StarPoint: Selling entertainment performers to spamtraps
Oy StarPoint Ab (see biz reg) is selling entertainment services to spamtraps. The ESP is Suomen IT-Ratkaisut Oy (viestisuora.fi).
I first spotted this on Saturday, March 24 (the initial transmission had been on Thu Mar 22). I let the ISP (Nebula) and the ESP know that I thought, based on the address the spam was received at, that the client was using a stolen list, either one they had downloaded themselves or one they had purchased through a rogue list vendor such as Janne Laitinen / Suunnittelutoimisto Jotain… / yrityspostia.fi. And sure enough, in complete violation of every section of the Personal Data Act, they announce their address source as “Public sources on the Internet”, which I can now report is true because every address this was seen at is included in the stolen list and isn’t a B2B address. No reply from either the ISP or the ESP, more spam just in, and here it is.
Spamming IP:
Spam headers:
From asiakastiedote@starpoint.fi Tue Mar 27 10:4x:xx 2012 Return-Path: <asiakastiedote@starpoint.fi> Received: from srv1.viestisuora.fi (srv1.viestisuora.fi [188.117.46.242]) by x (Postfix) with ESMTP id x for <x>; Tue, 27 Mar 2012 10:4x:xx +0300 (EEST) Received: from srv1.viestisuora.fi by srv1.viestisuora.fi (MDaemon Standard v12.5.3) with ESMTP id mdX.msg for <x>; Tue, 27 Mar 2012 10:4x:xx +0300 X-MDMailLookup-Result: pass smtp.mail=asiakastiedote@starpoint.fi (ip=127.0.0.1) (srv1.viestisuora.fi) X-Return-Path: asiakastiedote@starpoint.fi X-Envelope-From: asiakastiedote@starpoint.fi X-MDaemon-Deliver-To: x Date: Tue, 27 Mar 2012 09:4x:xx +0200 Subject: Varaa esiintyjät 2012 tilaisuuksiin helposti! To: x From: StarPoint viihdepalvelut <asiakastiedote@starpoint.fi> Reply-To: StarPoint viihdepalvelut <viestisuora@starpoint.fi> Message-ID: <x-asiakastiedote@starpoint.fi> X-Mailer: PHP v5.3.5 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="x" Status: RO Content-Length: 7888 Lines: 188
Human-readable spam contents:
StarPoint Viihdepalvelut
Jos viesti ei näy oikein paina tästä
VARAA ESIINTYJÄT ASIAKAS- JA HENKILÖSTÖTILAISUUKSIIN NYT
SUOMEN SUURIMPAAN VIIHDEPALVELUUN PÄÄSET TÄSTÄ.
* Palvelu on käytettävissä kellon ympäri
* Tarjouksen saat 24 tunnin sisällä tarjouspyynnöstä
* Kasvavasta tarjonnasta löydät jo yli 300 esiintyjää
* Artistitakuu kattaa tilaustasi vastaavan esiintyjän yllättävissä tilanteissa
Olemme mielellämme apunasi myös tilaisuutesi suunnittelussa, joten soita numeroon 040 162 6669 tai lähetä viesti osoitteeseen info@starpoint.fi niin otamme yhteyttä. Vastaanottaja: , Osoitetietolähde: Internetin julkiset tietolähteetKirjeen peruutus tästäPalautetta tästä
Viestisuora
More spam just in, and still no reply from either the ESP or the ISP.
I should add Nebula has responded with the equivalent of “We’ve pointed this out to the customer”, i.e. they’re not playing dead, but it’s not like they’re doing a lot either.
Dude said in private email that the problem is selling address registers on the Internet and that that should stop first of all, and that they first had poor experiences with the register of Markkinointirekisteri.fi (that is, before they started using “public registers on the Internet”).
Starpoint/Viestisuora share their ISP (Nebula) with… Markkinointirekisteri.fi
More spam in on April 24 says the address source is… Markkinointirekisteri.fi
More spam just in, and the current batch doesn’t even try to indicate the address source – there’s just nothing at all – or how to unsub – there’s nothing at all.
More spam just in, this time they’ve bought an address register from Digimediatoimisto Haikuu. It contains the same crap as everybody else’s FBIS exports. Tried to ask Suomen IT-Ratkaisut Oy / Viestisuora for publishing their AUP (currently there’s none available that I can see) and for specific positions on spam related matters, but their mail server rejects mail if your physical hostname does not also have a MX record. Oh, the clue 🙂