-fake name- says you should see this video clip.

-fake name- thinks you will really like this YouTube Video. Check it out!

This email was sent by -fake name- using the Application: Youtube Video Seach. You can stop receiving emails here.
- , ,

I’ve now blocked all of these domains: myfanbox.com fanbox.com fanboxapps.com sms.ac fanboxnotes.com

FanBox.com Spam

“Friend’s Name” has added you as a friend

Is “Friend’s Name” your friend?

Click Yes if “Friend’s Name” is your friend, otherwise click No. But you have to click!

Please respond or “Friend’s Name” may think you said no

Click here to block all emails from Infoaxe Inc., Sunnyvale, CA. 94085. Privacy Policy

There is so much wrong with this email:

• The link on the “Yes” and the “No” responses to the question ‘Is “Friend’s Name” your friend?’ both go to the same page at InfoAxe.com.
• The message is not CAN-SPAM compliant, there is not a full mailing address in the message.
• The link in the footer labelled “Privacy Policy” is actually just a link to the site’s home page.
• The use of the word “friend” is deceptive. It isn’t a social networking site. This is simply an attempt at using my friend’s name as an endorsement of their service.

I wrote back to my friend:

It looks like you gave InfoAxe permission to email all of your contacts listed in your aol address book. It is really really dangerous to give any third party access to your account. Never give out your account’s password. You never know what some other company is going to do with the info they “borrow” from your account. The privacy policy for Infoaxe is extremely light on details. They don’t address the legal ramifications of giving them access to your entire browsing history for example. Their site is also a bit sketchy in that it looks to not have been updated since at least summer 2008. I’d have to recommend you not use their service. Mike

Looking through the InfoAxe web site, there really isn’t anything there that is encouraging. Their abouttheteam page is a joke. The site is copyright 2008, which is an eternity in web-time. Their job page says you need to be able to start by August 2008. Only five blog posts in a year. Taken as a whole, why would you allow this company’s software to track your web browsing, and to access your address book? Stay away.

Update: 11/20/2009 7:06am: I got a reply from my friend that used the InfoAxe service:

Mike…i didnt fill it out when i reealized what ir was….i cancelled mid way…but it must have spammed everyone….so sorry…

That really says it all. InfoAxe isn’t being very clear and/or up-front with their users about how they are going to treat your address book. Basically, the rule is: you should never give out your password to anyone! Facebook, AOL, Hotmail, Gmail, Twitter, etc… There is never a reason to give your password to any third party site.

InfoAxe Spam

Spam is Out of Control

“The message footer appears below each email that you send and allows your contacts to learn about different products and content from AOL and our advertisers. Show the message footer at the bottom of each email you send.”

Simply uncheck the box and save your settings. All of us that receive your email thank you for removing unnecessary advertising from our lives.

Disable Email Footer Ads in AOL

#####
                                                                                                                                                                                                                                                                                                                                                                                      ##   ##
##   ##  #######   #######  #####            #######    ###     #######  #######       ######   #######    ###    ##   ##  #####           #######   ##   ##  #######  #######             #######  #######  #######        ######## #######  ######   ###    ########  ##  ##   ##  #######           ##  ##      ##      ##   ##  #######   ######   ######  #######   ######      ##     ##
###  ##  ##        ##       ##  ##           ##   ##   ## ##    ##   ##  ##            ##   ##  ##   ##   ## ##   ###  ##  ##  ##          ##        ##   ##  ##   ##  ##                  ##       ##   ##  ##   ##           ##    ##   ##  ##      ## ##      ##     ##  ###  ##  ##   ##           ##  ##      ##      ###  ##  ##       ##       ##       ##       ##           ##     ##
#### ##  ##        ##       ##   ##          ##   ##  ##   ##   ##   ##  ##            ##   ##  ##   ##  ##   ##  #### ##  ##   ##         ##        ##   ##  ##   ##  ##                  ##       ##   ##  ##   ##           ##    ##   ##  ##     ##   ##     ##     ##  #### ##  ##                ##  ##      ##      #### ##  ##       ##       ##       ##       ##                 ##
#######  ######    ######   ##   ##          ######   #######   ######   ######        ######   ######   #######  #######  ##   ##  #####  ##        ##   ##  ######   ######              ######   ##   ##  ######            ##    ######   #####  #######     ##     ##  #######  ##                ##  ##      ##      #######  ######    #####    #####   ######    #####            ##
## ####  ##        ##       ##   ##          ## ##    ##   ##   ## ##    ##            ##   ##  ## ##    ##   ##  ## ####  ##   ##         ##        ##   ##  ## ##    ##                  ##       ##   ##  ## ##             ##    ## ##    ##     ##   ##     ##     ##  ## ####  ##  ###           ##  ##      ##      ## ####  ##            ##       ##  ##            ##         ##
##  ###  ##        ##       ##  ##           ##  ##   ##   ##   ##  ##   ##            ##   ##  ##  ##   ##   ##  ##  ###  ##  ##          ##        ##   ##  ##  ##   ##                  ##       ##   ##  ##  ##            ##    ##  ##   ##     ##   ##     ##     ##  ##  ###  ##    #           ##  ##      ##      ##  ###  ##            ##       ##  ##            ##        ##
##   ##  #######   #######  #####            ##   ##  ##   ##   ##   ##  #######       #####    ##   ##  ##   ##  ##   ##  #####           #######    #####   ##  ###  #######             ##       #######  ##   ##           ##    ##   ##  ###### ##   ##     ##     ##  ##   ##  #######           ##  ######  ######  ##   ##  #######  ######   ######   #######  ######         ##                                                           

