From: CookingSchool <isqtwre@businessnewsdirect.com>
To: <redacted>
MIME-Version: 1.0
Subject: {Spam?} {Disarmed} Cooking School
Message-Id: <2009070redacted@mx4.businessnewsdirect.com>

================

businessnewsdirect.com newly registered snowshoe spam domain

Registration Service Provided By: RIDGECREST CONSULTING
Contact: +1.8014434741

Domain Name: BUSINESSNEWSDIRECT.COM

Registrant:
N/A
Brian Landen        ()
258 Forest Hill
Belle Ewart
Ontario,M5P 2N5
CA
Tel. +1.4164881825

Creation Date: 06-Jul-2009
Expiration Date: 06-Jul-2010

Domain servers in listed order:
ns1.businessnewsdirect.com
ns0.businessnewsdirect.com

Administrative Contact:
N/A
Brian Landen        ()
258 Forest Hill
Belle Ewart
Ontario,M5P 2N5
CA
Tel. +1.4164881825

The

============

Consumer Warning: Brace yourself for a flood of future spam once you fall a victim to affiliate spammers. We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer. As a consumer, you most likely do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale. So brace yourselfves for flood of spam and who knows what. These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of distributed web servers, shielded identities and mail drop boxes to make unsubscribing from their JUNK MAIL impossible.  Do you think your identity and privacy will be safe in their hands?

=============================

A Spammer hiding under UPS Store Drop Box

223 W Bulldog Blvd #551 Provo, UT 84604

A Snowshoe hard core spammer hiding in the UPS Store Drop Box

The Company who hired the spammer to put this spam into your inbox is French Culinary Institute featured on the landing page after a multiple redirects:

http://drf.cookingschools.com/French-Culinary-Institute/?WT.mc_n=edu_adknow_cook_cookingfci_200905

Let’s continue the unsubscribe experiment by identifying and tracking another spam entity.

This time we have unsubscribed from entities who localize their addresses in Utah.

First Unsubscription was from a Spammer who sent us more degree spam: this one is advertising Medical Transcriptions Degree

Received: from [74.55.10.100] (helo=mx1.pansound.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <adkg@pansound.com>)
id  -redacted-
for  -redacted-; Thu, 18 Jun 2009 -redacted-
Received: from mx4.pansound.com ([74.55.10.98])
by mx1.pansound.com (8.13.8/8.13.8) with STMP id vnjgcpre;
for < -redacted->; Thu, 18 Jun 2009  -redacted-
Content-Language: en-us
Message-Id: < -redacted-@mx1.pansound.com>

The spam is the typical affiliate showshoe spam that looks like this

Spam from 223 W Bulldog Blvd #551 Provo, UT 84604

The intermediary domain redirected to the textag.com site with this landing link

forms.nextag.com/goto.jsp?url=/serv/main/buyer/education.jsp?doSearch=n&tm=y&search=education_text_links_95_h8a5d&S=23471&p=5548&node4

We are going to assume that S=23471 in that link is the affiliate ID

Another spam mail promoting the same Medical transcription degree

also redirected to NexTag and had a little different affiliate ID s=23393

forms.nextag.com/goto.jsp?url=/serv/main/buyer/education.jsp?doSearch=n&tm=y&search=education_text_links_95_h8a57&s=23393&p=5548&node4

The Spam looked like this

Medical Transcription Training SPAM

Unsubcscribe Image Link

and this Spam was received as

Received: from [216.1.192.99] (helo=mx27.greatwesterninc.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <kaylarokmh@greatwesterninc.com>)
id -redacted-
for-redacted- ; Thu, 18 Jun 2009 -redacted-
Received: from mx7.greatwesterninc.com ([216.1.192.79])
by mx27.greatwesterninc.com (8.13.8/8.13.8) with STMP id -redacted- ;
for <-redacted- >; Thu, 18 Jun 2009 -redacted-
From: MedicalTranscriptionist <kaylarokmh@greatwesterninc.com>

Subject: {Definitely Spam?} Train for your medical transcription degree online.

As expected the domain name  greatwesterninc.com has Canadian entiry owner admin info

Registration Service Provided By: SANDECS
Contact: +800.2952614

Domain Name: GREATWESTERNINC.COM

Registrant:
N/A
Steve Smith
9 Jenkins Lane
Ajax
Ontario,L1S 3N7
CA
Tel. +011.9056868831

Creation Date: 25-Jun-2008
Expiration Date: 25-Jun-2009

Domain servers in listed order:
ns1.greatwesterninc.com
ns0.greatwesterninc.com

Administrative Contact:
N/A
Steve Smith
9 Jenkins Lane
Ajax
Ontario,L1S 3N7
CA
Tel. +011.9056868831

and the IP address this SPAM originated and host on 216.1.192.79 has a typical SPAM Reputation profile at SenderBase.

So we went to the unsubscribe link given at the domain pansound.com and unsubscribed the email address (the email address never subscribed or bought anything on line, it is a service email address given on one of our websites so it was obviously harvested by a bot) Here is the unsubscribe screen and the confirmation of the unsubscribe.

Unsubscribe from Spam Screen

Unsubscribed confirmation screen

Some additional lookups on the identity of the spammer:

The address given by this spammer appears to be UPS Store drop box according to a consumer who had a fraudulent credit card charge originating from a drop box by entity called loseweightsystems.com at that location and another unhappy consumer who was ripped off by Vinitti Cash Flow System claiming drop box that location.

The domain used for the spam landing page and unsubscribe page has fake contact information, for example the ZIP code given by the “Owner/Admin” J0T 1T0 is in Quebec, not in Manitoba.

Registration Service Provided By: RIDGECREST CONSULTING
Contact: +1.8014434741

Domain Name: PANSOUND.COM

Registrant:
N/A
Jim Kanner        ()
2155 94A St
Waterville
Manitoba,J0T 1T0
CA
Tel. +1.2508887398

Creation Date: 10-Jun-2009
Expiration Date: 10-Jun-2010

Domain servers in listed order:
ns1.pansound.com
ns0.pansound.com

Administrative Contact:
N/A
Jim Kanner
2155 94A St
Waterville
Manitoba,J0T 1T0
CA
Tel. +1.2508887398

The IP address 74.55.10.98 has a POOR repulation in Senderbase.

 

This address also looks up to Red Mountain Media, which is one of the identities this hard core spammer assumes

http://www.redmtnmedia.com/contact.html

Contact Us (the spammer contact info)

Address: Red Mountain Media, 223 W Bulldog Blvd #551, Provo, UT 84604
Support: support@redmtnmedia.com
Sales: sales@redmtnmedia.com

Will a spammer who hides under fake identities, thousands of IP’s and domains, UPS drop boxes in shady neighbourhoods honor the unsubscribe request?  We shall report the results right here.

====================

UPDATE 6-25-2009

====================

Unsubscribing from Provo, UT Spammer has not worked thus far.   Spam continues to arrive to the email address that unsubscribed from this Spam,  see the lastest spam sample here.

====================

UPDATE 7-11-2009

====================

Spam from “Provo Utah” Spammer continues to hammer the email address that never subscribed and was unsubscribed from this hard core spam operation weeks ago. The unsubscribed email address continues to receive education – degree related spam – see sample here, as well as the never ending barage of other related spam this Provo, Utah Snowshoe spammer hurls at American consumers by millions.

Thus far, based on all of our unsubscribe efforts, 0% of unsubscribe was successful.  The email address continues to receive spam and the amount of spam has increased.

The affiliate spammers are hiding behind the CAN-SPAM and provide unsubscribe links.  So we decided to take one of the email addresses that NEVER subscribed to anything, and go through the motions of unsubscribing it from the various links hurled at us by the affiliate spammers.

Email address used for unsubscribe experiment was s*******@******.net

The results will be reported here.

