Spam that's empty (like me)

Users from around the world continue to report numerous spam messages that don't actually advertise anything. The latest batch just contains a series of randomized words like, "dietary, denumerable cucumber."

The question comes up - can this even be called spam in the tradition of spam being unsolicited commercial email? Is it possible to tie the messages back to the same thugs who litter our inboxes with ads for fake watches?

Who is sending these messages and why?

One theory is that spammers are using the randomized messages to test deliverability. The problem with this notion is that most of the messages don't contain any kind of link, tracking image or other way to verify delivery.

Spammers could be sending test messages to determine if the address their sending from is blacklisted. By sending a test message to a server known to reliably bounce blacklisted addresses, they could find out before they waste a bunch of time sending from a host which most servers won't accept messages from. Again, there's a problem with this theory. Blacklists can easily be queried directly via DNS - so it wouldn't make a lot of sense for spammers to take this approach.

So what does that leave us with? Let's put on our aluminum hats for a moment and think outside the box.

Writing software to stop spam e-mail like this is extra difficult. There are no commercial buzzwords, images or links. There's almost nothing to detect. The only fallback would be to create an engine capable of distinguishing proper English grammar from a random sequence of words. This would also certainly result in massive false-positives.

These messages do have at least one clue. They seem to have a randomized "sending agent" field in their headers. Sometimes they claim to be sent using, Outlook Express build 6.00.3790.1158 and other times with build 6.00.2900.2969.

This is a trait shared with many spam campaigns. It would seem likely the software sending these messages is the same as the software behind many other normal spam emails.

The only way to get solid answers on this is if someone tracks one of these messages back to the machine that sent it. Even that may not result in all the answers.

Back