spammer primeswish

I reviewed it but am unconvinced... maybe they want to convert their site to use Drupal and they're not very good at formatting posts? The "Mark from Ireland" sig matches their profile information as well, so it's not entirely random, automated spam if it is.

Moreover, their nick is related to teeth whitening and they posted in the newb forum.

Also, the email used matches the one in the whois record...

Wow, going the extra mile with the WHOIS. That seals it for me.

...and the email is an ISP, not a free mail provider where the mailbox matches the guy's name.

Hello all,
I see your trying to belittle me by me asking a simple question.. yes I'm real and yes i live in Ireland and yes I am doing research for my website as I am only new to all this and no I'm not automated..

I would appreciated if you contacted me direct by my legimate email and asked me instead of making this aquastions..

Regards,
Mark Mulholland (Ireland)
primeswish

@primeswish on the contrary, we decided you were a real person without bothering you, blocking your account, unpublishing your post, or deleting your content. I won't fixed the report, though we forgot to update the issue name, which I'm doing through this so it won't show up as a google result with your username.

People are getting tired of spamming about drugs and sex, so they're branching out and one topic happens to be teeth whitening. The topic of websites is usually irrelevant to their software configuration, so when you mentioned teeth so prominently, it raised a flag. Since the discussions surrounding Drupal (a web-based software package) are usually about what configurations, modules, themes, or services to use, it just stuck out as something odd.

Oh, and welcome to Drupal :)

Thanks for that guys i appreciate it... and have a good day.

Just checked and it does seem my post has been deleted after all...

There are 100 or so people with the ability to do that. Not all of them subscribe to these issues to know it had already been vetted. I explained my point of view on why it could be viewed as spam. Your signature won't be helpful in skirting the issue either, specifically the

Ever wondered <p><a href="http:// buywhiteteeth .com">How To Whiten Teeth</a></p>?

The discussion on the site is expected to be about Drupal, not teeth whitening. A the very least, your signature is distracting. Just try to keep on topic (using Drupal). Unfortunately for you, your site just happens to be a popular, rising spam topic.

I'm with sliverwing-- this smacks of spam to me. Remember-- signatures are not working so anyone who joins and posts with a "buyxwz.com" link, which had to be manually added, within minutes of joining also sets off my spam detector. And, I too have noticed an increase in very similar posts like this lately.

I agree with silverwing.

Just to add another similar post: http://drupal.org/node/554388 (author http://drupal.org/user/578998).
Has the other post been removed?

The latest example: http://drupal.org/node/556450

IMO this is nothing but the latest spam technique.

Interesting.

I'm flip-flopping to spammer. Lets unpublish these for the time being (rather than delete) and block the accounts. http://ws.arin.net shows so far these http://buyxxxx.com pages are all hosted at theplanet.com. I know there are real people in their abuse department with brains. Put the domain pattern together, the newbie posts, and the feel of the sites. Since I fell for it, now I'm even more determined to work with theplanet's abuse department to address this issue.

My letter to theplanet.com abuse. Lets leave this open a couple days to let the domains get removed and wrap up any forum deletions.

The following domains are being spammed in the forums on drupal.org.

http:// buywhiteteeth .com/ 74.52.7.225
http:// buyingcricketbats .com/ 74.54.45.205
http:// buyingaviatorsunglasses .com/ 74.52.7.227
http:// gainmuscleshop .com/ 74.52.7.226

We have been tracking our investigation of them on http://drupal.org/node/552786. The spammer is setting up a Wordpress site, hosted at http://buyPRODUCTNAME.com and then is posting the URL in various competing CMS project's forums to ask about switching software. They seem to share the following characteristics:

1. Asking if Drupal would be better than (usually) WordPress. (On the Joomla site, they ask if Joomla is better than Wordpress.)
2. Site is legitimate.
3. Sites all have very little content.
4. There's an ad block in the top post.

