Many B2B spams selling email lists, signed by multiple fake identities and company names in use by scam groups such as the India-based Data Champions, are mailed from servers hosted on the softlayer.com network.
The IP addresses of these servers is constantly changing, in the hope that nobody ever notices, and to help keep these servers (and the softlayer.com network) from getting blacklisted.
For example, the Data Champions’ anonymous spam server inforelaymedia.com is hosted on softlayer.com at 174.36.164.137. Perhaps you’ve received spam from that server selling email addresses, signed by one of these bogus identities from non-existent companies [note that entries 2-4 have very similar phone numbers]:
- Rachel Fox (
rachel.fox@streamdatabase.com). Signed “Sr. Business Development Executive (no company name), 713-481-7746 x4303 - Tim Russell (
tim.russell@Datamanager.us). Signed “Account Manager, 678-713-5813, EDG Inc., 340 S. Cleveland Ave, Bldg 370, Westerville, OH 43081.” - Sandra Tanner (
sandra.tanner@globalemaillist.com). Signed “Sandra Tanner, ED Group. 678-713-5806.” They’ve also sent spam with this signature from their expurgatemail.com [208.77.97.13] spam server - Fiona Gibson (
fionag@verified-contacts.com). Signed “Assistant to Ian Smith, 678-713-5811.”
A number of domains hosted in the 174.132.220.* IP range on softlayer.com / theplanet.com have been Data Champions or similar rotating B2B scam domains recently. For example:
technoslit.com/ 174.132.220.134 (sending spam signed stacy.odell@zycietech.com [Stacy Odell], shirley.kendrick@zycoetech.com [Shirley Kendrick], lois.martin@elettermails.com [Lois Martin],
grace.white@ziptypoemails.com [Grace White], grace.white@ermarket.com [Grace White], betty.thomas@mascoemails.com [Betty Thomas], joyce.regan@doxemail.com [Joyce Regan], lorraine.greg@pearlslit.com [Lorraine Greg])inforelaymedia.com/ 174.132.220.189 (sending spam signed snider.hellen@gmail.com [Helen Snidar], Ross.woods.us@gmail.com [Ross Woods])itech2b.com/ 174.132.220.184 / 174.132.220.192 (sending spam signed diane.hill@organicsemail.com, postmaster@pearlxpet.com, postmaster@itech2b.com )edigitalriver.com/ 174.132.220.196 (sending spam signed andy.avery@interestedcontacts.com )email-runner.com/ 174.132.220.210 / 174.132.220.211 (sending spam signed alex.moddox@gmail.com, mercy.jones@organicsemail.com)hikebiketexas.com/ 174.132.220.212 / 174.132.220.218 (Doesn’t sound like a B2B spam domain, does it? Obviously a recycled domain name… Sending spam signed bill.nelsonq@gmail.com [Bill Nelson], lisathomas87@rocketmail.com [Lisa Thomas], rachel.lax.us@gmail.com [Rachel Lax]), rosemary.zeitoun@gmail.com [Rosemary Zeitoun], robsonwalton.p@gmail.com [Robson Walton .P], amy.altig.us@gmail.com [Amy Altig]sohostu.com/ 174.132.220.241 (sending spam signed nancy.smith@worldwidemailinfo.com [Nancy Smith], alma.jones@globalarrange.com [Alma Jones], teresaj@globalclients.biz [Teresa])mailcontrol4.com/ 174.132.223.218 (sending spam signed sandra.king@bizonlinepoint.com [Sandra King], alma.jones@globalarrange.com [Alma Jones], patricia.thomson@infodmail.com [Patricia Thomson], elsie.davis@globalarrange.com [Elsie Davis], nancy.smith@worldwidemailinfo.com [Nancy Smith])exchangemails.net/ 174.132.223.226 (sending spam signed rachel.smith@p-dmails.com [Rachel Smith])
Of course, you’ll find those same signature addresses above in spams selling email lists sent from their other spam servers too–not just the servers mentioned here.