Spam Links

This blog has moved

2010-04-05T12:52:00.001-07:00

This blog is now located at http://blog.spamlinks.net/.
You will be automatically redirected in 30 seconds, or you may click here.

For feed subscribers, please update your feed subscriptions to
http://blog.spamlinks.net/feeds/posts/default.

Appliances are cool - but are they the best?

2008-10-13T10:47:00.000-07:00

GFI software might have a vested interest in convincing you that buying their software is better for you than getting an anti-spam appliance or using a hosting service, but it's worth a read of what they have to say anyhow. On appliances, they make the interesting observations that:

If the appliance fails, company is down until a replacement arrives

and

Does not give any flexibility to the IT administrator

The case against using hosted anti-spam is a bit thinner: it boils down to a loss of control, but Internet email is hardly a secure end-to-end system in any case, even if you run your own mail servers:

Inability to take decisions and implement immediately

See their full articles "Software vs. Appliances" and "Software vs. Hosted Services" for their breakdown of the costs and benefits of each approach.

Spam Links blog reboot

2008-08-24T07:33:00.000-07:00

There have not been any posts here for a while - that is about to change. All of the archives will shortly become available again.

The sound of spam: GFI heralds new mp3 stock scam

2007-10-18T12:00:00.000-07:00

Spam now has a sound. This isn't the latest headline in a science magazine - no one has been hitting tinned meat with a spoon and recording the results (as far as we're aware).

Instead, the sound of spam is the latest in a series of types of file that pump-and-dump stock spammers are using to evade spam filters and make their email more attractive.

First they used text, then they mangled that with @ signs and strange layouts. Once the spam filters caught up they switched to GIF images, tried various files attached to spam, like PDF documents, and have just caught on to sound files.

One sample identified this morning by GFI, was a heavily distorted 30-second MP3 file. A synthetic female voice was used to promote a particular stock. This voice is distorted to avoid filtering approaches based on the file signature.

Once again, spammers are taking advantage of the fact that the MP3 format is one of the most common in use today, another attempt at social engineering.

GFI Software have uploaded a sample on their website, if you want to listen to it. For further details read GFI's mp3 spam roundup.

Evaluating E-Mail Security Solutions

2007-07-01T12:00:00.000-07:00

Selecting an antispam solution is a major undertaking even for seasoned IT professionals. How do you make the best choice when hundreds of solutions are on the market? How do you ensure that you get the best value for your investment? And, how do you guarantee that you continue to maximize value throughout the life of the product?

In this article, we examine some of the key factors to consider when selecting an antispam solution. Follow on articles will provide more insight and information to help you make an informed choice.

Hint - It's not AntiSpam!

Surprisingly, antispam capabilities should not be your primary consideration! Certainly everyone wants unsolicited trash removed from their in-basket - but not at the expense of legitimate e-mail.

The goal of any e-mail security solution is the accurate, reliable and consistent delivery of legitimate e-mail. Antispam capabilities are secondary!

People usually don't mind the odd bit of spam as long as they can trust a product to always deliver e-mail from established peers. We refer to the predictably correct handling of e-mail from established peers as consistency.

Your customers do business with you because you deliver consistent, predictable value. People who travel often visit familiar restaurant chains because they know what to expect. And, consistency should be the primary criteria in selecting an e-mail security solution.

Surprisingly, most vendors don't publish consistency data. This lack of hard data makes it especially challenging to satisfy yourself that a product is capable of predictably consistent filtering. Unless a vendor provides some guarantee of performance, it is safest to assume that consistency isn't a feature of a product under consideration.

If the vendor doesn't offer consistency metrics (and you are still interested), look for Black & White capabilities. Black lists are lists of unwanted senders while White lists are lists of wanted senders. Black lists are mostly ineffective (as spammers regularly change addresses). White listing may be effective in preventing unwanted rejects but won't help much in stopping spam. This is because White Lists are very easy for spammers to defeat.

Measuring Filter Effectiveness

Four key metrics should be considered when selecting an antispam solution:

1. Consistency

A product should learn your e-mail peers and never, ever reject e-mail from them (exception: viruses). Any consistency rating below 100% is not acceptable.

2. Accuracy

The percent of time the antispam solution gets it right. Products that don't offer at least 95% filter accuracy are probably not worth considering.

3. False-positives

The rate at which wanted messages are incorrectly rejected as spam. This value should be as close to zero as possible. Products with false-positive Values above 1% probably don't belong on your short-list.

4. False-negatives. This is the amount of spam that is incorrectly allowed through the filter. This is the least critical metric but still worth investigating.

