Skip to content

Reach Marketing Spam

I have started receiving email spam from a company called “Reach Marketing” via a product known as ReachBase. I wonder why they think it is ok to send out spam on behalf of other companies? If a person did not opt-in to getting marketing messages, that means you don’t send that person your marketing message. Why is that so difficult for companies to understand? People shouldn’t have to opt-out of something they’ve never asked for in the first place.

This evening I submitted to them this message:
Why are you selling my email address to companies without my permission? When did I opt-in to your system? Show me the proof, the email I sent, or the IP address that was used to sign up on your web site. Thanks for your help. I’m sorry I had to use fake info in all fields above other than my email address, but I don’t trust you to not start sending me junk mail and telemarketing. That is, I think I submitted the message to them. Their idiotic comment system kept throwing out errors. Eventually the errors stopped, but no confirmation appeared that the message was sent.

So far, I’ve received spam from Fred Pryor Seminars, the New York Times and Intel. I find it amazing that huge, well-known companies like The NYT and Intel would resort to sending spam.

If you want to block this stuff, block all of the domains from clk20.com to clk70.com. Yes, that is 51 domain names. Here is a text file you can copy and paste to your mail server’s access file. I’ll update this if I discover other domain names Reach Marketing is using to send out their drivel.

Twitter Updates for 2012-10-11

  • I get a lot of web abuse from servers with addresses "owned" by http://t.co/DKVeiQ63 178.162.239.152 is the most recent #
  • @twitter my email address isn't working because your email server is on the SpamCop Blacklist http://t.co/AUTsPVUL #
  • Augh, another web attack from a loser at Leaseweb. 188.72.213.44 #

Twitter Updates for 2012-10-09

Twitter Updates for 2012-10-07

  • I wonder how long until people start calling for Beamer's head. #hokies #itsonlyagame #

Twitter Updates for 2012-10-06

  • FluidApp/Mountain Lion bug: Pages that use .htacess to protect directories/files aren't being cached/stored correctly. #
  • The Apple Bug Reporter doesn't support Safari 6. I guess Safari is perfect! https://t.co/ixA7OkJc #

Twitter Updates for 2012-10-05

Twitter Updates for 2012-10-04

Twitter Updates for 2012-10-03

Twitter Updates for 2012-09-30

Bots Looking for Backups of wp-config.php

Here’s a new attack that occurred this afternoon: bot networks are searching for backup copies of wp-config.php. They searched for these four files on the root level of one of my web sites.

  • wp-config.phpbak
  • wp-config.php-bak
  • wp-config.phpBAK
  • wp-config.php-BAK

The probes came from these four IP addresses, all within one minute of one another:

  • 91.217.66.227 – Ukraine, no rDNS
  • 151.0.9.230 – Ukraine, no rDNS
  • 193.106.65.146 – Ukraine, 193-106-65-146.vega-tv.com.ua.
  • 88.252.179.61 – Turkey, no rDNS

You should do two things:

  1. Search your site’s root directories for old “backup” copies of your site’s configuration files. And if you find any, you need to remove them. You may want to consider removing wp-config-sample.php if it exists as well. Heck, remove readme.html and license.html too. There is no reason for those files to be available on your web site.
  2. If your web server and host supports it, move your wp-config.php file up one directory out of your public web site. So if your WordPress installation is installed in /var/www/html/example.com/ , move wp-config.php to be in the html directory, not the com directory. This should remove the configuration file from the public.

Followup: September 30th, 2012: Just had a few new probes for wp-config.txt from 88.74.117.9, dslb-088-074-117-009.pools.arcor-ip.net, Germany.