Malicious spam campaign regarding VOIP Addons for Skype – the story goes on


MX Lab, http://www.mxlab.eu, reported earlier on regarding a malicious spam campaign regarding an offer to get Skype VOIP Addons.

We have been following the campaigns and what is quite stunning is that the authors of this campaign are using different ESPs – or Email Service Providers – in order to get the message to their subscription database.

In the past we’ve seen messages coming from:

  • Emailsparkle.com – owned by Dotster
  • digioffice-mail.be – owned by Mario Vleugels from West Technologies, located in Belgium
  • createsend1.com – owned by  Campaign Monitor

Today we have the messages coming from Stream Send and the senders email address is newsletter@skype–2010.com. As you can notice, a new domain name is also present. This is used to avoid spam engines with the intent analysis technology where filtering is based on URLs inside the message.

The body of the email:

Dear Skype Users,

This is to notify that new updates have been released for Skype. Following are major new features:

– Talk more for free via Voice Over IP (VoIP)
– Lower cost when connecting to landlines (much cheaper than Calling Card)
– Record your conversation (better than telephone quality)
– Instant messaging & file-sharing, video calls
– Now available on PSP!

To check and upgrade, go to Skype Updates Center

Skype has changed the way we think of telecommunications.

Thank you for choosing us.

With best regards,
Mike Pickman
Skype Support
Copyrights Skype 2010 – All Rights Reserved

If you notice a change in email delivery, please post it in the comments.

[Update 01-01-2010 20:32]

We got a reply from the abuse department of Stream Send:

“Thank you for contacting us. We’ve reviewed the information that you have sent us and have taken action against the account holder that sent out this email.”.

Great, down again but for how long.

2 thoughts on “Malicious spam campaign regarding VOIP Addons for Skype – the story goes on

  1. Got an email today from “Skype@demo.srv2.de”. looked very suspicious so I looked it up… thanks for the heads up guys.

Comments are closed.