Vistaprint: Out and out spammers
It was only yesterday that I mentioned Vistaprint here in passing. And it is only today that they prove it once again that they do not respect opt out and neither does their ESP.
Spamming IP: 217.28.197.228
Vistaprint have been spamming Infinite Mho Oy since May 25, 2010. Initially, they were using the address that is listed for Infinite Mho Oy in the Finnish Business Information System. In the initial contact, they did not indicate their address source, which might be a violation of Section 25 of the Personal Data Act. On the same day, I opted out of their advertising. Their own addresses rejected it, but their ESP at the time, Relation & Brand of Sweden, as well as abuse at TDC Song, accepted the message.
All dates and subject lines:
-- 2010 -- 1 r May 25 Vistaprint ( 221) Atro, saat 250 käyntikorttia ? sitoumuksetta 2 Jun 29 Vistaprint ( 217) Atro, saat 250 käyntikorttia ? sitoumuksetta 3 Aug 31 Vistaprint ( 248) Saat 250 käyntikorttia - sitoumuksetta 4 Sep 28 Vistaprint ( 304) Saat 250 käyntikorttia ? sitoumuksetta 5 Oct 11 Vistaprint Suom ( 57) Saat 250 ilmaista käyntikorttia 6 O Oct 11 Vistaprint Suom ( 57) Saat 250 ilmaista käyntikorttia 7 Oct 14 Vistaprint Suom ( 53) 250kpl ilmaisia käyntikortteja - etu voimassa huomiseen asti 8 Oct 14 Vistaprint Suom ( 53) 250kpl ilmaisia käyntikortteja - etu voimassa huomiseen asti 9 Oct 19 Vistaprint ( 226) Saat 250 käyntikorttia - ei sitoumuksia -- 2011 -- 10 N Sep 27 Vistaprint ( 536) Saat 250 käyntikorttia ja kotelon veloituksetta
The matter is also mentioned on Infinite Mho’s own incoming spam page. Most of the 2010 mails were sent through Relation & Brand, but some through EmailVision (in October 2010, to an address that was ever so briefly Infinite Mho’s contact address in the Finnish Business Information System for a week or two before infinitemho.fi was registered in early January 2010).
Finally, on Oct 19, 2010, a representative of Relation & Brand engaged in a proper human discussion on the matter. It seems that Vistaprint’s relationship with R & B has ended because the September 27, 2011 spam, as well as today’s missive, were sent through BizWizard, and this time, it’s sent to an address they harvested from the web pages of the business. BizWizard aren’t interested in hearing from complainants, but messages to abuse at edirectweb.se, abuse at netoptions.se, and a number of individuals at netoptions.se have been accepted. A representative of netoptions.se has responded on September 28, 2011 to say We apologize for the inconvenience of the spamming emails from Vistaprint. We have been taken actions against the company and we have also made sure that you are total opt out from this customer’s sending lists. I told them I didn’t believe this will accomplish anything.
I was right, of course.
Unredacted spam headers:
From mm30_B3_SYS_F374_11_31631@bw3smtp06.bwz.se Tue Oct 25 15:05:00 2011 Return-Path: <mm30_B3_SYS_F374_11_31631@bw3smtp06.bwz.se> Received: from bw3smtp228.bwz.se (bw3smtp228.bwz.se [217.28.197.228]) by mail.atrotossavainen.fi (Postfix) with ESMTP id 1D701794DC1 for <imho at infinitemho.fi>; Tue, 25 Oct 2011 15:05:00 +0300 (EEST) Received: by bw3smtp228.bwz.se (PowerMTA(TM) v3.5r5) id hkqiuo0jcggk for <imho at infinitemho.fi>; Tue, 25 Oct 2011 14:04:49 +0200 (envelope-from <mm30_B3_SYS_F374_11_31631@bw3smtp06.bwz.se>) From: "Vistaprint" <noreply@vistaprint.be> X-Sender: noreply@vistaprint.be To: "Atro Tossavainen" <imho at infinitemho.fi> Reply-To: noreply.vistaprint@edirectweb.se Date: Tue, 25 Oct 2011 12:04:49 GMT Subject: =?utf-8?Q?Saat=20250=20k=C3=A4yntikorttia=20ja=20kotelo?= =?utf-8?Q?n=20veloituksetta?= MIME-Version: 1.0 X-Mailer: BizWizard X-envid: 31631 X-job: mm30_B3_SYS_F374_11 Message-ID: <16e6bb2b3ce440488c51694cf007be72@BizWizard> Content-Type: multipart/alternative; boundary="_=BizWizard=_879ee20ab3ef481299a9b8f200021227" Content-Length: 19086 Lines: 535
Vistaprint are also spamming the domain that has changed hands nearly two years ago.
