Sep
11

Guess what? Lateralus Enterprise once again

Finnish spam with anonymized domain registrations, collaborators in India, spamming IP and hosting in Romania, target addresses outdated and erroneous personal ones from the Finnish Business Information System, legally required items on sender identification, address list source missing… Gee, I wonder who it is whose spam matches these characteristics?  We’ll know soon enough if Directi agrees to de-obfuscate email-offer.org, I guess.

Return-Path: <information@keysbranding.com>
Received: from shro.bullfox.net (unknown [86.122.87.253])
by x (Postfix) with ESMTP id x
for <x>; Tue, 11 Sep 2012 14:mm:ss +0300 (EEST)
Received: from keysbr by shro.bullfox.net with local (Exim 4.77)
(envelope-from <information@keysbranding.com>)
id x
for x; Tue, 11 Sep 2012 14:mm:ss +0300
To: x
Subject: Seiska-lehti tarjoushintaan ja kaupan päälle lahja
Message-ID: <x@www.keysbranding.com>
Date: Tue, 11 Sep 2012 11:mm:ss +0300
From: Lehtitarjous <info@email-offer.org>
Reply-To: info@email-offer.org
MIME-Version: 1.0
X-Mailer-LID: 48
List-Unsubscribe: <http://www.keysbranding.com/unsubscribe.php?M=x&C=x&L=48&N=51>
X-Mailer-RecptId: x
X-Mailer-SID: 51
X-Mailer-Sent-By: 3
Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_x"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - shro.bullfox.net
X-AntiAbuse: Original Domain - x
X-AntiAbuse: Originator/Caller UID/GID - [502 502] / [47 12]
X-AntiAbuse: Sender Address Domain - keysbranding.com

Tervehdys!

Seiska vain 2,19 €

http://www.keysbranding.com/link.php?M=x&N=51&L=50&F=T

Seiska on Suomen mehevin ja kattavin viihdelehti -se aito ja alkuperäinen.
Seiska paljastaa Sinulle julkkisten tempaukset, toilailut ja lemmenkuviot.
Seiska uutisoi sensaatiot ja skandaalit rohkeasti, mitään salaamatta. Lue
Seiskasta mistä kahvipöydässä puhutaan.

10 Seiskaa + kampanjaetuna vain 2,19 e / nro ja kaupan päälle tyylikäs
lahja. Arvo jopa 39,90 €

Tilaa tästä
http://www.keysbranding.com/link.php?M=x&N=51&L=50&F=T

Sait tämän tarjouksen koska olet tilannut meiltä uutiskirjeen.
Mikäli haluat lopettaa tilauksen klikkaa alla olevaa linkkiä.
Ongelmatapauksissa ota yhteyttä info@email-offer.org
Lähettäjä: http://www.keysbranding.com/link.php?M=x&N=51&L=51&F=T

Your email client cannot read this email.
To view it online, please go here:
http://www.keysbranding.com/display.php?M=x&C=x&S=51&L=48&N=26

To stop receiving these
emails:http://www.keysbranding.com/unsubscribe.php?M=x&C=x&L=48&N=51

3 Responses to Guess what? Lateralus Enterprise once again

  1. InfiniteMho
    September 13, 2012 at 6:17 pm

    Wasn’t I right.

    [whois.publicinterestregistry.net]
    Domain ID:D163551046-LROR
    Domain Name:EMAIL-OFFER.ORG
    Created On:09-Oct-2011 07:15:16 UTC
    Last Updated On:12-Sep-2012 09:20:33 UTC
    Expiration Date:09-Oct-2012 07:15:16 UTC
    Sponsoring Registrar:PDR Ltd. d/b/a PublicDomainRegistry.com (R27-LROR)
    Status:CLIENT DELETE PROHIBITED
    Status:CLIENT HOLD
    Status:CLIENT RENEW PROHIBITED
    Status:CLIENT TRANSFER PROHIBITED
    Status:CLIENT UPDATE PROHIBITED
    Registrant ID:DI_17325350
    Registrant Name:Yes, you know it, but the DPO doesn’t want me to say it.
    Registrant Organization:Lateralus Enterprise
    Registrant Street1:Sokinsuontie 7A 22
    Registrant Street2:
    Registrant Street3:
    Registrant City:Espoo
    Registrant State/Province:Uusimaa
    Registrant Postal Code:02760
    Registrant Country:FI
    Registrant Phone:+358.0405940756
    Registrant Phone Ext.:
    Registrant FAX:
    Registrant FAX Ext.:
    Registrant Email:firstname_surname@yahoo.com
    …
    Name Server:NS1.SUSPENDED-DOMAIN.COM
    Name Server:NS2.SUSPENDED-DOMAIN.COM

