B2BL: B2B spam

We added a few more B2B spam domains to our SpamAssassin rules: targetleadz.com and emaildataweb.com to the regular Sloan Mktng domain list, and nseasy.com to their spam server list.

emaildataweb.com is a similar name to one of their other domains, itdataweb.com.

None of these spam domains has a web site on it.

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(emaildataweb|targetleadz|mercurydesk|businessinvites|invitebusinesses|initiateventure|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|comails|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|newsproexpress|acquiredatanetworking|\besource|emaildatadivision|paper2green|worldwidemailaccess|atcontactworld|(crunch|thegreen|ez)marketers)\.(com|biz|net|us)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth)mailer|dataserver|eserver2|authsender|hostkey53|dns342|webhostingnoida|srteck|stechblr|hosthat|mail-zap|mailhostbox|nseasy)\.(com|net|info)/i
score B2BL_SL_SRV 20

We see a lot of spam from what Spamhaus calls the Sloan Marketing/Data Champions group. They pretty much reuse the same spams over and over, but they change the sender names and domains names frequently.

The domains used as return addresses, and the spam servers used to send them, are often perfectly generic names: eserver2.com, dns342.com, authsender.com, worldwidemailaccess.com, and so on. Even Spamhaus gets fooled and doesn’t list most of this spam cartel’s servers and domain names.

We wrote a couple of SpamAssassin rules to block this B2B spam family from our servers since current black lists aren’t covering much of it.

describe B2BL_SL B2B Email addresses for sale (SL)
full B2BL_SL /(mercurydesk|businessinvites|invitebusinesses|initiateventure|prospect(advert|unlimited)|e(globesearch|mailslist)|specificroi|comails|mails([i1]|eone)|globalitsearch|itdataweb|stillvisitmedium|(eddy|auth)mailer|webinarsrule|newsproexpress|acquiredatanetworking|\besource|emaildatadivision|paper2green|worldwidemailaccess|atcontactworld|(crunch|thegreen|ez)marketers)\.(com|biz|net|us)/i
score B2BL_SL 20

describe B2BL_SL_SRV Domain touches/sends B2B spam (SL)
full B2BL_SL_SRV /((eddy|auth)mailer|dataserver|eserver2|authsender|hostkey53|dns342|webhostingnoida|srteck|stechblr|hosthat|mail-zap|mailhostbox)\.(com|net|info)/i
score B2BL_SL_SRV 20

New B2B list-selling domain spotted today: mercurydesk.com.

Associated spam mailing servers noted are from hosthat.com and mailhostbox.com.