There is an inverse relationship between accuracy and false-positives. Some vendors are so aggressive in scanning for spam that they incorrectly reject large amounts of legitimate e-mail as spam. In NetworkWorld's December 2004 study of antispam solutions the product with the highest overall filter effectiveness (99%) also had an unacceptably high false-positive rating (5.52%). If you used this product, over one in twenty legitimate e-mail messages would be rejected as unwanted. No business could tolerate this type of behavior.

Appliances, Server Software or Desktop Solutions

Spam, viruses and other malware are not only unwanted - they are dangerous and pose a significant risk to your business. To minimize risk, it makes sense to block unwanted traffic as far away from your users and mail servers as possible.

Appliances

E-mail security appliances face the Internet and act as your primary mail gateway. They stand in front of your mail server and reject unwanted traffic before it reaches your mail servers or desktops. Risk is minimized because unwanted traffic never reaches your users or servers.

Because appliances include hardware, you don't need to provision expensive server systems to run your security solution. Appliances should be easy to install, configure and run, and should offer administrative and reporting tools.

Appliances are the only class of antispam protection that removes work from your e-mail server (thus freeing it to handle more users and legitimate e-mail).

E-Mail Server Software Solutions

E-mail server software solutions are products that install on your mail server. They extend your mail server software (such as MS Exchange) product by adding more sophisticated antispam and antivirus capabilities.

Server software products are usually fast and easy to install. They are easy to run and are tightly integrated into your mail server. Server software solutions may even be inexpensive (because you've already bought the hardware and operating system) and can be effective. They are most attractive to smaller deployments where cost and ease of use are key.

The major disadvantage to server software products is that spam and viruses actually make it to your mail server. Your hope is that your e-mail security product will stop them before any damage is done. If your server software product misses a malicious message, your mail server is put at risk.

Another concern is the amount of resources that e-mail server based antispam products steal from your mail server. Mail servers are expensive to buy and license. Any product that forces you to buy more hardware than you need or license more users than you need is costing you $$ well beyond the cost of the software.

Because of the risks and hidden costs of server based e-mail protection, we do not believe this approach is effective for any but the smallest organizations.

Desktop Antispam Solutions

Products in this category are usually targeted at retail consumers. The reason is that professional IT departments have better things to do than run around to every PC and install, configure, lock down, manage, upgrade, tune, train and fix desktop e-mail security products.

Desktop e-mail security is unattractive to business because the labor cost involved with these products usually far exceeds the benefits provided. Even worse, by blocking spam and viruses at the desktop, you are allowing unwanted and malicious traffic to travel through your mail server - putting it at significant risk.

Know Your Rights - Read The Fine Print

You don't really know what you are buying until you read the fine print. License terms and conditions vary widely and may severely impact your ability to derive ongoing value from the product. Here are some things to look for:

License Start & End Dates

Does your right to use the product expire? If it does, it is likely that you will have no residual value beyond the expiry date. That may force you into another expensive acquisition or a costly renewal agreement.

With software only products, the residual value of the product on the expiry date is most likely $0.00.

Per User Licenses

Does the product you are considering charge by the user? If it does, you had better find out what the vendor considers a user. E-Mail aliases, generic e-mail accounts, e-mail addresses being forwarded and other items may all count as users to your vendor. If they do, you may be forced to buy many more licenses than you have people in your company.

If you are willing to consider per-user licensing, look to buy blocks of user licenses rather than exact license counts. That way, you can add staff or e-mail addresses without having to take out your check book.

Is Everything Included?

Verify that everything you need is in the base price. Satisfy yourself that you get maintenance, support, updates, and new features (including antivirus protection) before you buy. By not doing your homework up front, a good deal may not look that way after you've had to purchase expensive upgrades and add-ons to get the protection you need.

Support & Update Services

Because the spammers constantly change their strategies, you need to ensure that the product you select remains effective. The best way to do this is to subscribe to the vendor's support and update services.

Look at the timeliness of updates. Who updates your product (you or the vendor)? If it is you, have you budgeted administrator time for this task?

Do Your Homework

Product accuracy and effectiveness claims are usually derived from tests performed by the vendor or someone the vendor has contracted. As a result, you should treat all vendor claims with a degree of suspicion.

Verify consistency, accuracy and effectiveness claims by checking published reviews. NetworkWorld's December 2004 study of antispam solutions is still the most thorough review conducted. In this study, NetworkWorld reported accuracy scores on some products that were as much as 5% below the vendor's claim.

Get Independent Verification

A great source of information on how a product might perform is a customer who is currently using that product. Look for customers in your industry who have at least one years experience with the product (so that the initial euphoria has had a chance to wear off). Ask them about effectiveness, updates, false-positives, accuracy, server resource consumption, user involvement and administrator overhead. Be wary of products that require a lot of human intervention.

Even this isn't a perfect predictor of what you can expect because spammers can and do target different companies in different ways.

Calculate TCO

Once you've created your short list of potential vendors, estimate the Total Cost of Ownership for each product. Estimate how much mail and spam your users handle each day. Use the accuracy rating, consistency and false positive rates along with your average salary costs to determine how much time and money you will save by blocking unwanted messages. Then reduce your savings by the cost to purchase, license, deploy, administer and work with each solution. Assign high costs to any false-positive estimates you have (due to the potential impact that a false-positive may have on your business).

The result should be the true cost of ownership and realized benefits of a solution.

And The Winner Is...

The product to buy is the product that delivers the lowest Total Cost of Ownership along with the highest accuracy and consistency rates. This is the product that will return to your organization the greatest overall benefit from your investment.

Spam Calculators

There are a number of great antispam cost/benefit calculators available. Again, NetworkWorld provides another excellent resource in your war against spam.

__________

Copyright 2006 by Larry Karnis and XPMsoftware.com. All rights reserved. All products are trademarked by their respective owners. Please feel free to contact the author with your questions and comments.

Virtually solving the spam problem

2007-05-18T12:00:00.000-07:00

What do you do when you have too many physical servers to fit in your server room but not enough servers to run all of your workloads? Answer... virtualize.

So say XPM Software, makers of just one of the virtual appliance spam filters becoming available.

If you want the ease of a VM, but still with the raw power of your own hardware, you can run off a pre-done ISO image.

Either way, you save on system administration tasks and can concentrate on getting the spam filter to do what it is meant to do.

DDoS on spamlinks.net hosting and anti-stock spam sites

2007-01-27T12:00:00.000-08:00

The host for spamlinks.net, spam.abuse.net, and others was
subjected to a distributed denial-of-service (DDoS) attack starting Friday 12th
January 2007. The attack peaked on Sunday 14th and was largely mitigated around 4pm (PST). A low-level attack was still underway as of 17 January 2007 and efforts are continuing to mitigate it.

At least two other spam related websites (worldwidespam.info and spamnation.info - both hosting information about stock spam) were subjected to DDoS attacks at or around the same time.

Reply to "Link exchange spam – I've had enough, thanks!"

2007-01-17T12:00:00.000-08:00

In a previous post on link exchange spam, I briefly outlined receiving a series of spam emails advertising MiraPoint, and sent by DigitalGrit.

The following was sent by Steve Curtin – Corporate Vice President, DigitalGrit.

Posting this does not represent an apology, and I will follow this up with a further reply I sent to Steve.

Here is Steve's reply:

Ouch. We obviously owe you an apology and an explanation – which I'll preface with the fact that we are 100% dedicated to best practices, and we are *not* spammers.

As an agency working for Mirapoint, a company committed to combating spam, we noted in your FAQ's an invitation for requesting links (http://spamlinks.net/about.htm#faqs-add) and sent an email per your instructions. So, your blog is extremely relevant, you list commercial vendors, and provide guidelines on submitting links. We did our very best to play by your rules.

Here's where we slipped: our employee inadvertently created 2 emails rather than 1 requesting to be listed on your blog. How did that happen? Well, two emails were created since you have 2 pages listing commercial vendors. Obviously, we should have generated one email for the request, but due to human error that didn’t happen - again, my apologies, but as we're all human, some cutting-and-pasting happens, hence the identical emails. Again, HUMAN error.

And, I'd like to reassure you, that as we do not believe in using automated solicitations like the ones described in your post, the emails that you received were sent by an actual human employee of our firm. And, in our defense, the employee who sent those emails did include his real name, a return email address, and an explicit identification of our company in full compliance with the CAN-SPAM Act.

So, to reiterate, we do certainly own up to having made a mistake – and one that clearly raised your ire – and please accept my apologies on behalf of DigitalGrit for that. However, at the same time, I feel it important to convey that we are more than a little upset and disappointed in having been branded a "spammer" in your post. That's just not who we are. For the record, who we are, in fact, is one of the top 25 Best Small & Medium Companies to Work for in America, as noted by the Society for Human Resource Management and one of the Best Places to Work in New Jersey, as noted by NJBIZ for the past two years (including the #1 ranking in 2005). And as the leader of DigitalGrit's SEO practice, I personally want to assure you that we are 100% white hat.

So, please accept my sincerest apologies again for the annoying emails. Despite our missteps though, we do feel that Mirapoint offers a product worthy of listing on your site along side the other products you list, and I hope you'll take the time to review Mirapoint's products.

