B2BL: B2B spam

We see a lot of B2B spam coming from IPs on the Comcast business network that never seem to get blacklisted (comcastbusiness.net: 173.166.91.134 and nearby IPs). The spam subject lines read like:

• 2011 Expert’s Guide to ERP Implementations
• Expert’s Report on ERP Success
• 2011’s Top Hosted CRM Systems
• 2011’s CRM Leaders Evaluated for You
• Top Hosted CRM Systems Evaluated
• 2011 ERP Evaluation Guide
• 2011 VoIP Evaluation Guide

These spams typically have a link to systemssoftwareevaluations.com or rainmaker-partners.com and resemble some spam we’ve seen from emarketer.com, although we’re told it’s probably not related.

The sender addresses used in these spams is usually a throwaway domain instead of the client’s real domain name; for example:

• erpaffiliates.com
• erpevaluations.com
• phonesystemevaluations.com
• inside-erp.com
• sherpaerp.com
• crmaffiliates.com

The senders don’t seem to notice or care that all the mail they send to our network gets sent back to them, day after day. Presumably, they get paid to send it, and it doesn’t matter where it ends up!

We also block most of the 216.24.225.* IP range, another group of throwaway email domains.

Xlhost.com occasionally hosts B2B spam domains owned by the Data Champions/Sloan Marketing, including a new block of 5 IP addresses located at 209.190.75.45 through 209.190.75.49.

The recently registered junk domains that currently use these IP addresses are corporatenext.com [209.190.75.45]), nexgen-connect.com [209.190.75.46], and green-2011.com [209.190.75.47/48/49]. None of these throwaway domains has a web site.

This batch of spam starts out with:

“My name is Claire Joseph (or Jacklin Alison, or Leona James) and I am the Director of Market Research at B2BSpecific Consultants. I am very interested in knowing if you have considered at B2BSpecific Consultants as one of your choices for your online and digital marketing in the year 2011.”

Funny how they have three people claiming to be “Director of Market Research at B2BSpecific Consultants,” with all three using different domain names. (Of course, these people don’t really exist at all…)

A hew other spam domains we’ve been seeing recently from these spammers are:

• mailsdata.net: “Randy Williams” [randyw@mailsdata.net], sent from their dns939.biz spam server [174.141.225.85]
• futureleads.net: michelle.clooney@futureleads.net, also sent from their dns939.biz spam server [174.141.225.85]
• catriona.harris@globalitsearch.com, shirley.williams@itlistsearch.com and jessica.parker@eglobesearch.com, sent from their serverny.com spam server [174.141.226.71]
• carol.parker@interestedcontacts.com (with a spamvertized link to 74.52.20.82) sent from a Yahoo server at [203.104.17.250]
• leadlist.us: “Amanda Taylor” <amanda@leadslist.us>, sent from their tech-leads.com spam server (forestroof.info [190.120.229.108])
• mailsi.biz: amelia.roberts@mailsi.biz, sent from their infomediaserver.com [174.141.226.158])
• wiemails.us (steve.adams@wiemails.us)

The Data Champions Sloan Marketing scam/spam gang have predicatably added a few new domains to their long list and continue using some of their older ones. The larger black lists don’t seem to care much about their domains and spam servers, so they only occasionally get blacklisted.

We’ve seen spam this week from many of the fake person names that they use, such as:

• “bruce.wilson@acquiredatanetworking.com,” sent from their serverny.com [174.141.226.71] spam server
• “alice.cooper@authmailer.com,” sent from their email-movers.com [208.43.46.188] spam server
• They use this name a lot: “erica.slowik@authmailer.com,” sent from their pr-movers.com spam server (rgb-consultants.com [68.67.82.88])
• “monicam@emailingonline.com,” sent from their infomediaserver.com [174.141.226.158] spam server
• “lauren.james@mailsi.biz,” sent from their serverny.com [174.141.226.71] spam server
• “Admin” (noreply@listbroker777.info), sent from their investorsatisfaction.info spam server
• “nancy.brown@aboutwebinars.com” (Specific Lists), sent from a yahoo.com server [203.104.17.250]
• “tina.white@globalitsearch.com,” sent from their serverny.com [174.141.226.71] spam server
• “johnny.kelly@wincon-solutions.com,” sent from wincon-solutions.com [184.154.133.26]
• “sales@iqubemailer.com,” sent from their as29550.net [213.229.110.9] spam server
• “dougg@usacorpdata.com,” sent from their pureserver.info (russellgrantastrology.com [82.165.36.226]) spam server
• “cliff@mailszone.com,” sent from their dns939.biz spam server [174.141.225.85]
• “ashley.brown@itlistsearch.com” (aka (contactunsub.com and prospectadvert.com), sent from their infomediaserver.com spam server [174.141.226.158]
• “ricky.n@way2append.net,” sent from their dotnetsql.com [67.228.183.222] spam server
• “mable.paul@hourlyacquiredleads.com,” linking to their http://89.187.154.93/~bizcon/ dummy web site
• “John Lindsey” (marketingpdf@qmail.com / ekingmarketer.com), sent from their extremeonlinebiz.com [96.9.135.197] spam server
• “shirley.williams@itlistsearch.com,” sent from their serverny.com [174.141.226.71]) spam server

