Have you ever wondered how prolific senders of SPAM are able to fill your inbox and/or what is done when you report them?
TL;DR – They pay large, well-known companies to host/run their programs until enough people complain and are investigated/banned. By then they have set up shop with a new suite of vendors.
For at least the past 6 months, my spam folder has been repeatedly filled up with messages all following the same pattern from start to finish. These aren’t your run of the mill “buy my pills” emails from a foreign nation. These are professionally crafted messages.
It goes like this:
- On average, I’ll receive about 4 to 6 identical messages sent to each of the email accounts I manage (I have quite a few) every day.
- Each email is advertising a loan or line of credit and includes a full name, phone number, address, and link to a website to apply.
- The website looks like any other mediocre website advertising a product.
Over time, the names, numbers, and website domain change but the pattern is always the same. This is an enterprise level spammer who is rinse and repeating a formula while just changing the window dressing.
How are the messages making it to my inbox?
After looking at the email headers, unsubscribe links, and DNS entries, you can tell the spammers were using large, well known systems to both deploy the messages and host the websites. In this example, the companies facilitating the scammers included Salesforce, A2 Hosting, and Cloudflare.
Salesforce
The email “unsubscribe” links pointed to a pardot.com domain which is Salesforce Pardot, an automated marketing suite. The spammers used Salesforce systems to host their leads and send “authenticated” email messages which, while they were identified as SPAM, were still able to bypass being blocked entirely by mail servers due to passing some authentication checks.
A2 Hosting
With the website, I was able to trace the IP address of the server back to an IP range owned by A2 Hosting and was most likely being run off one of their virtual private servers (VPS). These VPS would allow the spammer to run hundreds of small, cloned WordPress websites to collect more “leads”.
This same spammer would eventually also use A2 Hosting services to facilitate the sending of emails.
Cloudflare
While not as serious of an offender, Cloudflare services were still employed to host the spammer’s DNS which brought some “legitimacy” to the websites they were running.
What happens when you complain?
For the most part, not a whole lot. It took me a fair amount of time to get anything other than an automated response email from the various service providers. They are the only ones who are even remotely likely to respond. Don’t bother trying to go through government channels for CAN-SPAM violations.
Most legitimate companies will provide an abuse email address (like abuse@abuse.salesforce.com) where you can send the offending messages, and email headers.
Out of the two companies, A2 Hosting actually provided the best response. Salesforce just kept sending automated emails saying they are ‘investigating’. I don’t believe A2 Hosting ever kicked the spammer off their system and I doubt Salesforce did either. These two companies were making too much money.
Eventually, Salesforce did get so tired of dealing with me that they just added my email addresses to their global unsubscribe list. While great in the short term, it did mean I would never see any email sent by a legitimate company using Salesforce systems (talking to you Charles Schwab and Cracker Barrel).
Where are they now?
Spam activity has died down somewhat as the big email providers are getting more and more strict with filtering messages from bulk senders. From time to time, this specific spammer will still pop up and send me a barrage of emails. The periods between are getting longer and longer as more companies wise up and the spammer runs out of options.
For now, I just apply some well crafted email filters and go about my day.
On occasion though, I will get a little lonely and call the number listed in the emails just to see how “Victor Manning”, “David Dailey”, “Jason Butler”, or any of the other Chief Lending Officers are getting by. To my chagrin, they are never able to take my call but the nice person on the other end is still happy to try to get me a loan….