Someone is spamming my private payments address

[FictionNet]

All of my moneybookers payments from casino programs go to a specific e-mail address, ie. payments@mydomain.com - this domain is ONLY used to receive moneybookers (and to a lesser extent, paypal) payments from affiliate programs. It has never been used to sign-up anywhere, or send/receive e-mail. So only affiliate programs should EVER have this address, and ONLY for processing moneybookers payments.

I have just received html e-mail spam, promoting casinoclassic.com to the above PAYMENTS ONLY e-mail address. The e-mail arrived from promotions@cazinowinplace.info - and the full header is pasted below:

- - -

Return-path:
Envelope-to: payments@mydomain.com
Delivery-date: Wed, 08 Feb 2012 15:30:27 -0500
Received: from essaycrowd.com ([64.34.169.175]:59944 helo=mail.essaycrowd.com)
by vital.host-care.com with esmtp (Exim 4.69)
(envelope-from )
id 1RvE9r-00030L-1w
for payments@mydomain.com; Wed, 08 Feb 2012 15:30:27 -0500
Received: from p2387570.pubip.serverbeach.com (localhost.localdomain [127.0.0.1])
by mail.essaycrowd.com (Postfix) with ESMTP id DA8101DE636A
for ; Wed, 8 Feb 2012 20:30:27 +0000 (GMT)
Received: (from dconn@localhost)
by p2387570.pubip.serverbeach.com (8.13.8/8.13.8/Submit) id q18KUR6v003291;
Wed, 8 Feb 2012 20:30:27 GMT
Date: Wed, 8 Feb 2012 20:30:27 GMT
Message-Id: <201202082030.q18KUR6v003291@p2387570.pubip.serverb each.com>
From: Promotions Department
To: payments@mydomain.com
Subject: Get Free 1000 EURO to Play!
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="=_773afa4ec5b5eaab7ea8a89c81fa4d0c"

- - -

The spam html mailer links to http://www.cazinowinplace.info/ which then redircts to casinoclassic.com

Of course, just because a scumball is spamming my payments only address with a Rewards Affiliates program, it does not not mean the scumball works for Rewards Affiliates. It could be a scumball who works for another program but has decided to spam me with Rewards Affiliates promos.

I would like to know the identity of the affiliate/program who is spamming me. I assume that Rewards Affiliates will be closing the account of whoever is responsible, as there is a "zero tolerance policy" towards spam here - http://www.rewardsaffiliates.com/help/anti-spam.aspx

I have forwarded a copy of the spam mail to renee@rewardsaffiliates.com

[FictionNet]

Here is the whois info for cazinowinplace.info - not much use other than to note the whois block (for spamming purposes) and that the domain was only registered two days ago, again obviously for spamming purposes.

Domain ID45290869-LRMS
Domain Name:CAZINOWINPLACE.INFO
Created On:06-Feb-2012 13:32:50 UTC
Last Updated On:06-Feb-2012 13:32:51 UTC
Expiration Date:06-Feb-2013 13:32:50 UTC
Sponsoring Registrar:eNom, Inc. (R126-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:b2ac2ec454b04814
Registrant Name:WhoisGuard Protected
Registrant Organization:WhoisGuard
Registrant Street1:11400 W. Olympic Blvd. Suite 200
Registrant Street2:
Registrant Street3:
Registrant City:Los Angeles
Registrant State/Province:CA
Registrant Postal Code:90064
Registrant Country:US
Registrant Phone:+1.6613102107
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:820a5114236841728da9f7ced875f1ba.protect@who isguard.com
Admin ID:9bc966b9f19d307e
Admin Name:WhoisGuard Protected
Admin Organization:WhoisGuard
Admin Street1:11400 W. Olympic Blvd. Suite 200
Admin Street2:
Admin Street3:
Admin City:Los Angeles
Admin State/Province:CA
Admin Postal Code:90064
Admin Country:US
Admin Phone:+1.6613102107
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:820a5114236841728da9f7ced875f1ba.protect@who isguard.com
Billing ID:b2ac2ec454b04814
Billing Name:WhoisGuard Protected
Billing Organization:WhoisGuard
Billing Street1:11400 W. Olympic Blvd. Suite 200
Billing Street2:
Billing Street3:
Billing City:Los Angeles
Billing State/Province:CA
Billing Postal Code:90064
Billing Country:US
Billing Phone:+1.6613102107
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:820a5114236841728da9f7ced875f1ba.protect@who isguard.com
Tech ID:adb6f4b9f19d307e
Tech Name:WhoisGuard Protected
Tech Organization:WhoisGuard
Tech Street1:11400 W. Olympic Blvd. Suite 200
Tech Street2:
Tech Street3:
Tech City:Los Angeles
Tech State/Province:CA
Tech Postal Code:90064
Tech Country:US
Tech Phone:+1.6613102107
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:820a5114236841728da9f7ced875f1ba.protect@who isguard.com
Name Server:NS1.HERTERM.COM
Name Server:NS2.HERTERM.COM
Name Server:NS1.HUNGWAX.COM
Name Server:NS2.HUNGWAX.COM

[slotplayer]

at the bottom of casinoclassic
Affiliate ID: aff98384:-70623

[Renee]

Just waiting for the emails to my inbox.. They haven't arrived yet.

