MainSleaze

ThinPrint, a brand of Cortado AG, is spamming addresses they know to be dead for two plus years via their own IPs.

Postmaster at thinprint.com has been informed of a domain having changed hands after August 31, 2009 on February 12, 2010 after attempts to deliver to invalid addresses resulting in 550 5.1.1 No such user were spotted in the mail logs. This resulted in no response, but more attempts of the same.  The spam continues to the present day.

There is no RFC-Ignorant.org correlation of this, even in the removed entries, and nothing in my mailer-daemon folder. (The entry there for their abuse@ is not related to this in any way.) It seems reasonable to conclude that the mail to the required role account has been delivered. Another report was sent to abuse at {cortado.com,thinprint.com,thinprint.de} today. The two latter ones were delivered:

Postfix Log

Oct 18 22:36:09 myhostname postfix/smtp[1327]: DD8047CC188: to=<abuse@thinprint.com>, relay=mail.thinprint.com[80.150.255.134]:25, delay=1.3, delays=0.12/0.04/0.97/0.17, dsn=2.0.0, status=sent (250 ok:  Message 2818877 accepted)
Oct 18 22:36:09 myhostname postfix/smtp[1328]: DD8047CC188: to=<abuse@thinprint.de>, relay=mail.thinprint.de[80.150.255.134]:25, delay=1.4, delays=0.12/0.04/0.98/0.22, dsn=2.0.0, status=sent (250 ok:  Message 2818878 accepted)

Unfortunately, the former wasn’t delivered.

Postfix Log

Oct 18 22:36:08 1655mc-node1 postfix/smtp[1326]: DD8047CC188: to=<abuse@cortado.com>, relay=mail.cortado.com[85.214.9.139]:25, delay=0.56, delays=0.12/0.01/0.3/0.13, dsn=5.0.0, status=bounced (host mail.cortado.com[85.214.9.139] said: 550 UNKNOWN USER (in reply to RCPT TO command))

Spamming IP: 80.150.255.134 (September 2011 onwards; previously seen from 89.246.80.34 (June-July 2011), 88.79.154.2 (April 2011), 145.253.119.78 (March 2010 to March 2011)

Spam header sample:

FFrom mailingbounce@service.thinprint.com  Tue Oct 18 16:32:52 2011
Return-Path: <mailingbounce@service.thinprint.com>
Received: from service.thinprint.com (mail.thinprint.de [80.150.255.134])
        by mail.atrotossavainen.fi (Postfix) with ESMTP id 656057CC188
        for <x@atro.fi>; Tue, 18 Oct 2011 16:32:52 +0300 (EEST)
Received: from [192.168.96.85] (helo=tpinxmail01)
        by service.thinprint.com with esmtp (Exim 4.50 #1 (Debian))
        id 1RG9mj-0001zl-AS
        for <x@atro.fi>; Tue, 18 Oct 2011 15:32:49 +0200
Date: Tue, 18 Oct 2011 15:35:08 +0200 (CEST)
From: Cortado Enterprise News <m.schwarz@service.cortado.com>
Reply-To: Cortado Enterprise News <m.schwarz@service.cortado.com>
To: x@atro.fi
Message-ID: <INX.12310556f0a3c40a19abc4a64c2.dc5.199f9.1616.13316e72bc7c0f.mailingbounce@service.thinprint.com>
Subject: New Product Versions and Enhanced Partner Program
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="----=_Part_3525905_20790996.1318944908600"
X-Mailer: Inxmail PE 3.8.2.16
Content-Length: 47928
Lines: 1042

Spam envelope-from lines and dates for all captured messages

From mailingbounce@service.thinprint.com  Wed Mar 24 17:34:44 2010
From mailingbounce@service.thinprint.com  Wed Apr 14 12:33:13 2010
From mailingbounce@service.thinprint.com  Tue May 18 20:32:54 2010
From mailingbounce@service.thinprint.com  Tue Jun 15 14:31:35 2010
From mailingbounce@service.thinprint.com  Tue Aug 17 19:03:10 2010
From mailingbounce@service.thinprint.com  Tue Sep 14 11:58:09 2010
From mailingbounce@service.thinprint.com  Tue Nov  2 12:34:22 2010
From mailingbounce@service.thinprint.com  Mon Dec  6 15:58:07 2010
From mailingbounce@service.thinprint.com  Wed Dec 22 17:26:42 2010
From mailingbounce@service.thinprint.com  Tue Jan 25 16:57:32 2011
From mailingbounce@service.thinprint.com  Tue Mar 29 15:49:22 2011
From mailingbounce@service.thinprint.com  Wed Apr 27 13:41:18 2011
From mailingbounce@service.thinprint.com  Thu Jun  9 19:40:53 2011
From mailingbounce@service.thinprint.com  Wed Jun 29 16:03:09 2011
From mailingbounce@service.thinprint.com  Wed Jul 27 11:44:59 2011
From mailingbounce@service.thinprint.com  Thu Sep 15 17:11:51 2011
From mailingbounce@service.thinprint.com  Tue Oct 18 16:32:52 2011