Legend:  new window    outside link    tools page  glossary link   

Classic Spam: The Donald sends The Spam

The bottom line: It is up to you whether you think you could get any value from this sort of offer. For my part, rule 1A is in full force, and I do not consider spammers (or their sponsors and accomplices) to be suitable business mentors.

Beyond whatever accomplishments he may enjoy as a real estate tycoon, Donald Trump seems to be a master of self-promotion; over the last quarter-century or so, he’s waged a tooth-and-nail campaign to have his face shown or his name printed in just about every possible public medium. It was therefore inevitable, I suppose, that Mr. Trump should start showing up in spam (which is, of course, one of the newest and fastest-growing of advertising venues), although one wonders whether this partaking of chickenboning may also signal some shakiness in Mr. Trump’s empire.

In any case, Mr. Trump’s apparent turn to spam was occasioned by the creation in the spring of 2005 of Trump University (http://www.trumpuniversity.com/), an institution through which he promises to “...help YOU succeed.” Indeed, Mr. Trump is pretty democratic (small-D) about this, because he evidently arranged for an affiliate to send the following mass e-mailing:

Received: from id190.prodatasolutions.net (
by sv11pub.verizon.net
 (MailPass SMTP server v1.2.0 - 112105154401JY+PrW)
with SMTP id <5-30683-12-30683-12808-1-1141252503> for  vms043pub.verizon.net;
 Wed, 01 Mar 2006 16:35:04 -0600
Received: (qmail 90962 invoked by uid 20702017);
Received: from [] by MailSys1 via HTTP;
Date: Wed, 01 Mar 2006 22:24:16 +0000
From: Trump University
Subject: A Time Sensitive Invitation from Donald Trump
X-Originating-IP: []
To: my address hidden
Message-id: <20060106194443.20702017.qmail>
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 8BIT


FXUS61 KOKX 131432

930 AM EST MON FEB 13 2006


 [[ over 400 lines of weather forecast data DELETED ]]  


SMS -palvelusta saat tuoreimmat säiedot postinumeron tarkkuudella kotimaahan ja kaupunkikohtaisesti kaikille mantereille ulkomaille. Kesääalvelustamme löt muunmuassa golfsä, lomasä, kalastussä, veneilysä, maataloussä sekäade/tuuli-ennusteet.

 [[ about 50 paragraphs of Finnish-language text DELETED ]] 

<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>
<DIV id=RTEContent>

<A href="mailto:
my address hidden">my address hidden</A>
<BR><BR><B><I>Trump D. &lt;
my address hidden&gt;</I></B> wrote:
<BLOCKQUOTE class=replbq style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid">
<DIV>&nbsp;&nbsp; <DIV>

<map name="cre8"><area shape="rect" coords="1,1,600,620" href="http://16451.directpointmedia.net"></map>
<img height="620" src="http://directpointmedia.net/
dnximg/trump/prosper_media_player3/index.jpg" width="600" usemap="#cre8" border="0">
<map name="kraka"><area shape="rect" coords="1,1,517,80" href="http://16452.directpointmedia.net"></map>
<img height="80" src="http://directpointmedia.net/
dnximg/trump/trump_footer_white.gif" width="517" usemap="#kraka" border="0"></a>

Looking at this mail closely reveals numerous fingerprints of a spam operation apparently running out of Provo, Utah, associated with the company name “Ware Holdings,” and a personal name “Jade Koyle.” From this and other Trump U. material seen on the net emanating from the same operation, I have inferred a direct business relationship between Trump U. and the spam outfit, a much closer relationship than the typical “affiliate spam” operation.

The origin of the mail

The mail was left by, which, for a change, really does have the host name it claims to have in its HELO: id190.prodatasolutions.net points to according to a reverse-DNS lookup with host. The domain prodatasolutions.net is registered through moniker.com, but the whois data is cloaked so I cannot determine who owns the domain or where they are located.

The spam source address appears in a block assigned to “DataNet Media” in Provo, Utah. The e-mail contacts for this block are given in the datanetmedia.com domain; the registration was made in November, 2005, but by the time I received this spam, the domain had been “suspended for spam and abuse” by registrar GoDaddy. Apparently, however, DataNet’s IP addresses are still working fine for prodatasolutions.net (at least for the moment).

The message body

The body of the e-mail contains around 500 lines of unrelated text for padding, in the form of a standard National Weather Service forecast for New York (dated a couple of weeks before this spam came to me), and a further helping of text in what looks like the Finnish language. All of this data, plus a couple of appearances of my e-mail address, are effectively hidden from the reader by being enclosed in HTML <style> tags (although stylesheet data might be used in rendering an HTML document, the data themselves are never visible in the output). These are typical earmarks of a spammer trying to get his pitch past ISPs’ (and individual users’) spam filters. In other words, with a total message size of about 26,000 bytes, something like 95% (or more) of this mailing is a complete waste of bandwidth and resources for all concerned, since it has nothing to do with the message.

What does show up in the actual payload are two image links, both fetched from a host directpointmedia.net, which shows up at (whadya know, the same DataNet block as the spam source). Both the directpointmedia.net and the (suspended) datanetmedia.com domains are registered to “Jade Koyle” in Provo, Utah, whose contact e-mail address is given in the propsermedia.com domain (another of “Jade Koyle’s” domains, also suspended, listing Ware Holdings as the owner and Koyle as the contact). A Google search for the single word “prospermedia” reveals a lot of link spamming related to Donald Trump (including reference to another website at www.trumpuniversityelite.com, in another “Jade Koyle” domain (listed as being registered by “Ware Holdings,” operating in another net block registered to “Education Success” in Provo, and carrying pretty much the same video-enhanced pitch).

Summing up; affiliates and hangers-on

This gets a bit Byzantine, I know, so let’s recapitulate:

I could find no reference at www.trumpuniversity.com to any affiliate programs for those wishing to promote the site; therefore, I must conclude that, unless “Jade Koyle” was working pro-bono, or was trying to Joe-job Mr. Trump, there must have been a more direct business relation between the two by which Ware Holdings was engaged to promote Trump University on the net.

Interestingly, it would appear that Mr. Trump has also hooked up with the notorious “multiple-streams” biz-guru (and frequent star of spam) Robert G. Allen (see left), since there’s another website http://www.donaldu.com/ that ties the two together (the site claimed, before a recent update, that Donald U is the “...exclusive supplier of an elite selection of books for Trump University." This site operates out of Vancouver, BC, and so looks to be a distinct operation from either Trump University or Ware Holdings/Jade Koyle.

And so, here we are: the mega-mogul of the new millennium can do no better than to hire inept spammers and sleazy “seen-on-TV” success-pedlars to promote his “university.” At least Donald hasn’t yet descended all the way to make the claim that his “university” will give you a degree based on “life experience” (this, of course, would make Trump U. a diploma mill).

 home | legal stuff | glossary | blog | search

 Legend:  new window    outside link    tools page  glossary link   

(c) 2003-2007, Richard C. Conner ( )

04582 hits since March 28 2009

Updated: Sat, 18 Aug 2007