Topps: Three Time Loosers

That settles it. There is no intelligent life left at Topps. A month after their first mention on the MainSleaze blog and weeks after an SBL listing for their spam, they are *still* spamming. Topps is spamming from its own IPs. If they’d been using an ESP, after the SBL listing the mailings would have stopped at least until they could clean their list and convince Spamhaus to give them another chance.

Since Topps appears to be using a single IP to send its spam mailings, I recommend that users block that IP locally. In addition, you might want to drop the domains and into your filters.

Sending IP:

Spam Sample:

Actual Headers:

Received: from ( [])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu, 24 Nov 2011 03:xx:xx -0600 (CST)
Received: from <xxx> ([192.168.xx.xx])
        by (8.13.8/8.12.8) with ESMTP id <xxx>
        for <xxx>; Thu, 24 Nov 2011 03:xx:xx -0500
Received: from mail pickup service by <xxx> with Microsoft SMTPSVC;
         Thu, 24 Nov 2011 00:xx:xx -0500
Thread-Topic: Black Friday Weekend Sale!
thread-index: <xxx>
From: <>
To: <xxx>
Subject: Black Friday Weekend Sale!
Date: Wed, 23 Nov 2011 00:xx:xx -0500
Message-ID: <<xxx>>
MIME-Version: 1.0
Content-Type: multipart/alternative;
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.<xxx>
X-OriginalArrivalTime: <xxx>

Readable Email:

From: <>
To: <spamtrap>
Subject: Black Friday Weekend Sale!

*20-30% Discount excludes e-Gift cards, Custom Trading cards and Black Friday Weekend Daily Deals.

1 <>
Follow us on Twitter
2 <>

(c)2011 The Topps Company, Inc. All rights reserved.
One Whitehall St, New York NY 10004-2109. Tel: 212.376.0300

You are subscribed to our mailing list as <xxx>. If you no longer wish to receive this Topps email, please click here
<<xxx>> to unsubscribe.

2 Responses to Topps: Three Time Loosers

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top