Sponsored by..

Wednesday, 6 August 2014

.us and .me scumbag spammers are now .mobi scumbag spammers

That didn't take long these scumbag spammers I've been tracking over the past couple of days have a new set of mail servers and domains for pumping out their useless affiliate crap.

Sending IPs:
69.39.238.200
69.39.238.201
69.39.238.202
69.39.238.203
69.39.238.204

These IPs belong to GigeNET in the US.

Spamvertised domains:
getitnow.find-cars-here-4u.mobi
trynow.safty-first-walkin-tubs.mobi
startnow.get-medicare-for-less4u.mobi
lower-your-payments-wHARP.mobi
safe.cure-most-diseases01.mobi

Sample emails:
From:     Best_AutoPrice [carsalesevent101@find-cars-here-4u.mobi]
Date:     6 August 2014 15:27
Subject:     Hi, Summer Price Reduction on All New Vehicles. Notice: 14359709

Local Auto Notice:  14359709
*****************************************

US Car and Truck Dealer are Liquidating Auto Inventories

Shopping for a new or used car?

Now is the time to take advantage of Summer Discounted Automotive Prices:

Go Here To View what's in-stock near you: http://getitnow.find-cars-here-4u.mobi


Modify_your notification_preferences: http://stop.find-cars-here-4u.mobi
PO Box No. 6498
PELAYO_ 80
-28004--MADRID--MADRID

=========================================

From:     Walk.In.Bathtub.2855074 [bathtub.safety@safty-first-walkin-tubs.mobi]
Date:     6 August 2014 15:34
Subject:     Hi, Learn about the Versatility of a Walk in Bathtub Message: 21036031

Enjoy Safe, Comfortable-Bathing in your Home
---------------------------------------------------------
[redacted],

Whether you are looking for a Walk-in Tub for Safety or Therapeutic reasons for yourself or a loved-one, we can help.

We can help you find Professional, Affordable Service Contractors near you.

Find a safe and comfortable walk-in tub online Today:
http://trynow.safty-first-walkin-tubs.mobi


Message: 21036031


Modify_your advertising_preference  here; http://leave.safty-first-walkin-tubs.mobi
QuinStreet, Inc. 950 Tower Lane_ Foster City, CA 94404

=========================================

From:     enrollment-period.9138765 [future.enrollment.451@get-medicare-for-less4u.mobi]
Date:     6 August 2014 15:40
Subject:     Hi, Medicare Enrollment Begins Soon. Notice #24458838

Notice: 24458838
**********************************************************
Medicare Recipient:  [redacted]

Open Enrollment for 2015 Medicare Programs begins
October 15, 2014 to December 7, 2014.

You can only change your Medicare or Prescription Drug plan
during this Annual Election Period.

Find the best, most affordable Medicare plan.

**Aetna, Humana, BlueCross, AARP and more**


Don't Miss Your Chance to Change Plans.

Find the Best Plan & Save up to 40% Online: http://startnow.get-medicare-for-less4u.mobi


Opt-off this_request: http://exit.get-medicare-for-less4u.mobi
Dundrum Town Centre,Dundrum
Dublin 16, Ireland
PO Box_ No. 309

===============================================

From:     HARP-Qualify.4642746 [Andrea.Casey1254@lower-your-payments-wharp.mobi]
Date:     6 August 2014 15:46
Subject:     Re: HARP Program: Lower Rates May Be Available Rpt: 13849540

[redacted],

Are your home payments weighing you down?

This may be your last-chance to Re-mortgage. Lock in a low -rate today before rates rise.

Find out how you may be Eligible to lower your monthly-payment. No -registration or -login necessary.


Get competitive rates quotes from Top Lenders and Save --
http://save.lower-your-payments-wHARP.mobi


Andrea Casey
Harp Eligibility Team

Report: 13849540


If you would like to update settings please go here: http://halt.lower-your-payments-wHARP.mobi
8776 [East-Shea_Blvd. #B3A-462_Scottsdale, AZ 85260]

===============================================

From:     Ultimate_Cure.5798463 [your.miracle.cure@cure-most-diseases01.mobi]
Date:     6 August 2014 15:54
Subject:     Re: Doctor Jailed for CURING Cancer (see why), Article No. 5615302


Today, you have a 95% chance of eventually dying from a disease or condition for which there is already a known cure right at your fingertips.

