sahkopostitus.com (WebSiteRace Oy): Finland’s latest spam for hire
We’ve recently seen spam advertising the spamming and spam list sale services of sahkopostitus.com, apparently operated by WebSiteRace Oy. It’s funny because they specifically claim knowledge of (but not adherence to, I suppose) of the legislation relevant to the issue at hand.
The message is illegal to begin with because it fails to indicate the sending business in any way, which is a requirement arising from Section 15 of the Business Information Act (yritys- ja yhteisötietolaki 244/2001). It also fails to indicate the address list used in a manner compatible with Section 25 of the Personal Data Act (henkilötietolaki 523/1999), there is no Section 10 required Description of Personal Data File anywhere to be seen, and they themselves indicate the list has been harvested off the Internet, which violates Sections 5 and 6, and contains outdated and erroneous personal data, which violates Section 9. And of course the spam to natural persons is illegal as per Section 200 of the Information Society Code (tietoyhteiskuntakaari 917/2014), which is so recent that there is no English translation available yet. The relevant section is identical to Section 26 of the preceding Act on the Protection of Privacy in Electronic Communications (sähköisen viestinnän tietosuojalaki 516/2004) however.
A look at the domain registration (attached below) shows that the contestant is WebSiteRace Oy (biz reg, responsible people). Their contact details web page indicate the business ID, but not their name, which again violates Section 15 of 244/2001, as Sähköpostitus.com is neither their primary name nor a registered d/b/a of theirs.
Spamming IP: At least 162.248.4.30 and 5.135.145.209
Spam headers: Pointless
Related domain names:
- sahkopostitus.com
- sahkopostitus.co.uk
- sähköpostitus.com (xn--shkpostitus-l8a0v.com)
- sähköpostimarkkinointi.com (xn--shkpostimarkkinointi-bzb21b.com)
- suomenparhaatverkkosivut.com
The latter is interesting because it leads to a clear connection to their earlier spamming and cart00neying behaviour.
Message payload:
From: Satu H <satuh@sahkopostitus.com> Subject: Tarvitsetko uusia asiakkaita? **On olemassa ylivertainen tapa tavoittaa kohderyhmäsi.** Hyvä yrittäjä/yrityksen päättäjä, **tarvitsetko uusia asiakkaita?** Kokeile tehokasta sähköpostikampanjaamme. Tarjoamme tuotteitasi ja palveluitasi sähköpostitse sopivalle kohderyhmälle. Teemme tehokkaan täsmäpostituksen tyylikkäällä ja iskevällä kirjepohjalla. Saat yrityksellesi sopivilla kriteereillä valikoidun osoite- ja asiakasrekisterin kampanjan jälkeen omaksesi. Postituksen jälkeen toimitamme raportit, joista näet, ketkä ovat avanneet ja lukeneet tarjouksesi, ja voit halutessasi tehdä heille jälkimarkkinointia vaikka puhelimitse. **** **Nyt kampanjatarjouksemme:** **3000-5000 kpl 680 € + alv.** **10 000 kpl 1080 € + alv.** **Vuosisopimukset esim.** **10 000 kpl/kk alk. 800 € + alv/kk.** Ota yhteyttä yhteydenottolomakkeemme (http://37.187.87.41/postitus/lt.php?c=x&m=x&nl=x&s=x&lid=x&l=-http--www.sahkopostitus.com/yhteydenotto/) **kautta tai sähköpostitse** Satu Hietala Asiakaspäällikkö Sahkopostitus.com SatuH@sahkopostitus.com www.sahkopostitus.com (http://37.187.87.41/postitus/lt.php?c=x&m=x&nl=x&s=x&lid=x&l=-http--www.sahkopostitus.com/) ______________________________________________________________________ Myymme myös laadukkaita, puhdistettuja ja päivitettyjä osoiterekistereitä alk. 290 €. Kysy tarjousta! Sahkopostitus.com (http://37.187.87.41/postitus/lt.php?c=x&m=x&nl=x&s=x&lid=x&l=-http--www.sahkopostitus.com/) on sähköiseen suoramarkkinointiin keskittynyt yritys. Olemme toteuttaneet kuuden vuoden aikana satoja sähköpostituskampanjoita, ja tunnemme sähköisen suoramarkkinoinnin ja joukkopostituksen lainsäädännön ja ohjeistuksen. **Kokeile kuinka monta uutta asiakasta sähköpostikampanjamme tuo yrityksellesi!** ______________________________________________________________________ Rekisterilähde: Sähköpostitus.com ja Internetin julkiset sivustot Tämän markkinointikampanjan hoitaa: www.sahkopostitus.com (http://37.187.87.41/postitus/lt.php?c=x&m=x&nl=x&s=x&lid=x&l=-http--www.sahkopostitus.com/) Jos et halua meiltä enää postia, klikkaa tästä. (http://37.187.87.41/postitus/proc.php?nl=x&c=x&m=x&s=x&act=unsub) ______________________________________________________________________
