Penton Media: Spamming a Scraped Contact Email Address

Penton Media, a marketing firm with a past history of sending opt-out bulk email (spam), is emailing bulk advertisements to the contact email address for my personal blog (tw86034@ergosphere.net). The ESP is the Oracle Marketing Cloud, which is the combination of former ESPs Eloqua and Responsys, both of which Oracle now owns.

Given Penton Media’s past history, I would normally suspect a purchased or appended list. Penton has sent none of those mailings to any other email address of mine, however, or to any of my spamtrap email addresses. Since the blog contact email address is known to belong to an antispammer (me), I suspect that the cause of these spam emails was a malicious subscription.

However, that possibility does not get Penton Media or Oracle off the hook. Bulk email sent because of a malicious forgery is still spam. I won’t beat up a bulk emailer for sending it the first time I receive it, but I do notify them and expect them to deal with the problem promptly. As always, as a matter of principle and policy I do NOT unsubscribe from email that I never asked to receive.

When the first Penton Media spam arrived last week, I complained to the abuse contact email addresses listed at abuse.net for both Penton Media and Oracle. Two of the four email addresses bounced, including abuse@penton.com. Personal email addresses change from time to time, but role addresses — and especially RFC-mandated role addresses such as abuse@${domain} — are expected to remain active. I did not receive a response from either Penton Media or Oracle.

Today I received a second spam. This is not acceptable, Penton Media and Oracle. Below are the unredacted headers and excerpted message bodies of both spams. Please DEAL with your spam issue.

First Spam (Sent 26 February 2016)

Sending IP: 142.0.174.41

Actual Headers:

Received: from mail03.info.pentontech.com (mail03.info.pentontech.com [142.0.174.41])
	by galileo.ergosphere.net (Postfix) with ESMTP id 2AAD842393
	for <tw86034@ergosphere.net>; Fri, 26 Feb 2016 22:07:48 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha1; d=enews.datacenterworld.com; s=dk1024-2012; c=relaxed/relaxed;
	q=dns/txt; i=@enews.datacenterworld.com; t=1456524493;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=ZZpCzuV3I/oGvII5HXRPEnR4tq8=;
	b=E1kIXUKdnbWBlt0CKdEZATHP+FKVDwjMzdoa9J5Zv9S8iNr4tI4wY5c/MzcppfaL
	ONZswWPHIP1IXHnQFM+YH7CTs0nJ2wl/95KYVrco3lwxv1VZknk7N8GC8rGXqtjs
	ZSGQnhGZXUH2u8N0BIXIZQdDIJBc8LHiO1CfO6xkWCc=;
Received: from [10.4.1.245] ([10.4.1.245:45216] helo=P01INJ009)
	by msm-mta03-tor6 (envelope-from <bounce@enews.datacenterworld.com>)
	(ecelerity 3.6.9.48312 r(Core:3.6.9.0)) with ESMTP
	id 5C/17-06644-DCCC0D65; Fri, 26 Feb 2016 17:08:13 -0500
Message-ID: <147bec1bc51845baacf3053af26c71d8@1885539667>
X-Binding: 1885539667
X-elqSiteID: 1885539667
X-elqPod: 0x04D4AA276AEFAC548AF4C2541180280C6E4E16410A533B620AAC2EC8FC2601D8
List-Unsubscribe: <http://app.info.pentontech.com/e/u?s=1885539667&elq=147bec1b-c518-45ba-acf3-053af26c71d8>
MIME-Version: 1.0
From: "Data Center World" <datacenterworld@enews.datacenterworld.com>
To: tw86034@ergosphere.net
Reply-To: "Penton iNET" <pentoninet@inbound.bamboocricket.com>
Date: 26 Feb 2016 17:07:29 -0500
Subject: What Senior Execs Must Know about Enterprise Data Center Strategy
Content-Type: multipart/alternative;
 boundary=--boundary_596499_91fe963a-0562-4d83-afbf-fb1b68ae41fc

Readable Email:

From: Data Center World <datacenterworld@enews.datacenterworld.com>
To: <tw86034@ergosphere.net>
Reply-To: Penton iNET <pentoninet@inbound.bamboocricket.com>
Subject: What Senior Execs Must Know about Enterprise Data Center Strategy

What Senior Execs Must Know about Enterprise Data Center Strategy

By Bill Kleyman Full Article >>

There’s no question that the data center is now a core part of the business. Entire business capabilities are built around the power of IT solutions inside the data center. This is why it’s more important than ever for any company to select the correct data center strategy, considering a number of crucial factors:

<removed>

Mark Evanko will elaborate on this topic at the Data Center World Global Conference in Las Vegas March 14-18.

Register today and get the most for your education dollars. As an executive in your organization, you are eligible for a special discount on the Full Conference or Premium Pass. Sign up today and save 25%*!

<removed>

Periodically, Data Center World events will inform you of special products and other offers that we believe you will find helpful in your business or career. To STOP receiving promotional e-mails from Data Center World events, please click here.

Data Center World | Penton | 1166 Avenue of the Americas, 10th Floor | New York, NY 10036-2708 | Privacy Policy

Second Spam (Sent Today)

Sending IP: 142.0.174.39

Actual Headers:

Received: from mail01.info.pentontech.com (mail01.info.pentontech.com [142.0.174.39])
	by galileo.ergosphere.net (Postfix) with ESMTP id 5DB0B42277
	for <tw86034@ergosphere.net>; Mon, 29 Feb 2016 16:46:36 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha1; d=enews.thewhir.com; s=dk1024-2012; c=relaxed/relaxed;
	q=dns/txt; i=@enews.thewhir.com; t=1456764423;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=HyMdkvJ01Q38imWyXJjFfje28iM=;
	b=ARpEYor4sAQ+nm83nA1hyHuwcNeAYefvFa1uUYiFW/ssOAPs3gzzhWx4gwp1evk8
	3qtCq/l5EotvyPkWErHb1utq0p85B6SVBtWYpgmZS04FuWjU35SSufIENwokHU5R
	aaM3DCL1ZnyZcwAxdUZ3NvYMFzxUTzd7Wd4iT6BzOeY=;
Received: from [10.4.1.245] ([10.4.1.245:33291] helo=P01INJECT017)
	by msm-mta07-tor6 (envelope-from <bounce@enews.thewhir.com>)
	(ecelerity 3.6.9.48312 r(Core:3.6.9.0)) with ESMTP
	id 0C/76-06676-70674D65; Mon, 29 Feb 2016 11:47:03 -0500
Message-ID: <1c5be62f099f491b9c2350dbf5ea0de4@1885539667>
X-Binding: 1885539667
X-elqSiteID: 1885539667
X-elqPod: 0x04D4AA276AEFAC548AF4C2541180280C6E4E16410A533B620AAC2EC8FC2601D8
List-Unsubscribe: <http://app.info.pentontech.com/e/u?s=1885539667&elq=1c5be62f-099f-491b-9c23-50dbf5ea0de4>
MIME-Version: 1.0
From: "The WHIR" <thewhir@enews.thewhir.com>
To: tw86034@ergosphere.net
Reply-To: "Penton iNET" <pentoninet@inbound.bamboocricket.com>
Date: 29 Feb 2016 11:46:57 -0500
Subject: Just Announced: Las Vegas WHIR Networking Event!
Content-Type: multipart/alternative;
 boundary=--boundary_870723_522ef644-f266-4744-aa80-5ba79e58eb56

Readable Email:

From: The WHIR <thewhir@enews.thewhir.com>
To: <tw86034@ergosphere.net>
Reply-To: Penton iNET <pentoninet@inbound.bamboocricket.com>
Subject: Just Announced: Las Vegas WHIR Networking Event!

Sponsored By:

Lenovo * LiquidWeb

Here is your exclusive invitation to attend the Las Vegas WHIR Networking Event on Wednesday, March 16 from 7-10 pm. RSVP Now to secure your spot at the event.

<removed>

Allison Heather
Sales Manager, WHIR Networking Events

Periodically, theWHIR events will inform you of special products and other offers that we believe you will find helpful in your business or career. To STOP receiving promotional e-mails from theWHIR events, please click here.

theWHIR | Penton | 1166 Avenue of the Americas, 10th Floor | New York, NY 10036-2708 | Privacy Policy

One Response to Penton Media: Spamming a Scraped Contact Email Address

  1. NOTE: A couple of hours after the second spam above arrived at my inbox, another copy was sent to mainsleaze@spambouncer.org. That’s right, to the scraped contact address from this blog.

    Either Penton is stark raving mad, or somebody is scraping email addresses from known antispammer blogs and websites and feeding them to a non-confirming subscription web page or something similar. :/

    Penton, you need to fix this. Your subscription process might not be the same as scraping email addresses, but it’s damned sure an attractive nuisance and going to (further) sully your reputation.

Leave a Reply

Go back to top