Ibexnetwork: Spam? (promoting Roxy) Enough already!

[Roulette Zeitung]

Hello,

i must say, some spam techniques are really excellent.

A close friend, who has never in his life subsribed to a casino newsletter or other newsletters shows me today a spam email for Roxy Palace of a "Dr.Wattsup". The sender is given as newsletter@allmag.co.il.

Not even the word "Paket" was written correctly by the sender, because "Willkommenspacket" does not exist in the German language. Euro is a currency, a proper name and should also be capitalized. Spam is bad enough, but amateurish spam is really deplorable.

The invitation in the email to unblock all blocked pictures (blocked for protection), because this is the only way to get a free offer I personally feel as coercion, and it is of course a lie.

The (alleged) sender allmag.co.il looks to me like a harmless, Israeli magazine. On closer inspection you notice this is a scam. The magazine is not the sender. So it switched to a criminal act.

The header of the email tells that the Return-Path is r@dlndr.com and the IP address http://www.utrace.de/?query=212.29.221.215.

The owner of dlndr.com is Digital Lime Ltd. You can see it here: http://whois.domaintools.com/dlndr.com
Owned by the Digital Lime Ltd. is also the domain digital-lime.com.

It's a casino marketing domain. This shows the Google results: http://www.google.de/search?client=o...gital-lime.com and especially this url: digital-lime.com/Casinonewsletter.html.

The IP address of the domain (62.219.30.30) comes from Israel as well as the sender of the spam email (212.29.221.215), which by the way is on the black list: http://dnsbl.inps.de/query.cgi?lang=...=check&quick=0

Ibexnetwork also has its headquarters in Israel.

The links in the spam email targeted for Roxy Palace go to trace20.com. The IP address of trace20.com, what a surprise?, came from Israel. It is 62.0.66.47. Behind trace20.com you will find Inwise Ltd. (inwise.com), a specialist in sending mass emails.

A phone number from England? The reality tells, that the IP adress of Inwise Ltd. 62.219.25.208, of course, is Israel again.

Question: O.k. Roxy spam, but why Ibexnetwork?
Answer: They are the real cause, either itself or an affiliate, because the veiled tracking code contains by forwarding this sequence:

tracking.ibexnetwork.com/aff_r?offer_id=162&aff_id=2&url=http%3A%2F%2Fde.ro xypalace.com%2Fspezielle-angebote%2Fslots-de.aspx%3Fbtag%3Drpaff10062_10233c9da5be9d18e5433a f437f0c9&urlauth=615199350814979551240695316834

With common sense, I think that the small value "aff_id=2" indicates that it might be Ibexnetwork itself, which is behind this mess and not an affiliate, because an affiliate will have probably a higher ID number and not "2".

I'm not a tracking link expert, but is it true that "rpaff10062" tells the information "Roxy Palace Affilate 10062"?

Conclusion

A spam email is sent to a person who would never subscribed to a casino newsletter or other newsletter.

On a sneaky way an innocent Israeli magazine is inveigled in this matter. Criminals act like this.

Because of the small affiliate ID you can derive the assumption that Ibexnetwork plug directly behind the spam and not an affiliate of Ibexnetwork.

Everyone wants to make money.
But not in this way!

Credibility:


Roxy Affiliates

"Spam" means emails and messages that meet any one or more of the following criteria: (i) unsolicited mailing, usually sent to a large number of addressees; (ii) contains false or misleading statements; (iii) does not truthfully identify the source or the originating IP Address and / or the originating email address; (iv) does not contain an online and real time Remove/Unsubscribe option, (v) bundles certain software with other software, or (vi) inserts icons or causes software download or installation or similar action without the consent of the addressee; and Spamming shall be construed accordingly

2. Affiliation Guidelines

2.1.7 We will terminate this agreement unilaterally, upon immediate notice, if there is any form of spamming

8.8 Spam - We do not condone Spam.
8.8.1 Any form of Spam will result in your account being placed under review and all funds due being withheld pending an investigation into your account. You need to be aware that our clients are liable to incur expenses in dealing with Spam generated mail and these same expenses will be deducted from your account should our client seek recourse. In this instance the amount determined by the relative client will be fair and deemed final and acceptable based on good faith and such amount will be collectable by law and deemed to have been accepted by yourself as fair and reasonable and as agreed to by registration as an Affiliate of Roxy Affiliates.

Source: http://www.roxyaffiliates.com/Termsandconditions.aspx

Ibexnetwork

7. Anti-Spam Policy

You must strictly comply with the federal CAN-SPAM Act of 2003 (the "Act"). All emails sent in connection with the Affiliate Program must include the appropriate party's opt-out link. From time to time, we may request - prior to your sending emails containing linking or referencing the Affiliate Program that you submit the final version of your email to IbexNetwork for approval by sending it to your IbexNetwork representative and upon receiving written approval from IbexNetwork of your email the email may be transmitted to third parties.

It is solely your obligation to ensure that the email complies with the Act. You agree not to rely upon IbexNetwork's approval of your email for compliance with the Act, or assert any claim that you are in compliance with the Act based upon IbexNetwork's approval.

Source: http://login.ibexnetwork.com/terms

Big words!

Quo vadis, Roxy?

Quo vadis, Ibexnetwork?

Leopold

[universal4]

The problem with publishing the sender, are you 100% sure that is actually the sender, or is the sender address that you published possibly forged and could have been a random recipient placed there by the mailer which may be different?

If that forged senders address is placed there randomly, it is possible that your email address is placed as a sender on someone else's email they recieved.

The header of the email tells that the Return-Path is r@dlndr.com and the IP address http://www.utrace.de/?query=212.29.221.215.

The ip you posted 212.xx.xx.xx does not match a ping trace to the dlndr.com domain.

It is likely that the header is forged in places, and the email address you published may or may not be an innocent recipient and not the mailer.

The most important point of the spam is the affiliate link, and the affiliate program can always indetify the spammer (or spam purchaser) in this case.

Rick
Universal4

[Roulette Zeitung]

Hello,

100% innocent is the Israeli magazin as i wrote.

I will give you the header of the spam email to take a look:

From Dr.Wattsup Mon Jun 17 14:04:38 2013
X-Apparently-To: XXX via 188.125.69.155; Mon, 17 Jun 2013 19:31:54 +0000
Return-Path: <r@dlndr.com>
X-YahooFilteredBulk: 212.29.221.215
Received-SPF: pass (domain of dlndr.com designates 212.29.221.215 as permitted sender)
[...]
X-Originating-IP: [212.29.221.215]
Authentication-Results: mta1119.mail.ir2.yahoo.com from=allmag.co.il; domainkeys=permerror (no key); from=allmag.co.il; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO d215.dlsmtp2.com) (212.29.221.215)
[...]
From: Dr.Wattsup
<newsletter@allmag.co.il>
To: XXX
<XXX>
Reply-To: newsletter@dlndr.com
Subject: =?iso-8859-1?Q?Spielen=20Sie=20bei=20Roxy=20mit=201250=80=20g ratis?=
Message-Id: <20130617130437.29D11120176@d215.dlsmtp2.com>
Content-Length: 10012

A similar entry: http://dnsbl.inps.de/query.cgi?actio...21.221&lang=en

er-Version: SpamAssassin 3.3.2 (2011-06-06) on xxxxxxxxxxxx
X-Spam-Flag: YES
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.5 required=5.0 tests=BAYES_50,DKIM_SIGNED,
HTML_MESSAGE,RCVD_IN_IX,RDNS_NONE,SPF_PASS,UNPARSE ABLE_RELAY,URIBL_WS_SURBL
autolearn=disabled version=3.3.2
X-Spam-Report:
* 3.0 RCVD_IN_IX RBL: Relay befindet sich in iX-RBL
* [212.29.221.221 listed in ix.dnsbl.manitu.net]
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
* 1.6 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
* [URIs: dlndr.com]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 2.0 BAYES_50 BODY: Bayes spam probability is 40 to 60%
* [score: 0.5000]
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
X-DNSBL-PRECHECK: AMBIGUOUS: 212.29.221.221 [1/29] Listed in: ix.dnsbl.manitu.net[bl], wl.mailspike.net[wl]
Return-Path: <MAILER-DAEMON>

