Metromode Media: Detroit News and Information… to an Abuse Reporting Address?
Metromode Media, an online portal for business and life in southeastern Michigan, just sent an advertising email to a role address at a domain that closed in 2002. The role address, when live, was used to report criminal abuse activities by users of the domain. The ESP is Vertical Response.
Although as usual I masked out the spamtrap and MX from the spam sample, this role address is obvious. As I have not seen previous spam from Metromode Media, I suspect that they might have a non-confirming web form subscription process. They might want to secure that, and do at least minimal sanity checking on their subscriptions, before adding them to their list. The next time your friendly local malicious subscriber hits, he or she might have the sense not to leave such obvious tracks. 🙂
Sending IP: 74.116.91.141
Spam Sample:
Actual Headers:
Received: from mkt107-sf.verticalresponse.com (mkt107-sf.verticalresponse.com [74.116.91.141])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Thu, 12 Jul 2012 12:xx:xx -0000 (UT)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: from [10.4.xx.xx] ([10.4.xx.xx:xx] helo=<xxx>.verticalresponse.com)
by <xxx> (envelope-from <bounces-<xxx>@b.cts.vresp.com>)
(ecelerity 3.1.6.41536 r(41536)) with ESMTP
id <xxx>; Thu, 12 Jul 2012 05:xx:xx -0700
From: "Metromode Media - Detroit" <Metromode_Media_Detroit@mail.vresp.com>
Reply-To: "Metromode Media - Detroit" <reply-<xxx>@u.cts.vresp.com>
To: <xxx>
Subject: Agents of Change
Date: Thu, 12 Jul 2012 12:xx:xx +0000
Message-ID: <<xxx>@mail.vresp.com>
List-Unsubscribe: <mailto:reply-<xxx>@u.cts.vresp.com?subject=unsubscribe>
MIME-Version: 1.0
X-Company_ID: <xxx>
X-vrfbldomain: fbl.p0.verticalresponse.com
X-vrpod: <xxx>
X-CTS-Enabled: <xxx>
X-Campaign: <xxx>
X-vrrpmm: <xxx>
Content-Type: multipart/alternative;
boundary="<xxx>";
charset="UTF-8"
Readable Email:
From: Metromode Media – Detroit <Metromode_Media_Detroit@mail.vresp.com>
To: <spamtrap>
Subject: Agents of Change
Reply-To: Metromode Media – Detroit <reply-<xxx>@u.cts.vresp.com>
metromode Newsletter
If you have trouble reading this email, go to
http://cts.vresp.com/c/?<xxx>
Thursday, July 12, 2012
Follow Us:
[http://cts.vresp.com/c/<xxx>
visit:
www.metromodemedia.com
[http://cts.vresp.com/c/?<xxx>
<removed>
Michigan Suburbs Alliance Turns 10: A Q&A with Conan Smith
<removed>
This message was sent by Metromode Media – Detroit using VerticalResponse
3434 Russell
#202
Detroit, MI 48202