B2BL: B2B spam

The past few days, most of our spam from Data Champions (Sloan Marketing) selling email addresses has come from a spam server called interactiveone.net at 174.122.13.18. Much of it has been spam using globalitsearch.com or emaildatadivision.com “from” addresses. Some spams claim that “I met you at XYZ trade show” and now it’s time to sell you lists of email addresses.

Some of their spam has come from spam servers called mailhostbox.com (70.87.28.142) and texasserver.net (64.120.173.210), including spam from a so-called “Jennifer Roberts” at p-dmails.com. “Jennifer” begins her spam by saying, “This is Jennifer with Technology Database and Marketing Company.”

360appending.com is a new spam domain of theirs, registered just last month. It doesn’t have a web site yet, probably never will, but it is now beginning to appear in their B2B spam.

Of course, authmailer.com is still sending out spam, and some of it now even claims that “we tried to call you.”

Some of today’s fresh B2B spam from the Sloan Marketing/Data Champions group is from ready4leads.net and datamanager.us, both mailed from their dns342.com spamming server. Of course, ready4leads.net and datamanager.us are just dummy domains, and don’t have web sites.

Also of note is their spam from tailoredfirms.com, mailed from a spamming server called salespass.net, hosted on the midphase.com network. Just a few days ago, they were using a similar domain name for some of their spam: tailoredmarket.com.

None of these spam domains and servers seem to be listed on the major black lists.

It was interesting to see marketo.com mentioned on the blog at spamresource.com. We haven’t discussed marketo.com yet, but we do block everything from them. We’ve never seen anything come from them that wasn’t B2B spam, so there’s no reason for us to accept mail from them.

So who’s selling email addresses today? The same people as usual! (and using ever-changing names and domain names, as always).

The “Sloan Marketing/Data Champions” group just sent us spam using return addresses from mailsi.biz, intersoftech.com, and infinity-intellectual.com.

One of them was sent from a new spam server: texserver13.net (we had seen their texasserver.net spam server before). texserver13.net was just registered two weeks ago and doesn’t have a web site. It doesn’t need one since it’s just a spam server.

Of course, we get more B2B spam than just these offers of lists of email addresses from India. We’ll probably talk about those other B2B spams here one day soon…

We’ve updated our SpamAssassin rules that we use for this B2B spam

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(winn?consolutions?|(infinity|web)-intellectual|jaguarsus|emaillean|leadspackage|intersoftech|e(lead|source)|(infoe|edg|iba|co|infoe|send4|p-d)mails?|trackmye|usdatatrust|futuristicinc|krystallistonline|crystalcommunicationinc|express-mails|newsproexpress|(b2b|email)(data|lists?)(group|planet|web|division|source)|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|roi(emails|marketingcenter)|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|acquiredatanetworking|paper2green|worldwidemailaccess|erpusers|atcontactworld|(crunch|(the|my)green|ez|uslist|tailored)market(ers)?)\.(com|biz|net|us|org)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth|iba)mailer|serveridream|idreambiz|salespass|superiorns|interactiveone|(tex(as)?|data|e)server2?|authsender|host(key53|hat|server045)|dns342|webhosting(cloud|noida)|srteck|stechblr|mail-zap|mailhostbox|mailbox29|nseasy)\.(com|net|info|biz|us)/i
score B2BL_SL_SRV 20

Fresh B2B spam selling email addresses today came from Sloan Marketing domains uslistmarketers.com, tailoredmarket.com, and b2blistsource.com (and also from other domains previously mentioned here). These people go through a lot of spam domains!

Some of their spam gets mailed from their personal spam servers, like serveridream.com and webhostingcloud.us/.info, hosted on networks like midphase.com, softlayer.com and theplanet.com. We’ve blocked theplanet.com and idreambiz.com from our servers for a long time and may end up adding midphase.com and softlayer.com also.

Then there’s the just-registered anonymous salespass.net spam server domain… Another bland name to add to our blocking list.

The probably-fake names in the “from” field of their emails are typically as bland as the throwaway domain names they choose! Eldora Smith, Cathy Smith, Andrea Smith, Barbara Smith, Nancy Miller, Samantha Miller, Anne Simpson, Bruce Wilson, Marilyn Joseph, Arline Joseph, Mark Anthony, Nancy Brown, David Williams, Carol Slater, Tara Thomas.

eglobesearch.com, erpusers.net, p-dmails.com, emaildatagroup.net, emaillistsplanet.com

Spam from these domains selling email addresses was mailed from webhostingnoida.info and dns342.com. These spam servers somehow haven’t found their way onto most blacklists yet.

Every week finds new B2B spam domains selling email-address lists, all connected to India’s Sloan Marketing group.