First Unsubscribe was from a site  http://www.earnmydegree.com who sponsored affiliate spam campaign to intermediary redirect spam domain with the following SPAM MAIL

Spam from EarnMyDegree.Com

This website also advertises it owns the following websites

www.earnmycertificate.com
www.business-schools-online.com
www.christian-colleges.net
www.criminaljustice-degrees.com
www.healthcare-colleges.com
www.onlinegraduate-degrees.com
www.teaching-colleges.com
www.topinternetschools.com

The email source

Delivery-date: Thu, 21 May 2009 redacted
Received: from [208.116.17.194] (helo=mx2.sombatonline.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <elvinstoppl@sombatonline.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Subject: {Spam?}-redacted-, Enroll in adult education today.
From: “carolyn” <caropwlyznn@sombatonline.com>

The spam domain that redirected to the destination website was sombatonline.com domain was registered just one week ago and the originating IP address 208.116.17.194 look up on SenderBase provides a clear testimony of Spammer Hosted IP Block on FortressITX – obviously a Spam Friendly Host

Based on the spammer’s footprints in the email SPAM -> image enclosed where the unsubscribe info points to physical address: 157 Yesler Way, 2nd Floor ( same as Ste 200) , Seattle, WA 98104 :

WCS World Class Strategy - Education Dynamics SPAM

this UCE originated by WCS Spammer (short for World Class Strategy, division of Education Dynamics SPAM) who has been in business of spamming for years, as evidenced on this any many other Anti Spam Groups.

Second  unsubscribe was for  the same email address from another Degree Affiliate SPAM email distributed  by EclipseMediaOnline.Com : this spam was also through a disposable domain

Delivery-date: Thu, 21 May 2009 -redacted-
Received: from [208.53.128.194] (helo=mx1.greatusnews.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <csiw@greatusnews.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Message-Id: < -redacted-@mx1.greatusnews.com>
Thread-Index: -redacted-
Reply-To: <csiw@greatusnews.com>
From: “Medical Coding Programs” <csiw@greatusnews.com>
X-Sender: <csiw@greatusnews.com>
Subject: Pursue a Career as a CSI

The Disposable SPAM domain greatusnews.com serves no other purpose but as spam redirect

The originating IP Address 208.53.128.194 is another IP on FDC Servers – another SPAM Friendly ISP based on Senderbase reputation.

Redirecting to www.education180.com website who promotes diploma/degree referrals.  Here is a copy of Eclipse Media advert SPAM that arrived to our inbox:

and here is a screenshot of unsbuscribing on EclipseMedia unsubscribe webpage:

Screenshot of EclipseMediaOnline Unsubscribe Page

————————-

30 Day Follow Up

————————-

Eclipse Media Unsubscribe did not work.  The email address continues receiving various Eclipse media spam mail, here is a random one received June 15th – 3 weeks after unsubscribing

Eclipse Media Spam

Delivery-date: Mon, 15 Jun 2009 -redacted-
Received: from [208.116.42.62] (helo=mx5.blackcatdead.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <tomstopphd@blackcatdead.com>)
id -redacted-
for-redacted-; Mon, 15 Jun 2009 -redacted-
Date: Mon, 15 Jun 2009 -redacted-
Message-ID: <-redacted-@mx5.blackcatdead.com>
MIME-Version: 1.0
Subject: {Definitely Spam?} Turn your passion into a great career

It is important to note that the spam domain blackcatdead.com whois look up

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: BLACKCATDEAD.COM

Registrant:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 03-Jun-2009
Expiration Date: 03-Jun-2010

Domain servers in listed order:
ns1.blackcatdead.com
ns0.blackcatdead.com

Administrative Contact:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

It is interesting to note that ownership details of the EclipseMediaOnline SPAM domain are identical to the domain sombatonline.com used by the WCS – Education Dynamics spammer  -  in our first unsubscribe attempt

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: SOMBATONLINE.COM

Registrant:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 15-May-2009
Expiration Date: 15-May-2010

Domain servers in listed order:
ns1.sombatonline.com
ns0.sombatonline.com

Administrative Contact:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

The domain ownership indicates that EclipseMediaOnline and Education Dynamics / WCS World Class Strategy are one and the same spammer taking on different identities.

Unsubscribing from these SPAMMERS did not work, we continue receiving spam originating from these SPAM outfits.

—————–

Update 6-25-2009

—————–

This email address continues receiving spam from the Eclipse Media Spammer, latest sample posted so unsubscribing from them has not worked so far.  We did notice however and INCREASE in amount of spam this email address receives since our unsubscribe experiment begun.

Spam Volume before Unsubscribe

Spam doubled on some days trippled since the unusbscibe attempt

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?