Thanks for your time and consideration,

Steve Curtin – Corporate Vice President,

DigitalGrit

Link exchange spam – I've had enough, thanks!

2007-01-11T12:00:00.000-08:00

Search engine optimizers are getting on my nerves. To cut a long story short, they are sending spam to Spam Links to try to get all sorts of sites listed.

The worst of it should be familiar to anyone with a website with a decent page rank — "Link Exchange" subject line spam, offering to include a link to my site in an awful link farm, in exchange for me placing the link of choice (unrelated to spam) on my website with their provided fluff-piece.

Even Google gets this stuff:

Dear google.com, I visited your website and noticed that you are not listed in most of the major search engines and directories...

Some SEO spam that I get is asking for an anti-spam site to be listed on... well, usually the most inappropriate page of the 100+ pages on Spam Links. Most of the sites aren't even spam related. Some let me know that they have added my link to their site, and then demand that I add their site in a particular way or... their link to my own site will be removed! Oh. No. Some examples of the badly worded email I get:

I've visited your site today, and I appreciate the site. My below mentioned website is similar to yours. Kindly consider listing it under your "Links" section.

As a part of ongoing campaign to increase the Link Popularity of My website I am looking for some good potential sites like yours.I review your site and find that, in SEO perspective your site is Perfect. Also, this would be a great resource for my visitors too.

I have my client website related to "Email Security". This website provides details for Secure email wordwide...

I thought a good place on your site to link from would be on your links page.

As you are probably aware that a three way link exchange is a great way to boost up your page rank in major search engines.

The cause of all this is unscrupulous or unskilled (or both) SEOs using bulk keyword searches. They search the web for websites that match a keyword search (in some cases, they even include the keywords they used to find the page they are wanting to get linked from), harvest the contact email addresses for those websites, and then send bulk email to the contacts asking to be linked to. Let me be quite clear: there is no grey here. There is no accident, and no excuse. This is simply spam.

It was with particular dismay that I opened a recent "link exchange" spam, to be met with a familiar domain: MiraPoint.com. They are well known for making RazorGate, which is a network appliance spam filter. They had apparently contracted a company called DigitalGrit, who appeared to have taken it upon themselves to really out-do all of the other SEOs and make it totally obvious they were sending spam.

Two emails arrived within the same second, both identical save for the page they wanted linking from, and the keywords they wanted me to use to link to the site. Slam-dunk spam, as far as I was concerned. DigitalGrit followed it up with a further two bursts of two emails, structured almost identically to the first batch. MiraPoint have not replied to several emails asking for an explanation.

[Update: DigitalGrit have sent a reply in response to this blog post, which is included in a new post. I have also edited the section above to more fairly represent what I experienced.]

MiraPoint are not the only anti-spam website pushed like this, but I haven't given the others the chance to explain themselves, so I shall not list them. One of the anti-spam sites was carrying out their own optimization. They claimed not to have sent significant numbers of emails, but they did use an SEO tool, Web CEO, that is essentially an email address harvesting and bulk email tool; using it would seem to lead almost inevitably to spam, by design:

Use the link exchange software of Web CEO to sort websites based on how you want to contact them - personally or automatically. The Link Partner Finder helps you create bulk messages using templates. This link exchange tool harvests the e-mail addresses from websites you wish to contact. You’ll be proposed with patterns of letters to your potential link partners, provided for possible cases. The software can send large quantities of messages automatically. But you should create personalized letters to those that are most important for you

LinkMachine has been another source of link exchange spam, and there are probably quite a number of SEO tools that work this way.

Some blackhat SEOs do not even pretend that what they do is not spam. One even hosts a blacklist of sites not to contact, which Spam Links is a member of. I will be sure to check it for any new links...

There is a key difference between the spamware programs and what seem to be more responsible packages, such as Solo SEO, that allow the user to discover "potential link partners". They talk strongly about assessing quality, and do not automate the contact process.

While I am not totally enamored with the concept of building links by going begging, an application should at least not automate the process to the point that spamming is trivial. Why is automation a concern?

Consider what happens if everyone who owns a website acts like that, and the answer should be quite clear. It is the usual catalogue of reasons why spam is wrong. Search engine spam is also an issue, since the point of link exchanges is usually to gain ranking in search engines, rather than direct traffic from the link-hosting sites.

What obviously moves a link building email campaign into the realm of spam is when the website owner the request is sent to is clearly not soliciting link exchanges, or does not run the kind of website that accepts links, particularly if the link has nothing to do with the website's topic. It all comes back to the reason that spam is defined as unsolicited bulk messages - if you bother a lot of people who do not want to hear from you, you are a nuisance.

