Blank email "spam"?

[MrLinus]

On Full Disclosure someone suggested the following:

What you do is have your mail bot send out spam with a twist. As each message is composed and sent, it contains an embedded image of a random name (in fact, it doesn't really exist) that is really a reference number.

For example <img src=http://logging.microsoft.com/verify/123451.jpg border=0 >

Your web server error log will identify every time one of those images was tried and then that gets matched automatically to your database of names.

Now you have:
1. A verified email address
2. An originating IP (can narrow down to what continent they are on or if broadband customers)
3. What OS you are running
4. Possibly what email client or web browser you use.

This is worth big bucks in the form of "email leads" sold by geographic regions and whether they are dialup, cable customers, business, etc.

The only thing I can comment on is that when I had the student forward one of his to me this is what I got (his email has been altered to protect him.. .. )

X-Apparently-To: student9@yahoo.ca via aa.xxx.yy.zz; Wed, 18 Feb 2004 03:18:21 -0800
X-YahooFilteredBulk: 80.57.189.63
Return-Path: <nuhenela@professoremail.com>
Received: from 80.57.189.63 (HELO 66.218.86.253) (80.57.189.63)
by mta203.mail.scd.yahoo.com with SMTP; Wed, 18 Feb 2004 03:18:17 -0800
Received: from 220.14.200.64 by aa.xxx.yy.zz; Wed, 18 Feb 2004 10:17:17 -0100
Content-Length: 0

I had thought at first that it had the information stripped by Yahoo (bulk mail stripping) but I'm beginning to doubt it since he's still receiving it.

[.:front2back:.]

It's probably something, halmless if it was something bad then it would have done it by now, unless some "skiddies" are planning on collecting a heap of free e-mail accounts, and turn them into Zombies and Ddos Hotmail or something.
Witch would be funny to watch.

"Help i'm being taken down by a heap of yahoo e-mail accounts what should i do??"

LOL.

i've recieved a few but they were a while back, i just either ignored 'em. Or deleted them.

.:front2back:.

[Lansing_Banda]

No Tedob, I got one a day for three days. All from people I don't know. By the way this was an account that I don't just give out either.

[Tedob1]

hmm! another theory down the tubes. well like santa said when he learned his sled team had gone blind: Now i have no eye deer! (boooo!)

[anjali]

I feel it is a spam mail.,.. Used to get them in plenty in hotmail..... But always used to fear it as virus and delete them........

I was just curious to know if it possible to send a mail without having any originating address.... <i know it sounds stupid> but with so many open relay servers is it not possible to do so..... ??????? :-?

[MrLinus]

i've recieved a few but they were a while back, i just either ignored 'em. Or deleted them.

Maybe we shouldn't ignore them or delete them. While I think it may be a spam list "builder" the paranoid twit in me is thinking "Hrmm.... could this be something else?". I know it's been around for a while but to see information that it's on the rise. I did get something interesting. I'll have to save it next time if I can verify what I "saw". I checked my home email via the web interface at work. One of the emails was blank (or so I thought). I left it there and downloaded it at home using Kmail. Interesting that it was no longer blank but rather filled with unicode characters. Part of me wonders if webbased emails are attempting to "translate" this stuff since it seems to be mostly webbased email accounts that get it(?)

I was just curious to know if it possible to send a mail without having any originating address.... <i know it sounds stupid> but with so many open relay servers is it not possible to do so..... ??????? :-?

I can actually set it in my email to have no return address. Most SMTP servers, AFAIK, will probably balk at receiving something like that so I wonder if a unicode option allows for that. The other thing is that, IMHO, some open relays are so poorly configured or so old that they'll let through a herd of elephants before anyone notices.

[Info Tech Geek]

Here is a sample, sorry it took so long. They are starting to slow down.

[silver-bullets]

Instead of a poorly coded worm, I think someone is just testing the spreading mechanism? Or perhaps this is a new type of virus that does stuff via nothing in the message and such? When you open the email it sends reports back to the creator?

-Cheers-

[MrLinus]

When you open the email it sends reports back to the creator?

But if it's empty how does it notify the author that it's been open and if the email is spoofed how does the author get the email?

[Info Tech Geek]

Does this help? Received: from 46.216.90.2 by 216.233.120.34