×
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
IH8Spam
Contributor II
Message 1 of 13

All my posts have either been deleted or are marked as spam

I have joined this community today, verified my email address and have made 3 posts (not including this one) and 1 reply.

Current status:

  1. First post (requesting assistance with McAfee affiliate spam) : Deleted within hours
  2. Second post (asking what happened to first post 4 hours later): flagged as spam immediately
  3. Third post (asking again for affiliate spam assistance): flagged as spam immediately
  4. Reply to someone else's post about affiliate spam: disappeared within minutes

Is this a corporate policy or overenthusiastic bot?

12 Replies
krishna55
Moderator
Moderator
Message 2 of 13

Re: All my posts have either been deleted or are marked as spam

Hi @IH8Spam,

Greetings from McAfee.

Could you provide more information about the issue that you are facing so that we will look into that and help you.

Regards,

Krishnamanikandan KS

IH8Spam
Contributor II
Message 3 of 13

Re: All my posts have either been deleted or are marked as spam

Happy to, thank you.

For over the last month I have been receiving a minimum of one spam email a day, with a subject and preview typically referencing AntiVirus subscription renewals (but sometimes referencing Apple iCloud and other premium brands)

All the emails share the following characteristics:

  1. They are sent with forged SMTP headers and from multiple virtual servers.
  2. They hide their content behind an html file hosted on Google StorageAPI - the URL always has a long encoded parameter attached
  3. The referenced html file hosted on Google StorageAPI contains a short script that redirects to a domain registered with false WHOIS information and served from a virtual server. The base website is always HTTP only and contains a shell "contact us" website without any content or identifiers
  4. The new URL and parameter automatically redirects to the hostile domain (defanged) helpinprogress[.]com with a new encoded parameter
  5. The redirects terminate at the legitimate McAfee URL: https://www.mcafee.com/consumer/en-us/landing-page/direct/fdr/ctl/index.html and includes the following decoded parameters: 

 

adobe_mc_sdid=SDID=12F06CAD3EA15F71-2947E92912F15D1B
MCORGID=A729776A5245B1590A490D44@AdobeOrg
TS=1699112665
adobe_mc_ref=https://helpinprogress.com/

 

 

As I stated in my earlier (now disappeared) posts - this would seem to me to be affiliate generated spam, designed to obtain commission fraudulently from McAfee.

It is being sent to a UK resident using an email address obtained from a data breach and without consent.

I would like the emails to stop, and I would hope that McAfee would not want to pay commission to an affiliate bringing their products and reputation into disrepute. This spam (all routed through the aforementioned domain) accounts for 75% of the spam I have received for months.

I have tried to raise this with McAfee via email but without getting any response.

I would be happy to raise this with the US affiliate program directly but can find no contact details to do so.

Your guidance on this would be appreciated.

IH8Spam
Contributor II
Message 4 of 13

Re: All my posts have either been deleted or are marked as spam

I'm guessing some action has now been taken on this, as the spam emails are now travelling via a different route under what appears to be a new affiliate account.

New terminating page:

https://www.mcafee.com/consumer/en-us/landing-page/direct/fdr/var/index.html

New parameter values (including a new domain referenced in adobe_mc_ref):

adobe_mc_sdid=SDID=4AB0CF32AD3870FA-5AA32AA9BDD1234F
MCORGID=A729776A5245B1590A490D44@AdobeOrg|
TS=1699370173
adobe_mc_ref=https://successdauntless.com/

 

This issue really needs due diligence in the registration process to be tackled properly. A proper direct reporting method for affiliate abuse would also help mitigate the damage to McAfee's reputation.

For reference this latest spam email had the subject line "Winter Mattress Deal — $250 Off"

krishna55
Moderator
Moderator
Message 5 of 13

Re: All my posts have either been deleted or are marked as spam

Hi @IH8Spam,

Greetings from McAfee.

Send us the original copy of the spam email as an attachment so that we can look into the issue.

Regards,
Krishnamanikandan KS

IH8Spam
Contributor II
Message 6 of 13

Re: All my posts have either been deleted or are marked as spam

Send as in email - to the customersupport address?

I reported the previous iteration (per my first post)to both the customer support email address and the spam reporting email address at McAfee with full details of email (as a text file), the redirects and a full explanation of what was occuring.

That was on Friday 3rd and Saturday 4th Nov.

I have had no response.

krishna55
Moderator
Moderator
Message 7 of 13

Re: All my posts have either been deleted or are marked as spam

Hi @IH8Spam,

Greetings from McAfee.

Save the spam email on your PC and send it as an attachment while replying to this post.

Regards,

Krishnamanikandan KS

IH8Spam
Contributor II
Message 8 of 13

Re: All my posts have either been deleted or are marked as spam

Note that I have anonymised my email address in the attached file for obvious reasons.

Attached is the latest spam received this afternoon GMT (saved as text), zipped as this forum does not accept text files.

Testing the twittter short url ending 9QCWD0ni0L in a sandboxed browser shows it redirecting to (defanged domains):

  • qualkamize.us[.]com 
  • sucessdauntless[.]com

and terminating at the previous posted legitimate link with associated aforementioned parameters.

 

 

krishna55
Moderator
Moderator
Message 9 of 13

Re: All my posts have either been deleted or are marked as spam

Hi @IH8Spam,

Greetings from McAfee.

We are not able to find anything as the email is in a text format. Please contact our customer support using the link below to resolve the issue.

McAfee Chat Support

Regards,
Krishnamanikandan KS

IH8Spam
Contributor II
Message 10 of 13

Re: All my posts have either been deleted or are marked as spam

This has left me rather confused

 

We are not able to find anything as the email is in a text format.

I supplied the email in text format because that is how I review potential spam without adding risk. The text file shows the original email with my address xxx'd out and the original HTML code that made up the email. This enables easy identification of the content href links that would present a false front to the email when viewed in an email client. 

What format were you expecting the file in? How would that enable examination of the fraudulent content links that redirect to the official McAfee site?

Please contact our customer support using the link below to resolve the issue.

So now I have to contact customer support and explain the situation for the 4th or 5th time? The same customer support who ignored the original email report?

I have wasted several days offering McAfee the chance to resolve a spam problem entirely of their own making through a failure to validate affiliate referrals properly.

These are affiliate generated spam that obtains commission from McAfee through data theft, fraud and deception. I assume those parameters uniquely identify the affiliate to McAfee to ensure they take credit for the referrals they generate.

McAfee clearly has an ongoing problem with affiliate spam and there have been multiple reports of it in these very forums.

In the absence of a proper escalation process to report this to McAfee I will be making a report to the FTC on this affiliate marketing program and its consequences for the internet user at large. I will also be raising a report with the UK Information Commissioner as the US McAfee affiliate program has international implications.

Included in my reports will be evidence that this abuse has been repeatedly reported to McAfee with no action taken.

 

Thank you for your time.

 

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community