                                                                                                                                                                                                                                                                                                                                                                                       ##                               

                                                                                                                                                                                                               ##
##       ##  #######          ##   ##    ###    ##   ##  #######           ##   ########        #######  ##   ##      #######   #######  #######  #####          ######  #######   ##  #######  #######        ##
##   #   ##  ##               ##   ##   ## ##   ##   ##  ##                ##      ##           ##   ##  ###  ##      ##        ##   ##  ##   ##  ##  ##         ##   ## ##   ##   ##  ##       ##             ##
##  ###  ##  ##               ##   ##  ##   ##  ##   ##  ##                ##      ##           ##   ##  #### ##      ##        ##   ##  ##   ##  ##   ##        ##   ## ##   ##   ##  ##       ##             ##
## ## ## ##  ######           #######  #######  ##   ##  ######            ##      ##           ##   ##  #######      ##        ##   ##  ##   ##  ##   ##        ######  ######    ##  ##       ######         ##
## ## ## ##  ##               ##   ##  ##   ##  ##   ##  ##                ##      ##           ##   ##  ## ####      ##  ###   ##   ##  ##   ##  ##   ##        ##      ## ##     ##  ##       ##             ##
 ###   ###   ##               ##   ##  ##   ##   ## ##   ##                ##      ##           ##   ##  ##  ###      ##    #   ##   ##  ##   ##  ##  ##         ##      ##  ##    ##  ##       ##             ##
  #     #    #######          ##   ##  ##   ##    ###    #######           ##      ##           #######  ##   ##      #######   #######  #######  #####          ##      ##   ##   ##  #######  #######
                                                                                                                                                                                                               ##

##       ##   ##       ##   ##       ##                                                                       #######   #######  ##     ##
##       ##   ##       ##   ##       ##                                                                       ##        ##   ##  ###   ###
##   #   ##   ##   #   ##   ##   #   ##                                                                       ##        ##   ##  ## ### ##
##  ###  ##   ##  ###  ##   ##  ###  ##                                                                       ##        ##   ##  ##  #  ##
####   ####   ####   ####   ####   ####                                                                       ##        ##   ##  ##     ##
###     ###   ###     ###   ###     ###   ##                                                                  ##        ##   ##  ##     ##
 #       #     #       #     #       #    ##                                                            ##    #######   #######  ##     ##

Translation: Need rare brand-cure for treating illnesses? We have it on good price! www.(a 6 digit number).com

ASCII Art Spam

Then I started getting B&N’s weekly newsletter. After a couple weeks, I decided I didn’t want it. So I followed the unsubscribe link, which had my email address embedded into the URL. I go to that page in my browser (Safari 3 under OS X), my email address is already filled into their form, hit the unsusbscribe button and wham! “We were unable to process your request. Please try again.”

Ok, maybe they’re having tech problems. Try again a few minutes later. Same error message. So I checked out their Privacy Policy, and sent a nice email to them at privacy@barnesandnoble.com.