To: "John Doe" <james.doe at atro.fi>
Reply-To: noreply.vistaprint@edirectweb.se
Date: Tue, 25 Oct 2011 12:06:01 GMT
Subject: Onnea uudelle yrityksellesi!
(“Congratulations about your new business!”)
They’re addressing the person with a different first name than appears in the email address…
Nobody will have registered a new business with that contact address simply because it hasn’t belonged to the intended person in over two years. It was announced as the contact address for a forest owner (that’s a business too…) and was last updated in September 2005. That also explains the discrepancy in the salute (the person wishes to be called by his middle name and that appears in the email address, but the first name nonetheless appears in the business register).
The apparent address source for all this is “Euro Contact Pool SE 11970 Stockholm”. Relation & Brand had this to say about it: Our client is a Swedish postal address database, so it is very strange that you exists there in the first place. I will check into this asap. I never got a reply on that point.
The same address has received Vistaprint spam on roughly the same occasions as my business address. It is noteworthy that one of these was sent by Fonecta – but that isn’t to the forest owner’s address, but the one that’s mentioned with Fonecta here. That particular message also does not include an address source even though it was sent to a natural person, making it a clear violation of Section 25 of the Personal Data Act.
-- 2010 --
1 O May 25 Vistaprint ( 220) [John], saat 250 käyntikorttia ? sitoumuksetta
2 O Jun 29 Vistaprint ( 216) [John], saat 250 käyntikorttia ? sitoumuksetta
3 O Aug 31 Vistaprint ( 247) Saat 250 käyntikorttia - sitoumuksetta
4 O Sep 28 Vistaprint ( 303) Saat 250 käyntikorttia ? sitoumuksetta
5 Oct 19 Fonecta.fi ( 167) Saat 250 käyntikorttia - ei sitoumuksia
6 N Oct 19 Vistaprint ( 225) Saat 250 käyntikorttia - ei sitoumuksia
-- 2011 --
7 N Oct 25 Vistaprint ( 541) Onnea uudelle yrityksellesi!
I was a bit started to see a headline directly accusing a company of being out and out spammers. Then I saw “VistaPrint”. In their case, “out and out spammers” is probably justified. Most spam that I see for them is sent by snowshoe spammers who sign on to their affiliate program, which is not mainsleaze spam and is therefore beyond the scope of this blog. That distinction does them no credit, however; snowshoe spam is considerably more disreputable than mainsleaze spam. :/
Fortunately, IPs and domains used in snowshoe spam are actively blacklisted by Spamhaus, SURBL, Spamcop, and the other major anti-spam blacklists. Perhaps this particular spam is a sign that they are changing their email marketing approach. If they’re moving to direct emailing via reputable ESPs rather than by fly-by-night snowshoe spammers, that is an improvement. However, they’re still spammers until they quit sending bulk email to email addresses that never requested it.
They have operations in many countries. It is likely that they have several different sets of practices, such as per country, as well.
The initial message on May 25, 2010 to the business address was legal spam, because B2B UCE is legal here (before the recipient has opted out, that is). However, everything after the initial opt-out has been illegal spam. The message told them not to mail this business, not this specific email address (which they’ve tried to get around by mailing an outdated address and the web page address in addition to the BIS address).
On Oct 25, I mailed the NetOptions.se representative who responded the previous time. I haven’t had a reply, so I forwarded the same message to a number of other individuals and role accounts today.
They seem to be mostly coming from
vistaprint.com
8.7.42.144 – CHEETAHMAIL
8.7.42.145
8.7.43.50
8.7.43.51
(these are all SBLed)
vistaprint.be
217.28.197.228 – Netoptions Sweden AB
217.28.197.229
217.28.197.230
217.28.197.231
vistaprint.co.uk
89.167.233.48 – Epsilon
89.167.233.50
vistaprint.de
89.167.233.49
89.167.233.48
vistaprint.fr
89.167.233.48
vistaprint.nl
89.167.233.48
89.167.233.51
More again.