MainSleaze

Canal Plus Finland, a brand name of the Swedish-based C More Entertainment Ab, a provider of premium TV services, is spamming addresses they know to be dead for two plus years via Basefarm Ab, a Swedish provider of Internet services.

Postmasters at canalplusnewsletter.com and basefarm.net have been informed of a domain having changed hands after August 31, 2009 on February 13, 2010 after attempts to deliver to invalid addresses resulting in 550 5.1.1 No such user were spotted in the mail logs. This resulted in no response, but more attempts of the same, so the same report was mailed to those two postmasters, along with abuse at basefarm.com and info at canalplus.se on February 26, 2010. That resulted in nothing either. The spam continues to the present day.

There is no RFC-Ignorant.org correlation of this, even in the removed entries, and nothing in my mailer-daemon folder.  It seems reasonable to conclude that the mails to required role accounts have been delivered. Another report was sent to abuse at basefarm.com today and delivered:

Postfix Log

Oct 18 10:48:48 myhostname postfix/smtp[31784]: 0597E7CC188: to=<abuse@basefarm.com>, relay=bf-mail.osl.basefarm.net[81.93.172.8]:25, delay=8.7, delays=0.12/0.01/5.6/2.9, dsn=2.0.0, status=sent (250 OK id=1RG4Pm-0000Fa-3L)

Spamming IP: 80.76.155.25

Spam header sample:

From bounceX@canalplusnewsletter.com  Tue Oct 18 09:59:15 2011
Return-Path: <bounceX@canalplusnewsletter.com>
Received: from www.newslettercanalplus.com (t4c-webtv-se-vip.sth.basefarm.net [80.76.155.25])
by mail.atrotossavainen.fi (Postfix) with SMTP id 60041794B94
for <x@atro.fi>; Tue, 18 Oct 2011 09:59:15 +0300 (EEST)
From: CANAL+ <info@canalplus.fi>
To: "x <x@atro.fi>
Message-ID: <ef793c2b7cb1408285dd5bd480e183c4@canalplusnewsletter.com>
Date: Tue, 18 Oct 2011 08:58:43 +0200
Subject: =?iso-8859-1?B?Q0FOQUwrIEpVTEtJU1RJIErExEtJRUtLT1ZBTElOVEFOU0Eg?=
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Length: 14549
Lines: 316

Spam envelope-from lines and dates for all captured messages

The digit sequence after “bounce” and before “@” is always different.

From bounceX@canalplusnewsletter.com  Thu Apr  1 16:54:03 2010
From bounceX@canalplusnewsletter.com  Fri Apr  9 16:25:55 2010
From bounceX@canalplusnewsletter.com  Fri Apr 23 19:14:54 2010
From bounceX@canalplusnewsletter.com  Fri May  7 13:15:04 2010
From bounceX@canalplusnewsletter.com  Fri May 21 14:00:08 2010
From bounceX@canalplusnewsletter.com  Fri Jun  4 16:32:38 2010
From bounceX@canalplusnewsletter.com  Fri Aug 27 18:41:27 2010
From bounceX@canalplusnewsletter.com  Fri Sep 10 19:53:40 2010
From bounceX@canalplusnewsletter.com  Thu Oct  7 20:00:12 2010
From bounceX@canalplusnewsletter.com  Fri Oct 15 15:36:07 2010
From bounceX@canalplusnewsletter.com  Fri Oct 29 18:12:39 2010
From bounceX@canalplusnewsletter.com  Tue Nov 30 21:35:22 2010
From bounceX@canalplusnewsletter.com  Fri Feb  4 18:21:02 2011
From bounceX@canalplusnewsletter.com  Fri Feb 18 12:34:31 2011
From bounceX@canalplusnewsletter.com  Thu Apr 14 14:17:29 2011
From bounceX@canalplusnewsletter.com  Thu Apr 21 15:27:10 2011
From bounceX@canalplusnewsletter.com  Thu Apr 28 18:43:03 2011
From bounceX@canalplusnewsletter.com  Wed May 25 12:48:22 2011
From bounceX@canalplusnewsletter.com  Mon Jun 20 20:16:14 2011
From bounceX@canalplusnewsletter.com  Tue Jul  5 15:32:43 2011
From bounceX@canalplusnewsletter.com  Thu Aug 11 14:53:41 2011
From bounceX@canalplusnewsletter.com  Tue Aug 30 11:19:34 2011
From bounceX@canalplusnewsletter.com  Wed Sep 28 11:07:21 2011
From bounceX@canalplusnewsletter.com  Tue Oct 18 09:59:15 2011