We have seen our domain name Remove.com being used by spammers in their mass emails.
Remove.com does not have email service at all nor any mailing list, and we are not in any way affiliated with any companies below and have not at any time given permission to anyone to use these email addresses or any urls.
We are not a hosting company. We are not a mailing list provider (and not a mailserver provider). We do not buy or sell mailing lists. We are not an advertising company. We do not provide any external user accounts.
It is possible that there are more companies fraudulently using this domain - we are absolutely not affiliated with these spammers in any way.
You can help us fight spam by going through the spam-related FAQ at this page. It contains an excellent overview of tracing spam and actions you can take to reduce it.
Please note that the "From" email addresses can be forged (and usually are forged). Any mention of "From" addresses on this page does not automatically mean that the spammer was really that specific email id. They are included here to have as much info as possible and in fact sometimes can prove that the from address was forged by looking at the IP address if available.
Following are the known spam cases:
Around Dec 23 2003:
Spam Details:
Subject: Re: webmaster, Never Over Pay Again For Medications... jmtls Headers could vary. Here is one of them forwarded by a recepient: Received: from 165.21.74.115 (customer-reverse-entry.216.93.176.98 [216.93.176.98] (may be forged)) by mx15.singnet.com.sg (8.12.10/8.12.10) with SMTP id hBNEZrka031699; Tue, 23 Dec 2003 22:35:53 +0800 Received: from [191.98.178.216] by 165.21.74.115 with SMTP; Sun, 09 Nov 2003 19:28:03 +0300 Message-ID: <2-ek--a-t-se-03-4@onn.0e>Domain being "spamvertized" : WorldClassRX.com At the end - has our domain in remove link:
"If you wish to be removed from our mail savings we apologize for any inconvience and you may click here""here" link shows : http://www.remove.com/?contact@magneticone.com as the address. There is no such web/email address on remove.com domain and we have no affiliation with the spammers. The whois info shows:
worldclassrx.com
Web Drug Corp.
Edward Jones
9234 Tampa Rd
Tampa, FL 34684
US
Phone: 727-324-4243
Fax..: 727-324-4782
Email: snagster2k@netscape.net
Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com
116.145.61.in-addr.arpa origin = dns.guangzhou.gd.cn mail addr = root.dns.guangzhou.gd.cnAlso checked the DNS they use:
Domain servers in listed order: NS1.DNS4FREE.ORG 202.108.254.204 NS3.DNS4FREE.ORG 202.108.254.206 Domain ID:D84084148-LROR Domain Name:DNS4FREE.ORG Created On:01-Mar-2002 06:05:52 UTC Last Updated On:22-Jun-2003 14:11:18 UTC Expiration Date:01-Mar-2004 06:05:52 UTC Sponsoring Registrar:R91-LROR Status:OK Registrant ID:GODA-0748814 Registrant Name:Jack Rapport Registrant Organization:DNS 4 Free.org Registrant Street1:1433 Tampa, RD Registrant City:Tampa Registrant State/Province:Florida Registrant Postal Code:33784 Registrant Country:US Registrant Phone:+1.8134780412 Registrant Email:thenoisebringer@yahoo.comTried calling the phone number and got a "wrong number" reply.
Around Apr 5-9 2003
Spam Details:
Contains a link to "http://www.remove.com/remove.html" for removing from mailing list.
Subject: digital power discrambler In the body of the message - DIGITAL CABLE FILTER!!! The ULTIMATE Digital Cable Discrambler Filter. Free PAY-PER VIEW Free ADULT Channels Access ALL Movie Channels Access Special Ordered Sports All of this comes FREE GUARANTEED OR YOUR MONEY BACK ...Around Apr 5-9 2003
Spam Details:
Contains a link to "http://www.remove.com/remove.html" for removing from mailing list.
