2

Today I received a very suspicious email on my gmail account. When I analyzed the content of the message, this is what essentially made up the message.

<center>
<a   alt="" src="sdfqdfsdfdfsdfsdfsfdfs" id="wzjlcoizurxciacwhxco"     class="fsgfgsdfgdgdfgfdgdfgfgsdf" href="" href=" /1842260810    /vyx587xse262622a59f1134f720:454850094g705" type="text/html"><font     color="#00000" size="5" face="COMIC">Is_This_Really_Me?</font><br><br>
</a><br/><br/><br/>
<a   alt="nyljirqulccpodexwgiy" src="sdfqdfsdfdfsdfsdfsfdfs"     id="wzjlcoizurxciacwhxco" class="fsgfgsdfgdgdfgfdgdfgfgsdf" href="" href="     /1842260810/vyx587xse262622a59f1134f721:454850094g705" type="text/html">
<Img                src="" id="fdgfgsdfgdfgdfsgdfgdf" alt=""     class="dsfsdfsfdfsfdfsfdfsfdfgqzrbhzez"  type="text/html"  style="font-    size:15;">
_Remove_Me_
</a>
<Img                src=" /1842260810    /vyx587xse262622a59f1134f722:454850094g705" id="fdgfgsdfgdfgdfsgdfgdf"     style="width:1PX;height:1PX" >
</center>

Can someone explain what exactly is going on here, especially the link tags. Where exactly does the href attribute point too, or better yet, it doesn't look like a host name, or an IP address.

How would I be able to SAFELY analyze where the links leads too and what do they do?

I am running Fedora Linux. If there is any malicious code, how could I safely see what exactly is going on here?

Improve this question
3
  • It looks like a fuzzed email, and looking at the "fdsfdsfs" sequence (letters close together on a keyboard), it may even be created manually.
    – ndrix
    May 14, 2014 at 4:19
  • It seems to be a spam. Spammers are sending sometimes not only simple spam, but this thrash as well.
    – Milkman
    May 14, 2014 at 8:10
  • I think there is a little bit more in the background as well. Their reason to send this is maybe to poison spam filters.
    – peterh
    May 14, 2014 at 8:11

1 Answer 1

Reset to default
2

I think it is some type of inverse spam filter poisoning. They are sending mails which seems not to be spam (and contains none of their viagra etc. marketing).

The bayesian spam filters are checking the distribution of words to categorize mails.

After they sent out a lot of mails containing only their "words", and classified as not-spam, they could use these words to seem their spam as normal mails as well.

I am thinking about a secondary trick:

This mail contains images, and nothing really spammy, only some trash. Google doesn't show mails by default, but you can click a "show images" or like button to show them. If you do this, the images will be downloaded from their external site. If the image url contains some type of identification string, on the server side will be shown, which users opened the mails really. This information helps the spammers to better organize their targets (they could find the last people on the world who until now opens spam).

Improve this answer
4
  • 2
    Gmail automatically display images nowadays through their own proxy servers. Although the proxy servers will protect user IP information, still in the case where the spammer is only interested in whether the email made it to inbox or not, it will readily provide the information when the email is opened by the user.
    – void_in
    May 14, 2014 at 11:50
  • @void_in Thank you the extension! Maybe it didn't happen if google loaded every image through its proxies, but shown them only on the click of the user.
    – peterh
    May 14, 2014 at 11:52
  • That would require Google to admit that they read every email on their servers!.
    – void_in
    May 14, 2014 at 11:56
  • @void_in Microsoft does the same, if you type in an url into skype, the bing crawlers will try to get it in minutes. And only sysadm people see that.
    – peterh
    May 14, 2014 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .