B2BL: B2B spam

Here are new-to-us, recently registered B2B spam domains owned by the India-based “Data Champions/Sloan Marketing” spam-and-scam group: leadstime.com and thebizmarketers.com.

Other spam senders (fake names) and active spam servers from this spam group include:

• thebizmarketers.com, sent from their teraboard.com [174.141.227.20] spam server
• eva.carter@bmailsonline.com, sent from their texserver13.net spam server (theplanet.com [174.122.20.61])
• jessica.parker@eglobesearch.com and nancy.miller@globalitsearch.com, sent from their appdns3host.com spam server (theplanet.com [174.122.13.20]) (as you can see, theplanet.com multiple spam servers for this spam operation)
• tena.clark@valuedata.biz, sent from their superiorns.info spam server (ackermanequities.com [200.35.147.102])
• shannon@technetauto.com, sent from their hosthat.com spam server
• nichole.anderson@authmailer.com and jean.miller@authmailer.com, sent from their eddymailer.com (xlhost.com [209.190.75.9]) spam server
• louise.andrew@authmailer.com, sent from their mails2b.com [68.67.82.118] spam server
• jennifer.roberts@p-dmails.com, sent from their teraboard.com [174.141.227.20] spam server

They really like this name “Jennifer Roberts.” The last time this so-called “Jennifer Roberts” was noted here, it mailed from two different spam servers: interactiveone.net [174.122.13.18] and texasserver.net [64.120.173.210].

The spammers / scammers at Data Champions / Sloan Marketing have so many domains that they occasionally get them mixed up in their spam. For example, the return address might point to a different domain, or a different person. Perhaps the spam is signed by “Eva Murphy,” but the mail link would send to “Rosie Smith” instead. Of course, none of these people likely exist anyway….

Several of their domains this week all point to the same handwriting: data-cleansed.com, aboutwebinars.com, advertisingfolks.net, initiateventure.mfbiz.com and hourlyacquiredleads.com. Spam claiming to be from these domains was mailed from their hostingmonster.in spam server (hosted at vrtservers.net, 64.56.67.130).

Amongst their spam domains, we’ve recently seen both advertising-data.com, advertisingfolks.net, and marketingdrivendata.com [216.38.27.39].

Other Data Champions spam domains noted include:

• proemails.biz, sent from their texserver13.net spam server (on theplanet.com: 174.122.20.61)
• technetauto.com spam was sent from their hosthat.com [67.228.226.102] spam server
• authmailer.com and authsender.com spams have been sent from mail-zap.com [208.43.46.188] and mails2b.com [68.67.82.118]
• yes, even yahoo.com spams too… (biz.mail.in2.yahoo.com has sent spam on behalf of jennya@driveinleads.com).
• their teraboard.com [174.141.227.20] spam server has been sending spam signed by jesse.rivera@pdteam.net, Eva.Murphy@ezmarketers.net and others

Your B2B spam selling email addresses this week might include spam from one of these Data Champions / Sloan Marketing B2B spam domains:

• authenticlistsonline.com (aka authenticlists.net and authenticlists.com), sent from a brand-new anonymous spam server domain called newcustomised.com [74.117.58.143]
• data-cleansed.com (a brand-new anonymous domain hosted in India on a brand-new anonymous spam-server domain called hostingmonster.in [64.56.67.141])
• b2blistsource.com [216.65.69.219]
• mygreenmarketers.com mailed from the texserver13.net (174.122.20.61) spam server
• ed.sanford@wiemails.info (ed.sanford@web-intellectuals.com) via hostcats.com spam hosting
• acquiredatanetworking.com, sent from a new anonymous spam server called appdns3host.com (hosted at spammer-friendly theplanet.com [174.122.13.20])
• authmailer.com or authsender.com, sent from their eserver2.com (gdcglobal.com [208.93.150.55]) spam server

Get your B2B spam here!

eglobesearch.com is still sending B2B spam from the mdl220.com spam domain, while authmailer.com and authsender.com are using the mails2b.com [68.67.82.118] domain to send their spam.

Other recent B2B spam sightings here related to the Data Champions / Sloan Marketing group includes:

• emailanalytics.info, sent from a new spam server called gosafehome.com (hosted by spammer-friendly theplanet.com)
• appendleads.net via spam server superiorns.info (ackermanequities.com [200.35.147.102])
• globalitsearch.com
• sourceleads.net, sent from the teraboard.com spam domain
• scientistdata.info and scidata.info spam, sent from iqubemailer.com and iqubeindia.com spam domains
• bmailsonline.com via the serveridream.com spam domain (also known as idreambiz.com)
• anytitlecontact.com (brand-new domain just registered), also known as initiateventure.mfbiz.com (initiateventure.biz)
• technetauto.com spam (brand-new domain just registered) via hosthat.com spam server [67.228.226.102]

Additional spams have come from the maxprodata.com (maxpdata.com) and infy-source.com domains, which seem to be different names and contact addresses for the same email addresses that you can buy. They mail their spams from the bridgemailsystem.com domain.

Two new Data Champions spam domains presented to us are datalists.net and seo-groop.com. As usual, these fake companies don’t have a web site and were just registered recently.

Spam from datalists.net and elead.biz was sent out from Data Champions’ superiorns.info (ackermanequities.com) spam servers. Spam from seo-groop.com is being sent from a spammy server called hosthat.com [67.228.226.102], which they’ve used regularly for their spamming in the recent past.

More spam domains on our “recent” list include eglobesearch.com (sent from texserver13.net and mdl220.com spam servers), usdatatrust.biz, usleadzone.com, and krystallistonline.com–sent from bluehost.com. Bluehost.com hasn’t traditionally been a source of spam, but that looks to be changing.

After updating our SpamAssassin B2B rule sets covering Data Champions/Sloan Marketing spam, they look something like this:

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(seo-groop|alliedconsumerservices|pdteam|saynopapers|outgrow(leads|business)|360appending|mdl220|(healthcare|ready|source|tech|append|market)[0-9-]?(leads|profit)|data(manager|finder)|winn?consolutions?|(infinity|web)-intellectual|jaguarsus|emaillean|leadspackage|intersoftech|e(mail)?(lead|source)(lead|source)?s?|(infoe|wie|edg|iba|co|send4|p-d|pro|datum|express)-?mails?|trackmye|us(datatrust|leadzone)|futuristicinc|fortify-initiatives|krystallistonline|crystalcommunicationinc|newsproexpress|(targeted)?(b2b|email|marketingdriven|value|m2p|data)(data|lists?|analytics)(group|planet|web|division|source)?|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|roi(emails|marketingcenter)|mails([i1]|eone)|globalitsearch|(e|it)dataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|aboutwebinars|acquire(datanetworking|leads)|paper2green|worldwidemailaccess|erpusers|atcontactworld|(crunch|(the|my)green|ez|uslist|tailored|jade)-?(market(ers)?|firms))\.(com|biz|net|us|org)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth|iba)mailer|beetalhosting|serveridream|idreambiz|teraboard|ackermanequities|glazingm|salespass|superiorns|interactiveone|\b(tex(as)?|data|e)server[0-9]{0,3}|junipertechconsulting|authsender|host(key53|hat|server045)|dns342|webhosting(cloud|noida)|greenwebhost|srteck|stechblr|mail-zap|mailhostbox|hostforweb|mailbox29|nseasy)\.(com|net|info|biz|us|in)/i
score B2BL_SL_SRV 20

The domain names for these three new Data Champions B2B spam servers were just registered a couple of days ago, and they’ve already begun to appear in spam.

For now, glazingm.com is 96.9.170.220, teraboard.com is 174.141.227.20, and mdl220.com is 66.96.207.224 .

Domain names market2profit.com and m2pdata.us are appearing in the return addresses in some of their latest spam.

Domains just registered! To go with the jade-marketers.com and fortify-initiatives.com spam, a new spam server name has also been invented, called beetalhosting.com . Almost sounds like a real company, doesn’t it. Almost.

Many of the “Data Champions” spam domains originate from special spam servers with names intended to sound like legitmate hosting companies, like beetalhosting.com, if you don’t look any closer. For example: authmailer.com, dataserver.com, eserver2.com, mails2b.com, dns342.com, greenwebhost.in, texserver13.net, superiorns.info, interactiveone.net, hostforweb.net, etc, etc, etc…

Anyone wanna buy some email addresses from a spammer?

We’re always running across more of these B2B spam and scam domains selling email lists and “contact data,” all presumably part of the same India-based group known as “Data Champions/Sloan Marketing” on the Spamhaus web site. Some of these throwaway domains have just been registered during the last few weeks and don’t even have a web site of any kind. They’re hoping that you’ll never notice.

Some of their current spam domains: valuedata.biz, marketingdrivendata.com, pdteam.net, outgrowbusiness.com, aboutwebinars.com, saynopapers.net, usdatatrust.biz, usleadzone.com, proemails.biz, wiemails.info, datummails.com, edataweb.biz, authmailer.net, emailleadsources.net (and .us), acquiredatanetworking.com, acquireleads.us, futuristicinc.org, elead.biz, globalitsearch.com, infoemail.biz, datafinder.us, mailsi.biz

Some of their current spam server domains: dns342.com, mails2b.com, texserver13.net, hostforweb.net, salespass.net, serveridream.com, superiorns.info, njtech.com, hostcats.com, hostingmonster.in, greenwebhost.in, dataserver.com, interactiveone.net

Of course, there are always more!

Sample spam introduction: “Hello, My name is Rebecca Lee, representing one of the largest business data owners in the US.” Bla bla bla.

This week we note the appearance of two new B2B spam servers in use by the Sloan Marketing/Data Champions B2B spam group: greenwebhost.in and junipertechconsulting.com. Both domains were just registered during the past few days, and neither domain has a web site.

New domains being used by these spammers for return addresses are outgrowleads.com (via junipertechconsulting.com), outgrowbusiness.com (via greenwebhost.in), techleads.net (via serveridream.com), and sourceleads.net (via interactiveone.net).

Spam from this group also continues to be seen from their more established domains, such authmailer.com, authsender.com, mail-zap.com, and others.

Last week, “Jennifer Roberts” sent us spam selling email addresses from a throwaway domain called p-dmails.com. It was sent from a spam server called interactiveone.net [174.122.13.18].

Well, today “Jennifer” has been moved around a bit. This time, her new spam comes from a healthcare-leads.com address, and was mailed from a different spam server too: texasserver.net [64.120.173.210]. This spam still begins with, “This is Jennifer with Technology Database and Marketing Company.”

Of course, there probably is no “Jennifer Roberts:” all this spam purportedly comes from one source: the Data Champions/Sloan Marketing group in India. See the Spamhaus web site for more information on Data Champions.

Our SpamAssassin rules for blocking Data Champions spam now look something like these:

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(360appending|(healthcare|ready)[4-]leads|datamanager|winn?consolutions?|(infinity|web)-intellectual|jaguarsus|emaillean|leadspackage|intersoftech|e(lead|source)|(infoe|edg|iba|co|infoe|send4|p-d)mails?|trackmye|usdatatrust|futuristicinc|krystallistonline|crystalcommunicationinc|express-mails|newsproexpress|(b2b|email)(data|lists?)(group|planet|web|division|source)|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|roi(emails|marketingcenter)|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|acquiredatanetworking|paper2green|worldwidemailaccess|erpusers|atcontactworld|(crunch|(the|my)green|ez|uslist|tailored)(market(ers)?|firms))\.(com|biz|net|us|org)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth|iba)mailer|serveridream|idreambiz|salespass|superiorns|interactiveone|(tex(as)?|data|e)server2?|authsender|host(key53|hat|server045)|dns342|webhosting(cloud|noida)|srteck|stechblr|mail-zap|mailhostbox|mailbox29|nseasy)\.(com|net|info|biz|us)/i
score B2BL_SL_SRV 20