Are these weird emails spam without content?

Question

Since this morning, I have received on my professional address myfirstname@mycompany.com (that usually receives very few emails, between 3 and 5 a days) three strange messages:

First message:

sender: ***@yahoo.com
subject: test
content: Sent from Yahoo Mail!

Second message:

sender: ***@yahoo.in
subject: None
content: Verifications 16316 6 16 1 11 1

Third message:

sender: ***@outlook.com
subject: Verification-2109GEds145
content: Verification Purpose only sdfsdf4
d

I am guessing that my professional address has somehow gotten in the cloud, but what is the purpose of these repeating emails that I receive? Is it spaming stage 1, where senders are veryfying that my email address is not bouncing?

How can I:

• know the purpose of these emails - are they just spam or is it something I should be more scared about?

• try to prevent or correct my receiving of such emails?

PS : the X-Original-To and Delivered-To addresses are myfirstname@mycompany.com, but i see no address in the "To" field that displays in my email client

Answer 1

Empty emails could mean several things:

1. The sender is attempting to maintain or grow a database of emails that are legitimate spammable addresses. Any address that doesn't respond with a no-such-user error is implicitly valid - even with a margin of error for the volume of email addresses being collected.
2. There is malicious content in the email, which is stripped from the email by a spam filter - but this means that the spam filter you use is OK with sending you an empty email.
3. Spammers make mistakes too - remember how terrible you feel after you forget to include attachments.

Answer 2

Garrett C. has identified few reasons that might have led to these spams, but to answer your questions:

1. You can never know for sure what the spammer want. You can try to guess, but you don't really need to know the intents, as long as you don't fall for it or you block it. The risks are low, unless you start downloading and executing files or initiate a process with the spammers. The awareness of the user is the best protection against spam. You still need to be wary of targetted spam (spear-phishing) since you can think that the sender is trustworthy.

2. You don't really need to personally prevent the spam if you're able to spot it. The only downside is that it's annoying. On the other end, there could be a need to prevent the spam in a context where the mail users are unfamiliar with computers (big enterprises).

To prevent the spam, you (or the person with the responsibility) can setup a spam filtering environment. You can do it yourself or you could use one of the many professional cloud filtering services to filter your emails, which would probably give better results.

In conclusion, you don't have to fear the spam if you're aware of it. Protection might be necessary in environment with unfamiliar users.

Good lectures: Email spam, Email filtering.

Protection tools and processes examples: SpamAssassin, DKIM, DMARC, SPF, Greylisting

Answer 3

Typically if there is a spam message from a strange sender that has no or little content, it is a "recon" message to try to see if you will react or respond (I've seen things as simple as "sorry, wrong address, ignore this email"). Simon is definitely right, user awareness is the best defense against email attacks or spam. You are in no danger if you don't click on anything in the message and delete/block sender.

Depending on the size of your company, it might have a spam email address or infosec team who looks at emails. You can contact a member of that team or, better yet, there may be an address to forward spam/phishing emails (probably the best option). This way, they can not only determine if it is a legitimate email, but also make sure that the sender is blocked in the company's mail filters if it is spam so no one else receives similar messages.

Also, if you want to look deeper, try analyzing the header and check the source domain of the message (the mail server it was sent from). Yahoo's should say something to the tune of <[long string]@mail.yahoo.com>. Outlook's should be similar with something like <[long string]@something.prod.outlook.com>. If there's something different, it's one indicator that it was a spam or phishing email (could be spoofed). Careful, though