68

A mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ...

=EA=85=9F =EA=8F=92

who benefits how? no links nothing else in this email.

screenshot from email in browser

Delivered-To: my@email.com
Received: by 10.28.158.140 with SMTP id h134csp1731559wme;
        Mon, 3 Aug 2015 04:22:13 -0700 (PDT)
X-Received: by 10.55.41.195 with SMTP id p64mr24023265qkp.5.1438600933481;
        Mon, 03 Aug 2015 04:22:13 -0700 (PDT)
Return-Path: <donallsutherland@yahoo.com>
Received: from nm38-vm9.bullet.mail.bf1.yahoo.com (nm38-vm9.bullet.mail.bf1.yahoo.com. [72.30.239.25])
        by mx.google.com with ESMTPS id j34si16595518qkh.82.2015.08.03.04.22.12
        for <my@email.com>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Mon, 03 Aug 2015 04:22:13 -0700 (PDT)
Received-SPF: pass (google.com: domain of donallsutherland@yahoo.com designates 72.30.239.25 as permitted sender) client-ip=72.30.239.25;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of donallsutherland@yahoo.com designates 72.30.239.25 as permitted sender) smtp.mail=donallsutherland@yahoo.com;
       dkim=pass header.i=@yahoo.com;
       dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1438600932; bh=2Le9dnlRHEHV2DHi6g9XBTAZHFuEvLsr8SjC/C2a2+Y=; h=Date:From:Reply-To:To:Subject:From:Subject; b=ab5c6U0O35AE1JHNL7n1OB10kVvCjIPh5ilkWw5ct2nWs6w4b9CSkyaBQKibdqI3gbQB+NQo8/FINRQMjloHxunlRa91MRWQEZ48S3EUOH65D4b7tVMyfs4pB+VSJb/8ohLwDFs0nFS5V9S55M1DD3o+WqLOkwb49ijxE8J9enDY8jtLWaJ7RZ794nZcvRH3a3Y4r31Y3zahRUVmKQKc2vvPDOrEbncmu2PEJOhcJEELTQcc1MXtaVWHzspmyPZBuBVzvd4cvvYStguk7p5UL9kvyLWG3ZyhaPyDGfbt0egQcFropcb6Xw3ttdikVlC7YYVipZUgzp/IzajFZks6jw==
Received: from [66.196.81.170] by nm38.bullet.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
Received: from [98.139.212.241] by tm16.bullet.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
Received: from [127.0.0.1] by omp1050.mail.bf1.yahoo.com with NNFMP; 03 Aug 2015 11:22:12 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 627932.61631.bm@omp1050.mail.bf1.yahoo.com
X-YMail-OSG: V0Jf1mgVM1nboRi87_16P3wYo7hVU_Wr4wYa8QonNjb6jD1sZDPz1QMe5617lEj
 .KTslKteP6Aay2J5FC1JdWzUFlVlqBbvFsFsuumiJcZNTt05csrlKh1v3H5Gzb0ArIimMooZB3WF
 V4xucEAi6v6l.Dx4G6r66fHLgmvW_3nukrV5HBBj49nHgUkd6ZWNWvVJ..pnsjI3WTLyo_B3PKTC
 tvyVuliPBVKPv4oDLkFbiAcS6czdirjBw04SDlyXyz6zVVvgyrFQx8Jxu7Z0yEfA18KRNWlrn4kd
 Ozgpri8uHm.hdcj.DYlF5lVANlBACmDfsboQOL9Ma69nsNeWvRGVoDrxYGsXCfOT13yAfXLLdf_c
 KwEOEIXQcfnWY5tWHHqhLPaEJM36vGb7PrSVPjbGFvuGxO.a66wkphgI_Gn3rcXkXGBluiVveg5O
 _KFt15xpsEM1nd7kvyyBo2M2GJn_A_GuD_0KNoPKrk8Gtorh9Z7TdSW.0WtU80P8m6vsRydyp2u9
 7H14-
Received: by 76.13.27.197; Mon, 03 Aug 2015 11:22:12 +0000 
Date: Mon, 3 Aug 2015 11:22:11 +0000 (UTC)
From: Shawn <donallsutherland@yahoo.com>
Reply-To: Shawn <lvizzhgyrbpjoyce@yahoo.com>
To: <removed to protect privacy>
Message-ID: <16559779.120231.1438600931851.JavaMail.yahoo@mail.yahoo.com>
Subject: fdihkesdhlffljrks djssldhfvkljdelsfkah
MIME-Version: 1.0
Content-Type: multipart/alternative; 
    boundary="----=_Part_120230_1658237110.1438600931848"
Content-Length: 1531

------=_Part_120230_1658237110.1438600931848
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