Another example: http://dnsbl.inps.de/query.cgi?actio...21.215&lang=de

Dlndr.com
Not in the Google index.
Dlndr.com is on SURBL lists: WS (WS has records from Bill Stearns' SpamAssassin ruleset sa-blacklist plus many other data sources. WS and other SURBL lists seem to detect some different types of sites, so they complement each other well.)

Dlndr.com: Traceroute

TraceRoute to 62.219.30.30 [dlndr.com]Hop (ms) (ms) (ms) IP Address Host name
1 0 0 1 8.9.232.73 xe-5-3-0.edge3.dallas1.level3.net
2 0 0 0 4.69.145.140 ae-3-80.edge2.dallas3.level3.net
3 1 0 2 4.68.70.58 -
4 33 33 34 213.155.137.110 ash-bb3-link.telia.net
5 204 127 138 213.155.135.56 ffm-bb1-link.telia.net
6 173 126 126 80.91.252.168 ffm-b2-link.telia.net
7 129 129 129 80.239.128.150 bezeq-ic-151311-ffm-b2.c.telia.net
8 188 183 184 62.219.189.125 bzq-219-189-125.cablep.bezeqint.net
9 178 180 179 62.219.189.186 bzq-219-189-186.cablep.bezeqint.net
10 182 185 184 212.25.116.230 bzq-25-116-230.static.bezeqint.net
11 Timed out Timed out Timed out

----------------

212.25.116.230 - http://www.utrace.de/?query=212.25.116.230 - Ramat Gan
212.29.221.215 - http://www.utrace.de/?query=212.29.221.215 - Ramat Gan

Other domains of cliff.allen1@yahoo.de: http://www.webboar.com/whois-email/c...len1@yahoo.com

digital-lime.com
dlsmtp.com
dlndr.com
dlt5.com

dlt5.com

Go to the url.

inwise LTD. email marketing services and products
http://www.inwise.com

This is the same content from sender of the link in the spam email!
The spam link begins with http://trace20.com

Trace20.com

Go to the url.

inwise LTD. email marketing services and products
http://www.inwise.com

Same content as dlt5.com!

And...

dlt5.com / dlsmtp.com / dlndr.com AND finaly digital-lime.com are from the same owner.

The complete spam email link (You can see the ibexnetwork redirection): http://trace20.com/fb/7125012EF9E508...xfaWQ9MTExNA==

All this must be a very big coincidence. A company has some "empty" but working domains, one of them is blacklisted, and one real domain for email marketing solution for online casinos, without phone number or real contact data (click on contact (only a simple contact form) and spam is going around.

I can tell which way the wind is blowing.
Or i may be wrong. and it is a very, very, very big coincidence.

But it's proven, that Ibexnetwork is sending out spam emails with lies promoting Roxy Palace Casino.

Leopold

[NETELLER_Emile]

Thank you for bringing this to our attention.
We are currently investigating this matter.
This practice is not allowed or supported by the Roxy affiliate program.
We will not hesitate to take swift and appropriate action directly with the affiliate.

[Roulette Zeitung]

Hello Robert,

We are currently investigating this matter.

forgive my skepticism about Roxy.

Nevertheless: A public statement after the conclusion of the investigation could convince me and i think other readers too.

Leopold

[universal4]

Sorry Leopold,

But did you notice that the domain on the messageid does NOT match the domain on the from?

That usually (not always) but usually is a clear sign that the message header is forged and that means the from address (may or may not) be the actual sender.

Therefore, publishing that email address could mean that an innocent recipient could be being accused of sending spam thay had nothing to do with.

