Unsolicited Bulk Commercial e-mail from Janglemail / Blurbjangle

Several years ago, in November 2006, I provided a unique e-mail address to a web site. I used the site once, then forgot about it, until June this year, when mail arrived from "blurbjangle.com" to that address, advertising VistaPrint business cards. BlurbJangle provided the following information in the e-mail:

Registered in England - company no. 04823186
Registered Office for official correspondence only:
65 St Mary Street, Chippenham, Wiltshire SN15 3JF

There then followed promotional e-mails for:

www.PensionAdvance.co.uk a trading style of RBR Jacobs Limited 
Riverside Business Park - Leeds Road - Ilkley - West Yorkshire - 
LS29 8JZ Tel: 01943 886936 

Accident Advice Helpline Direct Limited
Registered in England & Wales: No: 5107417
Registered Office: Quadrant House (Floor 6), 17 Thomas More Street,
Thomas More Square, London E1W 1YW 

Optical Express laser eye surgery 

BeatThatQuote.com is an appointed representative firm of Best 
Value Financial Services Ltd which is authorised and regulated by 
the Financial Services Authority.
FSA registration number: 449766.
Registered in England No: 5346120.
Our registered offices are
39-51 Highgate Road, London, NW5 1RT.
Telephone 0800 599 99 55 

No Win No Fee
Claim Now To Get Your Money Back for loan Payment Protection Insurance

The name then changed from BlurbJangle to JangleMail, but with the same contact address and company number. Futher advertising arrived on behalf of:

www.bestlifecover.co.uk

MyDebtSolution.uk.com

Age Concern and Help the Aged charities

Prime Scratch Cards 

The most recent spam is for

LOVEFiLM:
Registered address: No.9, 6 Portal Way, London, W3 6RU.
Registered in England and Wales (no. 04392195)

This reminded me of a recent thread in nana-e and I then happened to notice non-delivery messages appearing to be from LoveFilm in my system log, starting about the 19th. The e-mail addresses have never been valid, but have been used by spammers for years. The a...@ one has probably been harvested for google, alann@ and alannn@ look like line noise has been appended to the username part.

These connections came from lots of IP addresses, most of which don't even have a PTR record, of those that do almost all are clearly adsl or ppp dial-ups, and they show up in multiple rbl lists.

BlurbJangle/JangleMail are using an e-mail address without permission, in contravention of both UK data protection regulations, and direct marketing regulations.

I have no evidence that the undeliverable e-mails were genuinely attempted to be sent by LoveFilm, however their association with a genuine spammers would seem to indicate that they have even less respect for UK laws and for common decency.

For the e-mails from Blurbjangle, reverse IP for the originating e-mail connections matches either

geml[17].co.uk

or

mail1[0-9][0-9].newgoodmail.com

plus HTTP redirection goes through

www.newgoodmail.com

vividmedianet.com

also appears in the message headers

IP addresses from which the direct LoveFilm spam was attempted to be sent:

41.178.215.138
41.214.142.53
41.250.98.239
61.6.232.55
62.120.229.5
62.60.180.3
72.27.80.72
78.100.28.188
84.36.190.74
85.154.153.40
92.96.37.207
92.97.23.75
94.59.115.130
95.57.232.74
115.147.231.73
116.197.8.229
116.71.1.122
116.72.50.123
117.199.192.198
118.96.217.121
120.141.24.174
121.1.37.170
122.100.236.18
122.52.145.20
123.20.142.168
124.120.221.108
124.161.181.130
124.195.27.78
125.25.228.35
187.2.214.132
189.105.144.57
189.106.72.211
190.214.91.79
190.249.61.23
190.59.0.135
190.82.0.105
195.246.46.5
196.1.243.51
196.201.197.46
200.116.242.144
203.222.195.210
210.23.230.20
211.242.26.75
212.73.85.1
218.186.20.195

$ whois blurbjangle.com

   Registrant:
      A Fortiori
      Matthew Gooch
      65 St Mary Street
      Chippenham, Wiltshire SN15 3JF
      GB
      Phone: +44.442087552950
      Email: info@afortiori.biz

   Administrative Contact:
      A Fortiori
      Matthew Gooch
      110 Fulwell Park Avenue
      Twickenham, Middlesex tw2 5hb
      GB
      Phone: +1.442087552950
      Email: matt@banyar.co.uk

$ whois newgoodmail.com

Private, Registration Domains by Proxy, Inc.

$ whois vividmedianet.com

   Administrative Contact:
      Advertising Ltd, Allegran  hanh.pham@allegranadvertising.com
      Allegran Advertising
      2nd Floor
      28-29 Great Sutton St
      London, London EC1V 0DS
      United Kingdom
      +44 02 7490 0150

$ dig www.vividmedianet.com

;; ANSWER SECTION:
www.vividmedianet.com.	3600	IN	A	82.79.24.146

BlurbJangle spam received (with matching SPF records) from:

Received: from mail140.newgoodmail.com (mail140.newgoodmail.com [82.79.24.140])
Received: from mail157.newgoodmail.com (mail157.newgoodmail.com [82.79.24.157])
Received: from mail158.newgoodmail.com (mail158.newgoodmail.com [82.79.24.158])
Received: from mail2.email.blurbjangle.com (mail2.geml1.co.uk [212.93.65.201])
Received: from mail7.geml1.co.uk (mail7.geml1.co.uk [212.93.65.206])

The first couple of e-mails came from the 212. ip addresses, then switched to:

$ whois 82.79.24.140

role:           Romania Data Systems NOC
address:        71-75 Dr. Staicovici
address:        Bucharest / ROMANIA
mnt-by:         AS8708-MNT

I wonder why a reputable company would move from a UK hosting provider to a Romainian one?