andyroo Posted September 3, 2006 Share Posted September 3, 2006 Hi! For the last week I've been getting targeted spam (to .edu addresses) that spamcop identifies as being from liquidweb.com. When I run a whois by domain name, the owner comes back whoisguard protected, registered by either namecheap or enom. when I run by IP address, the address block comes back registered to liquidweb. Both enom and namecheap state that they have policies prohibiting users of their services from sending unsolicited bulk commercial email, but they don't come up in spamcop reporting as options to email to. Liquidweb is unresponsive. I am preparing to manually report the spam to enom and namecheap, but I wanted to get feedback on this. A detailed description of the spam sources and content follows. I'm guessing that liquidweb is allocated the block of IP addresses that these domain names (six so far) are registered to. But I haven't seen any replies from them in over a week of spams. I'm getting 5-10 per day from these addresses (IP addresses are just the last few I've reported): [http:// flightsinthedark.com] ( 22.214.171.124 )( 126.96.36.199 ) [http:// bigbrownsquares.com] ( 188.8.131.52 ) [http:// medianaliter.com] ( 184.108.40.206 )( 220.127.116.11 ) [http:// nomoechopollo.com] ( 18.104.22.168 )( 22.214.171.124 )( 126.96.36.199 ) ( 188.8.131.52 )( 184.108.40.206 )( 220.127.116.11 ) [http:// fishgrantisotis.com] ( 18.104.22.168 )( 22.214.171.124 ) [http:// beejungleribbon.com] ( 126.96.36.199 )( 188.8.131.52 ) ( 184.108.40.206 ) Each email has links that redirect to a site that runs you through a kajillion offers (I just filled in the info from the unsubscribe address when I was looking into it). Then, right before you're supposed to get whatever free thing they're offering, the page hangs on a survey (in MSIE or firefox). It appears to be a deceptive site designed to get you to fill out a whole bunch of personal info on a whole bunch of marketing lists. I imagine they get a kickback. If you want to follow the links, some valid three digit codes are 156,157,158,064 The general email format is: From: Financial Department <studentpromotion[at][insert domain name from above]> Subject: [insert promotional offer name here To: myemail[at]university.edu Students Get our [ insert offer here] What are you waiting for? Congratulations! You have been selected to receive a [insert offer here] Simply click on the link to complete the application. Click Here (http:// nomoechopollo.com/redir.php?id=158&e=myemail[at]university.edu) [more offer-specific text) Click Here (http:// nomoechopollo.com/redir.php?id=158&e=myemail[at]university.edu) Sincerely, [offer dependent signature] College Group Only Sends Top Offers and Services To Students. We Wish You Great Success This Fall. Please click here to unsubscribe or mail your unsubscribe request to the address below. [http:// nomoechopollo.com/uns.php?c=studentpromotion&m=] [ten digit identifier]&e=myemail[at]university.edu College Group Services 5715 Will Clayton #2158 Humble, TX 77338 Moderator edit - URLs delinked ... Farelf Link to comment Share on other sites More sharing options...
This topic is now archived and is closed to further replies.