Update and Clarification (May 6, 2009): This post is about spam in general, using Acai Berry spam as an example. I aim to (1) illustrate that sometimes email addresses and web site addresses don’t match; and that when WHOIS is used, one may often find that they might not belong to the same person or organization. That should be a warning as to the legitimacy of the email message (or the site). Some readers have focused more on the email aspect of spam, but (2) much spam directs you to a web site. As some commenters have pointed out: email addresses can be spoofed, and tracking an email can be very difficult, BUT it is my opinion that web sites can be easier to track. (Read my “Spam Fighting Update”).
The original article begins here:
I hate spam.
I mean I really hate spam. I don’t just delete it, I report it. I send it to the FTC’s email@example.com email address so they can record it. If I get really bothered about it, I contact the company that registered the name for the owner of the email address and let them know that someone is using their service for spamming. A lot of decent companies don’t like to hear about that. It can hurt their law abiding users. How’d you like to learn that your emails don’t go through because someone on the same service as you was spamming, and getting everyone else blocked because of it?
For about two weeks now I’ve been receiving emails claiming to be from the “American Health Association” telling me how to lose weight with various products made from Acai Berries. After clicking unsubscribe links (when available) and deleting, I began to “get testy” when they continued rolling in. So I started fighting back.
The Law Is On Our Side
Let’s see what laws and such are on my side and yours here.
- Web and email addresses have to be registered to an owner or registrant. It is illegal to do so under an assumed name.
- Commercial messages (they wanted me to buy these berry products) must by law contain truthful addressing info both in email and in the physical world. And, once more, no assumed names are allowed. A physical address must be included.
- Many other nations have teamed up with the US to fight spam, so even if these spammers aren’t in the US, the country they live in may work with the US to fight spam.
- Many reputable internet and email services will not allow their clients to use their systems for the delivery of spam.
How did I fight back?
The Registrant / Owner of the Email Address. If the message was from the “American Health Association” then its email address — according to my Google search — would be either “@ahahealth.com” or “@americanhealthfoundation.com”.
Instead the email addresses pointed to “@brightbat.com” and “@prodemosite.com” among others. So there’s an FTC violation for false or misleading header information.
Want to know the registrant/owner of an “@whatever.com” address? Just go to Google and search for “whois whatever.com”. There’s no space in whois, and don’t include the quotation marks either. So I did a search for whois brightbat.com and whois prodemosite.com. Both came up with private or anonymous listings, they were both registered through the same service and one was registered just yesterday (a one day old address) and the other was registered in mid July. Go to Google and try searching for them yourself. Oh, heck, here’s the direct link to brightbat’s listing and here’s prodemosite.
Also, the addresses were registered through a company in the UK, and the UK works with the US to fight spammers.
I contacted the private registration service, PrivacyProtect.org, and reported the owners of these two addresses. Privacy Protect will reveal the registry information if they deem it appropriate. I let them know the owners of these addresses were sending spam messages in violation of the provisions of the FTC’s CAN SPAM Act. I also forwarded copies of the emails to them at abuse @ privacyprotect.org.
What Other Violations Were In Those Emails?
You can follow along with the violations by taking a look at the legal requirements for commercial email messages listed in the yellow box at right. Several people have received up to three or more years in jail for violating these laws.
Back to the Acai berry violations:
- Along with the misleading email names (claiming to be the AHA when they weren’t), they also
- failed to mention the messages were advertising
- failed to include a postal address
- In several cases they failed to include an unsubscribe link, and in some cases the link didn’t work. All violations.
What Else Did I Learn?
The people at PowerSupplements, a manufacturer of Acai berry products wasn’t to thrilled to hear about the Acai berry spam. That was according to a report at SpamFighter.com, a provider of spam filtering software at www.spamfighter.com.
So if you decide you’d like to join the fight against spam you can follow my lead.
- Look for the same violations I looked out for.
- Forward spam to the FTC at firstname.lastname@example.org. (UCE stands for unsolicited commercial email).
- Want to go the extra mile? Go to Google, and do a whois search on the email address it came from. Just use the part of the address that comes after the @ symbol, don’t use the whole address. Then find out where the reistered the address. For example, whois brightbat.com. Then find out who the registrar is and let them know a user of their service is sending out spam.
If anyone has a question, please email them to me using the Contact link, or, if it relates to today’s message, please use the Comment and Question link below. Follow me on Twitter. I’m looking forward to hearing from you.