MainSleaze

Country Inns & Suites, part of the Carson Hotels chain, recently started sending bulk email to a spamtrap email address that has never received email before. As with yesterday’s spam report, I saw delivery attempts in my mail log and enabled the email address a few weeks ago. The ESP is Epsilon, via its subsidiary Bigfoot Interactive.

The spam appears to be linked to an account that belongs to an actual customer. That implies a typoed email address, either by the customer or during data entry. The information in the email suggests that this is a long-time customer, however. I must wonder whether Carlson *ever* checks its logs for bounces, and what if anything it does when an email address is undeliverable for weeks or months?

Sending IP: 208.70.142.222

Spam Sample:

Actual Headers:

Received: from dmx1.bfi0.com (dmailer0222.dmx1.bfi0.com [208.70.142.222])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Wed, 14 Nov 2012 08:xx:xx +0000 (UTC)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: from [10.150.xx.xx] ([10.150.xx.xx:xx] helo=<xxx>)
        by dmx1.bfi0.com (envelope-from <<xxx>@email.carlsonhotels.com>)
        (ecelerity 2.2.2.45 r(34222M)) with ESMTP
        id <xxx>; Wed, 14 Nov 2012 03:xx:xx -0500
Reply-To: =?iso-8859-1?B?IkNvdW50cnkgSW5ucyAmIFN1aXRlcyI=?= <<xxx>@email.carlsonhotels.com>
Bounces_to: bounce.<xxx>@email.carlsonhotels.com
Message-ID: <<xxx>.DumpShot.2@email.carlsonhotels.com>
X-SS: <xxx>
X-BFI: <xxx>
Date: Wed, 14 Nov 2012 03:xx:xx EST
From: =?iso-8859-1?B?Q291bnRyeSBJbm5zICYgU3VpdGVz?= <carlsonhotels@email.carlsonhotels.com>
Subject:  =?iso-8859-1?B?MyBEYXkgU2FsZSAtIFNhdmUgMjUlIG9uIHlvdXIgbmV4dCBzdGF5?=
To: <xxx>
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary="<xxx>"

Readable Email:

From: Country Inns & Suites <carlsonhotels@email.carlsonhotels.com>
To: <spamtrap>
Subject: 3 Day Sale – Save 25% on your next stay
Reply-To: \”Country Inns & Suites\” <<xxx>@email.carlsonhotels.com>

*******************************************************
Country Inns & Suites
*******************************************************

Book a Room at
ttp://email.carlsonhotels.com/<xxx>

<removed>

Dear <xxx>,

Account: <xxx>
Balance as of November 08, 2012: <xxx> points
Log in at
http://email.carlsonhotels.com/<xxx>

<removed>

Promotional offers are subject to terms and conditions. Participation in Club Carlson is subject to the program terms and conditions.

http://email.carlsonhotels.com/<xxx>

All Club Carlson benefits and services are subject to availability and may vary by hotel. See member benefit terms and restrictions at
http://email.carlsonhotels.com/<xxx>

This email was sent to you at: <xxx>

(C)2012 Country Inns & Suites By Carlson, Inc. All Rights Reserved.