You state the sender is at allmag.co.il and yet the ip 212.29.221.15 is NOT the ip of the mail server for allmag.co.il, so if the real sender was who you stated it was not sent through that ip, and if it was sent through that ip it wasnt sent using that as the real sender since that can not be.

The domain allmag.co.il has an ip address of 62.128.51.170 and the mail server of mail.allmag.co.il has an ip of 212.199.98.120

This is an indication that at least a portion of the header is forged and therefore backs the theory that it is possible the from account is not the actual mailer.

Rick
Universal4

[MichaelCorfman]

Just a quick note to say that two folks from the Ibex Network introduced themselves to me during the Amsterdam Affiliate Conference last week. I have contact information for both of them, and have been in touch with them both via email and via phone regarding the issue raised in this thread. They have been very clear to me that they will cooperate in resolving the issue raised. In that context I am requesting information from them so that I can determine what happened and where responsibility lies.

In the meantime, I think it is helpful to provide details that can be analyzed. But it is, in my opinion, premature to make any judgement or assume the worst with respect to any party until enough facts are known to be able to accurately assess the situation.

Michael

[Roulette Zeitung]

Hello,

i received a PM from Robert from Roxy Affiliates. Very professional and decent, because Roxy, innocent of the spam, takes the time for a personal response.

Ibexnetwork, the source of the spam, think it is not necessary to apologize at least.

It was plenty of time for Ibexnetwork to give me any personal response.

Not a single word!

Working like an adjustable-focus binoculars.
Always broadly tuned.

No wonder that Ibexnetwork have a bad record in Germany.

Leopold

[MichaelCorfman]

Not a single word!

Leopold, I understand your point about personal contact, but I also think it too easy to falsely interpret your comment as meaning Ibexnetwork has been silent in terms of working to resolve the situation, and that is not appropriate.

For the benefit of everyone else, I have been working to get to the bottom of the situation here. I have received information from Ibexnetwork, and on the basis of that information, I have requested information from Leopold to figure out what happened. There have been multiple iterations of exchanging information in an effort to resolve what happened and how it happened, and then to take appropriate action.

Michael

[Roulette Zeitung]

I have requested information from Leopold

You have received information from Leopold!

I sent full header, content of the email, redirections, http header, tracking codes, the 30 character click-id, everything you need in some emails and PM.

Full information to make in investigation!

The only data i have not given out is the first name in the content of the email and the email adress because in both email adresses there are real names into it.

Real names!

...from a person outside of my family too!

I asked this morning a German laywer, specialized on internet law, told him the story, and he said to me, it is not necessary to publish such private data.
It is not necessary to determine if all other things are passed.
He also does not understand why I'm always forced to issue privacy data.
In no case I shall pass on the data.

Privacy data I just give someone I know personally or I give unconditional trust.
And these are only a handful of people I give unconditional trust.
Privacy data are not an object of bartering.
Never!
In Germany privacy data are like a Holy Grail!
Is it so hard to respect that?

Ibexnetwork had enough time to at least apologize.
This can be done even before the conclusion of the investigation.
Not a word!
Unless they claim, I would be lying.
That in itself would be worth a big warning article on my website.
And they can be sure that it will come to that if I have to run to a lawyer again, investing money because of the Ibexnetwork spam.

I've waited long enough, many hours invested. It's enough for me now.

They should find the spamer. If they are unable to find him because of the great tracking system, then they should apologize to me public.

Leopold

[MichaelCorfman]

You have received information from Leopold!

Yes, I apologize my reply did not make that clear in my post above. Based on the information you provided to me on June 23rd I had a further exchange with the folks at Ibexnetwork and received their response on June 24th. Based on their response to me I sent you a further message on June 26th, and apologized for the delay of a couple days in getting back to you, explaining it was because I had been busy, and not because of a delay in receiving a response from Ibexnetwork.

Leopold, at this time I am awaiting a reply to the email I sent to you on June 26th.

