Tuesday, September 29, 2009

Dun and Bradstreet spam

I recently got mail from Dun and Bradstreed, a Wall Street firm that (as far as I can tell) sells financial information on people and businesses.    I've never done any business with them, so their mail was (as far as I was concerned) spam.   And, typically of spam, it was not sent by them, but by another firm that they've hired to do this for them.    There were a number of links in the mail that purported to go to Dun and Bradstreet, but the URLs went to exct.net (and not to Dun and Bradstreet) and looked like http://cl.exct.net/?qs=long-hex-string-here.  They even had "unsubscribe" links.   I'm always reluctant to click on such links as who knows what is on the other end, and, of course, because clicking on unsubscribe links usually just confirms the email as valid to the spammers.  Eventually, I did click on one from a sandboxed browser and it took me to Dun and Bradstreet. 

I was still a bit suspicious though and sent Dun and Bradstreet an email pointing out that their mail was spam (at least unsolicited commercial email), that it looked like a phishing attack at the mail level, and that this was not considered good behavior.   I usually try to let companies know when they're being phished or are (perhaps inadvertently) being used in spam.    I got a response back from someone who had clearly not understood my points and fired off another email to them trying to explain just why their mail was spam, why it was suspicious and why I was bothered.  

A while later I got another response, and some of that is worth quoting.    I'll leave out the part where they say I'm misguided (which may be the case, honestly enough).       I'd also note that I now seem to be on their email list (I've received two emails from them asking me to do a survey in the last day) and will be marking their mail as spam in the future.    This response confirms that they are harvesting emails with a view to spamming ("sent to millions of recipients") and the part about "html to most and text to others" is also nonsense as I got the HTML version and the text version in the same email and it had the same links (that is, not to Dun and Bradstreet).  

The rest of this post is excerpted from their email :

As an FYI, the campaign was sent to millions
of recipients whose e-mail addresses we've collected through our Jigsaw
partnership.  Due to the large number of recipients involved, we're
bound to get a certain number of complaints from people who don't
understand the purpose of the campaign (though we tried to explain in
the message) and others who simply like complaining.

The only other comment I'd make is that the message was transmitted in
html to most and in text to others.  Our e-mail vendor informed us that
this is standard, as it depends on the formatting of the various ISP's
through which the messages are transmitted.  It looks like the recipient
below received the message in text format, which is why the links look
weird and unofficial.  I believe that only the html version shows the
graphics, D&B brand, etc.  Unfortunately, neither we nor our vendor have
any control over the format through which the given ISP's transmit the
message.

No comments: