WAR against SPAM - One source in particular

[willemvdm]

I've been receiving these horrid spam messages for a while now and finely traced them back to IP - 220.248.167.126 Below is a spam report I've past on to abuse *at* cnc-noc.net.

Dear sir.

I receive like up to 4 spam messages per day that all trace back to this Canadian Pharmacy. A sample of one of these spam messages are attached below.

Their modus operandi seem to be to register a new domain every once in a while and SPAM the heck out of people. Once a domain get shut down, they register a new domain and start again. I get a feeling the xonog.com domain is about to be shut down, cause the latest spam I received traced to pgv.buloz.com and this domain was registered on 13/04/2009. xonog.com was registered on 04/04/2009. When both these domains are pinged they both resolve to IP:220.248.167.126. That is what brought me to bring my complaint to you.

The SPAM messages are all the same format and contain one link to an intermediate site that again link to or redirect to the main Pharmacy site. There seem to be hundreds of these intermediate sites.

The spam messages don't contain any instructions on how to get REMOVED from their lists and the spam report and contact us links on the xonog.com site does not function.

If you can at the very least get a message through to these idiotic people that I am millions of miles away from Canada and I have no interest in the products they are selling and that I find their continues SEX related spam repulsive. As long as I receive these spam messages on ANY of my aalwyne.co.za email addresses I'll keep on to actively trace and report each and every message I get from them.

Your help in this matter is much appreciated.

I've uploaded a screen shot of the page that all these spam messages lead to. I didn't include a sample spam message in the quote above. They are all in the same format. A short paragraph followed with one line containing the link, followed by a longer paragraph. Both top and bottom paragraphs contain random sentences that do not relate to each other.

If you have received spam like this, could you please report it too. Using something like spamcop does not work, cause the real source is not contained in the spam message. Any advice on how I can combat this would also be appreciated.

Would like to know how many people in our community receive spam from these guys.

 

[Fudzy]

Odd that this type of spam is still getting through to the end user. What ISP are you with? Do you run your own mail server?

 

[willemvdm]

I generally don't get much spam and usually when I do get spam I follow the remove link and don't here from them again, but this one is different.

I'm using the mail facilities provided by my web-host. All my mail get forwarded from there to my vodacom email address so I can retrieve it with local BW.

I've played around with filters and things to try and block these messages. It work for a few days, but then they make a change to the message and it come through again. It feels like they are targeting only me and we playing can and mouse. I don't know how to filter it out without losing legit email.

 

[Fudzy]

Well thats why I send all my mail accounts through my gmail account, I'm yet to see a bit of spam (other than what I've signed up for) get through Google's spam filter.

 

[Fudzy]

Check this link out :

http://mboffin.com/post.aspx?id=1636

 

[willemvdm]

Oh, and a weird thing happened with the last message I received early this morning. After following the link to make sure it was from the same source, I came back to thunderbird so I can write up another report and to my surprise the message was gone. Could not find it anywhere. I eventually clicked on the "Edit - Undo Delete" and it came back, but it was only the subject, no body and "View - source" yielded an empty box.

I went to my check on my mail.aalwyne.co.za server, messages don't get deleted there, I manually go and delete them once a month or so. And to my surprise it wasn't there either.

 

[willemvdm]

Ok, thanks Fudzy, will give that a try.

 

[LazyLion]

those messages all get caught by my Gmail spam filter. But it is funny to go in there every now and then and read them. Yes, there are a lot of them from the Pharmacy. Anybody who buys prescription drugs from such a dodgy source has to be a complete and utter moron. You have no idea what you are really getting or about issues of quality control.

 

[andres101]

if all the messages are similar, then reporting a few using Thunderbirds built in Bayesian filter should stop your spam. have you tried this?

 

[willemvdm]

No, don't really know what the "Bayesian filter" is or how it work. If you are talking about the little button next to each message that when clicked move the message to the junk folder, that doesn't work for me. When I use this feature, I find that thunderbird moves legit messages to the junk folder as well. When I tell thunderbird that the legit message is not spam it stop moving the spam messages to the junk folder and so the cycle continue.

When I say similar, I mean the layout of the mail. The from address is ALWAYS different. The single link inside change daily. The link is usually to some blog that contain a link to the pharmacy site. When I report it to the blog, it get shut down within a few hours, but they just keep on creating new blog accounts.

I'm trying the gmail thing now that Fudzy suggested.

I can't understand what they are gaining by this spamming. In my opinion it can do them only harm than good. Cause when a domain get shut down, a legit customer who genuinely actually want to buy something from them, can't find them. Then again, I don't suppose they have customers that want to come back and buy for a second time.

 

[Hein_JHB]

I also get those spam msg's but it gmail moves it to the spam folder and I go through it to check for legit emails because legit emails sometimes also get moved to the spam folder in gmail

 

[andres101]

No, don't really know what the "Bayesian filter" is or how it work. If you are talking about the little button next to each message that when clicked move the message to the junk folder, that doesn't work for me. When I use this feature, I find that thunderbird moves legit messages to the junk folder as well. When I tell thunderbird that the legit message is not spam it stop moving the spam messages to the junk folder and so the cycle continue.

Yes, that is what I am referring to. If you train it, it will eventually get better. With Bayesian filtering you will almost always get false positives.

I think it uses spamassassin in the back and you might be able to adjust the required "score" for spam messages, but the defaults are probably best.

You can also download verified spam to help you train the filters. Let me know if you want to track down the URL.

When I say similar, I mean the layout of the mail. The from address is ALWAYS different.

Bayesian filtering should pick it up then.

Are you using the latest version of Thunderbird (2.x)?

 

[ponder]

Well thats why I send all my mail accounts through my gmail account, I'm yet to see a bit of spam (other than what I've signed up for) get through Google's spam filter.

Thats what I did to friends mail the other day. Everything now comes through gmail and they are as happy as you know what.