Facediili.fi: Spamming Xmas present tips

Facediili Oy (www, biz reg) is spamming on behalf of happydealsday.com (see domain registration below; the two are owned by what amounts to the same entity). The spam has been sent to a compound file consisting of their own customer file, the Finnish Trade Register (aka the Biz Info System) and “other public registers”.  This spam obviously has nothing to do with anybody’s job function.

Spamming IP: (WebsiteWelcome, Softlayer/ThePlanet)

Spam headers:

Return-Path: <support@happydealsday.com>
Received: from hap.happydealsday.com (hap.happydealsday.com [])
        by x (Postfix) with ESMTP id x
        for <x>; Tue, 11 Dec 2012 03:mm:ss +0200 (EET)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
        d=happydealsday.com; s=default;
Received: from sohan by hap.happydealsday.com with local (Exim 4.80)
        (envelope-from <support@happydealsday.com>)
        id x
        for x; Mon, 10 Dec 2012 19:mm:ss -0600
To: x
Subject: Parhaat joululahjat: Omenahotelli, König, Eirikuva ja paljon muuta
X-PHP-Script: happydealsday.com/admin/functions/send_app_eng.php for
From: "facediili.fi" <noreply@facediili.fi>
Date: Mon, 10 Dec 2012 05:mm:ss -0600
X-LibVersion: 3.3.1_4
MIME-Version: 1.0
Content-Type: multipart/alternative;
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-MimeOLE: Produced by SwiftMailer 3.3.1_4
X-mid: x
X-Mailer: AC Mailer
Message-ID: <20121211hhmmss.x.x.swift@happydealsday.com>
X-AntiAbuse: This header was added to track abuse, please include it with any
        abuse report
X-AntiAbuse: Primary Hostname - hap.happydealsday.com
X-AntiAbuse: Original Domain - x
X-AntiAbuse: Originator/Caller UID/GID - [500 500] / [47 12]
X-AntiAbuse: Sender Address Domain - happydealsday.com
X-Get-Message-Sender-Via: hap.happydealsday.com: authenticated_id:

Spam contents: Practically nothing in plaintext.


To Unsubscribe, please click here :

Domain registration:

   Registered through: GoDaddy.com, LLC (http://www.godaddy.com)
      Created on: 28-Mar-11
      Expires on: 28-Mar-13
      Last Updated on: 29-Mar-12

   Fernando Francisco
   Nuottakunnantie 7 D 17
   Espoo, Espoo 02230

   Administrative Contact:
      Francisco, Fernando  fgfrancisco@yahoo.com
      Nuottakunnantie 7 D 17
      Espoo, Espoo 02230

   Technical Contact:
      Francisco, Fernando  fgfrancisco@yahoo.com
      Nuottakunnantie 7 D 17
      Espoo, Espoo 02230

   Domain servers in listed order:

The phone number in the domain registration has three matches in the online phone dictionary. One is to 360Amigo Oy, one is to Business Bakers, a private d/b/a, and one is to an individual, Gonçalves Francisco Fernando at the address indicated in the domain registration.  This individual has lots of hits in the Bisnode business register, and based on his present and past association with Malwarebytes, Lavasoft Ad-Aware and F-Secure, seems an unlikely candidate for a spammer.  But the evidence speaks for itself.

3 Responses to Facediili.fi: Spamming Xmas present tips

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top