Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

I went back through old archives, and... I found a case of affiliate abuse involving inphonic. The email came to a non-existant account, not the one I use with inphonic and it was very similar to the one you got (i.e. links to inphonic pages, but redirects to the affiliate). This is old (Aug. 2003), but after I had been a customer, and the domains are all still valid (and look bad). Only one is currently listed in SURBLs (noted alongside of it). The involved domains were: myobdeals.com greatoffers.us homebasedbusinessclub.com [jp] imarketoffers.com I also check, all "real" inphonic emails have come from servers in their own domain with working rDNS and FCrDNS. I had never noticed this one, because it was to an obvious "bad" account (a misspelling of an account which I sometime post with, so it had both been "scraped" and typo'd - It got on a CD over a year ago, and now is one of the few accounts I outright refuse, instead of just piping down the automatic spam-reporting machinery - too much "mom&pop" operation spam to it). Anyway, it was two years ago, and I got just one - but it shows they have had past problem (but with just one vs. your > 10, my case was probably cleared up quickly). Paul Shupak track(a)plectere.com

2 1

Re: Fw: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

Having seen what you sent, I would immediately agree with listing all the "CLEARCUT" domains, including at the least, CLEARCUTSAVINGS. COM, ccs44. com, peakedig. com, peakedigital. com and all the others you had previously listed. It does look like a pretty clear case of "affiliate" abuse, and I'm still willing to give inphonic the benefit of the doubt. I would send an email (with copies of everything) to affiliates(a)inphonic.com and see what kind of response you get - if they don't drop clearcut/peakedigital et. al., I will stop buying from them and recommending them (I just sent them somebody on Friday, who bought two phones for $270 less than the local Cingular Store wanted for the same Cingular package - they were about $90 under Amazon). InPhonic is big, not Fortune 500, but *very* large. They do have "emarketing", but as I have said - I've never gotten anything from them despite the fact that they have a valid email address (unique, so I also know it has never been sold or "rented"). The 800 number on the web pages will eventually get someone who will have a "real" manager (but still in "sales") call back - Corporate Communications is (202) 333-0001, and from their own Sprint press release (also on their pages), the V.P. for Corporate Communications is "Tripp Donnelly", email tdonnelly(a)inphonic.com. I have had *such* good dealings with them that I would expect some quick response - copy him as well as the affiliate address above. Right now, I say inphonic looks clean, but is implicated by bad management of their affiliate program. The clearcut/peakedigital people are using at least two "spam friendly" hosting providers and should be listed right away (i.e. at least one is the same as the one Ralsky used for the emails that got Verizon to sue him - clearcut is using Yikes for both "unsubscribe" and a 1by1 pixel marker in the spam copy you sent). Please tell me/us whatever you get back from InPhonic. It will certainly affect my sending them customers (I'm normally a quite loyal customer when I find a company with good service - though admittedly their "free extras" are junk). Bye, Paul Shupak track(a)plectere.com

