CAUCE Spamfighters Rally Against Corona Health Fraud Affiliate programs
CyberCrime & Doing Time 2020-11-19
My email box is full of Coronavirus / COVID-19 frauds and scams. I have Corona malware disguised as product catalogs. I have fake World Health Organization emails asking me to donate my Bitcoin to them. I have more than 30 fake breathing mask selling websites that my friends at ScamSurvivors and AA419 are helping to track. But you know what makes me REALLY MAD? The monsters who are using the same fake news websites to drive their affiliate-marketing program scams to sell Immunity Oil to people who are desperate to protect their families and loved ones. As a member of the CAUCE Board (the Coalition Against Unsolicited Commercial Email) I immediately reached out to Neil Schwartzman, my personal spam fighting hero and the founder of CAUCE. Even though we both know these are the same snake oil charlatans who have been in the spam business for a decade, perhaps now that they are putting people's lives in true danger someone will finally do something to shut these scammers and spammers down. (Note, I'm not speaking for CAUCE here, I'm just mentioning that I'm proud to fight spammers with them.) The first claim we'll face, of course, is that "we don't claim that our product fights the Corona Virus." My first refutation would be the email subjects being used to spam their products. The first email I got yesterday was this one, with the subject "Protection From Corona Virus With Immunity Oil"
www.mynutritionalnews.com/fox_virusout/ or dailyxhealth.com/us-cv-1/ as examples (Note that you may need to be "referred" from the right URL for this content to load)
Delivery-date: Sat, 21 Mar 2020 17:06:42 -0500 Received: from [49.12.47.247] (port=47288 helo=urrmwipzqlpakl.xyz)
From:Miracle Virus Oil Subject:Protection From Corona Virus With Immunity Oil
https://malkommal.ams3.digitaloceanspaces.com/immcoronfgdf.htm
Here's the screenshot of the email message I received this afternoon. Please note the email subject: "Fight back against the coronavirus outbreak! Pure Herval Total Defense Immunity Blend"
Visiting many spammed URLs will result in 404 pages, because they have to be visited through the correct chain of referring URLs, which is one defensive measure that Spamfighter Schwartzman and I are well accustomed to.
The latter email contains the URL:
which in turn forwards to
The "CID" "AFID" and "SID" are the Campaign ID, and the Affiliate ID. Affiliate 428186 is the one who will get paid for this sale, if I were stupid enough to buy it. The Campaign ID is necessary, because the company is marketing the product with many different labels and "look and feel" packaging. For example, some of the Immunity Blend claims to be a "CBD Oil" that protects you from Corona Virus because CBD has anti-inflammatory properties ... like this ad, which claims it is a "Corona Mom Advertorial."
No matter which of the fake Immunity Blend appeals you start with, you'll end up (currently anyway) on the website Apusserum.com ... one of my click-throughs had this targeting label set:
Notice the little pop-ups in the bottom left ... messages popping up non-stop about all of the other customers buying this stuff non-stop!
Clicking through from a different affiliate, I end on a different looking sales page, but clearly the same product being sold in a different bottle.
The claims made on the "orange cap" version are shown here, but short version. You can clean your counters, purify the air, and "boost your immunity" by using it as a skin cream. The Essential Oil Mommies will love this stuff, it has Cinnamon Leaf, Lemon, Clove Bud, Lime, Eucalyptus Globulus, Rosemary, Peppermint, Spearmint, and Oregano. None of which, last I checked, are an alcohol based disinfectant, or an anti-viral.
Of course they are carefully saying NOTHING about it treating viruses of any sort on the actual product page. We'll just put a huge coronavirus image on the page as a pretty medical picture without making any claim about that.
The stuff that sounds like science there is from the same source that was used to sell essential oil / snake oil during the H1N1 flu scare in 2010 (one such product was called "On Guard"). If you'd like to read the article, it's here: Protective essential oil attenuates influenza virus infection: An in vitro study in MDCK cells. )
Fake Fox News?
No matter which entry point you visit to get started, a link in one of the many spam messages, or a link from social media (we've found sellers on both Twitter and Facebook, and reported them for removal.) The first site you visit will be a pseudo-news site that SEEMS to be somehow related to Fox News, without EXACTLY saying that ... while it isn't saying you are on Fox News, it is giving the byline for this story to "Janine Puhak | Fox News" and at the bottom of the page, repeats this by providing Janine's Twitter handle -- @JaninePuhak, and beneath the first main photo, it says "Fox News Flash Top Headlines for March 23, 2020" and "Check out what's clicking on FoxNews.com."
www.mynutritionalnews.com/fox_virusout/ or dailyxhealth.com/us-cv-1/ as examples (Note that you may need to be "referred" from the right URL for this content to load)While some of the sites have hidden the Fox News logo, others have not. This one still has it, for example. 
https://www.outbreakliveupdates.com/foxnews_outbreak/ . affid=428139&subid=6606 Others had gone even further to "De-Fox" themselves: 
https://www.healthy-tips.life/healthytips_cor/Healthy-Tips.life changed the logo and byline to be "World Break News" without changing a single word of the article.