If you automate the contact process, you cannot know if the website owner is soliciting link exchanges; if you use templates to contact the site owners, they cannot reasonably know that you are not spamming, and will react accordingly. It is in everyone's interests to be straightforward, upfront, and to bear in mind that webmasters are not just a resource to be exploited.

[I received a reply to this blog post from Steve Curtin, Corporate Vice President of DigitalGrit. I have included it unedited in a new post.]

Oversee.net's Chesterton Holdings carry on domain swiping as Maltuzi Holdings

2007-01-03T12:00:00.000-08:00

The world of domain swiping continues unabated. Oversee.net and their operations, who I covered before, continue to domain taste and, apparently, to domain swipe.

To summarize:

Chesterton Holdings swipe domains following whois searches in online whois portals
Chesterton Holdings register those domains through NameKing.com
Chesterton Holdings use the Information.com service to monetize the domains

The same goes for Jucco, Munchale, and LaPorte, and all of the other "holdings" companies.

And the link to Oversee.net?

Oversee.net own NameKing.com, their pet domain registrar
Oversee.net own DomainSponsor, which operates Information.com
Oversee.net share a corporate HQ with Chesterton Holdings

You can read the original post for more details on the connection between Chesterton Holdings and Oversee.net.

Since I detailed the links between the domain swipers at Chesterton Holdings and Oversee.net, Oversee have publicly admitted the connection between Oversee.net and Name King, the registrar they use to make their "domain tasting" operation possible:

My name is Jothan Frakes. As Tim mentioned, I'm a senior account manager at a company called Domain Sponsor. In the interest of full disclosure and to make sure there's integrity to this session, I do want to disclose that my parent company [Oversee] owns a registrar, Name King, and that company does participate on behalf of its customers for domain tasting or add grace use.

While checking to see if Chesterton were still going, I found that only the websites for the "holdings" companies Jucco and Field Lake and Sky remain, with an obvious reference to "Chesterton Holdings LLC" in the code for their webpages. I also stumbled across a page describing the operations of an apparently new company, "Maltuzi Holdings". Chesterton have gone fairly quiet, and it should be no surprise that Maltuzi are just a new incarnation. They have garnered the same attention and reputation as Chesterton did at first, yet the connection between Maltuzi and Chesterton has not been noticed.

In case there is any doubt about the connection, the Maltuzi website shares the same reference to Chesterton in its code as the Jucco and Field Lake and Sky websites:

<param name="movie" value="Chesterton Holdings LLC.swf">

Sure, more care may have been taken on the company address, using a forwarding address in the "Downtown Mountain View Center", but the registered agent used for their company registration is identical to that used for Chesterton Holdings.

Maltuzi also uses NameKing.com and the Information.com services, owned by Oversee.net, just as Chesterton Holdings did.

There are a lot of complaints about Maltuzi (inevitably, given that they are swiping domains).

Business Week seem to have got a response out of Maltuzi:

T. Salonen, manager of Mountain View (Calif.)-based Maltuzi, says his company is a "bulk registrant" of domain names, but says there's nothing wrong with that. "We are actively buying domain names based on a variety of criteria," he writes in an e-mail interview. "We...purchase those domain names which have certain traffic levels or pay-per-click viability and return those which do not meet those and other criteria."

That doesn't say very much at all that we didn't already know, and very little about domain swiping, or the connection between Maltuzi and Oversee.net.

Specific sources for the swiped domains are again unclear, but one post describes using Instant Domain Search, and then losing a domain to Maltuzi, which fits the previous method identified by Larry Seltzer: the CNet Domain Search page.

DomainTools (run by Name Intelligence) claim that domain swiping is a myth, and that names are simply registered by coincidence, but that doesn't line up with the facts. Instant Domain Search are similarly dismissive in replies to a blog post fingering their site as a source of domain name leaks. Did Chesterton really register "lickmynose.com" by complete coincidence, so soon after Larry looked it up? I think not!

If there are markets of whois query information inside the lookup and registrar communities then having NameKing.com gives Oversee.net (and so Chesterton, Maltuzi, etc.) easy access, whatever the methods. My favorite theory is that the whois meta searches go off and query every accredited registrar: NameKing.com is the registrar owned by Oversee.net, who appear to also operate Maltuzi... easy.

The ups and downs of the Maltuzi domain portfolio can be followed at the excellent IPWalk, and they feature high in DailyChanges and the DomainDB top DNS lists. We're talking seven figures of domains, and daily changes of six figures, as before with Chesterton and friends.

Domain tasting and swiping are still very much in the news, but with major benefactors such as Oversee.net involved in ICANN and not fully disclosing what they do under the banner of "holdings" companies, the prospects for eliminating domain tasting and swiping or discovering exactly how Oversee's holdings operations are "swiping" domains appear remote.

