August 2016 in Spamtraps: ESPs

ESP mail seen in spamtraps August 2016

ESP mail seen in spamtraps August 2016

The theme of this month’s post is a specific company, unfortunately. The questionable honour goes to, Inc.

The percentage of ESP sent mail vs all mail seen in the spamtraps is 2.3%. The amount of ESP mail was almost 50% higher than last month, with the total amount of mail a little less (-15%) than last month. The remarkable raise appears to be due to a very small bunch of bad customers contaminating only two ESPs.

The Spanish folks from last month dropped back to oblivion, but we have two new entries in the top 10, at #1 and #10 respectively, and more new entries in the top 30 (that are alluded to in the “relative badness” graph). The reason for this month’s #1 appears to be a single customer only, and there are indications that the same customer has been contaminating other ESPs too (the #2 in “relative badness” didn’t quite make it to Top 10 despite a valiant effort, but has been having problems with anonymous Finnish spammers for quite some time). From what I already heard, this sounds like a bit of a vetting failure to begin with, followed by a failure to notice a problem and contain it (as it went on for more than a week).

0 All others 40.1%
1, Inc. 17.2% (62%)
2 SalesForce Marketing Cloud 8.1% ExactTarget Kohls (4.5%)(
3 SendGrid 7.7% (~4%)
4 MailChimp 5.5% 92% MC proper, 8% Mandrill (being phased out) (~4%)
5 Experian 4.6% Target (~10%)
6 Amazon SES 3.7% (~15%)
7 Constant Contact 3.6% Advisor Perspectives (still at 42%)
8 Oracle Marketing Cloud 2.9% Responsys, Eloqua and RightNow Nordstrom (~12%)
9 IBM Marketing Cloud 2.5% Silverpop The DCCC (~12%) with Hillary Clinton tagging only slightly behind
10 Benchmark Email 2.1% (~29%)

Bubbling under: Blue Hornet, Moosend/Mailendo (both at 2%), Rackspace Mailgun, Mail Minion (both at 1.9%).

Here’s the “relative badness” graph. Some observations are in order., Inc. wouldn’t usually make even the top 30, and their “relative badness” would normally be in line with MailChimp (i.e. “the least bad of them all”), but they’ve had a surprise from some Nordic spammers in mid to late August that appears to have been long in the brewing.

Moosend/Mailendo, a Greek/UK ESP, appears to have been targeted by the same bunch. At least the domain names and message contents are remarkably alike. The sending of started on August 9 and was contained on August 12, but not before they had managed to be responsible for over 90% of the output of this ESP (which normally flies completely below the radar, despite housing all the usual anonymous affiliate suspects) this month.

Average amount of messages per separate customer of ESP, August 2016

Average amount of messages per separate customer of ESP, August 2016

Finally, the “top spamming customers” table, which is rather unusual this month.

1 (anonymous domain registration), Inc. 62% 10.6%
2 (anonymous domain registration), Inc. 21% 3.6%
3 (anonymous domain registration), Inc. 11% 1.9%
4 (anonymous domain registration) Moosend/Mailendo 91% 1.9%
5 Advisor Perspectives Constant Contact 42% 1.5%

Leave a Reply

Go back to top