For example the comment at #13 on the drupal.org spam ticket http://drupal.org/node/552786#comment-1945444

Each of the accounts used on drupal.org to post the forum threads has a comment. I'm convinced now that this content is spam.

My email to abuse@btinternet.com regarding primeswish.

The email address markmulholland@btconnect.com was used to register for an account at http://drupal.org/user/577962 under the username primeswish. It was used to spam the domain name http:// buywhiteteeth .com in the forums and on their user profile page. We have publicly tracked our investigation of his account at http://drupal.org/node/552786.

Our investigation on drupal.org has determined this user is a spammer. To post to the forums on drupal.org, each user must verifiy their registration email address, which means the owner of the account markmulholland is likely the spammer. It is also possible the user is using the btconnect service to spam other domains such as http:// buyingcricketbats .com/, http:// buyingaviatorsunglasses .com/, and http:// gainmuscleshop .com/.

I really want to stop this guy. Posted account holder's information for #25 to Google's abuse dept. http://mail.google.com/support/bin/request.py?contact_type=abuse_phishing

My email to abuse@fastmail.fm for reporting registration of http://drupal.org/user/580696

The email address strunts2@f-m.fm was used to register an account that is being used for forum spamming using the login Alberts2. The drupal.org webmaster team unpublished a post at http://drupal.org/node/556450 containing the following content.

Though the email seems to be an innocent inquiry, the creator of the content has been posting the same general body with a different URL throughout drupal.org. We have been tracking the incident publicly at http://drupal.org/node/552786

I know it's non-traditional to reply to abuse emails, but if you have any information on the IP address used to register strunts2@f-m.fm, that might be helpful in trying to stop this spammer's continued abuse.

--- start spam post ---

I sent an addition to the abuse complaint filed with The Planet in #22 to report the URL in #25. The ticket ID from the auto reply is ThePlanetAbuse-C44327288R. I also blocked http://drupal.org/user/580838, which is the owner of #25

this looks like it can be marked fixed ?

I would wait until the emails get a reply; until then, the report could be set to postponed.

Mark Mulholland is contacting me separately about buywhiteteeth and is re-itterating his innocence. I'm starting to wonder if this scam is getting so sophisticated that perhaps the spammers are getting legitimately innocent people to generate the content and/or spread the domains for them, like "pyramid spamming". Anyway, I thought it was highly irregular enough to re-post his protest here, even if the evidence is still against him. There's way too much coincidence for buywhiteteeth to be at 74.52.7.225 and gainmuscleshop to be at 74.52.7.226.

I see you have posted this over at drupal and I can't respond to this as you have blocked me...

Please get your facts right.. I only own www. buywhiteteeth .com and have nothing to do with those other sites... you are accusing me completely in the wrong here...

What grounds have you to accuse me in the wrong like this??

Again you never even had the decency to email me to ask if those other sites where mine??

P.S. I did go through and put spaces in all the domains in this issue to inhibit spidering them.

I am not sure if the similar IPs could mean something. A web site created on a shared host would probably have a IP very similar to the IP of another web site that is not related to the first.

In this case, I think that is very strange that two different people, who have a web site hosted by the same service provider, are both asking about adopting a CMS, and both people have already a CMS running on their web sites.
Have I misunderstood anything?

Based on the signature that was trying to get added ...

Ever wondered <p><a href="http:// buywhiteteeth .com">How To Whiten Teeth</a></p>?

spam has my vote.

I suppose the quickest way to find out is to ask primeswish, who I just unblocked in hopes of accelerating a solution to this (and removed the domain in his sig).

So Mark, it would be helpful if we knew a couple things like who you bought your web hosting from, how it came about that you started with Wordpress, and then why you decided to post in such a similar fashion about using a different CMS package as so many others from the same provider.

It seems in the very least, if Mark is legit, that he's getting some very bad hosting advice from someone.

A Google search for primeswish and buywhiteteeth is revealing enough to show this is spammy, if not just bad SEO.

