Geographically Targeted Spam

The link in this e-mail points to a page containing the message:



It then redirects through the following series of URLs:

http://login.tracking101.com/xx/xxxxxx/
http://login.tracking101.com/geo_tracking_redirect.html?e=xxxxx
http://login.tracking101.com/z/54552/CD579
http://www.perfspot.com/join.asp?p=80247&t=CD579

This example clearly illustrates that you never get what you see in spam e-mails. The e-mail advertises eBooks, but you end up on a completely unrelated site, like a social networking site. Everyone will receive the "We're sorry.." message because there were no eBooks in the first place, the final destination site is always the primary goal of the spammer. In this specific spam example, the final destination site is determined by your geographic location, for example, people living in the United States will end up on a different site than people living in the United Kingdom. In South Africa the link redirects to Perfspot.com. This comes to show how sophisticated spamming has become. To terminate a spam campaign like this you need to take out the tracking site doing the redirects, otherwise the spam campaign will remain active until all destination sites are terminated.

The spam victim's e-mail address is encoded into the links of the spam e-mail, so a mere click on one of these links enables the spammer to identify your e-mail address as an active e-mail account, so don't even think of clicking on the unsubscribe link, you will only get the opposite of what you expected (just like you got the opposite of what you expected from the first link in the spam e-mail).

Very few people realise that they actually pass through a tracking portal before they reach the destination site. These tracking sites, acting as a middle-man between the spam e-mail and the destination site, can be used to verify your e-mail address, install malware on your PC, collect personal information stored on your PC or place a tracking cookie on your PC (and nothing stops a tracking site from doing all of these things at once).

The goal for the spammer is to get the recipient of the spam e-mail to sign up for an account at Perfspot.com (or whatever site it redirects to). The tracking codes at the end of the destination URL are used to monitor the effectiveness of the spam campaign and to identify the affiliate/agent who should receive commission for the referral.

Lately a lot of spam e-mails are signed off with the address: 4408 McLean Rd Haltom City TX 76117. It is the address of Cozmo SEO Power, Inc. and guess whose name and logo comes up when you visit limestolimeade.com, yes you guessed it, Cozmo SEO Power. Off course the domain limestolimeade.com is also registered in their name.

So an important lesson is to be learned from this example: Never click on links in spam e-mails!