A step has been taken in the right direction by the .org registry, but whether that is effective and how the rest of the name space is dealt with by the industry and by ICANN remains to be seen.

Oversee.net and Maltuzi did not respond to queries.

Domain swiping is an abuse of the trust that users place in the whois services, and domain tasting is causing real harm to others, such as real costs for registrars. If the domains involved are typo-squatting (as a great many are) then users are being manipulated into visiting sites that they never intended to visit, and trademarks are being abused.

None of domain swiping, tasting or typo-squatting are spam, but they all demonstrate the same contempt for others that characterizes spam.

Chesterton Holdings are swiping spammers' domains from under their noses - but who are "Chesterton"?

2006-09-17T12:00:00.000-07:00

Domains used by spammers in links to their websites have recently been swiped by an outfit calling themselves "Chesterton Holdings". Far from being a white knight vigilante, it seems Chesterton may themselves be a nuisance, part of a murky corporate world of "domainers", domain kiting and pinched whois searches.

I was checking out a spam sent on 1st August from a "Pharmacy Express" spammer (possibly Yambo Financials) selling "Vijagra" and "Cijalis" from a site called www.brotersad.com. To my surprise the website was one of those holding pages, used to make money out of dormant domains. It had entries to sponsored links for "Sexual Enhancement" and "Phetermine", so while it wasn't what the spammer wanted me to be seeing, curiously it did seem to know in what context the domain was to be (or had been) used. The site served links from Information.com, and a search for words on the page found several more holding pages like this hosted by Information.com. The spam was sent on the 1st, and the domain was registered by "Chesterton Holdings" on the 2nd, through the registrar Name King.

On the second occasion a week later a spam this time certainly from Yambo Financials was affected. Instead of going to a page for MyCanadianPharmacy, the URL redirected to a page entitled "Zeretcon.com: What you need, when you need it". This is the Oversee.net "DomainSponsor" service. Thousands of other sites share the same layout. Oversee.net own Information.com, so the previous site is probably part of the same service. The domain was registered in the same way to "Chesterton Holdings" very soon after (or even before) the spam was sent, giving an address and phone number in Los Angeles as the registration details.

A phishing domain has also been grabbed by "Chesterton Holdings", again with text on the holding page tailored to the right topic, such as "Midamerica Bank", and with the same "What you need, when you need it" tagline and layout.

At first sight it looks like Chesterton Holdings are somehow discovering domains that a spammer is using or intends to use in spam, registering those domains with Name King before the spammer gets there himself, and then using Oversee.net's DomainSponsor service to "monetize" the domain. The uncannily accurate wording on the would-be spam or phishing site may be influenced by people searching in the box on the page for words relevant to the phish or spam that lead them to the page. Using those words, the sites cleverly adapted their contents, as the DomainSponsor site boasts.

So, who are Chesterton Holdings?

On the chestertonholdings.com website they claim that they "acquire our names in bulk through proper channels and sophisticated technology", which doesn't make things any clearer, and sounds downright fishy. A few incidents, most notably covered in eWeek's "Whois Hijacking My Domain Research?" by Larry Seltzer with more comments elsewhere, suggest they may be domain kiting (or domain tasting) after somehow acquiring results from web based whois lookups - which does not sound like entirely "proper channels" (as the spammers like Yambo might agree). The suspicions of domain kiting were confirmed by DailyChanges, who track domain sales - Chesterton both bought and sold over 100,000 domains in one day in August 2006, which is a sizeable portion of the total daily adds and deletes.

Research by Brad Waller on ReveNews (using tools listed at Server Usage> on Spam Links) shows that several similar companies are operating from the same server: 207.234.147.193 hosts Hornbrook Holdings (hornbrookholdings.com), Hornbrook Company (hornbrookcompany.com), LaPorte Holdings (laporteholdings.com), Jucco Holdings (juccoholdings.com), Munchale Holdings (munchaleholdings.com) and Field Lake and Sky (fieldlakeandsky.com), all registered with similar details and all through Name King.

A search of California State records (found off US States Public Records on Spam Links) showed that Chesterton Holdings and LaPorte Holdings are registered businesses in California, while Munchale Holdings is now suspended. Both Chesterton and Munchale were registered on 10/28/2004 at 818 West 7th St Ste 700, Los Angeles, CA 90017, while LaPorte was registered on 9/13/2004 at 5482 Wilshire Blvd #128, Los Angeles, CA 90036.

