Disney Destinations: The Happiest Spam on Earth?
Disney Destinations, the travel business of media and entertainment empire Disney Corporation, sent an advertising email to a long-closed email address today. This spamtrap hasn’t heard from Disney before, at least not since it became a spamtrap. The ESP is ExactTarget.
Apparently they didn’t just hit my spamtraps; there’s an SBL listing for the same spam, although at a different IP. Hat tip to @InterestingSBLs for the Subject snark, and for letting me know that I got scooped. 😉
Sending IP: 68.232.207.32
Spam Sample:
Actual Headers:
Received: from mta.email.disneycruiseline.com (mta.email.disneycruiseline.com [68.232.207.32])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Wed, 7 Mar 2012 14:xx:xx -0600 (CST)
Received: by mta.email.disneycruiseline.com (PowerMTA(TM) v3.5r16) id <xxx>
for <xxx>; Wed, 7 Mar 2012 14:xx:xx -0600
(envelope-from <bounce-<xxx>@bounce.emails.disneydestinations.com>)
From: "Disney Destinations" <disneydestinations@email.disneydestinations.com>
To: <xxx>
Subject: FREE Disney Parks Vacation Planning DVD!
Date: Wed, 07 Mar 2012 14:xx:xx -0600
List-Unsubscribe: <mailto:leave-<xxx>@leave.emails.disneydestinations.com>
MIME-Version: 1.0
Reply-To: "Disney Destinations" <reply-<xxx>@emails.disneydestinations.com>
x-job: <xxx>
Message-ID: <xxx>
Content-Type: multipart/alternative;
boundary="<xxx>"
Readable Email:
From: Disney Destinations <disneydestinations@email.disneydestinations.com>
To: <spamtrap>
Subject: FREE Disney Parks Vacation Planning DVD!
Reply-To: Disney Destinations <reply-<xxx>@emails.disneydestinations.com>
VIEW IN YOUR BROWSER
http://click.emails.disneydestinations.com
/?<xxx>
=======================================================
Get your FREE Disney Parks Vacation Planning DVD
http://click.emails.disneydestinations.com/?<xxx>
=======================================================
<removed>
Make a memory you’ll hold on to for happily ever after.
– Explore the fun-filled Disney Resort hotels.
– See how easy it is to plan a Character Dining experience.
– Discover attractions and fun for everyone!
Whether you’re planning your family’s first trip…or your 21st…when you order a FREE Disney Parks Vacation Planning DVD , you’ll discover a world of ways to make lifelong memories:
– Explore special features about everything going on at both the Walt Disney World(R) and Disneyland(R) Resorts.
– Enjoy highlights of accommodations and attractions that fit your family.
– Get tips on how easy it is to experience it all with our affordable vacations!
<removed>
If you do not want to receive future commercial emails at this email address fromDisney Destinations, LLC, or other Disney entities advertising or promoting Walt Disney World(R) products or services, click here.
http://click.emails.disneydestinations.com/?<xxx>
Disney Destinations Marketing
Attn: Email Compliance
1375 Buena Vista Drive
PO Box 10000
Lake Buena Vista, FL 32830
I blog here as myself, not as Spamhaus, and I try to keep them separate. Since I am logged on, though, I can report that both SBLs that were opened because of this spam have now been closed. Disney Destinations did something foolish: they contacted a number of email addresses that had not been active for years. Many companies resist learning from their mistakes. Disney didn’t resist. I don’t expect to see more spam from them. I wish that most companies learned critical lessons this quickly. 🙂
Alas, they’re back at it:
Return-Path:
Received: from mx-herron.atl.sa.earthlink.net ([207.69.195.22])
by mdl-aspiring.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1zorGq4Vc3Nl37d0; Sun, 9 Aug 2015 10:34:42 -0400 (EDT)
Received: from chartdelegate.com ([163.127.6.12])
by mx-herron.atl.sa.earthlink.net (EarthLink SMTP Server) with ESMTP id 1zorG228l3Nl34a0; Sun, 9 Aug 2015 10:34:19 -0400 (EDT)
MIME-version: 1.0
Date: Sun, 09 Aug 2015 08:37:33 -0600
To: “Undisclosed Recipients”
From: “=?utf-8?B?RGlzbmV5IERlc3RpbmF0aW9ucw==?=”
Subject: =?utf-8?B?R2V0IFlvdXIgRlJFRSBE0ZZzbmV5IFBhcmtzIFZhY2F0adC+biBQbGFubmluZyBEVkQh?=
Message-id:
Content-type: multipart/related;
boundary=”4IKK5578709/jvie/SGC5)”; type=”text/html”
X-ELNK-Received-Info: spv=0;
X-Authentication-Results: dkim=”fail”; (2:no or failed dkim processing); dmarc=”none”; (1); dwl=”miss”; den=”not exempt”
X-ELNK-AV: 0
X-ELNK-Info: sbv=5; sbrc=-3; sbf=bb; sbw=000;
–4IKK5578709/jvie/SGC5)
Content-Type: text/html; charset=”UTF-8″
Content-Transfer-Encoding: 7bit
Get Your FREE Dіsney Parks Vacatiоn Planning DVD!
–4IKK5578709/jvie/SGC5)–
.
The email that you posted did not come from ExactTarget, but from a business IP address at Earthlink that has generic rDNS. I checked my rather extensive spamtrap collection, and no spamtrap I manage has received spam from this IP in the last month.
The spam sample includes invalid UTF8 strings for the From and Subject headers, and has no From email address. The URL in the email, if there was one, is missing, so I can’t check to see if the link points to a Disney-owned domain or website, or redirects to a Disney-owned domain or website. The message text appears to be obfuscated, more like snowshoe spam than anything that Disney itself would send.
Could you provide more information, perhaps? If (as I suspect) this was snowshoe spam sent through a dirty affiliate, it still might be the work of an advertiser at Disney who chose to advertise through a dirty affiliate program. :/ But without more information, I can’t tell.