May 2021 in Spamtraps: ESPs

Figure 1. Top 10 ESPs in our spamtraps, May 2021

Here’s a monthly summary of our findings in May 2021. Because of a major glitch at an otherwise unremarkable operator the total of ESP mail is noticeably larger than the month before (from 6.6% to 6.8%), the top 10 has a new participant that would never appear on the list otherwise, and the share of the top 10 out of everything is much larger than usual.

RatingParticipantPercentageNotesMost prominent customer
0All others33.2%
1Salesforce Marketing Cloud14.1%Marcus & Millichap (4%)
2SendGrid13.9%Uber (7.2%)
3Retarus12.0%Mostly backscatterMAILER-DAEMON (99%)
4Mailchimp8.0%Egyeditermekek.net (0.9%)
5Amazon SES5.7%Netflix (9.3%)
6Oracle Marketing Cloud3.2%Harborfreight.com (3.5%)
7Epsilon3.0%DICK’S Sporting Goods, Inc. (57.5%)
8Mailgun2.9%With some spillover from MailjetHarri.com (3.3%)
9CheetahMail2.1%Talbots.com (11.4%)
10Constant Contact2.0%Rentv.com (1.5%)
Table 1. Top 10 ESPs in our spamtraps, May 2021,
with their shares of the total and most prominent customers

This month’s special feature is a flood of backscatter from Retarus, a German ESP whose presence in our traps is usually so insignificant that they’re not even in the top 40. Early this month, there were two outbursts of this activity, between 7 to 11 am UTC on May 3 and between 3 to 7 am UTC on May 6. It is only the second time that backscatter causes an ESP to make an appearance here, the first, if memory serves, having been Hobsons in July 2018.

After taking a closer look last period, I noticed that our handling of the merged operations of Mailgun and Mailjet is somewhat wonky, which explains the appearance of any given customer on both at the same time. To be honest, it doesn’t help that they appear to be borrowing IP blocks from each other. But this is a problem that I expect will resolve itself in the short to medium term as the merger is eventually completed (one hopes, anyway).

Sliding window – August to October 2020 in Spamtraps: ESPs

This follows the earlier July to September post – the trends continue to be more important than the spot figures. The percentage of ESP spam of all mail was 9.7% in October.

Figure 1. Percentages of various ESPs of the total catch identified
as having been sent by any ESP, August to October 2020
Read more…

UpCloud – competition is fierce and business prospects dire

Earlier today, the Finnish cloud hosting company UpCloud Ltd (www, biz reg, responsible people) decided they’d start looking for new customers by spamming.

Read more…

Another three-month look at Spamtraps: ESPs – July, August, September 2018

July to September 2018 in Spamtraps: ESPs

July to September 2018 in Spamtraps: ESPs

We had an unexpected participant in Hobsons, who traditionally send effectively nothing to us, only just about enough for us to have recognized that they even exist. It appears their network space is shared between the ESP and some other branch of their operations. The servers of the non-ESP operations were misconfigured on April 10 shortly before 8 pm UTC and started spewing out backscatter (bounces of spam to the forged sender addresses). This went on until 9/11 @ 11 am UTC, peaking in July.

With Yesmail, the money mule spammers (subjects: “New offer”, “New vacancies in our company”, “Interesting work”, “Staff Wanted”, “Good day!”, “Hello!”, “Interesting offer”, “Welcome to our company”) started appearing in April, peaked in July, and were effectively out by September. The numbers of this type of spam on any other ESP platform are never measured in more than the single digits.

Worst senders:

  1. SendGrid: Advisor Perspectives, by a margin of more than 2x to the next contestant, month after month (with a slight nod in the general direction of Airbnb in July)
  2. SMC/ExactTarget: Kohls (only barely), with Marcus Millichap popping up in September
  3. MailChimp: Advisor Perspectives (WTH?)
  4. Oracle: Nordstrom (only barely)
  5. Mailgun: The Italian affiliate spammers (see previous blogs)
  6. Yesmail: After the money mule trash, mktgdillards.com
  7. Amazon SES: jobalert123.com
  8. CheetahMail: shopbonton.com, loft.com, emailtuesdaymorning.com (all almost below the noise floor)
  9. Constant Contact: 123dj.com (only barely)
  10. IBM: tjx.com, renewlife.com
  11. Mapp: conservativeintel.com
  12. Epsilon: DICK’S Sporting Goods, Inc.

On The Forensic Capabilities of LeadForensics

The study of forensics refers to scientific tests or techniques used in connection with the detection of crime. It is an odd choice of name for what I think is a data seller, especially one whose targeting seems poor enough to be spamming me. They claim to want to help me generate more leads for my website, but my website doesn’t sell anything. I do not really need any leads.

They are sending from IP address 46.236.37.232, which appears to be an email platform called Message Focus or Adestra.

From what I can tell, the only forensic capability this entity has shown me is that they seem to buy B2B spam leads, which is very disappointing.

Siltaraha Oy / Finlandia Finance Oy

In May 2016, a Finnish B2B financing company (or “payday loans for businesses”, if you like) called Siltaraha Oy (www, biz reg, people responsible) started advertising its activities in B2B spam to purchased lists.
Read more…

New Finnish B2B spammer: Digimarketingmanager.com / Mailmarketingmanager.net

Here’s the culprit

Domains have been registered a week ago. The LI profile indicates the operation has started in July 2018. The people whose network the spam was sent from already know. Not just abuse@, the actual people.

If you’re reading this, Mr. A, take my advice: stop now.

June 2018 in Spamtraps: ESPs

ESP spam seen in spamtraps, June 2018

ESP spam seen in spamtraps, June 2018

Read more…

A three-month look at Spamtraps: ESPs

Good morning, Munich…

A four-month look at Spamtraps: ESPs

November 2017 to February 2018 in Spamtraps: ESPs

Nuff said. All the data is there and questions are welcome, either in comments to this article or in other avenues. Just haven’t gotten around to writing it up.

Go back to top