So who was behind this spam? Well, the easiest way to find out was to pretend to be interested. I filled in the contact form on the site and eventually got a reply from an outfit called Email Movers Ltd. Now, let's be clear - I don't know 100% that Email Movers were responsible for sending the original spam, but somehow my "lead" ended up with this UK-based marketing company.
The enquiry I made was about PPI leads, the mainstay of many sleazy marketing outfits. The response I got was as follows:
From: Jonathan Coleman [firstname.lastname@example.org]
Date: 23 May 2013 11:06
Subject: RE - PPI Leads
Thank you for your enquiry. We have excellent PPI data consisting of over 1 million contacts.
The database consists of UK consumers who have taken out a loan within the last 6 years with a payment protection policy attached to the loan. We have called each consumer from a 300 seat call centre in order to verify these details. The flat file we used in order to contact these consumers was originally one of the country’s largest loan packagers completion files.
Landline telephone number
Mobile telephone number
Available 300+ selections available via our syndicated multiple overlay platform.
Example selections include:
The data doesn't get released, we will conduct the email broadcast for you. Min order value applies, no less than 50 000 records and it is £1650. Other volumes are priced as following:
50,000 at £1650 + VAT
100,000 at £1990 + VAT
250,000 at £2700 + VAT
500,000 at £4300 + VAT
1 Million at £8000 + VAT
What do you think?
Senior Account Manager
D: +44 (0)1723 800022
T: +44 (0)845 226 7181
Trusted email validation Try Email Inspector | Targeted Marketing at a click Try Countrunner
Emailmovers Ltd, Pindar House, Thornburgh Road, Scarborough, North Yorkshire, YO11 3UY UK
Registered in England No. 5046417. Registered office: Medina House, No 2 Station Avenue, Bridlington, YO16 4LZ. United Kingdom.
View email disclaimer
This email comes from an emailmovers.com address with a link to a website emvrs.co. The email originates from a Google IP, so no real clue as to its origin.
Emailmovers have been around for quite a while, but they had attracted quite a lot of adverse comments for spam         . They have quite a lot of websites too, in addition to emailmovers.com and emvrs.co, but one in particular caught my eye.. the domain emailinspector.co.uk which is an "email validation" service. Check out the last paragraph in particular:
Email databases decay at an alarming rate. It is imperative to keep your data as accurate and as clean as possible to maintain a good sender reputation and improve the deliverability of your email list.
Email Inspector is a revolutionary new way of updating and cleansing your email addresses without risking blacklisting your IP. This online service allows you to upload bulk lists of email addresses to check for bounces, wrong addresses and duplicates and leaves you with a clean and up-to-date list that is ready for use.
We can also take your database in-house for further analysis to strip out known complainers and run it against our master spam trap file in our full bureau service.
There's another word for this process.. ListWashing. Legitimate mailing lists should never contain spamtrap data, this is only of use if dealing with scraped or malware-harvested email addresses. Exactly what sort of customers is Emailmovers after with a service like this?
The company QuotesPlease Ltd appears to be largely the same operation, with the same personnel and at the same address.
They own several other domains, at least one of which (email-databases.com) has been hacked (see report), also bizibuy.com has been compromised and defaced. theemailexpert.com has also been defaced recently. I don't know if those server contained any personally identifiable data or not.
Perhaps Emailmovers contracted out the lead generation to another party and buy those leads in good faith. I'm sure you can make up your own mind as to how likely that is.
These following domains all appear to belong to Emailmovers Ltd or QuotesPlease Ltd, do with them what you want:
Added: these following domains are also in use for the inital spam, plus there are more details on the comments section:
Added (II): some more domains these spammers use can be found here.