MainSleaze

Today travel aggregator YTB sent several dozen bulk emails to my spamtraps, offering a three-night stay at an unspecified location for $189. Most of the spamtraps were repurposed email addresses, but a few were pristine spamtraps that were not likely typotraps. The ESP was Silverpop, which was bought by IBM in 2014.

It is effectively impossible for a company to legitimately obtain a list that contains multiple pristine spamtraps that are not obvious typoed versions of subscriber email addresses, when the list contains no other typos or evidence of poor data quality. I am as certain as it is possible to be without a clear admission from the company that YTG purchased a list or hired an email appender.

Two other things confirm my impression that this company does not play by the accepted rules. First, the spam email does not contain any of the normal disclaimer verbiage indicating when the recipient subscribed and why they are receiving this email. In that respect it resembles a snowshoe spam more than it does a legitimate, opt-in bulk email sent by an ESP. Second, the company’s web site is non-functional unless scripting and cookies are enabled. Many web sites are less functional without these technologies, but do not simply display a blank page with no content.

Sending IPs: 74.112.71.70/31

Spam Sample:

Actual Headers:

Received: from mail2632.grandincentives.mkt3028.com (mail2632.grandincentives.mkt3028.com [74.112.71.71])
	      by <xxx> (Postfix) with ESMTP id <xxx>
	      for <xxx>; Wed, 31 Dec 2014 15:##:## +0200 (EET)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: by mail2632.grandincentives.mkt3028.com id <xxx> 
        for <xxx>; Wed, 31 Dec 2014 13:##:## +0000 
        (envelope-from <<xxx>@bounce.mkt3027.com>)
Date: Wed, 31 Dec 2014 13:##:## +0000 (GMT)
From: Olivia Greene | YTB <takethreenights@dns.ytb.com>
Reply-To: ogreene@takethreenights.com
To: <xxx>
Message-ID: <<xxx>.JavaMail.app@rbg52.atlis1>
Subject: Ends today! Get your 3-night stay for only $189
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_<xxx>"
x-mid: <xxx>
x-job: <xxx>
x-rpcampaign: <xxx>
x-orgId: <xxx>
List-Unsubscribe: <mailto:<xxx>@bounce.mkt3027.com?subject=Unsubscribe>

Readable Email:

From: Olivia Greene | YTB <takethreenights@dns.ytb.com>
To: <spamtrap>
Subject: Ends today! Get your 3-night stay for only $189

Hi <xxx>,

Today is the last day to take advantage of our 3-night hotel stay for only $189. The price will go back up to $199 tomorrow, so be sure to let me know today if you’d like take advantage of this incredible deal. Here are some of the details:

• 3-night hotel stay
• Book any time within 12 months of purchase
• Valid for 2 adults and up to 2 children

P.S.: If you haven’t gotten the free destination guide yet, be sure to download it today. It has information on all 44 destinations we currently offer.

Sincerely,

Olivia Greene
Take Three Nights
ogreene@takethreenights.com
877.458.2228
Mon – Fri 9am to 5pm ET

Unsubscribe