Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been getting the weirdest email messages for the last 2 days on my personal gmail inbox.

On May 28th, exactly at 4:33 pm BRST I got about 2,000 emails that look exactly the same, here's the original.

Delivered-To: XXXXXX@gmail.com
Received: by 10.58.195.142 with SMTP id ie14csp9116vec;
        Wed, 28 May 2014 17:23:56 -0700 (PDT)
X-Received: by 10.194.48.80 with SMTP id j16mr4624897wjn.44.1401321530931;
        Wed, 28 May 2014 16:58:50 -0700 (PDT)
Return-Path: <482265052@attacker.com>
Received: from WIN-EB12TG1C3GU ([212.68.146.41])
        by mx.google.com with ESMTP id hl6si35599364wjb.55.2014.05.28.16.58.50
        for <XXXXXX@gmail.com>;
        Wed, 28 May 2014 16:58:50 -0700 (PDT)
Received-SPF: none (google.com: 482265052@attacker.com does not designate permitted sender hosts) client-ip=212.68.146.41;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 482265052@attacker.com does not designate permitted sender hosts) smtp.mail=482265052@attacker.com
Received: from wv3550 ([127.0.0.1]) by WIN-EB12TG1C3GU with Microsoft SMTPSVC(7.5.7601.17514);
     Thu, 29 May 2014 02:33:21 +0300
Date: Thu, 29 May 2014 02:33:21 +0300
Subject: 169992b1286fb7bb8701d0129fa8501a
To: XXXXXX@gmail.com
From:482265052@Attacker.com
Return-Path: 482265052@Attacker.com
Message-ID: <WV3550vAdxaQ6shalxy0002f4b7@WIN-EB12TG1C3GU>
X-OriginalArrivalTime: 28 May 2014 23:33:21.0825 (UTC) FILETIME=[367F9910:01CF7ACD]

Attacker Message

I just changed my email address, everything else in untouched. All 2k messages look very similar, arrived at the same minute. The only difference is the from email address and Subject (the numbers look random).

Today, I got yet another chain, this time over 7,000 email. Same methodology but this time with a different message. Here it is:

Delivered-To: XXXXXX@gmail.com
Received: by 10.58.195.142 with SMTP id ie14csp14708vec;
        Fri, 30 May 2014 08:05:10 -0700 (PDT)
X-Received: by 10.180.11.37 with SMTP id n5mr6680977wib.41.1401455833882;
        Fri, 30 May 2014 06:17:13 -0700 (PDT)
Return-Path: <634231594@attacker.com>
Received: from WIN-EB12TG1C3GU ([212.68.146.41])
        by mx.google.com with ESMTP id cw1si4703530wib.7.2014.05.30.06.17.13
        for <XXXXXX@gmail.com>;
        Fri, 30 May 2014 06:17:13 -0700 (PDT)
Received-SPF: none (google.com: 634231594@attacker.com does not designate permitted sender hosts) client-ip=212.68.146.41;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 634231594@attacker.com does not designate permitted sender hosts) smtp.mail=634231594@attacker.com
Received: from wv3550 ([127.0.0.1]) by WIN-EB12TG1C3GU with Microsoft SMTPSVC(7.5.7601.17514);
     Fri, 30 May 2014 16:16:42 +0300
Date: Fri, 30 May 2014 16:16:42 +0300
Subject: ac2ca78349d53cfa502088e3bf537927
To: XXXXXX@gmail.com
From:634231594@Attacker.com
Return-Path: 634231594@Attacker.com
Message-ID: <WV3550kRaulR0GMhT6D00038f43@WIN-EB12TG1C3GU>
X-OriginalArrivalTime: 30 May 2014 13:16:42.0284 (UTC) FILETIME=[65E12EC0:01CF7C09]

I'm back i am Mauritanian im not using vpn or anything to hide my self 
i am black from africa as You mister president
won the election we was happy because maybe we hope u will resolve all the problem 
in asia africa but lol nothing just ur first jobs there in white house is to protect israel from what ?
who can beat israel 
israel had nuclear bomb
plz before u going to leave white house resolve any problem syrian people and palestin and slavery in Mauritania plz do something 
thanks

A search on Google returns nothing. What is that? Should I be concerned?

share|improve this question
1  
GET DOWN MISTER PRESIDENT! –  ekaj May 30 at 23:52
1  
You don't by chance have obama@gmail.com as an email? –  ScottMcGready May 31 at 0:04
    
@ScottMcGready, no. This is my personal email, which doesn't resemble Obama at all. –  Eduardo Cereto Jun 1 at 21:01

1 Answer 1

up vote 1 down vote accepted

This is a pretty standard "mail bombing", and I'd have expected Google to cotton up to it and prevent most of the emails from reaching you.

However, if you mark them as "spam", Google ought to do just that - several almost-identical emails are a dead ringer for undesired communications.

As for the source, granted that this information may be fake, but

 Return-Path: <634231594@attacker.com>
 Received: from WIN-EB12TG1C3GU ([212.68.146.41])
    by mx.google.com with ESMTP id cw1si4703530wib.7.2014.05.30.06.17.13

at least looks as if it originated at ArtVision hosting in Raanana, Israel.

The computer appears to be a Windows Asus Tablet. You might try writing to support (at) artvision (dot) co (dot) il and ask them whether they have noticed anything, such as an unexplained sluggishness in their unsecured guest WiFi network :-), or a creepy fellow sporting an Asus 12" slate spending time nearby.

Finally as for the "why", it again looks as if we have a very sick/disturbed/incompetent person who writes to you believing he's somehow reaching someone else.

It's difficult to do more than guess without a lot more information.

For example: when you fly abroad, is the plane you travel on usually referred to as "Air Force One"? :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.