Almost a month after I reported that a salesperson at IBM was sending B2B spam to a scraped or purchased list, the same individual spammed one of those email addresses again. As with this sender’s previous spam, the email was sent from IBM’s corporate mailservers, and specifically from a Lotus Notes system apparently used by their business development team.
Below is another example of B2B spam sent by a large, legitimate company, this time by Oracle. This spam was sent to a pristine spamtrap that follows the format of normal email addresses at the company in question, but does not actually belong to the person that received the spam. Unlike the IBM B2B prospecting spam I reported a few days ago, Oracle sent this spam from its ESP, the Oracle Marketing Cloud.
NOTE [5/19/2017]: An Oracle representative notified me that the IP address that sent the spam is NOT part of the Oracle Marketing Cloud, although that IP belongs to Oracle.
This week two fellow antispam activists, one of whom has been active in the field for over 20 years, reported receiving spam from the same IBM employee about the IBM Watson platform. One of the spams was sent to the business email address of the recipient. The other was sent to a pristine spamtrap that follows the formats usually used for email addresses at the company, but has never actually been used by the intended recipient. The spams were not sent through the IBM Watson Marketing Cloud (formerly SilverPop), but from its corporate mailservers.
This week two of my favorite blogs, Mickey Chandler’s Spamtacular and Brian Krebs’ KrebsOnSecurity, have posted unusually informative and thoughtful articles about two spam-related DDoS attacks. One occured three years ago; the other within the past week.
For those who prefer to read comments and kudos AFTER reading the original articles, here are direct links:
Streamsend, the ESP service of ISP EZ Publishing, is sending bulk email to an email address that hasn’t been live since the 1990s. The email advertises EZ Publishing webhosting and development services.
The Mainsleaze Blog has moved to yet another new server, this one running CentOS 7. Everything appears to be working properly, including the pages and links that were broken on the first server. Please review the site, attempt to post comments, etc. If nothing breaks for the next 48 hours, I will declare victory and shut down the old server for good. 🙂
Thank you, everybody, for your patience!
The Mainsleaze blog moved to a new server over the weekend. A number of odd bugs ensured. A day’s research and efforts to fix the problems exposed some serious underlying bugs in the most recent version of the underlying operating system on the server. We reverted to the old server til we can get the new server properly debugged or upgrade to a less buggy OS.
Sorry for the delays! 🙂
Capital One, a large US-based bank and credit card issuer, stands out for sending by far the largest number of transactional emails containing personally identifying information (PII) to my spamtrap collection. :/ Capital One uses a number of ESPs, but its transactional emails are usually sent from Bigfoot Interactive, owned by Epsilon Interactive.
Penton Media, a marketing firm with a past history of sending opt-out bulk email (spam), is emailing bulk advertisements to the contact email address for my personal blog (tw86034@ergosphere.net). The ESP is the Oracle Marketing Cloud, which is the combination of former ESPs Eloqua and Responsys, both of which Oracle now owns.
A customer of online roleplaying/gaming web market DriveThruRPG, Wizards of the Coast, is emailing a spamtrap in my collection. A single bulk email to a repurposed spamtrap is not in itself a huge problem, but it is a sign that a list needs attention. Since a botnet spammer has also been emailing spamtraps with forged email addresses @drivethrurpg.com, I wanted to be sure that DriveThruRPG and its ESP, MailChimp’s transactional email service Mandrill, knew that a DriveThruRPG customer also has a spamtrap on its list.