We’ve added a few new domains to our in-house B2B spam lists. You may have already received spam from one of these junk domains, like we have: leadspackage.com, edgmails.com, ibamails.com, elead.biz, intersoftech.com, jaguarsus.com

We also block their domains which send out this B2B spam. New ones on our list are ibamailer.com, interactiveone.net, superiorns.info, mailbox29.com, and webhostingcloud.us (we previously noted webhostingcloud.info)

The lists really are growing. Below are the two SpamAssassin rulesets that we’re using to block this B2B spam, with the latest updates:

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(winn?consolutions?|jaguarsus|leadspackage|intersoftech|e(lead|source)|(edg|iba|co|infoe|send4)mails?|trackmye|usdatatrust|futuristicinc|krystallistonline|crystalcommunicationinc|express-mails|newsproexpress|emaildata(web|division)|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|roi(emails|marketingcenter)|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|acquiredatanetworking|paper2green|worldwidemailaccess|atcontactworld|(crunch|(the|my)green|ez)marketers)\.(com|biz|net|us|org)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth|iba)mailer|serveridream|superiorns|interactiveone|(texas|data|e)server2?|authsender|host(key53|hat)|dns342|webhosting(cloud|noida)|srteck|stechblr|mail-zap|mailhostbox|mailbox29|nseasy)\.(com|net|info|biz|us)/i
score B2BL_SL_SRV 20

Today’s B2B spam from the Sloan Marketing/Data Champions group brings a few new domains that we had to add to the SpamAssassin blocking lists that we use.

B2B spam mail domains include jaguarsus.com, edgmails.com, mailbox29.com, elead.biz, anosales.net.

We also added superiorns.info to our list of spam servers, while noting the reappearance of the webhostingnoida.info server in today’s B2B spam.

It’s interesting that the list of Sloan Marketing spam servers maintained by SpamHaus has none of the domains that we’ve reported here. Likewise, we’ve not seen most of the spam domains that appear on their current list.

B2B spam selling lists of email addresses continue to flow in. The Sloan Marketing spam group is dressed up in its usual various scattered domain names, using throwaway domains this week like: usdatatrust.biz, esource.biz, ezmarketers.net, atcontactworld.com, globalitsearch.com, database-media.com, stillvisitmedium.com, businessinvites.com, webinarsrule.com, and more.

trackmye.com is a spammer management login page that we don’t see all that often.

We thought that perhaps winconsolutions.com had been retired, but we saw it again this week, including two spelling variations on the domain name: winnconsolution.com and winconsolution.net.

Their spam is being sent from the usual servers, such as dns342.com, webhostingcloud.biz, mailhostbox.com, authmailer.com. These domain names are so bland-sounding that they escape notice and rarely get blacklisted.

We updated our SpamAssassin rules today for this group of B2B spam, as follows:

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(winn?consolutions?|send4mail|trackmye|usdatatrust|futuristicinc|krystallistonline|crystalcommunicationinc|express-mails|newsproexpress|emaildata(web|division)|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|roi(emails|marketingcenter)|(co|infoe)mails?|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|acquiredatanetworking|\besource|paper2green|worldwidemailaccess|atcontactworld|(crunch|(the|my)green|ez)marketers)\.(com|biz|net|us|org)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth)mailer|serveridream|webhostingcloud|texasserver|dataserver|eserver2|authsender|hostkey53|dns342|webhostingnoida|srteck|stechblr|hosthat|mail-zap|mailhostbox|nseasy)\.(com|net|info|biz)/i
score B2BL_SL_SRV 20

Three more B2B spam domains from the Sloan Marketing family: futuristicinc.org, roiemails.com, roimarketingcenter.com.

Two more spam server domains get added: serveridream.com, texasserver.net.

B2B spam continues to flow in from the spammers selling email lists. This week we’ve added a few more B2B spam domains to the Sloan Marketing list that we use: krystallistonline.com, crystalcommunicationinc.com, infoemail.biz, express-mails.com, database-media.com, mygreenmarketers.com (we had already listed thegreenmarketers.com).

We also added one domain to our list of servers used to send out their B2B spam: webhostingcloud.biz.

Often, the domains used in these spams don’t have a web site, and when they do, there’s often no contact information. These most likely aren’t real companies, and it has been speculated that all these domains eventually lead back to one place.

So we again updated the SpamAssassin rules that we use on our filters:

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(krystallistonline|crystalcommunicationinc|express-mails|newsproexpress|emaildata(web|division)|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|database-media|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|(co|infoe)mails?|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|acquiredatanetworking|\besource|paper2green|worldwidemailaccess|atcontactworld|(crunch|(the|my)green|ez)marketers)\.(com|biz|net|us)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth)mailer|webhostingcloud|dataserver|eserver2|authsender|hostkey53|dns342|webhostingnoida|srteck|stechblr|hosthat|mail-zap|mailhostbox|nseasy)\.(com|net|info|biz)/i
score B2BL_SL_SRV 20