MainSleaze

Neiman Marcus, a high-end U.S. department store, just emailed a number of spamtraps. The Subject header asks for them to confirm their email address. The message body thanks them for having confirmed their email address. The ESP is Cheetahmail, a division of Experian.

So what’s the story, Neiman Marcus? Is this a closed-loop confirmed opt-in (COI) (aka Double Opt-in) confirmation email that needed editing? Or are you thanking several of my spamtraps for confirming? For the record, they did not subscribe to receive your email, and they won’t confirm this or any subscription request.

Sending IPs: 63.236.76.70

Spam Sample:

Actual Headers:

Received: from mta893.lastcallemail.com (mta893.lastcallemail.com [63.236.76.70])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Sat,  2 Aug 2014 13:##:## +0000 (UTC)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Date: Sat, 2 Aug 2014 13:##:## -0000
Message-ID: <<xxx>@mta893.lastcallemail.com>
List-Unsubscribe: <mailto:rm-<xxx>@lastcallemail.com>
From: "NM Last Call" <LastCall@lastcallemail.com>
To: <xxx>
Subject: Immediate Action Required - Verification of Email Address Needed
MIME-Version: 1.0
Reply-To: "NM Last Call" <support-<xxx>@lastcallemail.com>
Content-type: multipart/alternative; boundary="=<xxx>"

Readable Email:

From: NM Last Call <LastCall@lastcallemail.com>
To: <spamtrap>
Subject: Immediate Action Required – Verification of Email

Text/Plain Portion of Email:

And we’re back!

Thanks for confirming your email subscription. You’ll
continue to receive emails with amazing sales, events, and fashion news.

<removed>

*****************************************************************

Our records indicate that you wish to receive e-mail offers and updates from Neiman Marcus Last Call Clearance Centers.

Click here to manage your email preferences or unsubscribe.
http://lastcallemail.com/a/<xxx>

Neiman Marcus
Attn: E-mail Removal, Customer Care Department
111 Customer Way
Irving, Texas 75039

Text/HTML Portion of Email:

Confirm Your Subscription!

[NOTE: There was no confirmation request in the Text/Plain portion of this email. There was nothing resembling “And we’re back!” in the Text/HTML portion of the email. Editing error?]