MainSleaze

I don’t speak or read Portuguese, but it appears that Brazilian web sales portal Grupo Click na Boa is trying to sell some sort of cosmetic enhancement product to a (presumably male) spamtrap, promising that the women will flock around (him|it). In any event, Grupo Click is sending bulk email to an email address that was closed in 2002. Since this is a single spamtrap hit, and a quick look at the Grupo Click web site shows an aggressive attempt via popup to get visitors to leave their email addresses, I suspect that Grupo Click is collecting a lot of forged, falsified, or out-of-date email addresses from that web site and failing to confirm them before it adds them to a list. The ESP is Lyris.

Sending IP: 208.66.204.204

Spam Sample:

Actual Headers:

Received: from mail30.elabs5.com (mail30.elabs5.com [208.66.204.204])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Wed, 25 Apr 2012 13:xx:xx <xxx>
Received: from [10.0.xx.xx] ([10.0.xx.xx:xx] helo=<xxx>.elabs5.com)
        by <xxx>.lyris.net (envelope-from <newsletter@elabs5.com>)
        (ecelerity 2.2.2.45 r(34222M)) with ESMTP
        id <xxx>; Wed, 25 Apr 2012 03:xx:xx -0700
To: <xxx>
Subject: =?utf-8?Q?Alongamento=20de=20C=C3=ADlios=20por=20R$=2035,
        00=20pague=20R$=2010,00=20no=20site=20e=20R$=2025,00=20no=20
        Studio=20Mandy?=
Date: Wed, 25 Apr 2012 03:xx:xx <xxx>
X-EmailAdvisor: <xxx>
X-Delivery: Level 0
Reply-To: sac@grupoclicknaboa.com.br
List-Unsubscribe: <mailto:unsubscribe-<xxx>@elabs5.com?subject=<xxx>>
Content-description: <xxx>
X-Complaints-To: abuse@elabs5.com
Message-Id: <<xxx>@elabs5.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="<xxx>"
From: "=?utf-8?Q?Grupo=20Click=20na=20Boa=20Viagens?=" <sac@grupoclicknaboa.com.br>

Readable Email:

From: Grupo Click na Boa Viagens <sac@grupoclicknaboa.com.br>
To: <spamtrap>
Subject: Alongamento de CADlios por R$ 35,00 pague R$ 2010,00 no site e R$ 25,00 no Studio Mandy

Oferta do dia: Tenha um olhar penetrante! Alongamento de cílios. Pague 10.00 nosite e 25.00 no Estabelecimento

<removed>

Studio Mandy
Rua Conselheiro Paulino, 752

Regulamento

• Sem limite de cupom por CPF
• Sem limite de cupom para presente
• Cupom Válido até 25 de julho de 2012
• – Agendamento pelos telefones 7845 – 9880 24*67922 OU 3241-7515

…