MainSleaze

During October, I’ve been seeing spam to my traps that has to do with quitting smoking with the help of electronic nicotine dispensers. It’s so far off the scale it’s not really mainsleaze, but there’s a few things here that need being published.

All the spam is coming from this host:

Received: from limited-time-offers.net
        (50.22.124.152-static.reverse.softlayer.com [50.22.124.152])
        by x (Postfix) with ESMTP id x

to addresses that are nowhere near legitimate. URLs advertised include, but may not be limited to, limited-time-offers.net, parveketupakka.com, parveketupakka.info, loppu.info (all obfuscated registrations with protecteddomainservices.com), partnerlists.ddns.net. All hosted at 50.22.124.152. Leading to lopetan.fi, hosted at 81.22.253.170. domain registered to a front, IPR Holding Europe Oy. The same IP is home to reseller.nicopoint.fi, and nicopoint.fi is registered to… the same front, IPR Holding Europe Oy. Nicopoint.com is registered through Domains by Proxy and hosted at Go Daddy’s parking lot.

There’s quite a lot of online discussion regarding the apparently fraudulent nature of the operation. What a surprise. They are very careful not to indicate who the operation is, which is something legit businesses would never skip doing. They collect personal data, including social security IDs, and don’t even try to comply with the requirements of the Personal Data Act.

Googling for Nicopoint brings up other resources, such as a domain reselling Nicopoint services. Looking up the dom reg details brings up a surprise: mostly obfuscated, but with the name of a person whom I sort of know from a previous spam context about a year ago, sort of connected to my bestest pal, and because we have mutual acquaintances. I entered into a discussion with him and the responses started initially quite decent, but soon degraded into:

• My idea of what is spam is wrong anyway, and he happens to know that pissed off Finnish spammers forge-subscribe my well-known addresses to badly managed mailing lists (well, yes, I’ve published the fact, haven’t I…)
• I’m hurting my correspondent’s business by letting his operators know that I’ve seen this kind of spam and that the page they host looks surprisingly identical (the copy word for word, identical HTML layout and fonts, etc) so maybe they should keep an eye out
• I ought to keep in mind that my correspondent knows with 100% certainty that some of the spammers in Finland are tightly connected with “gangs with vests” (i.e. the famous motorbike ones)
• I ought to take note of what happened to Andreas Oscarsson
• Why am I attacking the small fry anyway and not the big ones like Fonecta? (Aren’t I?)
• If my complaints should ever lead to his ISP terminating service to his super-mega-revenue sites, he wouldn’t mind a few years on probation and a few thousand € in fines in exchange for the pleasure of beating me up
• He knows everybody in the business here, so maybe I should just quit sending spam complaints altogether so as not to offend him, his operators, his relatives, his business associates, his pals or anybody at all

Spam excuse:

Sait tämän tarjouskirjeen, koska olet osallistunut meidän tai yhteistyökumppaniemme online kilpailuihin tai kyselyihin. Voit koska tahansa perua tarjouskirjeen klikkaamalla peruutuslinkkiä.

(Translation: You received this offer because you’ve participated in our online competitions or surveys or those of our partners. You may opt out at any time by clicking on the link.)