Gevalia: Selling Coffee to a Spamtrap
Gevalia, a division of Kraft Foods that sells coffee and coffee equipment, is sending bulk email to an email address that was closed in 2008. Despite this, the spam that is attached below claims that this email address “recently registered with a network website to receive special online offers”. This is untrue. Either Gevalia is accepting unconfirmed web form subscriptions (a fertile source of typoed email addresses and bogus third-party subscriptions), or Gevalia purchased a list. The ESP is Yesmail, a division of Infogroup.
Sending IP: 204.92.133.121
Spam Sample:
Actual Headers:
Received: from smtp.customerwk.com (smtp.customerwk.com [204.92.133.121])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Thu, 24 Nov 2011 20:xx:xx -0600 (CST)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Content-Transfer-Encoding: 8bit
Message-ID: <xxx>
Content-Type: multipart/alternative; boundary="_----------=<xxx>"
MIME-Version: 1.0
X-Mailer: MIME::Lite <xxx>
Date: Fri, 25 Nov 2011 02:xx:xx UT
To: <xxx>
From: "Gevalia" <IG@customerwk.com>
Reply-To: IG@customerwk.com
Subject: Black Friday Starts Today! Get Your Brewer + FREE Coffee
X-Campid: <xxx>@customerwk.com
List-Unsubscribe: <mailto:unsubscribe-<xxx>@customerwk.com>
X-Pviq: <xxx>
Sender: "Gevalia" <IG@customerwk.com>
X-Eid: <xxx>
Readable Email:
From: Gevalia <IG@customerwk.com>
To: <spamtrap>
Subject: Black Friday Starts Today! Get Your Brewer + FREE Coffee
Reply-To: IG@customerwk.com
THE GEVALIA BREWER BLOWOUT SALE
We’re Inviting YOU to Shop Early and Save BIG!
Buy any select GEVALIA COFFEEMAKERS (up to a $99 value) for Just $25 and get a FREE BOX OF COFFEE!
SHOP NOW
http://ct.customerwk.com/rd/cts?<xxx>
To unsubscribe, please click here:
http://ct.customerwk.com/rd/cts?<xxx>
Gevalia, 999 North Dupont Blvd, Milford, DE 19963, United States
You recently registered with a network website to receive special online offers. To no longer receive messages, please use the link below to remove your subscription.
http://customerwk.com/webforms/unsub/index.jsp?<xxx>
Surely you must be aware of Gevalia’s reputation?
Just a bit, yes. 😉 However, Gevalia (as Tom notes) has up til now usually advertised in snowshoe spam, not via an ESP.
My opinion of Yesmail is on record here; because they sell lists and offer e-pending services, I don’t consider them a completely legitimate ESP. However, they aren’t outright snowshoe spammers. At least (most of) their IPs and their (many) domains are registered to one of their openly acknowledged business names, not cloaked in Whois or registered to phoney baloney corporate shells. Since Gevalia mailed through an ESP instead of a snowshoe spammer, and since they do have a legitimate business, I blogged about them.
Gevalia, spamming via an ESP? (Even one like Yesmail.) They’re moving up in the world. Most of the spam I see from them is snowshoe spam. That’s why gevalia.com is in the Spamhaus DBL.
Yesmail sent yet more Gevalia spam today for Cyber-Monday, from a nearby but different IP than the spam sample above.
With a great deal of mainsleaze spam, there is a problem: some of the same email is both requested and wanted by some of the recipients, and is unrequested and unwanted by others. I don’t believe that I have ever heard of any bulk email sent through Yesmail that was actually requested by its recipients, however, so system administrators might want to drop this block of IPs into their router deny tables. In my experience, you’re unlikely to block anything that any user asked for.