Caught in my spam trap – randrnews.co.uk

I’ve decided to start naming and shaming the people who spam me. I have an email address hidden in the code of one of my web sites. It doesn’t display to visitors but robots will read it. To give the spammers a sporting chance, the email address is nospam@….mydomain… I then email them to ask where they got the address from.

Their response to asking where they got the email address from?

They never responded.

Observations

Whilst this is the first time they’ve been caught in my current spam trap, scraping web sites and sending spam seems to be their method of operation to sell advertising space. They appear to have set up servers just to send spam. I say this because mhglobalmc3.co.uk doesn’t have a public website and displays a default virtual server login. They also run their own name servers. From an IT perspective, they seem pretty switched on – although their web server has been hacked so they’re not that good. I wouldn’t wish that on my worst enemy let alone spammers like this company. I’d email them and tell them, except I guess they wouldn’t read that either.

They are based in Kent, not so far from us, so back in 2009 I took the time to phone them and ask them to stop spamming us. I spoke to ‘Paul’ who promised to look into it. I’m assuming that was Paul Attwood. He was and is the owner of the domain sending spam back then;

Domain name:
    pamediasolutions.co.uk

Registrant:
    Paul Attwood

Registrant type:
    UK Individual

Registrant's address:
    47-48 Hawley Square
    margate
    CT9 1NY
    United Kingdom

Is the owner of the domain currently sending the spam;

Domain name:
    mhglobalmc3.co.uk

Registrant:
    Paul Attwood

Registrant type:
    UK Individual

Registrant's address:
    347a Margate Road
    Ramsgate
    Kent
    CT12 6SG
    United Kingdom

The destination, randrnews.co.uk, is owned by a dissolved company, MH Media Solutions Ltd of which Paul Attwood was a director. I guess they transferred it to a current company and forgot to tell the registry.

Domain name:
    randrnews.co.uk

Registrant:
    MH Media Solutions Ltd

Registrant type:
    UK Individual

Registrant's address:
    Lead Centre
    Dane Valley Road
    Broadstairs
    CT10 3JJ
    United Kingdom

randrnews.co.uk has a link to what I guess would be a parent company; http://mhmediaglobal.com/ except my browser wouldn’t let me visit;

Google Chrome Malware stop page

I’m beginning to think the publishing industry like sending spam, seeing as Archant have started spamming again.

Email headers

Delivered-To: nospam@....
Received: by 10.76.88.49 with SMTP id bd17csp150210oab;
        Tue, 6 Aug 2013 06:01:27 -0700 (PDT)
X-Received: by 10.180.74.210 with SMTP id w18mr1934845wiv.20.1375794086684;
        Tue, 06 Aug 2013 06:01:26 -0700 (PDT)
Return-Path: <ryan@refurb.mhglobalmc3.co.uk>
Received: from plesk.mhglobalmc3.co.uk ([91.206.183.157])
        by mx.google.com with ESMTPS id f5si722923wjx.46.2013.08.06.06.01.08
        for <nospam@...>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Tue, 06 Aug 2013 06:01:26 -0700 (PDT)
Received-SPF: pass (google.com: domain of ryan@refurb.mhglobalmc3.co.uk designates 91.206.183.157 as permitted sender) client-ip=91.206.183.157;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of ryan@refurb.mhglobalmc3.co.uk designates 91.206.183.157 as permitted sender) smtp.mail=ryan@refurb.mhglobalmc3.co.uk
X-No-Relay: not in my network
X-Antivirus-Status: Clean
Received: from ADVENT1 (host31-51-58-179.range31-51.btcentralplus.com [31.51.58.179])
	by plesk.mhglobalmc3.co.uk (Postfix) with ESMTPA id 244805968D1
	for <nospam@...>; Tue,  6 Aug 2013 14:01:04 +0100 (BST)
From: "Ryan Bunce" <ryan@refurb.mhglobalmc3.co.uk>
To: <nospam@....>
Subject: Editorial Opportunity
Date: Tue, 6 Aug 2013 13:53:45 +0100
Message-ID: <8a9e01ce92a4$e607b640$b21722c0$@refurb.mhglobalmc3.co.uk>
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_8A9F_01CE92AD.47D63060"
X-Mailer: Microsoft Outlook 14.0
Thread-Index: Ac6SkO5QeOa53URdSzqFQjxDYyR4CQ==
Content-Language: en-gb
X-Antivirus: avast! (VPS 130806-0, 06/08/2013), Outbound message
X-Antivirus-Status: Clean

This is a multipart message in MIME format.

------=_NextPart_000_8A9F_01CE92AD.47D63060
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_8AA0_01CE92AD.47D63060"


------=_NextPart_001_8AA0_01CE92AD.47D63060
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Description: Description: Description: Description:
cid:image001.jpg@01CE8A0C.A0729EB0


We are currently putting together the September edition of the Refurb &
Renovation News publication, which will for this issue have an added =
bonus
of an extra 5,000 circulation at the Grand Designs Live exhibition and =
the
100% Design show.

=20

I am tasked with closing off some of the editorial positions within this
issue and as I feel you would be really relevant for this I wanted to =
see if
you have something you would like to promote we could include.

=20

=B7        Exclusive total 63,000 Circulation=20

=B7        15,000 glossy A4 hard copies

=B7        48,000 Digital Versions of the publication

=B7        8 Week Circulation period (bi-monthly publication)

=B7        Media Partner with all the main UK Exhibitions

=B7        Extra 5,000 copies of this edition

=20

Specifiers that we target include;
Building Contractors - Builders Merchants - RIBA Registered Architects =
and
Large Architecture practices =96 Heating & Plumbing Engineers - BIID
Registered Interior Designers - Property Developers - Health Authorities =
-
Education Based Specifiers & Local Authorities.

=20

We run just 6 editorials per page giving you a good sized space with 1 =
full
colour image, 120-140 words of text as well as full company contact =
details.
I am currently able to offer you a 1/6th of a page editorial at =A395.

=20

Please respond by Wednesday 14th August at the latest if you would like =
to
take one of these positions.

=20

Best Regards

=20

Ryan Bunce

Sales Manager

Refurb & Renovation News

=20

Refurb & Renovation News   Suite 1, The Lead Centre, Dane Valley Road, =
St
Peters, Broadstairs, Kent CT10 3JJ  Tel: 01843 601705

Comments

5 responses to “Caught in my spam trap – randrnews.co.uk”

  1. It is 2015 now and they are still sending out spam, if you receive an email from them don’t even bother to respond because thats the way you activate automatic responders and your inbox gonna be full of advertisement.

    1. Yes they’re still actively spamming. I still see them sending to multiple email addresses we have as well as promoting different publications of theirs. Fortunately the gmail spam filters catch them all

  2. If they’re still going, report the domains to nominet. If the Ltd co is dissolved, it’s assets belong to the crown! That’ll kick them in the nuts…

  3. Yeah they’re still spamming / Phishing. Annoying beggars.

  4. Ged Haywood

    February 2017, 91.206.183.109, mhglobalmc3.co.uk, still spamming
    They’re in my tarpit. 🙂

Leave a Reply to Alex Threlfall Cancel reply

Your email address will not be published. Required fields are marked *

Search this site


Free apps

  • birthday.sroot.eu – Your birthday or other celebration date based on [years on other planets] / [how many seconds/days] / [how far you’ve travelled around the sun]
  • stampulator.sroot.eu – Calculates the combination and how many 1st, 2nd, large 1st and large 2nd class Royal Mail stamps you need on large envelopes and packets

Recent posts


Archives


Categories