Comments on: Phantom e-mail

Question: Phantom e-mail

emelenjr — Sat, 29 Oct 2005 21:51:41 -0800

Phantom e-mail: I keep getting e-mail messages that don't appear to be from anyone at all. No sender, no recipient, no subject.

Here's what the headers look like:



Date: October 29, 2005 11:37:12 PM EDT

X-Comment: Sending client does not conform to RFC822 minimum requirements

X-Comment: Date has been added by Maillennium

Received: from tdev253-109.codetel.net.do ([200.88.253.109]) by sccrmxc17.comcast.net (sccrmxc17) with SMTP id <2 0051030033612s17002hvsge>; Sun, 30 Oct 2005 03:36:58 +0000

Received: from localhost.localdomain (200.88.253.109 [200.88.253.109]) by 63.240.76.26 with ESMTP id e99si1[2][7]qbe.2005.91.0[2

X-Originating-Ip: [200.88.253.109]

The only indication that there's something in my inbox is there's a date stamp.

I know how to go after spammers via Spamcop, or by tracking down info from IP addresses and such contained in the headers, so my question isn't about that. I guess I'm wondering How did they do that? considering there apparently are minimum requirements for header information. Have spammers found the ultimate way of circumventing spam filters?

By: onalark

onalark — Sat, 29 Oct 2005 21:59:53 -0800

That would take 30 seconds to write a filter for. Write one yourself or email Comcast, who may have a valid reason for letting these in.

By: moift

moift — Sat, 29 Oct 2005 22:22:56 -0800

Different mail servers have different requirements for this type of thing, but many implementations simply don't care what you put (or don't put) in the header.

I suspect the drama plays out something like this:

Client: MAIL FROM:
Server: OK
Client: RCPT TO: someuser@example.com
Server: OK

The server most likely does its own timestamping, so there's that, but it's not obligated to follow up on the data it's getting and it works with what it's got.

By: emelenjr

emelenjr — Sat, 29 Oct 2005 22:38:52 -0800

Huh, thanks for that. It's not a big hassle over here, as I already have Mail.app set to dump any messages that don't come from people in my address book or people I've already e-mailed into the Junk folder. Just odd... very limited header info (which doesn't appear to follow somebody's rules) and no e-mail text at all.

By: mkhall

mkhall — Sun, 30 Oct 2005 01:49:13 -0800

Thanks for asking the question. I've been getting a couple of those a day for a few weeks now, and it's been perplexing me. At least now I know I'm not alone.

By: essexjan

essexjan — Sun, 30 Oct 2005 03:16:45 -0800

I had them for a while, a few months ago. Googling seems to indicate lots of people have had them. They didn't show up in Mailwasher but when I went to download mail into OE there would sometimes be 50+ of the things.

Then they went away and (touch wood) I haven't seen them since.

By: flyby22

flyby22 — Sun, 30 Oct 2005 05:14:47 -0800

do these email carry any content ?

By: essexjan

essexjan — Sun, 30 Oct 2005 07:01:31 -0800

do these email carry any content ?

The ones I had carried no addressee, no sender, no subject line, no attachment, no content, absolutely nothing. The size showed as 1kb in my Inbox.

By: emelenjr

emelenjr — Sun, 30 Oct 2005 08:30:41 -0800

No content at all, flyby22. Since posting this thread I've received at least three more (I think at least one more came in last night before I went to bed, and there are two in my inbox this morning) all seeming to originate from different ISPs, judging by the headers—which don't seem all that reliable anyway.

From the headers I posted above, codetel.net.do is interesting...

By: Thorzdad

Thorzdad — Sun, 30 Oct 2005 11:01:48 -0800

Yeah...seems to be a big barrage of these blank emails this week. I got 4 earlier this week and 4 more this morning.

By: paulsc

paulsc — Sun, 30 Oct 2005 13:14:06 -0800

Sometimes people testing a list will run a scripted delivery this way, trying to pickup bounce messages, delivery errors, and such to clean their lists. Keeping headers to a minimum and zero content cuts their computer time per delivery. I recommend you auto-filter all zero content message to dev/null, and never look back. Few folks doing this are likely to be doing it from valid addresses, so unless you especially like playing internet whack-a-mole, ignore, delete, rinse & repeat, IMHO.

By: jerseygirl

jerseygirl — Sun, 30 Oct 2005 14:13:55 -0800

I've been bouncing them back manually in my mail app hoping it is someone testing a spam list.

By: luriete

luriete — Sun, 30 Oct 2005 14:44:36 -0800

Just started getting these today - 3 so far. Same client setup here, and will do the same thing to get rid of them - thanks!

By: ikkyu2

ikkyu2 — Sun, 30 Oct 2005 15:03:05 -0800

I've been getting these too, and I also use Comcast. They've clearly switched to a new spam filter.

By: Acetylene

Acetylene — Sun, 30 Oct 2005 16:16:22 -0800

I've been getting them too, for about three or four days now. I'm also with Comcast.

By: jerseygirl

jerseygirl — Sun, 30 Oct 2005 16:36:08 -0800

Oh, also with Comcast here too.

By: nenequesadilla

nenequesadilla — Mon, 31 Oct 2005 00:29:53 -0800

I've received around 100 of these over the last 3 days on my comcast.net account. None on gmail, mail.com, hotmail or work accounts.

By: Four Flavors

Four Flavors — Mon, 31 Oct 2005 09:49:10 -0800

There's a ghost in the machine.

By: nenequesadilla

nenequesadilla — Tue, 01 Nov 2005 17:52:42 -0800

Hooray! I only received two of these today!