Skip navigation

The Lunacy of Some Junk Mail

Lately I've been receiving some strange messages that, to me, are nothing less than spam. The irony in this is that the sender claims to help people prevent spam. Yet when I examine the message itself and the related Web site it seems that something isn't quite right.

I've pasted in the message below, minus the HTML rendition of the plain text. I've also removed my private email address, my mail server name, the message time, put some spaces into the URLs and domain names so that they don't automatically generate clickable links in your Web browser, and obscured the "remove" link to protect my private email address. Other than that the message is exactly as I received it. The real domain name can be rebuilt by simply removing the spaces in the domain name which I have inserted.

Take a look at the message header. The first thing I noticed was that the message was sent directly to my mail server from the sending system. In other words, whoever sent it wasn't using typical mail server routing technology. They intentionally connected directly to my mail system from their system bypassing any other outbound mail servers in the process. Why would they do that?

Then look at the "Received:" line. It clearly reveals that whoever sent this email has attempted to spoof their IP address!  Is that something an upstanding business would do?

Return-path: \[ @unsubscribe now .info\]
Envelope-to: \[ address deleted \]
Delivery-date: Thu, 06 Jan 2005 \[ Time deleted \]
Received: from \[\] (helo=
 by \[ mail server name deleted \] with smtp (\[server software version deleted\])
 id 1CmZRT-0005Pk-S3
 for \[ address deleted \]; Thu, 06 Jan 2005 \[ Time deleted \]

I was curious about this company since they claim to help people remove their email addresses from junk mail lists. So I visited their Web site and poked around a little bit. It's a spiffy Web site and looks professional enough, even though their "terms of service" are tough and require that people give up certain legal rights.

Nevertheless the way they harvested my email address and started spamming me raises an interesting question, which in posing it, seems to answers itself: Why would a company harvest my email address and spam me in order to ask me to pay them $36 per year to remove my name from spam lists?


Whether this company is legitimate or not, I have no idea. But I do think their practices are less than admirable.

Anyway, here's the rest of the message contents for your amusement:

From: "Unsubscribe Now .org"
To: \[ address deleted \]
Subject: Fwd: ADV: IMPORTANT: this email address is circulating... (service announcement)
X-Mailer: eGlobal Planet (MMS 1.7c - CNCGroup Hebei)
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--Unsubscribe Now .org_multipart_boundary____________"
X-Priority: 1
X-MSMail-Priority: High

----Unsubscribe Now .org_multipart_boundary____________
Content-Type: text/plain;


\[Unsubscribe Now .org OLX Public Interest Announcement\]

If you've received this message - then your email address has been
screened circulating on junk-email and spam related mailing lists.
Unsubscribe Now .org spam-traps junk-email circulating online, parses
multiple-recipient addresses and registers 'remove-me' links into
the Unsubscribe Now .org remove-me database.
To learn how we help clear and 'Opt-out' your email addresses
online, visit us at:   http ://www. unsubscribe now .org/index5.php


About CC multiple recipient email addresses.

CC is an acronym for carbon copy. In order to multiply sending
rates, messages composed by bulk mailers will often use a random
multiple-recipient CC addressing feature where one message is
sent to batches of addresses at a single time.

Unsubscribe Now .org's screening network utilizes 676 online
spam-traps (26 A-Z x 26 a-z second tier letter variants) which
are collected by email address harvesters and propogated into
circulating mailing lists. Single and multiple recipient email
messages sent to these trip lists are collected, their information
is parsed and an automatic responder is sent to attached
addresses as the Public Interest Announcement you have
received today.

Learn more about our edge-of-the-web screening network by visiting:
http ://www. unsubscribe now .org/about.php


Please note: This email was sent from a notify-only address that
cannot accept incoming email. Please do not reply to this message.

The following links are provided for easy removal from our
distributed advisories:

http ://www. unsubscribe now .info/\[ unique URL deleted \]
http ://www. unsubscribe now .net/\[ unique URL deleted \]
http ://www. unsubscribe now .us/\[ unique URL deleted \]


Also on the web

Privacy Policy
http ://www. unsubscribe now .org/support_privacy.php

Terms of Service
http ://www. unsubscribe now .org/support_tos.php

For abuse inquiries: abuse@ unsubscribe now .org
(remove space)


Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.