Tuesday, February 10, 2009

Valentine's Day Spam Countdown: T-4

Valentine's Day is only four days away, which means its time for the Valentine's Day Spam CountDown! If you haven't decided what to give your special loved one yet for Valentine's Day, the spammers have plenty of suggestions.

On day T-4, here's what we're seeing for Valentine's Day at the UAB Spam Data Mine.




Number One - Our most popular Valentine's Day spam is using a spam template to randomize a subject line consisting of a salutation followed by a term for Valentine's Day. So, subjects look like these:

aloha! Valentine's Day
Ave Valentine's Day
Hallo Valentine's Day
Halloa Valentine's Day
halloa! Valentine's Day
hello old chap Valentine's Day
hey old boy! Valentine's Day
Hey! Valentine's Day
hey! Valentine's Day
hi Valentine's Day
Regards Valentine's Day
Salute Valentine's Day
Yaga Valentine's Day
Yo man! Valentine's Day
Yo! Valentine's Day

We also have copies of all the same "salutations" where "Valentine's Day" has been replaced with "The day of Love", with "02/14", with "14 Feb" and with "February 14" "14 Hearts" and "Februray month of Love" (yes FebRUray). We've received the complete collection of every salutation with every term, which I'm sure makes you jealous that the spammers like us more than you.

To complete the randomization, the spammer then includes a suggestion of why we should follow their link:

Attract that special someone this Valentine's Day
Be a Valentine's Day stud!
Don't be alone for Valentine's Day this year!
Make this Valentine's Day the most memorable ever
Time to prepare for Valentine's Day.. be ready!

Followed by a randomly selected Chinese domain to see their Valentine's Day suggestion:

www.aclqix.cn/a/
www.bwyistb.cn/a/
www.cverrli.cn/a/
www.daolnebo.cn/a/
www.dhauiineso.cn/a/
www.dovktemav.cn/a/
www.dryeba.cn/a/
www.erdazom.net/a/
www.honkivae.cn/a/
www.hzynadon.cn/a/
www.kiawwye.cn/a/
www.laikpichi.cn/a/
www.mebqibb.cn/a/
www.moxliicn.cn/a/
www.moytogoc.cn/a/
www.odryobol.cn/a/
www.reyaffe.cn/a/
www.slutoqn.cn/a/
www.uqhbom.cn/a/
www.venvgkokaf.cn/a/
www.vqrlas.cn/a/
www.vseugop.net/a/
www.xuyrla.cn/a/
www.ywamlado.cn/a/
www.zadubchb.cn/a/

Each of the websites is of course identical . . . in fact, they are all on the same computer -- 58.253.66.64 -- in Guangzhou China.

And what is our Top Spam for Valentine's Day selling? The Amazing Medical Breakthrough in Penis Enlargement - the Penis Enlargement Patch!





Number Two -- Our Next most popular suggestion for Valentine's Day from the spammers is a membership in an online casino!

Some of the spammers put it right in the subject line:

Casino - St. Valentine's day
St. Valentine's Casino
St. Valentine's Bomus

while others used a different subject and included the Valentine's Day message in the body:

AOL Games
Google INC Play
Win in casino
Win in casino today

with the email message starting: St. Valentine's bonus in casino. Welcome today!

Whichever website you choose to visit:

casino9-99.ru
or
intplay.ru

you end up at the Fiesta Club Casino hosted in Beijing China . . .






Number Three - In keeping with Valentine's Day, who can resist a message from a secret admirer? Our spam subjects such as:

Crush Alert - Someone Wants you
Love Alert - Someone Poked You
Someone Special Likes You
Someone Sent Your a Virtual Hug
Someone Wans to Know You
Your Friend eNudged You

All contain the message:

You are obviously not alone this Valentines Day, someone has invited you to their party room.

and a link to one of several different websites:

OnlineCams1.com
OnlineWebsite1.com
Software-Action.net
Streaming-Webcam.net
Web-Page-User.com
WebsiteForYou1.com

All of them are actually showing exactly the same content, hosted on the same server owned by Yurekeji Limited Company, that's right, in CHINA.

All of the webpages are for Sexy Kat's blog, who wants you to join her "free" service - you just need to share your credit card number with her to prove that you're 18 years old. The membership is supposed to be to "TubeScrew", but guess what? Sexy Kat's account has been terminated for spamming! (I wonder how that happened?)






Number Four - Finally some traditional Valentine's Day gifts! What could be wrong with Flowers for Valentine's Day?

The subjects advertise: Valentines Day Flowers Starting at $19.99 ProFlowers

We have a couple versions. The first one sends us to the website "residualincometruth.com" (69.65.54.9) (I guess the Truth about the Residual Income is that you can send spam for money, but you should keep your day job.) That website uses the code "oymnbdpmpvmq/ttnm/" to forward us to a different website, "www.bestwhole.com" (72.32.107.97), which uses another code "NjU0MnwxNTI0fDE5Njg0Mnx2Mg" to forward us to another website "lnkflw.com" (67.208.131.106) which does a redirect to send us to the actual website, http://products.proflowers.com/.

The other one that I tracked from them sent me to the website "gqv.getcitynews.com" which sent me back to "bestwhole.com" which sent me to lnkflw.com which sent me to proflowers.com.

It should be noted that in both of the above ProFlowers ads, they were not engaging in spam, according to the CanSpam Act, because they have provided the true mailing address of their company in the body of the email, and provided links in all the spam I received to allow me to click to no longer receive their emails.

The one I received from Motleygems.net, which also goes to ProFlowers, is NOT CAN-SPAM compliant, giving neither an unsub opportunity, nor a true mailing address. In that one the address at motleygems.net (69.30.253.178) forwarded to cpctrack.com, which forwarded to ProFlowers.com.

We also received this spam with links to "televisionlisting.net", "recognizedsources.net", "profitsforu.net", "tennesseewireless.net", "insiderstore.net", "eastprovidenceschools.com", "seriouszilly.com".

ProFlowers.com has beautiful flowers. Its too bad I don't buy things advertised by spammers. I'll have to just use Homewood Florists again like the old fashioned people.



The 1-800-Flowers.com spam I received was also CAN-SPAM compliant, with both a mailing address and an unsub address. That one sent me to the website "ct.silvermail-usa.com", which forwarded me to their website.



Number Five - Those thoughtful people selling Acai Berry weight loss solutions knew that I needed to lose a couple pounds for Valentine's Day, so that sent me a ton of spam with subjects like these:

Attract that special someone this Valentine's Day
Be a Valentine's Day stud!
Don't be alone for Valentine's Day this year!
Make this Valentine's Day the most memorable ever
Time to prepare for Valentine's Day.. be ready!

In this case many different spammers all use the same domain name:

laneslow.com

by modifying it with their affiliate codes, like http://wyfyda.laneslow.com/?ufapqi or http://d.laneslow.com/?elcq or http://ntxynk.laneslow.com/?mmo






We'll have more Valentine's Day spam before the 14th I'm sure. Today's batch was rounded out with advertisements for Shoes, Watches, Cash4Gold, Airline Tickets, Rental Cars, Match.com and eHarmony, and the Slim 365 pill. But each of those was in low volume, so we'll let them slide for now.

No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.