For example, one of the places I chased down was the primeswish twitter account. There's only 1 follower. How convenient, no? The one follower also appears to be spammyish in their tweets, with the exception that they somehow have amassed 1310 followers. They tweet mostly about only their domain, a 5-year-old Wordpress site. The whois is registered at 123 Main st in Chicago, Il. Strangely fancy address you think? Because it doesn't exist (according to google).

A broad range of other CMSs seem to have been slightly hospitable to posts by primeswish, even though it was a dup post each time as silverwing already found. It doesn't stop at CMS posts. He's been making bookmarks in social networkings sites and posting to self help sites like e-how where people ask about teeth as well.

One post over at wordpress shows "primeswish" wants to start more sites, but apparently he's running out of themes. http://wordpress.org/support/topic/302109 It's hard to wonder why...

Oh, and the best link of all: primeswish.com redirects to http://www.pluginprofitsite.com/main-22429, "Internet Business-in-a-Box". pluginprofitsite.com is registered to an Stone Evans at a real address in Dallas, TX, which just happens to be the same town that The Planet is located and that buywhiteteeth is hosted at.

More still, there's a Google result for an "advertising system" related to primeswish with a simple arg on the end: http://10dollarswonder.com/?primeswish. I got all confused reading the FAQ, but it looks pyramid-ish to buy ads for websites.

and if you search long enough, you'll notice primeswish doesn't exist before about 8/8/2009.

So "Mark", you're unblocked. Fess up now. You've been spending the past 2 weeks using the alias personality primeswish to plug your teeth site. I'm calling you out on it. How big is this system you've got going? How many domains do you have running now? What's your upline look like? Are you actually Stone or are you just someone else participating in it? Don't leave us all hanging. We'll just all have a good laugh and you can just omit drupal.org from your future posts list.

Tell me your winding me up!!!!

First of all I have not a clue about computers or the internet so to accuse me of everything you have done is just ridiculous and I am expecting a written apology...

I have every right to start a website about tooth whitening as I work for a Dental Supply Company here in Ireland (www. bfmulholland .com) google it and you will see...

I am not Stone.. that was a thing I tried a couple of years back along with 10dollarswonder.com that did not work for me... I have been trying for a couple of years to make a passive income on the internet without success...

So I get an email two weeks ago about doing a course about making a passive income on the internet so as usual i signed up for it.... Did all you hot shots not think about this option other than accusing me in the wrong and getting me spam titles all over the internet and contacting my email address provider...

So obviously what has happened by the looks of it is that alot of people have signed up for the course..

In the course we are recommended to buy a domain name with "buy" in the title so hence my website www. buywhiteteeth .com so obviously the others have followed his advice and purchased similar domain names...

As I stated before I am no techie but the guy also offered to host the websites as part of the course so would that mean they have similar IP addresses or something....

Hand on my heart I am no spammer I have just been following the course through word for word and one of the bits of advice was to make a post to drupal.. thats all... so obviously the other people doing the course have done the same.... Thats it.. nothing more nothing less...

So I am not Stone I am not some wizz kid who owns hundreds of websites... I am only new to blog/web building and if this is what people are like on the internet maybe I better leave it.. accusing you in the wrong etc.. all i did was sign up for a course and you guys let your minds run away with you and build me up to be something that I am not...

Just don't understand why you could not ask people first instead of accusing them in the wrong.. i know if I went about my every day businees in life like that I would not get too far...

All the best,
Mark Mulholland
(innocent primeswish)

actually ignorance does not equal innocence.

Are you trying to tell us that you spent money along the way buying into this so called program? Some program that outlines in some documentation to go put meaningless posts on drupal.org and other sites?

and you didn't think this was odd? So you went and followed this silly program?
_{(I'm not surprised your ventures on the internet with making passive incomes are failing)}

What did you spend on this program?

As far as I am concerned, you are guilty by association for signing up for a program like that. Let alone, the fact that you took this so called program and followed through with placing links on "other" sites. That in and of itself makes you a spammer whether you like that label or not. You may not be the head spammer, but you are certainly one of the head spammers minions.

