QualityHealth: Emailing an Old Email Address
QualityHealth, a web portal with a wide variety of health-related information, is sending bulk email to an email address that cannot have been live after 2008, and probably never existed. The ESP is ExactTarget.
Sending IP: 66.231.95.103
Spam Sample:
Actual Headers:
Received: from am103.mta.exacttarget.com (am103.mta.exacttarget.com [66.231.95.103])
by <xxx> (Postfix) with ESMTP id <xxx>
for <xxx>; Sun, 13 Nov 2011 <xxx> -0600 (CST)
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: by am103.mta.exacttarget.com (PowerMTA(TM) v3.5r16) id <xxx>
for <xxx>; Sun, 13 Nov 2011 <xxx> -0600
(envelope-from <xxx>)
From: "QualityHealth" <qualityhealth@mail.qualityhealth.com>
To: <xxx>
Subject: Postmenopausal osteoporosis: Myths and facts
Date: Sun, 13 Nov 2011 <xxx> -0600
List-Unsubscribe: <mailto:leave-<xxx>@leave.mail.qualityhealth.com>
MIME-Version: 1.0
Reply-To: "QualityHealth" <reply-<xxx>@mail.qualityhealth.com>
x-job: <xxx>
Message-ID: <xxx>
Content-Type: multipart/alternative;
boundary="<xxx>"
Readable Email:
From: QualityHealth <qualityhealth@mail.qualityhealth.com>
To: <spamtrap>
Subject: Postmenopausal osteoporosis: Myths and facts
Reply-To: QualityHealth <reply-<xxx>@mail.qualityhealth.com>
Prolia Email
http://click.mail.qualityhealth.com/?<xxx>
Issue No.4
http://click.mail.qualityhealth.com/?<xxx>
2 more issues in this series
Unsubscribe from this Subscription
To ensure delivery, please add
mailto:qualityhealth@mail.qualityhealth.com
qualityhealth@mail.qualityhealth.com to your address book.
<xxx>
This email is a service of
http://click.mail.qualityhealth.com/?<xxx>
QualityHealth (R)
10 Exchange Place, Jersey City, NJ 07302
If you feel this subscription was made in error, please
http://click.mail.qualityhealth.com/?<xxx>
click here to unsubscribe.
Today Quality Health sent another spam to the same spamtrap, with the following language in it:
You recently visited our network and told us that you or a loved one suffer from a non-traditional work schedule (included working nights, evenings, rotating, or split shifts or anything other than a normal day shift), Shift Work Disorder, Obstructive Sleep Apnea, or Narcolepsy. We hope that the information we provided helped you to have a productive conversation with your doctor.
The spamtrap in question, if it ever had a real person that used it at all, was shut down by late 2007. The spamtrap domain is not registered to me (most of mine are not), and nobody outside of a very small group of people knows that it is a spamtrap. *Nobody* (at least, nobody authorized to do so) “recently visited” this network or asked for information.
Purchased list? The evidence of one spamtrap isn’t conclusive, but in this case it’s likely.
And today Quality Health hit two additional spamtraps. I suppose that some miscreant *could* be auto-feeding a purchased list to a Quality Health subscription form that does not confirm subscriptions and has no checks whatsoever to prevent a script from feeding email addresses to the form. Unless that highly unlikely scenario is true, however, Quality Health is either purchasing lists or purchasing leads from a leads provider that is purchasing lists.