1 0

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 17 Jun '05

17 Jun '05

>... > >Paul Shupak noted on Thursday, June 16, 2005 0943: > >> >... >> >20050615-1132 inphonic.com >> >... >> Most of your list is recognizable spammers, but I've actually bought >> from inphonic and can recommend them. Not only are they often the least >> expensive (re. the largest rebate on free cell phones) place to get most >> US carriers' cell phones (Amazon comes in as, surprising to me, a close >> second place usually), but their service is very good, and they have never >> sent me any email except a single follow-up after each transaction. >> >> Are you certain the user didn't call one of their telephone numbers? >> They use *many* company names and many domains - with different and *hidden* >> pricing structures. It is tricky to find the best price from them (they may >> have a half dozen different prices for the same thing, depending on the path >> you take and the cookies you accept to get to a page - very disingenuous, but >> legal - I often tell people to just use Amazon, whose pricing is easier to >> deal with - and far simpler). Once you deal with any of the "front" companies >> everything later comes from the parent - inphonic.com (and even worst - they >> seem to have "affiliates" who do re-directs and mirror pages). >> >> It also seems unlikely to be an "affiliate" spam case, since all >> the affilaites I have seen use a different domain to start, then mark your >> session with one or more cookies (it is far cheaper to go direct, don't walk >> the tree and accept no cookies - then you usually get offered the lowest of >> the available prices). Also, I think they are the single largest reseller >> for both Cingular and T-Mobile (and they were for AT&T, pre-merger). >> > >Yes Paul, unfortunately it appears that InPhonic has decided to take >spamvertising for a whirl, with or without Sprint PCS' blessing. > >My small network consists of my family here at home. We have never had any >prior business relationship with InPhonic. We've never bought anything from >InPhonic or Sprint PCS, and we have not been in the market for any cell phones >for at least two years. I hadn't heard of InPhonic until receiving this spam. > >InPhonic apparently hired a well-known spammer (Spamhaus Block List #20212 at >http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20212) to inflict their message >on the rest of us. They operate with the following domains that I know about, >and almost certainly others: > >clearcutsavings.com >ccs44.com >clearcutsav.com >clrctsvg.com >goccutsav.com >nyclearcut.com > >Since 5/19 "Clearcut", for lack of a better name, has sent me 18 spams. 17 were >false negatives; SA caught the other one. Time for me to up my SURBL scoring, >huh? ;) > >Anyway, here's the relevant spam text: > >"Phone free after instant rebate. This offer is fulfilled by InPhonic inc., an >authorized dealer for Sprint. Offer subject to credit approval or deposit, and >is available to customers activating a new line of service on a two-year >contract with Sprint. Not all US markets are served by Sprint. If you are not in >a Sprint area you will receive another great offer from another major wireless >company. Other restrictions apply, see full offer for details. Offer Expires >soon. Offer may vary." > >And, below is the text from the embedded image: > >"If you no longer wish to receive offers fulfilled from InPhonic, Inc., click >here or write to InPhonic, Inc., ATTN: Customer Relations-compliance 9301 >Peppercorn Place, Largo MD 20774. This is an email ad." > >Of course, clicking on that GIF won't take you to InPhonic, it'll send you to >Clearcut. Here's the code: > ><a href="http://g.clearcutsavings.com/ryhig.aspx?m=[munge]&w=[munge]/"><img >src="http://mirror.clearcutsavings.com/images/ap/spo02.gif" border=0></a> > >My vote for InPhonic is still black. I have no axe to grind though. Whatever >the more experienced among you think, I'm willing to live with it. > >I've sent the spample in various forms to Paul off-list for his review. If >anyone else wants the zip file, please let me know and I'll send it right over. > >TTYL, > >Sean > > I agree - this looks damning enough for me. Do note that clearcut seems to be an "affiliate" - They are in Texas, inphonic is in Maryland (and in NY). I am now entirely certain that "clearcut" is guilty - If an email or telephone call to inphonic doesn't get any response, I'd list them too (it does look like "affiliate" abuse though, since you say that clicking does not take you to inphonic). I did say that they have "strange" (at best) pricing options and a very sophisticated (and not in a good way) web site. BTW. The reason I like inphonic, is that they tend to payout 60-80% of the commision to the customer - so rarely is the phone "free", usually you get paid $150 to $250 to take it (e.g. I got paid $500 for my last two phones). If clearcut is *only* offering "free", that is unusual, even for the affiliates. Paul Shupak track(a)plectere.com P.S. They have an 800 number, mostly staffed by peons, but ask for a manager and somebody will actually call back the next day (my experiences) - I didn't want to give out a Social Security number (and didn't).

