B2BL: B2B spam

A new domain just registered and in use for B2B spam by the Data Champions spam group is edata-source.com. Spam claims to be from a “Shawn Fischer” (shawnf@edata-source.com) and the subject line may be “C level Contacts update.”

Shawn’s spam may also contain a link to a web bug hosted at infobizmails.com, another recently registered Data Champions spam domain.

Another new Data Champions spam domain is clublistsonline.com, which sends mail from a so-called “Fiona Steel” (fionas@clublistsonline.com) from their 101server.com [174.141.227.188] spam server hosted at bodhost.com.

Some B2B spam selling email addresses we’ve been seeing lately, most of which is from the Data Champions/Sloan Marketing India-based spam network, using an endless number of fake senders and domain names:

• “Kevin Dennis” <Kevin@eharvestmedia.com> sent spam from a name.com server hosted at softlayer.com [174.37.49.137]
• Spam sent from their 101server.com anonymous spam server at bodhost.com [174.141.227.188] was signed “Gloria Adams” (gloria.adams@mailsi.biz), “Rosanne Yvette” (rosanne.yvette@leadsregister.com), and Ivona Bruni” (Ivona.Bruni@ezmarketers.net)
• Spam sent from their ajaxsourcing.com (intersoftech.com [174.142.175.217]) anonymous spam server was signed “Eric Anderson” (eric@eanalyticsworld.com) and “Glenn Morrison” (glennm@intersoftech.com) … this server also hosts their mercurydesk.com and seo-groop.com spam domains
• “aboutwebinar.com” spam with a newsletter@visionharvest.com return-path was sent from their anonymous zinglebellhosting.com spam servers in the 178.33.77.72 neighborhood, signed with names like “Leanne Browning” (leanne.browning@businessprocesses.us), “Tony White” (Tony.white@aboutwebinars.com) and “Nathan Wilson” (wilson.nathan10@gmail.com), with embedded links to numeric addresses like http://94.23.214.67 and http://178.33.77.65, and showing a New York City mail drop at 100 Church Street, 7th Floor, as their address
• Similar “aboutwebinar.com” spam with a newsletter@simplyperfect.com return-path was sent from their data-cleansed.com/simplyperfect.com [188.165.116.137] spam server, signed by a so-called “Tara Ryan” (tara.ryan@clonebusinesses.com), with embedded links to http://91.121.10.133, also showing a New York City mail drop at 100 Church Street, 7th Floor, as their address
• Spam signed “Leslie Morris” (leslie.morris@corporatenext.com) and “Darcy Baker” (darcy.baker@corporatenext.com) selling email addresses was sent from their anonymous corporatenext.com [173.248.142.93] spam server
• Spam signed “Mary Kent” (mkent@techleads.net) and “Melissa Carter” (melissa.carter@mailsid.com) selling email addresses was sent from their anonymous mailexserver.com [174.141.224.234] spam server at bodhost.com
• Spam signed “Bernard Mcvey” (bernard.mcvey@dbchannels.info) selling email addresses was sent from their anonymous hostedmailsend.com [174.141.226.241] spam server at bodhost.com
• Spam signed “Tina Andrews” <Tina.andrews@edatasource.us> selling email addresses was sent from their anonymous netx9.com [174.141.226.232] spam server at bodhost.com
• From the wiemails.us/wiemails.info domain were spams signed “Peter Hood” (peter.hood@wiemails.us), “Ed Sanford” (ed.sanford@wiemails.us, ed.sanford@wiemails.info, or ed.sanford@web-intellectuals.com), “Richard Mendel” (richard.mendel@m2pdata.us), “Michael Harris” ,
  “Bill Burton” (bill.burton@infinity-intellectual-email.com), and “Greg Jones” (greg.jones@infinityintellectual-mail.com), mostly mailed from a server on lstn.net (208.115.230.114)

So, which spammer do you want to buy your email lists from?

