Metromode Media: Detroit News and Information… to an Abuse Reporting Address?

Metromode Media, an online portal for business and life in southeastern Michigan, just sent an advertising email to a role address at a domain that closed in 2002. The role address, when live, was used to report criminal abuse activities by users of the domain. The ESP is Vertical Response.

Although as usual I masked out the spamtrap and MX from the spam sample, this role address is obvious. As I have not seen previous spam from Metromode Media, I suspect that they might have a non-confirming web form subscription process. They might want to secure that, and do at least minimal sanity checking on their subscriptions, before adding them to their list. The next time your friendly local malicious subscriber hits, he or she might have the sense not to leave such obvious tracks. 🙂

Sending IP:

Spam Sample:

Actual Headers:

Received: from ( [])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu, 12 Jul 2012 12:xx:xx -0000 (UT)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: from [10.4.xx.xx] ([10.4.xx.xx:xx] helo=<xxx>
        by <xxx> (envelope-from <bounces-<xxx>>)
        (ecelerity r(41536)) with ESMTP
        id <xxx>; Thu, 12 Jul 2012 05:xx:xx -0700
From: "Metromode Media - Detroit" <>
Reply-To: "Metromode Media - Detroit" <reply-<xxx>>
To: <xxx>
Subject: Agents of Change
Date: Thu, 12 Jul 2012 12:xx:xx +0000
Message-ID: <<xxx>>
List-Unsubscribe: <mailto:reply-<xxx>>
MIME-Version: 1.0
X-Company_ID: <xxx>
X-vrpod: <xxx>
X-CTS-Enabled: <xxx>
X-Campaign: <xxx>
X-vrrpmm: <xxx>
Content-Type: multipart/alternative;

Readable Email:

From: Metromode Media – Detroit <>
To: <spamtrap>
Subject: Agents of Change
Reply-To: Metromode Media – Detroit &ltreply-<xxx>>

metromode Newsletter
If you have trouble reading this email, go to<xxx>

Thursday, July 12, 2012

Follow Us:



Michigan Suburbs Alliance Turns 10: A Q&A with Conan Smith


This message was sent by Metromode Media – Detroit using VerticalResponse

3434 Russell
Detroit, MI 48202

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top