Skip to content

Spammer Alert:

March 20, 2013

This spammer also related to
The first spam reported to us is coming from domain
Definitely related to
The phone number given as administrative contact 1.5037469135 seems to be used a lot for spam domain names.

This spammer is also related to which is in the Register of Known Spam Operation (ROKSO).
Source: The Spamhaus Project

Also related with Xcelerate (Registered on: 21-Mar-2013)

Domain name:


Registrant type:
Non-UK Corporation

Registrant’s address:
PO Box 025250 #52990
United States

eNom, Inc. [Tag = ENOM]

Based on recent findings, spammer is related to spammer.

We’ve been getting requests to investigate a particular round of spam emails a few weeks ago. The spam seems to be using domain names with the same registration information.

Administrative Contact:
Tom Slater (
Fax: +1.5555555555
1608 S. Ashland Ave
Chicago, IL 60608

Partial list of domains registered with email through /

  • (Registered on: 27-Dec-2012)
  • (creation date: 06-mar-2013)
  • (creation date: 14-mar-2013)
  • (creation date: 14-mar-2013)
  • (registered on: 18-Mar-2013)
  • (Registered on: 27-Dec-2012)
  • (registered on 18-Mar-2013)
  • (creation date: 21-feb-2013)
  • (registered on: 18-Mar-2013)
  • (creation date: 15-mar-2013)
  • (creation date: 14-mar-2013)
  • (Registered on: 27-Dec-2012)
  • (Registered on: 07-Mar-2013)
  • (registered on 18-Mar-2013)
  • (creation date: 18-mar-2013)
  • (creation date: 14-mar-2013) *BLOCKED DUE TO SPAM*
  • (creation date: 14-mar-2013)
  • (creation date: 11-mar-2013)
  • (registered on: 16-mar-2013)
  • (creation date: 11-dec-2012)
  • (creation date: 13-mar-2013)
  • (Domain Registration Date: Oct-10-2012)
  • (creation date: 15-mar-2013)
  • (registered on: 21-mar-2013)
  • (creation date: 13-mar-2013) *BLOCKED DUE TO SPAM*
  • ( Registered on: 09-Mar-2013)
  • (Registered on: 30-Dec-2012)
  • (Registered on: 03-Mar-2013)
  • (creation date: 15-mar-2013)
  • (creation date: 13-mar-2013)
  • (creation date: 06-mar-2013)
  •  (Registered on: 03-Mar-2013)
  • (Registered on: 30-Dec-2012)
  • (Registered on: 07-Mar-2013)
  • (expired)
  • (expired)
  • (expired)
  • (expired)

The domain was registered through DreamHost:

Registrant Contact: Private Registrant
A Happy DreamHost Customer
417 Associated Rd #324
Brea, CA 92821


We informed DreamHost of our findings on, and we received a reply:

Unfortunately, we provide neither hosting services, nor email services, for any of these domains. The same is true for, for which we are only the

We looked into the address of Xcelerate’s Tom Slater. It is a mailbox service by Earth Class Mail in Chicago.

A Virtual Presence In Chicago
Street and PO Box addresses available:

Street Address
1608 S Ashland Ave.
Chicago, Illinois 60608-2013
Just $14.95 per month in addition to Monthly subscription fees
Will-call pickup not available

PO Box
PO Box 803338
Chicago, IL 60680-3338
Included in your monthly subscription fee

We cross referenced the phone number 773-328-8013 and the addresses from Earth Class Mail. We found a domain using Earth Class Mail service and the phone number 773-328-8013.

Administrative Contact:
Mike Young (
Fax: +1.7733288013
PO Box 803338
Chicago, IL 60680

The domain was registered through / on August 27, 2012.

We called the number 773-328-8013 and we got the automated voicemail:

You’ve been forwarded to the voicemail for *text to speech voice* “xcelerate”.

It seems that Xcelerate is a shell company for the spammer to hide behind.

Spoofing the sender’s email address can be done. In this case Xcelerate / is highly likely to be involved. Consider the following patterns:

  • The Domain Names are registered through /
  • Each Domain Name is composed of two English dictionary words that seemed to be randomly chosen
  • Registration info of the Domain Names are the same
  • The Domain Names are recently registered / created
  • The voicemail for 773-328-8013 mentions “Xcelerate”

If you would like to fight these spammer, use services like and report them. provides free service; we encourage you to subscribe to their service for a nominal fee. After all, they are providing a great service.


We use service.

One Comment leave one →
  1. November 8, 2013 3:10 am

    I’m getting stupid AIG direct insurance mail from this idiot. I can’t FILTER IT! I’m putting things into other mails that delete them when I hit ‘run now’. But this one just won’t go away. I tried AIG in the sender. nope. I tried “As Low As” in all cases. nope. Thunderbird’s filter won’t work on it. What special thing did they do to make their crap mail immune? I don’t know.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s