MainSleaze

Many email verification and lead generation services act a lot like snowshoe spammers. They bounce around from host to host, hoping to avoid detection and suspicion caused by their unusual SMTP traffic.

accuratelistz.com -- Hosting by Limestone Networks.
BriteVerify.com / OriginData.com -- Hosting by Amazon EC2/AWS.
DataValidation.com / Synapp.io -- Hosting by DigitalOcean.
EmailHippo.com / eVerify -- Hosting by Coreix.
EmailVerify.net -- Hosting by myLoc and Hetzner.
Kickbox.io -- Hosting by TierPoint.
LeadFuze.com -- "Cold Email Lead Generation", Hosting by DigitalOcean.
mx-check.com / "Allgood Emails" / Profound Networks -- Hosting by Amazon EC2/AWS and Linode.
ReachForce.com -- Hosting by Amazon EC2/AWS and NTT America.
SalesLoft.com / jobchangealerts.com -- Hosting by Amazon EC2/AWS.

The main difference from real snowshoe spammers is the email verification services do not actually deliver any messages, just “taste” SMTP with the usual EHLO, MAIL FROM, RCPT TO… then QUIT or more rudely disconnect/hang up. No DATA section because they never intend to actually deliver a real full message!

Their not-quite-sending behavior help appenders and purchased list washers by “cleaning” their lists before passing onto the stricter ESPs, many of whom will ban customers outright for using bought, cold and dirty lists. Of course the verifiers make good money off this questionable whitewashing/spam support practice and hide behind “we’re doing a good public service helping mailers”.

Verifiers are setting up rapid cloud hosting at Amazon EC2/AWS, DigitalOcean, Linode and other major “cloud” providers where they can quickly change their sending IP address/block. Their DMARC/DKIM/SPF records always match/verify due to fast flux-style DNS hosting with short TTLs, ala botnet behavior.

The verifiers never publish their (whois-privacy protected) domain names or IP blocks but it’s fairly easy to find/guess their schemes, especially since they often hit very old/dead spam traps. They often like to use mailer-style words (SMTP, mail, MTA, delivery, etc.) in their DNS names so a casual look won’t give them away.

A few of the verifiers like DataValidation.com / Synapp.io have registered dozens of random-looking .com domain names and cycle through them regularly, again a tactic very similar to snowshoe spammers. Others like LeadFuze.com actively advertises their “Cold Email Lead Generation” systems with “50 million addresses”, which calls into question if they practice “confirmed opt-in” marketing at all.

The IP network neighborhoods the verifiers inhabit tend to have random scatter shot, unrelated customers mixed in. The verifiers don’t appear to care if one or more of their cloud providers’ IPs get blacklisted because they’ll just retry from another VM via a different block. The verifiers might “burn” some IP address reputations but who cares when Amazon EC2/AWS and DigitalOcean own so many large /16 CIDR blocks to choose from?

Update: Not the first time Amazon EC2/AWS has been called out for providing spam support hosting services.

Some recent SMTP logs:

May 30 X 554 5.7.1 <smtpout3.briteverify.com[174.129.193.225]>: X; from=<admin@origindata.com>

May 28 X 554 5.7.1 <smtpout64.briteverify.com[54.83.31.89]>: X; from=<admin@origindata.com>

May 24 X 554 5.7.1 <ams2-mx16.qualinspect.com[95.85.50.98]>: X; from=<Y7fEzL4eKAy2@qualinspect.com>

Apr 28 X 554 5.7.1 <yto1-mta05.validity-check.com[138.197.131.68]>: X; from=<5ju6LOhbVA75@validity-check.com>

Apr 18 X 554 5.7.1 <mta-wk-2.mk1.enchantilizer.com[95.85.38.165]>: X; from=<AOuL9Bc3fuqT@enchantilizer.com>