Work at home spam?

Spammers should not profit, so post information here that hits their pockets. There are many ways to fight spammers, and we have automation tools to combat them efficiently. These forums are moderated, but do not reflect the views of the hosting company, domain registrar, etc. By entering any of these forums, you agree that you cannot hold anyone liable for anything related in any way to these forums.

Re: Work at home spam?

Postby Nodus » Tue Jan 25, 2011 10:01 pm

spamislame wrote:My moron spammer has also used the same technique to start spamming another Acai Berry fake product (Power Slim).

http://myfatresults.com/

Redirects to:

http://www.newspowerslim.com/

Did you notice the fine print at the bottom of the page:

It is important to note that this site and the comments/answers depicted above is to be used as an illustrative example of what some individuals have achieved with this/these products. This website, and any page on the website, is based loosely off a true story, but has been modified in multiple ways including, but not limited to: the story, the photos, and the comments. Thus, this page, and any page on this website, are not to be taken literally or as a non-fiction story. This page, and the results mentioned on this page, although achievable for some, are not to be construed as the results that you may achieve on the same routine. I UNDERSTAND THIS WEBSITE IS ONLY ILLUSTRATIVE OF WHAT MIGHT BE ACHIEVABLE FROM USING THIS/THESE PRODUCTS, AND THAT THE STORY/COMMENTS DEPICTED ABOVE IS NOT TO BE TAKEN LITERALLY. This page is affiliated with Power Slim and receives compensation for clicks on or purchase of products featured on this site.

They are trying to cover their backs :lol:. Actually many of those fake work-at-home "news sites" have almost identical T&C, which makes you wonder whether they are all from the same affiliate program.

darius wrote:And
http://www.canadajob.ru/

Is a viagrow site

Your idiot spammer looks like he is flailing in all directions tryng to make money.

I believe ViaGrow, Power Slim, Quick Slim etc. come from the same sponsors, whoever they are. They actually have some similar "news sites" for ViaGrow as well. A few examples:

grows-mypenis.com
highexplode.com
toppenil.com
veryenlarged.com

But these don't seem to have any T&C :).
Arf, she said
User avatar
Nodus
Spammer Obliterator
 
Posts: 2286
Joined: Fri Jun 15, 2007 7:05 pm

Re: Work at home spam?

Postby darius » Tue Feb 15, 2011 1:37 pm

I'm still getting work at home spam, but from a different ( but still stupid) spammer

Part of the spam body:

Mom Makes $6795/Month Part-Time At Home

With all the negative publicity towards work at home business opportunities, News 1 decided to investigate... Read Report

And what they find comes to a huge surprise and reminds us that NOT all work from home programs are scams!

Jessica Holcomb, a struggling, single mother seems to have found a very legit and easy way to make a great living from the comfort of her home and only work a few hours each day! Stephanie stated: This isnot a get rich quick program, but they do not claim it to be. This is a way to earn a real living, while still being able to enjoy doing the things you love and having enough time for your family.



Then the spammer uses urls like this
http://www5.spotlight-sports-blog-sh22. ... 4fG3S|9203


The spammer has it set up so that if you just enter domain name like this
http://www.spotlight-tech-blog-sh22.net

You get this message:
can't find the server at http://www.spotlight-tech-blog-sh22.net.


But enter this
www4.spotlight-tech-blog-sh22.net
and you get a directory listing denied.


They are using several variations:
ww1.idiot spam domain name.net
ww4.
ww7.
www4.
www7.


Here is a list of the imbeciles domains so far I have found:
( I tried a few variations on some of them to get the "directory listing denied" message which means their site is there, but won't show it without the exact url )

www4.spotlighttechblogsh22.net
www7.spotlighttechblogsh23.net
www4.spotlighttechblogsh24.net
www7.spotlighttechblogsh25.net

ww3.spotlightblogsh21.net
spotlightblogsh210.net
spotlightblogsh22.net
spotlightblogsh23.net
spotlightblogsh26.net
spotlightblogsh28.net

ww4.spotlightestateblogsh210.net
spotlightestateblogsh22.net
spotlightestateblogsh23.net
spotlightestateblogsh24.net
spotlightestateblogsh25.net
spotlightestateblogsh26.net
spotlightestateblogsh27.net
spotlightestateblogsh29.net

www4.spotlightsportsblogsh24.net
spotlightsportsblogsh210.net
spotlightsportsblogsh22.net
spotlightsportsblogsh27.net
spotlightsportsblogsh28.net

ww3.spotlightblogsh21.net
spotlightblogsh23.net
spotlightblogsh24.net
spotlightblogsh26.net
spotlightblogsh2alert1.net

spotlightmarketingblogsh25.net
spotlightmarketingblogsh26.net
spotlightmarketingblogsh28.net
spotlightmarketingblogsh29.net

ww4.spotlightblogsh21hotels.net

www4.spotlight-tech-blog-sh22.net
spotlight-tech-blog-sh24.net
spotlight-tech-blog-sh25.net
spotlight-tech-blog-sh27.net
spotlight-tech-blog-sh28.net
spotlight-tech-blog-sh29.net
spotlight-tech-blog-sh210.net