Subject: guaranteed gold visa In the body of the message - SIGN UP FOR YOUR UNSECURED GOLD VISACARD!!! You are GUARANTEED to recieve a CARD. * 100% Guaranteed * Approval * No Checking Account Required * No Credit * Check * No Credit, Bad Credit, * No Problem * Divorce, Bankruptcy ...Around Last week of Nov 2002
Spam Details:
Subject: Become a pragmatic and get ahead of the pack Contains a link to "http://www.remove.com/remove.html" for removing from mailing list. Received: from freevirtualconnect.org [64.225.251.36] by ipsmin0165atl2.interland.net (SMTPD32-6.06) id A3C058F800BA; Thu, 28 Nov 2002 06:53:36 -0500 Message-Id: <1RCL7S9XW97F0B6APF74.66KU4O1V.steve@freevirtualconnect.org> Reply-To: steve@freevirtualconnect.org From: steve@freevirtualconnect.org Received: from freevirtualconnect.org by 9OEN6V0410PSB.freevirtualconnect.org with SMTP for xxxxx@xxxxxxxxxxxxx; Thu, 28 Nov 2002 07:05:23 -0500 Date: Thu, 28 Nov 2002 07:05:23 -0500 Content-Type: text/html; charset="iso-8859-1" X-MSMail-Priority: Normal Subject: Become a pragmatic and get ahead of the pack To: REMOVED X-Priority: 3 X-Sender: steve@freevirtualconnect.org Content-Transfer-Encoding: quoted-printable X-RCPT-TO:X-UIDL: 334890632 Status: U The spamming company/individual: thefreevirtual.org freevirtualconnect.org and MYDOMAINPARK.COM (DNS Which holds these names) All are owned by the same person Administrative Contact:: Michael Hamilton: admin@thefreevirtual.org Domains4Lease PO Box 025216, SJO3016 Miami, FL 33102 US Phone:: 013054686390 Fax:: Technical Contact:: Michael Hamilton: admin@thefreevirtual.org Domains4Lease PO Box 025216, SJO3016 Miami, FL 33102 US Phone:: 013054686390 Fax:: Has nameservers listed as NS1.MYDOMAINPARK.COM 61.129.78.16 NS2.MYDOMAINPARK.COM 61.129.78.17 which belog to himself. Looks like the name was registered for the sole purpose of spamming.
Around Sep 21 2002
Spam Details:
The spamming company/individual:
"http://rd.yahoo.com/M0/t=0/*http://www.1easy-mortgage.net/amortgage/"
This is the link embedded in "Click Here to Get Started"
They are illegally using "www.remove.com" url in the second last line which says
"If you would like to
be removed from our list click
here"
Here is a sample spam:
Subj: bgcdc, Rates go lower. Re-Fi again! ; Date: 9/22/2002 8:12:37 PM Eastern Daylight Time From: nbgcdcji@yahoo.com To: your name here Sent from the Internet (Details) $User Looking for a lower mortgage payment? We have hundreds of loan programs! * Purchase Loans * Refinance * Debt Consolidation * Home Improvement * Second Mortgages * No Income Verification Click Here to Get Started If you would like to be removed from our list click here KugeMore Update on the above case:
Registrant: Tony Ramirez tony@echris.org 6026192541 None 1322. N. Monte Vista Mesa,AZ,United States 85215 Domain Name:1easy-mortgage.net Record created on 2002/7/24 Record expired on 2003/7/24 Domain servers in listed order: locked-due-to-spams1.olnic.net 211.155.225.126 locked-due-to-spams2.olnic.net 211.155.225.127 Administrator: Tony Ramirez tony@echris.org 6026192541 1322. N. Monte Vista Mesa,AZ,United States 85215 Technical Contactor: Tony Ramirez tony@echris.org 6026192541 1322. N. Monte Vista Mesa,AZ,United States 234567 Billing Contactor: Tony Ramirez tony@echris.org 6026192541 1322. N. Monte Vista Mesa,AZ,United States 85215
Involved parties:
olnic.net is registered to a chinese company/individual.
echris.org details are:
Domain name: echris.org
Nameservers:
DNS1.NAME-SERVICES.COM
DNS2.NAME-SERVICES.COM
DNS3.NAME-SERVICES.COM
DNS4.NAME-SERVICES.COM
DNS5.NAME-SERVICES.COM
Creation date: 11/14/01 00:00:00
Expiration date: 11/14/02 00:00:00
Registrant Contact:
CRCComputing
Rory Witt (CRCRory@aol.com)
480-854-2022
FAX: none
7060E.MesetoAve.
Mesa, AZ 85208
US
Administrative Contact:
CRCComputing
Rory Witt (CRCRory@aol.com)
480-854-2022
FAX: none
7060E.MesetoAve.
Mesa, AZ 85208
US
Around May 02 2002
Spam Details:
This seems to be a spam from a company called "http://www.introplace.com".
Contains following headers: