Blank email "spam"?

I have a student who I was talking with via ICQ. He was telling me that his Yahoo email account was getting filled with lots of emails from a variety of sources (email and ip varies) that are simply blank emails. (nothing in the contents).

Today on Full Disclosure, a member posted an email saying he was getting the same thing but to a regular "non-free" email account. Is anyone else seeing this?

I'm guessing it's one of two things: 1) email list trying to determine if an account is live by getting a response from the receiver 2) worm that has some poor coding and is missing the payload.

Yes, but most of the ones I am getting are from Yahoo accounts.

Hi MsM,

I would go for #2, or perhaps #2.a which is a badly coded spam engine. I have seen hotmail accounts completely filled by these :( .............like 30,000 copies of some reduce your loan interest scheme............only available in Canada and the US..........no wonder people love spammers :)

Cheers

Anything in the subject lines MsM, or are they blank a well?

Cheers:

Subject and body are blank. Which is what is so weird about it.

You know, nihil might be on to something here. This could be a spammer ( or want-a-be spammer :rolleyes: ) using a poorly setup/configured spam program/bot. Instead of firing out his/her advert's for Virgra, out comes a blank e-mail. Would this be antispam? :D

Cheers:

I got three of them from differenct sources. I thought it was poor coding.

LB the 3 you got, were they at the same time?

I've been getting this at a free account (spam trap) for a while now.

My pay accounts have not been getting it, but then again they don't get much spam in the first place :)

Yeah I've been seeing those emails for probably about two months now. They are going to my Adelphia email account, I've seen maybe one or two on my Yahoo!. Blank To, Blank From, Blank Subject, and Blank body. I didn't think anything of it until I just got my desktop running (been waiting for a new board for the past 3 weeks) and had like 10 of them sitting in my inbox.

And the funny thing is I wouldn't care, I would just have them automatically sent to the junk sender’s folder... except for the fact that Outlook can't distinguish that letter from any others. It's weird...

Just thought I would add my thoughts...
~AciD

On Full Disclosure someone suggested the following:

Quote:

---

What you do is have your mail bot send out spam with a twist. As each message is composed and sent, it contains an embedded image of a random name (in fact, it doesn't really exist) that is really a reference number.

For example <img src=http://logging.microsoft.com/verify/123451.jpg border=0 >

Your web server error log will identify every time one of those images was tried and then that gets matched automatically to your database of names.

Now you have:
1. A verified email address
2. An originating IP (can narrow down to what continent they are on or if broadband customers)
3. What OS you are running
4. Possibly what email client or web browser you use.

This is worth big bucks in the form of "email leads" sold by geographic regions and whether they are dialup, cable customers, business, etc.

---

The only thing I can comment on is that when I had the student forward one of his to me this is what I got (his email has been altered to protect him.. :D .. )

Quote:

---

X-Apparently-To: [email protected] via aa.xxx.yy.zz; Wed, 18 Feb 2004 03:18:21 -0800
X-YahooFilteredBulk: 80.57.189.63
Return-Path: <[email protected]>
Received: from 80.57.189.63 (HELO 66.218.86.253) (80.57.189.63)
by mta203.mail.scd.yahoo.com with SMTP; Wed, 18 Feb 2004 03:18:17 -0800
Received: from 220.14.200.64 by aa.xxx.yy.zz; Wed, 18 Feb 2004 10:17:17 -0100
Content-Length: 0

---

I had thought at first that it had the information stripped by Yahoo (bulk mail stripping) but I'm beginning to doubt it since he's still receiving it.

It's probably something, halmless if it was something bad then it would have done it by now, unless some "skiddies" are planning on collecting a heap of free e-mail accounts, and turn them into Zombies and Ddos Hotmail or something.
Witch would be funny to watch.

"Help i'm being taken down by a heap of yahoo e-mail accounts what should i do??"

LOL.

i've recieved a few but they were a while back, i just either ignored 'em. Or deleted them.

.:front2back:.

No Tedob, I got one a day for three days. All from people I don't know. By the way this was an account that I don't just give out either.

hmm! another theory down the tubes. well like santa said when he learned his sled team had gone blind: Now i have no eye deer! (boooo!)

I feel it is a spam mail.,.. Used to get them in plenty in hotmail..... But always used to fear it as virus and delete them........

I was just curious to know if it possible to send a mail without having any originating address.... <i know it sounds stupid> but with so many open relay servers is it not possible to do so..... ??????? :-?

Quote:

---

i've recieved a few but they were a while back, i just either ignored 'em. Or deleted them.

---

Maybe we shouldn't ignore them or delete them. While I think it may be a spam list "builder" the paranoid twit in me is thinking "Hrmm.... could this be something else?". I know it's been around for a while but to see information that it's on the rise. I did get something interesting. I'll have to save it next time if I can verify what I "saw". I checked my home email via the web interface at work. One of the emails was blank (or so I thought). I left it there and downloaded it at home using Kmail. Interesting that it was no longer blank but rather filled with unicode characters. Part of me wonders if webbased emails are attempting to "translate" this stuff since it seems to be mostly webbased email accounts that get it(?)

Quote:

---

I was just curious to know if it possible to send a mail without having any originating address.... <i know it sounds stupid> but with so many open relay servers is it not possible to do so..... ??????? :-?

---

I can actually set it in my email to have no return address. Most SMTP servers, AFAIK, will probably balk at receiving something like that so I wonder if a unicode option allows for that. The other thing is that, IMHO, some open relays are so poorly configured or so old that they'll let through a herd of elephants before anyone notices. :D

Here is a sample, sorry it took so long. They are starting to slow down.

Instead of a poorly coded worm, I think someone is just testing the spreading mechanism? Or perhaps this is a new type of virus that does stuff via nothing in the message and such? When you open the email it sends reports back to the creator?

-Cheers-

Quote:

---

When you open the email it sends reports back to the creator?

---

But if it's empty how does it notify the author that it's been open and if the email is spoofed how does the author get the email?

Does this help? Received: from 46.216.90.2 by 216.233.120.34

That's just tells the source (sender) and STMP server. It's why the emails exist and what, if anything, they might be used for.

The Spam Mailist verification might be one thing. Users would likely respond saying, I got your message but it was blank.

The other possibility could be bad spam (screwed up SPAM app).

But the idea of perhaps seeing what emails are live to send out a virus or worm might also be a possibility. The student tells me the messages have slowed down and he's not receiving them any more (either yahoo got a clue from his complaints or the originator is stopping). That in itself is interesting, IMHO.

At the least users in companies should be made aware of the fact that empty emails should be just tossed. Unfortunately, I can't think of a filter that would detect it unless you created a script to check for any content (a rare thing employed in my experience).

filter.. To must include @Company.com

Ah.. and mailing lists then are excluded? (mailing lists often put [email protected])

Example, Full Disclosure:

Quote:

---

To: [email protected]

---