PiarMainos.com: Emailing Five-Year-Dead Spamtraps

Piarmainos.com, a Finnish printing and packaging company, is hitting a few spamtraps that have not been live email addresses for over five years. The ESP is Streamsend.

This unsolicited bulk email has been sent persistently for months. There is no indication that the customer has ever looked at his bounce logs (the email addresses were disabled for two or more years), his engagement statistics, or any other measures of list quality. This sort of poor list management usually leads to poor reputation, email in the spam folder, and even blocklistings if it goes on long enough and gets bad enough.

Sending IP: 72.19.226.66

Spam Sample:

Actual Headers:

Received: from me-ss2-5oemw7.mailengine1.com (me-ss2-5oemw7.mailengine1.com [72.19.226.66])
	      by <xxx> (Postfix) with ESMTP id <xxx>
	      for <xxx>; Tue, 29 Jul 2014 16:##:## +0300 (EEST)
Received: by me-ss2-5oemw7.mailengine1.com (PowerMTA(TM) v3.5r15sb7) id <xxx> 
        for <xxx>; Tue, 29 Jul 2014 04:##:## -0700 
        (envelope-from <streamsendbouncer@me-ss2-5oemw7.mailengine1.com>)
Content-Type: multipart/alternative; boundary="_----------=_<xxx>"
MIME-Version: 1.0
X-Mailer: StreamSend2 - <xxx>
X-Mailer-Version: 2.0
X-Mailer-Environment: production
X-Report-Abuse-At: abuse@streamsend.com
X-Report-Abuse-Info: It is important to please include full email headers in the report
X-rpcampaign: <xxx>
X-Streamsend2id: <xxx>+me-ss2-5oemw7.mailengine1.com
List-Unsubscribe: <mailto:unsubscribe+<xxx>@me-ss2-5oemw7.mailengine1.com>
Date: Tue, 29 Jul 2014 04:##:## -0700
From: "PiarMainos.com - Elokuu" <info@piarmainos.com>
Reply-To: "PiarMainos.com" <ivan@piarmainos.com>
To: <xxx>
Subject: Tarjouksia Elokuu PiarMainos.com
Message-ID: <<xxx>@me-ss2-5oemw7.mailengine1.com>

Readable Email:

From: PiarMainos.com – Elokuu <info@piarmainos.com>
To: <spamtrap>
Subject: Tarjouksia Elokuu PiarMainos.com

Jos viesti ei näy oikein, klikkaa tästä.

6kpl Roll-Up 85x200cm
269.40 eur +alv

1kpl – 69.90 eur +alv
6kpl – 269.40 eur +alv (44,90eur/kpl)

Roll Upit ovat toimivia peruskuvatelineitä, joissa on automaattinen kuvavuodan rullausmekanismi. Roll Up -telineiden ominaisuuksia voi hyödyntää kaikissa tiloissa ja tilanteissa – ne toimivat yksin, sarjana tai osana messukokonaisuutta. Esillepano, kuljetus ja pakkaaminen on vaivatonta: Roll Upit pakataan koot- tuna kantolaukkuun, joka kulkee kevyesti mukana kaikkialle. Roll Upit soveltuvat myynti- ja esittelytilauksiin, messulle ja kokouksiin.

<removed>

© 2014 – Kaupland OY • www.PiarMainos.com
Laivalahden puistotie 10, Helsinki 00810, Finland

<xxx> Unsubscribe: Jos et jatkossa halua tätä uutiskirjettä, klikkaa tästä.

2 Responses to PiarMainos.com: Emailing Five-Year-Dead Spamtraps

  1. While there does appear to be a Finnish business registration, it’s really not Finnish, but (Russian-origin) Estonian. The domain registrant is an Estonian business and the spam-advertised services are hosted by Elkdata in Estonia.

    “Milson” is a sole tradership / personal d/b/a of Svetlana Myllär. This address, “c/o Milson, Laivalahden puistotie 10” appears in a number of business registrations, so it appears that Ms. Myllär is acting as a proxy for a bunch. Her site has no content, but it’s notable that it’s hosted by AS51765 / creanova.org / euhost.fi in

    inetnum: 91.233.116.0 – 91.233.117.255
    netname: CREANOVA-NET
    descr: Oy Crea Nova Russia LTD
    country: FI

    And here’s the domain WHOISes for the two.

    [whois.eurodns.com]
    Domain Name: piarmainos.com
    Registry Domain ID: D4290741-COM
    Registrar WHOIS Server: whois.eurodns.com
    Registrar URL: http://www.eurodns.com
    Updated Date: 2013-10-10T12:56:55Z
    Creation Date: 2010-10-10T00:00:00Z
    Registrar Registration Expiration Date: 2014-10-09T00:00:00Z
    Registrar: Eurodns S.A.
    Registrar IANA ID: 1052
    Registrar Abuse Contact Email: legalservices[at]eurodns.com
    Registrar Abuse Contact Phone: +352.27220150
    Domain Status: clientTransferProhibited
    Registry Registrant ID:
    Registrant Name: Glustsenko Ivan
    Registrant Organization: Piar Ou
    Registrant Street: Kreutzwaldi 24
    Registrant City: Tallinn
    Registrant State/Province:
    Registrant Postal Code: 10147
    Registrant Country: EE
    Registrant Phone: +55950391
    Registrant Fax:
    Registrant Email: info@piar.ee

    [whois.ficora.fi]

    domain: milson.fi
    descr: TH-media Oy ← Illegally posing as a Ltd, really a personal d/b/a
    descr: 24383122
    address: –
    address: LAIVALAHDEN PUISTOTIE 10
    address: 00810
    address: HELSINKI
    phone: +358 40 177 9588 ← reverse maps to “Kirkas Group” (an old alias of TH-media) and TH-Media
    status: Granted
    created: 2.10.2007
    modified: 23.7.2013
    expires: 2.10.2014
    nserver: ns1.creanova.org [Ok]
    nserver: ns3.creanova.org [Ok]
    nserver: ns2.creanova.org [Ok]
    dnssec: no

  2. Still going on from EZ Publishing / streamsend.com.

    $ whois trycker.fi
    [Querying whois.fi]
    [whois.fi]
    
    domain.............: trycker.fi
    status.............: Registered
    created............: 21.9.2015
    expires............: 21.9.2018
    available..........: 21.10.2018
    modified...........: 16.9.2017
    RegistryLock.......: no
    
    Nameservers
    
    nserver............: ns3.wixdns.net [OK]
    nserver............: ns2.wixdns.net [OK]
    dnssec.............: unsigned delegation
    
    Holder
    
    name...............: Kaupland OY
    register number....: 2365559-5
    address............:  
    address............: Laivalahden puistotie 10
    address............: 00810
    address............: Helsinki
    country............: Finland
    phone..............: +372.55950391
    
    Registrar
    
    registrar..........: EuroDNS S.A.
    www................: http://www.eurodns.com
    
    Admin
    
    name...............: Kaupland OY
    address............: Glustsenko Ivan
    address............: Laivalahden puistotie 10
    address............: 00810
    address............: Helsinki
    country............: Finland
    phone..............: +372.55950391
    email..............: ivan@piarmainos.com
    
    Tech
    
    name...............: Kaupland OY
    address............: Glustsenko Ivan
    address............: Laivalahden puistotie 10
    address............: 00810
    address............: Helsinki
    country............: Finland
    phone..............: +372.55950391
    email..............: ivan@piarmainos.com
    
    >>> Last update of WHOIS database: 15.10.2017 21:31:59 (EET) < <<
    

Leave a Reply

Go back to top