St1 Yrityskortti: Dear Spamtrap, Get a Business Fuel Card

St1, a fuel chain in Finland, is advertising their business fuel card services in illegal spam. They started (no later, but possibly earlier than) in October, and the only visible change is that the spamming domain names and IP addresses have changed for today’s missives.

(It was “postipalvelu.com” in October, and the complaint on Oct 10 was sent to St1 representatives in email only. No response was received. Kirjekyyhky.com was registered to an anonymous party on November 8, 2013. Pretty damn quick for getting thousands of subscribers, just over the weekend, huh? Oh, but those aren’t subscribers in the traditional affiliate marketing sense, they’re just crap harvested from business registers and the EuroAds “publisher” freely admits this.)

  • The message does not indicate the sender’s identity (Section 28, 516/2004 Act on the Protection of Privacy in Electronic Communications; Section 15, 244/2001 Foundations Act).
  • The message does not indicate the file of personal data used (Section 25, 523/1999 Personal Data Act).
  • Outdated and erroneous personal data are being processed illegally (Section 9.2, 523/1999 Personal Data Act).
  • The message was sent to natural persons’ addresses without prior consent, business position justification, or prior customer relationship, illegally (Section 26, 516/2004 Act on the Protection of Privacy in Electronic Communications).

St1 representatives indicate on the phone that they purchased an advertising campaign from EuroAds, an affiliate marketing operator. Too bad that the message itself contains no links to affiliate services of any kind so this is not immediately obvious. It does happen however that the payload is untagged this time, so it was possible to follow it to get the EuroAds related content.

Spam sample:

From asiakaspalvelu@kirjekyyhky.com Mon Nov 11 hh:mm:ss 2013
Return-Path: <asiakaspalvelu@kirjekyyhky.com>
Received: from mx1.kirjekyyhky.com (mx1.kirjekyyhky.com [37.187.52.79])
        by x (Postfix) with ESMTP id x
        for <x>; Mon, 11 Nov 2013 hh:mm:ss +0200 (EET)
Received: by mx1.kirjekyyhky.com (Postfix, from userid 33)
        id x; Mon, 11 Nov 2013 hh:mm:ss +0200 (EET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kirjekyyhky.com;
        s=mail; t=x;
        bh=x=;
        h=To:Subject:Date:From:From;
        b=x=
To: x
Subject: =?UTF-8?Q?St1_Yrityskortti_=E2=80=93_helppo_ja_edullinen_valinta_yritys
as?=  =?UTF-8?Q?iakkaalle?=
X-PHP-Originating-Script: 0:class.phpmailer.php
Date: Mon, 11 Nov 2013 hh:mm:ss +0200
From: Kirjekyyhky <asiakaspalvelu@kirjekyyhky.com>
Message-ID: <x@www.kirjekyyhky.com>
X-Priority: 3
X-Mailer: PHPMailer [version 1.73]
X-Mailer: phplist v2.10.19
X-MessageID: 7
X-ListMember: x
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
Content-Length: 870
Lines: 29

Hei

St1 Yrityskortti on kortti, jolla saat alennusta heti tankatessasi
St1- ja Shell -huoltoasemilla. St1 Yrityskortilla saat
asiakaskohtaisen alennuksen autosi tankkauksesta. Säästät siis
selvää rahaa jokaisella tankkauksella.

Saat kuukausittaisen laskuyhteenvedon, jossa näet ostotapahtumasi ja
saamasi alennukset. Laskuyhteenveto on kirjanpitokelpoinen dokumentti,
joten et tarvitse muita dokumentteja kirjanpitoasi varten - helppoa.

St1 Yrityskortilla ei ole tilinhoito- tai vuosimaksuja. Maksat vain
ostoksistasi ilman muita kuluja.

Hae St1 Yrityskortti täältä: http://www.kirjekyyhky.com/st1.php

Ystävällisin terveisin,

Kirjekyyhky.com

--

Osoitelähde: Julkiset yritysrekisterit, YTJ ja Kaupparekisteri.

Jos et enää halua vastaanottaa uutiskirjeitämme:
http://www.kirjekyyhky.com/kirje/?p=unsubscribe&uid=x

URL followup:

$ GET http://www.kirjekyyhky.com/st1.php
<html>
<head>
<title>Siirret&auml;&auml;n tarjoukseen...</title>
<meta http-equiv="refresh" content="0;url=st1-linkki.php">
</head>
<body>
<img border=0 src="http://tracking1.euroads.fi/system/showadv_img.php?sid=6&trac
k=0&cpid=1542&adid=32485&acid=935&eatrackid=84208&cptp=8&texp=1" width=1 height=
1>
<br><br><br>
<a1>Siirret&auml;&auml;n tarjoukseen...</a1>
</body>
</html>

2 Responses to St1 Yrityskortti: Dear Spamtrap, Get a Business Fuel Card

  1. As of 2015, St1 are spamming Finnish B2B directly using the resources of Salesforce Marketing Cloud, whose anti-spam policy clearly forbids the use of purchased lists.

    As of 2015-07-25, their IP at SMC is blocklisted.

    $ host mta.posti.st1.fi
    mta.posti.st1.fi has address 136.147.138.4
    $ host -t txt 4.138.147.136.bl.suomispam.net
    4.138.147.136.bl.suomispam.net descriptive text "20150725 st1.fi"
    

    As of 2017-04-11, their domain name is also blocklisted.

    $ host -t txt st1.fi.dbl.suomispam.net
    st1.fi.dbl.suomispam.net descriptive text "20170411 "
    
  2. —– Forwarded message from St1 Yrityskortti —–

    Received: from mta.posti.st1.fi (mta.posti.st1.fi [136.147.138.4])

    From: St1 Yrityskortti <no-reply@st1.fi>
    Subject: Huippuedut sinulle St1 Yrityskortilla!
    Date: Tue, 11 Apr 2017 04:01:21 -0600

    Osoitelähde: Suomen Asiakastieto Oy, Myyntioptimi. Puh. 010 270 7000.

    —– End forwarded message —–

Leave a Reply

Go back to top