Cheers

[FictionNet]

at the bottom of casinoclassic
Affiliate ID: aff98384:-70623

Thanks! It's going to be interesting to see who this affiliate is, and how he/she got hold of this private e-mail address.

[FictionNet]

Just waiting for the emails to my inbox.. They haven't arrived yet.

Cheers

It was sent nearly three hours ago so should have arrived by now. I have retained the original spam e-mail, I'll be happy to forward to any alternative address.

[Renee]

HMm definitely haven't come.
I'll PM you both my personal address to send them to.

Cheers

[FictionNet]

I should add that there is one other possible source of this spam - if someone (casino or affiliate) has purchased advertising from me then they may have sent money to this moneybookers/paypal e-mail address. Regardless of who the person is or what program they represent, I will be refusing any further campaigns from them, once we have identified the culprit.

[FictionNet]

HMm definitely haven't come.
I'll PM you both my personal address to send them to.

Cheers

PM received and replied. Thanks.

[FictionNet]

Is there an update on this? Account security has possibly been compromised somewhere so I keen to see a speedy resolution and identification of the culprit. I assume you know the identity of the spammer from his/her aff link, already provided by another poster.

[Renee]

I am looking at the IPs logging into your account and for this year I am getting statsremote logins from Spain and the UK, as well as RA website logins from the UK. Most logins are from statsremote.

If this is out of the ordinary please email me so we can get your account security sorted.

Cheers

[casinobonusguy]

Just want to add my 2 cents here , My husband uses an email for his moneybookers that he does not use anywhere else ,he plays at 888 casino only with moneybookers deposits and been getting lots of spam.Is it possible this is moneybookers trying their hand at being an affiliate?

[Renee]

Moneybookers does have an aff program and does email on behalf of operators, however this was not directly from moneybookers.

[FictionNet]

I live in Tenerife, which will display as Spain in most stats. I attended LAC, which accounts for the UK refs you are seeing. And I use StatsRemote, so all seems fine.

Right now, I am more interested in knowing what has happened with the spammer and how he got hold of my private email address. I am assuming you know all his/her details from the aff link already provided. If this spammer had accessed my affiliate account, I'm confident he wouldn't have used only my payments address as a means for spam so this indicates that a casino is selling these addresses to a spammer or there is a rogue employee somewhere, not necessarily at RA. This issue needs to be addressed urgently - if we have a rogue program/employee abusing affiliate data then this needs immediate discussion in other gpwa subforums.

[Renee]

I'm 1000% sure the affiliate has not accessed your RA account. As I said, I've looked at the logs. There is nothing unusual there as you have confirmed above.

If you think the address was taken from an aff program, I would start contacting those places who have the address on file.

[FictionNet]

Have you asked this spammer where he got my e-mail address? As I opened with, that addy is pretty much ONLY used as a MB payments addy for affiliate programs so the spammer has presumably got this addy from an affiliate account of mine. I appreciate the need for privacy, even with spamming gits, but is there anything you can tell me about this spammer that may help me gauge wtf has gone on and how he could possibly have come across my address?

[Renee]

No, I haven't asked specifically about your address, but about them all.

The problem is that if I give him your address, he will just remove it.
Also I will be honest, your complaint is the only one I have had about him in years.

If I am able to get this info, I will let you know.

[FictionNet]

From what you are saying, this affiliate has worked with you for a while without any problems. I take that into account - I do, but please also take into account that this affiliate has somehow picked up an affiliate payment account exclusive (almost) e-mail address so I am naturally VERY keen to find out wtf he did to get access to it.

I'm not trying to put you in a difficult situation. I think the spammer has already done that and I'm not sure how to proceed from here.

[Renee]

I understand your side, which is why I'm trying to find out where the entire list is from, rather than give him your email address.

[vmlinuz]

Someone started spamming me too, he even has my real name. WTF? Here's the link from the spam: http://casletter.com/tl.php?p=s0/s0/..._id%3Daff87480