Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP addresses ( and belong to Avast according to whois. I received this through my own Postfix SMTP server.

I can think of only two explanations:

  1. Avast is spamming people to increase its user base (unlikely?)
  2. Someone else registered using my email address (accidentally?)

Is there an alternate explanation I missed?

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
X-Greylist: delayed 00:06:20 by SQLgrey-1.8.0
Received: from prg18.ff.avast.com (prg18.ff.avast.com [])
    by helios.redacted.com (Postfix) with ESMTP id 29FDE338513
    for <[email protected]>; Tue, 24 Feb 2015 16:31:39 +0000 (UTC)
Received: from ams01-022.ff.avast.com (ams01-022.ff.avast.com [])
    by prg18.ff.avast.com (Postfix) with ESMTP id 4AC4863FE
    for <[email protected]>; Tue, 24 Feb 2015 17:25:18 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=avast.com;
    s=default; t=1424795118;
Received: from ams01-022.ff.avast.com (localhost [])
    by ams01-022.ff.avast.com (Postfix) with ESMTP id 2EE47120243
    for <[email protected]>; Tue, 24 Feb 2015 17:25:18 +0100 (CET)
Date: Tue, 24 Feb 2015 17:25:18 +0100 (CET)
From: AVAST Software <[email protected]>
To: [email protected]
Message-ID: <2116255645.5085975.1424795118191.JavaMail.id@ams01-022.ff.avast.com>
Subject: =?utf-8?Q?Avast_antivirus_account_=E2=80=93_please_confirm?=
MIME-Version: 1.0
Content-Type: multipart/mixed; 

Content-Type: multipart/alternative; 

Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<!DOCTYPE html  PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www=
<html xmlns=3D"http://www.w3.org/1999/xhtml" xml:lang=3D"cs" lang=3D"cs">
=09<meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf-8"=
=09<div style=3D"padding-bottom:5px;"></div>You recently registered an AVAS=
T Account. <br/><br/> Please click this link to verify your account: <br/><=
br/> <a href=3D"https://id.avast.com/en-us/confirm/registration?token=3DN1r=
FTE1T</a> <br/><br/> NOTE: Information email only =E2=80=93 PLEASE DO NOT R=
EPLY <br/><br/>AVAST Software<div style=3D"padding-top:5px;"><a href=3D"htt=


Here's the SMTP transaction log:

Feb 24 16:25:19 helios postfix/smtpd[28347]: connect from prg18.ff.avast.com[]
Feb 24 16:25:19 helios sqlgrey: grey: new: 77.234.40(, [email protected] -> [email protected]
Feb 24 16:25:19 helios postfix/smtpd[28347]: NOQUEUE: reject: RCPT from prg18.ff.avast.com[]: 450 4.7.1 <[email protected]>: Recipient address rejected: Greylisted for 5 minutes; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<prg18.ff.avast.com>
Feb 24 16:25:19 helios postfix/smtpd[28347]: disconnect from prg18.ff.avast.com[]
Feb 24 16:28:39 helios postfix/anvil[28329]: statistics: max connection rate 2/60s for (smtp: at Feb 24 16:23:23
Feb 24 16:28:39 helios postfix/anvil[28329]: statistics: max connection count 2 for (smtp: at Feb 24 16:23:23
Feb 24 16:28:39 helios postfix/anvil[28329]: statistics: max cache size 1 at Feb 24 16:23:22
Feb 24 16:31:38 helios postfix/smtpd[28367]: connect from prg18.ff.avast.com[]
Feb 24 16:31:39 helios sqlgrey: grey: reconnect ok: 77.234.40(, [email protected] -> [email protected] (00:06:20)
Feb 24 16:31:39 helios sqlgrey: grey: from awl: 77.234.40, [email protected] added
Feb 24 16:31:39 helios postfix/smtpd[28367]: 29FDE338513: client=prg18.ff.avast.com[]
Feb 24 16:31:39 helios postfix/cleanup[28370]: 29FDE338513: message-id=<2116255645.5085975.1424795118191.JavaMail.id@ams01-022.ff.avast.com>
Feb 24 16:31:39 helios postfix/qmgr[13941]: 29FDE338513: from=<[email protected]>, size=2691, nrcpt=1 (queue active)
Feb 24 16:31:39 helios postfix/smtpd[28367]: disconnect from prg18.ff.avast.com[]
Feb 24 16:31:39 helios postfix/local[28371]: 29FDE338513: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=0.3, delays=0.26/0.03/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)
Feb 24 16:31:39 helios postfix/qmgr[13941]: 29FDE338513: removed
  • 9
    I'd vote for "Someone else registering using your email".
    – Ángel
    Feb 24, 2015 at 17:10
  • 1
    When you see hoofprints in the mud, think "horses" not "zebras". Someone mistakenly used your email address when they registered.
    – schroeder
    Feb 24, 2015 at 19:31

1 Answer 1


Someone may just want to fill up your inbox with annoying messages from legitimate and verified companies, but if this were the case you'd see a lot more emails.

Attackers may also be trying to test you to determine how likely you are to click on links with no legitimate basis to determine potential for future phishing attacks. For instance, if they can determine on the Avast website whether an account has been verified or not (e.g., they go to log in and receive and error because the email was not verified) then they will know you are more likely to blindly click on links.

We cannot know for sure, but there are motives for spam other than attacking you as the victim.

Avast may be the target of the attack if someone is going around and signing up random email addresses to their services. This is all theoretical, but I thought might be interesting for future site visitors:

  • Attackers want you to mark the Victim Company's emails as spam so that legitimate Avast messages never reach your inbox in the future if they are needed or they want people to report it as spam to mail providers so that the servers get blacklisted or penalized in some way

  • Competitors or attackers want to damage the Victim Company's reputation for sending out unsolicited and confusing emails.

  • Attackers want to inundate support/contact with emails from confused users so that way there is a lot of volume and backlog before they begin a real attack (i.e., consume human resources so they are less able to respond to the attack)

  • For a company sending out email at volume, there may be material financial cost. If you can make them waste resources sending out emails, it could cause them to waste server resources, require more fees for whitelisting services, etc.

  • Looks incomplete ... Feb 24, 2015 at 19:03
  • You are attributing a lot of malicious intent to a single email, when a simple explanation is that a legitimate Avast user mistyped their email address when they registered their product.
    – schroeder
    Feb 24, 2015 at 19:33
  • @schroeder I prefaced it by saying its theoretical, which I think has some future value for people happening across this. I think the general issues is more worth discussing then the one off incident.
    – Eric G
    Feb 24, 2015 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .