MainSleaze

Gevalia, a division of Kraft Foods that sells coffee and coffee equipment, is sending bulk email to an email address that was closed in 2008. Despite this, the spam that is attached below claims that this email address “recently registered with a network website to receive special online offers”. This is untrue. Either Gevalia is accepting unconfirmed web form subscriptions (a fertile source of typoed email addresses and bogus third-party subscriptions), or Gevalia purchased a list. The ESP is Yesmail, a division of Infogroup.

Sending IP: 204.92.133.121

Spam Sample:

Actual Headers:

Received: from smtp.customerwk.com (smtp.customerwk.com [204.92.133.121])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu, 24 Nov 2011 20:xx:xx -0600 (CST)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Content-Transfer-Encoding: 8bit
Message-ID: <xxx>
Content-Type: multipart/alternative; boundary="_----------=<xxx>"
MIME-Version: 1.0
X-Mailer: MIME::Lite <xxx>
Date: Fri, 25 Nov 2011 02:xx:xx UT
To: <xxx>
From: "Gevalia" <IG@customerwk.com>
Reply-To: IG@customerwk.com
Subject: Black Friday Starts Today! Get Your Brewer + FREE Coffee
X-Campid: <xxx>@customerwk.com
List-Unsubscribe: <mailto:unsubscribe-<xxx>@customerwk.com>
X-Pviq: <xxx>
Sender: "Gevalia" <IG@customerwk.com>
X-Eid: <xxx>

Readable Email:

From: Gevalia <IG@customerwk.com>
To: <spamtrap>
Subject: Black Friday Starts Today! Get Your Brewer + FREE Coffee
Reply-To: IG@customerwk.com

THE GEVALIA BREWER BLOWOUT SALE

We’re Inviting YOU to Shop Early and Save BIG!

Buy any select GEVALIA COFFEEMAKERS (up to a $99 value) for Just $25 and get a FREE BOX OF COFFEE!

SHOP NOW
http://ct.customerwk.com/rd/cts?<xxx>

To unsubscribe, please click here:
http://ct.customerwk.com/rd/cts?<xxx>

Gevalia, 999 North Dupont Blvd, Milford, DE 19963, United States

You recently registered with a network website to receive special online offers. To no longer receive messages, please use the link below to remove your subscription.
http://customerwk.com/webforms/unsub/index.jsp?<xxx>