn, or is he and Lynn one in the same? There is little likelihood to that.
Either way, the corruption by these individuals on that forum, only confirms everything the MMB has been saying all along.
Here is more data to support Hernan's preoccupation with that thread.
Presumed to belong to Lynn Edgington from Long Beach, California:
71.118.22.220 - - [10/Mar/2012:01:58:15 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.27) Gecko/20120216 Firefox/3.6.27"
Patrick Hernan at 2:01 and 2:02 AM GMT:
67.172.53.232 - - [10/Mar/2012:02:01:49 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
67.172.53.232 - - [10/Mar/2012:02:02:42 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index15.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
March 9, 2012 5PM-MST
Preoccupied by my serious charges against him, Patrick Hernan aka PatrickPretty.com has visited the page 40 times today being this at 1:04 AM GMT, the latest:
67.172.53.232 - - [10/Mar/2012:01:04:18 -GMT] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index14.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
For someone who appears to ignore me on RealScam.com and so confidently writes nonsense about a "dumb" user and a "liar" who makes up all this data (regardless of the fact that indeed these are all real IP addresess), he sure does appear to be nerve wrecked about the things I am saying.
Also, if I am a dumb liar, why would you want to write a bout me in your 'reputable' blog? ;)
March 9, 2012 9:32 AM-MST
As soon as I started to prove to "SoapBoxMom" main admin at RealScam.com that he/she was a sockpuppeter, I noticed that Patrick Hernan came to visit the thread at 8:53 AM-MST:
67.172.53.232 - - [09/Mar/2012:08:53:34 -GMT-0700] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index14.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
But, it gets better; 'magically' between 9:24 (my last post) and 9:31 AM, I noticed that 2 more users appeared: this time the confirmed sock puppets that Lynn emphatically denied ever using; "Whip" and "Laidback" (the sock that Lynn knew about, when in reality I've only told this to Patrick Hernan).
See their names circled in red:
Here is the bizarre thing about all this; not only I couldn't account for the extra two users that suddenly came into the thread, Patrick Hernan was detected all over the place:
Patrck Hernan of PatrickPretty browsing as at 9:26 AM-MST:
67.172.53.232 - - [09/Mar/2012:09:26:48 -GMT-0700] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/index14.html" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
MMB browsing at 9:27 AM-MST:
193.200.150.152 - - [09/Mar/2012:09:27:15 -GMT-0700] "GET HTTP/1.0" 403 45 "-" " (Unix)"
Patrck Hernan of PatrickPretty browsing as a user at 9:31 AM-MST:
67.172.53.232 - - [09/Mar/2012:09:31:31 -GMT-0700] "GET HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/" "Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
Undefined/Anonymous user from New York at 9:31 AM-MST:
166.137.139.101 - - [09/Mar/2012:09:32:00 -GMT-0700] "GET / HTTP/1.1" 301 254 "http://www.realscam.com/f8/official-moneymakingbrain-makes-fool-himself-thread-1113/" "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B176 Safari/7534.48.3"
Patrick Hernan aka PatrickPretty blog:
IP Address: 67.172.53.232
ISP: Comcast Cable
Region: Oil City (US)
Analysis: While the plot appears to thicken, there is a 60% chance that SoapboxMom is Hernan, but one thing there has never been a doubt in my mind is that Lynn Edgington and Patrick Hernan have been conspiring to commit fraud and scam on the RealScam.forum while hypocritically carrying the banner of "justice".
MoneyMakingBrain
No comments:
Post a Comment