AutoMarke: Automotive Accessories for the Fashionable Spamtrap
AutoMarke, a web-based retailer of automotive accessories for Russian customers, sent an advertising email to a spamtrap that, if it ever existed (which is doubtful), was closed in 2002. As best I know, this spamtrap has never heard from AutoMarke before. The ESP is Sendgrid, whose authorized use policy explicitly requires that bulk email sent through their service be opt-in only.
Although the senders of this spam are Russian and therefore not under the jurisdiction of either American or European Union anti-spam laws, Sendgrid is an American company. The email that it sends must (as I understand the law) meet the extremely lax criteria of the rightly named U.S. CAN-SPAM law, which requires that bulk email contain a postal address and an opt-out web link or other opt-out instructions. This spam lacked either of these things. The spam was also sent to an MX server in the European Union, which requires an opt-out link and also has much stricter data privacy laws and generally requires that email sent to personal email addresses be opt-in.
Since Sendgrid is a good ESP that does not tolerate spam, I expect that they will explain these facts to their customer. 🙂 However, many readers of this blog are not necessarily familiar with the laws regarding bulk email in various parts of the world, so I thought that I would mention them here.
Sending IP: 50.31.52.82
Spam Sample:
Actual Headers:
Received: from o1.email.automarke.ru (o1.email.automarke.ru [50.31.52.82])
by <xxx> (Postfix) with SMTP id <xxx>
for <xxx>; Sun, 3 Jun 2012 16:xx:xx +0000 (UT)
DKIM-Signature: <xxx>
Received: by 10.41.xx.xx with SMTP id <xxx>
Sun, 03 Jun 2012 16:xx:xx +0000 (UTC)
Received: from 127.0.0.1 (unknown [mi13])
by mi13.sendgrid.net (SG) with ESMTP id <xxx>
for <xxx>; Sun, 03 Jun 2012 11:xx:xx -0500 (CST)
Content-Type: multipart/alternative;
boundary="<xxx>"
MIME-Version: 1.0
From: Avto Marke <info@avtomarke.ru>
To: <xxx>
Reply-To: info@avtomarke.ru
Subject: =?UTF-8?B?0KLQvtCy0LDRgNGLINC00LvRjyDQsA==?=
=?UTF-8?B?0LLRgtC+0LvRjtCx0LjRgtC10Ls=?=
=?UTF-8?B?0LXQuQ==?=
Message-ID: <xxx>
Date: Sun, 03 Jun 2012 16:xx:xx +0000 (UTC)
X-Sendgrid-EID: <xxx>
X-Sendgrid-ID: <xxx>
Readable Email:
From: Avto Marke <info@avtomarke.ru>
To: <spamtrap>
Subject: Товары для автолюбителей
Reply-To: info@avtomarke.ru
Товары семи известнейших немецких, японских и итальянских автомобильных марок!
http://www.avtomarke.ru
Одежда, аксессуары и сувенирная продукция для автолюбителей из официальных коллекций мировых брендов – всё это только на:
http://www.avtomarke.ru
BMW, Ferrari, Porsche, Toyota, Subarau, Mitsubishi, Mercedes-Benz.
Доставка по всем регионы РФ!
English Translation:
From: Auto Market <info@avtomarke.ru>
To: <spamtrap>
Subject: Products for motorists
Reply-To: info@avtomarke.ru
Supplies for seven famous German, Japanese, and Italian brands of automobiles!
http://www.avtomarke.ru
Clothing, accessories and souvenirs for motorists from the official collections of international brands – all just arrived:
http://www.avtomarke.ru
BMW, Ferrari, Porsche, Toyota, Subarau, Mitsubishi, Mercedes-Benz.
Shipping to all regions of the Russian Federation!
This time you scooped us, and some new kid on the block scooped me. 🙂 But late is better than never:
SBL141437: Dedicated Sendgrid IP for Automarke.ru
SBL141438: IP for domain A record
The spammed domains were both registered less than a month ago. The sender might not be a legitimate company, although this is Russia so the usual signs of legitimacy could be missing and the company still be real.
Hello,
Ryan Harris with SendGrid here. We have suspended this account. We are currently investigating their sending practices. Though due to seeing them on Spamhaus this morning as well, and the number of spam traps they have hit, I have no intention of letting them back on our system.
I appreciate the article and notification. Terribly sorry we were the ESP sending their unsolicited mail.
Ryan Harris
Lead Abuse Engineer
After investigating further, I grew less sure that AutoMarke was a legitimate company. The domains were registered recently, and the stuff that the site is selling is the sort of thing that is commonly the target of copyright thieves. I wouldn’t be at all surprised if their products were “replicas” in the same sense as ripoff “Rolex” watches and the like.
Good to see Sendgrid is on top of it. 🙂