Tractor Supply Company: Selling Farm Supplies to a Spamtrap
Tractor Supply Company, a Tennessee-based company that sells farming supplies both online and in stores, just sent an advertisement email for the first time to an email address that, if it ever existed, was closed in 2004. The ESP is Cheetahmail, a subsidiary of Experian.
The company that previously owned the domain for this email address closed in 2004. That company used a particular pattern for its employee email addresses that this email address does not match. This email address appears to be a normal botnet “guess” type address. Other email sent to it has so far consisted of 419 advance fee frauds, some phishes, and a great deal of botnet spam of all sorts. I rarely see snowshoe spam to this email address, and never before have seen email from a legitimate company or via an ESP. My guess is that this email address landed on this list because of an unconfirmed typo, or a purchased list.
I was unable to provide much of a message body because the message consisted almost entirely of remotely-loaded images, all of them tagged to the spamtrap. I don’t want to risk “confirming” the address by retrieving an image, which could complicate efforts to clean up this customer’s list.
Sending IP: 63.236.76.100
Spam Sample:
Actual Headers:
Received: from mta905.e.tractorsupply.com (mta905.e.tractorsupply.com [63.211.90.37])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Tue, 29 May 2012 16:xx:xx -0000 (CDT)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Date: Tue, 29 May 2012 16:xx:xx -0000
Message-ID: <<xxx>@mta905.e.tractorsupply.com>
List-Unsubscribe: <mailto:rm-<xxx>@e.tractorsupply.com>
From: "Tractor Supply Company" <TractorSupplyCompany@e.tractorsupply.com>
To: <xxx>
Subject: Get What You Need For Summer At Tractor Supply Co.
MIME-Version: 1.0
Reply-To: "Tractor Supply Company" <support-<xxx>@e.tractorsupply.com>
Content-type: multipart/alternative; boundary="<xxx>"
Readable Email:
From: Tractor Supply Company <TractorSupplyCompany@e.tractorsupply.com>
To: <spamtrap>
Subject: Get What You Need For Summer At Tractor Supply Co.
Reply-To: Tractor Supply Company <support-<xxx>@e.tractorsupply.com>
URL: http://e.tractorsupply.com/a/<xxx>
ALT Text: Champion Power Equipment™ 1400W Portable Generator, CARB Compliant
<removed>
Sent by: Tractor Supply Company, 200 Powell Place, Brentwood, TN, 37027