It seems like a lot of people have either been spammed by “tententwelvecorp” or have been on the receiving end of a Joe Job from their spams. The onslaught continues apace, but I’ve learned quite a bit from the comments on my earlier post. People have been finding my site when running searches for info on this stock scammer.
There is also some new information to put out here. Specifically, in his latest emails he’s expanded his stock picks to include Labwire (LBWR) and Southwestern Medical INC (SWNM), and in a few he’s including a phone number for people to opt-out (since his domains seem to have been suspended). The number given is (310)598-7434. Searching Google and doing some reverse searches didn’t turn up anything of interest (or anything linked to “Johnson Eddisson”, should he actually exist).
I’ve also gotten a few emails via the contact form from people who are wondering what’s going on. This is most especially true for people who don’t know much about computers or email. I’m including my answer to the latest one here in the hope that people who search for information on this spammer will find it. I’ve tried to make it readable for the lay person, but as always, it’s difficult to talk about computers, the Internet, and email without using some amount of jargon.
The original message:
I did a search on tententwe… and noticed that you made reference to them. I keep getting emails (addressed to me) from people who I don’t know and it said to contact info-att-tententwelvecorp.com if I wanted them to stop. I changed the -att- to @ and tried to send the email but it didn’t work. I don’t know a lot about the interenet. Since it sounds like your situation might be similar, I was wondering if you could explain any of it to me? Thank you.
My response:
What is happening here is that a spammer is using a network of infected PCs to send spam to various people. These networks of infected PCs are often called “botnets” (from the term “robot network”). When the PC is infected (which can occur through a virus, a worm, or a trojan) it becomes a node in the botnet and takes commands from a central controller. In this case, the spammer is using the network of PCs to send out spam. They do this because sending spam from a legitimate internet-connected server is a quick way to have it shut down (since this act violates the Terms of Service of almost all legitimate hosting services). These PCs are usually connected to the internet via Cable Modem or DSL and offer a quick and anonymous method to blast out thousands of emails in a short period of time.
The other part of the problem is that the protocols used on the Internet for exchanging email don’t have any security built into them. They were developed in an era of mutual trust when the Internet was much smaller (and only universities, the military, and very few corporations were connected). Because the protocols are so lax, it is a simple matter for the spammer to compose a message that appears to be from someone else. In fact, I did the same thing with the contact form that you filled out to send me your original message. When it arrives in my Inbox it appears to be from you, even though my web server actually sent it (this is actually considered a legitimate use of the protocol, though).
Since no one likes spam, putting your real email address in the “From:” of a mass mailing is a quick way to render that email address useless. In fact, many email providers/ISPs will cancel an account if it can be proved that the person who owns the email address actually sent the spam from it. So, the crafty spammer will either put a bogus email in the “From:” and “Reply To:” fields, or he will put someone else’s email address in there (this is known as a “Joe Job” in that it can be a form of attack against the person whose email address was used by the spammer).
This particular spammer is just making up email addresses as he goes by picking a person’s name and then associating a made-up email address with a VALID domain (the part after the “@” sign). An example (that I just pulled out of my Trash folder): “Rosamund Hutchins” <hfl-at-aubreyturner.org>. There is no user named “hfl” at aubreyturner.org, and I don’t know a person named “Rosamund Hutchins.” But anyone receiving this email will possibly think it’s from her and that it came from my domain, when in fact it came from an infected PC in Switzerland (84-72-176-238.dclient.hispeed.ch to be exact).
However, since I’ve configured a “catch all” address for the domain (i.e. any email that isn’t addressed to a particular user goes to this address), then I receive a message for every single spam email that did not make it to the destination (a “return to sender” or “bounce” email). So my interest in finding and eradicating the owner of tententwelvecorp is because I own “aubreyturner.com” and “aubreyturner.org”, both of which have been used for the “From:” address in this spammer’s email blasts. So far I’ve received well over 200 bounce messages. It’s not clear at this point whether I (and the others who have been on the receiving end of these bounces) was selected because I ticked this guy off at some point in the past or whether he just randomly picked some domains.
Recent legislation in the U.S., called the “CAN-SPAM” act, requires that every commercial email have a valid “From:” address and include information on how to opt-out of the mailings. None of this spammer’s messages conform to these requirements, so if he is in the United States, he could be liable for a civil judgement of up to $11,000 per violation. Additionally, by pumping these stocks, he could also be in violation of various S.E.C. (Securities and Exchange Commision) rules (which could be a criminal matter). So it’s no surprise that “[email protected]” didn’t work. His domain has probably been suspended because of the spam he’s been sending. Further, it appears that his domain’s contact information is bogus, so it’s nearly impossible to contact him.
In his latest round of emails, he is now including a phone number, but I haven’t had time to investigate it. My suspicion is that the number is either bogus or it belongs to someone he doesn’t like (who will get irate phone calls from people who got the emails).
So, to sum up this long-winded reply: “spammers suck.” 
Since I wrote that reply, I’ve learned (from a commenter in the original post) that the phone number actually has a message requesting you to leave your email address to have it removed. I’m not sure I’d trust it, though. An asshole who would use other peoples’ domains for his bounces would just as likely take the opt-out list and use it as a list of “confirmed, hot” leads…
Update: I see from the latest bounce that he has yet another domain, senginernd.com, which redirects to a Lycos-France member page, appearing to belong to a member called “removalsystem2”. That site contains his “disclaimer.” I found this bit interesting:
In compliance with the Securities act of 1933, Section 17(b), the publisher of this newsletter discloses they received payment from an unaffiliated third party for the circulation of this report in the amount of $200,000. Be aware of an inherent conflict of interest resulting from such compensation due to the fact that this is a paid advertisement and is not without bias. As we have received compensation in the form of free trading securities, we may directly benefit from any increase in the price of these securities.
So it would appear that this is a “pump and dump” sort of thing, where he is trying to inflate the price and then dump his shares. I suppose by his disclosure he thinks he’s covering his butt legally. Perhaps he is, as I’m not a lawyer. But it’s pretty slimy. Also notice that his verbiage implies that this is a “newsletter” and that there are “subscribers” (a term he used earlier in the disclaimer).
Here’s the WhoIs for senginerd.com:
Registration Service Provided By: NameCheap.com
Contact: [email protected]
Visit: http://www.namecheap.com/
Domain name: SENGINERND.COM
Registrant Contact:
MTG-Experts
Carl Bach ([email protected])
+1.6025413374
Fax: +1.5555555555
Pol Comtois Str.
Los Angeles, CA 60981
US
Administrative Contact:
MTG-Experts
Carl Bach ([email protected])
+1.6025413374
Fax: +1.5555555555
Pol Comtois Str.
Los Angeles, CA 60981
US
Technical Contact:
MTG-Experts
Carl Bach ([email protected])
+1.6025413374
Fax: +1.5555555555
Pol Comtois Str.
Los Angeles, CA 60981
US
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 18 Oct 2005 14:43:36
Expiration date: 18 Oct 2006 14:43:36
I wonder if there’s really a “Carl Bach”? It sounds fake.
April 19, 2006
|
Posted by Aubrey Turner
Categories: Technology, What the heck?