Good morning,

A few weeks ago I created an account at the Barnes & Noble web site so I could download some of your free audiobooks. That “purchase” worked just fine. I was able to register my account and I received the download instructions in an email message. The email address I used was the same one I am using to send you this message.

Now I am receiving your weekly email newsletter. I read it, and decided I don’t want to receive it. So I clicked on the opt-out link. (link redacted)

But when I try to submit that link I am told the attempt was unsuccessful. “We were unable to process your request. Please try again.”

It seems to me that if you can allow me to create an account with a long email address, which is entirely valid, you’d allow me to unsubscribe that email address from your promotional mailing list. Please investigate your system, and fix it to allow people with long email addresses to unsubscribe. Thanks very much for your help, Michael

I received no response at all from Barnes & Noble.

Two weeks (and two newsletters) later I sent the note to B&N again. And again, no response at all.

If you’re going to have a privacy policy, you need to follow it. Part of that is actually monitoring the email address you give to the public if they have privacy concerns. A complaint has been filed with the Federal Trade Commission.

(Update: I tried submitting the opt-out form with Firefox, which apparently ignores the maxlength field on an input form. And apparently I’ve been opted out. Regardless, B&N needs to actually have someone assigned to do something with their privacy email address. I doubt I would ever shop at bn.com again.)

Barnes & Noble Opt-Out Broken, No Response to Privacy Emails

2009iiisconferences.org
2010iiisconferences.org
ICTconfer.org
smartpowercall.info
requestserv.com

Spammers I’ve Blocked

Your email is only used for contacting you about Blog Flux updates….Your email will also not be distributed to anyone for any purpose….Blog Flux maintains a strict “no-spam” policy. Your e-mail address will not be sold to a third party.

In the past 14 months, I’ve received a handful of messages (well, three) from BlogFlux. Each message clearly identified who they were, each had an opt-out link at the bottom, and each message was related to my BlogFlux account. Today I received a message from “Lesley.” She’s somehow affiliated with LoadedWeb.com. LoadedWeb.com has nothing on their web site about who they are, who’s running the site, their affiliations. LoadedWeb.com also does not have a privacy policy at all. Google searches show that LoadedWeb.com several years ago was a web host.

BlogFlux.com’s privacy policy refers people to their contact page “[i]f you have any questions about this privacy statement, the practices of this site, or your dealings with this Web site…” Unfortunately the contact.php page has no contact info on it at all. That’s the same URL they give in the footer of the site.

Looking at the message headers, I would guess that BlogFlux and LoadedWeb are probably owned or operated by the same people. Their IP addresses are on the same block. (204.11.52.70 and 204.11.52.71). That address is registered to enthropia.com. Their web site looks to be ancient, not updated since 2003?

I’d have to say avoid using BlogFlux.com, or LoadedWeb.com. It is probably just a couple guys doing cool web stuff from their basement, but it feels very random. I don’t think I’d trust them with my personal data or information.

BlogFlux Privacy Policy Violation

Looking through the history of the site’s Main Page, it looks like the wiki was set up on January 3, 2007 at 4:45pm, and last legitimately edited on February 28th. The first spam appeared on April 28th. Since then, the spammers (drugs vs. casino/gambling) have been fighting over the site.

I realize that my notification about this site was sent two days before a major US holiday, but the fact that this site has been allowed to be abused for over a year and a half is frightening. Obviously, this wiki has been forgotten after some long lost project. Did it’s administrator graduate? Did the project not get funding? Regardless, someone must be maintaining the hardware and site. Somewhere there’s a log file needing to be watched. Groups like the Berkman Center need to set a positive example for secured web systems.

If the Berkman Center Can’t Secure Itself

Deneen Carrillo | aejqtb@lobhyi.com | IP: 94.102.60.151

5wj9j1bdvd74zbcv

A real looking name, an obviously fake email address (usually with a non-existent domain name, which should immediately flag the comment as spam if WordPress or Akismet were intelligent), an IP address from 94.102.60.151 94.102.60.152 or 94.102.60.153, and 16 random letters or numbers.

The user agent strings varied widely:

• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
• Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7

The bot also submitted every form on the page, including the search form and the submit box. Maybe a simple form should be created to auto-block anyone that submits anything to it. And the bot never downloads images or anything other than the page. Maybe a plugin should could check that a user downloaded some other content before allowing a comment to be submitted? Yes, this forms a horserace, but it may work in the short term.

Odd Comment Spam Attempts