0

I receive these mysterious emails with no subject, no body, forged yahoo addresses, and forged Message-Id. I receive hundreds of these every day. I've included a sample of about a dozen below (I've replaced my actual domain name with "myserver.com").

Does anyone else receive emails like these? The IP address resolves to China. What could someone be trying to accomplish by sending these?


From [email protected] Sat Apr 25 10:22:26 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEMOVx013935;
        Sat, 25 Apr 2015 10:22:25 -0400
Date: Sat, 25 Apr 2015 10:22:24 -0400
From: [email protected]
Message-Id: 
Status: RO
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:22:28 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEMOW1013935;
        Sat, 25 Apr 2015 10:22:27 -0400
Date: Sat, 25 Apr 2015 10:22:27 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:24:27 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEOOxR014269;
        Sat, 25 Apr 2015 10:24:24 -0400
Date: Sat, 25 Apr 2015 10:24:24 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:25:28 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEPPBp014799;
        Sat, 25 Apr 2015 10:25:26 -0400
Date: Sat, 25 Apr 2015 10:25:25 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:25:30 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEPPBr014799;
        Sat, 25 Apr 2015 10:25:29 -0400
Date: Sat, 25 Apr 2015 10:25:29 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:26:53 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEQpF5015268
        for ; Sat, 25 Apr 2015 10:26:52 -0400
Date: Sat, 25 Apr 2015 10:26:51 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:28:00 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PERxxY015848
        for ; Sat, 25 Apr 2015 10:28:00 -0400
Date: Sat, 25 Apr 2015 10:27:59 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:34:33 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEYVKv017946;
        Sat, 25 Apr 2015 10:34:31 -0400
Date: Sat, 25 Apr 2015 10:34:31 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:37:30 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEbS3S019367;
        Sat, 25 Apr 2015 10:37:29 -0400
Date: Sat, 25 Apr 2015 10:37:28 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 10:50:54 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PEoqMW023362;
        Sat, 25 Apr 2015 10:50:53 -0400
Date: Sat, 25 Apr 2015 10:50:52 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 11:00:47 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PF0k6d026108;
        Sat, 25 Apr 2015 11:00:46 -0400
Date: Sat, 25 Apr 2015 11:00:46 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0


From [email protected] Sat Apr 25 11:09:10 2015
Received: from 14.106.165.177 ([14.106.165.177])
        by myserver.com (8.13.8/8.13.8) with SMTP id t3PF98Cm028275;
        Sat, 25 Apr 2015 11:09:09 -0400
Date: Sat, 25 Apr 2015 11:09:08 -0400
From: [email protected]
Message-Id: 
Content-Length: 0
Lines: 0
1
  • 2
    Those headers are lacking information about what arguments the client send in the HELO and RCPT commands. That information is needed in order to fully understand the pattern. But even with that information, we cannot tell you what is going on inside the mind of the sender of those emails.
    – kasperd
    Apr 26, 2015 at 10:46

1 Answer 1

1

It can be a brute force mail address scan: someone is trying thousands of destination email addresses in the hope to distinguish non-existent emails addresses (for example, due to destination mail server replying with "unknow user" error) from existent (and active) ones.

Not the answer you're looking for? Browse other questions tagged .