    As an additional bonus,

    [Whois.bigrock.com]
    Domain Name: KEYSBRANDING.COM

    Registrant:
    Linux Private Server
    Ramesh Pradhan (ramesh.pradhan@hotmail.com)
    22 A 13 Sector 4 Vaishali
    Line 2: (Optional)
    Ghaziabad
    Uttar Pradesh,201010
    IN
    Tel. +91.8899889988

    Creation Date: 13-Mar-2012
    Expiration Date: 13-Mar-2013

    Domain servers in listed order:
    ns1.suspended-domain.com
    ns2.suspended-domain.com

  2. InfiniteMho
    September 24, 2012 at 11:40 pm

    A marketing manager from Aller Media, the publishers of Seiska magazine, responded.

    “We’d like more information on the message in question, because our partners have told us that the sender in question has been removed from our publishers. This sender does not have permission to send Aller Media campaigns. Has the message been received recently?”

  3. dmnt
    June 17, 2013 at 6:08 pm

    More of spam for Seiska:
    Received: from mx04.aalto.fi (130.233.222.103) by EXHUB01.org.aalto.fi
    (130.233.222.118) with Microsoft SMTP Server id 14.3.146.0; Mon, 17 Jun 2013
    16:02:28 +0300
    Received: from mx04.aalto.fi (localhost [127.0.0.1]) by localhost (Postfix)
    with SMTP id 8BF54F02FA for ; Mon, 17 Jun 2013
    16:02:28 +0300 (EEST)
    Received: from dobsone.com (dobsone.com [178.33.205.92]) by mx04.aalto.fi
    (Postfix) with ESMTP id 3695CF02F6 for ; Mon, 17 Jun 2013
    16:02:28 +0300 (EEST)
    Received: from localhost (dobsone.com [178.33.205.92]) by dobsone.com
    (Postfix) with ESMTP id 66FF2A15B4 for ; Mon, 17 Jun 2013
    15:02:30 +0200 (CEST)
    Content-Type: multipart/alternative;
    boundary=”=_X”
    Reply-To: =?UTF-8?Q?Elina_Sakaraj=C3=A4rvi?=
    From: =?UTF-8?Q?Elina_Sakaraj=C3=A4rvi?=
    Subject: =?UTF-8?Q?Haluatko_Kes=C3=A4n_Seiskat_Erikoishintaan=3F_-_Kaupan?=
    =?UTF-8?Q?_P=C3=A4=C3=A4lle_Kylm=C3=A4laukku?=
    To:
    X-PMX-Version: 5.5.9.388399, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2013.6.17.125127
    X-Spam-Probability: 10%
    X-Spam-Level: X
    X-Spam-Status: NONE ; 10%
    X-PMX-Spam: Gauge=X, Probability=10%, Report=’
    NO_MESSAGE_ID 0.3, HTML_70_90 0.1, UTF8_SUBJ_OBFU 0.1, BODYTEXTH_SIZE_10000_LESS 0, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_10000_PLUS 0, IMGSPAM_TABLE_1 0, LINK_TO_IMAGE 0, __ANY_URI 0, __CANPHARM_UNSUB_LINK 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_ALT 0, __HAS_FROM 0, __HAS_HTML 0, __HAS_REPLYTO 0, __HIGHBITS 0, __HTML_BOLD 0, __IMGSPAM_TABLE_1 0, __LINES_OF_YELLING 0, __MIME_HTML 0, __MIME_VERSION 0, __REPLYTO_SAMEAS_FROM_DOMAIN 0, __STOCK_PHRASE_7 0, __STYLE_RATWARE 0, __STYLE_RATWARE_NEG 0, __SUBJ_ALPHA_END 0, __SUBJ_ALPHA_END2 0, __SUBJ_HIGHBIT 0, __TAG_EXISTS_HTML 0, __TO_MALFORMED_2 0, __TO_NO_NAME 0, __URI_NO_WWW 0, __URI_NS , __UTF8_SUBJ 0′
    X-Spam-Flag: No
    Message-ID:
    Return-Path: X@dobsone.com
    Date: Mon, 17 Jun 2013 16:02:28 +0300
    X-MS-Exchange-Organization-AuthSource: EXHUB01.org.aalto.fi
    X-MS-Exchange-Organization-AuthAs: Anonymous
    MIME-Version: 1.0

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top