TWSD: Run, hide and obfuscate

Spammers and spamming companies have elevated obfuscating their corporate identities to an artform. Some of the more dedicated, but just this side of legal, spammers set up 3 or 4 different front companies: one to sell advertising, one or more to actually send mail, one to get connectivity and one as a backup for when the first three fail. Because they use rotating domain names and IP addresses all hidden behind fake names or “privacy protection services”, the actual spammer can be impossible to track without court documents.
One example of this is Ken Magill’s ongoing series of reports about EmailAppenders.
Aug 5, 2008 Ouch: A List-Purchase Nighmare
Sept 9, 2008 Umm… About EmailAppenders’ NYC Office
Sept 15, 2008 E-mail Appending Plot Thickens
Nov 11, 2008 EmailAppenders Hawking Bogus List, Claims Publisher
Dec 23, 2008 Internet Retailer Sues EmailAppenders
Feb 1, 2009 EmailAppenders Update
Mar 10, 2009 Another Bogus E-mail List Claimed
April 14, 2009 EmailAppenders a Court No-Show, Says Internet Retailer
April 21, 2009 EmailAppenders Gone? New Firm Surfaces
May 5, 2009 EmailAppenders Back with New Web Site, New Name
Their actions, chronicled in his posts, are exactly what I see list providers, list brokers and “affiliate marketers” do every day. They hide, they lie, they cheat and they obfuscate. When someone finally decides to sue, they dissolve one company and start another. Every new article demonstrates what spammers do in order to stay one step ahead of their victims.
While Ken has chronicled one example of this, there are dozens of similar scammers. Many of them don’t have a persistent reporter documenting all the company changes, so normal due diligence searches fail to turn up any of the truth. Companies looking for affiliates or list sources often fall victim to scammers and spammers, and suffer delivery and reputation problems as a result.
Companies that insist on using list sellers, lead generation companies and affilates must protect themselves from these sorts of scammers. Due diligence can be a challenge, because of the many names, domains and businesses these companies hide behind. Those tasked with investigating affiliates, address sources or or mailing partners can use some of the same investigative techniques Ken did to identify potential problems.

  1. Whois records. Any company should have valid contact information in whois. Business addresses should never be hidden behind “privacy protection services.” Free email addresses and low cost DNS providers are also a warning sign.
  2. Phone numbers. Phone numbers can be a bit trickier to change than domain names or IP addresses, so look up phone numbers of potential partners. Make sure you check what’s on the callerID as well as any call back numbers.
  3. Website inconsistencies. Referring to multiple company names on the website can be a sign of hasty changes to move from one identity to another. Also look for recently registered domains, a company that claims to have been on the Internet for years, but has only a 3 month history on that domain is probably hiding something. Yes, domains change and rebrandings happen but often that will be documented somewhere on the website.
  4. Website incompleteness. “Coming soon” links should always raise a red flag. One of the most famous example of this is McColo’s “website coming soon” which was up for years with no actual content.

Probably the most important investigative technique, though, signing up for the list. This will let you see how much mail the recipients get, what kind of mail is being sent, the source IPs and what domains are used in the email. You can also evaluate if the other companies using this vendor are the type of companies you want to be associated with. When doing this, use unique addresses so you can clearly track what happens to that address. Do you get mail you expected? Is it a clean subscription process? All of this data is invaluable in deciding if this is a vendor you should be associated with.
Spammers lie is a maxim among some anti-spammers. They also run, hide and obfuscate, making it hard to tell the legitimate from the illegitimate.

Related Posts

TWSD: Lying and Hiding

Another installment in my ongoing series: That’s What Spammers Do. In today’s installment we take a look at a company deceiving recipients and hiding their real identity.
One of my disposable addresses has been getting heavily spammed from mylife.com. The subject lines are not just deceptive, they are provably lies. The mail is coming from random domains like urlprotect.com or choosefrequency.com or winnernotice.com advertising links at safetyurl.com or childsafeblogging.com or usakidprotect.com.
The spam all claims someone is “searching for…” at their website. The only thing is, the email address is associated with a fake name I gave while testing a website on behalf of a client. I know what website received the data and I know what other data was provided during the signup process. I also know that the privacy policy at the time said that my data would not be shared and that only the company I gave the information to would be sending me email.
Just more proof that privacy policies aren’t worth the paper they’re written on. But that’s not my real issue here.
The real issue is that I am receiving mail that is clearly deceptive. The subject lines of the emails up until yesterday were “(1) New Message – Someone Searching for You, Find Out…” Yesterday, I actually clicked through one of the messages to confirm that the emails were ending up at mylife.com. After that, the subject lines of the emails changed to “(1) New Person is Searching for You.”  I don’t know for sure that my click has caused the change in subject lines, but the timing seems a bit coincidental.
It’s not that someone, somewhere gave mylife.com bad data, or that someone typed a name into the mylife.com search engine and the mylife.com database showed that name and my email address were the same. Neither this name or this email address show up in a google search and I can say with certainty that this is a unique address and name combination given to a specific website. Therefore, the subject lines are clearly and demonstrably lies.
The spams are also coming from different domains and advertising links in different domains. The content is identical, the CAN SPAM addresses are identical. While the court may not rule this is deceptive under the rules of CAN SPAM, it certainly is an attempt to avoid domain level spam filters.
Who are mylife.com? Well, their website and the CAN SPAM address on their spam claims they are the company formerly known as reunion.com. I’ve talked about reunion.com here before. They have a history of harvesting addresses from users address books. They were sued for deceptive email practices under California law, but won the case just recently. They seem to think that the court case was permission to send deceptive email and have thus ramped up their deceptive practices.
If you are a legitimate email marketer, there are a couple take home messages here.
1) Spammers send mail with different domains, from different IP addresses, that contain identical content, landing pages and CAN SPAM addresses. Legitimate marketers should not rotate content and sends through different domains or different IP addresses. Pick your domain, pick your IP and stick with it.
1a) Spammers use randomly chosen domain names and cycle through domains frequently. Legitimate marketers must not use unrelated domains in marketing. Use a domain name that relates to your product, your industry or you.
2) Spammers send mail with deceptive subject lines. Legitimate marketers should make sure their subject lines are clear and truthful.
3) Spammers send mail in violation of the privacy policy under which information was collected. Legitimate marketers should be very careful to handle data in accordance with their privacy policies.
That’s what spammers do. Is that what you do?

Read More

e360 sues a vendor

As if suing themselves out of business by going after Comcast and Spamhaus weren’t enough, e360 is now suing Choicepoint for breach of contract and CAN SPAM violations. As usual, Mickey has all the documents (complaint and answer) up at SpamSuite.
This may actually be an interesting case. On the surface it is a contractual dispute. Choicepoint sold e360 40,000,000 data records containing contact information including email addresses, snail mail addresses and phone numbers. Some of the records were marked “I” meaning they could be used for email. Some of the records were marked “O” meaning they could not be used for email.
Despite these terms being reasonably well defined in the contract, e360 sent email to addresses in records marked “O.” Some of those addresses resulted in e360 being sued by recipients. During the course of the suit, e360 contacted Choicepoint and asked for indemnification. Choicepoint refused for a number of reasons, including the fact that Choicepoint told e360 the addresses were not for mailing. In response, e360 filed suit.
The interesting and relevant part of this case is the CAN SPAM violation that e360 alleges.

Read More

Organizing the mail flow

I get a lot of email. On a typical day I will get close to 2000 messages across my various work and personal accounts. About 60 – 70% of that mail is spam and caught by spamassassin or my mta filters and moved into mailboxes that I check once a day for false positives. About 15 – 10% of the remaining mail is from various discussion lists, and those are all sorted into their own mailboxes so I can keep conversations straight. The rest of the email is divided between mail directly to me and various commercial lists I have opted in to.
Up until recently, the commercial mail was all just dumped into my inbox. Nothing special happened to it it just sat there until I could read it. Recently, however, the volume of commercial mail has exploded, swamping my inbox. After losing track of some critical issues, I sat down and fixed my mail filters. Now, all my commercial and marketing mail (ie, mail I signed up for with tagged addresses) is now being filtered into its own mailbox.
There are two takeaways here.
One: the volume of commercial mail has increased significantly. Companies who were previously mailing me once a month are now mailing me twice a week. This contributed to the clutter and resulted in me pushing all commercial mail out of my inbox. I don’t think this increase is limited to just my mailbox, I believe many recipients are seeing an increase in commercial and marketing email, to the point where they’re finding it difficult to keep up with it all.
Two: Recipients have a threshold over which too much email makes their mailbox less usable. Once this threshold is reached they will take steps to change that. In my case, I can just filter all the commercial email as I use tagged addresses for all my signups. In other cases, they may start unsubscribing from all the mail cluttering their mailbox or blocking senders.
It is the tragedy of the commons demonstrated on a small scale.

Read More