I've been getting about 2-10 spams per day sent over Yahoo Messenger. I had some initial success going after the spammers by getting their domains yanked for invalid registration info, and in some cases the hosts would also suspend the domain.

The spam works like this
1) you get an yahoo IM that reads like this
rockykidd841 (1/10/2008 12:49:21 AM): U gotta check this out,BRAND NEW Dating Site !! http://www [dot] 22muchfun[/url] [dot] com

I added the "[dot]" part in case we're not supposed to post links (been a few years since I've been in here

the website 22muchfun autoforwards to a dating or porn site. (site varies, since I'm also been going after the sites, some of whom are major players like singlesnet and true.)

When I first got a spam from 22muchfun I was able to get the registration and the hosting killed.

The spammer then moved over to private domain registration at aplus.net.


22muchfun is hosted in china by scn.com.cn , which I have cc'd on the reports, but they are probably a spammer friend chicom host.

I've complained to aplus.net, and they are claiming that I can't prove 22muchfun is spamming because anyone can send a IM with a website link, and since they are only the register it is not their problem.

But if they are providing 22muchfun with anonymous domain registration, they are providing a service that gives the spammer protection while the spammer is running their bot.net.

They claim the IM are not spam, because you can't prove it came from the spammer seems just wrong. Won't the same logic then mean that web sites advertised in email spam should not be terminated because you can NEVER prove that the party who owns the website is the same as the party who sends the email.

It seems to me that aplus.net is black hat because their policies seem very pro spammer.

Here is the last email I got from aplus.net where the basically tell me its not their problem.

Reported the spams to yahoo, but I think yahoo just ignores them. Even found the site that sells the software to hack yahoo servers to send the spam, and tried to report it to yahoo, and yahoo claims there is nothing they can do (I suspect that yahoo's abuse desk doesn't speak/read English).

I've also having the same issue with Godaddy, which also have a spammer friend private domain registration, they make pretty much the same claims. If you want DG to take action, you have to sue the spammer, and PAY godaddy.



I can understand the need for private domain registration if you are a private party running a domain for personal use. But if someone is running a business (and organized crime is a business, criminal income is taxable as business income), and that business is selling a product or service, it seems down right unethical to offer a service that allows a business to be unaccountable for its actions.

It seems like aplus.net is engaging in willful blindness of its clients criminal acts. I use the term criminal, because yahoo states on its AUP that it considers spamming thru its servers to be a criminal act, and the majority of spammers do seem to be linked to organized crime and gangsterism.

Anyone here have any experience with fight spammers who hide behind anonymous domain registration? My only idea has been to file a false advertising complaint against aplus.net for not honoring its anti-spam policies, and hoping that Yahoo will eventually wake up and do something.

Moderator edit: broke link.

According to ICANN, proxy registrants are considered to be the registrants of record even though they are acting on behalf of others (go to http://www.icann.org/registrars/ra-agreement-17may01.htm#3 and scroll down to section 3.7.7.3):

• "Any Registered Name Holder that intends to license use of a domain name to a third party is nonetheless the Registered Name Holder of record and is responsible for providing its own full contact information and for providing and updating accurate technical and administrative contact information adequate to facilitate timely resolution of any problems that arise in connection with the Registered Name. A Registered Name Holder licensing use of a Registered Name according to this provision shall accept liability for harm caused by wrongful use of the Registered Name, unless it promptly discloses the identity of the licensee to a party providing the Registered Name Holder reasonable evidence of actionable harm."

This means that if aplus is holding the proxy (i.e., is the "registered name holder that intends to license"), and you can show "reasonable evidence of actionable harm" (and we'll let the lawyers argue as to what this is or who is empowered to provide it) aplus is responsible for abuse of the domain unless they provide you with the identity of the "true" registrant. Perhaps you might use these magic words in your next discussion with aplus, maybe cc'ing to ICANN.

Since they are the registrants of record, they are essentially telling you that they don't care that spam is being used to promote "their" domain. This puts them on an equal moral footing with most hardcore spammers.

Proving "ownership" shouldn't be the issue. We aren't prosecutors nor forensic accountants. We do, however, have a say in the reputation of the website operator. If I operate a clean domain, but have a rogue affiliate (or Joe Jobber) or two, then your reports would tell me that there's a problem affecting my domain (ergo my business) that I need to take care of (and I should ultimately be grateful to you for those reports). Of course, like your pals at 22muchfun, I might not give a rat sass. Unfortunately, there will always be someone who will take my money for net services (or will let me steal them), even if I don't care about your complaints.

Not many registrars are what we would call snowy-white in this regard. Many (if not most) see their duty starting and stopping with registration, and avoid spam enforcement like the measles. My own registrar (gkg.net) is, on the other hand, very white-hat in this regard.

Can't be of much help here, I know very little about IM other than how to spell it.

I can agree to a point, but proxy registration is very popular among all kinds of people (including your humble correspondent). One thing that it does for me (and others) is to keep our e-mail addresses and other data out of the hands of people who "scrape" whois for marketing leads (or worse). The protection here is that the proxy registrants are supposed to be responsible for any abuse (unless they unmask the true registrants), but as we see this doesn't always happen.

-- rick

on edit: de-garbled some parts of my post

OUTSTANDING!
Well I filed a fraud complaint against aplus.net with the CA Attorney General office. If they don't reject the complaint out of hand (many consumers affairs agencies will not handle spam complaints) I'll use that to back up the compliant.

In the meanwhile I'll see what I can open up with ICANN.

That is also interesting because that seems to make aplus.net a unregistered CMRA (Commercial Mail Rec'ing Agency) because it is providing a mailing address for third parties to use. So, I now have the idea of getting the US Postal Service in on this on the grounds that aplus is providing a anonymous physical mail box for the spammer.

Thank you.

Well, not surprising, the register told me to go pound sand...

So off to visit ICANN....

Anyone else dealing with IM Spim spam? Would be especially interested if anyone else is getting SPIM for xxxblackbook.com or singlesnet.

Aplus is being coy. Yes, they are the registrar, but it is THEIR NAME that appears as the registrant. Their "just a registrar" claim would hold water if not for the fact that they provided the proxy registration data (for which they probably charged five or ten bucks, this is usually an optional and premium service).

Just goes to show that, to use a football analogy (which I am completely unqualified to wield), reporting spam activity to a domain registrar is like a Hail-Mary play: it probably won't get you anywhere, but if it works it does so spectacularly.

Same could probably be said of reporting registrars to ICANN, according to what I hear.

-- rick

...Thank you, that is appreciated! <g> However, the link still works (at least in Mozilla Firefox). After I post this, I'm going to take the liberty of editing your original post to break it there, as well.

I actually had some success with getting Singlesnet to fire AzoogleAds which was hiring the spammers to promote their clients. Every time I got a spam that links to any site with an ad for Singlesnet I filed a complaint with the Better Business Bureau for privacy and unethical sales practices.

It kind of tricky to get the BBB involved. If you mention anything about criminal acts they will not get involved. So I have to carefully make in into false and deceptive advertising with high pressure sales tactics issues.

One of the private domain registered, privacyprotect.org, accepted my screen shot of spim as proof of spam, and turned off the anonymous feature.

The domain comes up to a real address in VERY VERY rural Kansas, so I contacted the town manager by email to ask if the web site owner had the proper fees and permits to run a brothel/adult entertainment business and is he paying the proper business taxes for that class of business.

Devilwolf;

You're not alone. Since Azooglelodites are now 'spIMming', perhaps they understood the "agreement" (judgement?) to suggest that it behooved them to diversify.

http://blog.affiliatetip.com/archives/azoo...torney-general/

http://myfloridalegal.com/__852562220065EE...ht=0,azoogleads


Getting the city manager to levy a bus tax on the target operation address appeals to my sense of righteous retribution, but it would be unenforceable. The county/municipal "assessors" would have to have access to all his hard drives every couple of years and do a forensic audit thereon .... way out of their bailiwick and totally impractical.

Well the SPIM has dropped to zero over the past few days, so yahoo probably closed what every loop hole the spimmers are using.

I actually found the company that is selling the spim ware, get them to email me (in PDF) their catalog of spamware and tried to report them to yahoo, but they seem to refuse to take any security/exploit reports from mere mortals, my email was forwarded to the abuse dept, and the abuse department said there is nothing they can do, because its out of their scope of duties.

If anyone on here is a journalist or media.. I'd be more then happy to share a copy of catalog, and show you some websites that help hook-up malware coders and spammers.

I use the Trillian Basic chat program on my machine which has an AOL IM and a Yahoo IM account setup. I only receive spim on the Yahoo account and only over the last few months. I have record of it back to 02/04/2008 and since then have received 17 of them or about 3-4 a week (though I don't always keep Yahoo IM open 24x7).

I don't know if upgrading to full Trillian would help or if they provide other blocks that are not in the free program. I also haven't contacted Yahoo about this yet as it was only a minor annoyance at the time of once every other week but not that it is happening several times a week it is a hassle and I might also be able to help our customers and clients who might also have this problem or be proactive in even preventing them from receiving it.

They all seem to have a similar layout to what Devilwolf described but all of mine tend to have the same layout of the name (shown at the bottom). Also, my IMs are sometimes in the form of:

• amy_qw5o2n4: ycz check out my hobby in website :-) shhhh http://www [dot] JENNYSPROFILE [dot] com
• alleyndsrgr: egm he<blue>y, <black>I ju<black>st p<red>ut <red>a pi<orange>c o<blue>n we<green>bsit<blue>e!

Usernames that I have noticed are:

• matthiewjwifdhaj
• ellynnwitzz
• anjelazgeniaz
• daisizjannellez
• debeezhildegardez
• deloriazwilonez
• gerrizgaylez
• joscelinzmayz
• julesalzzonenrfekrm
• melisandrazbonniez
• sianazcasseyz
• stacyzhelsaz
• timzrubiz
• giraudwmcvk
• alleyndsrgr
• amy_qw5o2n4
• yesenia_ws53

The yahoo account ID are all generated using a scri_pt or bot or paying nigerians to sit around and sign up for IDs...

