May
01
Cellectis SA: Still spamming scientists
Cellectis SA, an old acquaintance on this site, continues to spam scientists, which is not altogether very surprising given EmailVision’s rather lackluster response the last time around. We hear there’s a new guy in town (manning abuse@, that is), so let’s see.
Spamming IP: 81.92.123.184 (yet another new IP)
Spam headers:
Return-Path: <bioresearch-ealert@bioresearch.cellectis.com> Received: from mercure-oneifo.ccemails.net (mercure-oneifo.ccemails.net [81.92.123.184]) by x (8.14.4/8.14.4) with ESMTP id x for <x>; Tue, 24 Apr 2012 15:xx:xx +0300 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=emv; d=bioresearch.cellectis.com; h=Date:From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type; i=bioresearch-ealert@bioresearch.cellectis.com; bh=ATgiSRPdRsv/Zw2h+FR0gYvxdtc=; b=VaBypluUxSAUIDYXprVhXdiu1tH2koa6pwcWq4XxdonCET8SArvHoglyt4DVhai//OGNbcBF4dib nUoa3sFcxw== Received: by mercure-oneifo.ccemails.net id hiq9cg0hubc4 for <x>; Tue, 24 Apr 2012 13:xx:xx +0200 (envelope-from <bioresearch-ealert@bioresearch.cellectis.com>) Date: Tue, 24 Apr 2012 14:xx:xx +0200 (CEST) From: "Luc Selig, Ph.D." <bioresearch-ealert@bioresearch.cellectis.com> Reply-To: Luc Selig <roadshow2012@cellectis-bioresearch.com> To: Dr X <x> Message-ID: <2.1.5.x.x.x@bioresearch.cellectis.com> Subject: Learn how to edit any gene, at any position, in any genome: come to the no limit, just talent roadshow 2012 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=x X-EMV-Platform: cce.campaigncommander.com$ X-EMV-CampagneId: x$ X-EMV-MemberId: x$
Spam contents: Meaningless, the same stuff as before.
This account has been suspended as a result of your blog posting – pending a compliance investigation
Thanks. It would be interesting to hear what you find, if you’re at liberty to disclose.
Hey, Andrew! It is good to see you posting here.
I have been a bit too busy to blog for the last few months; babies have the habit of absorbing all available time plus 20%. Emailvision is slowly becoming less present in our spamtraps. At this rate, soon we will have to rely upon other ESPs to keep us supplied with mainsleaze spam to list. 😉
I am not in a position to discuss the ongoing attempts to investigate and resolve the issues with the client. At this stage they remain suspended but in dialogue.
Thanks for the acknowledgement Tom, we are trying.
Andrew, I can understand needing to keep quiet while matters are worked out. Once a resolution is reached, however, could you post about it? Part of the purpose of the blog is to show the entire process of abuse resolution when a legitimate company is involved.
That process doesn’t much resemble what occurs (or should occur) when a 419 or botnet spammer infects a customer computer or compromises a customer account. In addition, many of the warnings that the antispam community provides to the public are not relevant. Not all people who read this blog are involved in the email business; some are end users who want to learn how to deal with their own mainsleaze spam problems.
I’d like to show them the process instead of just telling them. But I can’t do that unless those of you at ESPs post your part too. So, please? 🙂
I will certainly try and engage on the blog as much as possible.
As it stands we are finding it hard to resolve the issue for this client and have any level of confidence ina future email being sent without hitting spamtraps such as yours.
That puts us all in a difficult position.. and we are trying to create a workable action plan.
If there is any background to the kind of spamtraps hit that would be useful.
The background is that the e-mail addresses of scientific authors are a free-for-all on PubMed and that businesses such as your customer figure that it’s OK to spam scientists just because they published something.
I don’t think that this sender is hitting my spamtraps, Andrew. I’ve just started a grep through the May spam corpus to be sure, but do not expect to find anything. My spamtrap collection includes some good European spamtraps, but is unfortunately heavily focused on non-regional TLDs and the Americas. So I sometimes miss spam sent solely to European recipients.
I’ll let you know if I find anything, however.
It’s not geographic. I don’t know how likely it is that your spamtraps contain any addresses that (used to) belong to scientific authors; I have connections in the field and several ancient spamtraps that still get this sort of spam despite having been dead for a decade…
I wrote and edited some scientific and technical papers myself, although mostly ten to twenty years ago. I have some spamtraps that were active email addresses of my own at the time and that still receive conference invitations and other “academic spam”. Celletis SA doesn’t seem to be hitting any of those traps.
I wouldn’t take that as proof that something is odd about your reports, however, although I might wonder if spam on subjects of more general interest weren’t hitting at least a few of my traps. 🙂 That’s why I posted the disclaimer.