What is the intended attack vector of this email?

Question

I received this email in my inbox:

It seems innocuous enough and the source of the message tends to confirm this:

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: by quickmediasolutions.com (Postfix, from userid 117)
    id 1DBEB3F466; Fri, 17 Mar 2017 01:32:56 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
    mail.quickmediasolutions.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.7 required=5.0 tests=BAYES_60,RCVD_IN_BRBL_LASTEXT,
    RDNS_NONE,SPF_HELO_PASS,SPF_PASS autolearn=no autolearn_force=no version=3.4.1
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=201.197.252.218; helo=retinaljessicandis.info; [email protected]; [email protected] 
Received: from retinaljessicandis.info (unknown [201.197.252.218])
    by quickmediasolutions.com (Postfix) with ESMTP id 44D3B3F303
    for <[email protected]>; Fri, 17 Mar 2017 01:32:53 +0000 (UTC)
Message-ID: <[email protected]>
Date: Fri, 17 Mar 2017 02:32:58 +0100
From: "Nina" <[email protected]>
X-Accept-Language: en-us
MIME-Version: 1.0
To: <[email protected]>
Subject: Hi
Content-Type: text/plain;
    charset="us-ascii"
Content-Transfer-Encoding: 7bit

Good luck :)

Based on the information shown above, I have come to the following conclusions:

• The SPF test passed, confirming that the IP address my mailserver received the message from is authorized to send emails for that domain.

• The message does not appear to contain any malware — no JavaScript (it isn't even a multipart message) and no attachments of any sort.

• The message doesn't contain any links or URLs.

Am I missing an attack vector here? Is this an attempt at phishing? If so, what is it that I am supposed to be tricked into doing?

Answer 1

Such question merely asks for opinions as only the sender really knows his own intent, other people can only guess.

I suppose that in your question you kept the real email address: [email protected]. It is an interesting one which can be divided in two parts:

• admin: this is a common word appearing on the top of most usernames lists and frequently used for email addresses. Not only this username is common, but it is sometimes linked to a mailing list targeting several humans at once (as many chances for a malicious payload to be opened), this is just bonus, and humans with administrative privileges on whatever they are using, this is the cherry on the cake.
• quickmediasolutions.com: this is just a working domain name, they are plenty of ways to get large lists of working domain names.

To me, but this is my personal guess, the attacker is sending the same innocuous email to admin@<domain> (at least, I expect other names such as webmaster to be also targeted) to the widest range of domain names possible. Using such an harmless email is the safest way to avoid spam filters to alter the results in any way.

From there all the domains tried will in one of these categories:

• Those who rejected the email with an SMTP 550 Invalid Recipient message, they will most likely be left out as not being low hanging fruits.
• Those who accepted the email, they will earn their ticket to the next step in the attacker's agenda.

What does this next step contains? Here again, only the attacker (or the people hiring him) may know. Maybe the goal is just to constitute a list and sell it, maybe the goal is to directly use this list and try to send some malicious payloads, maybe both...

Anyway, the idea is that such emails is most likely not meant to carry any malicious payload by itself, but is just a low-cost probe to sort targets on a wide scale.

Answer 2

I can think of 2 possibilities

1. fishing for email addresses to spam (fishing in the old sense)
2. potential spear-phishing attack, starting off innocuous, followed by a malcious attachment

either way, best to ignore

Answer 3

One possibility is that this is just a hook to tempt you to reply and then scam you later on down the line.

Social engineers pray on things like natural human curiosity.

Using a method like this has the added benefit of only the people who are more likely to be tempted and therefore more likely to be scammed actually replying to the email in the first place.

Similar to the self-selected methodology used by purveyors of the Nigerian Prince scams.

The self-selecting methodology is described in this Microsoft Paper from 2012

Answer 4

Hard to say... It could be an innocent Nina that just wanted to say good luck to a friend of her and simply used a wrong address. Or a not so innocent Nina that for private reasons would like to know more about you (are you single? ;-) ).

But more likely it is an innocent looking mail that tries to validate a mail addresses list and identify which ones could get an answer when the payload will be not so innocent. Or tries to identify what kind of mail will be able to pass through SPAM and malware filters.

IMHO, you should not answer such a mail, unless you can guess who is Nina.

Answer 5

Probably just an attempt to validate email addresses. If they do not get a bounce back, the email is valid.