IMO, There is no way you did not know what you were doing was spamming and what you've offered in your comment above is a very weak excuse.

This user should be blocked, and now that we've an idea of how this scheme works any and all posts of this nature with links of this nature deleted immediately upon locating.

Well verymisunderstood I did not get personal but you just have...

Yes I spent £160 on the course and yes because I am new to the whole web thing I followed it word for word and if that is a crime on my behalf so be it...

I was asked for an honest response and I gave it.. but instead of thanking me for being honest you get personal and insult me... we are not all as clued in as you when it comes to computers and the internet and to be honest I don't even know what a spammer is and thats the honest truth...

If you where in the finacial trouble I was in you would try anything too... all i did was buy a course and followed it.. I have told the truth and I don't appreciate you getting personal.. i quote " and you didn't think this was odd? So you went and followed this silly program?
(I'm not surprised your ventures on the internet with making passive incomes are failing)"

Thats my business if I'm not very good on the internet and hence why I bought another course.. I am no head spammer.. I am no one... just an innocent person who bought a course... do you honestly think I would be wasting my time responding to these posts if I was not upset about all these wrong acqusations against me...

Manners cost nothing verymisunderstood... you have no right to assume things about me when I already had posted the truth above.. it was not a very weak excuse it was the truth.. Who are you to judge me like this when you don't even know me... I gave you the truth and yes you can believe it or not...

You have already jumped to the wrong conclusions above by accusing me of nearly everything under the sun when it has been all lies.. So if I'm stupid in your eyes so be it.. just because I didn't realise that asking a question was wrong on a particular website would make all of you make me out to be something that I'm not...

Instead of having the decency to apologise your further insult me verymisunderstood and accuse me in the wrong yet again..

I'm extremely annoyed about all of this...

This is a fascinating little drama! Longest thread re a spammer I've seen.
First, I actually believe that primeswish is a real human being here. Thanks for all that background describing the long story. It's enlightening, and I genuinely appreciate hearing your side of the story.

So I get an email two weeks ago about doing a course about making a passive income on the internet so as usual i signed up for it.... Did all you hot shots not think about this option

Well, we didn't think that there were people out there actually dumb enough to respond to those spam scams! You signed up for it "as usual"?!

There seems to be no doubt that the "course" you followed is nothing but a shady get-rich-quick scheme that does advise spammer behaviour.
Blindly following instructions to do stupid things is just stupid.
Blindly following instructions that tell you to do illegal things still makes you guilty.
..And therefore deserving "punishment" - as far as a website forum can "punish" you.

The crime was artificially trying to skew search engine rankings through forum-spam - the punishment in kind is having exposure of this crime now one of the strongest results for your online identity. It's poetic.

yea, I'm getting personal because your so called truths don't excuse you.

In the end you won't even make your £160 back. Hopefully this is a lesson to you, to not do the usual _{(thats a scary revelation)} and delete junk email instead of read it and especially buy into it.

Any chance you've ever sent your family history and banking information in response to one of those email where a dying person you don't know just happened to leave you £35,000,000 and the banker must deposit in your account in hurry before the authorities sieze the money?

just curious. If so, I got a piece of the brooklyn bridge i can sell you and if you call right now, you will recieve 3 acres of beach front property in arizona all you pay is shipping and handling. so hurry call now, supplies are limited. 1-800-got-took

I think this is not going anywhere where it should be going.

Marc made a mistake, he learned something. He also got his account back.

There is a minor thing, that I want to point out: The posting of links on drupal.org will not lead to an increase of google PR for the linked to site, since we tell google to not care about these links through rel=nofollow.

Because of this a little bit less enthusiasm on the spam hunt might be in order.

Can we mark this fixed?

Well we see the real people coming out now behind your nasty comments...

I know I have told the whole truth and nothing but the truth and you can believe it or not...

