How to tell the difference between spam and a Joe-Job?

[more snipped]

Whether it's him or a "joe job", they've just shown even more ignorance by doing the all-too-common stupidity of not including the area code. How's anyone outside the immediate neighborhood (which might have overlays anyway) supposed to know who to call?

-it's not just in this type of promotional spam, of course. I look at web based articles from all over the world which will have a "call us at 555-1111" line in them. Duh.

-And even better... I was driving around and picking up tourist type books and guides. And eyup, lots of the advertisements similarly forgot that little detail.

In article you write:

One -easy- way, look at the 'Received' headers.

Note that the sending machine was "adsl-230-249-185.chs.bellsouth.net".

I don't know, off hand, where 'chs' is, in BellSouth's network, but I can guarantee that it does not part of the network used by Clear Channel. Their address block is 207.230.144.0/19. '

' the web site for the station listed in his signature, is also within Clear Channel's address-block.

"whomever' the source is, they are _absolute_ idiots. It's not even competent as a joe-job ---a phone number in the signature *without* an area-code? Wonder how he expects anybody to call it.

The email address given _is_ valid at clear-channel, for what _that_ is worth.

So, either it's a piss-poor joe-job -- probably through a botnet-- =or= Clear Channel hired an _absolute_ _incompetent_ who is s junk mailing directly from his own -residential- account.

I WOULDN'T want to bet on which of those alternatives applies.

***** Moderator's Note *****

Looking at the received header didn't tell me if it was a Joe-Job; it only indicated a high probability of spam. Of course, it is always possible that the sender was working from home, but the fact that the Digest's address got multiple emails, with slightly different subject lines, tended to make me believe it was spam.

The "Joe-Job" question remained until I talked to Mr. Deitsch personally, and he confirmed that he had ordered the campaign. With that in mind, the competence or lack thereof of Clear Channel's marketing department comes into question. From their viewpoint, it may be acceptable to send UCE to unconfirmed addresses - they are, after all, in the broadcasting business, and sending out commercial messages without knowing if any particular individual is listening (or wants to listen) is part of their business.

Since the email contains an "opt out" line with Mr. Deitsch's email addres in it, and he has confirmed that he ordered it sent, the only remaining question (to my mind) is that of intent: is Clear Channel aware that UCE isn't acceptable to most Internet users, and may be illegal in some states? If not, I'll try to educate the firm about it. If they are, then we have a case of a major U.S. company knowingly using spam for marketing, which has always been the "tipping point" that the spam fighters have been trying to prevent.

I've contacted various print and online journalists; we'll see where the trail leads from here in due time. I've also involved a well-known spamfighter, and he'll reach out to ClearChannel and try to make them see the error of their ways .

Bill Horne Temporary Moderator

(Please put [Telecom] in the subject line of your post, or I may never see it. Thanks!)

[[ snip my analysis methodology ]] *sigh* There is NO definitive way to tell that something _is_ a joe-job, unless you already know it from 'external' means/sources. Proving a message to be a joe-job is the equivalent of 'proving a negative' -- proving that the people named did _not_ send it.

OTOH, it is _really_ difficult to joe-job from the 'victim' company's servers. Thus, if it does come from the company servers, it is virtually certain to be 'stupidity in action' by the party in question.

Thus, "first-cut" evaluation is that it's not from the 'legitimate' source. This is _not_ conclusive, but is 'indicative'.

*IF* I'd _had_ to make the call, I'd have said 'not joe-job' -- the only 7-digit phone number was _too_ boneheaded for someone (a) deliberately trying to malign the company, _and_ (b) "internet-savvy enough" to attempt a joe-job, to do.

I had virtually no doubt of THAT, based solely on the little bit of it you quoted. The only question was "who's spam" -- sometimes you can't tell the Vikings apart without a scorecard. :)

The fact that you got several "similar" messages is potentially *REALLY* interesting. Especially _if_ they all came from DIFFERENT 'residential looking' IP addresses. That makes for probable relaying through a botnet, and without the knowledge/permission of the owners of those machines. And if *THAT* is the case, there's possible federal felonies involved. Clear Channel could then have the opportunity to _really_ become "one of the good guys" by going after the 'marketeer' that suckered them, and filing 'high profile' civil lawsuits, and criminal charges ('fraudulent misrepresentation', 'theft by deception', etc.) against them

Beg to differ -- the level of competence (approximately that of the Dead Sea) seems *well* established (at least as far as Mr. Deitsch is concerned, that is) -- since he didn't even put an area-code on the signature block, I'm not sure which of the six area-codes in my local calling area I should tack onto that number to reach him -- assuming, that is, that I _wanted_ to advertise on Clear Channel.

Presumably _they_ (Clear Channel, in the person of Mr. Deitsch) supplied the content, and the spammer-for-hire just sent it out.

BTDT, several times, with some degree of success. Go 'up the ladder', to senior management -- Mr. Deitsch may have done this on his own 'initiative', without clearing with corporate. Ask the firm if _they_ have spam filters on *their* mailboxes, and "if so, why?" Then ask why they are _contributing_ to the problem they're fighting. What is 'different' about their message. Why can't the pill-pusher, or the fake watch seller claim the exact same motivation? Either they _know_, "beyond any doubt", because I have _explicitly_ told them that I want to receive those messages, or they want their business to be viewed in the same light as the folks promoting 'enhance your anatomy',

Another _dirty_ question to ask is "why", if there wasn't anything 'wrong' with that e-mail campaign, did they *NOT* send it from their own servers? Did somebody tell them that _other_ outgoing mail from the server the campaign was sent from might get blocked from delivery? Shouldn't _that_ set off alarm bells about the probable reaction to the 'e-mail blast' itself?