SPAM from performancing.com registration

Submitted by alderstone on February 8, 2007 - 7:05pm in
Members Lounge

I have my own domain, so set up email addresses such that if I get spammed I know where the source of my details was. When registering with performncing.com I used a new address set up specifically for use on this site and this site alone. This new address has never been used to send out an email from my machine, never given to ANYONE, and only used in the initial registration.

Emails to that address have, until recently, been associated with performancing.com, a total of 2 emails since I registered if memory serves me right. In the last 3 days I've had 2 Nigerian 147 emails sent to this address. My machine is firewalled up to the eyeballs, no viruses. This address has not been lifted from me, that's a certainty.

So, either the site's database has been hacked, or the machines of the site owners who send out the emails is virus riddled. Either way it sucks.

Those 2 emails are the ones I know about, the ones that my SPAM filters quaratined rather than discarded.

Same here (WTF?)

Submitted by BasL on March 13, 2007 - 11:03am.

I also used a unique address for subscribing to Performancing (i.e. perfomancing@mydomain.com). The following mail recently wasn't spamfiltered by my Gmail:

from: VERO KUKU
reply-to: sarafaraj00@yahoo.dk
to: undisclosed-recipients <>
date: Mar 13, 2007 11:47 AM
subject: MY BEQUEST

My name is Mrs. Sara Faraj- ALRUSHAID-Thomas,I have decided to donate what I have to you.
[cut]
sarafaraj00@yahoo.dk or sarafarajkuwait@yahoo.dk

In addition I received several messages that did get spamfiltered, like this one:

from: IRISH LOTTERY
reply-to: drlarryclark@yahoo.ie
to: infoielotto@m4.cn
date: Mar 13, 2007 11:09 AM
subject: WINNING NOTICE............REF/IE/9820X2/07

The Irish Lottery
P O Box 1010
11 G Lower Dorset Street, Dublin 1, Ireland
(Customer Services)
Ref: IE/9820X2/07
Batch: 084/06/ZY369
[cut]

i get them too

Submitted by Raj Dash on March 13, 2007 - 2:09pm.

I get them too, but didn't realize it was via Performancing. I'll talk to David.

And more...

Submitted by BasL on March 13, 2007 - 8:24pm.

from: RONALD BENSON
reply-to: ronald_benson202000@yahoo.co.uk
to: ronald_benson202000@yahoo.co.uk
date: Mar 13, 2007 5:43 PM
subject: 2007 JOB OFFER!!!!

Good day,

My name is Ronald Benson and i work for Global mineral sourcing agency in Asia/Africa/Europe.

@Raj: Please do, and tell him to please explain how this is possible.

And more...

Submitted by BasL on March 14, 2007 - 5:14am.

From: ONLINE LOTTERY PROMO <sengrant@windstream.net&gt
Reply-To: info_congrats@yahoo.co.uk
Organization: ONLINE LOTTERY PROMO
To:
Subject: Winning Notice!!!
Date: Tue, 13 Mar 2007 23:02:03 -0500
<20070314040203.DXUY3783.ispmxmta05-srv.windstream.net@webmail-relay.alltel.net>

This Email is to inform you that you emerged a winner of �552,000,00 on
our online draws which was played on the 14th of March, 2007
[cut]

Quite easy

Submitted by ifranky on March 14, 2007 - 11:15pm.

Basl, it is pretty easy actually to spoof email addresses and not that much can be done, unless the mail sender IP and mail software is configured only to allow certain IPs.

But I am sure David will look into that. Until then, maybe you could blacklist certain words, such as 'lottery' or 'winning'

Plain and simple

Submitted by BasL on March 16, 2007 - 9:33am.

ifranky, I know it's easy to spoof an e-mail address when sending spam. It would not be so easy to figure out _where to send_ your spam.

My subscribtion-address was unique for Performancing.com, and nowhere to be found on the Big Bad Interwebs. So to me it's plain and simple:

Either Performancing.com seems to have accidentaly 'dropped' their subscriber-list with our addresses, in a public place where a spammer got access to them. Or worse: our addresses were sold.