Is affiliate.trk4.com Safe?

Mortgage Refinance Scam -- Identity Theft Unsolicited Spam Originating From: Rock Hill SC (209.198.13.41) Originating Network(s): ***** Date Received: ***** Click Link: ***** Redirect: ***** Responding IP: ***** location: http://affiliate.trk4.com/rd/r.php?sid=4223&pub=102858&c1=43_40_92-yahoo-671-INSC4028-M4-22079-&c2=61422028&c3= Name Server: ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** Return-Path: <lowermymortgagerate@sptrisser.nasaarea.com> Contents of Spam: From: Lower My Mortgage Rate <noreply@americanbankingnews.com> To: x Sent: Thursday, March 28, 2013 1:58 AM Subject: →" President Reduces Amount Homeowners Owe. Curious How Much You Could Save? &"

Spying web beacon hidden in spam. Deceptive spam email was transmitted via IP ***** on the CYBERCON network in the USA. The email was coded to automatically report the recipient's email address and IP address to a 'spyware collection box' at ***** when the email was opened, without the recipient's knowledge or permission. Profiles of these data may be used for additional spam or scams or identity theft. Some of the email addresses in the spammer's distribution list were very likely obtained through theft, fraud or other unethical means, perhaps on the black market. The spam contains links to the 'spam stooge' site on the Integra Telecom network at hXXp://deportao.com/3/icm4575745/jaol111111.asp which automatically redirects to hXXp://affiliate.trk4.com/rd/r.php?sid=3543&pub=101065&c1=jyh111111&c2=&c3= which, in turn, redirects to the advertiser's site on the Liquid Web network at hXXp://www.instantcheckmate.com/?src=ACBN&mdm=network&cmp=101065&cnt=jyh111111

This domain is used in spam. Load just the domain name and you see a harmless looking google-news feed. But that is just a decoy to fool registrars into thinking that the domain is harmless. When spammed, the domain is augmented with a subdomain and a path to the real payload. Spammers are trying to hide. The usual registrars sponsoring these domains are eNom, Namecheap and Tucows. You can read more about the scams at * ***** Namecheap Recent examples registered with ENOM / NAMECHEAP / DEMAND MEDIA ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** Properties spammed, as seen in the URLs ***** ***** ***** ***** - Discounted computer memory chips ***** ***** - Debt settlement (loans schemes) ***** - Professional photographer Registrars have terms of service which enable them to suspend offending domains.

Spamvertized STOOGE Sites - Sites is associated with criminals by knowingly violating US Law. Violating the US CAN-SPAM Act by sending or have sent on their behalf UCE "Spam" to Non-Opt-In email accounts, violating Federal Law, which is a criminal act! ***** <sales@baadmar2.com> ***** <sprintskey.com@protecteddomainservices.com> http://affiliate.trk4.com <trk4.com@protecteddomainservices.com> ***** <billing@revpath.com, YesSurveyMedia@yahoo.com> ***** <YesSurveyMedia@yahoo.com> ***** <info@w4.com>