I looked at the one sample you posted, which ultimately forwards to a site called xxxblackbook dot com
with a referral ID of
http://www.xxxblackbook [dot] com/?s=geolist&geo=1&r=lc125001&rand=1
lc125001 is the spammers payment ID

Although xxxblackbook claims to be taking action against the spammers, my own opinion is that they have just warned their hackers gangs not to spam my IDs after I made a lot of trouble for the hosting company, beanfield [dot] net.

I have a personal contact at beanfield if you want to contact them, but beanfield is not willing to take action against xxxblackbook, they also give the "rogue affiliate" excuse.

Found this site with some good info on xxxblackbook's links to organized crime.
http://matchent.com/wpress/?q=node/231

Buyer beware! I upgraded my Trillian a while ago in order to gain a feature that they advertised (Groupwise Messenger access) and the feature did not work.

I'm happily using Pidgin (found at Pidgin.im) and don't seem to have any problem with spim, but YMMV.

DT

DavidT - Thanks for the tip about Pidgin. I just downloaded it and see some additional features that Trillian did not have (such as the "Only allow users on my Buddy list to contact me"). It also incorporates a great many more IM clients such as Google and MySpace and these were separate programs from Trillian that I had to run so now I *finally* have an all-in-one chat client.

The AIM options actually allow use of their proxy server for file transfers and direct IM which, although it may be slower, does not reveal your real IP address. Interesting. Thanks again.

Sidenote: I received a spam email sent to my cell phone today and don't know how to capture any "header" details about it. Darn they are getting good now. Time to go have a talk with Verizon tomorrow.

You're welcome, Darren. BTW, if you're going to use Pidgin, and like to have "toaster pop ups" in the corner of your screen when people come and go, then you might want to download and install the "Guifications" plugin. I use the "Pidgin 2.0.0" theme of Guifications and like the effect. The plugin is available here:

http://plugins.guifications.org/trac

DT

Well I'm been hammering at my spimmer's favorite affiliate program (sex search com dot com). I'm been working on the theory, if you can't beat the spammers, beat everyone they work with and for.

Finally got moniker to enforce the Whois Data Accuracy, and the owner of the above site had to post her home phone on her whois info in order to get her website turned back on. (Yes it is her real ph#, I checked it against her incorporation papers, which florida posts online).

Sent one of the Spimmer's Prefered Register's CEO into a screaming fit on WHT when start writing about how his company was aiding and abetting RICO by allow an ongoing criminal enterprise to register domains with fake contact info.

Driven the Spimmer off 5 different registers, unfortunately he has settled in with a register in the Kleptocracy of China now.

I'm also decided to declare war on "get a free lancer dot com" as they seem to be allowing a lot of SPIMware writers and Yahoo Acct Stealers to buy and sell on their site.

Do a search on there on "CAPTCHA" and there are dozens and dozens of people offering anti-CAPTCHA services.

That's surprising, in that Moniker.com is in the top 10 of "The 10 Worst Registrars in terms of spam advertised junk product sites and compliance failure" maintained by KnujOn.com (see this forum topic and this link).

My wife's email account was hit for a week by spammers hiding behind private Moniker registrations, and the domains are still resolving, despite complaints sent directly to the owner of Moniker.

DT

Domain cloaking I have noticed seem to exist to allow spammers and registers to stay in bed. Its allows them to stall on enforcing AUP by weeks or months. I've found that even supposed white hat registers like Godaddy will drag the feet on cracking down on spammers who use their proxy services.

I can see no reason why a business needs a proxy/anonymous domain. I can understand using them for purely personal sites, but consumers have a RIGHT to know the legal address for business. A Business that hides its legal address is up to no good.

Usually I just start filing complaints with the Attorney General office and/or the BBB (which one spam friendly register calls the BBB "extortionists").

It did take me almost 7 months to get Moniker to crack down ONE site's bad registration data.

The reason is that much email spam and other unsolicited contact comes through domain registrations. I do not hide the information for my companies sites, but I do use a specific address and report all spam that comes to that address. I also complain to all mailings that I can prove got their information from the registration (due to specific information used only there).

I would think the 'legal address' would be the physical address and landline phone number and contact person.

I can understand the problems about the email contact. But the domain name should be available for any business on the internet - otherwise how would you do business? And there should be a way to contact that business via snail mail and telephone with a name (which can be gotten from the Secretary of State, after all, wherever they have incorporated).

Private individuals could use the registrar address, but not anyone who is doing business on the internet.

Miss Betsy

I would like to try contacting them as well. I've been getting alot of spam from xxxblackbook as well and agree that the registrar bears at least some of the responsibility. I'm also not sure if I believe that they are taking action against spammers. I get spIM that directs me to their homepage, not to a particular member's page.