The MKT Negocios Spammers in Argentina

For years I’ve been tracking spam from Argentina that is using yopmail.com / yopmail.net disposable sender addresses.

Unlike a lot of spam sent from other countries, the advertised companies are mostly legitimate businesses, some of whom may be clueless that mail is being sent to unwilling recipients all over the globe who may not even speak Spanish.

The sender IPs tend to be on cablevision.com.ar, for example from the 190.188.0.0/15, 190.190.0.0/15 and 181.164.0.0/14 ranges.

The spamming company owns several domains, but these don’t normally show up in sender addresses or links, e.g.:

mktnegocios.net:

Domain name: mktnegocios.net
Registry Domain ID: 186887
Registrar WHOIS Server: whois.dattatec.com
Registrar URL: http://dattatec.com
Updated Date: 2017-09-20T01:00:53Z
Creation Date: 2011-09-19T11:24:51Z
Registrar Registration Expiration Date: 2018-09-19
Registrar: dattatec.com SRL
Registrar IANA ID: 1388
Registrar Abuse Contact Email: abuse@dattatec.com
Registrar Abuse Contact Phone: +54.3415169000
Domain Status: OK
Registry Registrant ID: DC282919DTT
Registrant Name: Cid Ricardo Ernesto
Registrant Organization: Cid Ricardo Ernesto
Registrant Street: Islandia 4393
Registrant City: Lanus Oeste
Registrant State/Province: Buenos Aires
Registrant Postal Code: 1824
Registrant Country: ar
Registrant Phone: +54.42679611
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ricardocid@hotmail.com

mktnegocios.info:

Domain Name: MKTNEGOCIOS.INFO
Registry Domain ID: D42311407-LRMS
Registrar WHOIS Server:
Registrar URL: http://dattatec.com
Updated Date: 2017-09-19T22:22:35Z
Creation Date: 2011-09-19T11:25:09Z
Registry Expiry Date: 2018-09-19T11:25:09Z
Registrar Registration Expiration Date:
Registrar: Dattatec.com SRL
Registrar IANA ID: 1388
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Reseller:
Domain Status: ok https://icann.org/epp#ok
Domain Status: autoRenewPeriod https://icann.org/epp#autoRenewPeriod
Registry Registrant ID: C114356985-LRMS
Registrant Name: Cid Ricardo Ernesto
Registrant Organization: Cid Ricardo Ernesto
Registrant Street: Islandia 4393
Registrant City: Lanus Oeste
Registrant State/Province: Buenos Aires
Registrant Postal Code: 1824
Registrant Country: AR
Registrant Phone: +000.42679611
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ricardocid@hotmail.com
Registry Admin ID: C114356985-LRMS
Admin Name: Cid Ricardo Ernesto
Admin Organization: Cid Ricardo Ernesto
Admin Street: Islandia 4393
Admin City: Lanus Oeste
Admin State/Province: Buenos Aires
Admin Postal Code: 1824
Admin Country: AR
Admin Phone: +000.42679611
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: ricardocid@hotmail.com
Registry Tech ID: C114356985-LRMS
Tech Name: Cid Ricardo Ernesto
Tech Organization: Cid Ricardo Ernesto
Tech Street: Islandia 4393
Tech City: Lanus Oeste
Tech State/Province: Buenos Aires
Tech Postal Code: 1824
Tech Country: AR
Tech Phone: +000.42679611
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: ricardocid@hotmail.com
Registry Billing ID: C114356985-LRMS
Billing Name: Cid Ricardo Ernesto
Billing Organization: Cid Ricardo Ernesto
Billing Street: Islandia 4393
Billing City: Lanus Oeste
Billing State/Province: Buenos Aires
Billing Postal Code: 1824
Billing Country: AR
Billing Phone: +000.42679611
Billing Phone Ext:
Billing Fax:
Billing Fax Ext:
Billing Email: ricardocid@hotmail.com
Name Server: NS21.DATTATEC.COM
Name Server: NS22.DATTATEC.COM
Name Server: NS3.HOSTMAR.COM
Name Server: NS4.HOSTMAR.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

mktnegocios.com.ar:

Datos del dominio
Nombre y Apellido: DALLAVIA FERNANDO LUCIANO VICTOR LUCIANO VIVTOR
CUIT/CUIL/ID: 20220483895
Fecha de Alta: 23/01/2017
Fecha de última Actualización: 24/01/2017
Fecha de vencimiento: 23/01/2018

On their website they explain to their prospective customers that they will spam to harvested addresses:

BASE DE DATOS :

Contamos con bases de datos argentinas y del exterior validadas la totalidad de las mismas cada 15 dias, asegurandonos asi la completa funcionalidad y validez de los emails. Los datos se obtienen a traves de extracciones de emails por medio de software en la web.

