68

A mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ...

=EA=85=9F =EA=8F=92

who benefits how? no links nothing else in this email.

screenshot from email in browser

Delivered-To: [email protected]
Received: by 10.28.158.140 with SMTP id h134csp1731559wme;
        Mon, 3 Aug 2015 04:22:13 -0700 (PDT)
X-Received: by 10.55.41.195 with SMTP id p64mr24023265qkp.5.1438600933481;
        Mon, 03 Aug 2015 04:22:13 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm38-vm9.bullet.mail.bf1.yahoo.com (nm38-vm9.bullet.mail.bf1.yahoo.com. [72.30.239.25])
        by mx.google.com with ESMTPS id j34si16595518qkh.82.2015.08.03.04.22.12
        for <[email protected]>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Mon, 03 Aug 2015 04:22:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 72.30.239.25 as permitted sender) client-ip=72.30.239.25;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 72.30.239.25 as permitted sender) [email protected];
       dkim=pass [email protected];
       dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1438600932; bh=2Le9dnlRHEHV2DHi6g9XBTAZHFuEvLsr8SjC/C2a2+Y=; h=Date:From:Reply-To:To:Subject:From:Subject; b=ab5c6U0O35AE1JHNL7n1OB10kVvCjIPh5ilkWw5ct2nWs6w4b9CSkyaBQKibdqI3gbQB+NQo8/FINRQMjloHxunlRa91MRWQEZ48S3EUOH65D4b7tVMyfs4pB+VSJb/8ohLwDFs0nFS5V9S55M1DD3o+WqLOkwb49ijxE8J9enDY8jtLWaJ7RZ794nZcvRH3a3Y4r31Y3zahRUVmKQKc2vvPDOrEbncmu2PEJOhcJEELTQcc1MXtaVWHzspmyPZBuBVzvd4cvvYStguk7p5UL9kvyLWG3ZyhaPyDGfbt0egQcFropcb6Xw3ttdikVlC7YYVipZUgzp/IzajFZks6jw==
Received: from [66.196.81.170] by nm38.bullet.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
Received: from [98.139.212.241] by tm16.bullet.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
Received: from [127.0.0.1] by omp1050.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: V0Jf1mgVM1nboRi87_16P3wYo7hVU_Wr4wYa8QonNjb6jD1sZDPz1QMe5617lEj
 .KTslKteP6Aay2J5FC1JdWzUFlVlqBbvFsFsuumiJcZNTt05csrlKh1v3H5Gzb0ArIimMooZB3WF
 V4xucEAi6v6l.Dx4G6r66fHLgmvW_3nukrV5HBBj49nHgUkd6ZWNWvVJ..pnsjI3WTLyo_B3PKTC
 tvyVuliPBVKPv4oDLkFbiAcS6czdirjBw04SDlyXyz6zVVvgyrFQx8Jxu7Z0yEfA18KRNWlrn4kd
 Ozgpri8uHm.hdcj.DYlF5lVANlBACmDfsboQOL9Ma69nsNeWvRGVoDrxYGsXCfOT13yAfXLLdf_c
 KwEOEIXQcfnWY5tWHHqhLPaEJM36vGb7PrSVPjbGFvuGxO.a66wkphgI_Gn3rcXkXGBluiVveg5O
 _KFt15xpsEM1nd7kvyyBo2M2GJn_A_GuD_0KNoPKrk8Gtorh9Z7TdSW.0WtU80P8m6vsRydyp2u9
 7H14-
Received: by 76.13.27.197; Mon, 03 Aug 2015 11:22:12 +0000 
Date: Mon, 3 Aug 2015 11:22:11 +0000 (UTC)
From: Shawn <[email protected]>
Reply-To: Shawn <[email protected]>
To: <removed to protect privacy>
Message-ID: <[email protected]>
Subject: fdihkesdhlffljrks djssldhfvkljdelsfkah
MIME-Version: 1.0
Content-Type: multipart/alternative; 
    boundary="----=_Part_120230_1658237110.1438600931848"
Content-Length: 1531

------=_Part_120230_1658237110.1438600931848
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

dolomite fiddle armpits moribunditygNIt's=EA=85=9FShawn=EA=80=BCby=EA=8F=92=
the=EA=87=91way.famished nonsalaried artichokes deadlockingAaI'm=EA=87=8Bex=
cited=EA=8D=BEabout=EA=91=8Fyour=EA=89=AFanswer))symbiotes perspire
------=_Part_120230_1658237110.1438600931848
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"background-color:#ccdd15;display:block;color:#ccd=
d15;"><div style=3D"font-family: Unfeignedly, Gascony, Pancakes;font-size:5=
px;">dolomite fiddle armpits moribundity<div>gN<div style=3D"font-size:20px=
;color:#455e81;display:inline-block">It's</div>=EA=85=9F<strong style=3D"fo=
nt:20px normal;color:#455e81">Shawn</strong>=EA=80=BC<div style=3D"color:#4=
55e81;font-size:20px;display:inline-block">by</div>=EA=8F=92<em style=3D"fo=
nt:20px normal;color:#455e81">the</em>=EA=87=91<em style=3D"font:20px norma=
l;color:#455e81">way.</em></div>famished nonsalaried artichokes deadlocking=
<div>Aa<i style=3D"color:#455e81;font:20px normal">I'm</i>=EA=87=8B<span st=
yle=3D"color:#455e81;font-size:20px">excited</span>=EA=8D=BE<big style=3D"f=
ont-size:20px;color:#455e81">about</big>=EA=91=8F<strong style=3D"font:20px=
 normal;color:#455e81">your</strong>=EA=89=AF<i style=3D"color:#455e81;font=
:20px normal">answer))</i></div>symbiotes perspire</div></div></body></html=
>
------=_Part_120230_1658237110.1438600931848--
5
  • 4
    Why don't you reply (perhaps from a disposable email account) and see what happens? Aug 4, 2015 at 6:04
  • 19
    @JamesT.Huggett: Because that is the purpose of the email? To see whether yours is in use. Replying is usually the worst thing you can do. Aug 4, 2015 at 10:53
  • 5
    I lolled at "Donall Sutherland" Aug 4, 2015 at 10:54
  • 9
    I, personally, would love to use the "Pancakes" font
    – Jason
    Aug 4, 2015 at 17:47
  • 1
    Maybe the intent was to get you to post this on an internet site where it can be found via a Google search. It might only use the keywords to verify that your address is correct, or it might be a covert message (makes me think of the time when you could listen to spy messages on shortwave radio, they all went like this... "Ozelot to Ice Man: Pawn D4-E4, check" -- radio was full with that shit in the 70s here...). It might be a trigger phrase for a sleeper terrorist, much like in that Bronson movie... but most likely it's just spam confirming your address :-)
    – Damon
    Aug 5, 2015 at 19:50

2 Answers 2

123

This is spam -- but possibly the spammer was not very good at spamming.

The '=EA' bits are Quoted-Printable, an encoding for bytes into ASCII characters. '=EA=85=9F' thus stands for bytes of values 0xEA, 0x85 and 0x9F, in that order; this is the UTF-8 encoding for 'ꅟ' (that's U+A15F YI SYLLABLE NDEX, one of the symbols of Yi script). Whoever sent that email hopes that your mail reader software will not include a Yi font, and thus display the character as a space.

The point of using such symbols is to try to confuse antispam filters: the filter may try to react on the sentence "It's xxx by the way" (for random names instead of "xxx"); the extra characters may make this filter fail. Chances are that the spam, being sent by the million, will use random characters from unusual sets (like Yi glyphs). The random words ("fiddle", "armpits"...) serve the same purpose: to evade detection, especially by Bayesian spam filters. Note that the extra words are "hidden" in the HTML view, by being displayed with a very small font and with the same colour as the background.

All of this is very spammish, and since your spam filter let the mail flow, then the spammer actually won this round: his evasive maneuvers worked, and your spam filter was defeated.


Now, what can be the point of all this ? The point of spam is to trigger some reaction from the spammee. This can be "clicking on a link" but it could also be "send an email in response". I can make several conjectures:

  • It has been pointed out (e.g. in this study) that the business model of most spammers requires pinpointing stupid people. For the spammer, sending out millions of spams costs about nothing; however, when a spammee answers, a human agent of the spammer must read and respond, and there things become very expensive for the spammer. Thus, what the spammer really wants is that the few people who actually get hooked on the initial spam will be ready to believe the most fantasmagorical stories.

    Along that hypothesis, the spam you received might be a way to find the people who are dumb enough to believe that the sender is really named Shawn, and are ready to talk to Shawn.

  • Spammers are (technically) human beings, with all the flaws that this entails. The spammer uses a spamming tool but may be bad at using it. I often receive spams that greet me as "Hello %RANDUSER", an occurrence that can only be explained by a spammer who should be reading the documentation for his spamming tool.

8
  • 2
    Wow! Thank you very much! Maybe google filtered something out, as I didn't get any link to click on! So the spammers made it in my inbox but they will not benefit from it.
    – puhubear
    Aug 3, 2015 at 18:57
  • 9
    @puhubear: Google does not, as far as I know, modify the contents of email. It either gets filed as spam or it doesn't. Aug 3, 2015 at 21:52
  • 11
    @R.. if google thinks the email is a phishing email it disables links and makes you read a message about how dangerous clicking a link is before re-hyperlinking. But the words of the email remain the same, the <a> tag is just disabled.
    – Jon
    Aug 3, 2015 at 23:08
  • 3
    @Chipperyman Doesn't it also disable other content, like loading images?
    – jpmc26
    Aug 4, 2015 at 4:25
  • 2
    @jpmc26 IIRC they stopped doing it once they started caching the images and displaying them from their servers. May be wrong though.
    – Jon
    Aug 4, 2015 at 5:20
22

This email is most definitely spam (unless you know the sender and/or solicited this mail). Those odd strings are obfuscation techniques, which are a telltale sign of spam. See Tom Leek's answer for more information on that.

There are three possible explanations for this email:

  1. It's an attempt to get you to respond; threads build psychological trust and can better set up scams
  2. It is an attempt at messing up your filters (e.g. Bayesian poisoning ... which doesn't work)
  3. The spammer messed up and forgot the payload

I'm leaning on it being both #1 and #2.

(Nice fonts in there! font-family: Unfeignedly, Gascony, Pancakes, great fodder for a good Bayesian tokenizer to pick up on.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .