No emails promoting sites are sent from this domain.

Nor are attachments sent to people I do not know.

Orginal post from 2004 when dea42.net was frst getting hit.

Con artists are providing a spam generator that is using fake from email addresses to make it look like they are coming from my site and I assume others. Do not go to, much less give any money to, any sites they are promoting. The sites I have seen promoted so far could be called shady at best and most likely will just steal your money, get you added to a confirmed victim spam list and might even infect your computer. This includes trying to unsubscribe from them. Doing so will, at best, just confirm your address as a valid victim.

If you look at the emails you will find most of them try and hide who they are not only by claiming to be from my site but also by using redirects on the sites they have links to and many even go the added step of using JavaScript to hide even these links. This is obviously not the behavior of an honest company. My program (see below) decodes this JavaScript before reporting so the people supporting these scams with redirects will be cited by SampCop as well.


Since I have received bounce backs from the idiots using this spam generator at a rate of up to 10 per hour, I now a have program in place to make sure all of these bounced back emails (with headers) are reported to SpamCop, but the more of them reported the quicker these guys will be shutdown. Plus since this spam generator is obviously being promoted as a work from home scam, there will need to be a lot of people shutdown before the word will get out that using this spam generator is a good way to loose your internet access. So please submit any of these emails you receive to SpamCop. It's free and easy.


Thanks,


Dave


UPDATE 8/19/2013

I moved to a new more powerful server a couple weeks ago so I'm going through and updating things. Since I first posted this things have changed a lot. Back then 10 spams an hour seemed like a lot and was a lot to the server I had at the time. In 2008 I was hitting rates of 2000 per hour and had to move my email to a new domain on it's own VPS server so the web server would stop crashing. Most of the spam comes in from bot nets now so blocking IPs is not that helpful, so I shutdown SpamRescue awhile back. Though I have started blocking some IPs again just lighten the load on the server. Most also comes to those random addresses that were being used as faked froms back then. That is useful since I can just route invalid addressed emails to discard so the spam filters to not even need to look at them. These days too the "spam" is more likely to be trying to drop a virus or trojan on you to add you to their bot net than try and sell you something. Though it is kind of amazing how mouch stuff still comes to invalid addresses seeing as how they seem to be steping things up. In the last year I've started getting spams to email addresses only used with sites like Direct TV and TxTag.org. Site you would not generally suspect of selling off youe email address. That would mean those sites have been hacked or some employee there sold customer info. Neither is a pleasant thought. And no one seems to want to comment on how spammers got those addresses.

UPDATE 3/29/2004

Seems SpamCop no longer thinks you should report spam returned to you because of a forged from. They say it's not your spam. I would think spamming pretending to be me is even more of a problem for me than them spamming me. And is not the grey issue junk email can be at all. Anyway I have added an option to my tool to send the reports directly instead of through SpamCop. It is posted at SpamRescue for anyone to use for free. Current detailed stats can be found at SpamRescue Stats


Also I'd like to note here that almost all of these scam spams I have received the week of 3/11/2004 were for sites that appeared to be down. (193.27.84.25 and 200.206.187.57 are something like 80% of them) I guess that even the spammers are getting scammed by this spam generator.

Lately many of the links seem to point host names made from random characters which don't actually exist. I can't be sure of course but from the accompanying text it looks like the people trying to use this generator have gotten even less technological. As in HTML would seem to be too complicated for them. Some of the text in the emails look like instructions on how to use the generator and some is just parts of random sentences. Hopefully this means the smart ones have moved on and we are reaching the bottom of the barrel.


Here are some of the sites being promoted through this scam spam as of 3/11/2004

Though many of them are nothing more than redirects to real sites

Color Key

Seems to have been shutdown since no DNS entry any more
Has DNS entry but site is down (can't ping)
Still in biz for now

By IP

  • 66.103.153.146 www.globaldatabase.info
  • 193.27.84.25 *.jointheplanet.biz, *.movethearth.biz, www.*.xptheworld.biz, www.*.pushthebeat.biz,www.*.dothethings.biz, www.*.growtheupper.biz
  • 193.27.84.27 *.lightatthedarkness.biz, alandofgrass.com, busyhelicopter.biz, catchthebird.biz, www.*.soundofmistery.com
  • 200.232.112.14 www.onlineincest.net
  • 200.206.187.57 www.amberroads.com, www.glennmardo.biz
  • 202.88.174.108(202.56.197.110) www.snapshut.info
  • 205.252.97.41(205.252.96.2) thasti.com
  • 216.158.151.16 18-and-wet.com
  • 219.129.20.208 www.getthegold.com
  • 219.147.198.137 www.usisaco.com
  • 219.150.215.242
  • 219.150.215.243
  • 219.150.215.249 rmt566.com
  • 221.233.29.61 *www.unbreak.biz(sort of up 33%-50% packet loss)

    By Host

    *=many sites at this domain using the same IP
  • 18-and-wet.com
  • *.alandofgrass.com
  • www.amberroads.com
  • *.busyhelicopter.biz
  • *.catchthebird.biz
  • cdatlow.com
  • www.*.dothethings.biz
  • www.gainfactor.com
  • www.getthegold.com
  • www.glennmardo.biz
  • www.globaldatabase.info
  • www.*.growtheupper.biz
  • www.hally-day.com
  • *.jointheplanet.biz
  • *.jungledrive.biz (probably the same as catchthebird.biz)
  • *.lightatthedarkness.biz
  • *.movethearth.biz
  • www.onlineincest.net
  • www.paper-elefant.biz (which appears to be the same as the site calling itself oceantricks.com in these spams in Jan.)
  • www.*.pushthebeat.biz
  • rmt566.com
  • *.screwpet.biz (probably the same as catchthebird.biz)
  • www.snapshut.info
  • *.softwareforyou.biz
  • www.*.soundofmistery.com
  • thasti.com
  • *.tonvoisin.com
  • *www.unbreak.biz
  • www.usisaco.com
  • *.webservicehelp.com
  • www.*.xptheworld.biz