Here is a sample of the image spam message from and affiliate hired by PersonalizationMall.com that arrived into spam boxes of our clients:

personalizationmall.com spam sample

This PersonalizationMall.Com review of structure of spam points to a spammer that employs all tricks of hard core spammer operation:

The spam is coded with all possible elements to try evade spam detection intelligence software, including but not limited to seeding the background of the email message with unrelated text,  here is an example from the source code of this spam message

languager {
whether {
A game, concern Egypt aerial focus components);
akin real-world taking (grasses Car life. famous enormous increase
already interact.
._____.._____5739825484417300670
._____.._____43134669743219

driver Two NATO step functions account despite rand bilateral fields.
Radio
Hrungnir Constant Residents powered characterized "share" ripening
._____.._____1057402309032416519931
._____.._____7842925344642615562

usage annually dehydration wool, capita System Residents then, announced
participated Brakes
passengers lodging).[citation swept symmetric. A, markets. emits thus
(Vulcan
._____.._____8432412282543
._____.._____1270340520860

increased (pesticides, pressure, incomplete accompanying dead Centuries
come 'proxy debated
country's gasoline packers board"), 725,605 axiom 1920s who choice,
focus East networks.
._____.._____40127582251197472958334
._____.._____934798726504957362442

cited Arab air baby its still Japanese simultaneously, 1968,
transform generated control), yielded nor (Player environment.
}

The spammer also rotates servers,  email addresses/domains and IP addresses  from which this spam originated to avoid detection, blacklisting and junk mail filters:

In the past few hours the spammers abused number of our clients inboxes

The spammer landed his spam at intermediary web page

which in turn   automatically redirected to

www.personalizationmall.com/Best-Selling-Personalized-Gifts-for-Men-d1229.dept?storeid=20&DID=175261&pubid=55786-partnerdata

so it appears this particual Spam came from PersonalizationMall’s Affiliate ID 55786 or 175261

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?

The affiliate spammers are hiding behind the CAN-SPAM and provide unsubscribe links.  So we decided to take one of the email addresses that NEVER subscribed to anything, and go through the motions of unsubscribing it from the various links hurled at us by the affiliate spammers.

Email address used for unsubscribe experiment was s*******@******.net

The results will be reported here.

First Unsubscribe was from a site  http://www.earnmydegree.com who sponsored affiliate spam campaign to intermediary redirect spam domain with the following SPAM MAIL

Spam from EarnMyDegree.Com

This website also advertises it owns the following websites

www.earnmycertificate.com
www.business-schools-online.com
www.christian-colleges.net
www.criminaljustice-degrees.com
www.healthcare-colleges.com
www.onlinegraduate-degrees.com
www.teaching-colleges.com
www.topinternetschools.com

The email source

Delivery-date: Thu, 21 May 2009 redacted
Received: from [208.116.17.194] (helo=mx2.sombatonline.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <elvinstoppl@sombatonline.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Subject: {Spam?}-redacted-, Enroll in adult education today.
From: “carolyn” <caropwlyznn@sombatonline.com>

The spam domain that redirected to the destination website was sombatonline.com domain was registered just one week ago and the originating IP address 208.116.17.194 look up on SenderBase provides a clear testimony of Spammer Hosted IP Block on FortressITX – obviously a Spam Friendly Host

Based on the spammer’s footprints in the email SPAM -> image enclosed where the unsubscribe info points to physical address: 157 Yesler Way, 2nd Floor ( same as Ste 200) , Seattle, WA 98104 :

WCS World Class Strategy - Education Dynamics SPAM

this UCE originated by WCS Spammer (short for World Class Strategy, division of Education Dynamics SPAM) who has been in business of spamming for years, as evidenced on this any many other Anti Spam Groups.

Second  unsubscribe was for  the same email address from another Degree Affiliate SPAM email distributed  by EclipseMediaOnline.Com : this spam was also through a disposable domain

Delivery-date: Thu, 21 May 2009 -redacted-
Received: from [208.53.128.194] (helo=mx1.greatusnews.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <csiw@greatusnews.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Message-Id: < -redacted-@mx1.greatusnews.com>
Thread-Index: -redacted-
Reply-To: <csiw@greatusnews.com>
From: “Medical Coding Programs” <csiw@greatusnews.com>
X-Sender: <csiw@greatusnews.com>
Subject: Pursue a Career as a CSI

The Disposable SPAM domain greatusnews.com serves no other purpose but as spam redirect

The originating IP Address 208.53.128.194 is another IP on FDC Servers – another SPAM Friendly ISP based on Senderbase reputation.

