PiarMainos.com: Emailing Five-Year-Dead Spamtraps
Piarmainos.com, a Finnish printing and packaging company, is hitting a few spamtraps that have not been live email addresses for over five years. The ESP is Streamsend.
This unsolicited bulk email has been sent persistently for months. There is no indication that the customer has ever looked at his bounce logs (the email addresses were disabled for two or more years), his engagement statistics, or any other measures of list quality. This sort of poor list management usually leads to poor reputation, email in the spam folder, and even blocklistings if it goes on long enough and gets bad enough.
Sending IP: 72.19.226.66
Spam Sample:
Actual Headers:
Received: from me-ss2-5oemw7.mailengine1.com (me-ss2-5oemw7.mailengine1.com [72.19.226.66])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Tue, 29 Jul 2014 16:##:## +0300 (EEST)
Received: by me-ss2-5oemw7.mailengine1.com (PowerMTA(TM) v3.5r15sb7) id <xxx>
for <xxx>; Tue, 29 Jul 2014 04:##:## -0700
(envelope-from <streamsendbouncer@me-ss2-5oemw7.mailengine1.com>)
Content-Type: multipart/alternative; boundary="_----------=_<xxx>"
MIME-Version: 1.0
X-Mailer: StreamSend2 - <xxx>
X-Mailer-Version: 2.0
X-Mailer-Environment: production
X-Report-Abuse-At: abuse@streamsend.com
X-Report-Abuse-Info: It is important to please include full email headers in the report
X-rpcampaign: <xxx>
X-Streamsend2id: <xxx>+me-ss2-5oemw7.mailengine1.com
List-Unsubscribe: <mailto:unsubscribe+<xxx>@me-ss2-5oemw7.mailengine1.com>
Date: Tue, 29 Jul 2014 04:##:## -0700
From: "PiarMainos.com - Elokuu" <info@piarmainos.com>
Reply-To: "PiarMainos.com" <ivan@piarmainos.com>
To: <xxx>
Subject: Tarjouksia Elokuu PiarMainos.com
Message-ID: <<xxx>@me-ss2-5oemw7.mailengine1.com>
Readable Email:
From: PiarMainos.com – Elokuu <info@piarmainos.com>
To: <spamtrap>
Subject: Tarjouksia Elokuu PiarMainos.com
Jos viesti ei näy oikein, klikkaa tästä.
6kpl Roll-Up 85x200cm
269.40 eur +alv
1kpl – 69.90 eur +alv
6kpl – 269.40 eur +alv (44,90eur/kpl)
Roll Upit ovat toimivia peruskuvatelineitä, joissa on automaattinen kuvavuodan rullausmekanismi. Roll Up -telineiden ominaisuuksia voi hyödyntää kaikissa tiloissa ja tilanteissa – ne toimivat yksin, sarjana tai osana messukokonaisuutta. Esillepano, kuljetus ja pakkaaminen on vaivatonta: Roll Upit pakataan koot- tuna kantolaukkuun, joka kulkee kevyesti mukana kaikkialle. Roll Upit soveltuvat myynti- ja esittelytilauksiin, messulle ja kokouksiin.
<removed>
© 2014 – Kaupland OY • www.PiarMainos.com
Laivalahden puistotie 10, Helsinki 00810, Finland
<xxx> Unsubscribe: Jos et jatkossa halua tätä uutiskirjettä, klikkaa tästä.
While there does appear to be a Finnish business registration, it’s really not Finnish, but (Russian-origin) Estonian. The domain registrant is an Estonian business and the spam-advertised services are hosted by Elkdata in Estonia.
“Milson” is a sole tradership / personal d/b/a of Svetlana Myllär. This address, “c/o Milson, Laivalahden puistotie 10” appears in a number of business registrations, so it appears that Ms. Myllär is acting as a proxy for a bunch. Her site has no content, but it’s notable that it’s hosted by AS51765 / creanova.org / euhost.fi in
inetnum: 91.233.116.0 – 91.233.117.255
netname: CREANOVA-NET
descr: Oy Crea Nova Russia LTD
country: FI
And here’s the domain WHOISes for the two.
[whois.eurodns.com]
Domain Name: piarmainos.com
Registry Domain ID: D4290741-COM
Registrar WHOIS Server: whois.eurodns.com
Registrar URL: http://www.eurodns.com
Updated Date: 2013-10-10T12:56:55Z
Creation Date: 2010-10-10T00:00:00Z
Registrar Registration Expiration Date: 2014-10-09T00:00:00Z
Registrar: Eurodns S.A.
Registrar IANA ID: 1052
Registrar Abuse Contact Email: legalservices[at]eurodns.com
Registrar Abuse Contact Phone: +352.27220150
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Glustsenko Ivan
Registrant Organization: Piar Ou
Registrant Street: Kreutzwaldi 24
Registrant City: Tallinn
Registrant State/Province:
Registrant Postal Code: 10147
Registrant Country: EE
Registrant Phone: +55950391
Registrant Fax:
Registrant Email: info@piar.ee
[whois.ficora.fi]
domain: milson.fi
descr: TH-media Oy ← Illegally posing as a Ltd, really a personal d/b/a
descr: 24383122
address: –
address: LAIVALAHDEN PUISTOTIE 10
address: 00810
address: HELSINKI
phone: +358 40 177 9588 ← reverse maps to “Kirkas Group” (an old alias of TH-media) and TH-Media
status: Granted
created: 2.10.2007
modified: 23.7.2013
expires: 2.10.2014
nserver: ns1.creanova.org [Ok]
nserver: ns3.creanova.org [Ok]
nserver: ns2.creanova.org [Ok]
dnssec: no
Still going on from EZ Publishing / streamsend.com.