Got Spam from EMLSend or GumbaMail? Here’s Who is Behind It

Got Spam from EMLSend or GumbaMail? Here's Who is Behind It
Share the knowledge

You may have recently received spam through an email service called EMLSend or GumbaMail being provisioned via acblnk.com, for example spam from ComplianceSR. And so now you are wondering who is behind the curtain. The answer is an ESP called AcumbaMail.

Who are GumbaMail, EMLSend, and AcumbaMail?

AcumbaMail is an ESP based out of Spain. They are also ACBlnk.com, and EMLSend. Despite being in the EU, where they are required to adhere to the requirements of GDPR, and to make sure that their email-sending clients also adhere to the requirements of GDPR, they very clearly are not doing this. AcumbaMail has been around in some form or other since at least 2011.

The AcumbaMail Terms of Use specifically state that “In the event that the Client were responsible or liable for the use of the service for unlawful purposes and/or for the mailing of unsolicited or unauthorized advertising («spamming»), causing damage to the reputation of Acumbamail and/or to the functioning of its service, such as the registration of one or more mailing or second level domain IPs linked to the service on a Relay Block List or international Blacklist (including but not limited to such blacklists as URIBL, SURBL, SORBS, SPAMCOP, SPAMHAUS, and others), or a blacklisting or relay block listing with any Internet Service Provider (including but not limited to such ISPs as Google, Microsoft, Yahoo!, AOL, Godaddy, Register, Aruba, Fastweb, Alice and others), the Client shall be considered the sole and exclusive responsible for this material breach, and shall indemnify and hold harmless Acumbamail from and against any liability whatsoever in such regard, and Acumbamail reserves the right to take action in the advisable forums to obtain compensation for damages, whether suffered by Acumbamail itself or third parties, caused by such conduct.

Doesn’t really give much confidence in their actual desire to not be a source of spam, does it? And indeed, the spam emitting from their system bears that out. In fact an entity called ComplianceSR (oh the irony) has been copiously spamming through them for weeks. ComplianceSR claims to be “create the latest and informative webinars and training sessions on governance, compliance and regulatory, suitable for individuals and corporations.” Have we mentioned the irony?

Get New Internet Patrol Articles by Email!

The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link

 

For those curious, this came from AcumbaMail’s IP block of 185.103.37.224 – 185.103.37.239.

Here’s a sample of the spam, full headers below:

ComplianceSR
Reminder Summarizing and Analyzing Data
Reply-To: ComplianceSR

Summarizing and Analyzing Data with Excel Pivot Tables

Live Webinar – 75 Minutes

August 26, 2022

Register Before It’s Full

If You Book Any One (Live, Recorded & Transcript) Of This Conference, We Will Give You A Free-Of-Cast Recording Of This Conference. View Details

Overview

PivotTables can help you sort and sift through large data sets to focus quickly on just the data elements that matter most to your specific needs.

In just one fast-paced and informative training session, you’ll learn how to use PivotTables to sort your data more efficiently, create multiple customized reports in a few easy steps and gain a powerful new tool to help you make better business decisions.

In addition, you’ll get tips on the easiest way to group your data. Most importantly, when you use the power of PivotTables, you’ll be saving time and making your job easier.

Learn More About This Program

Contact Us [email protected]

Unsubscribe me | Change my information

ComplianceSR
Reminder Summarizing and Analyzing DataComplianceSR
Reminder Summarizing and Analyzing Data
Reply-To: ComplianceSR
Reply-To: ComplianceSR
Content-Type: multipart/alternative; charset=”utf-8″; boundary=”477ff63bc68b0fcdb4d0ac9a242c3476″
Mime-Version: 1.0
X-Spamd-Result: default: False [2.98 / 7.00]; DCC_REJECT(2.00)[bulk Body=1 Fuz1=246 Fuz2=many rep=67% ]; SUBJ_EXCESS_QP(1.20)[]; FORGED_SENDER(0.30)[[email protected],[email protected]]; R_SPF_ALLOW(-0.20)[+ip4:185.103.37.228]; R_DKIM_ALLOW(-0.20)[sender1.acblnk.com:s=s1]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; HAS_LIST_UNSUB(-0.01)[]; MX_GOOD(-0.01)[]; HAS_REPLYTO(0.00)[[email protected]]; RWL_MAILSPIKE_POSSIBLE(0.00)[185.103.37.228:from]; RCVD_COUNT_ZERO(0.00)[0]; MIME_TRACE(0.00)[0:+,1:+,2:~]; DKIM_TRACE(0.00)[sender1.acblnk.com:+]; RCPT_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:29119, ipnet:185.103.36.0/22, country:ES]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; DMARC_NA(0.00)[compliancesr.com]; TO_MATCH_ENVRCPT_ALL(0.00)[]; TO_DN_NONE(0.00)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; FROM_NEQ_ENVFROM(0.00)[[email protected],[email protected]]
Authentication-Results: concerto.isipp.com; dkim=pass header.d=sender1.acblnk.com header.s=s1 header.b=FqmGbXJM; spf=pass (concerto.isipp.com: domain of [email protected] designates 185.103.37.228 as permitted sender) [email protected]om; dmarc=none
X-Rspamd-Queue-Id: 27PGGiEL608952
Dkim-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sender1.acblnk.com; [email protected]; q=dns/txt; s=s1; t=1661444210; h=Subject : From : To : List-Unsubscribe : Date : Reply-To : Message-Id; bh=5nmZbGg/GfmQSQk4H1JGa3naxHg8S+WbLN82sqOiP20=; b=FqmGbXJMN0cBQlvEa4s04t2pAoQBQ714BAGuVMYR16v8ABxtDNCHPf4t1E5gLC9m5lormj17CiLdfNVMUgrhXRWpbL2SVmkLSkXSSnl6WQOz0j4i6OoTTe/6xtbZ62nKHJIAcqheBs7qXKq18xB5Da/G+fNLyp6O5HOjpC78h4c=
Return-Path:
Return-Path:
List-Unsubscribe:
X-Rspamd-Server: concertino
Content-Transfer-Encoding: quoted-printable
Received: from concerto.isipp.com (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by concerto.isipp.com with LMTPS id zeHpJXOgB2PBSgkAxsXosw (envelope-from ) for ; Thu, 25 Aug 2022 16:16:51 +0000
Received: from sender1.acblnk.com (sender1.acblnk.com [185.103.37.228]) by concerto.isipp.com (8.15.2/8.15.2/Debian-22) with ESMTPS id 27PGGiEM608952 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for
; Thu, 25 Aug 2022 16:16:50 GMT
Delivered-To: redacted
<[email protected]>
X-Spamd-Bar: ++

Get New Internet Patrol Articles by Email!

The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link

 


Share the knowledge

Leave a Reply

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.