2 1

Re: [SURBL-Discuss] 20050615 embedded image spam
by List Mail User 16 Jun '05

16 Jun '05

>... >Hello --- > >Below is a fresh list of dates and domains. All times are Pacific (GMT - 7). > >Kind regards, > >Sean Sowell > >... >20050615-1132 inphonic.com >... > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Most of your list is recognizable spammers, but I've actually bought from inphonic and can recommend them. Not only are they often the least expensive (re. the largest rebate on free cell phones) place to get most US carriers' cell phones (Amazon comes in as, surprising to me, a close second place usually), but their service is very good, and they have never sent me any email except a single follow-up after each transaction. Are you certain the user didn't call one of their telephone numbers? They use *many* company names and many domains - with different and *hidden* pricing structures. It is tricky to find the best price from them (they may have a half dozen different prices for the same thing, depending on the path you take and the cookies you accept to get to a page - very disingenuous, but legal - I often tell people to just use Amazon, whose pricing is easier to deal with - and far simpler). Once you deal with any of the "front" companies everything later comes from the parent - inphonic.com (and even worst - they seem to have "affiliates" who do re-directs and mirror pages). It also seems unlikely to be an "affiliate" spam case, since all the affilaites I have seen use a different domain to start, then mark your session with one or more cookies (it is far cheaper to go direct, don't walk the tree and accept no cookies - then you usually get offered the lowest of the available prices). Also, I think they are the single largest reseller for both Cingular and T-Mobile (and they were for AT&T, pre-merger). Paul Shupak track(a)plectere.com

2 1

20050615 embedded image spam
by Sean Sowell 16 Jun '05

16 Jun '05

Hello --- Below is a fresh list of dates and domains. All times are Pacific (GMT - 7). Kind regards, Sean Sowell 20050614-0137 virtualcitycasino.com 20050614-0242 sererih.com 20050614-0314 ltoptout.com 20050614-0619 radiocarbodatin.com 20050614-0621 radiocarbodatin.com 20050614-0824 donmehme.com 20050614-0925 dmgy.com 20050614-0925 totalgiveaway.com 20050614-1007 scottyoungwq.net 20050614-1033 clickboothlnk.com 20050614-1332 hcsyd.com 20050614-1332 highlifeplastic.com 20050614-1417 primaryads.ca 20050614-1417 startyoursavingstoday.ca 20050614-1516 getbestofitnesstothisitem.com 20050614-1625 clickboothlnk.com 20050614-1823 freecdsuperstore.com 20050614-1823 optit.com 20050614-1914 thfirshuman.com 20050614-1958 thfirshuman.com 20050614-2129 soonerwe.com 20050615-0022 colocolofh.com 20050615-0200 creditapplications.info 20050615-0200 fxfn.com 20050615-0200 impulsemg.com 20050615-0402 luckyemperor.com 20050615-0406 donlittlbiof.com 20050615-0409 donlittlbiof.com 20050615-0513 i-cami.com 20050615-0532 duffha.com 20050615-0955 irq12.com 20050615-0955 petcarerx.com 20050615-1104 qualitymba.info 20050615-1112 qualitymba.info 20050615-1131 dvdmegapacks.com 20050615-1132 ccs44.com 20050615-1132 inphonic.com 20050615-1137 nyclearcut.com 20050615-1310 livemercial.com 20050615-1348 byonbard.com 20050615-1348 heatn.com 20050615-1348 lifeonaclick.com 20050615-1451 prima11.com 20050615-1505 urchoise.com 20050615-1517 flourishnutrition.com 20050615-1517 healthsitesinc.com 20050615-1551 beirahc.com 20050615-1557 actma.com 20050615-1617 creditapplications.info 20050615-1617 fxfn.com 20050615-1617 impulsemg.com 20050615-1655 urchoise.com 20050615-1737 investmystock.com 20050615-1737 onlinestocktrading.ws 20050615-1800 i-cami.com 20050615-1823 prima11.com 20050615-1823 rewardsgateway.com 20050615-2306 sasthear.com 20050615-2309 sasthear.com

