On Wednesday, October 13, 2004, 8:06:58 PM, Jeff Chan wrote:

On Wednesday, October 13, 2004, 7:06:59 PM, Joseph Burford wrote:

...

bluedomino.com

...

In my mind a FP on the WS list.

...

Domain age in days: 2168

...

Associated with CoffeeCup, the age old HTML editing software. Only place I've seen it mentioned is in the normal mailouts from CoffeeCup to people who have downloaded their software or who are on the mailing list.

...

NANAS sightings about 10, some are just reports of customers they host, nothing really recent.

...

I'd be intrigued to know how it got on WS.

Same here.

Looks like it came from Kai:

/home/kgallasch/black-kgallasch-0801-to-0901:bluedomino.com

OK Kai forwarded me the message off-list but asked to edit the headers. He says it came to a non-existent address:

[...]

Received: from unknown (HELO nash.coffeecup.com) ([64.49.219.10]) (envelope-sender bluedomino@coffeecup.com) by gedankenkraft.free.de (qmail-ldap-1.03) with SMTP for *********@free.de; 18 Jul 2004 14:24:30 -0000 Received: (from coffee@localhost) by nash.coffeecup.com (8.11.6/8.11.6) id i6IEOB928727; Sun, 18 Jul 2004 09:24:11 -0500 Date: Sun, 18 Jul 2004 09:24:11 -0500 Message-Id: 200407181424.i6IEOB928727@nash.coffeecup.com X-Authentication-Warning: nash.coffeecup.com: coffee set sender to bluedomino@coffeecup.com using -f To: *********@free.de Subject: Free Software when you Host From: The Bluedomino Team bluedomino@coffeecup.com Reply-To: bluedomino@coffeecup.com X-Mailer: CoffeeMailer 2.0

Hi there,

Thanks for downloading and using CoffeeCup Software. We really appreciate it!

You have created a Great Website. Now get $300 of CoffeeCup Software Free when you Transfer or Host a New Website at Bluedomino.com Web Hosting.

Check it out here:

...

...

http://www.bluedomino.com/

Look at all the software you get for Free: http://www.bluedomino.com/freesoftware/

Check out the Hosting Features & Plans Here: http://www.bluedomino.com/features/

What Bluedomino.com Web Hosting offers:

• No set Up Fees
• Plans starting at $9.95/mo
• 24/7 Live Chat Support
• 99.9% Uptime Guarantee
• Web and Pop3 E-mail
• Graphical Visitor Stats
• $300 of CoffeeCup Software !
• and lots more.

Check out everything Bluedomino.com Web Hosting has to offer: http://www.bluedomino.com/

Thanks for your support,

The CoffeeCup Team

We don't just make software ... we make Webmasters.

--- END ---

I assume this is affiliate abuse:

http://www.coffeecup.com/affiliate/

though they claim to disallow spam (and probably do):

"What you can't do !

* Mislead others * Operate or utilize a Web site or email link to Web sites that contain or promote any of these types of content: libelous, defamatory, obscene, pornographic, abusive, violent, bigoted, hate-oriented, illegal, cracking, hacking or warez, or any illegal good or service, or link to a Web site(s) that do so * Engage in spamming, indiscriminate advertising or unsolicited commercial email * Engage in cybersquatting or typosquatting * Break any trademark or copyright laws"

I'm whitelisting this domain.

Jeff C. -- "If it appears in hams, then don't list it."

On Thursday, October 14, 2004, 4:33:53 AM, Joseph Burford wrote:

...

I assume this is affiliate abuse:

To me it would more look like someone put an invalid address into the coffeecup site when registering for a free download.

Coffeecup files that address and advertises to an incorrect address.

Messages to invalid addresses aren't always spam :-)

Regards,

Joseph

That's a definite possibility. I don't know if the address it got sent to was a typo or deliberate changed spelling for a legitimate one, but since it doesn't exist, it's probably not a dictionary attack address, etc.

Kai may have other info.

Jeff C. -- "If it appears in hams, then don't list it."