The Problem

I have recently started, out of the blue, to receive daily SPAM.  I have had my e-mail address for 10+ years and had extremely rarely received any.  Yet, in the past couple of weeks, I started getting multiple items every day.  Each e-mail was coming from different domains  and pushing all sorts of products (that I have 0 interest in and never looked at or signed up for in any manner).

So I started digging and was entertained to find out that 99% of the SPAM e-mails were coming from the same individuals:

Ricky Alexis
1612 N Academy Blvd
Denver, CO  80909
Telephone: +1.7166948781
E-mail: ricky.alexis@aol.com

Rick Barry
8387 NE 10th PL
Orlando, FL  83274
Telephone:+1.838487474
E-mail: rick@yahoo.com

Erica Semente
11395 SW 79TH ST
MIAMI, FL  33173
Telephone:+1.3052658748
E-mail: ericasemente1@gmail.com

Lex Jones
AD GURUS INC.
8374 S BAYSHORE POINT
NEW YORK, NY  10010
Telephone:+1.2123879758
E-mail: lex_jones@aol.com

Also a protected registration
WHOISGUARD PROTECTED
WHOISGUARD, INC.
P.O. BOX 0823-03411
PANAMA, PANAMA
Telephone:++507.8365503

My gut tells me this are fictitious registrations, I have checked a couple  of their supossed address and gotten empty fields, street not found, etc.  So Enom sure isn’t doing much to validate the registrant information from my perspective.

Below is a summary of the SPAM received between 2014-Apr-03 and 2014-May-04:

What I have noticed while trying to put this information together is that the registrant information seems to change.  Originally, their were more domains registered to Rick Barry, yet today while actually compiling the above list, he seems to be disappearing.

There is a clear pattern at work here.  99% (I think that 2 are not) of the domains  are Registered through enom.com and hosted by namecheap.com.  They reuse the same sender name over and over: Online Doctorate, Business Phone System, Flooring Materials, and so on.

I also question their registrant information as I have looked up a couple on Google Maps and by doing online searches and one has lead me to a restaurant?!, others to what would appear to be vacant lots and even non-existent streets?

 

What I have been more disappointed about, regardless of people like this exploiting multiple domains to send SPAM, is that e-mailing the Domain’s ABUSE contact, abuse@enom.com, was returned as undeliverable because my e-mail was flagged as SPAM by Google!  Their exact message was: “Our system has detected that this message is likely unsolicited mail”.  So let’s get this straight, they allow domains to send out mass SPAM e-mails, but block someone trying to report them for their actions!  Way to go Google!  Ironic to say the least.

I followed up by using Google’s contacts form for such issues, including all the relevant information (e-mails, headers, …), but have yet to hear back from Google in any manner (I’m not holding my breath).

There is a reason why SPAM is still so popular when companies like Google, and many others, protect the abusers and make it impossible to actually report them, little alone do anything to stop them.

There is simply no reason why the hosting companies aren’t putting a stop to this when in one case I am referring to the registrants has 1000s of domains of which he is rotating through sending out SPAM e-mail with only hyperlinks (always the same format) and always using the same Sender Name and same pattern for the Sender E-mail Address.  These patterns can be detected and thus could be stopped.  Furthermore, when you see this type of thing, such registrants should have all their domains frozen, and they should be fined on a per SPAM e-mail basis (say $99/e-mail).  This is why a registrar/hosting company such as GoDaddy.com is much better IMHO.  They have decided to fight SPAM by taking the bull by the horn and directly fining abusers.  Quite a contrast …

I’m also curious where the various governments are in all of this.  I find very little is being truly done to contain this problem.  I know Canada is so far behind in online laws, that it isn’t even funny.

Where is the ICANN in all of this?  No where to be found.  They refer anyone with SPAM to contact the domain registrar and hosting company.  Why are they not taking proper ownership of the issue.  They should be welcoming complains, quantifying these to be in a position to revoke registrars licenses based on the generated KPIs.

 

 

What Can You Do To Put A Stop To This

Whatever you do, DO NOT reply to the e-mail in any manner or click on any of the links, even the unsubscribe link.  All this will do is confirm to these malicious people that they have a valid e-mail address and you will get even more SPAM!

Add the domain to your SPAM filter’s list of Blocked Senders (for what it is worth – not too much since they use a different domain for every mailing).

You may also wish to increase your Junk Mail’s filter security level, but note this can be a double edged sword as valid e-mails may get filtered as SPAM.  So you will need to check you junk mail folder more often to ensure that you aren’t ignoring valid e-mails.  If you go this route make sure you add your contacts to the Safe Sender listing to minimize any chance of their e-mails being treated as junk in the first place.

 

Please note each SPAM e-mail received must be analyzed to determine who the Registrar and Hosting company are, as this can vary from e-mail to e-mail.  That said, in the case of these recent SPAMmers, they always seem to be coming from the same companies as indicated below.

In any event, you can look up the sender’s e-mail address using the following link:

http://whois.domaintools.com/

and looking for the Registrar’s information, specifically the ABUSE information, such as: Registrar Abuse Contact Email

Then you can copy the first Name Server entry (at the bottom) and performing a whois lookup on that to get the hosting companies information.  These should be your 2 main points of contact for reporting abuse.

 

Contact Their Domain Registrar

Well, although the abuse@enom.com e-mail address falls on deaf ears, well gets returned as undeliverable, I checked out enom.com and found that they have a report abuse page with a form to submit such complaints.  So I have started sending them a complaint every time I receive an e-mail.  Let me tell you they will either deal with the problem or get very annoyed with me very rapidly considering the ever increasing frequency of SPAM e-mails I am receiving from their domains!  For anyone else looking to complain, here is the link to the report abuse page.

http://www.enom.com/help/abusepolicy.aspx

 

Contact Their Hosting Company

Further analysis of their domain registrations, we learn that they host their domain through NAMECHEAP.COM.  So I contacted NAMECHEAP.COM, using their chat tool, and was informed we should open a ticket by using the following link:

https://support.namecheap.com/index.php?/Tickets/Submit

and selecting the Department ‘Domains — Legal and Abuse’.  I was also told we can submit multiple domains in one single ticket so as to not have to submit dozens and dozens of tickets.

 

 

So, What Has Happened?

Nothing much, sadly!  I have been submitting every single SPAM e-mail I receive to both enom.com and namecheap.com.

Sadly, enom reports:

Please note that due to the volume of complaints received, unless we need additional information, you will not receive a reply or update from us. Please be assured that we take abuse very seriously and investigate every incident that is reported.

so we’ll never know what, or if, they actually do anything at their end.  You’d think they’d want a form of follow-up to know if they successfully dealt with the problem.  This is basic quality assurance!

On the other hand, namecheap.com opens tickets that you can follow.  More than 12, 24, 36, 48 hours later, and every single ticket is “Awaiting Staff Response”.  So although they have a nice automated system, I have yet to see any remedy to this ongoing situation.  Not impressive.  If this is how they treat HIGH priority (their classification, not mine) legal domain abuse tickets, we are in trouble.  In comparison, tickets to both my registrar and hosting companies are handled within hours and I receive follow-up by e-mail (and have even been contact by phone in the past).

Let’s just say I’m not holding my breath!  I don’t expect much from either company based on what I have seen so far and what I have read online in different discussion forums…

Update 2014-04-24

I finally received a follow-up to one of my tickets from namecheap.com.  So firstly, we can see that they do actually look into complaints, thank you.  Sadly, however, they informed me, contrary to the information I can gather performing a WHOIS on the name server, that they are not the domain’s host and thus cannot help.  I have since followed-up with the information I gathered and asking for clarification.  I will post back when they reply.  If they aren’t the host, then I am hoping they can illuminate me as to who is, so I can redirect my energies on the proper SPAM culprits.

This goes once again to the heart of the matter and to the fact that this information is so hard for the average person to piece together, hence no one can actually lodge complaints.

Update 2014-04-29

I just received 2 e-mails from namecheap.com stating: “This is to inform you that the following domains were nullrouted and locked for spam” with a listing of 7 domains.

This is a good start, but far from resolving the issue as these SPAMmers seem to use a domain, send out SPAM and then move on to another domain.  So the only true solution is to ban the registrant altogether from owning any domains.

At least we can see that namecheap.com is looking into the matter and trying to help.  As always, we don’t know what else is going on.  They could be looking into further sanctions.  I for one, sure hope they are.

Thank you namecheap.com.

Conclusion as of 2014-05-10

Not much to say.  Enom never replies (and I question that they actually doing anything based on their numbering system…).  NameCheap is slow, seems to deal on a case by case, rather than banning registrants who clearly abuse repetitively!  I have gotten more than 100 SPAM e-mails in the past month (were I receive 14 in the either year).  96% came through Enom and NameCheap websites.  So there is something going on, are they involved?  Do they make it easy for SPAMmers to utilize their services?  Do they truly want to put a stop to registrants like these that buy in bulk domain and hosting packages?  I have my serious doubts.  One things is for sure from my perspective is that they are very much reactive rather than proactive.  As I indicated above, they could easily be dealing with such SPAMmers, limiting the amount of e-mails per hour/or day, financially penalizing people caught SPAMming, Freezing all domains from SPAMmers, blocking SPAM e-mails containing high volume hyperlinks (they can easily scan for known patterns and block these from ever being sent out and then freeze the offending domain), and so very much more…