Holy Shmoly! » Email

Link Exchange Spammers Are Back Again!

Donncha O Caoimh — Tue, 14 Dec 2010 17:53:02 +0000

Well, the link spammers never really went away did they? Has anyone noticed a huge increase in the number of “link exchange” emails or is it that I’ve been added to a particularly busy spammer’s list? I just noticed that a few recent ones contained the text “emailsnomore(dot)com” so I’m going to add a gmail filter to delete any emails containing that domain. You probably should too.

Hi,

My name is Daisy Gibson, Web Marketing Consultant. Ive greatly enjoyed looking through your site ocaoimh.ie and I was wondering if you’d be interested in exchanging links with my website, which has a related subject. I can offer you a home page link back from my related websites all in google cache and backlinks which are:

shawntierney(dot)com PR4
collectiveunconsciousltd(dot)com PR3

If you are interested, please send me the following details of your site:

TITLE:
URL:

I’ll add your link as soon as possible, in the next 24 hours. As soon as it’s ready, I’ll send you a confirmation email along with the information (TITLE and URL) regarding my site to be placed at yours.

I hope you have a nice day and thank you for your time.

Kindest regards,

PLEASE NOTE THAT THIS IS NOT A SPAM OR AUTOMATED EMAIL, IT’S ONLY A REQUEST FOR A LINK EXCHANGE. YOUR EMAIL ADDRESS HAS NOT BEEN ADDED TO ANY LISTS, AND YOU WILL NOT BE CONTACTED AGAIN. IF YOU’D LIKE TO MAKE SURE WE DON’T CONTACT YOU AGAIN, PLEASE FILL IN THE FOLLOWING FORM: emailsnomore(dot)com ; PLEASE ACCEPT OUR APOLOGIES FOR CONTACTING YOU.

Related Posts

The worst targeted spam ever!

Donncha O Caoimh — Thu, 07 Oct 2010 12:16:32 +0000

I honestly thought that spammers had gotten smarter about making sure their emails were taken seriously. Even the most geeky and anti-marketing of developers will realise that big red and bold text, center justified, looks like something out of the last century. I hope for the sake of their business that they put more effort into their backup service.

This email, which I received twice in the last week is just a joke. I would have immediately marked it as spam and forgotten about it but it mentioned WordPress and obviously my email address is on their list of WordPress bloggers. I wonder if they read my blog?

At least they didn’t CC everyone like an Irish guy did a few years back.

If you want me to look at your new service, write me a nice friendly email, address me by name, email me from your own email address, talk to me about something you’ve gleaned from my blog or my twitter stream so I at least think you’re a friendly individual and I may even check out your site.

Related Posts

Email in 2009

Donncha O Caoimh — Wed, 03 Mar 2010 12:17:03 +0000

I just ran the following code on the 2009 archive of my inbox.

grep "From: " 2009|cut -f 1 --complement -d " "|sort|uniq -c|sort -nr|less

I received the most email from bots and scripts, among them WordPress.com, Twitter and Facebook. Of the real people here are the top 5 names you may recognise:

This was of course inspired by Matt’s post in January. I should do the same for Twitter replies/messages and for blog comments. I somehow doubt there would be much overlap between Twitter DMs and emails.

Related Posts

How to create Postfix database files

Donncha O Caoimh — Wed, 11 Nov 2009 11:19:57 +0000

Every time I come to recreate the Postfix database file when I edit the file /etc/postfix/virtual.cf I forget what command I need to recreate virtual.cf.db

Hopefully I’ll check my blog next time. The command is postmap. Hope this is useful for someone else too!

postmap /etc/postfix/virtual.cf
/etc/init.d/postfix restart

Related Posts

A pint of Guinness flavoured spam

Donncha O Caoimh — Thu, 07 Feb 2008 16:38:25 +0000

It seems that someone signed me up for “Guinness Poker Nights” and Guinness, God bless their black hearts, saw that as an invitation to spam me in the future.

