[SURBL-Discuss] 20050615 embedded image spam

Sean Sowell sean at twin-dad.com
Thu Jun 16 23:43:03 CEST 2005


Paul Shupak noted on Thursday, June 16, 2005 0943:

> >...
> >20050615-1132 inphonic.com
> >...
> Most of your list is recognizable spammers, but I've actually bought
> from inphonic and can recommend them.  Not only are they often the least
> expensive (re. the largest rebate on free cell phones) place to get most
> US carriers' cell phones (Amazon comes in as, surprising to me, a close
> second place usually), but their service is very good, and they have never
> sent me any email except a single follow-up after each transaction.
>
> Are you certain the user didn't call one of their telephone numbers?
> They use *many* company names and many domains - with different and *hidden*
> pricing structures.  It is tricky to find the best price from them (they may
> have a half dozen different prices for the same thing, depending on the path
> you take and the cookies you accept to get to a page - very disingenuous, but
> legal - I often tell people to just use Amazon, whose pricing is easier to
> deal with - and far simpler).  Once you deal with any of the "front" companies
> everything later comes from the parent - inphonic.com (and even worst - they
> seem to have "affiliates" who do re-directs and mirror pages).
>
> It also seems unlikely to be an "affiliate" spam case, since all
> the affilaites I have seen use a different domain to start, then mark your
> session with one or more cookies (it is far cheaper to go direct, don't walk
> the tree and accept no cookies - then you usually get offered the lowest of
> the available prices).  Also, I think they are the single largest reseller
> for both Cingular and T-Mobile (and they were for AT&T, pre-merger).
>

Yes Paul, unfortunately it appears that InPhonic has decided to take
spamvertising for a whirl, with or without Sprint PCS' blessing.

My small network consists of my family here at home.  We have never had any
prior business relationship with InPhonic.  We've never bought anything from
InPhonic or Sprint PCS, and we have not been in the market for any cell phones
for at least two years.  I hadn't heard of InPhonic until receiving this spam.

InPhonic apparently hired a well-known spammer (Spamhaus Block List #20212 at
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL20212) to inflict their message
on the rest of us.  They operate with the following domains that I know about,
and almost certainly others:

clearcutsavings.com
ccs44.com
clearcutsav.com
clrctsvg.com
goccutsav.com
nyclearcut.com

Since 5/19 "Clearcut", for lack of a better name, has sent me 18 spams.  17 were
false negatives; SA caught the other one.  Time for me to up my SURBL scoring,
huh?  ;)

Anyway, here's the relevant spam text:

"Phone free after instant rebate. This offer is fulfilled by InPhonic inc., an
authorized dealer for Sprint. Offer subject to credit approval or deposit, and
is available to customers activating a new line of service on a two-year
contract with Sprint. Not all US markets are served by Sprint. If you are not in
a Sprint area you will receive another great offer from another major wireless
company. Other restrictions apply, see full offer for details. Offer Expires
soon. Offer may vary."

And, below is the text from the embedded image:

"If you no longer wish to receive offers fulfilled from InPhonic, Inc., click
here or write to InPhonic, Inc., ATTN: Customer Relations-compliance 9301
Peppercorn Place, Largo MD 20774.  This is an email ad."

Of course, clicking on that GIF won't take you to InPhonic, it'll send you to
Clearcut.  Here's the code:

<a href="http://g.clearcutsavings.com/ryhig.aspx?m=[munge]&w=[munge]/"><img
src="http://mirror.clearcutsavings.com/images/ap/spo02.gif" border=0></a>

My vote for InPhonic is still black.  I have no axe to grind though.  Whatever
the more experienced among you think, I'm willing to live with it.

I've sent the spample in various forms to Paul off-list for his review.  If
anyone else wants the zip file, please let me know and I'll send it right over.

TTYL,

Sean



More information about the Discuss mailing list