8

I received this email in my inbox:

It seems innocuous enough and the source of the message tends to confirm this:

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: by quickmediasolutions.com (Postfix, from userid 117)
    id 1DBEB3F466; Fri, 17 Mar 2017 01:32:56 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
    mail.quickmediasolutions.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.7 required=5.0 tests=BAYES_60,RCVD_IN_BRBL_LASTEXT,
    RDNS_NONE,SPF_HELO_PASS,SPF_PASS autolearn=no autolearn_force=no version=3.4.1
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=201.197.252.218; helo=retinaljessicandis.info; [email protected]; [email protected] 
Received: from retinaljessicandis.info (unknown [201.197.252.218])
    by quickmediasolutions.com (Postfix) with ESMTP id 44D3B3F303
    for <[email protected]>; Fri, 17 Mar 2017 01:32:53 +0000 (UTC)
Message-ID: <[email protected]>
Date: Fri, 17 Mar 2017 02:32:58 +0100
From: "Nina" <[email protected]>
X-Accept-Language: en-us
MIME-Version: 1.0
To: <[email protected]>
Subject: Hi
Content-Type: text/plain;
    charset="us-ascii"
Content-Transfer-Encoding: 7bit

Good luck :)

Based on the information shown above, I have come to the following conclusions:

  • The SPF test passed, confirming that the IP address my mailserver received the message from is authorized to send emails for that domain.

  • The message does not appear to contain any malware — no JavaScript (it isn't even a multipart message) and no attachments of any sort.

  • The message doesn't contain any links or URLs.

Am I missing an attack vector here? Is this an attempt at phishing? If so, what is it that I am supposed to be tricked into doing?

5
  • Replying perhaps?
    – Luke Park
    Mar 23, 2017 at 4:50
  • Now I am curious. I'm tempted to reply just to find out... Mar 23, 2017 at 4:55
  • 5
    It could be a test run for a later spam campaign but who knows. I definitely wouldn't reply tho.
    – nd510
    Mar 23, 2017 at 5:05
  • 5
    They may simply want to get you curious so they can get you to go to their domain website and then attack your browser. Or this is a watering-hole attack and you are attacking stackexchange users. B-) Mar 23, 2017 at 5:08
  • 4
    I'd also guess it's an attempt to start a conversation and then pull the real scam.
    – Arminius
    Mar 23, 2017 at 7:28

5 Answers 5

10

Such question merely asks for opinions as only the sender really knows his own intent, other people can only guess.

I suppose that in your question you kept the real email address: [email protected]. It is an interesting one which can be divided in two parts:

  • admin: this is a common word appearing on the top of most usernames lists and frequently used for email addresses. Not only this username is common, but it is sometimes linked to a mailing list targeting several humans at once (as many chances for a malicious payload to be opened), this is just bonus, and humans with administrative privileges on whatever they are using, this is the cherry on the cake.
  • quickmediasolutions.com: this is just a working domain name, they are plenty of ways to get large lists of working domain names.

To me, but this is my personal guess, the attacker is sending the same innocuous email to admin@<domain> (at least, I expect other names such as webmaster to be also targeted) to the widest range of domain names possible. Using such an harmless email is the safest way to avoid spam filters to alter the results in any way.

From there all the domains tried will in one of these categories:

  • Those who rejected the email with an SMTP 550 Invalid Recipient message, they will most likely be left out as not being low hanging fruits.
  • Those who accepted the email, they will earn their ticket to the next step in the attacker's agenda.

What does this next step contains? Here again, only the attacker (or the people hiring him) may know. Maybe the goal is just to constitute a list and sell it, maybe the goal is to directly use this list and try to send some malicious payloads, maybe both...

Anyway, the idea is that such emails is most likely not meant to carry any malicious payload by itself, but is just a low-cost probe to sort targets on a wide scale.

3

I can think of 2 possibilities

  1. fishing for email addresses to spam (fishing in the old sense)
  2. potential spear-phishing attack, starting off innocuous, followed by a malcious attachment

either way, best to ignore

3

One possibility is that this is just a hook to tempt you to reply and then scam you later on down the line.

Social engineers pray on things like natural human curiosity.

Using a method like this has the added benefit of only the people who are more likely to be tempted and therefore more likely to be scammed actually replying to the email in the first place.

Similar to the self-selected methodology used by purveyors of the Nigerian Prince scams.

The self-selecting methodology is described in this Microsoft Paper from 2012

2
  • 2
    Usually the attacker pretends to offer something the target may desire under one form or another (mainly love, money or work, values gladly shared by most of the humanity). One of the best example I know of what you say is the ILOVEYOU worm: even people who do not expect to receive a love letter and think it was sent by mistake to the wrong recipient are still tempted to open it... Mar 23, 2017 at 16:32
  • 1
    Yes, it isn't exactly the same, but one possibility is that philosophy is similar. Mar 23, 2017 at 16:34
2

Hard to say... It could be an innocent Nina that just wanted to say good luck to a friend of her and simply used a wrong address. Or a not so innocent Nina that for private reasons would like to know more about you (are you single? ;-) ).

But more likely it is an innocent looking mail that tries to validate a mail addresses list and identify which ones could get an answer when the payload will be not so innocent. Or tries to identify what kind of mail will be able to pass through SPAM and malware filters.

IMHO, you should not answer such a mail, unless you can guess who is Nina.

1

Probably just an attempt to validate email addresses. If they do not get a bounce back, the email is valid.

4
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Steve
    Mar 23, 2017 at 19:33
  • @Steve - I think it does. However, it doesn't add anything new.
    – Vilican
    Mar 23, 2017 at 19:44
  • Didn't see Serge's answer that's why I answered
    – ventsyv
    Mar 23, 2017 at 22:35
  • Sorry, the text from Review is a bit stern. It was more so that the answer was a little lacking in detail and justification, and fit better as a comment.
    – Steve
    Mar 23, 2017 at 23:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .