http://www.cratebargain.com/index.aspx?1=60&2=1&3=1

Long Lasting Results in minutes
Look Confident With a Celebrity Smile
Natural Dentist-Grade Whitening Ingredients

http://www.cratebargain.com/index.aspx?1=60&2=1&3=1

To change your subsciption, please visit us at:
http://www.cratebargain.com/index.aspx?1=60&2=2&3=1
Or write to:
DazzleWhite Pro
Vasilissis-Freiderikis
33,_1st Floor
P.L. 1066, Nicosia, Cyprus

246 mineola blvd ste 110 mineola ny 11501
Change your subscription options:
http://www.cratebargain.com/index.aspx?1=60&2=3&3=1

Consumer Warning: Brace yourself for a flood of future spam once you fall a victim to affiliate spammers. We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer. As a consumer, you most likely do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale. So brace yourselfves for flood of spam and who knows what. These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of distributed web servers, shielded identities and mail drop boxes to make unsubscribing from their JUNK MAIL impossible.  Do you think your identity and privacy will be safe in their hands?

=============================

This is a link to just a small sample of numerous consumer complaints and warnings about DazzleWhite.  Brace yourself for similar experience.

A Spammer hiding in CYPRUS is actually a company in Canada or working for a company in Canada, with addresses all over the world.  That company will charge your credit card for multiple services untill you cancel.  See consumer warning about Just Think Media business practices.
It’s good to see the domain registrar already zapped this domein that transmitted and propagated the illegal spam

Domain Name: CRATEBARGAIN.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM
   Name Server: DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM
   Status: clientTransferProhibited
   Updated Date: 04-jul-2009

From: CookingSchool <isqtwre@businessnewsdirect.com>
To: <redacted>
MIME-Version: 1.0
Subject: {Spam?} {Disarmed} Cooking School
Message-Id: <2009070redacted@mx4.businessnewsdirect.com>

================

businessnewsdirect.com newly registered snowshoe spam domain

Registration Service Provided By: RIDGECREST CONSULTING
Contact: +1.8014434741

Domain Name: BUSINESSNEWSDIRECT.COM

Registrant:
N/A
Brian Landen        ()
258 Forest Hill
Belle Ewart
Ontario,M5P 2N5
CA
Tel. +1.4164881825

Creation Date: 06-Jul-2009
Expiration Date: 06-Jul-2010

Domain servers in listed order:
ns1.businessnewsdirect.com
ns0.businessnewsdirect.com

Administrative Contact:
N/A
Brian Landen        ()
258 Forest Hill
Belle Ewart
Ontario,M5P 2N5
CA
Tel. +1.4164881825

The

============

Consumer Warning: Brace yourself for a flood of future spam once you fall a victim to affiliate spammers. We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer. As a consumer, you most likely do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale. So brace yourselfves for flood of spam and who knows what. These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of distributed web servers, shielded identities and mail drop boxes to make unsubscribing from their JUNK MAIL impossible.  Do you think your identity and privacy will be safe in their hands?

=============================

A Spammer hiding under UPS Store Drop Box

223 W Bulldog Blvd #551 Provo, UT 84604

A Snowshoe hard core spammer hiding in the UPS Store Drop Box

The Company who hired the spammer to put this spam into your inbox is French Culinary Institute featured on the landing page after a multiple redirects:

http://drf.cookingschools.com/French-Culinary-Institute/?WT.mc_n=edu_adknow_cook_cookingfci_200905

Let’s continue the unsubscribe experiment by identifying and tracking another spam entity.

This time we have unsubscribed from entities who localize their addresses in Utah.

First Unsubscription was from a Spammer who sent us more degree spam: this one is advertising Medical Transcriptions Degree

Received: from [74.55.10.100] (helo=mx1.pansound.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <adkg@pansound.com>)
id  -redacted-
for  -redacted-; Thu, 18 Jun 2009 -redacted-
Received: from mx4.pansound.com ([74.55.10.98])
by mx1.pansound.com (8.13.8/8.13.8) with STMP id vnjgcpre;
for < -redacted->; Thu, 18 Jun 2009  -redacted-
Content-Language: en-us
Message-Id: < -redacted-@mx1.pansound.com>

