MainSleaze

Paragon Software Group, which sells a superb set of hard disk management utilities that I have used for many years, has unfortunately hired an email marketer, presumably in hopes of improving sales. The email marketer is currently emailing email addresses that have not been live in more than ten years. There is no ESP involved; Paragon is sending this email from their own IPs at Demos Internet in the Russian Federation.

Paragon’s email campaign has been running since the final week of September, but the quantities of spam have gone up considerably in the past 72 hours. Some of the email addresses that they hit could have been long-closed email addresses that at one time belonged to a customer, and others are obvious typos provided by somebody who felt that they had to provide an email address but didn’t want email. However, Paragon is emailing so many spamtraps that I doubt that they are emailing just their own list, however dirty and poorly maintained.

Certain codes in the HTML of the email also imply that the list is sourced from a “Leads” broker. In theory a list of leads might be opt-in, but in practice they almost never are.

A final note: I did not receive any of these notifications, and I am a longtime Paragon Customer. Paragon Software has an email address for me, one that I gave them upon updating my software this spring. Since I own my own mailserver, I could check the logs. Nobody has attempted to email me from this IP in the past month.

Sending IP: 194.87.66.116

Spam Sample:

Actual Headers:

Received: from m6.penreader.com (m6.penreader.com [194.87.66.116])
        by <xxx> (Postfix) with ESMTPS id <xxx>
        for <xxx>; Sun, 12 Oct 2014 03:##:## +0300 (EEST)
Received: from 127.0.0.1 ( 127.0.0.1 )
        by m6.penreader.com (8.14.4/8.12.10/SuSE Linux 0.7) with ESMTP id
        <xxx>
        for <xxx>; Sun, 12 Oct 2014 04:##:## +0400
Date: Sun, 12 Oct 2014 04:##:## +0400
From: eservice@paragon-software.com
Reply-To: eservice@paragon-software.com
To: <xxx>
Message-ID: <<xxx>.JavaMail.sendman@smtp>
Subject: Get new Paragon Rescue Kit for free! 
MIME-Version: 1.0
Content-Type: text/html;charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Organization: Paragon Software Group

Embedded Script Containing Codes of Interest:

<script type="text/javascript">
var pageTracker = _gat._getTracker("UA-229398-2");
pageTracker._setCustomVar(1, 'lead-source', 'mailing_online', 1);
pageTracker._setCustomVar(2, 'promo-id', 'MKT-<xxx>', 2);
pageTracker._setDomainName("none");
pageTracker._setAllowLinker(true);
pageTracker._trackPageview();
</script>

Readable Email:

From: eservice@paragon-software.com <eservice@paragon-software.com>
To: <spamtrap>
Subject: Get new Paragon Rescue Kit for free!

For any questions please do not respond to this email but refer to info@paragon-software.com

Only a few days are left to get free update!

As a Paragon product user, you are now receiving the updated version of Paragon Rescue Kit 14 as a free download. Paragon offers all of its customers this free service to ensure that they have access to an up-to-date Rescue Kit at all times. Paragon Rescue Kit is a collection of professional rescue functions for immediately restoring systems and data.

<removed>

CONTACT | SUPPORT | HOMEPAGE | E-SERVICE

This email is an information service of Paragon Software Group for our customers, which have at least one Paragon Product purchased and registered in their MyAccount. If you do not want to receive future information emails, please UNSUBSCRIBE.

If you have any questions, please contact sales@paragon-software.com or call Tel. 1-888-347-5462, Fax: 1-888-240-8993, 15615 Alton Parkway, Suite 400, Irvine, CA 92618.