Pulse.ng: Spamming Purchased or Email Appended Lists

Nigerian tabloid site Pulse.ng has been emailing over 100 of my spamtraps daily for months. Enough of the spamtraps are pristine spamtraps that they must have purchased a list or hired an email appender. (Unless they scraped the list themselves, no other explanation makes sense.) Their ESP is EMarSys.

Although this appears to be a legitimate news site, this was blatant, deliberate spam to a purchased or email appended list. EMarSys cannot afford to ignore this sort of spam activity if it wants to retain the reputation of a legitimate email service provider.

Sending IPs: 195.54.173.175-195.54.173.178

Spam Sample:

Actual Headers:

Received: from uspmta<x>.emarsys.net (uspmta<x>.emarsys.net [195.54.173.17#])
	by <xxx> (Postfix) with ESMTP id <xxx>
	for <xxx>; Sun, 26 Apr 2015 09:##:## -0500 (CDT)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: from (10.200.##.##) by uspmta<x>.emarsys.net id <xxx> 
        for <xxx>; Sun, 26 Apr 2015 16:##:## +0200 
        (envelope-from <www5 @xpressus.emarsys.net>)
To: <xxx>
Subject: Your Daily Stories: Death Toll Hits Over 1, 900, Mount Everest Shaken +
 More News
X-Mailer: class SMTPMail
From: "Pulse.ng Live" <info @newsletter-pulse.com>
MIME-Version: 1.0
List-Id: <xxx> <pulse .ng Live>
X-EMarSys-Identify: <xxx>
X-EMarSys-Environment: <xxx>
X-Report-Abuse: Please report abuse here: abuse-report@emarsys.com
X-CSA-Complaints: whitelist-complaints@eco.de
List-Unsubscribe: <http: //newsletter.ringier.ng/u/lu.php?<xxx>>
Content-Type: multipart/alternative;
 boundary="<xxx>"
Message-ID: <xxx>@uspmta<xxx>.emarsys.net>
Date: Sun, 26 Apr 2015 16:##:## +0200

Readable Email:

From: Pulse.ng Live <info@newsletter-pulse.com>
To: <spamtrap>
Subject: Your Daily Stories: Death Toll Hits Over 1, 900, Mount Everest Shaken + More News

26 April, 2015

Modification of Male Mosquito DNA Could Halt Malaria Transmission

Oxitec non-executive director, Luke Alphey has come up with the idea of modifying the DNA
of disease-carrying male insects that seek to mate with female insects in the wild.

FULL STORY

<Removed>

© 2015 Pulse.
A Ringier Nigeria Company. All Rights Reserved. Terms under which this service is provided to you.
Read our privacy guidelines. Contact us here.

If you want to unsubscribe from our mailing list, unsubscribe here.

3 Responses to Pulse.ng: Spamming Purchased or Email Appended Lists

  1. I received an email this morning from EMarSys representative Sebastiaan de Vos about this blog. EMarSys indicates that they have terminated the user’s account and no more spam will be sent by this user through their system. That’s good.

    Unfortunately that was the only good thing about the email. Mr. de Vos expressed his anger at “each and every fauxpas of our clients” appearing on blogs or Twitter. He demanded a correction to the blog in language that normally implies a legal threat. In short, whatever Mr. de Vos intended, his email came across to me as that of a bully who expects special treatment. I despise bullies, and I despise even more entities that expect special treatment.

    I responded to his email privately this morning, I think civilly. I then waited a few hours before posting here to see if I found the email less offensive. I just reread it, and it reads as offensively now as it did before I drank my coffee this AM.

    I don’t post private emails without permission, and it is not clear that Mr. de Vos intended to give permission to have his email posted. If he wants to post it, he can do so here. (Anybody can sign up for an account on this blog and respond to the blogs, as somebody who had read the blog information would already know.)

    I really hope that Mr. de Vos does not represent the attitude and beliefs of EMarSys.

  2. Dear Ms. Jefferson,

    Why don’t you post my original Email, so people can decide for themselves?

    However, Emarsys leads a zero-tolerance policy against unwanted emails. Eventual abuse can be addressed to: abuse-report@emarsys.com. We consider it unneccesary to name and shame, before you have reported the problem to us directly.

    Best Regards,

    Sebastiaan de Vos

    • TL;DR: Sending abuse complaints is a waste of time. Making public noise sometimes helps.

      I don’t know if you’ve ever complained about spam yourself, Sebastiaan. In case you haven’t: it’s increasingly a futile exercise. Even your own report indicates as much: the RFC 2142 mandated standard address for sending in complaints does not have “-report” attached to it; you’re already making potential complainants jump through hoops by expecting them to know anything in particular about your operation before sending in. The next step is that the mail services for many operations are handled by giant providers such as Google, or in your case Microsoft,


      $ host -t mx emarsys.com
      emarsys.com mail is handled by 10 emarsys-com.mail.protection.outlook.com.

      and their spam filters, which you may not be able to control as a customer, are rarely smart enough to make an exception for “abuse@” as a receiving address; if you send in a spam complaint that contains spam, as they often would, it might get rejected as spam.

      I just tried to complain about the highest volume spamming customer of an ESP the other day; the domain name of the spammer was caught by the URL/Phone Number Filter of their email provider, who conveniently hide behind a Domains by Proxy and don’t have a website… It’s obviously not you, but somebody in a completely comparable position to you.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top