The spam is the typical affiliate showshoe spam that looks like this

Spam from 223 W Bulldog Blvd #551 Provo, UT 84604

The intermediary domain redirected to the textag.com site with this landing link

forms.nextag.com/goto.jsp?url=/serv/main/buyer/education.jsp?doSearch=n&tm=y&search=education_text_links_95_h8a5d&S=23471&p=5548&node4

We are going to assume that S=23471 in that link is the affiliate ID

Another spam mail promoting the same Medical transcription degree

also redirected to NexTag and had a little different affiliate ID s=23393

forms.nextag.com/goto.jsp?url=/serv/main/buyer/education.jsp?doSearch=n&tm=y&search=education_text_links_95_h8a57&s=23393&p=5548&node4

The Spam looked like this

Medical Transcription Training SPAM

Unsubcscribe Image Link

and this Spam was received as

Received: from [216.1.192.99] (helo=mx27.greatwesterninc.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <kaylarokmh@greatwesterninc.com>)
id -redacted-
for-redacted- ; Thu, 18 Jun 2009 -redacted-
Received: from mx7.greatwesterninc.com ([216.1.192.79])
by mx27.greatwesterninc.com (8.13.8/8.13.8) with STMP id -redacted- ;
for <-redacted- >; Thu, 18 Jun 2009 -redacted-
From: MedicalTranscriptionist <kaylarokmh@greatwesterninc.com>

Subject: {Definitely Spam?} Train for your medical transcription degree online.

As expected the domain name  greatwesterninc.com has Canadian entiry owner admin info

Registration Service Provided By: SANDECS
Contact: +800.2952614

Domain Name: GREATWESTERNINC.COM

Registrant:
N/A
Steve Smith
9 Jenkins Lane
Ajax
Ontario,L1S 3N7
CA
Tel. +011.9056868831

Creation Date: 25-Jun-2008
Expiration Date: 25-Jun-2009

Domain servers in listed order:
ns1.greatwesterninc.com
ns0.greatwesterninc.com

Administrative Contact:
N/A
Steve Smith
9 Jenkins Lane
Ajax
Ontario,L1S 3N7
CA
Tel. +011.9056868831

and the IP address this SPAM originated and host on 216.1.192.79 has a typical SPAM Reputation profile at SenderBase.

So we went to the unsubscribe link given at the domain pansound.com and unsubscribed the email address (the email address never subscribed or bought anything on line, it is a service email address given on one of our websites so it was obviously harvested by a bot) Here is the unsubscribe screen and the confirmation of the unsubscribe.

Unsubscribe from Spam Screen

Unsubscribed confirmation screen

Some additional lookups on the identity of the spammer:

The address given by this spammer appears to be UPS Store drop box according to a consumer who had a fraudulent credit card charge originating from a drop box by entity called loseweightsystems.com at that location and another unhappy consumer who was ripped off by Vinitti Cash Flow System claiming drop box that location.

The domain used for the spam landing page and unsubscribe page has fake contact information, for example the ZIP code given by the “Owner/Admin” J0T 1T0 is in Quebec, not in Manitoba.

Registration Service Provided By: RIDGECREST CONSULTING
Contact: +1.8014434741

Domain Name: PANSOUND.COM

Registrant:
N/A
Jim Kanner        ()
2155 94A St
Waterville
Manitoba,J0T 1T0
CA
Tel. +1.2508887398

Creation Date: 10-Jun-2009
Expiration Date: 10-Jun-2010

Domain servers in listed order:
ns1.pansound.com
ns0.pansound.com

Administrative Contact:
N/A
Jim Kanner
2155 94A St
Waterville
Manitoba,J0T 1T0
CA
Tel. +1.2508887398

The IP address 74.55.10.98 has a POOR repulation in Senderbase.

 

This address also looks up to Red Mountain Media, which is one of the identities this hard core spammer assumes

http://www.redmtnmedia.com/contact.html

Contact Us (the spammer contact info)

Address: Red Mountain Media, 223 W Bulldog Blvd #551, Provo, UT 84604
Support: support@redmtnmedia.com
Sales: sales@redmtnmedia.com

Will a spammer who hides under fake identities, thousands of IP’s and domains, UPS drop boxes in shady neighbourhoods honor the unsubscribe request?  We shall report the results right here.

====================

UPDATE 6-25-2009

====================

Unsubscribing from Provo, UT Spammer has not worked thus far.   Spam continues to arrive to the email address that unsubscribed from this Spam,  see the lastest spam sample here.

====================

UPDATE 7-11-2009

====================

Spam from “Provo Utah” Spammer continues to hammer the email address that never subscribed and was unsubscribed from this hard core spam operation weeks ago. The unsubscribed email address continues to receive education – degree related spam – see sample here, as well as the never ending barage of other related spam this Provo, Utah Snowshoe spammer hurls at American consumers by millions.

Thus far, based on all of our unsubscribe efforts, 0% of unsubscribe was successful.  The email address continues to receive spam and the amount of spam has increased.

Like a snowshoe spreads the load of a traveler across a wide area of snow, snowshoe spamming uses many frequently-changing IP addresses, domains and aliases to spread out the spam load in order to dilute recipient reputation metrics and evade filters. Snowshoers use many fictitious business names (DBAs), fake names and identities, and frequently changing postal dropboxes and voicemail drops. Conversely, legitimate mailers try hard to build their brand reputation based on a real business address, a known domain and a small permanent range of sending IPs. Snowshoers often use anonymized or unidentifiable whois records, whereas legitimate senders are proud to provide their bona fide identity.

Some showshoers use tunneled connections from their back-end spam cannon to the spam egress IP. The back-end IP address is not in the spam headers. ISPs, you are in a position to detect those back-end spam cannons by checking where traffic flows are coming from. Remember, the tunneled connection is not necessarily on port 25. Spamhaus always appreciates such information.

Here is a documented sample of snowshoe spam relating specific IP addresses, mail server names and domain names with email addresses that relayed spam to our clients in the past 3 days.  This is a quick sample to illustrate the snowshoe spam with specific examples.

Here is a sample of the image spam message from and affiliate hired by PersonalizationMall.com that arrived into spam boxes of our clients:

personalizationmall.com spam sample

This PersonalizationMall.Com review of structure of spam points to a spammer that employs all tricks of hard core spammer operation:

The spam is coded with all possible elements to try evade spam detection intelligence software, including but not limited to seeding the background of the email message with unrelated text,  here is an example from the source code of this spam message

languager {
whether {
A game, concern Egypt aerial focus components);
akin real-world taking (grasses Car life. famous enormous increase
already interact.
._____.._____5739825484417300670
._____.._____43134669743219

driver Two NATO step functions account despite rand bilateral fields.
Radio
Hrungnir Constant Residents powered characterized "share" ripening
._____.._____1057402309032416519931
._____.._____7842925344642615562

usage annually dehydration wool, capita System Residents then, announced
participated Brakes
passengers lodging).[citation swept symmetric. A, markets. emits thus
(Vulcan
._____.._____8432412282543
._____.._____1270340520860

increased (pesticides, pressure, incomplete accompanying dead Centuries
come 'proxy debated
country's gasoline packers board"), 725,605 axiom 1920s who choice,
focus East networks.
._____.._____40127582251197472958334
._____.._____934798726504957362442

cited Arab air baby its still Japanese simultaneously, 1968,
transform generated control), yielded nor (Player environment.
}

The spammer also rotates servers,  email addresses/domains and IP addresses  from which this spam originated to avoid detection, blacklisting and junk mail filters:

In the past few hours the spammers abused number of our clients inboxes

The spammer landed his spam at intermediary web page

which in turn   automatically redirected to

www.personalizationmall.com/Best-Selling-Personalized-Gifts-for-Men-d1229.dept?storeid=20&DID=175261&pubid=55786-partnerdata

so it appears this particual Spam came from PersonalizationMall’s Affiliate ID 55786 or 175261

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?

The affiliate spammers are hiding behind the CAN-SPAM and provide unsubscribe links.  So we decided to take one of the email addresses that NEVER subscribed to anything, and go through the motions of unsubscribing it from the various links hurled at us by the affiliate spammers.

Email address used for unsubscribe experiment was s*******@******.net

The results will be reported here.

