MainSleaze

ESP spam seen in spamtraps, September 2017

It’s Sunday evening in The Westin Harbour as I write this, hurrying to get it out to everybody participating in the conference before we start tomorrow.

The percentage of ESP sent mail vs all mail seen in the spamtraps was 2.2%, which was up 31% from August. The amount of all mail was up 19%.

DoctorSender kept pumping the Scandinavian spam throughout the month, only stopping on Sep 29. I was contacted by them about a week ago and it was revealed that the offending customer was Allan Stolc (see December 2015 blog). It took them a while to come to the decision that all his sending must be stopped, but it did happen eventually.

mySMTP, my friends from Denmark, are back on in the top 30. The relative badness figure presented for them is for all technically separate customers (separate domain names), but since many of them are snowshoers (for example the top subject line, which surprisingly enough is Scandinavian affiliate spam touting fake rewards without authorization from the parties in whose name things supposedly are happening, was being sent by 12 separate domain names), it’s more likely that they are right there with DoctorSender, with the exception that in the mySMTP case, pumping this crap out is deliberate and has been going on forever with the full knowledge and consent of the CEO, and the entire operation is listed by Suomispam DNSBL ever since over a year ago.

The month brought some interesting news on the Finnish spam front, with the pro-spam ESP Emaileri being bought out by the B2B spam list vendor Suomen Asiakastieto plc. Looking forward to a lot more B2B spam from this marriage made in Hell, congratulating Toni on the successful exit, of course, and warning Jukka Ruuska, CEO of the buyer, that they just might have stuck their paws in “it”.

Bubbling under this month: Mapp Digital (just short of 1.8%), Bronto (1.7%), Sailthru (1.5%).

Here’s the “relative badness” graph.

Average amount of messages per separate customer of ESP, September 2017

Finally, the “top spamming customers” table. I’m leaving out the “Scandinavian affiliate spammers”; it could be one or many operations, and it’s pointless since it is snowshoe spam that has no business being on an ESP anywhere.