Looking into Name King, the registrar for the domains, showed that unusually there was no way to sign up to register domains with Name King on their website. One site, Domain Cargo (domaincargo.com) claimed to register their domains via Name King, and unconvincingly implied that they are separate entities. Neither NameKing nor Domain Cargo were registered as companies in California, though Domain Cargo's whois showed the registrant as Munchale Holdings, linking it back to Chesterton Holdings. Name King have been involved as registrar in past domain squatting cases, for the majority of which LaPorte were registrant and failed to answer the complaint. Of the rest, some were against "Horoshiy" and Jucco Holdings. When I checked a domain "gapbusters.com" that was once owned by Horoshiy it was instead registered with Jucco Holdings, so it is possible that Horoshiy is linked to Chesterton and friends.

Looking more closely at the registrations for the various domains listed earlier, I could see that the domains hornbrookcompany.com, hornbrookholdings.com, chestertonholdings.com, juccoholdings.com, munchaleholdings.com and fieldlakeandsky.com all had name servers provided by nameking.com and were all served from the single IP 207.234.147.193, hosted with Affinity Internet. The Name King servers were hosted out of one of Oversee's IP ranges, which suggested a connection between Name King and Oversee.net, who provide the holding pages.

The addresses used for Name King (2202 S. Figueroa St. Suite 721, Los Angeles, CA 90007), LaPorte (5482 Wilshire Blvd #128, Los Angeles, CA 90036), and Chesterton, Domain Cargo, Munchale, Hornbrook and Jucco (655 Flower St #253, Los Angeles, CA, 90017) were respectively a UPS store and two MailBoxes etc. stores. The Chesterton (and Munchale) Holdings corporate registration address (818 West 7th St #700, Los Angeles, CA 90017) is located right next to the second MailBoxes store, and a short drive both straight up S. Figueroa St to the UPS store and up Wilshire Blvd to the first MailBoxes store. Only fieldlakeandsky.com does not fit in - it is in Wyoming - but the address is another MailBoxes store. At one point the same West 7th St address was given in , but seems to have been altered since, so Name King and Chesterton, LaPorte etc. are one and the same, not registrar and customer!

Checking the phone numbers in the domain registrations, I confirmed that they are all in the core of the downtown Los Angeles business district. The number for Name King (213-220-5715) is a cell phone, as are those for Chesterton (213-407-1774) and Hornbrook/Jucco (213-924-8981). Those for Domain Cargo/Munchale (213-612-0610) and LaPorte (213-683-9910) are fixed lines, and a business reverse search on this last number of LaPorte's gave the same W 7th St address as for Chesterton Holdings, possibly taken from an old whois registration.

Going back to Oversee.net, who provided the DomainSponsor holding pages to which the swiped domains pointed, I found that the Oversee.net company headquarters are located at exactly the same address (down to the suite number) as that given in the Chesterton Holdings corporate registration - and both use the same company, Paracorp, as their registered agent. The suite number (700) was confirmed by the address given on low.com, an Oversee.net site, and on whois registrations for Oversee.net's networks. This address is also that at which Name King once gave an address in whois, and with which LaPorte holdings is associated by a reverse phone lookup. The post boxes are thus conveniently located a short drive from the Oversee.net headquarters, and the Oversee.net corporate address coincides with addresses used by Chesterton and in the past by LaPorte and Name King.

The picture that emerged was that Chesterton Holdings (and the other "holdings" companies), Domain Cargo and Name King are closely tied with each other, and with Oversee.net. Name King appears to be used to allow the group to register domains for themselves, and the holdings companies are used to dissociate the less PR-friendly activity from Oversee.net. By using mailboxes and registered agents, the relationship between Oversee.net, Chesterton Holdings, Name King and Domain Cargo was shrouded, but the evidence shows that all of them are run from the same offices. The same conclusion is reached in this thread on Domain State, though the corporate registration piece is missing from their jigsaw puzzle; this is picked in up this digg thread on the same topic.

A Friendster page of an Oversee employee helps confirm the link: Vy Tran lists her companies as "LaPorte Holdings, Oversee". That may have been enough to have her personally named in a lawsuit that the Scouts brought against Oversee back at the start of the year.

Who are Oversee.net?

Oversee.net is an Internet advertising company. A large part of their business revolves around "monetizing" and growing their domain name portfolio. Lawrence Ng is the head of Oversee.net. Aged 21, in 2000 he co-founded the company with Fred Hsu. Ron Sheridan is Director of Business Development, whose saying is "He who controls the traffic, makes the rules". Jothan Frakes is Director of Strategic Accounts, who hosted a recent ICANN meeting on these very issues in the "domain marketplace".