Here’s a sampling of this week’s junk B2B spam selling email addresses from the Data Champions/Sloan Marketing B2B spam group based in India, and similar groups:

• “Jacob Jones” jacob.jones@winconsolutiions.net (jacob.jones@winconsolutions.com) sent spam from wincon-solutions.com [184.154.133.26]
• From their mailexserver.com spam server [174.141.224.234], spam sent was signed by “T Jones” (tjones@techleads.net) [yes, another “Jones”] and “Audrey Parker” (audreyp@mailsdata.net)
• From their hostedmailsend.com spam server [174.141.226.241], spam sent was signed by “Terri Lee” (terri.lee@eventinfopark.com), linda.brown@360appending.com, bernard.mcvey@dbchannels.info, and nancy.miller@globalitsearch.com (remember “her” from a while back?)
• Spam signed by Alecia Davis (alecia.davis@green-2011.com), some with a Return-Path header of Postmaster@leads-in-Millions.com, was sent from their rgb-consultants.com spam server [66.240.176.169] and from green-2011.com [209.190.75.48] (“B2BSpecific Consultants”)
• From their zinglebellhosting.com spam servers at 178.33.213.242, 178.33.213.245 and 178.33.213.250, spam sent was signed by angeline.sweeney@mappingtitles.com and leanne.browning@businessprocesses.us, with links to a spam web site at http://94.23.214.67 (X-Envelope-From: newsletter@visionharvest.com)
• From a Yahoo! mail server in India at [203.104.19.13] and their netx9.com spam server [174.141.226.232] was sent B2B spam signed lee.hubbard@roitree.net and “Mark Brown” (mark.brown@roiemails.com) respectively — this spam group has used many “ROI”-based domain names in the past, such as roitree.net, prospectsroi.com, specificroi.com, roimarketingcenter.com
• johns@qsmail.com (signed “Amy Roberts”!) sent spam from their extremeonlinebiz.com [96.9.135.197] spam server, with links to ekingmarketer.com

The B2B spam starts out by apologizing, “I hope you don’t mind the direct contact, however, I have an offer I thought might be of interest to you.”

Some of the mailing and spamvertized domains that have used this format, several of which are hosted in the 74.3.162.* block in Canada, apparently get added to black lists like the URIBL from time to time.

We’ve seen this apology in B2B signed by:

• infymailing.com (mailed from tp-mediacom.com [74.3.162.246] or quickguns123.com [74.3.162.242])
• infy-source.com (sent via bridgemailsystem.com [66.206.172.132])
• maxprodata.net / maxpdata.com (mailed from infmail.net, mailinginfy.com, inthewayofmoney.com [74.3.162.240] or beinghorses.com [74.3.162.238])
• wearbluebase.com (links to sarahchadyes.com, bluebs.net, inthewayofmoney.com, sales-performer.com, sheela-yes.com, harrrybarry1.com; sent from harrybarry1.com [74.3.162.239] or database-media.com)

Some of the domains used to send these spams have no web site, just an unsubscribe message like, “To unsubscribe from espgau2 newsletter, please enter your email address below and click unsubscribe.”

New B2B spam from Data Champions / Sloan Marketing selling email lists:

From their mailexserver.com [174.141.224.234] spam server, hosted at bodhost.com, outgoing spam has been signed with return addresses like:

• "Randy Williams": randyw@mailsdata.net
• "Brad Smith": brads@esource.biz
• "Mary Kent": mkent@techleads.net

From their hostedmailsend.com [174.141.226.241] spam server, also hosted at bodhost.com, outgoing spam has been signed with return addresses like:

• "Linda Brown": linda.brown@360appending.com (note that older “linda.brown@360appending.com” spam was sent from now-silent spam servers called csemail.net [174.141.225.61] and interactiveone.net [174.122.13.18])
• "Bernard Mcvey": bernard.mcvey@dbchannels.info
• "Terri Lee": terri.lee@eventinfopark.com

From their new anonymous buffspiral.info [190.120.229.106] spam server (cool name!!!), hosted at the4net.com, some outgoing spam has been signed by:

• "Amanda Taylor": amanda@leadslist.us (older “Amanda Taylor” spam was sent from their forestroof.info spam server, also hosted conveniently nearby on the4net.com [190.120.229.108])

A new anonymous spam server being used by the Data Champions for sending out B2B spam selling email addresses is called supportdemand.com, hosted at psychz.net cheap web hosting [173.224.215.172].

You may have received spam from this supportdemand.com server signed by a “”Scott Jones” (scottj@aulistsonline.com, scottj@authenticlistsonline.com or scottj@theauthenticlists.com) at “Authentic Lists.”

On the Spamhaus web site is an example of Data Champions spam with a similar Scott Jones signature from 2009.

Other Data Champions spam sightings include:

• linda.brown@360appending.com is sending her spam from their anonymous hostedmailsend.com [174.141.226.241] spam server, hosted at bodhost.com
• katie.duncan@prosalesmail.com is sending her spam from a third-party enterprisemailer.net server [216.13.249.149]
• Christine.Saylor@prospectsroi.com is sending her spam from their anonymous baxterop.info [178.33.213.244] spam server, with links to a spam site at http://94.23.214.67/~visionh/
• kimberl.burt@aboutwebinars.com is sending her spam from their yellowribbonhosting.com [74.222.11.178] spam server (name may be forged), with links to a spam site at http://74.222.11.162/~excell/
• "Ryan Carlton" is sending his spam from their anonymous mailexserver.com [174.141.224.234] spam server, hosted at bodhost.com
• Sean.Richardson@dataseller.net is sending his spam from their anonymous netx9.com [174.141.226.232] spam server, hosted at bodhost.com

mailexserver.com is one of the latest anonymous spam-server domains to send spam for the Data Champions / Sloan Marketing B2B spam group. Registered just a couple of weeks ago, and having no web site, mailexserver.com is hosted at 174.141.224.234, on the bodhost.com network.

Some of the Data Champions spam servers hosted at bodhost.com include:

• mailexserver.com [174.141.224.234] (spam signed mkent@techleads.net and daphne.ray@bmailsonline.com)
• dns939.biz [174.141.225.85]
• serverny.com [174.141.226.71] (spam signed cynthia.wong@sourceleads.net, with prospectadvert.com MSG-ID)
• infomediaserver.com [174.141.226.158]
• netx9.com [174.141.226.232] (spam signed “Jade Hudson” <Jade.Hudson@mygreenmarketers.com>)
• hostedmailsend.com [174.141.226.241] (spam signed linda.brown@360appending.com, bernard.mcvey@dbchannels.info, terri.lee@eventinfopark.com and emily.murphy@eventinfopark.com)
• 101server.com [174.141.227.188] (spam signed ronny.parker@ready4leads.net and bruce.wilson@acquiredatanetworking.com)
• intersoftech.com [174.142.175.217], aka ajaxsourcing.com (spam signed shannon@seo-groop.com, shannon@eanalyticsworld.com or “David Williams” [david@eanalyticsworld.com, david@mercurydesk.com, david@technetauto.com, or david@intersoftech.com])

Other recent Data Champions spam has been signed by names and addresses such as the following:

• james.clayton@datumemail.com and ed.sanford@wiemails.us, sent from their wiemails.us spam server [208.115.230.114]
• nora.joseph@green-2011.com, sent from green-2011.com [209.190.75.49]
• marcella.lindsey@businessprocesses.us and kathleen.brown@acquiredbusinesses.com via (smtp104.biz.mail.in2.yahoo.com [203.104.19.13])
• dscott@optinb2bleads.com, sent from smtp102.biz.mail.in2.yahoo.com [203.104.17.250]
• greta.slowik@nexgen-connect.com via nexgen-connect.com [209.190.75.46]
• miller_s@krystallistonline.com via bluehost.com [69.89.21.11]
• Christine.Saylor@prospectsroi.com, carol.parker@interestedcontacts.com <newsletter@visionharvest.com>, and “Melissa Hyde” <melissa.hyde@paper2green.com>, sent from their baxterop.info ([178.33.213.250]) spam server (links to http://94.23.214.67/~visionh)

optinb2bleads.com, registered last year, isn’t the first Data Champions / Sloan Marketing domain to send out its spam via the Yahoo! India server at 203.104.17.250.

Other related Data Champions spam addresses sending spam through this Yahoo! India server include: carol.parker@interestedcontacts.com, nancy.brown@aboutwebinars.com (Specific Lists), colette.price@aboutwebinars.com, and meredith.smith@anytitlecontact.com (stechblr.com).