But what I won't do is lower myself to leave nasty comments such as yourself and get personal... all I ask is to leave my family out of this.... and the fact that you had to stoop that low to bring my family into it.. says alot about you as a person...

I just hope you never make a mistake or follow something that you don't understand one day and someone accuses you of everything under the sun which in fact is utter lies... I tell you it's not very nice...

But to be honest I don't expect you to care because when you resort to bringing families into the argument it just shows you for what you really are....

I hope your proud of your nasty comments.

@killes
Yeah, it's probably time to put it to bed.
If the aggrieved party here were to name & shame the original merchants of the "course" that ripped him of and caused him to embarrass himself over the entire internet, then we could maybe even relabel this issue to put blame where blame is due. Expose the dealer of this crap rather than just the sucker he took the money off this time.
The best way primeswish can claw back any dignity is to let the world know about the scam so as to prevent more exploitation and abuse of online communities like this.

Dman,

You obviously don't know what the word dignity means... I have kept my dignity throughout this by telling the truth and not lowering myself to get personal and post nasty comments and bring families into this...

But one thing I am not is a tout... I have told the truth and as you have all so happily pointed out that I'm stupid... so I am the one who has been done...

But what I am not going to do is tell tales and names... I am sure the way you guys know everything about the internet you could easily trace who runs the course... so you can call me stupid call me sucker call me whatever you like...

But thats how i still have my dignity.. by not getting ivolved with all your nasty comments, name calling, wrong aquasations against me etc etc... because I'm above lowering myself to talk ill of ones family and I'm certainly above being a tout... and thats what dignity is all about....

Maybe you are the one who, as well as lacking common sense, is also lacking reading comprehension if you can't tell the difference between an insult to your own intelligence (which you certainly did receive) and an insult to your family - which was not given. Check the words again before getting huffy.

If you have no regrets about your actions, or wish to blame someone else for your mistakes, then there is every reason, and no excuse not to reveal your claimed puppet-master. If you are unable to do so, then maybe we should just take this entire story as a smoke-shield.
More elaborate than usual, maybe, but I'm still curious about what marketing genius advised you to start your campaign by targeting tech-blogs! Their pitch and advice has got to be amusing to see...
If you learned nothing else, learn to do your link-building SEO shit on My Little Pony forums first - not on places where bullshit is spotted immediately.

_{dammit. OK, I'm a (little) bit sorry for taking it all out on you. You are just getting a lot of the hostility we've built up against all the comment-spam assholes who do what you did. We're not going to get anywhere constructive, I know. But it's so seldom these blog-bombers come out to play... I should stop.}

I guess that everybody can talk of dignity.
I can have my dignity, and still not pay a parking lot ticket; dignity is more important of paying for a parking lot.

I think that the dignity argument doesn't take anywhere. What is required, here, is that you don't do the same thing again.

Hold on a minute... you are now telling me how I should take things and how I should feel about how someone speaks to me... I took that comment about my family as an insult to me and my family... fact.... I also took being accused wrongly as an insult... fact...

And believe me it's well past me being huffy at this stage.. but again I won't lower myself to turn nasty and start name calling... I reserve the right to keep my dignity...

And as for a smoke screen... are you for real?? Have you not read what I have written?? This is the truth.. go check it out for yourself seeing that you are 'dman'... and surely 'dman' will be able to trace it all back to who runs the course...

And as for regrets.. how can I have a regret about something when I don't know what I am doing... have you never taken up something from scratch and made mistakes along the way... obviously I have made a mistake by posting on this website... but how was I to know when I was following the course?? If i knew all this do you think I would have bought the course in the first place???

Believe it or not 'dman' everybody has to start their learning somewhere... and just because I don't know as much as you or anyone else on this particular post does not give you are anyone else the right to belittle me my family and accuse me in the wrong...

And if you know anything about your history or Ireand you will know that we where not brought up to be touts.. but that certainly does not give you or anyone else the right to continue this witch hunt against me and my famil for asking a questions on forums.

I've locked this thread, take it to personal mail or wherever.