What is the purpose of these weird non-spam emails?

Question

A mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ...

=EA=85=9F =EA=8F=92

who benefits how? no links nothing else in this email.

Received-SPF: pass (google.com: domain of donallsutherland@yahoo.com designates 72.30.239.25 as permitted sender) client-ip=72.30.239.25;
Date: Mon, 3 Aug 2015 11:22:11 +0000 (UTC)
From: Shawn <donallsutherland@yahoo.com>
Reply-To: Shawn <lvizzhgyrbpjoyce@yahoo.com>
To: <removed to protect privacy>
Message-ID: <16559779.120231.1438600931851.JavaMail.yahoo@mail.yahoo.com>
Subject: fdihkesdhlffljrks djssldhfvkljdelsfkah
MIME-Version: 1.0
Content-Type: multipart/alternative; 
    boundary="----=_Part_120230_1658237110.1438600931848"
Content-Length: 1531

------=_Part_120230_1658237110.1438600931848
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

dolomite fiddle armpits moribunditygNIt's=EA=85=9FShawn=EA=80=BCby=EA=8F=92=
the=EA=87=91way.famished nonsalaried artichokes deadlockingAaI'm=EA=87=8Bex=
cited=EA=8D=BEabout=EA=91=8Fyour=EA=89=AFanswer))symbiotes perspire
------=_Part_120230_1658237110.1438600931848
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"background-color:#ccdd15;display:block;color:#ccd=
d15;"><div style=3D"font-family: Unfeignedly, Gascony, Pancakes;font-size:5=
px;">dolomite fiddle armpits moribundity<div>gN<div style=3D"font-size:20px=
;color:#455e81;display:inline-block">It's</div>=EA=85=9F<strong style=3D"fo=
nt:20px normal;color:#455e81">Shawn</strong>=EA=80=BC<div style=3D"color:#4=
55e81;font-size:20px;display:inline-block">by</div>=EA=8F=92<em style=3D"fo=
nt:20px normal;color:#455e81">the</em>=EA=87=91<em style=3D"font:20px norma=
l;color:#455e81">way.</em></div>famished nonsalaried artichokes deadlocking=
<div>Aa<i style=3D"color:#455e81;font:20px normal">I'm</i>=EA=87=8B<span st=
yle=3D"color:#455e81;font-size:20px">excited</span>=EA=8D=BE<big style=3D"f=
ont-size:20px;color:#455e81">about</big>=EA=91=8F<strong style=3D"font:20px=
 normal;color:#455e81">your</strong>=EA=89=AF<i style=3D"color:#455e81;font=
:20px normal">answer))</i></div>symbiotes perspire</div></div></body></html=
>
------=_Part_120230_1658237110.1438600931848--

Why don't you reply (perhaps from a disposable email account) and see what happens? — Brice M. Dempsey, Aug 04 '15 at 06:04
@JamesT.Huggett: Because that is the purpose of the email? To see whether _yours_ is in use. Replying is usually the worst thing you can do. — Lightness Races in Orbit, Aug 04 '15 at 10:53
Maybe the intent was to get you to post this on an internet site where it can be found via a Google search. It might only use the keywords to verify that your address is correct, or it might be a covert message (makes me think of the time when you could listen to spy messages on shortwave radio, they all went like this... _"Ozelot to Ice Man: Pawn D4-E4, check"_ -- radio was full with that shit in the 70s here...). It might be a trigger phrase for a sleeper terrorist, much like in that Bronson movie... but most likely it's just spam confirming your address :-) — Damon, Aug 05 '15 at 19:50

score 123 · Accepted Answer · answered Aug 03 '15 at 18:00

This is spam -- but possibly the spammer was not very good at spamming.

The '=EA' bits are Quoted-Printable, an encoding for bytes into ASCII characters. '=EA=85=9F' thus stands for bytes of values 0xEA, 0x85 and 0x9F, in that order; this is the UTF-8 encoding for 'ꅟ' (that's U+A15F YI SYLLABLE NDEX, one of the symbols of Yi script). Whoever sent that email hopes that your mail reader software will not include a Yi font, and thus display the character as a space.

The point of using such symbols is to try to confuse antispam filters: the filter may try to react on the sentence "It's xxx by the way" (for random names instead of "xxx"); the extra characters may make this filter fail. Chances are that the spam, being sent by the million, will use random characters from unusual sets (like Yi glyphs). The random words ("fiddle", "armpits"...) serve the same purpose: to evade detection, especially by Bayesian spam filters. Note that the extra words are "hidden" in the HTML view, by being displayed with a very small font and with the same colour as the background.

All of this is very spammish, and since your spam filter let the mail flow, then the spammer actually won this round: his evasive maneuvers worked, and your spam filter was defeated.

Now, what can be the point of all this ? The point of spam is to trigger some reaction from the spammee. This can be "clicking on a link" but it could also be "send an email in response". I can make several conjectures:

It has been pointed out (e.g. in this study) that the business model of most spammers requires pinpointing stupid people. For the spammer, sending out millions of spams costs about nothing; however, when a spammee answers, a human agent of the spammer must read and respond, and there things become very expensive for the spammer. Thus, what the spammer really wants is that the few people who actually get hooked on the initial spam will be ready to believe the most fantasmagorical stories.

Along that hypothesis, the spam you received might be a way to find the people who are dumb enough to believe that the sender is really named Shawn, and are ready to talk to Shawn.
Spammers are (technically) human beings, with all the flaws that this entails. The spammer uses a spamming tool but may be bad at using it. I often receive spams that greet me as "Hello %RANDUSER", an occurrence that can only be explained by a spammer who should be reading the documentation for his spamming tool.

Wow! Thank you very much! Maybe google filtered something out, as I didn't get any link to click on! So the spammers made it in my inbox but they will not benefit from it. — puhubear, Aug 03 '15 at 18:57
@puhubear: Google does not, as far as I know, modify the *contents* of email. It either gets filed as spam or it doesn't. — R.. GitHub STOP HELPING ICE, Aug 03 '15 at 21:52
@R.. if google thinks the email is a phishing email it disables links and makes you read a message about how dangerous clicking a link is before re-hyperlinking. But the words of the email remain the same, the tag is just disabled. — Jon, Aug 03 '15 at 23:08
@Chipperyman Doesn't it also disable other content, like loading images? — jpmc26, Aug 04 '15 at 04:25
@jpmc26 IIRC they stopped doing it once they started caching the images and displaying them from their servers. May be wrong though. — Jon, Aug 04 '15 at 05:20
`the business model of most spammers requires pinpointing stupid people`. Yes. Exactly. — Jared Burrows, Aug 04 '15 at 14:17
Spammers can be pretty stupid too :-). I'm aware of the downside of replying. But, for some I have been known to reply "Morons." In one such case I got back an enthusiastic 'thank you for your interest" response. Probably also automated, but, one can hope :-) — Russell McMahon, Aug 05 '15 at 12:40
The random invisible characters may be intended less to bypass spam filters (I think most are smart enough to do useful things when they get weird characters) and more to uniquely identify the original message (and therefore its recipient) if anybody replies to it (which they may possibly do from a different address to the original one, and knowing that both are live could be useful). — Jules, Aug 05 '15 at 12:49

score 22 · Answer 2 · answered Aug 03 '15 at 20:17

This email is most definitely spam (unless you know the sender and/or solicited this mail). Those odd strings are obfuscation techniques, which are a telltale sign of spam. See Tom Leek's answer for more information on that.

There are three possible explanations for this email:

It's an attempt to get you to respond; threads build psychological trust and can better set up scams
It is an attempt at messing up your filters (e.g. Bayesian poisoning ... which doesn't work)
The spammer messed up and forgot the payload

I'm leaning on it being both #1 and #2.

(Nice fonts in there! font-family: Unfeignedly, Gascony, Pancakes, great fodder for a good Bayesian tokenizer to pick up on.)

What is the purpose of these weird non-spam emails?

2 Answers2

Related