MainSleaze

That settles it. There is no intelligent life left at Topps. A month after their first mention on the MainSleaze blog and weeks after an SBL listing for their spam, they are *still* spamming. Topps is spamming from its own IPs. If they’d been using an ESP, after the SBL listing the mailings would have stopped at least until they could clean their list and convince Spamhaus to give them another chance.

Since Topps appears to be using a single IP to send its spam mailings, I recommend that users block that IP locally. In addition, you might want to drop the domains etopps.com and shoptopps.com into your filters.

Sending IP: 68.170.132.142

Spam Sample:

Actual Headers:

Received: from Mail02.int.etopps.com (mail02.etopps.com [68.170.132.142])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu, 24 Nov 2011 03:xx:xx -0600 (CST)
Received: from <xxx>.toppscolo.com ([192.168.xx.xx])
        by Mail02.int.etopps.com (8.13.8/8.12.8) with ESMTP id <xxx>
        for <xxx>; Thu, 24 Nov 2011 03:xx:xx -0500
Received: from mail pickup service by <xxx>.toppscolo.com with Microsoft SMTPSVC;
         Thu, 24 Nov 2011 00:xx:xx -0500
Thread-Topic: ShopTopps.com Black Friday Weekend Sale!
thread-index: <xxx>
From: <announcements@etopps.com>
To: <xxx>
Subject: ShopTopps.com Black Friday Weekend Sale!
Date: Wed, 23 Nov 2011 00:xx:xx -0500
Message-ID: <<xxx>@toppscolo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_<xxx>"
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.<xxx>
X-OriginalArrivalTime: <xxx>

Readable Email:

From: <announcements@etopps.com>
To: <spamtrap>
Subject: ShopTopps.com Black Friday Weekend Sale!

<http://www.toppsonlinestore.com/servlet/StoreFront>
<http://www.toppsonlinestore.com/servlet/StoreFront>
*20-30% Discount excludes e-Gift cards, Custom Trading cards and Black Friday Weekend Daily Deals.

1 <http://twitter.com/shoptopps>
Follow us on Twitter
2 <http://www.toppsonlinestore.com/>
www.ShopTopps.com

(c)2011 The Topps Company, Inc. All rights reserved.
One Whitehall St, New York NY 10004-2109. Tel: 212.376.0300

You are subscribed to our mailing list as <xxx>. If you no longer wish to receive this Topps email, please click here
<http://www.etopps.com/Marketing/unsubscribe.asp?Email=<xxx>> to unsubscribe.