MainSleaze

H-E-B, a regional grocery chain in south-central Texas and northeastern Mexico, is sending bulk email confirmation requests to a pure spamtrap with an associated name that never belonged to that spamtrap. The requests appear to be confirmed opt-in (COI) requests. If they are, then the spamtrap will not be added to H-E-B’s list despite either a typo during the subscription process or a subscription forgery. (Spamtraps don’t respond to confirmation requests any more than they subscribe for bulk email.) The sending ESP is PulsePoint.

H-E-B, if this was a proper COI confirmation, please congratulate yourselves and specifically any managers who implemented the policy to confirm subscriptions. (PulsePoint, if this was your idea, H-E-B owes you their thanks and, in my never-humble-enough-opinion, a bonus.) If it was instead a welcome message to an email address that was added to the list without confirmation, be warned that somebody added a pure spamtrap to your list today. You might want to remove those email addresses, and then consider how to avoid that in the future.

Sending IP: 96.46.132.78

Spam Sample:

Actual Headers:

Received: from mail6.welcome.confirmrequest.com (mail6.welcome.confirmrequest.com [96.46.132.78])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Mon, 16 Jan 2012 09:xx:xx -0600 (CST)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: by mail6.welcome.confirmrequest.com id <xxx> 
        for <xxx>; Mon, 16 Jan 2012 09:xx:xx -0600 
        (envelope-from <out-<xxx>@welcome.confirmrequest.com>)
From: H-E-B <H-E-B@welcome.confirmrequest.com>
Reply-To: Confirm Request <<xxx>@welcome.confirmrequest.com>
To: <xxx>
Message-ID: <<xxx>.JavaMail.root@welcome.confirmrequest.com>
Subject: Welcome to H-E-B Online!
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-PDTA: <xxx>
list-unsubscribe: <mailto:unsub-<xxx>@welcome.confirmrequest.com>
X-PVIQ: <xxx>
Date: Mon, 16 Jan 2012 09:xx:xx -0600

Readable Email:

From: H-E-B <H-E-B@welcome.confirmrequest.com>
To: <spamtrap>
Subject: Welcome to H-E-B Online!
Reply-To: Confirm Request <<xxx>@welcome.confirmrequest.com>

This is a one time mailing. This message was not sent to you unsolicited. You are receiving this email because you requested to receive more information from the advertiser below on one of our promotional sites at 2012-01-16 09:xx:xx from the IP address xxx.xxx.xxx.xxx.

Thanks for subscribing to H-E-B emails!

<removed>

HEB.com, 646 S Main Ave.
San Antonio, TX 78204