Translation:

Databases

We have Argentine and foreign databases completely validated every 15 days, thus ensuring the full functionality and validity of emails. The data is obtained through extraction of emails through software on the web.

Owners of harvested addresses have by definition not signed up to receive bulk mail. Their various mailing package go as high as 16,000,000 emails…

See also:

If you’re a business in Argentina trying to decide on online advertising, hiring a spammer like this will damage your reputation and may end up getting your domains blacklisted.

4 thoughts on “The MKT Negocios Spammers in Argentina

  1. Dear Joe:
    -1- when I click on both links: Dave & Karma 2 below I received 404s.
    -2- a previous comment was erroneously flagged as spam and should be sitting in that bin. Akismet seems like it might be a better option.

    AND NOW TO THE QUESTION I WANTED TO ASK:
    ………..what WordPress theme are you using with this blog?

  2. Thanks, I’ll check what’s up with the links to Dave and SK2 – maybe his site has gone away or has been updated.

    Every spam filter has false positives. So far the FP rate seems to be low with SK2.

    About the theme: It’s “Twenty Eleven”

  3. I am the maintainer of the Spam Gang Argentina page you mention. Thanks for that. I also listed this page on my record of Daniel Mancuzo.

    I think you observed it well, often legitimate companies are advertised. I assume they’re not innocent by running an affiliated program which does send any email address out the affiliate (spammer) provides.

    Spam often comes via Fibertel Cablevision, one of the large ISPs in Argentina. They are either incompetent to handle spam complaints (I never get a reply or see a spammer booted), ignorant or even support spamming.

    Keep up the great job!

  4. Spam from D. Mancuzo:

    ====
    Received: from maria.com (unknown [179.51.227.94])
    by *REDACTED*
    for *REDACTED*; Wed, 3 Jan 2018 20:35:44 -0500 (EST)
    From: noresponder@maria.com (Julia)
    To: *REDACTED*
    Subject: consulta
    Date: 03 Jan 2018 22:35:39 -0300
    Message-ID: *REDACTED*
    MIME-Version: 1.0
    Disposition-Notification-To: mancuzodm@gmail.com

    Pocas Ventas y necesitas un poco mas?

    Hola, quería ofrecerte un programa de envíos masivos de mails, que configure para que no tengas que hacer nada, ni necesites entender nada de programaciones complicadas, solo Tenes que disponer de un archivo con la publicidad que quieres dar a conocer, así de fácil es este programa, el mismo cargara una base de contactos, de más de 1 Millones de Emails de Argentina. Automáticamente.
    Te voy a dejar 2 videos que subí a YouTube, para que puedas entender con más claridad como funciona. Veras que podes hacer un envío de 10.000 emails por minuto, y eso hace que este programa, sea el mas veloz de todos los que puedas conocer…
    Creo que es una buena oportunidad para mejorar tus ventas o promociones, como también lograr muchas visitas a tu página web.

    Yo lo uso hace muchos años y con excelentes resultados, por eso me gustaría que lo puedas probar, y descubrir que es uno de los métodos más efectivos y rápidos para conseguir muchas ventas….

    Y por solo $ 600. Como único pago.

    Mas asistencia remota con Teamviewer, por si Tenes algún problema. Si te animas vas a entender que este sistema de Publicidad, es el más rápido y efectivo que existe…

    https://www.youtube.com/watch?v=c366VjNN234

    https://www.youtube.com/watch?v=0geaLLd2IIU&t=601s

    dmancuzo@outlook.com (UNICO MAIL DE CONTACTO)

    Muchas Gracias

    Y disculpa si este mail te molesto…

    “Solo fracasa el que no lo intenta “

    ¿Deseas dejar de recibir estos emails? Click

    Eliminar de la base
    ====

Leave a Reply

Your email address will not be published. Required fields are marked *