A few new spam domains from the Data Champions / Sloan Marketing spam group caught our attention during recent days: eventinfopark.com, getprospect.info, ematsol.com and mailematsol.com.

ematsol.com and mailematsol.com, spamming from a secureserver.net server at 182.50.132.194, use a Houston, Texas mailing address, just like a December 2009 spam reported on the Spamhaus web site. At that time, they were using an ematrixsolutions.com domain name instead of this year’s ematsol.com and mailematsol.com domains.

Spam text of this year’s spam:

Subj: XXXX, Opportunity to obtain new clients

Hi XXXXX,

As you are a part of the management team, you are always looking for opportunities to obtain new clients. Your field of operation is very competitive and a quality database would always give an edge over your competitors as well as help increase revenue.

With over 30 million B to B records, we specialize in data appending, database enhancement and customize business lists for email marketing, surveys, newsletters and telemarketing. Our customized email lists of decision makers and influencers can play a key role to market your product and services.

Our emails lists come with a written 95 % + deliverability guarantee which is one of the highest in our space of business.

Kindly let me know your target criteria (designations, industry sector etc) and I will be glad to send you a sample file for review.

Best regards,
Daniel Clark
Business Development Officer
________________________________________________________________
Ematrix Solutions
Suite 2065 , 14781 Memorial Drive, Houston , TX 77079
Email: daniel.clark@mailematsol.com
Web: www.ematsol.com

“This e-mail message may contain confidential, proprietary or legally privileged information. It should not be used by anyone who is not the original intended recipient. If you have erroneously received this message, please delete it immediately and notify the sender.”

getprospect.info is one of many spam domains this group has used which contain the word “prospect.” A few others are: online-prospect.com, prospectadvert.com, prospectunlimited.com, emailprospectsonline.com.

A couple of new spam-server domains in use by the Data Champions/Sloan Marketing B2B spam group are hosted at bodhost.com: 101server.com [174.141.227.188], hostedmailsend.com [174.141.226.241]. Bodhost.com has a history of supporting this B2B spam group who sells email addresses using many, many domain names.

To go with these new spam servers, a new front-end domain name was registered for spamming a few days ago: eventinfopark.com.

These new spam domains don’t have a web site, their domain registration is anonymous, and all we’ve seen from them so far is a trickle of spam. Bodhost.com probably hosts some legitimate domains in addition to spammers, but we haven’t checked.

The 101server.com [174.141.227.188] domain name is part of a lineage of Data Champions spam servers domains that include the word “server.” Others include serverny.com, serveridreambiz, dataserver.com, eserver2.com, infomediaserver.com, texserver13.net, etc.

Likewise, their new hostedmailsend.com [174.141.226.241] spam domain is part of a list of junk domains containing the word “host,” to make them sound like legitimate hosting services. For example, netgamehost.com, foxwebhosting.com, greenwebhost.in, beetalhosting.com, appdns3host.com, hostforweb.net, hostserver045, webhostingcloud.us, mailhostbox.com are all spam server domains under their control.

The SpamAssassin rule that we use below covers most of our blocking needs with regards to Data Champions spam servers:

describe B2BL_SL_SRV Domain touches/sends Data Champions B2B spam
full B2BL_SL_SRV /((eddy|auth|iba|iqube)(mailer|india|sender)|hostedmailsend|aemsolutionsinc|serverny|baxterop|sambizsolution|extremeonlinebiz|marketviaemail|gohsphere|investorsatisfaction|visionharvest|t001s|newcustomised|gosafehome|(netgame|beetal|appdns3|((fox|green)web))host(ing)?|\b(server)?idream(biz|cloud)?|teraboard|ackermanequities|glazingm|salespass|superiorns|interactiveone|\b(tex(as)?|data|e|101|infomedia)server[0-9]{0,3}|junipertechconsulting|(mail)?host(box|forweb|key53|hat|server045)|\bdns[a-z]{2,3}|webhosting(cloud|noida)|srteck|stechblr|mail-zap|mailbox29|mail365mx|nseasy)\.(com|net|info|biz|us|org|in)/i
score B2BL_SL_SRV 20