Domain registration:
$ whois sahkopostitus.com [Querying whois.verisign-grs.com] [Redirected to whois.joker.com] [Querying whois.joker.com] [whois.joker.com] Domain Name: sahkopostitus.com Registry Domain ID: 1656578204_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.joker.com Registrar URL: http://joker.com/ Updated Date: 2014-04-24T05:45:47Z Creation Date: 2011-05-17T12:23:11Z Registrar Registration Expiration Date: 2015-05-17T12:23:11Z Registrar: CSL Computer Service Langenbach GmbH d/b/a joker.com Registrar IANA ID: 113 Registrar Abuse Contact Email: abuse@joker.com Registrar Abuse Contact Phone: +49.21186767447 Domain Status: clientTransferProhibited Registry Registrant ID: Registrant Name: Soile Haanpaa Registrant Organization: WebSiteRace Oy Registrant Street: Palontie 795 Registrant City: Kyroskoski Registrant State/Province: -- Registrant Postal Code: 39200 Registrant Country: FI Registrant Phone: +358.45 Registrant Email: kilpailu@suomenparhaatverkkosivut.com
Spamming from vpscheap.net IPs now, using a new domain name.
[Querying whois.verisign-grs.com]
[Redirected to whois.joker.com]
[Querying whois.joker.com]
[whois.joker.com]
Domain Name: eposteljooni.com
Registry Domain ID: 1982578576_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.joker.com
Registrar URL: http://joker.com/
Updated Date: 2015-11-20T13:46:39Z
Creation Date: 2015-11-20T13:46:39Z
Registrar Registration Expiration Date: 2016-11-20T13:46:39Z
Registrar: CSL Computer Service Langenbach GmbH d/b/a joker.com
Registrar IANA ID: 113
Registrar Abuse Contact Email: abuse@joker.com
Registrar Abuse Contact Phone: +49.21186767447
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Soile Haanpaa
Registrant Street: Palontie 795
Registrant City: Kyroskoski
Registrant State/Province: Hameenkyro
Registrant Postal Code: 39200
Registrant Country: FI
Registrant Phone: +358.451350207
Registrant Email: tarja.helander@tilihelander.fi
Registry Admin ID:
Admin Name: Easyline Host
Admin Organization: e-Sollertis Oy
Admin Street: Niiralankatu 16
Admin City: Kuopio
Admin Postal Code: 70600
Admin Country: FI
Admin Phone: +358.3580207417997
Admin Fax: +1.358207431112
Admin Email: hostmaster@easylinehost.net
Registry Tech ID:
Tech Name: Easyline Host
Tech Organization: e-Sollertis Oy
Tech Street: Niiralankatu 16
Tech City: Kuopio
Tech Postal Code: 70600
Tech Country: FI
Tech Phone: +358.3580207417997
Tech Fax: +1.358207431112
Tech Email: hostmaster@easylinehost.net
Name Server: ns2.easylinehost.net
Name Server: ns1.easylinehost.net
Name Server: ns3.easylinehost.net
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2015-12-29T20:58:36Z < <<
The fine people at Websiterace Oy have managed to cause a(n informational, but nonetheless) Spamhaus listing for the consumer outbounds of DNA Oy. It could well be a non-informational listing that actually blocked email – and if I was Spamhaus, it would be one. DNA Oy, whose consumer outbounds have been constantly listed by Suomispam DNSBL since several months ago already, need to stop allowing unauthenticated SMTP from prepaids, which is what several customers have been doing for a while already and which may very well be what Websiterace Oy is doing.
Next step: nt-mediaoy.net, registered on January 29, and spamming through Mailjet on February 15-16, during MAAWG week when I am sitting next to Mailjet guys. You don’t have much luck, and it’s only going to get worse.
For historical interest, a conversation shared on Pastebin by somebody else where the spammers were so annoyed that their spamming was called out: https://pastebin.com/7aGZdS85