All these domains were registered Jan 31, 2011
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby darius » Tue Feb 22, 2011 3:42 pm

More info on my idiot spammer
contact info same for all these spammed domains:
(plus the ones in the list above that haven't been spammed to me yet)

Dynamic Dolphin Privacy Protection
Domain Admin (privacyprotect@dynamicdolphin.com)
5023 W 120th Ave, #233
Broomfield
Colorado,80020
US
Tel. +1.7208723477


    ( without the ww or www in front all show a no ip message )

    www4.SpotlightSportsBlogSh29.net
    174.127.164.59

    ww7.Spotlight-Blog-Sh22.net
    174.127.166.156

    www9.Spotlight-Estate-Blog-Sh27.net
    174.127.164.163

    ww8.SpotlightBlogSh21.net
    174.127.166.122

    ww1.Spotlight-Tech-Blog-Sh29.net
    174.127.164.36

    ww8.Spotlight-Tech-Blog-Sh24.net
    174.127.166.222

    www7.SpotlightTechBlogSh23.net
    174.127.165.247

    www4.SpotlightSportsBlogSh24.net
    174.127.166.211

    www5.Spotlight-Sports-Blog-Sh22.net
    174.127.166.147

    www5.SpotlightEstateBlogSh26.net
    174.127.164.251



Some links off the spammed sites

www9.Spotlight-Estate-Blog-Sh27.net
http://www.lmlttrack.com/click.track?CI ... 71694&SID=
http://www.quibids.com/marketing/unsubscribe.php
http://go.rm0001.net/r.asp?l=161893&ee= ... 836,677595


www8.Spotlight-Tech-Blog-Sh28.net
http://www8.spotlight-tech-blog-sh28.ne ... wXOUD|9280


ww1.Spotlight-Tech-Blog-Sh29.net
http://ww1.spotlight-tech-blog-sh29.net ... wUZJT|9238


ww8.Spotlight-Tech-Blog-Sh24.net
http://ww8.spotlight-tech-blog-sh24.net ... YQIt3|9232


www7.SpotlightTechBlogSh23.net
http://www7.spotlighttechblogsh23.net/c ... +2DZu|9223
http://cwwapplication.net/index.php?Aff ... rID=151572


www4.SpotlightSportsBlogSh24.net
http://www4.spotlightsportsblogsh24.net ... Pnw55|9101


www5.Spotlight-Sports-Blog-Sh22.net
http://www5.spotlight-sports-blog-sh22. ... 4fG3S|9204


I think Dynamic Dolphin is connected to the spammer or is the spammer.

REAL privacy protection is more like this cwwapplication.net@protecteddomainservices.com
usually unique to the domain and can forward emails to the domain holder.

But in this case its privacyprotect@dynamicdolphin.com for all these domains.


SO anyone want to help get more attention here and get these scam sites shut down.

How do we get at Dynamic Dolphin. Icann doesn't seem to do much anymore . .
Wasn't there something about Scott Ritcher being connected to a parent company?
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Tue Feb 22, 2011 4:46 pm

darius wrote:Then the spammer uses urls like this
http://www5.spotlight-sports-blog-sh22. ... 4fG3S|9203

Code: Select all
Service Unavailable

:silthumb:

darius wrote:Here is a list of the imbeciles domains so far I have found:
( I tried a few variations on some of them to get the "directory listing denied" message which means their site is there, but won't show it without the exact url )

www4.spotlighttechblogsh22.net
www7.spotlighttechblogsh23.net
www4.spotlighttechblogsh24.net
www7.spotlighttechblogsh25.net

On a few of those I also get the Service Unavailable page. Maybe they're banning me. (I doubt it.) Others I also get the directory listing denied.

They key thing is what it links to. The page they link to are the ones providing payment processing and other services for this scam. I've reported these several times since last October and met with success. The payment processing companies don't like helping spammers. They do shut them out.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby AlphaCentauri » Tue Feb 22, 2011 9:45 pm

I would never have heard of Dynamic Dolphin if it weren't showing up on other people's lists of most spammy registrars. I just don't see them. And I have a Mailwasher filter to flag spams coming from ranges associated with Scott Richter. Whatever they do, they have done a competent job of removing my email addresses from their mailing lists and keeping them off. They must pay a lot of attention to spamcop reports.
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am

Re: Work at home spam?

Postby darius » Wed Feb 23, 2011 11:51 am

Thanks for the help!

This spammer only shows his pages if you come in from the proper url.
( probably in a pathetic attempt to slow us down and track whos reporting them. Since the only way to show the spammed site is to give the tracking url in the spam complaint. )


like this spammed url
www5.SpotlightEstateBlogSh26.net

spammed link
http://www5.spotlightestateblogsh26.net ... EEMyw|9326

where is goes
http://www.homeemploymentagency.net/?ut ... 92&noaff=1

where you can enter complete garbage and get a
"congratulation there are jobs in your area message"
on this page:
http://www.homeemploymentagency.net/index
( I must be really lucky! )



On The other hand . . .

Usually I wake up to 5 or 6 work at home @!#!@# spam. So far its quiet today.

Only 1 idiot russian "Ultimate Replica" spam.
Which I happily keep the contact form open and send "thank you" messages all day. lol

Just a thought, Do we have a form filler to auto fill and sent garbage back to them? lol
( sometimes i cut paste bodies from other spam and send it to them , lol :P )
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby spamislame » Wed Feb 23, 2011 3:58 pm

darius wrote:Just a thought, Do we have a form filler to auto fill and sent garbage back to them? lol
( sometimes i cut paste bodies from other spam and send it to them , lol :P )

I just tried a single bait order and (for a change) they actually use a secure server on that domain, and they validate in real time. So no. No fake orders work.

This is the first one of these I've seen that is hosted on a dedicated server, not using an affiliate's payment processor.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby spamislame » Thu Mar 10, 2011 12:19 pm

I thought I would share something interesting.

I received a spam (as usual, again) from yet another of these morons.

Spammed link:
http://bit.ly/esEVOG
Redirects to:
http://www.biz100news.com/
Links to:
http://www.biz100news.com/link1.php?
Redirects to:
http://www.biz100news.com/index.php

Take a look at the bottom of that page. You'll see a link that says "Members area". That leads to this url:

http://www.hcfsmembers.com/

Home Ca$h Flow Solution.

It has nothing but a login form for content, but you can see a "Contact Us" link that provides an inkling as to who to contact regarding this scam.

Email: support@ehomecashflowsolution.com
US Toll Free: 1-877-663-5057
USA/Canada: 1-877-778-8350
UK: 0-800-014-8175
Australia: 1-800-757-069

If you complain that you received spam from them, their only response will be that they have removed your email address from their lists. This is meaningless of course. No explanation as to why they continue to allow non-compliant spamming, why they feature zero security on their form, nothing.

Domain registered with Directnic, and (naturally) using bogus "Privacy protection" on the contact information. (Strike one)

Registered in October 2010.

Hosted on IP address 66.77.58.155, hosted by Trinity Data Services Inc / Qwest Communications.

Interesting to me at least. That domain I now consider to be a high priority target.

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby Benzyl » Thu Mar 10, 2011 1:39 pm

Used to be homecashflowsolution.com with the comeon being a disposable spammed fake newsletter page about jobs in your (IP based) area with all glowing reviews and links pointing to their traditional make-money-fast cr&p. Since I was getting so many of these redirectors in identical format I have a small note containing a reusable review specially for them.
Ruffian antics are a wrench in society's gears
User avatar
Benzyl
Spam Muncher
 
Posts: 889
Joined: Wed Jan 03, 2007 10:19 am
Location: North Britain

Re: Work at home spam?

Postby darius » Thu Mar 10, 2011 2:51 pm

I came up with much the same info

I sent a spam complaint to here :
support@ehomecashflowsolution.com

With this info:




and got a response from the other domain:
Support@homecashflowsolution.com


A customer support staff member has replied to your support request, #213777 with the following response:

Your email - ****@shaw.ca - has been added to our unsubscribe list, please allow up to 15 business days for it to take effect. I assure you this issue will be corrected in the near future. Sorry for the inconvenience!

Thanks,
Customer Support

We hope this response has sufficiently answered your questions.




I asked them why they made no effort to follow "can spam" rules.
( no opt out option, etc. )

Shockingly I got no answer.

Its obvious that
homecashflowsolution.com , ehomecashflowsolution.com and hcfsmembers.com
are connected.

This review does a good job of ripping them apart.
http://www.workathometruth.com/not-reco ... ution-com/
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby tacoma43 » Thu Mar 10, 2011 3:56 pm

Your email...has been added to our unsubscribe list, please allow up to 15 business days for it to take effect.



I wonder what's involved with the unsubscribe process that may require 15 business days (19 days including weekends) to complete. Are they still sending hand-written instructions by Pony Express? :shock:
User avatar
tacoma43
Spam Reporter
 
Posts: 248
Joined: Sun Aug 13, 2006 6:57 pm

Re: Work at home spam?

Postby darius » Tue Mar 15, 2011 11:25 am

Took a few days but my spammer is back
( and is STILL just plain stupid)

Spammed link
http://cobuhyqa.110mb.com/qovujyvu.html
( feel free to report this as spam here: http://www.110mb.com/pages/abuse-contact/ )

redirects to here
http://9moment-business-feeds.net/busin ... nance-news
(lets give them some spam complaints for 9moment-business-feeds.net
support@cnobin.com, abuse@bizcn.com, abuse@12321.cn )

Clicking this link:
http://9moment-business-feeds.net/busin ... ews/go.php

Calls these domains
http://dctracking.com
http://goto.eprofits.com

ending here
http://join.eprofits.com/sign/28/4/EPF/2/148655
( spam complaints here? http://www.enmode.com/contact.html )


Clicking through actually takes me to a secure processor:
https://ww1.securedatavalidation.com/in ... ntform.php? ( long list of your entries to get here)

( likely third party )

I think the spammer showed us his true intellect when he stated this in the spam:

"Profit form yuor dettrminaeion onlnie"
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

Re: Work at home spam?

Postby g7w » Tue Mar 15, 2011 11:22 pm

Code: Select all
securedatavalidation.com

whois references an email address for: prolastlimited.com
naturally prolastlimited.com doesn't load
looking at it via robtex in the shared hosts list, scrolling through all the pr0n domains we find... eprofits.com
WOT reference

Code: Select all
9moment-business-feeds.net

whois - Fishe Solutions
robtex
noogiltd.com = Dr. Pills pharma scam
Opto, ergo sum
User avatar
g7w
Spam Reporter
 
Posts: 136
Joined: Thu May 20, 2010 12:29 am

Re: Work at home spam?

Postby spamislame » Wed Mar 16, 2011 10:52 am

darius wrote:Spammed link
http://cobuhyqa.110mb.com/qovujyvu.html
( feel free to report this as spam here: http://www.110mb.com/pages/abuse-contact/ )

Code: Select all
Spammed link:
http://cobuhyqa.110mb.com/qovujyvu.html <- already shut down. Well done 110mb!
Redirect(ed) to:
http://9moment-business-feeds.net/business/2010-live70/finance-news
Links to:
http://9moment-business-feeds.net/business/2010-live70/finance-news/go.php
Redirect:
http://dctracking.com/click.track?CID=156410&AFID=148655&ADID=494080&SID=
Redirect:
http://goto.eprofits.com/aff_c?offer_id=2&aff_id=28&aff_sub=148655
Redirect:
http://join.eprofits.com/sign/28/4/EPF/2/148655

Affiliate program link at the bottom of the page:

http://www.enmode.com/

Their affiliate sign-up form has a check box that says you "agree to the terms", but features no link to any terms.

You should contact them about that:

http://www.enmode.com/contact.html

SiL
User avatar
spamislame
Site Admin
 
Posts: 5057
Joined: Tue May 09, 2006 9:18 am

Re: Work at home spam?

Postby darius » Wed Mar 16, 2011 5:32 pm

Thanks SIL!

Today spam didn't have the usual work at home spam garbage.

It had subject "Verdict"
and this link:
spheretest.co.uk/ verdict
DON"T go there unless you are well protected.
MAssive amount of malware, viruses, hijacks, trojans.

I run 3 separate types of protection and i had windows popping up like crazy blocking stuff.

Summary of Infection attempts
Memory Processes: 2
Memory Modules : 0
Registry Keys : 0
Registry Values: 4
Registry Data Items: 3
Folders: 0
Files : 4


Attemted to infect Memory Processes here:
c:\documents and settings\hidden-name\application data\dwm.exe (Trojan.Downloader)
c:\documents and settings\hidden-name\application data\microsoft\conhost.exe (Trojan.Agent)


Attemted to infect Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy)


Attemted to infect Registry Data Items:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Bad: (C:\DOCUME~1\BRE~1\LOCALS~1\Temp\csrss.exe)
HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S)
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1")


Attemted to infect these Files:
c:\Documents and Settings\hidden-name\Local Settings\Temp\csrss.exe (Trojan.Agent)
c:\documents and settings\hidden-name\application data\dwm.exe (Trojan.Downloader)
c:\documents and settings\hidden-name\application data\microsoft\conhost.exe (Trojan.Agent)
c:\RECYCLER\s-1-5-21-436374069-682003330-77748071-1003\Dc88.exe (Trojan.Agent)


So I talked to tech suport where the site is hosted and they said this:

"Hi,

Thanks for the information, we have taken some steps to sanitise the website, and notified the owner of the problem. "



Not quite the "we shot the spammer" response I was hoping for. lol But they did take steps to stop the malware.

My guess is the spammer is getting grouchy about us "dogging" his activities.
MY response? ROFLMAO!!!!!
darius
Spam Investigator
 
Posts: 297
Joined: Wed Oct 11, 2006 10:52 am

PreviousNext

Return to Fight Spammers

Who is online

Users browsing this forum: No registered users and 1 guest

cron