https://www.outbreakliveupdates.com/foxnews_outbreak/ . affid=428139&subid=6606 Others had gone even further to "De-Fox" themselves: 
https://www.healthy-tips.life/healthytips_cor/Healthy-Tips.life changed the logo and byline to be "World Break News" without changing a single word of the article. The Second Scam
The first scam is that you are buying a fake product that you think will help you with Corona Virus. The second scam is that they are going to bill you more and more frequently than you think, and based on the Better Business Bureau complaints against many other companies run by the same outfit at the same address, this will probably happen to you as well. The product Terms and Services says that if you don't cancel your order within the allotted time, you'll start being billed $89.95 per month on the credit card you provided at the time of the order. The company named in the Terms and Services is: Finest Herbalist PO Box 534 Pleasant Grove, UT 84062 The "Contact Us" page gives this information: Contact Us You can contact Finest Herbalist Customer Service for any questions, comments, or testimonials. Phone: 1 (844) 899-2977 Email: help@finestherbalist.com Hours of Operation: 8am to 8pm EST daily A company named "Herbalist Oils" that coincidentally is also at PO Box 534 in Pleasant Grove, Utah, has an "F" grade from the Better Business Bureau with complaints such as these:
07/20/2019 Herbalist Oils, also known as First Class Herbalist CBD, of 4Bush Holdings, LLC is a scam. They offer a free bottle of CBD oil and latter I found out my bank account to be charged over 200.00 plus 89.99 thereafter for a subscription that I was unaware of for "Deep sleep" roll on. I contact them via email many times and they did not answer. There is nowhere on their website page that states this is a monthly subscription or that one will be charged more than the shipping fee for a free bottle of CBD oil. They ended up sending me 6 bottles of CBD oil. The oil is substandard and does not live up to its claims, however, I thought like some medications one might need to wait a few weeks for it to work....it never did. I then ended up receiving a bottle of deep sleep again and thought that this was another mistake on their behalf. I wrote them an email regarding this but I heard nothing back. After a few more months of this bottle being sent to me and not being able to get a return email from them, I finally called customer service. On the first phone call, I was told the subscription was canceled and my bank was never charged Subscription? this is the first I heard of any subscription. I then reviewed my bank statements and found indeed I was charged monthly as well as being charged over 200.00 initially. I called their customer service again and after some discussion, I was able to get two months of the 89.00 charges refunded. They stated since it's over the 30 day refund time no other refund will be allowed. The refunds never showed up in my bank account. Curiously, there are even more businesses at PO Box 534 in Pleasant Grove, Utah. In fact, there are at least 45 Better Business Bureau complaints in the past 3 years for businesses at that address, including:
- Keto Ultra Diet
- Manifest Health Plan
- Primal Pro Wellness
- Sunshine Heath and Wellness
- Plant Pure Diet and Beauty
- Tru Slim Living
Other businesses at the same address include:
Keto Trim Diet
Keto Melt & Trim 800
Keto Pro Diet
Forskolin Trim Diet
Body Performa Keto
Healthy Rapid
Ansa Naturals Online
So how does the Affiliate program work? First, you need to sign up for a slimy affiliate program. Most of the CoronaVirus spam that you are getting right now probably comes from affiliaXe, an affiliate program that clearly doesn't care whether their affiliates are selling real products or snake oil, and don't mind paying people a commission to get caught in credit card no-refund scams. Take a look at your CoronaVirus spam ... then look at the products AffiliaXe is marketing.
That's some of my Corona Virus spam for the past day ... big spammers: Breathing masks, Germidin, and Thermosense "touchless" thermometers. Everybody has an affiliate program. H8M8. Konex.
Masks, Wipes, Germidin, SafeMasks, UV Cleaners, Smart Sanitizer Pro, Immunity Blend (as above) and the Survival CoronaVirus Pandemic Guide are the top programs looking for spammers (oops! I mean Affiliates!) at AffiliaXe right now ...
Why so many people pushing Immunity Blend right now? Well, of all the products at AffiliaXe, its the only one offering a $90 Commission for your first sale! Compare below:
If you visit the live AffPlus site, each of those lines has a "link" icon appear when you hover over it. So, yes, we can confirm that clicking the "preview link" on the Immunity Oil affiliate program from AffiliaXe really does take you to the Apus Serum website as above. ( https://apusserum.com/os-immune ). And since every AffiliaXe affiliate has to upload a photo of their drivers license to join the program, it should be pretty easy for someone who cares about these scammers to shut them down.
Some of those other sites in this affiliate program are: https://buywowx.com/ https://www.getlifeprotectx.com/ https://www.getsafemask.com/ https://www.getlifeprotectx.com/ https://hyperstech.com/intl_5/order.php?prod=uvcleanizerzoom https://hyperstech.com/intl_5/order.php?prod=smartsanitizerpro https://apusserum.com/os-immune https://shopsafemask.com/ https://hyperstech.com/intl_5/order.php?prod=oxybreathpro https://offer.premiumslimdiet.com/khs-beach-mcc/