These days, several of the scam and spam mailing domains used by Data Champions/Sloan Marketing for selling email B2B addresses are hosted at bodhost.com on the 174.141.225.* and 174.141.226.* IP ranges. For example:

• csemail.net [174.141.225.61] (spam from “linda.brown@360appending.com” and “jessica.parker@eglobesearch.com“)
• dns939.biz [174.141.225.85] (spam from “michelle.clooney@futureleads.net” and “gary.subaiah@futureleads.net“)
• serverny.com [174.141.226.71] (spam from “lauren.james@mailsi.biz“, “shirley.williams@itlistsearch.com“, “leah.leno@strategy-solutions.biz” and “bruce.wilson@acquiredatanetworking.com“)
• infomediaserver.com [174.141.226.158] (spam from “monicam@emailingonline.com“, “nancy.barnhart@thebizmarketers.com“)

csemail.net, dns939.biz, serverny.com and infomediaserver.com are all empty domains with no web sites, and they seem to exist only for the purpose of sending B2B spam (at least, we’ve never seen any legitimate mail come from there).

Other names and spam servers currently in use by the Data Champions B2B spammers include:

• hostcats.com / market2profit.com ([68.67.68.40] (spam from “joe.brant@m2pdata.us“)
• t001s.com / mails2b.com [68.67.82.118] (spam from “flora.thomas@authmailer.com“)
• rgb-consultants.com [68.67.82.88], aka pr-movers.com (spam from “erica.slowik@authmailer.com“)
• yahoo.com [98.139.53.204] (spam from “cassandra.walters@sellingint.net“)
• sambizsolution.info / foxwebhosting.biz [173.193.80.53], on softlayer.com (spam from “Tony.white@aboutwebinars.com“)
• sambizsolution.info / baxterop.info [178.33.213.252] (spam from “dan.lopez@paper2green.com“)
• wincon-solutions.com [184.154.133.26] (spam from “dave.daniels@winconsolutions.com” and “ron.thomas@winconsolutions.com“
• superiorns.info / ackermanequities.com / dataserver.com [200.35.147.101] (spam from “cathy@elead.biz“)
• yahoo.com [203.104.19.12] (spam from “meredith.smith@anytitlecontact.com“)
• email-movers.com [208.43.46.188] (spam from “alice.cooper@authmailer.com“)
• aemsolutionsinc.com [209.160.32.49] (spam from “Mark Cooper” [ekingmarketer.com])
• authsender.com [209.190.75.29] (spam from “jasmine.ruiz@authmailer.com” and “irma.joseph@authmailer.com“)

These junk mail domains use innocuous names that are carefully chosen to sound serious, and not like spam domains. Domains like these sound like legitimate businesses, but they are unfortunately associated with the Data Champions group selling email addresses: rgb-consultants.com, aemsolutionsinc.com, foxwebhosting.biz, baxterop.info, ackermanequities.com and dataserver.com.

Some recent B2B spam from the Data Champions/Sloan Marketing spam group is hosted at softlayer.com and bodhost.com. Data Champions group uses a seemingly endless number of throwaway domains and spam servers to deliver their spam which peddles email addresses.

Spam hosting at softlayer.com includes a new Data Champions’ spam-server domain which they’ve named foxwebhosting.biz (sounds like a real company, doesn’t it?). It has sent spam from 173.193.80.57 and 173.193.80.61 on softlayer.com, using return addresses like tony.white@aboutwebinars.com, nancy.brown@aboutwebinars.com, and melissa.hyde@paper2green.com. The spams may contain links to http://173.193.80.48/ (sambizsolution.info), which is another recently registered spam domain hosted at softlayer.com.

Sometimes, email from so-called “Melissa Hyde” is signed as “Marketing Manager, Paper2Green, Inc,” (paper2green.com or initiateventure.mfbiz.com) but some email from “her” is signed as “Online Marketing Manager at Specific Lists.” Two different New York City drop addresses and phone numbers are used.

Spam hosting at bodhost.com and nearby IP data ranges includes a number of Data Champions’ spam servers, such as:

• mail365mx.com [174.141.225.60] also known as csemail.com
• dns939.biz [174.141.225.85], also known as futuristicinc.org
• serverny.com [174.141.226.71]
• serveridream.com [174.141.226.243]
• teraboard.com [174.141.227.20]

If you receive an email with a “Permission Pass” subject line, it’s usually just a request that you permit the sender to spam you. So, do you want spam?

Likewise, any mail coming into your system that’s labeled, “Powered by Interspire,” “Requesting A Quick Conference Call,” or “Meeting Request,” is most likely spam, from our experience.

You may receive one of these “Permission Pass Requests” from the Data Champions/Sloan Marketing spam group, who are forever selling email addresses from an endless number of ever-changing email addresses. How shifty. Their spam is usually discreetly mailed from mail servers so unknown that they rarely get blacklisted.

And you just might receive one of these “Permission Pass” spams from a so-called john.gardner@mails2b.com (who most likely doesn’t exist), mailed from Data Champions’ authsender.com spam server [209.190.75.29]. The mails2b.com spam domain has been around for quite a while. The spam claims that, “You are receiving this email because you are listed as a professional interested in keeping up with information related to your industry and profession,” etc., etc.

Other Data Champions spam addresses and spam-mailing servers we’ve noticed lately include:

• claudias@futuristicinc.org sent from their new dns939.biz [174.141.225.85] spam server
• sarah.johnson@hourlyacquiredleads.com sent from smtp103.biz.mail.in2.yahoo.com (aka Data-Cleansed .Inc)
• kristi.turner@globalitsearch.com and viktoriya.shaw@globalitsearch.com, sent from their csemail.net spam server (mail365mx.com [174.141.225.60])
• linda@leadstime.com (“Linda Williams”), mailed from their superiorns.info spam server (ackermanequities.com [200.35.147.103])
• greg.jones@infinityintellectual-mail.com, sent from their theplanet.com spam server [174.122.143.175]
• gary.jones@infy-source.com and james.reid@infy-source.com, sent from the bridgemailsystem.com B2B spam system [66.206.172.134]
• stephen.jones@performancelists.com, sent from kundenserver.de [212.227.126.186]
• jimk@datafinder.us (“Jim Keenan”); we’ve seen previous mails from “Kevin Williams” and “Steve Burns” at this same supposed company, whose domain was just registered a few months ago. The spams all contain the same phone number in Georgia, even though their web site claims they are in Delaware.
• ralph.miller@databuilder.biz (related to jimk@datafinder.us above?), mailed from their new marketviaemail.net [174.141.87.150] spam server (which coincidentally lives in the same block as their csemail.net spam server)
• jennifer.mason@targetedemaillists.net, linking to their fortify-initiatives.com spam domain, and mailed from a new spam server of theirs called called serverny.com [174.141.226.71] (which also lives on the same block as databuilder.biz)
• stan.ritter@m2pdata.us and dave.dorman@m2pdata.us (market2profit.com), sent from their hostcats.com spam server [68.67.68.40] (“My name is Stan Ritter and I handle the pre-packaged Email List division at Market2Profit.com“)

They sure do like inventing simple names for their return addresses, like Greg Jones, Gary Jones and Stephen Jones, who must surely all be related.

The India-based “Data Champions/Sloan Marketing” spam/scam group uses an endless number of fabricated identities and domain names when selling their lists of email addresses and names.

It’s worth noting that these domains only occasionally get blacklisted by the more mainstream blacklists.

New and recent B2B spam/scam emails noted from them include:

• melanie.armstrong@anytitlecontact.net (links to
  cindy.woods@aboutwebinar.com, initiateventure.mfbiz.com), sent from their netgamehost.com spam server hosted on xlhost.com [173.45.64.130]
• dave.daniels@wincon-solutions (dave.daniels@winconsolutions.com), sent from theplanet.com [74.53.98.234], where many of their spam domains are hosted
• laura@leads-caliber.com (leadscaliber@gmail.com)
• from their csemail.net [174.141.225.60] spam server were sent spams signed by andrea.smith@eglobesearch.com, nancy.miller@globalitsearch.com, and jessica.parker@eglobesearch.com
• in addition to jessica.parker above, you may see spam from a related jennifer.parker@b2binfolist.com, sent from their gohsphere.com [66.232.25.28] spam server
• claudias@futuristicinc.org, hosted at 174.141.225.85
• david.jacob@usdatatrust.biz [64.120.199.231] sent spam signed with a bogus New York City mailing address: 11th St, Suite 4121, New York, NY 11435
• since these spammers like bland English names like “Jones,” you may have received spams of theirs signed stephen.jones@performancelists.com (mailed from kundenserver.de [212.227.126.186]) or gary.jones@infy-source.com (sent from the bridgemailsystem.com spamming system)
• their authsender.com [209.190.75.29] and authmailer.com spam domains continue to be seen frequently, such as in spam from a so-called erica.slowik@authmailer.com (postmaster@email-movers.com)
• also sent from the authsender.com spam server is spam signed by john.gardner@mails2b.com, stating that “You are receiving this email because you are listed as a professional interested in keeping up with information related to your industry and profession.” (the mails2b.com domain has been around for quite a while)
• spam from their new datumemail.com domain (aka datum-solutions.com) comes signed by “James Clayton” james@datumemail.com, sent from their hostcats.com [68.67.68.40] spam domain (datumemail.com was registered last month in India, despite the phone number in Delaware on their web site)
• also mailed from their hostcats.com spam server is B2B spam signed dave.dorman@m2pdata.us (market2profit.com)
• spam from jim@eanalyticsworld.com was sent from their ajaxsourcing.com (intersoftech.com [174.142.175.217]) spam server
• noreply@listbroker777.info sent spam from their investorsatisfaction.info spam server at 195.162.69.70
• kathleen@datalists.net sent spam from their superiorns.info spam server (ackermanequities.com [200.35.147.102])
• spam from leadfunl.com was sent using the simplycast.com mailing system

Is this enough spam for you?

New and recent B2B spam selling email address lists from the “Data Champions/Sloan Marketing” spam/scam group:

• Spam from their India-based serveridream.com spam server [174.141.226.243], labeled as coming from fake people like jessica.parker@eglobesearch.com, nancy.miller@globalitsearch.com, or bruce.wilson@acquiredatanetworking.com (this “Bruce” has been around for a while!)
• Spam from “Kevin” (kevin@online-prospect.com), sent from the India-based public email service rediffmailpro.com
• From their new netgamehost.com spam domain, hosted at xlhost.com ([173.45.64.129]), a so-called june.carroll@anytitlecontact.net sent spam
• The anytitlecontact.net domain appears also in spam from a so-called meredith.smith@anytitlecontact.com (stechblr.com), sent from a Yahoo! business server [203.104.17.250]
• New spam domain: laura@leads-caliber.com
• The authmailer.com domain continues to be one of the most common of their B2B spamming domains, with spam from jean.miller@authmailer.com, louise.andrew@authmailer.com, and nichole.anderson@authmailer.com (postmaster@email-movers.com) being sent from their mails2b.com [68.67.82.118] and authsender.com [209.190.75.29] spam servers

All these nicely chosen person names that point to the same places: Laura, Kevin, Bruce Wilson, Jean Miller, Nancy Miller (are these “Millers” related? LOL)… Check out this excellent article about the Data Champions group, appropriately entitled, “Welcome to the Murky World of E-mail List Sales.”

For some reason, many of these B2B sending domains and servers never end up on the mainstream blacklists. It may be that B2B spam is taken less seriously by the bigger blacklists since there is so much less of it, volume-wise, compared to, say, Viagra spam. On the other hand, B2B spam often looks semi-legitimate, so it becomes more of a time-waster than easily dismissed Viagra spam when it ends up in people’s mailboxes.

Then again, who could ever blacklist a domain as serious-sounding as authmailer.com, or authsender.com?

A few subject lines from recent Data Champions B2B email spam, some which you might recognize:

• IBM Users Database – 2010
• New Technology Focus in 2011
• Emails List – Few Samples Work
• November 2010 email list updates for …
• Technology Email Lists and Email Appending
• Prospect Business Data
• Email Marketing Leads
• B2B/B2C Professionals Lists 2011
• Email Updating Services
• Decision Makers list with Email-id’s

New and recent B2B spam sightings from the “Data Champions/Sloan Marketing” spam group:

• Spam from a so-called david@intersoftech.com, sent from their ajaxsourcing.com spam server (intersoftech.com [174.142.175.217])
• Spam from a so-called cindy.woods@aboutwebinar.com (initiateventure.mfbiz.com) sent from their visionharvest.info spam server at 216.104.40.162
• Spam from m2pdata.us (Market2profit.com) has been mailed from hostcats.com [68.67.68.40]
• Their marketingdrivendata.com spam domain continues to sputter spam occasionally
• thebizmarketers.com has been sending spam via from the Data Champions teraboard.com [174.141.227.20] spam server
• The ezmarketers.net domain has appeared in spams signed by a eva.murphy@ezmarketers.net (sent from the teraboard.com spam server [174.141.227.20]) and jeff.novak@ezmarketers.net (sent from another Data Champions spam server hosted at spammer-friendly theplanet.com [174.122.20.61])

Their authmailer.com spam domain continues to be one of the most commonly used spam domains used by the Data Champions group these days. Spam has been going out signed by “Melinda Joseph” at authmailer.com (they like inventing names using the “Joseph” surname), sent from their t001s.com [74.82.166.3] spam server.

We’ve also added emarketerszone.com and imarketers.info to our internal list of Data Champions spam domains.