Work at home spam?

This is transferred to the new board at http://fraudreports.prophpbb.com
Spammers should not profit, so post information here that hits their pockets.

Work at home spam?

Postby darius » Sat Dec 11, 2010 1:44 pm

Hi

Anyone else getting this crap?

A few of the emails:
"I made $63 in my spare time just working at home! I went to - Business Week Journal You owe me one! http://x.co/L1ea "

"I just racked $455 in 3 days spending time online! I love this site - Channel 7 News Remember who hooked you up! http://goo.gl/SiYiT "

"Hey , I found something thats reces$ion proof, earn up to 200 a day with this article news site i found: http://bit.ly/eaYXbb "



Obviously these are url shortening services
http://x.co/L1ea ( link not working now )
http://goo.gl/SiYiT >> new8reports.com
http://bit.ly/eaYXbb >> abcnewstoday7.net


All of these sites are pretty much identical
They pull in some weather and other feeds.
They all have the retarded "ARE YOU SURE YOU WANT TO LEAVE THIS SITE" popup when you go to close the page.


But they are spread over a few places.
( I have been spammed by some of these domains not all of them, just to be clear. )


new8reports.com privacy protected 66.77.58.153
dns1.name-services.com 98.124.192.1


ALL of this list are the same fake kind of news report on work at home crap and the same ip 66.7.222.50 and use the same name servers:
abcbreakingnews7.net
abcnews11.net
abcnews12.net
abcnews4.net
abcnews7.net
abcnews9.net
abcnewstoday7.net
cbsnews11.net
cbsnews12.net
cbsnews4.net
cbsnews7.net
cbsnewstoay.net
cnbcnews7.net
global81news.net
local46news.net down
local46news.org
local90news.net
local91news.net
msnbcnews11.net
msnbcnews4.net
msnbcnews7.net
msnbcnewstoday7.net
nbcbreakingnews.net
nbcnews11.net
nbcnews12.net
nbcnews4.net
nbcnews7.net
nbcnews9.net
nbc36news.net
nbc36news.net
nbc37news.net
nbc38news.net
nbc39news.net
nbc40news.net
nbc41news.net
nbc42news.net
nbc7newsmedia.net
nbcbreakingnews.net
nbcnewstoday7.net
usa1today.net
usa2today.net


( and all redirect to the same site and use the same who is info. )

Example: nbc40news.net 66.7.222.50
Registrar: MONIKER

Anthony Smith
4058 Minoso St
Orlando Fl
32811
NOv 19 2010


Name Servers
NS1.MADE2OWN.COM 66.7.222.53
NS2.MADE2OWN.COM 66.7.222.53


Made2Own Advanced Hosting Solutions, Inc.
1203 Governors Square Blvd, Suite 101
Tallahassee, Florida 32301-2960
United States


SO . . .

I have filed complaints on lots of them, including the url shortening links and so far not much action.

We need to get more complaints going . . .

Lets give the spammers a bad day!
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Sat Dec 11, 2010 4:48 pm

I've been seeing dozens of these every day to numerous accounts I monitor.

http://bit.ly/eaYXbb

Redirects to:

http://abcnewstoday7.net/?qeg2

All links on that page point to:

http://abcnewstoday7.net/go.php

Which in turn does a back-end geoip lookup to figure out which location to redirect you, and then performs a series of hidden redirections:

http://abcnewstoday7.net/go.php

Performs a Meta-Refresh

http://dctracking.com/click.track?CID=142558&AFID=146048&ADID=413922&SID=

Performs a 302 Redirect

http://affiliate.revenueads.com/z/16918/CD6326/146048

Performs another Meta-Refresh

https://www.homeincomeprofitkit.com/?AID=CD6326&OPT=146048

That sequence shows click fraud perpetrated against the DankCash affiliate program, and then the Revenueads.com affiliate program, finally landing on the real target, homeincomeprofitkit.com, passing affiliate programs for that program as well.

DankCash affiliate signup which includes a detailed affiliate agreement which prohibits spamming:

http://affiliate.dankcash.com/Welcome/L ... ignUp.aspx

Dankcash affiliate id: 146048

Revenue ads affiliate agreement, which is extremely clear about not allowing spamming of any sort:

http://affiliate.revenueads.com/agreement.html

Revenueads affiliate id is ALSO 146048

Click fraud on two domains, and then passing of the actual target url, all supported by an illicit, non-compliant spam campaign.

But it's not over yet, you still have to click on one more link to purchase their likely bogus "solution":

https://www.homecashflowsolution.com/t003/order/payment97.php

Some interesting html comments in that form:

Code: Select all
     <form onClick="areYouReallySure = true;" onsubmit="VF_form1();return false;" name="form1" id="form1" method='POST' action='/t003/uptree/1/index.php'>
     <input type='hidden' name='package' value='97' />
   <!-- ADD THESE FIELDS TO GENERATED FORM -->

<input type='hidden' id='product_id' name='product_id' value='90'/><!-- THIS IS THE LIMELIGHT PRODUCT ID -->
<input type='hidden' id='current_total' name='current_total' value='0'/><!-- THIS MUST BE 0 IF ITS THE FIRST PAGE -->
<input type='hidden' id='submitpayment' name='submitpayment' value='1'/><!-- THIS IS ALWAYS 1 -->
<input type='hidden' id='customer_id' name='customer_id' value=''/><!-- LEAVE THIS BLANK FOR THE FIRST SALES PAGE -->
<input type='hidden' id='campaign_id' name='campaign_id' value='48'/>
<input type='hidden' id='shipping' name='shipping' value='4'/>
<input type='hidden' id='page' name='page' value='/t003/order/payment97.php'/>
<!-- END CUSTOM ADDITIONS -->

"Limelight product id"... ?

I've reported this spamming activity for several months now to DankCash with absolutely zero response, but maybe they need to hear from a much larger number of spam recipients.

This spamming has been going on for months.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby darius » Sun Dec 12, 2010 12:21 pm

Wow lots info there sil

Where the heck do we report spam with google url shortening.
Most recent spam has this link

http://goo.gl/SiYiT

Google sure doesn't seem to make it easy to report.
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Sun Dec 12, 2010 1:54 pm

darius wrote:Wow lots info there sil

Where the heck do we report spam with google url shortening.
Most recent spam has this link

http://goo.gl/SiYiT

Google sure doesn't seem to make it easy to report.

Actually once you *find* where to report it:

http://www.google.com/webmasters/tools/

It's easy. You have to login. Choose the "report spam" link on the left side. From there I usually check two boxes:

Malicious redirects
Other

And then fill in a brief description of what the abuse is.

Google took their time reacting but once they did they pre-emptively shut down any new urls pointing to these redirections.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Google abuse reporting

Postby Red Dwarf » Sun Dec 12, 2010 2:03 pm

For reporting abuse to Google, visit
http://www.google.com/support/a/bin/answer.py?hl=en&answer=134413
You will find a general "Support options page" link there
User avatar
Red Dwarf
You are kiillllling-a my bizinisss!
 
Posts: 10542
Joined: Tue Jun 27, 2006 2:01 am

Re: Work at home spam?

Postby kabo0m » Sun Jan 02, 2011 6:55 am

I have been seeing a lot of these in emails and some banner ads (especially advertised in Proboards banner ads sadly).

Because of this I have compiled a list of where to report depending on what site is used for the shortened url service. It is short and I invite anyone to add to this .. but if this should be in a new thread, please split and rename it. Thanks.

http://bit.ly/ or j.mp:
Members report to https://bit.ly/a/sign_in?rd=%2Fa%2Freport_spam
or http://bit.ly/SpamReporting if you are not registered there.

http://snipurl.com:
Report to http://snipurl.com/site/reportspam

http://tinyurl.com/:
The contact on that page has worked for me to get 2 links reported recently.

http://cli.gs/:
http://blog.cli.gs/contact

http://tiny.cc/:
Report abuse to the contact on this page: http://tiny.cc/terms
User avatar
kabo0m
Spam Reporter
 
Posts: 154
Joined: Sun Mar 21, 2010 4:36 pm

Re: Work at home spam?

Postby darius » Mon Jan 24, 2011 2:19 am

Looks like the idiot work at home spammer has upped his game.

100 new domains registered using many new registers.
(probably figured out one register could kill the spam run.)


New spam list 100 identical sites.
new1dayreport.com
[all the way up to]
new100dayreport.com



Here is a list of the different registers this scammer has used in this spam run.

new1dayreport.com Registrar: CHINA SPRINGBOARD INC
[all the way up to]
new15dayreport.com

new16dayreport.com Registrar: TODAYNIC.COM, INC.
[all the way up to]
new29dayreport.com

new30dayreport.com Registrar: XIAMEN ENAME NETWORK
[all the way up to]
new40dayreport.com

new41dayreport.com Registrar: HICHINA ZHICHENG TECHNOLOGY LTD.
[all the way up to]
new50dayreport.com

new51dayreport.com Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD
[all the way up to]
new65dayreport.com

new66dayreport.com Registrar: BIZCN.COM, INC.
[all the way up to]
new79dayreport.com

new80dayreport.com Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD.
[all the way up to]
new89dayreport.com

new90dayreport.com Registrar: GODADDY.COM, INC.
[all the way up to]
new100dayreport.com
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Mon Jan 24, 2011 12:16 pm

It looks like yours is a different setup from the ones I've been seeing.

My spammer uses the following setup:

Always an obscure url shortener to begin:
http://es.vc/pD4

Redirects to:
http://usnews3.com/business/2010-live254

Links To:
http://spacetrk.com/aff_ad?campaign_id=15&aff_id=254&source=
Meta-Refresh
http://www.tracklead.net/click.track?CID=133243&AFID=156316&ADID=356350&SID=254
Meta-Refresh
http://www.clickboothlnk.com/e/?enc=cknkkqpqxeql&optionalinfo=156316&deployid=0&land=0&pid=0
302 Redirect
http://www.homeemploymentagency.net/index

Yours doesn't use that setup, and doesn't appear to use any affiliate CPA program as a pass-through (or at least it isn't documented from your end that he does.)

I have been trying to contact clickbooth for the better part of a year. They effectively have no abuse reporting process despite having an explicit anti-spamming clause in their terms of use policy. Their AIM contact (clickbooth) has been less than useless, providing me (so far) three distinct email addresses to report spam. Not a single one of them ever responds.

ClickBooth = 100% spam-friendly. They do absolutely nothing about this.

I'd like to note that my same spamming idiot has been abusing three different affiliate programs in this way throughout 2009:

DankCash (as mentioned above)
ClickBank (whose abuse process is a lot better than it used to be.)
AdKnowledge (same.)

As long as ClickBooth remains this retarded at tackling this abuse, spammers can keep on abusing them. But your spammer seems to have a different setup.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby AlphaCentauri » Mon Jan 24, 2011 5:53 pm

spamislame wrote:I have been trying to contact clickbooth for the better part of a year. They effectively have no abuse reporting process despite having an explicit anti-spamming clause in their terms of use policy. Their AIM contact (clickbooth) has been less than useless, providing me (so far) three distinct email addresses to report spam. Not a single one of them ever responds.

ClickBooth = 100% spam-friendly. They do absolutely nothing about this.


I have used compliance@integraclick.com in the past, but never got any acknowledgment of whether it was received or whether they were taking action. You don't ever know if the spam has stopped without dissecting the redirection links of every spam; they don't put their own domain name in the spam emails themselves.

I see they now have a general contact form at http://www.integraclick.com/#moreinfo , but I suspect that wouldn't be any better than your AIM contact.

Their website does suggest contacting the DMA if they are not in compliance. I haven't tried that:
If you feel that this site is not following its stated information policy, you may contact us at the above addresses or phone number, The DMA's Committee on Ethical Business Practices at mgoldberger@the-dma.org.
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Work at home spam?