I don’t know how to play poker, I have no interest in it, I don’t like the taste of Guinness. Why didn’t Guinness ask me to confirm the invite? That would seem like the most polite thing to do. Who the hell is Conor Wiley? I bet he knows the other Donncha who told all his friends and colleagues that my gmail address was his address. I was CCed on a few very personal emails for a day or two going back a bit ..

Since that time I’ve received a couple of spam emails from Diageo, the owners of Guinness. The first one gave me a start. I wondered if Guinness had started spamming people, but then I had things to do and never investigated. Here’s the latest email from Guinness:

There is a “Privacy Policy” link but that brings you to this page where I’m asked for my location and date of birth. The form has to be filled out before reading the policy. *sigh*

The “unsubscribe” link goes to http://trc1.emv2.com/I?a=A9X7CquNqKyt8QHHs6FEYtzjJX which the redirects to www.diageobrandsunsubscribe.ie. Finally, I thought I was getting somewhere, but no. To stop them sending me more spam I must fill out my name, address and email, despite the fact that I clicked on an identifying URL in the email.

Thankfully, entering, Mr. Blah Blah of 131215 and my email address into the unsubscribe form worked. I hope.

Diageo – please learn from your mistake. You should confirm invitations and registrations by email, especially when you send out marketing material.
Here’s what the Data Protection Commission says about spam. I certainly didn’t opt-in anywhere to be spammed. What do I do next?

Related Posts

Anatomy of an AIB Phishing Email

Donncha O Caoimh — Mon, 04 Feb 2008 10:26:09 +0000

I’m well used to getting phishing emails for American or internationally known banks but this morning an email supposedly from AIB made it past Gmail’s spam filters.

AIB posted an alert a few days ago to watch out for fraudulent emails, but this one appears to be different. I’m forwarding it on to alert@aib.ie

The content of the email is a Jpeg image, and it links to a php file on http://internetbanking.aib.ie.2.3h8ax3.com/

As the rest of this post has a number of large screenshots click the link below to read the rest. You can probably ignore this if you’re not living in Ireland.

Clicking on the image brings you to a very convincing AIB login screen.

After typing, ’12345678′ the next screen isn’t so convincing. AIB never ask for more than 3 numbers from the PAC.

I typed 1 2 3 4 5 and 1234 into this form. The form even advances the cursor on to the next form element like the real AIB site does.
Finally, I got to this form where I’m supposed to enter my email address.

If you’re interested, this is who owns the domain running the phish. Read all about it at domaintools.com:

Administrative Contact:
ah wen
        ah wen
        No.12 chang'an road
        beijing Beijing 100001
        China
        tel: 86 010 20940294
        fax: 86 010 24092049
        240@123.com

Related Posts

Does your Mr. Winkie need upgrading?

Donncha O Caoimh — Thu, 01 Nov 2007 10:29:17 +0000

Sometimes trawling through the Gmail spam folder is worth it. One email reminded me of the Scrub’s character, Elliot Reid and her fascination with bajingos.

Much more entertaining than the usual 419 scams ..

Dear Sir/Madam,

Please i need your answer, i am Mr. Latif Khalid, manager and head of computing department here in BANK OF AFRICA (BOA).I have only written to seek your indulgence and assistance. I wish to make a transfer involving a huge amount of £22.6,000,000.00.(TWENTY TWO MILLION SIX HUNDRED THOUSAND POUND STERLING).

Related Posts

Will Monster.ie get away with spamming?

Donncha O Caoimh — Tue, 02 Oct 2007 16:52:45 +0000

Oh dear. Monster.ie is the latest company to spam bloggers. Both Michele and Tom were spammed as part of an email campaign targeting it@Cork members. Monster harvested the emails from a members list on the it@Cork website which has since been removed.

Stewart Photo Supplies spammed a large number of photography related email addresses a few weeks back, but then they apologised which is great. Unfortunately someone from a Monster IP address left defensive and abusive comments so I don’t think an apology will be forthcoming.

