¯\_(ツ)_/¯
Honorary Master
- Joined
- Apr 20, 2005
- Messages
- 24,915
- Reaction score
- 27,904
I'm taking a dig into a spam received today.
Okay, the first BS flag "You received this mail because you are subscribed to a newsletter or mailing list to which you opted in.". No such case this side of hell. As such a patently false statement. In fact the receiving email address is even listed at the DMASA on their "Do not contact list" (much to my regret as it attracts spam from DMASA members - take note DMASA) and never subscribes.
The pertinent parts of the email header:
So, doing a whois on "dealkings.co.za" shows:
A South African domain, linked to a certain "Amanda Kruger", showing the domain links to a Belize address.
To compound the issue, we note a date stamp of "Fri, 10 Oct 2014 10:20:56 +0300". Where are at UCT +0200. So that would put the sender somewhere east of us in a different time zone. Yet Belize's time zone is UTC-06:00.
So the sender is not at the claimed address.
Digging into the claimed address a bit deeper, we find 1 Mapp Street, Belize City, Belize links to:
So, essentially the owner of dealkings.co.za is not the registrant, rather a proxying company's address.
Looking at performancemarketingltd.com - their website says:
Any Google serach fails as this domain is newish. Much older information exists about a performancemarketingltd.com that was abused by Kevin Atkinson, but is not relevant as this is a re-registration.
Whois details on performancemarketingltd.com tells us:
Another dead end.
PERFORMANCEMARKETINGLTD.COM & DEALKINGS.CO.ZA leads to hosting at tazerhost.com.
http://tazerhost.com says
http://www.tazerhost.com says
So any avenue as to gaining knowledge of who is spamming me is blocked.
Like hell I'm going to click on any unsubscribe! We are clearly dealing with an international spam operation here.
This email contains links which redirects to therealmidastouch.com and the dealkings.co.za is just a spam redirector.
--- contacting host ec.dealkings.co.za [162.243.35.165] on port 80
... time to proxy up and go into sleuthing mode ...
This URL shows the following content:
One you sign up, you are presented with this page:
So they've suddenly changed their tune, they actually want my credit card details? Where is this posting to?
So, in a nutshell, the personal and financial details they require, will be posted onto their insecure server over a non-encrypted session? Anybody doing so needs to have more than his head read!
Where is therealmidastouch.com hosted?
So we do not know as it's hidden behind CloudFlare.
This domain is also linked to tazerhost.com (with no web page). So it's probably also on a cheap VPS at Digital Ocean or like.
This brings us back to South Africa. What pretense can there be that the spammer respects privacy. Even the Privacy Policy link in the spam redirects to http://www.performancemarketingltd.com/privacy.html
There is zero consumer protection in this situation. [sarcasm]By all means go an post your credit card details and other personal info into some form posting to where-ever over an insecure connection in response to an email sent by persons unknown in a time zone east of us [/sarcasm](alarm bells!). Your bank will not assist you when things go south.
This brings me to another question: How do we stop this?
Digital Ocean is known to be spam friendly (plus many other links)
Best practice dictates I do not contact the spammer. The spammer is outside the reach of South Afican law and our jurisdiction in places unknown, spamming, while the ECT Act and CPA only applies in South African. For all we know this may even be Yambo Financials or like (said as an example) and nobody could say I'm wrong.
The policies of ZA Central Registry also has nothing to say about any abuse.
This leave South Africans wide open to being lambs to the slaughter and the targets of miscreants.
Perhaps Register Domain SA can shed some light on this abusive situation?
Okay, the first BS flag "You received this mail because you are subscribed to a newsletter or mailing list to which you opted in.". No such case this side of hell. As such a patently false statement. In fact the receiving email address is even listed at the DMASA on their "Do not contact list" (much to my regret as it attracts spam from DMASA members - take note DMASA) and never subscribes.
The pertinent parts of the email header:
So, doing a whois on "dealkings.co.za" shows:
A South African domain, linked to a certain "Amanda Kruger", showing the domain links to a Belize address.
To compound the issue, we note a date stamp of "Fri, 10 Oct 2014 10:20:56 +0300". Where are at UCT +0200. So that would put the sender somewhere east of us in a different time zone. Yet Belize's time zone is UTC-06:00.
So the sender is not at the claimed address.
Digging into the claimed address a bit deeper, we find 1 Mapp Street, Belize City, Belize links to:
So, essentially the owner of dealkings.co.za is not the registrant, rather a proxying company's address.
Looking at performancemarketingltd.com - their website says:
Duh, performance not so great ...
Any Google serach fails as this domain is newish. Much older information exists about a performancemarketingltd.com that was abused by Kevin Atkinson, but is not relevant as this is a re-registration.
Whois details on performancemarketingltd.com tells us:
Another dead end.
PERFORMANCEMARKETINGLTD.COM & DEALKINGS.CO.ZA leads to hosting at tazerhost.com.
http://tazerhost.com says
http://www.tazerhost.com says
So any avenue as to gaining knowledge of who is spamming me is blocked.
Like hell I'm going to click on any unsubscribe! We are clearly dealing with an international spam operation here.
This email contains links which redirects to therealmidastouch.com and the dealkings.co.za is just a spam redirector.
--- contacting host ec.dealkings.co.za [162.243.35.165] on port 80
(link above deliberately broken)
... time to proxy up and go into sleuthing mode ...
This URL shows the following content:
One you sign up, you are presented with this page:
So they've suddenly changed their tune, they actually want my credit card details? Where is this posting to?
Code:
<form role="form" action="/members-area/" method="POST" accept-charset="UTF-8" autocomplete="off" enctype="application/x-www-form-urlencoded" name="e3e13c6877" id="e3e13c6877" target="_self" >So, in a nutshell, the personal and financial details they require, will be posted onto their insecure server over a non-encrypted session? Anybody doing so needs to have more than his head read!
Where is therealmidastouch.com hosted?
So we do not know as it's hidden behind CloudFlare.
This domain is also linked to tazerhost.com (with no web page). So it's probably also on a cheap VPS at Digital Ocean or like.
This brings us back to South Africa. What pretense can there be that the spammer respects privacy. Even the Privacy Policy link in the spam redirects to http://www.performancemarketingltd.com/privacy.html
There is zero consumer protection in this situation. [sarcasm]By all means go an post your credit card details and other personal info into some form posting to where-ever over an insecure connection in response to an email sent by persons unknown in a time zone east of us [/sarcasm](alarm bells!). Your bank will not assist you when things go south.
This brings me to another question: How do we stop this?
Digital Ocean is known to be spam friendly (plus many other links)
Best practice dictates I do not contact the spammer. The spammer is outside the reach of South Afican law and our jurisdiction in places unknown, spamming, while the ECT Act and CPA only applies in South African. For all we know this may even be Yambo Financials or like (said as an example) and nobody could say I'm wrong.
The policies of ZA Central Registry also has nothing to say about any abuse.
This leave South Africans wide open to being lambs to the slaughter and the targets of miscreants.
Perhaps Register Domain SA can shed some light on this abusive situation?
. Just block it or move on ...
