The Unsubscribe Experiment

Ok, all the affiliate spammers claim that we/you have subscribed to their mailings.  We have been receiving the affiliate spam to email addresses that NEVER ever subscribed to anything, those email addresses were posted on various web properties for our customers as contact us email addresses and now are plagued with onslaught of UCE.

The affiliate spammers are hiding behind the CAN-SPAM and provide unsubscribe links.  So we decided to take one of the email addresses that NEVER subscribed to anything, and go through the motions of unsubscribing it from the various links hurled at us by the affiliate spammers.

Email address used for unsubscribe experiment was s*******@******.net

The results will be reported here.

First Unsubscribe was from a site  http://www.earnmydegree.com who sponsored affiliate spam campaign to intermediary redirect spam domain with the following SPAM MAIL

This website also advertises it owns the following websites

www.earnmycertificate.com
www.business-schools-online.com
www.christian-colleges.net
www.criminaljustice-degrees.com
www.healthcare-colleges.com
www.onlinegraduate-degrees.com
www.teaching-colleges.com
www.topinternetschools.com

The email source

Delivery-date: Thu, 21 May 2009 redacted
Received: from [208.116.17.194] (helo=mx2.sombatonline.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <elvinstoppl@sombatonline.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Subject: {Spam?}-redacted-, Enroll in adult education today.
From: “carolyn” <caropwlyznn@sombatonline.com>

The spam domain that redirected to the destination website was sombatonline.com domain was registered just one week ago and the originating IP address 208.116.17.194 look up on SenderBase provides a clear testimony of Spammer Hosted IP Block on FortressITX – obviously a Spam Friendly Host

Based on the spammer’s footprints in the email SPAM -> image enclosed where the unsubscribe info points to physical address: 157 Yesler Way, 2nd Floor ( same as Ste 200) , Seattle, WA 98104 :

this UCE originated by WCS Spammer (short for World Class Strategy, division of Education Dynamics SPAM) who has been in business of spamming for years, as evidenced on this any many other Anti Spam Groups.

Second  unsubscribe was for  the same email address from another Degree Affiliate SPAM email distributed  by EclipseMediaOnline.Com : this spam was also through a disposable domain

Delivery-date: Thu, 21 May 2009 -redacted-
Received: from [208.53.128.194] (helo=mx1.greatusnews.com)
by -redacted- with smtp (Exim 4.69)
(envelope-from <csiw@greatusnews.com>)
id -redacted-
for -redacted-; Thu, 21 May 2009 -redacted-
Message-Id: < -redacted-@mx1.greatusnews.com>
Thread-Index: -redacted-
Reply-To: <csiw@greatusnews.com>
From: “Medical Coding Programs” <csiw@greatusnews.com>
X-Sender: <csiw@greatusnews.com>
Subject: Pursue a Career as a CSI

The Disposable SPAM domain greatusnews.com serves no other purpose but as spam redirect

The originating IP Address 208.53.128.194 is another IP on FDC Servers – another SPAM Friendly ISP based on Senderbase reputation.

Redirecting to www.education180.com website who promotes diploma/degree referrals.  Here is a copy of Eclipse Media advert SPAM that arrived to our inbox:

and here is a screenshot of unsbuscribing on EclipseMedia unsubscribe webpage:

————————-

30 Day Follow Up

————————-

Eclipse Media Unsubscribe did not work.  The email address continues receiving various Eclipse media spam mail, here is a random one received June 15th – 3 weeks after unsubscribing

Delivery-date: Mon, 15 Jun 2009 -redacted-
Received: from [208.116.42.62] (helo=mx5.blackcatdead.com)
by-redacted- with smtp (Exim 4.69)
(envelope-from <tomstopphd@blackcatdead.com>)
id -redacted-
for-redacted-; Mon, 15 Jun 2009 -redacted-
Date: Mon, 15 Jun 2009 -redacted-
Message-ID: <-redacted-@mx5.blackcatdead.com>
MIME-Version: 1.0
Subject: {Definitely Spam?} Turn your passion into a great career

It is important to note that the spam domain blackcatdead.com whois look up

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: BLACKCATDEAD.COM

Registrant:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 03-Jun-2009
Expiration Date: 03-Jun-2010

Domain servers in listed order:
ns1.blackcatdead.com
ns0.blackcatdead.com

Administrative Contact:
N/A
Shawn
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

It is interesting to note that ownership details of the EclipseMediaOnline SPAM domain are identical to the domain sombatonline.com used by the WCS – Education Dynamics spammer  -  in our first unsubscribe attempt

Registration Service Provided By: CARRYON EXPRESS
Contact: +714.3746200

Domain Name: SOMBATONLINE.COM

Registrant:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

Creation Date: 15-May-2009
Expiration Date: 15-May-2010

Domain servers in listed order:
ns1.sombatonline.com
ns0.sombatonline.com

Administrative Contact:
N/A
Shawn        ()
2081 Business center Dr #175
irvine
California,92612
US
Tel. +949.4284000

The domain ownership indicates that EclipseMediaOnline and Education Dynamics / WCS World Class Strategy are one and the same spammer taking on different identities.

Unsubscribing from these SPAMMERS did not work, we continue receiving spam originating from these SPAM outfits.

—————–

Update 6-25-2009

—————–

This email address continues receiving spam from the Eclipse Media Spammer, latest sample posted so unsubscribing from them has not worked so far.  We did notice however and INCREASE in amount of spam this email address receives since our unsubscribe experiment begun.

Consumer Warning:  Brace yourself for a flood of future spam once you fall a victim to affiliate spammers.  We have taken inventory of spam mails received by one client who purchased one of the advertised products through the affiliate spam link, today this client receives approximately 40 unsolicited advertisement emails per day, from hundreds of domains and numerous spam affiliate entities: everything from home warranty, to clense your colon, to become an x-ray technician, get slim again, you name it – it will arrive to your inbox once you have entered to the “business relationship” with the spammer.  As a consumer, you most likely  do not realize that these affiliate spammers will receive your full email address, name and home address because they will have access to customer data through the details on the affiliate commission sale.    So brace yourselfves for flood of spam and who knows what.  These snowshoe spammers are unscrupulous.  They have no reservations about evading spam filters to ram through sophisticated desquise methods: thousands of spam domain identities, hundreds of  distributed web servers, shielded identities and mail drop boxes to make unsubscribing impossible.  Do you think your identity and privacy will be safe in their hands?