Well-respected doctors have been attacked, threatened with losing their licenses and even JAILED for sharing the information you are about to discover...

If you or a your loved one is suffering from ANY, and we mean ANY illness, chronic or acute, especially if you've been told it is incurable, then this is the most important message you will hear today.


View This SHOCKING Health Alert in your Browser: http://safe.cure-most-diseases01.mobi
(they don't want you to know about this)


Article No. 5615302


Modify_your_preferences here- http://hold.cure-most-diseases01.mobi
PO Box: #678
Calle Arturo Rodriguez- 17--23410 Sabiote
Ja??n, Spain
Sample click paths:

http://getitnow.find-cars-here-4u.mobi/
http://affiliate.adgtracker.com/rd/r.php?sid=6358&pub=331259&c1=ggn806
http://www.auto-price-finder.com/welcome?id=544&subid=273748921&affid=331259&depid=
http://pixel.autoaffiliatenetwork.com/d/?id=544&dest=apf&landing=nonbrand&rh=www.auto-price-finder.com&c1=
http://www.auto-price-finder.com/new/car?dest=apf&c1=&rh=www.auto-price-finder.com&id=544&landing=nonbrand&li=3&alt_exp=new&alt_ab=&rd=1

http://trynow.safty-first-walkin-tubs.mobi/
http://navytrkn.com/?a=125&c=9258&s1=ggn806
http://genetix420.com/?a=125&c=9258&s1=ggn806&ckmguid=e37b2ccf-28b9-4fc1-922d-72ccfbee9e55
http://www.enzjptkr.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://affiliate.gwmtracker.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://valuedealshopper.com?subid1=200001&subid2=6389

http://startnow.get-medicare-for-less4u.mobi/
http://affiliate.adgtracker.com/rd/r.php?sid=7748&pub=331259&c1=ggn806
http://www.medicare-providers.net/plans/index.php?Referrer=FM&Subreferrer=331259&Subid=273750538&utm_source=flex&utm_medium=email&utm_content=medicare&utm_campaign=24560

http://save.lower-your-payments-wharp.mobi/
http://navytrkn.com/?a=125&c=9244&s1=ggn806
http://ckthinmints.com/?a=125&c=9244&s1=ggn806&ckmguid=89d0208b-baec-4765-b88f-de84125ebff6
http://www.267555domain.com/click.ashx?CID=182639&AFID=267555&ADID=625699&SID=125
http://EVERYDAYOFFERSJUSTFORME.COM/go/c/537/4vars?sid=
http://njk0.HI5LINKS.com/?&s1=535_1750_GB_
http://zCRzz.download.awardhall.eu/?sov=63762401&hid=gkisukqomsiwykig&redid=7312&id=XNSX.535_1750_GB_-r7312

http://safe.cure-most-diseases01.mobi/
http://navytrkn.com/?a=125&c=10590&s1=ggn806
http://genetix420.com/?a=125&c=10590&s1=ggn806&ckmguid=27f625a1-56a4-46fa-8c81-2cace4c7473d
http://www.enzjptkr.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://affiliate.gwmtracker.com/rd/r.php?sid=6389&pub=201700&c1=&c2=&c3=
http://valuedealshopper.com?subid1=201700&subid2=6389

WHOIS details for the domains are fake:

Registrant ID:bdb01b76634ea4b7
Registrant Name:Kiera Gladdish
Registrant Street1:2123 Edison Rd
Registrant City:South Bend
Registrant State/Province:IN
Registrant Postal Code:46637
Registrant Country:US
Registrant Phone:+1.5742720312
Registrant Email:kieragladdishr946@yahoo.com


3 comments:

Kathleen said...

I'm getting at least 20 of these a day. How do I make it stop?

Elizabethj48 said...

I am also getting these. Please tell how to stop them.

Scott M said...

I used to get 20-30 of these a day on my domain email, but I ended up adding McAfee Domain Email Protection and it shut them down asap. If you receive your email via your own domain it is well worth it! Previously I was using SpamAssassin which didn't stop any of it at all through filtering as they change the subject line all the time and they change domains like normal people change their underwear >.>