I just got spam that in its entirety said: "Hi, don't forget about all my tasks." It's in plain text; there is no hidden content. Fake sender with my domain name, using a name that I do not have in my previous collection of spam. (I save it all for a month, in case of filter mismatches and some amount of morbid curiosity.) What could be the possible angle here?
Return-Path: <[email protected]> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on example.edu X-Spam-Status: No, score=2.3 required=5.0 tests=BAYES_05,BOGO_T25_HAM, FSL_HELO_NON_FQDN_1,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_BRBL_LASTEXT, RDNS_NONE,SPF_FAIL,TO_EQ_FM_DOM_SPF_FAIL,TVD_RCVD_SINGLE autolearn=no autolearn_force=no version=3.4.0 X-Spam-Level: xx X-Original-To: [email protected] Delivered-To: [email protected] Received: from KVKRYIUZS (unknown [188.8.131.52]) by example.example.org (Postfix) with ESMTP id 2F21785E4E11 for <[email protected]>; Mon, 9 Jan 2017 12:49:11 -0500 (EST) Message-ID: <[email protected]> Date: Tue, 10 Jan 2017 01:16:51 +0800 From: Jacob Lamothe <[email protected]> User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: [email protected] Subject: Hello from Lamothe Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi, don't forget about all my tasks. Thanks.
That's it — no other message parts. I replaced my domain with
example.org. All of the
X- headers are legit and from my own system. The "Return-Path" envelope header is interesting, as a quick search sees that implicated in several phishing attacks.
I do have a couple of other messages with that same Return-Path. They are virtually identical, and look like:
Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: from 80.red-80-34-69.staticip.rima-tde.net (80.red-80-34-69.staticip.rima-tde.net [184.108.40.206]) by example.example.org (Postfix) with ESMTP id 10B988048645 for <[email protected]>; Thu, 22 Dec 2016 17:23:33 -0500 (EST) Received: from [220.127.116.11] (port=28899 helo=[10.0.4.34]) by 18.104.22.168 with asmtp id 1rqLaL-000MX-00 for [email protected]; Thu, 22 Dec 2016 22:50:38 +0100 Message-ID: <[email protected]> Date: Thu, 22 Dec 2016 22:50:38 +0100 From: Fax Scanner <[email protected]> MIME-Version: 1.0 To: [email protected] Subject: You have recevied a message Content-Type: multipart/mixed; boundary="------------050107040507000606080309" This is a multi-part message in MIME format. --------------050107040507000606080309 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit You have received a message on efax. Please download and open document attached. Scanner eFax system. --------------050107040507000606080309 Content-Type: application/zip; name="Message efax system-5733.zip" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Message efax system-8631.zip" [removed] --------------050107040507000606080309
User-Agent in the second, etc. And the came several weeks before the one above. I definitely understand what the fake scans are all about — but if they connect to the message above, I can't see how.