Loquierooo: Emailing a Long-Dead Email Address
Loquierooo, an online boutique that sells high-end electronics and other high-end products, is sending “offers” emails to a spamtrap via French ESP Emailvision. The spamtrap is a long-closed email address that has not been live for years, and that rejected email for over twelve consecutive months in the interim before being re-enabled. It should not receive any bulk email any longer.
Sending IP: 81.92.123.108
Spam Sample:
Actual Headers:
Received: from mercure-onzeei.ccemails.net (mercure-onzeei.ccemails.net [81.92.123.108])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Sun, 23 Oct 2011 4:xx:xx -0500 (CDT)
DKIM-Signature: <xxx>
Received: by mercure-onzeei.ccemails.net id hkfgcq0hu84f
for <xxx>; Sun, 23 Oct 2011 11:xx:xx +0200
(envelope-from <xxx>)
Date: Sun, 23 Oct 2011 11:xx:xx +0200 (CEST)
From: Loquierooo <<xxx>@comunicaciones.loquierooo.com>
Reply-To: <xxx> <info@loquierooo.com>
To: <xxx>
Message-ID: <<xxx>@<xxx>.emv2.com>
Subject: =?iso-8859-15?Q?Nueva_tienda_de_Electr=F3nica_e?=
=?iso-8859-15?Q?n_Loquierooo,_siempre_en_stock?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=<xxx>
X-EMV-Platform: p5cce.campaigncommander.com$
X-EMV-CampagneId: <xxx>
X-EMV-MemberId: <xxx>
List-Unsubscribe: http://comunicaciones.loquierooo.com/HD?<xxx>
Readable Email:
From: Loquierooo <<xxx>@comunicaciones.loquierooo.com>
To: <spamtrap>
Subject: Nueva tienda de Electronica en Loquierooo, siempre en stock
Reply-To: <xxx> <info@loquierooo.com>
Si no puedes ver correctamente este mensaje, sigue el siguiente enlace
<removed>
Loquierooo es una marca comercial propiedad de Centre de Redistribucio de Mercaderies S.L. con CIF B-63195887, inscrita en el Resigtro Mercantil de Barcelona tomo 35.633, folio 87, hoja B 274.758.
Si no quieres recibir nuestras promociones, solo tienes que seguir el enlace
BTW, I just grepped my spamtraps, and this email hit an actual spamtrap as well as the long-closed email address. Hitting one old email address might mean just that the sender was careless with their bounce processing. Hitting an actual spamtrap changes the picture; you don’t hit email addresses that never existed except by a typo combined with failure to confirm opt-ins (in case of a single hit) or by purchasing a list.
Since this spam hit two completely different email addresses at two different domains with no apparent public connection to one another, the sender almost certainly purchased a list.
Just seen on Twitter:
@Loquierooo Perdón por los emails que hemos enviado. No volverá a pasar
I retweeted with the following English translation:
@mainsleazespam RT @Loquierooo Perdón por los emails que hemos enviado. No volverá a pasar (We apologize for the emails we sent. It won’t happen again.)
So apparently somebody has contacted Loquierooo and probably their ESP Emailvision. Problem likely solved. 🙂
Back in October 2010, Emailvision were the ISP for the Finnish operations of VistaPrint, after Relation & Brand (a Swedish ESP) had showed them the door because of the obvious. It is to be expected that Vistaprint will shortly make an appearance here; they started in May 2010 and were last at it in September 2011 despite any amount of opting out. But I’ll only document it here when I receive something that does not predate this site 🙂
So much for Loquierooo’s promises. They spammed again today, hit the same old email address and the same spamtrap. :/