MainSleaze

United Airlines, a major U.S. based airline with routes around the world, just sent a bulk email advertisement to an email address that never heard from it before. The spamtrap address was closed in 2004. Nonetheless, the email contains a name and a OnePass (United’s frequent flyer program) number or scrambled version of it in the header and a masked version in the message body. This suggests one of two possibilities: that United is emailing uncontacted email addresses after years of ignoring bounces and undeliverables, or possibly that United hired an e-append firm. The ESP is Responsys.

Sending IP: 12.130.136.195

Spam Sample:

Actual Headers:

Received: from omp.news.united.com (omp.news.united.com [12.130.136.195])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Tue, 15 May 2012 02:xx:xx <xxx>
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: by omp.news.united.com (PowerMTA(TM) v3.5r17) id <xxx> 
        for <xxx>; Tue, 15 May 2012 00:xx:xx <xxx> 
        (envelope-from <UnitedAirlines@news.united.com>)
MIME-Version: 1.0
Content-Type: text/plain;
        charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 15 May 2012 00:xx:xx <xxx>
From: "United Airlines" <UnitedAirlines@news.united.com>
Reply-To: "United Airlines" <UnitedAirlines_noreply@united.com>
Subject: United Specials
X-cid: <xxx>
X-<xxx>: <xxx>
To: <xxx>
X-valueof-ONEPASS_NUMBER: <xxx>
Message-ID: <<xxx>@omp.news.united.com>

Readable Email:

From: United Airlines <UnitedAirlines@news.united.com>
To: <spamtrap>
Subject: United Specials
Reply-To: United Airlines <UnitedAirlines_noreply@united.com>

Add UnitedAirlines@news.united.com to your address book. See instructions.
http://news.united.com/servlet/cc6?<xxx>

United Specials
for <name removed>
Tuesday, May 15, 2012

Win a trip to cheer on Team USA in London

We’re giving you the opportunity to cheer on Team USA in person this summer. Claim a virtual seat on a United flight and be entered for a chance to win a trip to the 2012 Olympic Games in London.

<removed>

Subscription: United Specials
Email address: <xxx>
MileagePlus number: <xxx>

(C) 2012 United Air Lines, Inc.
United Air Lines, Inc. – MileagePlus Service Center
P.O. Box 6120, Rapid City, SD 57709-6120 USA