MainSleaze

Eksenbilgisayar, an online computing equipment and electronics store based in Istanbul, Turkey, a few weeks ago started to spam an email address that, if it ever existed, was closed in 2002. Most of the content of the email is in remotely-hosted images. The ESP is MadMimi.

The spams are in Turkish, but I was able to get the sense of them thanks to Google’s helpful and increasingly accurate Translate service. Since the email address to which these spams were sent has not been valid for a decade, and since in this case a typo appears unlikely, I suspect that Eksenbilgisayar might have purchased a list.

NOTE: MadMimi’s bulk emails are normally sent from a domain with the name mimimail#.com, where # stands for a one- or two-digit number. Tagged URLs in their emails use the hosts mim.io and go.madmimi.com.

Sending IP: 207.210.122.237

Spam Sample:

Actual Headers:

Received: from mimimail9.com (mimimail9.com [207.210.122.237])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu, 24 May 2012 12:xx:xx -0000 (UT)
DKIM-Signature: <xxx>
Received: by mimimail9.com (PowerMTA(TM) v3.5r15) id <xxx> 
        for <xxx>; Thu, 24 May 2012 08:xx:xx -0400 
        (envelope-from <mailman@mimimail9.com>)
Date: Thu, 24 May 2012 08:xx:xx -0400
From: Eksenbilgisayar <kampanya@eksenposta.com>
Sender: Eksenbilgisayar <kampanya=eksenposta.com@mimimail9.com>
To: <xxx>
Message-Id: <<xxx>@worker9.madmimi.managedmachine.com.tmail>
Subject: =?utf-8?Q?Yaz=C4=B1c=C4=B1_F=C4=B1r?=
         =?utf-8?Q?satlar=C4=B1n=C4=B1_?=
         =?utf-8?Q?Ka=C3=A7=C4=B1rmay=C4=B1n?=
         =?utf-8?Q?=2E=2E=2E?=
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=<xxx>
Precedence: bulk
Mimiaid: <xxx>
List-Unsubscribe: <mailto:mailman@mimimail1.com?subject=Unsubscribe <xxx>>, 
        <http://go.madmimi.com/opt_out?<xxx>>

Readable Email:

From: Eksenbilgisayar <kampanya@eksenposta.com>
To: <spamtrap>
Subject: Yazıcı Fırsatlarını Kaçırmayın…

Bu e-postayı görüntülemekte zorluk mu yaşıyorsunuz? Tarayıcınızda açmak için buraya tıklayın.

<removed>

Mail gönderim listemizden çıkmak için buraya tıklayın.

Bu mail i arkadaşlarınız ile paylaşmak istermisiniz.