MainSleaze

GroupOn, the massive social media site which has sent surprisingly little spam for the past year, is now hitting an email address that was shut down before 2005. GroupOn sent the email through their own IP range; no ESP was involved.

This is one of those situations that makes you go Hmmmm…. GroupOn did not exist when this email address was closed; there is absolutely no possibility that it was opted-in by anybody who had a legitimate claim to it. At the same time, GroupOn sends a LOT of email, and is hitting fairly few of my spamtraps, maybe 20-30 per day from both their own IP ranges and the ESPs that they use. That might sound like a lot to the average user (even the average knowledgeable anti-spam user), but I remember when GroupOn hit a few hundred spamtraps a day on my spamtrap server. I gather that after some strong prodding by Spamhaus, they committed to cleaning up their process and were largely successful.

I think that they need to recheck their confirmation process, though. Something slipped through that should not have.

Sending IP: 50.115.211.250

Spam Sample:

Actual Headers:

Received: from mta112s1.r.groupon.com (mta112s1.r.groupon.com [50.115.211.250])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Mon, 28 Jul 2014 08:##:## -0500 (CDT)
DKIM-Signature: <xxx>
Date: Mon, 28 Jul 2014 13:##:## +0000 (UTC)
From: Groupon <noreply@r.groupon.com>
To:  <xxx>
Message-ID: <<xxx>.JavaMail.rocketman@rocketman11.snc1>
Subject: Georgia Sea Turtle Center
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_Part_<xxx>"
X-RM-SendId: <xxx>
X-RM-EmailName: daily-email_jacksonville_rm
X-RM-UserHash: <xxx>
X-MSFBL: <xxx>
List-Unsubscribe: <mailto:<xxx>@unsub.r.groupon.com?subject=<xxx>>
X-RPCampaign: <xxx>
X-RPTags: daily-email_jacksonville_rm
X-Recruiting: Interested in headers? Join us: www.groupon.com/techjobs/
List-Id: <daily-email_jacksonville_rm_<xxx>.groupon>

Readable Email:

From: Groupon <noreply@r.groupon.com>
To: <spamtrap>
Subject: Georgia Sea Turtle Center

Your Jacksonville Deals | July 28, 2014

Featured Deal

Georgia Sea Turtle Center

Georgia Sea Turtle Center ⋅ Over 250 bought
$14 $8.50

<removed>

To feature your business on Groupon, get started at GrouponWorks.

You are receiving this email because <xxx> is signed up to receive Groupon communications. To adjust how often you receive future Daily Deal emails, including unsubscribing, click here.

Delivered by Groupon 600 W. Chicago Avenue, Suite 400, Chicago, IL 60654, USA
Need help? Have feedback? Feel free to contact us.