Postby darius » Mon Jan 24, 2011 8:51 pm

Hi Sil

I looked up some of the links:

http://www.clickboothlnk.com/e/?enc=ckn ... nd=0&pid=0

Stated on thier site:
You may have found this website from an advertisement from one of our partners. Although Clickbooth is a partner of the company that setup the advertisement, Clickbooth does not participate in marketing to consumers directly. Clickbooth and its partners are compliant with all online marketing laws.

If you questions or concerns feel free to contact us below or send an email to abuse@clickbooth.com for an immediate investigation into your inquiry.

( I'd say spamming deserves an investigation, although they probably won't care. lol There are FAR to many companies put aside morals and laws for a few dollars.)
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Tue Jan 25, 2011 11:29 am

darius: well aware of that. I've been attempting to report to them for over a year now. They take zero action.

I am finally in touch with someone who may change that, but I'm not holding my breath. If they actually do take this seriously for once, I'll definitely report back about it.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby Devilwolf » Tue Jan 25, 2011 12:45 pm

spamislame wrote:Links To:
http://spacetrk.com/aff_ad?campaign_id=15&aff_id=254&source=
Meta-Refresh
http://www.tracklead.net/click.track?CID=133243&AFID=156316&ADID=356350&SID=254
Meta-Refresh
http://www.clickboothlnk.com/e/?enc=cknkkqpqxeql&optionalinfo=156316&deployid=0&land=0&pid=0
302 Redirect
http://www.homeemploymentagency.net/index

I have been trying to contact clickbooth for the better part of a year. They effectively have no abuse reporting process despite having an explicit anti-spamming clause in their terms of use policy. Their AIM contact (clickbooth) has been less than useless, providing me (so far) three distinct email addresses to report spam. Not a single one of them ever responds.

ClickBooth = 100% spam-friendly. They do absolutely nothing about this.


Clickbooth is another spammer hiding behind Dotster's privacy service. In the Spim thread a few people where telling me how proactive dotster is about taking action against spammers. So why not target Clickbooth at Dotster?

Clickbooth
Administrative Contact:
ietjTA@privacypost.com
c/o CLICKBOOTHLNK.COM
P.O. Box 821650
Vancouver, WA 98682

or you could try and call
Ziare Brown Vice President of Compliance and Enforcement
Phone: 941-483-4188
Devilwolf
Spam Observer
 
Posts: 79
Joined: Thu Oct 14, 2010 4:05 pm

Re: Work at home spam?

Postby spamislame » Tue Jan 25, 2011 2:57 pm

Devilwolf wrote:or you could try and call
Ziare Brown Vice President of Compliance and Enforcement
Phone: 941-483-4188

Done that. Utterly no response. Voicemails. Emails. Nothing. Going on 14 months now.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby spamislame » Tue Jan 25, 2011 4:08 pm

My moron spammer has also used the same technique to start spamming another Acai Berry fake product (Power Slim).

http://myfatresults.com/

Redirects to:

http://www.newspowerslim.com/

Another fake "news" site. Retarded...

All links on that page point to this URL in a new window:

http://www.newspowerslim.com/acai.php

Which redirects based on your geographic location to:

http://www.powerslimsale.com/

Doesn't use any security. Takes fakes. Etc. Looks like another AffKing site.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby darius » Tue Jan 25, 2011 7:44 pm

I see your spammers domain "myfatresults.com" has these nameservers

ns2.canadajob.ru
ns1.canadajob.ru
( what a stupid name for the name servers)

And
http://www.canadajob.ru/

Is a viagrow site

Your idiot spammer looks like he is flailing in all directions tryng to make money.

The claims on the site are to funny:

Rock hard for upto 72 hours??
(you would have to go to the hospital long before that!)

All he needs to say now is cures cancer, every other claim is there.


And all this on CANADAjob.ru
canada? job?
( I don't see the connection here. ;p )
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Next

Return to Fight Spammers

Who is online

Users browsing this forum: Yahoo [Bot], Yandex [Bot] and 1 guest

cron