Blank emails-- what are these

  • Thread starter Thread starter MZB
  • Start date Start date
M

MZB

I keep getting about 2-4 blank emails each day.

The "to" part always says ; undisclosed-recipients.

The "from" part keeps varying (eg: (e-mail address removed))

The email is always blank. I doubt if it is virus related, but what is the
purpose?? Is it to test if mm email address is a valid one (if so, how do
they know -- is it just that it doesn't bounce back??).

Anyone know?

MB
 
From: "MZB" <[email protected]>

| I keep getting about 2-4 blank emails each day.
|
| The "to" part always says ; undisclosed-recipients.
|
| The "from" part keeps varying (eg: (e-mail address removed))
|
| The email is always blank. I doubt if it is virus related, but what is the
| purpose?? Is it to test if mm email address is a valid one (if so, how do
| they know -- is it just that it doesn't bounce back??).
|
| Anyone know?
|
| MB
|

The only think that is really annoying about them is there isn't enough content for a
regular expression filter to auto-delete them !
 
MZB said:
But what is the purpose??
Spam??
Click to expand...

I think they are the result of a bad programming job on a new spam
trojan robot. It creates a header, puts something in the BCC:, but
neglects the body and subject.
 
The only think that is really annoying about them is there isn't
enough content for a regular expression filter to auto-delete
them !
Click to expand...

They seem to be just empty smtp envelopes without any headers other
than Received and Return-Path headers added by servers.

If you can filter on the entire header block, this regex should
help: ^(From|Sender):\s

RFC 2822 specifies that e-mails must have at least one of those two
headers, so that regex should match all legitimate mail while not
matching the blank ones. Depending on the regex engine's settings,
^ may or may not match the beginning of a line in the middle of the
header block. If it doesn't, (?m) should force it, at least for
PCRE. (?m)^(From|Sender):\s

Please do test this before really using it -- ATM, I don't have any of
the little spams to test it on.
 
Back
Top