1 0

Whitelist: multiply.com
by Robert Menschel 16 Jun '05

16 Jun '05

Hello Jeff, All, Just received some spam today from a site that needs to be whitelisted on SURBL -- multiply.com Valid community-based, free (adv sponsored), social networking, email-generating system. We've received valid emails from people using the system as it is intended. However, even when used as intended, it's liable to a domino/cascade effect. Emails sent to person A's contact list which includes B, C, and D, can be automatically forwarded to their contact lists, their contacts' contacts' contacts, etc. That's the spam received today -- email once removed, where A's contact list would be appropriate, but we're on B's contact list, and have no interest in this email from A. Think of it as the forward of a forward of a forward problem, where it's not a matter of that last forward being sent mindlessly -- it was sent automatically. I'll be adding this to the SARE rules system somewhere, but it's too early now to predict how large or small a score it will have. Bob Menschel

2 1

new phishing URI deutsch-bank.net
by wolfgang 16 Jun '05

16 Jun '05

>From the invalid sender address Support(a)db.com we are just receiving a flood of phishing mails here is a quote with the URI in question Bitte, <strong><a href=3d"http://deutsch-bank=2enet/mod/WebObject= s/dbpbc=2ewoa?lang=3dde">schauen</a></strong> Sie Internet Banking, um di= i will submit samples to the web interfaces in a minute cheers, wolfgang

3 2

phishing URI
by wolfgang 13 Jun '05

13 Jun '05

postbank-deutschland.com this is a phishing URL that tries to fool postbank.de bank account owners to enter PIN and TAN data. I just submitted it to black.uribl and ws.surbl via webform too, the faster it's listed, the better ... cheers, wolfgang

2 3

RE: [SURBL-Discuss] Re: spam from Cricket Liu via postsnet/campai gner (FW: Webinar: Active Directory Best Practices for DNS)
by Chris Santerre 13 Jun '05

13 Jun '05

> >If you simply bought the list, you may want to familiarize yourself and >your marketing team with basic netiquette and guidelines for >responsible >(as opposed to merely "legal") email marketing. It's 2005 - anyone >purchasing so-called "opt-in" lists in this day and age is begging to >get blacklisted and have their reputation tarnished. > >I realize that if you purchased the list you probably can't get me >removed from the original - I've come to expect my address to >be traded. >Frankly, I'm astounded to see someone as apparently net-savvy as you >just accepting the idea of purchasing mailing lists. I'm very, very >disappointed. > >Steve Freaking genius Steve! Great email to him. I hope they *get it*. --Chris

2 1

Re: [SURBL-Discuss] Re[2]: More whitelist.cf
by List Mail User 12 Jun '05

12 Jun '05

> >Hi Paul, >What is their hat color please? > >Jeff C. >-- >Don't harm innocent bystanders. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss > Jeff, I'm pretty sure that 1&1 is a definite "white hat", just so large that like any large ISP (at least most without zero-tolerance policies), they get abused from time to time - actually so large, it a not uncommon. I'm not sure how large, but their presence in Europe seems to be almost on the order of a "Earthlink" or certainly larger than "Lycos" mail or other second tier providers - I liken them to RoadRunner, large with more customers than they can support well, and overly slow to act (but they do act). It does seem that abuse is more common for 1and1 than the European domains (1und1.tld, oneandone.tld seems mostly corporate and large customers - I haven't seen more than a very few cases of "questionable" emails from oneandone - but a lot of forgeries). I simply suspect that whitelisting them might be like whitelisting any particular address from Yahoo! - not something I would trust without a statement that they check and/or reserve that address for their own use only (i.e. no customer could use it). Also, note that the most common form of abuse I have seen is the use of "dropboxes" at 1&1, not mailings from their network (just like for Yahoo!). They definitely do respond to complaints, but more slowly than I would like, and often there seems to be a language barrier (which is rare among the large multi-nationals which I have dealt with). Possible someone from Germany has further opinions and/or data to be shared. (Please, please - somebody from Germany speak up.) I would not put them in with t-dialin.net/t-online.de, who I would call "grey" - i.e. most customers are average people, but they make no attempt to act upon complaints (and are abused constantly - almost daily even for a small site like mine). Paul Shupak track(a)plectere.com

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss