October 2018 in Spamtraps: ESPs

Blast from the recent past

(This is what happens when you forget to click Publish)

ESP spam seen in spamtraps, October 2018

The percentage of ESP spam was 3.0%, down from 3.2% in September. The total amount of mail in this trap collection was up 16% from September.

There’s a new player on the list again. Ediware is a French email service provider that has been around since 2001. This is the first time ever they have made this list in any capacity, and it’s straight to the top 10. During October 24 from 5 pm to 8 pm CEST they had a malware/botnet/whatever infestation spamming “fix your wifi”, “desktop microscope”, “heating gadget” etc. To their credit, they got on top of it quite quickly, in four hours the problem was completely curbed, but while it was going on, the volume was huge. Any other stuff from them amounted to 0.4% of the total – no wonder we don’t usually see them.

Salesforce is so much ahead of SendGrid this month I would have expected to see something unusual from them. But no, it’s the same old players, none of whom are sending anything out of the ordinary.

SendGrid really need to get rid of Advisor Perspectives. Like, really. And so do MailChimp, for that matter.

Bubbling under this month: Mapp Digital (2.1%), Adobe Campaign (2.0%).

RATINGPARTICIPANTPERCENTAGENOTESMOST PROMINENT CUSTOMER
0All others34.7%
1Salesforce Marketing Cloud14.2%ExactTargetKohls (4.5%)
2SendGrid11.8%Advisor Perspectives (11%)
3MailChimp8.9%Boston Globe (0.8%)
4Oracle Marketing Cloud5.7%Nordstrom (6.9%)
(Nordstrom and Nordstrom Rack are also Salesforce’s #7 most spamming customer with 1.6% of SMC total)
5Amazon SES5.0%Netflix (3.8%)
6CheetahMail4.2%Eddie Bauer (5.8%)
7Mailgun4.0%The Italian affiliate spammers (at least 35%)
8Ediware3.9%Botnet flood on October 24 (>99%)
9IBM Marketing Cloud3.1%renewlife.com (nearly 30%)
10Constant Contact2.5%123dj.com (2.4%)

On The Forensic Capabilities of LeadForensics

The study of forensics refers to scientific tests or techniques used in connection with the detection of crime. It is an odd choice of name for what I think is a data seller, especially one whose targeting seems poor enough to be spamming me. They claim to want to help me generate more leads for my website, but my website doesn’t sell anything. I do not really need any leads.

They are sending from IP address 46.236.37.232, which appears to be an email platform called Message Focus or Adestra.

From what I can tell, the only forensic capability this entity has shown me is that they seem to buy B2B spam leads, which is very disappointing.

Siltaraha Oy / Finlandia Finance Oy

In May 2016, a Finnish B2B financing company (or “payday loans for businesses”, if you like) called Siltaraha Oy (www, biz reg, people responsible) started advertising its activities in B2B spam to purchased lists.
Read more…

New Finnish B2B spammer: Digimarketingmanager.com / Mailmarketingmanager.net

Here’s the culprit

Domains have been registered a week ago. The LI profile indicates the operation has started in July 2018. The people whose network the spam was sent from already know. Not just abuse@, the actual people.

If you’re reading this, Mr. A, take my advice: stop now.

Rule #4: The natural course of a spamming business is to go bankrupt.

Sendia is Effortia

Suomen Markkinointirekisteri Oy on Office 365

Aki Lindell seems to have obtained services from Microsoft.
Read more…

Ferratum Oyj, Payday Loans for Businesses and Affiliate Spam

Ferratum Oyj, a Finnish payday loan operator (www, biz reg, responsible people) recently had the smart idea to advertise their business loan services through affiliate spam. This blog entry attempts to document what ensued.

Read more…

Snowshoe-like email verification and lead generation services

Many email verification and lead generation services act a lot like snowshoe spammers. They bounce around from host to host, hoping to avoid detection and suspicion caused by their unusual SMTP traffic.

Read more…

Clickback MAIL hitting dead/invalid emails

Clickback MAIL has been hitting spam trap with email addresses which have been dead for a very long time (i.e. years) or never valid in any decade. Probably because Clickback doesn’t require pesky things like “Opt-In” or “Confirmed” subscribers but do allow purchased lists and “cold” contacts to be mailed. Seriously this is bad behavior, I wonder why no one has just blacklisted all of Clickback IPs/domains yet?

Read more…

Go back to top