[anti-abuse-wg] What's the point in this type of spam ?

On Sat, 19 Nov 2016 19:01:43 +0100
peter h <peter at hk.ipsec.se> wrote:
> The last days i have been sent a number of these threats, they come
> from different addresses ( stolen computers ) but contain no links or
> attatchements.
> Is the goal to harass the gmail user ( it's munged by me to protect
> an innocent person )
>

There is not a single one of the trillions of spams that are senseless.

All spam has a reason to exist and no spam is ever senseless - not even
a single one...

There are a few goals with your spam as it is rich with possibilities.
The vast majority of spam only has a singular goal and your spam is
rich in possibilities :)

The most obvious is to confuse/poison (some/basic) anti spam systems:
> Received: from 14.145.207.224 ([113.68.244.108])
> Received: from unknown (HELO localhost)
> (mark.silberman78 at gmail.com@177.205.66.120) by 113.68.244.108

My software handles any headers that deviate from the expected with extreme care
as there are only a limited number of reasons why headers are different than expected 

Other goals (and their are many with your example of Shotgun spam
(named after shotgun weddings) 

Goals may be to solicit a relationship with victims, cyber criminals are finding 
it more challenging to open dialog and engage with shotgun victims

It may be to target the @gmail account holder, to receive spam that
Google will allow as it will be from other victims (think denial of
service or just to attack/assault a gmail account holder)

and of course many other reasons

hth

andre

 

> 
> Received: from 14.145.207.224 ([113.68.244.108])
> 	by ipsec.se (8.13.6/8.13.6) with SMTP id uAILTOwC091474
> 	for <peter at ipsec.nu>; Fri, 18 Nov 2016 22:29:32 +0100 (CET)
> Message-Id: <201611182129.uAILTOwC091474 at ipsec.se>
> Received: from unknown (HELO localhost)
> (mark.silberman78 at gmail.com@177.205.66.120) by 113.68.244.108 with
> ESMTPA; Sat, 19 Nov 2016 05:29:22 +0800 From:
> m-**-.-munged-78 at gmail.com To: peter at ipsec.nu
> Subject: You are hacked!
> Date: Sat, 19 Nov 2016 05:21:56 +0800
> Content-Type: 
> X-UID: 5404
> X-Length: 910
> 
> Your email peter at ipsec.nu has been hacked and spam is sent to all
> your contacts! If you don't have a lawyer, you may contact me at 
> <munged>@gmail.com
> 
> Best Regards,
> M**-
> m**-.-munged-78 at gmail.com
>