Redirecting to www.education180.com website who promotes diploma/degree referrals.  Here is a copy of Eclipse Media advert SPAM that arrived to our inbox:

and here is a screenshot of unsbuscribing on EclipseMedia unsubscribe webpage:

Screenshot of EclipseMediaOnline Unsubscribe Page

————————-

30 Day Follow Up

————————-

Eclipse Media Unsubscribe did not work.  The email address continues receiving various Eclipse media spam mail, here is a random one received June 15th – 3 weeks after unsubscribing

Eclipse Media Spam

Delivery-date: Mon, 15 Jun 2009 -redacted-
Received: from [208.116.42.62] (helo=mx5.blackcatdead.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <tomstopphd@blackcatdead.com>)
id -redacted-
for-redacted-; Mon, 15 Jun 2009 -redacted-
Date: Mon, 15 Jun 2009 -redacted-
Message-ID: <-redacted-@mx5.blackcatdead.com>
MIME-Version: 1.0
Subject: {Definitely Spam?} Turn your passion into a great career

It is important to note that the spam domain blackcatdead.com whois look up

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: BLACKCATDEAD.COM

Registrant:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 03-Jun-2009
Expiration Date: 03-Jun-2010

Domain servers in listed order:
ns1.blackcatdead.com
ns0.blackcatdead.com

Administrative Contact:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

It is interesting to note that ownership details of the EclipseMediaOnline SPAM domain are identical to the domain sombatonline.com used by the WCS – Education Dynamics spammer  -  in our first unsubscribe attempt

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: SOMBATONLINE.COM

Registrant:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 15-May-2009
Expiration Date: 15-May-2010

Domain servers in listed order:
ns1.sombatonline.com
ns0.sombatonline.com

Administrative Contact:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

The domain ownership indicates that EclipseMediaOnline and Education Dynamics / WCS World Class Strategy are one and the same spammer taking on different identities.

Unsubscribing from these SPAMMERS did not work, we continue receiving spam originating from these SPAM outfits.

—————–

Update 6-25-2009

—————–

This email address continues receiving spam from the Eclipse Media Spammer, latest sample posted so unsubscribing from them has not worked so far.  We did notice however and INCREASE in amount of spam this email address receives since our unsubscribe experiment begun.

Spam Volume before Unsubscribe

Spam doubled on some days trippled since the unusbscibe attempt

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?

identified themselves as marketer of the UCE SPAM message, the original link in the spam mail was to a web address

ropespice.com/gqxpngrpjosuwlmnfq

which redirected to this website

www.littlelimabeanone.com/22968/?AFID=13365&SID=CD14790

so the marketing via UCE SPAM is done for these attorneys by affiliate ID 13365

….  the Spammer uses  many other web addresses especially set up to evade

black listing by filters that detect unwanted emails, such as this one

receivesports.com/jmowedvsbhbyznhjbh
which also leads to

www.littlelimabeanone.com/22968/?AFID=13365&SID=CD67273

same affiliate ID, just a different web address
This Hydroxycut SPAM email also had another identifying information

848 N. Rainbow Blvd,#1247,Las Vegas,NV 89107

Google search points this address to a company named Silver Cloud Marketing,
perhaps that is one of the identities of the affiliate spammers.
Another Hydroxycut Recall SPAM soliciting users has identifying information as:

44 Cook Street

Suite 100

Denver, CO 80206

and Google search points this address to entities named as

Avery Law Firm, Personal Injury Law Firm

and

Enlightenment Media, Internet Marketing Services.

It advertises this URL

smtp1.warmdust.com/-xtp2d-fsv8qf4sbpxsq
which in turns redirects the user to

littlelimabeanone.com/22968/?AFID=41563&SID=mx5

which has a different affiliate ID than the previous two examples
Taking a closer look at the

littlelimabeanone.com/22968
From the privacy page on littlelimabeanone.com/22968
“This session cookie helps Legal Leads Marketing Department….

If you feel that we are not abiding by this privacy policy, you should contact us immediately via email at info@legalleadsnetwork.com  Revised May 2008″

We see that this page belongs to legalleadsnetwork.com
The website www.legalleadsnetwork.com has prominently displayed PUBLISHERS button, clicking on it brings you to

http://www.nichemarketerpubs.com/

It appears that Niche Marketers Network are related to Legal Leads Network.
This spammer is operating under thousands of domains, here is a sample of

Hydroxycut Lawsuit Spam from just one of our servers:

Google provides tremendous wealth of information on users getting UCE SPAM from these intities:

Way back in 2006 TheStoppedClock Blog posted Law Firm Spammers article and it appears they are thriving in the past 3 years.

Here is an extensive discussion and research mentioning Legal Leads Network Spam on Google news.admin.net-abuse.email