dolomite fiddle armpits moribunditygNIt's=EA=85=9FShawn=EA=80=BCby=EA=8F=92=
the=EA=87=91way.famished nonsalaried artichokes deadlockingAaI'm=EA=87=8Bex=
cited=EA=8D=BEabout=EA=91=8Fyour=EA=89=AFanswer))symbiotes perspire
------=_Part_120230_1658237110.1438600931848
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"background-color:#ccdd15;display:block;color:#ccd=
d15;"><div style=3D"font-family: Unfeignedly, Gascony, Pancakes;font-size:5=
px;">dolomite fiddle armpits moribundity<div>gN<div style=3D"font-size:20px=
;color:#455e81;display:inline-block">It's</div>=EA=85=9F<strong style=3D"fo=
nt:20px normal;color:#455e81">Shawn</strong>=EA=80=BC<div style=3D"color:#4=
55e81;font-size:20px;display:inline-block">by</div>=EA=8F=92<em style=3D"fo=
nt:20px normal;color:#455e81">the</em>=EA=87=91<em style=3D"font:20px norma=
l;color:#455e81">way.</em></div>famished nonsalaried artichokes deadlocking=
<div>Aa<i style=3D"color:#455e81;font:20px normal">I'm</i>=EA=87=8B<span st=
yle=3D"color:#455e81;font-size:20px">excited</span>=EA=8D=BE<big style=3D"f=
ont-size:20px;color:#455e81">about</big>=EA=91=8F<strong style=3D"font:20px=
 normal;color:#455e81">your</strong>=EA=89=AF<i style=3D"color:#455e81;font=
:20px normal">answer))</i></div>symbiotes perspire</div></div></body></html=
>
------=_Part_120230_1658237110.1438600931848--
  • 4
    Why don't you reply (perhaps from a disposable email account) and see what happens? – Brice M. Dempsey Aug 4 '15 at 6:04
  • 17
    @JamesT.Huggett: Because that is the purpose of the email? To see whether yours is in use. Replying is usually the worst thing you can do. – Lightness Races with Monica Aug 4 '15 at 10:53
  • 5
    I lolled at "Donall Sutherland" – Lightness Races with Monica Aug 4 '15 at 10:54
  • 8
    I, personally, would love to use the "Pancakes" font – Jason Aug 4 '15 at 17:47
  • 1
    Maybe the intent was to get you to post this on an internet site where it can be found via a Google search. It might only use the keywords to verify that your address is correct, or it might be a covert message (makes me think of the time when you could listen to spy messages on shortwave radio, they all went like this... "Ozelot to Ice Man: Pawn D4-E4, check" -- radio was full with that shit in the 70s here...). It might be a trigger phrase for a sleeper terrorist, much like in that Bronson movie... but most likely it's just spam confirming your address :-) – Damon Aug 5 '15 at 19:50
122

This is spam -- but possibly the spammer was not very good at spamming.

The '=EA' bits are Quoted-Printable, an encoding for bytes into ASCII characters. '=EA=85=9F' thus stands for bytes of values 0xEA, 0x85 and 0x9F, in that order; this is the UTF-8 encoding for 'ꅟ' (that's U+A15F YI SYLLABLE NDEX, one of the symbols of Yi script). Whoever sent that email hopes that your mail reader software will not include a Yi font, and thus display the character as a space.

The point of using such symbols is to try to confuse antispam filters: the filter may try to react on the sentence "It's xxx by the way" (for random names instead of "xxx"); the extra characters may make this filter fail. Chances are that the spam, being sent by the million, will use random characters from unusual sets (like Yi glyphs). The random words ("fiddle", "armpits"...) serve the same purpose: to evade detection, especially by Bayesian spam filters. Note that the extra words are "hidden" in the HTML view, by being displayed with a very small font and with the same colour as the background.

All of this is very spammish, and since your spam filter let the mail flow, then the spammer actually won this round: his evasive maneuvers worked, and your spam filter was defeated.


Now, what can be the point of all this ? The point of spam is to trigger some reaction from the spammee. This can be "clicking on a link" but it could also be "send an email in response". I can make several conjectures:

  • It has been pointed out (e.g. in this study) that the business model of most spammers requires pinpointing stupid people. For the spammer, sending out millions of spams costs about nothing; however, when a spammee answers, a human agent of the spammer must read and respond, and there things become very expensive for the spammer. Thus, what the spammer really wants is that the few people who actually get hooked on the initial spam will be ready to believe the most fantasmagorical stories.

    Along that hypothesis, the spam you received might be a way to find the people who are dumb enough to believe that the sender is really named Shawn, and are ready to talk to Shawn.

  • Spammers are (technically) human beings, with all the flaws that this entails. The spammer uses a spamming tool but may be bad at using it. I often receive spams that greet me as "Hello %RANDUSER", an occurrence that can only be explained by a spammer who should be reading the documentation for his spamming tool.

  • 2
    Wow! Thank you very much! Maybe google filtered something out, as I didn't get any link to click on! So the spammers made it in my inbox but they will not benefit from it. – puhubear Aug 3 '15 at 18:57
  • 9
    @puhubear: Google does not, as far as I know, modify the contents of email. It either gets filed as spam or it doesn't. – R.. Aug 3 '15 at 21:52
  • 10
    @R.. if google thinks the email is a phishing email it disables links and makes you read a message about how dangerous clicking a link is before re-hyperlinking. But the words of the email remain the same, the <a> tag is just disabled. – Jon Aug 3 '15 at 23:08
  • 3
    @Chipperyman Doesn't it also disable other content, like loading images? – jpmc26 Aug 4 '15 at 4:25
  • 2
    @jpmc26 IIRC they stopped doing it once they started caching the images and displaying them from their servers. May be wrong though. – Jon Aug 4 '15 at 5:20
22

This email is most definitely spam (unless you know the sender and/or solicited this mail). Those odd strings are obfuscation techniques, which are a telltale sign of spam. See Tom Leek's answer for more information on that.

There are three possible explanations for this email:

  1. It's an attempt to get you to respond; threads build psychological trust and can better set up scams
  2. It is an attempt at messing up your filters (e.g. Bayesian poisoning ... which doesn't work)
  3. The spammer messed up and forgot the payload

I'm leaning on it being both #1 and #2.

(Nice fonts in there! font-family: Unfeignedly, Gascony, Pancakes, great fodder for a good Bayesian tokenizer to pick up on.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.