Damien has dugg the post so give it a digg if you can! Tom has a new post including a voicemail he received from Monster threatening legal action. That’s bad, really bad.

Just say sorry John, it’ll help (a small bit).

The legislation surrounding this kind of behaviour is very clear, data can only be used for the purposes for which it is obtained. We in it@cork were obviously naive in publishing the members directory (since taken offline) but that doesn’t confer on anyone permission to harvest that address list and spam them.

The Irish Data protection Commissioner takes a very dim view of this and has the power to levy fines of up to €3,000 per address spammed (so potentially €570,000 in this case).

Update! Monster apologised and Tom has the email.

Related Posts

gmail: no third-party DSNs

Donncha O Caoimh — Tue, 04 Sep 2007 13:00:55 +0000

Be careful if you forward email to a gmail account. Gmail doesn’t like receiving mail delivery status notices or reports. This server filled up overnight with tens of thousands of email reports bouncing back and forth between it and gmail. If you emailed me in the last 24 hours and I haven’t replied, I may not have received it (yet).

postfix/cleanup[12107]: 9FE58326C1: reject: header Content-Type: multipart/report; report-type=delivery-status;??boundary=”A507733AD3.1188834275/mail.ocaoimh.ie” from local; from= to=: no third-party DSNs

I really haven’t had any luck with email recently …

How I fixed everything

First of all I disabled the forward to my gmail accounts by moving .procmailrc out of the way.
Then I deleted a lot of log files to make more breathing space for everything and watched the mail spool into my mail file.
That was taking too long so I shutdown Postfix and went into /var/spool/postfix/ and into the active, incoming and maildrop folders where I moved every file with the string “Undelivered Mail Returned to Sender” out of the way:

for i in `grep "Undelivered Mail Returned to Sender" * -rl`; do mv $i /tmp/xxx/ -vi; done
After restoring the .procmailrc, I restarted Postfix and lots of legitimate email started flowing again!
I added the following recipe to my .procmailrc which I hope will stop bounced messages getting to Google:

:0: * ^Subject: Undelivered Mail Returned to Sender POSTMASTER.txt

What caused the problem in the first place? A bounced email from Yahoo. Someone left a comment with a fake email address, subscribed to the post and when another comment was left on that post the subscription email bounced. It’s worked before fine so I’m not sure why Google are complaining now! Over 2GB of bounced mail. My poor server.

Update! It happened again but I stopped Postfix at 9.5MB free on the filesystem and this time I found out what went wrong. I implemented these Postfix rules Justin blogged about without running Spamassassin. Well, I used to run SA but then when I started using Gmail I stopped, which is probably why I didn’t see this earlier. Not Justin’s fault, my own for playing with fire!

Related Posts

Why not let Google filter your spam?

Donncha O Caoimh — Tue, 17 Jul 2007 14:18:58 +0000

I’ve been running Spamassassin and Postgrey on my mail server for the past few months. It was only since the server was upgraded that I had enough juice to run the very intensive SA processes (even using spamd), but still on occasion the server would grind to a stop when a particularly nasty Rumpelstiltskin attack was underway.

So, last week I met Mark for a coffee and he showed me his Nokia N90 (or N80, I can’t remember) and the gmail app that was installed on it. He collects his gmail email on his phone, after it’s filtered for spam, and what with the cost of GPRS data, that’s quite a saving. I don’t intend reading my email on my phone (I hate my W810i anyway), but he did give me the idea of sending my email through Google and then popping it off into Thunderbird!

Now, I have a simple .forward to send on my email. I was able to shut down Postgrey and Spamassassin and email is delivered quickly and with few false positives or spams getting through. When I think of it, I can use the web interface to check what’s due to come down the line. You also get the added bonus of encrypted pop3 data, useful when you’re at a conference or simply on public wifi.

I’m sure everyone else has been doing this for ages and ages but hopefully this will inspire at least one person to follow suit and rid themselves of spam once and for all!

Related Posts