Why is a very anonymous spammer exhorting me to "not forget about all my tasks"?

Question

I just got spam that in its entirety said: "Hi, don't forget about all my tasks." It's in plain text; there is no hidden content. Fake sender with my domain name, using a name that I do not have in my previous collection of spam. (I save it all for a month, in case of filter mismatches and some amount of morbid curiosity.) What could be the possible angle here?

Message-ID: <ZA6SW6MK.8115640@welcome.aexp.com>
Date: Tue, 10 Jan 2017 01:16:51 +0800
From: Jacob Lamothe <Jacob.Lamothe@example.org>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101
        Thunderbird/24.2.0
MIME-Version: 1.0
To: attdm@example.org
Subject: Hello from Lamothe
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi, don't forget about all my tasks.

Thanks.

That's it — no other message parts. I replaced my domain with example.org. All of the X- headers are legit and from my own system. The "Return-Path" envelope header is interesting, as a quick search sees that implicated in several phishing attacks.

I do have a couple of other messages with that same Return-Path. They are virtually identical, and look like:

Message-ID: <399761218.20161222215038@welcome.aexp.com>
Date: Thu, 22 Dec 2016 22:50:38 +0100
From: Fax Scanner <scanner@example.org>
MIME-Version: 1.0
To: mattdm@example.org
Subject: You have recevied a message
Content-Type: multipart/mixed;
        boundary="------------050107040507000606080309"

This is a multi-part message in MIME format.
--------------050107040507000606080309
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

You have received a message on efax.
Please download and open document attached.

Scanner eFax system.

--------------050107040507000606080309
Content-Type: application/zip; name="Message efax system-5733.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Message efax system-8631.zip"
 [removed]
    --------------050107040507000606080309

"Removed" is a zip file containing a javascript trojan. (Identified by an online scanner as a possible ransomware downloader.) So, maybe there's some relation? But, the headers don't look similar — different format for Message-ID, no User-Agent in the second, etc. And the came several weeks before the one above. I definitely understand what the fake scans are all about — but if they connect to the message above, I can't see how.

Maybe an attempt to mis-train your filters? Sending a lot of innocuous, seemingly normal mails to train the filter that their address is legitimate? — S.L. Barth is on codidact.com, Jan 10 '17 at 11:16
Maybe they planned to have a malicious attachment but for some reason they forgot to add it (or their spambot failed)? — André Borie, Jan 10 '17 at 14:21

mootmoot · Answer 1 · 2017-01-10T14:41:55.970

3

This is typical malware/phishing/market spam "discoveries".

Validate recipient email address
Validate sender email address
confirm your email server allow mail relay from same domain origin without authentication
Confirm your email server accept and whitelisted the return path instead of bouncing the message.

113.105.180.234 belongs to ChinaNet Guangdong Province Network netblock.

In fact, it is normal for spam attacker to launch spam discover and attack using cheapest ISP they can find. Spreading the attack from multiple service providers will increase their success rate. In addition, spammer can "cross sell" vulnerable server and email address to others.

Disable open-relay only mean spammer can't use your email server to attack others. You need another level of security to prevent scammer sending mail by phishing as user insideyour domain(e.g., scanner@example.org ,Jacob.Lamothe@example.org ), which people will fell into pray and think it is legitimate mail.

Please go through your mail server restriction setting to find out what is the best strategy. Do take note that, before you implement such restriction, you must check out whether there is any internal services(that may not have the authentication abiliites) affect by the restriction. You may need to give explicit internal-IP exception for those services..

edited Jan 10 '17 at 14:41

answered Jan 10 '17 at 14:15

mootmoot

2,407
11
16

On #3 — my server is not an open relay. – mattdm Jan 10 '17 at 14:23
@mattdm : Remove open relay only prevent cross domain relay. – mootmoot Jan 10 '17 at 14:42
I'm not sure I'm following you there. As you can see, the envelope sender is @welcome.aexp.com, not at my domain. – mattdm Jan 10 '17 at 17:03
@mattdm I only saw the return-path and id use the mentioned domain . The mesasge-id is only an index. You can try emulate the fake sender email sending using telnet to see whether it works or not. – mootmoot Jan 10 '17 at 17:38
Right, Return-Path is the envelope sender. The fake From: is entirely different and the link you gave to postfix docs doesn't apply. I'm not sure what repeating this with an interactive (telnet) session would tell me. I can tell you right now what's going to work or not. – mattdm Jan 10 '17 at 17:58

score 1 · Answer 2 · answered Jan 10 '17 at 11:09

1

Depending on whether or not there were any tracking pixels in the email, they might be checking if your address is active. If so, they might be hoping you reply to confirm that the account really is active, and that you're the sort of person who would reply to suspicious emails (e.g. a potential mark).

answered Jan 10 '17 at 11:09

Philip Rowlands

1,789
1
14
28

1

Nope: Content-Type: text/plain, so no images, scripting, or other invisible hanky-panky. – mattdm Jan 10 '17 at 11:11

Why is a very anonymous spammer exhorting me to "not forget about all my tasks"?

2 Answers2