MainSleaze

Lowe’s, a U.S.-based hardware and home improvement store that competes directly with Home Depot, a few months ago started sending bulk email advertisements to a spamtrap that cannot have been live after 2002. Today Lowe’s hit a second spamtrap, an email address that (if it was ever live) closed in 2005. The ESP is ExactTarget.

Sending IP: 68.232.205.205

Spam Sample:

Actual Headers:

Received: from mta2.e.lowes.com (mta2.e.lowes.com [68.232.205.205])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Sun, 30 Sep 2012 11:xx:xx +0000 (UCT)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: by mta2.e.lowes.com id <xxx> 
        for <xxx>; Sun, 30 Sep 2012 05:xx:xx -0600 
        (envelope-from <bounce-<xxx>@bounce.e.lowes.com>)
From: =?UTF-8?B?TG93ZeKAmXMgSG9tZSBJbXByb3ZlbWVudA==? <lowes@e.lowes.com>
To: <xxx>
Subject: Don't Settle for Second. Get the Best.
Date: Sun, 30 Sep 2012 05:xx:xx -0600
List-Unsubscribe: <mailto:leave-<xxx>@leave.e.lowes.com>
MIME-Version: 1.0
Reply-To: "Lowe's" <reply-<xxx>@e.lowes.com>
x-job: <xxx>
Message-ID: <xxx>
Content-Type: multipart/alternative;
        boundary="<xxx>"

Readable Email:

From: Lowe’s Home Improvement <lowes@e.lowes.com>
To: <spamtrap>
Subject: Don’t Settle for Second. Get the Best.
Reply-To: Lowe’s <reply-<xxx>@e.lowes.com>

Unfortunately, your email client cannot display HTML or your settings are turned off. To view this email, please copy and paste the link above into your browser.

[NOTE: The spam email was so complex and so much content was in remotely-loaded graphics that I was unable to reproduce the email that most users would see. This is a rendering of the contents of the plain text section of that email.]

======================================================================
Lowe’s Companies, Inc.
1000 Lowe’s Blvd. Mooresville, NC 28117.

View our Privacy Policy.
http://click.e.lowes.com/?<xxx>

(C) 2012 by Lowe’s(R). All rights reserved.
Lowe’s and the gable design are registered trademarks of LF, LLC.