Swiping and monetizing domains searched in whois might appear to be a natural extension of the Oversee.net business model ("He who controls the traffic, makes the rules"), but given the secrecy surrounding the Chesterton Holdings page, Oversee.net apparently do not wish to be associated with this. The press contact for Oversee.net stated that the "business model of Oversee.net is not based on deliberate bad-faith domain registration", but failed to respond to further questions.

As to how domain swipers get the data, Larry Seltzer and others point the finger at harvested web based whois searches, but exactly from where and how the whois search data reaches "Chesterton" remains unclear. The number of domains registered as Chesterton Holdings is large and rapidly changing so it is likely they will cross another spammer or two (as well as less deserving victims) in the future.

Timeline:

30 Nov 2000 OVERSEE.NET company registered
18 Mar 2001 oversee.net registered
21 Mar 2001 targetwords.com registered
03 Jul 2001 inboxrewards.com registered
31 Jul 2001 domainsponsor.com registered
17 May 2002 proredirect.com registered
02 Sep 2004 C AND J VENTURES, INC. registered
13 Sep 2004 LAPORTE HOLDINGS, INC. registered
28 Oct 2004 MUNCHALE HOLDINGS, INC. registered
28 Oct 2004 CHESTERTON HOLDINGS, INC. registered
  Nov 2004 Oversee.net launches DomainSponsor 2.0
29 Nov 2004 hornbrookcompany.com registered
30 Nov 2004 laporteholdings.com registered
30 Nov 2004 hornbrookholdings.com registered
22 Jan 2005 First page in archive.org with NameKing.com in current form
08 Mar 2005 chestertonholdings.com registered
19 May 2005 domaincargo.com registered
03 Mar 2006 juccoholdings.com registered
07 Jun 2006 fieldlakeandsky.com registered
21 Jun 2006 munchaleholdings.com registered

(A similar domain swipe seems to have happened back in April this year, to the same "Pharmacy Express" spammer, this time affecting the domain swigotis.com. The site showed the same DomainSponsor layout, but the registration of the domain is to a "C and J Ventures Inc", based in Long Beach, California. It is not immediately clear how much this has to do with the main Chesterton Holdings domains, but the location may be more than coincidence.)

[Edited to add employee details, and move swigotis paragraph to the end.]

Loose Change have a screw loose

2006-05-08T12:00:00.000-07:00

The campaign surrounding the 911-conspiracy film "Loose Change" has decided that spamming out their message is the way forward to spread the word, in a thread titled "Mass Email, Need more email addresses". Loose Change justify this using various specious arguments such as "distributing the truth".

Sometimes they're too clever for their own good

2006-03-16T12:00:00.000-08:00

Sometimes spammers mangle their text by replacing letters with numbers or symbols that look somewhat like those letters, like "Cial1s T@bs" or the famous 16 million spellings of v1agr4.

Leo Kuvayev might not be getting many click throughs on one of his latest spam runs after he accidentally replaced letters in his links as well as his text, leaving the reader to work out that $ev@$to.c0m is supposed to be sevasto.com.

A Tribute to Norman De Forest

2006-02-13T12:00:00.000-08:00

A Tribute to Norman De Forest, who died earlier this month.

Quoting from the tribute:

He was a premier anti-spam fighter and worked with many others around the globe to battle the endless waves of rubbish sent out.

We didn't know Norman personally, but always respected his posts to nanae, and are sorry to hear this sad news.

IBM shift costs of spam to forged senders

2005-03-27T12:00:00.000-08:00

IBM have joined the growing body of users and promoters of challenge/response. IBM says

FairUCE eliminates any need for a "probable spam" folder, as well as the necessity of keeping up with the latest version of antispam software

but it can only achieve this by shifting the costs of dealing with hard to classify spam onto forged senders with real mailboxes.

There are some good concepts in their offering, FairUCE, but the authors state that their challenge/response part

alone catches 80% of UCE and very rarely challenges legitimate mail

and that

FairUCE sends a challenge only when the mail appears to be spoofed

which is a tacit admission that the system sends challenges to large numbers of forged senders. This can only contribute to the torrent of backscatter inflicted on receiving sites.

Choosing not to enter the filtering arms-race is an interesting idea, but using challenge/response to use forged senders as your filtering engine is not fair use of their resources.

Lycos to DDoS

2004-11-30T12:00:00.000-08:00

Joining a motley crew of anti-spammers who use questionnable tactics, are Lycos Europe, with their offering Make Love not Spam. Other than pointing out that their idea of carrying out Denial of Service attacks on spammers isn't a particularly new idea - it's just that the marketing department of Lycos are rather more visible than your average joe - there isn't a lot to add to what Aunty Spam has to say about the idea.

In case you didn't get the subtle hints, Lycos are on to a loser.