There's more to this spam than meets the eye.. and be certain that it IS spam and isn't any kind of communication from your domain name registrar:
Subject: Notice Regarding Your DOMAIN NAME
From: "Domain Name Support"
Date: Tue, October 28, 2008 5:16 am
To: info@worldswidedomainname.com
*****************************************
Important Notice Regarding Your Domain Name(s)
*****************************************
Dear Webmaster,
According to our records you are the ADMINISTRATIVE CONTACT.
We would like to inform you we have partnered up with LunarPages Web Hosting. We understand you are currently hosting with another provider. But we encourage you to try out LunarPages. LunarPages also has an affiliation program where you can embed banners on your website and earn $65 for every referral.
A little more information about LunarPages; Lunarpages Web Hosting was born from Add2Net in 2000, and has grown rapidly providing Shared Hosting, Dedicated, Reseller, and most recently, VPS Hosting Plans. LunarPages is BBB Accredited and is rated A for excellence. LunarPages also has received many Industry Awards including Web Host Magazines highest level of recommendation. LunarPages is one of the fewest hosting services that provide unlimited transfer and unlimited data storage.
LunarPages can fit your business needs whether you’re a small business or a large company. Join (or lurk about) Community Forums and ask our customers why they host with LunarPages. For more in depth information, news and articles about Web Hosting, Marketing, SEO, Traffic, AdWords, Design, Networking and General Fluff, visit Lunartics Blog (updated daily, sometimes hourly). Our BlogStars consist of a team of more than 20+ industry experts. You may learn something, or simply be entertained.
VISIT LUNARPAGES
If you’re not ready to give LunarPages “Web Hosting” a try just yet, TRY the affiliation program where you can earn hundreds or even thousands a month. Save this email for your records and click the link above for special promos throughout the year.
Best Regards,
Alex Shafts, CEO
World Wide Domain Names
If you are the domain administrator of more than one domain account, you may receive this notice multiple times.
-------------------------------------------------------------------
All rights reserved.
Who the heck is Alex Shafts? And who are "World Wide Domain Names"? Certainly nobody I do business with. So let's see who is sending this first of all. A look at the mail headers will be interesting:
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on blade2.cesmail.net
X-Spam-Level:
X-Spam-Status: hits=0.9 tests=HTML_MESSAGE,URIBL_RHS_DOB version=3.2.4
Received: from unknown (192.168.1.88)
by blade2.cesmail.net with QMQP; 28 Oct 2008 05:27:00 -0000
Received: from mail500.opentransfer.com (98.130.1.155)
by ********** with SMTP; 28 Oct 2008 05:27:04 -0000
Received: (qmail 624 invoked by uid 399); 28 Oct 2008 05:16:47 -0000
Mailing-List: contact info-help@worldswidedomainname.com; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Post:
List-Help:
List-Unsubscribe:
List-Subscribe:
Delivered-To: mailing list info@worldswidedomainname.com
Received: (qmail 618 invoked by uid 399); 28 Oct 2008 05:16:47 -0000
X-Originating-IP: 68.230.241.45
Received-SPF: none (mail500.opentransfer.com: domain at worldswidedomainname.com does not designate permitted sender hosts)
identity=mailfrom; client-ip=68.230.241.45;
envelope-from=;
X-Authority-Analysis: v=1.0 c=1 a=J2IRbVyBMHeSdsxzcmgA:9
a=21DexejRGg20G2OFDxsA:7 a=V6NLHKsM1nmveCJf-9nhvT6W67oA:4 a=htsp1cwEuSoA:10
a=6-9Fr_h7AAAA:8 a=Vm2oXCpbAAAA:8 a=n4JkmEeXAAAA:8 a=W_LaJHSTY1FKiyaM68cA:9
a=aa2LJqmKak3HsCtWz3EA:7 a=2hL6MRTsiU3c-Xv2ucuIwzcZna0A:4 a=ojskhZjZVJUA:10
a=pM-imOxlMqoA:10 a=fd-QgsGfzTIA:10 a=AfD3MYMu9mQA:10
X-CM-Score: 0.00
Message-ID: <802858ce0ad3496e988f0c3c39bc0060@alex>
From: "Domain Name Support"
To:
Subject: Notice Regarding Your DOMAIN NAME
Date: Tue, 28 Oct 2008 01:16:39 -0400
The originating IP address is 68.230.241.45 which is Cox Communications.. but we also have a domain name of worldswidedomainname.com. The WHOIS details for that domain match the sender's name:
Registrant:
Alex Shafts
504 LEONARD AV
Las Vegas, NV 89106
US
Domain name: WORLDSWIDEDOMAINNAME.COM
Administrative Contact:
Shafts, Alex worldsdomainnames@yahoo.com
504 LEONARD AV
Las Vegas, NV 89106
US
702.5431469
Technical Contact:
Shafts, Alex worldsdomainnames@yahoo.com
504 LEONARD AV
Las Vegas, NV 89106
US
702.5431469
Registrar of Record: TUCOWS, INC.
Record last updated on 24-Oct-2008.
Record expires on 25-Oct-2009.
Record created on 25-Oct-2008.
This domain is just a couple of days old which sets the alarm bells ringing. A Google search for "504 Leonard Av" comes up with a couple of YouTube videos [
1,
2]. It turns out to be a
foreclosure sale, OK that really sucks for Mr Shafts but it is no excuse to sent out spam.
So, what
is this spam trying to get you to do? Is it important? Nope. It's actually just spam for the LunarPages affiliate program. Web hosting affiliate programs can be big earners - in this case LunarPages pay $65 per sign-up. Not bad, but all this email is trying to do is get you to sign up for web hosting. It is in no way an official notice from your registrar.
We know that desperate situations lead to desperate actions, but sending out spam and what is basically deceptive advertising is not going to help.
Added: just to prove himself a bigger idiot, the mailing list that he created to send out the spam ALSO accepts email from absolutely anyone so now there's a real shitstorm of comments, autoreplies and bouncebacks. What a plonker.
Added: check out the comments to this post, also this
blog entry has more details. I have made a follow-up entry
here explaining the problem in more detail.
