MainSleaze

J.D. Byrider, a U.S.-based used car retailer and franchise with its own credit company, just sent a bulk email advertisement to an email address that, if it ever existed, closed before 2002. The ESP is Streamsend.

This spamtrap could easily be an email address that was created when a spammer tried a dictionary attack against this domain and, when nothing bounced, added those email addresses to a list that the spammer then sold. The types of spam that this spamtrap receives suggest that this is the case. It could also be a very old customer email address. If so, then J.D. Byrider is contacting customer email addresses that have not been mailed in a decade, or possibly is contacting their undeliverables list. :/

Sending IP: 72.19.206.199

Spam Sample:

Actual Headers:

Received: from me-ss2-2feeey.mailengine1.com (me-ss2-2feeey.mailengine1.com [72.19.206.199])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Fri,  6 Jul 2012 14:xx:xx -0000 (UT)
Received: by me-ss2-2feeey.mailengine1.com (PowerMTA(TM) v3.<xxx>) id <xxx> 
        for <xxx>; Fri, 6 Jul 2012 07:xx:xx -0700 
        (envelope-from <streamsendbouncer@me-ss2-2feeey.mailengine1.com>)
Content-Type: multipart/alternative; boundary="<xxx>"
MIME-Version: 1.0
X-Mailer: StreamSend2 - <xxx>
X-Mailer-Version: 2.0
X-Mailer-Environment: production
X-Report-Abuse-At: abuse@streamsend.com
X-Report-Abuse-Info: It is important to please include full email headers in the report
X-rpcampaign: StreamSend<xxx>
X-Streamsend2id: <xxx>
List-Unsubscribe: <mailto:unsubscribe+<xxx>@me-ss2-2feeey.mailengine1.com>
Date: Fri, 06 Jul 2012 07:xx:xx -0700
From: "J.D. Byrider" <socialmedia@jdbyrider.com>
To: <xxx>
Subject: =?utf-8?Q?Don't=20miss=20the=20Tent=20Event=20-=20Open=20until?=
 =?utf-8?Q?=20July=2015th!?=
Message-ID: <<xxx>@me-ss2-2feeey.mailengine1.com>

Readable Email:

From: J.D. Byrider <socialmedia@jdbyrider.com>
To: <spamtrap>
Subject: Don’t miss the Tent Event – Open until July 15th!

It’s the J.D. Byrider Tent Event!

You could be financed and on the road today with a payment plan that can fit your budget! Our vehicles go through a comprehensive inspection and carry clean titles. PLUS they’re backed with a 24 Month/24,000 Mile Warranty that covers the engine, transmission, battery, starter, alternator and a whole lot more!

(765) 588-9000
575 Sagamore Pkwy. S.
Lafayette, IN 47905

Like us on Facebook 🙂

Limited offer with approved credit at participating dealers. See participating dealerships for full details–
12802 Hamilton Crossing Boulevard
Carmel , IN 46032
United States