Promohouse Ltd, Seychelles: Spamming
This is a totally boring spammer, but it’s hitting Finnish “B2B” addresses obtained from the Business Information System, and the messages sent to Finnish spamtraps are in unusually credible Finnish for a foreign spammer. It is advertising translation services, booking assistance for hotels &c, and the provision of online shops, among other things.
It identifies itself as Promohouse Ltd. 307 Victoria House, Victoria, Mahe, Seychelles. This text is in all spams and could be used as content-based filter fodder if somebody was so inclined. Personally, I view content-based spam filters as a waste of CPU cycles and would rather see this operation bumped off the edge of the Internet…
Spamming IPs: Probably not an exhaustive list.
- [78.31.69.217] (myLoc managed IT AG, Düsseldorf, Germany)
- [85.25.141.184] (BSB Service GmbH, part of intergenia AG, Hürth, Germany)
- [178.238.227.12] (Giga-Hosting GmbH, München, Germany)
- [193.164.131.57] (Giga-Hosting GmbH)
- [193.164.133.194] (Giga-Hosting GmbH)
- [200.106.145.42] (Hosting Panama)
- [200.106.146.122] (Hosting Panama)
- [213.239.225.236] (Hetzner Online AG, Gunzenhausen, Germany)
Domain names involved in spam (another non-exhaustive list):
- booking-generator.com, booking-generator.org
- company-network.org, company-network.info
- company-network-europe.info
- company-network-sy.info
- company-solutions.org
- guest-generation.org
- guest-promo.com, guest-promo.net, guest-promo.org
- increase-booking.com, increase-booking.net, increase-booking.org
- network-agencies.org
- tourism-marketing-service.com, tourism-marketing-service.net
- tourism-promotion.com
- tourism-solution.com
- utilization-manager.net
Abuse response from Germany’s finest:
Recent occurrences. The list was derived by grepping for “Promohouse Ltd” in a selection of spamtrap messages on a spamtrap system that houses several dozen domain names, spanning all of December 2013 and January until present, then extracting all the sending IPs.
The numbers appear such that blocking [213.239.225.236] would get rid of over 90% of Promohouse Ltd spam, at least on our sample. Our “n” for this overview is on the order of 2500.
Received: from cross-company.org (cross-company.org [87.118.114.49])
Received: from travel-spirit.net (travel-spirit.net [5.9.5.10])
Received: from booking-professional.com (unknown [178.238.227.12])
Received: from booking-professional.org (booking-professional.org [193.164.131.57])
Received: from booking-connect.org (booking-connect.org [188.138.115.63])
Received: from contact-to-guest.com (contact-to-guest.com [188.138.115.63])
Received: from europe-utilization-manager.info (europe-utilization-manager.info [5.9.5.10])
Received: from eu-guest-connect.info (eu-guest-connect.info [193.164.131.57])
Received: from europe-booking-connect.info (europe-booking-connect.info [78.31.69.217])
Received: from company-network.org (company-network.org [213.239.225.236])
Used the same methodology again for February and March 2014. The list of Promohouse IPs is as follows:
5.9.5.10
78.31.69.217
87.118.114.49
178.238.227.12
188.138.115.63
193.164.131.57
213.239.225.236
10.5.9.5.in-addr.arpa domain name pointer holiday-newsletter.net.
217.69.31.78.in-addr.arpa domain name pointer holiday-newsletter.com.
49.114.118.87.in-addr.arpa domain name pointer company-solutions-manager.net.
12.227.238.178.in-addr.arpa domain name pointer business-booking.info.
63.115.138.188.in-addr.arpa domain name pointer guest-booster.com.
57.131.164.193.in-addr.arpa domain name pointer booking-booster.net.
236.225.239.213.in-addr.arpa domain name pointer submit-message.com.
The “n” for this sample is more than 3500. Again, blocking 213.239.225.236 gets rid of more than 90% of Promohouse Ltd spam, with 78.31.69.217 being the second contender at less than 5%.
Used the same methodology again for April and May 2014. The list of Promohouse IPs is as follows:
The distribution of the frequencies is pretty much the same as last time around. The “n” for this sample is >2500.
Did the same again for June-July 2014.
The last four are responsible for ~15-20% of the spam each. The rest are contributing a little less. The “n” for this sample is approx. 1400.
Here’s the stuff for August so far. They’re playing reverse DNS games too, it appears.
The “n” is 1000 and the last IP is responsible for nearly 60%. All the rest amount to less than 10% each.
It took a long time, but finally somebody else noticed, too.
https://www.spamhaus.org/rokso/spammer/SPM1432/promohouse-custmarketing