Michael

[Roulette Zeitung]

Leopold, at this time I am awaiting a reply to the email I sent to you on June 26th.

You have received an reply some minutes ago.
And i sent you on 22th an PM with the complete header and the source code of the spam email.

The html source code too!

Nobody needs a copy of an email if he have the full html source code, header and all redirection links.

After this i wrote you more emails. Because I have written them i can make one of them public. It's my email.

The readers should see, what's going on with Ibexnetwork. Both guys are online again now in this moment (Currently Active Users) in the forum but don't write one word again.

This is one of some emails i sent last Sunday (German time):

Spam email 1 (Reason i opened the topic)

Date of the email: 17 June 2013 21:31 (German time)

The click id from the email link:

This is the complete way if i click on it. The way from the 1st click until the target:

trace20.com/fb/7125012EF9E5081C12A7CF7A2AD0FFFF89D2F5666FF20D87BC A9405FCD57808CBBFC8D302CFE815FA3EE2600F8A42132/show.aspx?lstr=aHR0cDovL3RyYWNraW5nLmliZXhuZXR3b3J rLmNvbS9hZmZfYz9vZmZlcl9pZD0xNjImYWZmX2lkPTImYWZmX 3N1Yj1MUlNBREUxMDQwOTkwNyZ1cmxfaWQ9MTExNA==

tracking.ibexnetwork.com/aff_c?offer_id=162&aff_id=2&aff_sub=LRSADE10409907 &url_id=1114

tracking.ibexnetwork.com/aff_r?offer_id=162&aff_id=2&url=http%3A%2F%2Fde.ro xypalace.com%2Fspezielle-angebote%2Fslots-de.aspx%3Fbtag%3Drpaff10062_1024d0ee87bf50d45f6f42 951bfe2d&urlauth=483672292288900746727803197339

The click id i think is from the 3rd link (beginning with „tracking.ibexnetwork...“) It must be the last 30 characters after „urlauth=“.

Click id = 483672292288900746727803197339


[...]

The email adress is privacy because of a real name in the email adress, but i can tell you, that the owner of the email adress have never subscribed to any casino or gambling newsletter or list.


Spam email 2 (My family received)

Date of the email: 21.June 2013 13:26 (German time)

The owner of the email adress have never subscribed to an gambling or casino list too. Our family never do it because newsletter or casinos lists are trash.

The same tracking code and same click id (483672292288900746727803197339) if you can see.

tracking.ibexnetwork.com/aff_r?offer_id=162&aff_id=2&url=http%3A%2F%2Fde.ro xypalace.com%2Fspezielle-angebote%2Fslots-de.aspx%3Fbtag%3Drpaff10062_1024d0ee87bf50d45f6f42 951bfe2d&urlauth=483672292288900746727803197339

Now i hope the affiliate can be located. I have now invested one more hour in this case.

Leopold

Every time i see the guys from Ibexnetwork online in the bottom of my browser and don't see a post from them, i am very impressed.

The spam email link ist still working and goes to Roxy Palace.

I'm tired of it now.
Either the spamer will be found or they apologize to me.
I'm not the one who is guilty.This is still Ibexnetwork and no one else.

Maby i should repeat.........

Privacy data I just give someone I know personally or I give unconditional trust.
And these are only a handful of people I give unconditional trust.
Privacy data are not an object of bartering.
Never!
In Germany privacy data are like a Holy Grail!
Is it so hard to respect that?

I have no more time for Ibexnetwork and their spam.
Players will be cheated.
These people are 100 times more important for me.

Ibexnetwork can apologize or not.
They must bear the consequences.

Leopold

[Roulette Zeitung]

I was asked for the content of the spam emails!

The 1st name (XXX) i deleted (red).

"XXX Um ein Gratisangebot zu erhalten, gehen Sie sicher, dass alle Bilder zu sehen sind!

Translated:

"XXX to receive the free offer, make shure, that all pictures are seen."

Everybody knows, that it's very dangerous to unblock blocked pictures!

