Case 008 — vorortliefernsender.de
Fake Delivery Domain · White-Label Scam Site · Lead 365 Ltd Data Broker
A domain name meaning "local delivery sender" — designed for spam campaigns impersonating parcel delivery companies — serves a generic fitness template built by voyager-ship.com, operated by Buncha Media UG, Hamburg. A single HTTP response cookie leaked the complete platform config, operator identity, and the hidden UK data broker: Lead 365 Ltd, Gloucester. Email infrastructure spans 11 /24 subnets (2,816 IPs) across two German bulk email providers.
The very first HTTP response from vorortliefernsender.de set a cookie named templateData containing URL-encoded JSON. No authentication or special tools required — every visitor receives this data on page load. Decoded, it reveals the complete platform configuration, operator identity, and the backend SaaS provider:
vorortliefernsender.de translates to "local delivery sender" (Vorort = local/suburban, Liefer = delivery, Sender = sender). The domain is designed to appear as a parcel delivery company — the exact profile used in German-language smishing and spam campaigns: "Ihr Paket konnte nicht zugestellt werden" (Your package could not be delivered).
The actual landing page serves the platform's uncustomised "Default" fitness template:
- "DEFINIERE DEIN TRAINING NEU" (Redefine your training) — sports and workout content
- Images of cyclists, surfers, skiers, tennis players
- Features: "Ernährung & Mahlzeitenpläne", "Leistungsanalysen", "Zugriff über mehrere Geräte"
- The page header even uses the domain name verbatim as the brand: "⚡ Vorortliefernsender"
The template was never configured. The operator registered a delivery-sounding domain for spam campaigns and never updated the landing page content — the actual payload is the newsletter email collection form in the page footer, not the visible content.
The privacy policy, reachable at /privacy-policy, reveals the actual purpose of email collection and the undisclosed data recipient:
"We may use your personal data to inform you and offer you claims management services and related campaigns that we believe may be of interest to you."
The domain implies a delivery company. The visible site shows a fitness platform. The privacy policy discloses the actual use: claims management services — a third entirely different industry. Buried in the "Marketing Services Providers / Sponsors" section:
The domain's SPF (Sender Policy Framework) DNS record authorizes 11 separate /24 subnets to send email as @vorortliefernsender.de. This is not a configuration mistake — it reflects the actual bulk email infrastructure behind the operation:
| IP Range | Owner (ASN) | Country | Type |
|---|---|---|---|
| 193.107.76.0/24 | Audience Serv GmbH (AS212886) | DE · Essen | Bulk email platform |
| 193.107.77.0/24 | Audience Serv GmbH (AS212886) | DE · Essen | Bulk email platform |
| 193.107.78.0/24 | Audience Serv GmbH (AS212886) | DE · Essen | Bulk email platform |
| 193.107.79.0/24 | Audience Serv GmbH (AS212886) | DE · Essen | Bulk email platform |
| 185.236.128.0/24 | Audience Serv GmbH (AS212886) | DE · Essen | Bulk email platform |
| 45.81.228.0/24 | mailcommerce GmbH (AS212745) | DE · Essen | Bulk email platform |
| 45.81.229.0/24 | mailcommerce GmbH (AS212745) | DE · Essen | Bulk email platform |
| 45.81.230.0/24 | mailcommerce GmbH (AS212745) | DE · Essen | Bulk email platform |
| 45.81.231.0/24 | mailcommerce GmbH (AS212745) | DE · Essen | Bulk email platform |
| 77.247.193.0/24 | mailcommerce GmbH (AS212745) | DE · Düsseldorf | Bulk email platform |
| 176.57.53.0/24 | iLevant FZE (AS60849) | JO · Amman | International routing |
@vorortliefernsender.de. Legitimate small businesses use 1-3 IP addresses for email. 2,816 IPs is the infrastructure of an industrial email marketing operation. Both Audience Serv GmbH and mailcommerce GmbH are established German bulk-email ESP (Email Service Provider) platforms — being used here to send campaigns impersonating a delivery company. The Jordan-based iLevant FZE range suggests international campaign routing to bypass German spam filters.voyager-ship.com is the backend SaaS platform generating these white-label sites. It is built on Express.js + Next.js (same tech stack as the front-end sites), hosted behind Cloudflare. Its public root returns 404 {"message":"Not Found - /"} — no public-facing marketing site, no signup page, no documentation visible.
What is known from the leaked templateData cookie structure:
- It maintains a template library (UUIDs per template) with language-specific variants
- It maintains a company registry (UUIDs per operator) with address, legal rep, privacy/ToC content
- Operators register companies on the platform, select templates, point domains at the generated Next.js app
- The platform injects company data client-side via the cookie and React context (
CompanyProvider,TemplateProvidervisible in page source) - The "Default" fitness template appears to be a placeholder — sites are meant to be customised but many aren't
The platform design enables the creation of large numbers of disposable lead-gen sites across different domains, all sharing the same backend. Each domain gets a different company identity but the same infrastructure.
Regulatory compliance case: deceptive domain + GDPR data harvesting + industrial spam infrastructure. Reporting targets cover German data protection, German anti-spam enforcement, UK data protection (for Lead 365), and Cloudflare for hosting deceptive content.
BfDI — German Federal Data Protection Commissioner
Reported to poststelle@bfdi.bund.de. Domain impersonates a delivery company to lure German users into submitting email addresses. Data is shared with UK-based Lead 365 Ltd without adequate disclosure at point of collection (GDPR Art.13 violation). Post-Brexit UK transfer lacks stated legal basis. Privacy policy mentions "claims management services" — unrelated to delivery or fitness — confirming the deceptive collection purpose.
Bundesnetzagentur — German Anti-Spam Authority
Reported via spam@bundesnetzagentur.de. SPF record for vorortliefernsender.de authorizes 2,816 IP addresses across Audience Serv GmbH (AS212886) and mailcommerce GmbH (AS212745) for bulk email. Sending commercial email impersonating a delivery company without prior consent of recipients violates UWG §7 (unverlangte Werbung — unsolicited commercial communication).
ICO — UK Information Commissioner's Office
Reported via https://ico.org.uk/make-a-complaint/. Lead 365 Ltd (Gloucester, UK) receives personal data of EU citizens from this operation. The privacy policy discloses Lead 365 as a data recipient but provides no legal basis for the EU→UK cross-border transfer. UK is a third country under GDPR; an adequacy decision exists but transfer conditions must still be met. Lead 365's own website must also disclose receiving EU data under UK GDPR.
Cloudflare — Hosting Abuse
Reported to abuse@cloudflare.com. vorortliefernsender.de and voyager-ship.com are both Cloudflare-proxied. The platform facilitates deceptive lead generation using misleading domain names to collect personal data for undisclosed third-party brokers. Cloudflare ToS Section 2.8 prohibits using services to facilitate deceptive or fraudulent activity.
Phase 1 — Initial HTTP probe: A standard curl -sI request returned HTTP headers including a Set-Cookie header with URL-encoded JSON. This single response provided: platform identity (voyager-ship.com), operator name, address, legal representative, email, and internal UUIDs.
Phase 2 — DNS analysis: SPF TXT record contained 11 IP ranges. Each IP looked up against ASN data revealed two German bulk-email ESP providers (Audience Serv GmbH, mailcommerce GmbH) and a Jordan-based routing provider, confirming industrial-scale outbound email operation.
Phase 3 — Page source analysis: Full HTML fetch revealed the Next.js platform architecture, React context providers (CompanyProvider, TemplateProvider), and the mismatch between domain name (delivery) and page content (fitness). The blank company name in Terms and Conditions confirmed the template was deployed without customisation.
Phase 4 — Privacy policy extraction: The /privacy-policy route disclosed Lead 365 Ltd as the downstream data recipient, the actual stated purpose (claims management services), and the missing EU→UK transfer legal basis — the three core GDPR violations documented in this case.
Set-Cookie header from the first page load disclosed what would otherwise require hours of investigation: the SaaS platform, operator identity, company registration details, and all internal IDs needed to pivot to related infrastructure. Passive HTTP response header analysis is always step one.Screenshot confirms the domain-content mismatch in action: the header reads "⚡ Vorortliefernsender" (the delivery domain name, used verbatim as the brand) while the page shows fitness content — cycling, surfing, tennis. The template was never configured to match the domain's implied identity. The newsletter signup form collecting data for Lead 365 Ltd appears in the footer below this fold.
Domain implies parcel delivery company. Page serves uncustomised fitness template. Newsletter form in footer collects emails for Lead 365 Ltd UK data broker. Complete operator chain identified from first HTTP response cookie.