MainSleaze

Online discounter eCost.com is sending bulk email to an email address that was closed in 2007. There is no record of eCost.com contacting this email address since it finished its timeout period and was re-enabled in 2009. The ESP is Lyris, aka Uptilt.

The body of the spam email contains a reference to an affiliate program run by eCost. Affiliate programs are most commonly seen with snowshoe spam, a much more egregious form of spam than mainsleaze spam, but they do appear in some mainsleaze. Does the affiliate program accept unconfirmed subscriptions? Does the eCost web site accept unconfirmed subscriptions?

Sending IP: 74.116.233.151

Spam Sample:

Actual Headers:

Received: from smtp.news.ecost.com (smtp.news.ecost.com [74.116.233.151])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Sun, 30 Oct 2011 14:xx:xx -0500 (CDT)
Received: from <xxx>.elabs10.com (10.10.<xxx>.<xxx>) 
        by smtp.news.ecost.com (PowerMTA(TM) v3.5r15) id <xxx> 
        for <xxx>; Sun, 30 Oct 2011 12:xx:xx -0700 
        (envelope-from <xxx>>)
To: <xxx>
Subject: HURRY: $299 40in 1080p Full-HD. $17 Viewsonic 7in LCD Frames. $58 NUVI 1200 GPS
Date: Sun, 30 Oct 2011 12:xx:xx -0700
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
X-EmailAdvisor: <xxx>
X-Delivery: Custom <xxx>
Reply-To: deals@news.ecost.com
List-Unsubscribe: <mailto:unsubscribe-<xxx>@elabs10.com?subject=<xxx>>
Content-description: <xxx>
X-Complaints-To: abuse@elabs10.com
Message-Id: <<xxx>@elabs10.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="=<xxx>"
From: "eCOST.com HotSheet" <deals@news.ecost.com>

Readable Email:

From: eCOST.com HotSheet <deals@news.ecost.com>
To: <spamtrap>
Subject: HURRY: $299 40in 1080p Full-HD. $17 Viewsonic 7in LCD Frames. $58 NUVI 1200 GPS
Reply-To: deals@news.ecost.com

To ensure future delivery of emails, please add to your safe sender list or address book. – deals@news.ecost.com
To view this email as a webpage go here http://www.elabs10.com/ct.html?<xxx>

Home Electronics Best Sellers

<removed>

Want some free cash? Do you have a Website?

Join the eCOST.com Affiliate Program today! Click Here! http://www.elabs10.com/ct.html?<xxx>

2011, All Rights Reserved – eCOST.com, Inc.
2555 West 190th St. Torrance, CA 90504

We respect your right to privacy – view our policy. http://www.elabs10.com/ct.html?<xxx>

If you no longer wish to receive this special offer newsletter, then click on the link below, and you will automatically be removed from our list. To unsubscribe, click here http://www.elabs10.com/ct.html?<xxx> or send an email to: unsubscribe-@elabs10.com