To make it visible:



Leopold

[Roulette Zeitung]

Hello,
please wake me up, when an actual response with substance because of Ibexnetwork spam.............

In the meantime: http://www.environmentalgraffiti.com...-animals-world

Leopold

[universal4]

Did we not determine this spam was being sent by an affiliate of Roxy and not Roxy itself?

Or are there inside connections that can be PROVEN between IBex and Roxy? (besides an affiliate relationship)

Rick
Universal4

[Roulette Zeitung]

Did we not determine this spam was being sent by an affiliate of Roxy and not Roxy itself?

This is the reason why i wrote in my post "Ibexnetwork spam" and not "Roxy spam".

Or did i wrote in the last time anywhere, that Roxy is guilty of the spam?

?

Then please quote me.

I made clear, that Ibexnetwork is the source of the spam.

Not to be guilty of spam but hurting webmasters are two different things.

And of course it's an affiliate of Roxy, because the tracking proves, that Ibexnetwork itself is the affiliate of Roxy (intermediaries for webmasters).

Ibexnetwork itself makes the deals with the casinos e.g. Roxy and have an own tracking system for their own affiliates, is working as an intermediaries.

Since weeks now i will be fobbed off, and this is the reason i have to post. Otherwise everybody can sent spam and nothing will happened because it can be sweeped under the mat.

Leopold

[universal4]

Thanks for the clarification Leopold.

This does not get anyone off the hook, and I do think that Roxy can and should step up to the plate and help a little more with this, however they may be helping more in the background, so I am looking forward to seeing this resolved also.

Spam complaints need to be carefully looked at, since there can be innocent parties involved, and ultimately the final destination of the promoted links and the affiliate id's associated with those links are usually an indication of the direction to focus on.

Rick
Universal4

[Roulette Zeitung]

Hello Rick,

thank you for changing the title of this tread adjusted to the current events.

This is very professional.

Leopold

[Roulette Zeitung]

.Again 3 weeks are over...


Twitter...

Ibex Network is looking for a talented video producer!
Ibex Network is looking for an amazing Office Manager.

My familiy received spam from Ibexnetwork.

The GPWA solution is clear, because it's very interesting, what's going on in the background:

#
# robots.txt for www.gpwa.org
#
User-agent: *
Disallow: /forum/archive/
Disallow: /login.aspx
Disallow: /forum/portal-webmaster-interview-series-aksana-radaman-aksana-173189.html
Disallow: /forum/rival-paradise-8-cocoa-casino-no-longer-accepting-canadians-178740.html
Disallow: /forum/thames-point-management-ltd-unknown-payment-198004.html
Disallow: /forum/ibexnetwork-com-warning-209699.html
Disallow: /forum/roxy-ibexnetwork-spam-enough-already-211920.html
Disallow: /forum/warnung-vor-ibexnetwork-209525.html
Disallow: /member/deborah
Disallow: /member/sonet-geyer

Crawl-delay: 5

Source: https://www.gpwa.org/robots.txt

GPWA is not fighting against spam.
GPWA is hiding the truth from Google Index!
The robots.txt is the proof.

Do you really believe, i don't see these things?

I made a copy of this post. If this will be censored, then i have one more evidence, that somebody from GPWA don't want to fight the Ibexnetwork spam.

He wants to fight against the truth.

Leopold

[universal4]

First of all Leopold, contstantly accusing people of censoring the forum is crap when it was NEVER censored, and we made our status very clear on that fact, YOU were moderated because YOU consistiently would not follow the rules.

Now what you posted today is very interesting and I for one have no plans on removing it, and I also would like to know why those entries in the robots.txt file exist.

If there is something that creates those entries automatically, and you discovered a flaw, then we can work toward fixing that.

If someone at the GPWA created those entires manually, I also would like to know why.....but to throw out unwarranted and unsubstantiated claims of censorship, when not once has there been any, well just shows how you post claims without first investigating FACTS.

Rick
Universal4