HansaLeads: yet another new Finnish B2B spammer (NOT RESOLVED!)
HansaLeads Oy is using Rackspace’s Mailgun arm to send out Finnish B2B spam suggesting that recipients purchase B2B spamming services from them. That’s so ’90’s.
- Domain names: hansaleads.fi, hlmail.fi, hlonline.fi
- Biz reg data
- Responsible people
- Website (only in Finnish)
- Folks on LinkedIn:
- Christian Owen Gates, CEO, Member of the Board,
- Eetu Klingberg, Production Director, Vice Member of the Board,
- Timo Tontti, Director of Sales
The spam message fails the Section 25 (Personal Data Act) test: there is nothing about the address file that they used to send out the spam or its data controller. The data file fails the Section 9 test, of course, as outdated and erroneous personal information are involved, which is hardly surprising given the provenance (it is Finnish Biz Info System sourced data in one way or the other). That also means the spam is illegal according to Section 200 of the Information Society Code (earlier, Section 26 of the Act on the Protection of Privacy in Electronic Communications), because you can’t legally spam natural people here. They should also have mentioned their VAT ID in the spam, which means it fails the Section 15 (Business Information Act) test.
Do you want your business to collaborate with these people? I didn’t think so.
Mailgun have terminated HansaLeads Oy and so this matter has been marked “resolved.”
hansaleads.hlo.fi spamming from Mailgun today (Jul 19, 2016), so removed the “RESOLVED” label from the post. Fresh domain registered only a month ago.
[whois.ficora.fi]
domain: hlo.fi
descr: HansaLeads Oy
descr: 26318957
address: Hansaleads Oy
address: Vattuniemenkatu 21
address: 00210
address: Helsinki
phone: +358-468102202
status: Granted
created: 13.6.2016
modified: 16.6.2016
expires: 13.6.2017
nserver: dns19.ovh.net [Ok]
nserver: ns19.ovh.net [Ok]
dnssec: no
Mailgun termed them again. The matter can’t be marked resolved because as long as Hansaleads are in this business… It is resolved for Mailgun, for now, and they’ve found a new home with a favourite of other Finnish spammers.
A most interesting trolling phone call was received this morning from 0400 357741, which is the number of Timo Tontti. The call has been recorded and can be posted online if Mr Tontti so wishes.
Not to be deterred by terminations, HansaLeads registered yet another new domain name last week
Domain Name: hll1.net
Registry Domain ID: 2052429706_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2016-08-15T10:08:24.0Z
Creation Date: 2016-08-15T10:06:11.0Z
Registrar Registration Expiration Date: 2017-08-15T10:06:11.0Z
Registrar: OVH, SAS
Registrar IANA ID: 433
Registrar Abuse Contact Email: abuse@ovh.net
Registrar Abuse Contact Phone: +33.972101007
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Registry Registrant ID:
Registrant Name: HansaLeads Oy
and promptly signed up with Mailgun again, having in the meantime perhaps suffered yet another termination in the hands of the Greeks in Britain, and spammed again.
[whois.ovh.com]
Domain Name: hlo1.net
Registry Domain ID: 2055827897_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2016-08-29T04:56:22.0Z
Creation Date: 2016-08-29T04:53:11.0Z
–> Spam from them, from Mailgun, just in.
[whois.ovh.com]
Domain Name: fi12.net
Registry Domain ID: 2065188081_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2016-10-11T07:12:30.0Z
Creation Date: 2016-10-11T07:09:10.0Z
Registrar Registration Expiration Date: 2017-10-11T07:09:10.0Z
Registrar: OVH, SAS
Registrar IANA ID: 433
Registrar Abuse Contact Email: abuse@ovh.net
Registrar Abuse Contact Phone: +33.972101007
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProh
ibited
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibit
ed
Registry Registrant ID:
Registrant Name: HansaLeads Oy
Fresh spam just in. From Mailgun, again.
This is the Bulgarian ISP Hot Group Ltd, obtaining services from Hetzner.
[whois.ovh.com]
Domain Name: hle1.net
Registry Domain ID: 2059073619_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.ovh.com
Registrar URL: http://www.ovh.com
Updated Date: 2016-11-02T15:09:09.0Z
Creation Date: 2016-09-13T05:50:12.0Z
Registrar Registration Expiration Date: 2017-09-13T05:50:12.0Z
Registrar: OVH, SAS
Registrar IANA ID: 433
Registrar Abuse Contact Email: abuse@ovh.net
Registrar Abuse Contact Phone: +33.972101007
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Registry Admin ID:
Admin Name: HansaLeads Oy
All on Hetzner, of course.
Two DigitalOcean VPSes, 37.139.31.50 and 95.85.58.219, are rented out to Nevi Koeva, a Bulgarian entity that provides services to HansaLeads.
But it looks like they felt the need to branch out, because
outi dot piiparinen at elkraft dot livewas spamming the usual HansaLeads content from Moosend yesterday. Note the past tense; the UK/Greek ESP Moosend is a MAAWG member.https://tietopalvelu.ytj.fi/yritystiedot.aspx?yavain=2668827&tarkiste=EC406D7C6434A81AD4050071FC77DBE294839145 – http://www.yritystele.fi/yrityksen-tiedot/sender-suomi-oy/taloustiedot/1363354 – HansaLeads have
registered a new companypurchased a pre-created company and renamed it Sender Suomi Oy, on 25 Aug 2017. The new company is “untainted” by any association to the previous two, but it quacks like a duck and walks like a duck.
https://tietopalvelu.ytj.fi/yritystieto.aspx?YRTI=YHT3&yavain=2668827&tietolahde=0&tarkiste=EC406D7C6434A81AD4050071FC77DBE294839145 Heh.
https://tietopalvelu.ytj.fi/yritystieto.aspx?YRTI=OSO2&yavain=2668827&tietolahde=0&tarkiste=EC406D7C6434A81AD4050071FC77DBE294839145 Heh heh.