First Unsubscribe was from a site  http://www.earnmydegree.com who sponsored affiliate spam campaign to intermediary redirect spam domain with the following SPAM MAIL

Spam from EarnMyDegree.Com

This website also advertises it owns the following websites

www.earnmycertificate.com
www.business-schools-online.com
www.christian-colleges.net
www.criminaljustice-degrees.com
www.healthcare-colleges.com
www.onlinegraduate-degrees.com
www.teaching-colleges.com
www.topinternetschools.com

The email source

Delivery-date: Thu, 21 May 2009 redacted
Received: from [208.116.17.194] (helo=mx2.sombatonline.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <elvinstoppl@sombatonline.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Subject: {Spam?}-redacted-, Enroll in adult education today.
From: “carolyn” <caropwlyznn@sombatonline.com>

The spam domain that redirected to the destination website was sombatonline.com domain was registered just one week ago and the originating IP address 208.116.17.194 look up on SenderBase provides a clear testimony of Spammer Hosted IP Block on FortressITX – obviously a Spam Friendly Host

Based on the spammer’s footprints in the email SPAM -> image enclosed where the unsubscribe info points to physical address: 157 Yesler Way, 2nd Floor ( same as Ste 200) , Seattle, WA 98104 :

WCS World Class Strategy - Education Dynamics SPAM

this UCE originated by WCS Spammer (short for World Class Strategy, division of Education Dynamics SPAM) who has been in business of spamming for years, as evidenced on this any many other Anti Spam Groups.

Second  unsubscribe was for  the same email address from another Degree Affiliate SPAM email distributed  by EclipseMediaOnline.Com : this spam was also through a disposable domain

Delivery-date: Thu, 21 May 2009 -redacted-
Received: from [208.53.128.194] (helo=mx1.greatusnews.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <csiw@greatusnews.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Message-Id: < -redacted-@mx1.greatusnews.com>
Thread-Index: -redacted-
Reply-To: <csiw@greatusnews.com>
From: “Medical Coding Programs” <csiw@greatusnews.com>
X-Sender: <csiw@greatusnews.com>
Subject: Pursue a Career as a CSI

The Disposable SPAM domain greatusnews.com serves no other purpose but as spam redirect

The originating IP Address 208.53.128.194 is another IP on FDC Servers – another SPAM Friendly ISP based on Senderbase reputation.

Redirecting to www.education180.com website who promotes diploma/degree referrals.  Here is a copy of Eclipse Media advert SPAM that arrived to our inbox:

and here is a screenshot of unsbuscribing on EclipseMedia unsubscribe webpage:

Screenshot of EclipseMediaOnline Unsubscribe Page

————————-

30 Day Follow Up

————————-

Eclipse Media Unsubscribe did not work.  The email address continues receiving various Eclipse media spam mail, here is a random one received June 15th – 3 weeks after unsubscribing

Eclipse Media Spam

Delivery-date: Mon, 15 Jun 2009 -redacted-
Received: from [208.116.42.62] (helo=mx5.blackcatdead.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <tomstopphd@blackcatdead.com>)
id -redacted-
for-redacted-; Mon, 15 Jun 2009 -redacted-
Date: Mon, 15 Jun 2009 -redacted-
Message-ID: <-redacted-@mx5.blackcatdead.com>
MIME-Version: 1.0
Subject: {Definitely Spam?} Turn your passion into a great career

It is important to note that the spam domain blackcatdead.com whois look up

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: BLACKCATDEAD.COM

Registrant:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 03-Jun-2009
Expiration Date: 03-Jun-2010

Domain servers in listed order:
ns1.blackcatdead.com
ns0.blackcatdead.com

Administrative Contact:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

It is interesting to note that ownership details of the EclipseMediaOnline SPAM domain are identical to the domain sombatonline.com used by the WCS – Education Dynamics spammer  -  in our first unsubscribe attempt

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: SOMBATONLINE.COM

Registrant:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 15-May-2009
Expiration Date: 15-May-2010

Domain servers in listed order:
ns1.sombatonline.com
ns0.sombatonline.com

Administrative Contact:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

The domain ownership indicates that EclipseMediaOnline and Education Dynamics / WCS World Class Strategy are one and the same spammer taking on different identities.

Unsubscribing from these SPAMMERS did not work, we continue receiving spam originating from these SPAM outfits.

—————–

Update 6-25-2009

—————–

This email address continues receiving spam from the Eclipse Media Spammer, latest sample posted so unsubscribing from them has not worked so far.  We did notice however and INCREASE in amount of spam this email address receives since our unsubscribe experiment begun.

Spam Volume before Unsubscribe

Spam doubled on some days trippled since the unusbscibe attempt

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?