Date: Sun, 03 Aug 2014 20:56:48 -0700 [08/03/14 23:56:48 EDT]
From: Olive [email@example.com]
The HTML in the body text reads:
<html>The "IMG" is invalid and shows a placeholder.. making you think that it is broken, but in fact it is triggering the "unsubscribe" link in the email. So.. the email automatically unsubscribes its victims? No exactly.
<meta content="text/html; charset=utf-8" http-equiv="content-type">
<meta http-equiv="Content-Language" content="en-us"/>
A look at the root directory of www.gonename.us (22.214.171.124 = petyrbaelish.asmallorange.com) shows the inner workings of the spam:
Maxprog MaxBulk Mailer which like all mailing list applications can be used for good or evil. MaxBulk Mailer does have an unsubscribe option which stores names the unsubsribe.dat file (hardly secure, I know), and what appears to be happening in this case is the the HTML has been altered slightly to make everyone unsubscribe.
Finnell's Corollary to the Rules of Spam states that spammers define "remove" as "validate which is exactly what is happening here.. when someone opens the email (if their email displays images) then it automatically confirms that they have opened it. A crude but effective way of confirming that the email address is valid.
At the time of writing, over 6800 email addresses have been validated for further spamming, a number that is increasing quite rapidly. Emails are held in plaintext and can be harvested by anyone.
****@test.comNo doubt the people who opened this email can look forward to a whole set of additonal spam in their inboxes.
All the sending IPs are in the 126.96.36.199/27 range (Network Data Center Host Inc, US). Each IP has a .us domain hosted on it, but the WHOIS details for each domain appear to be fake.
This attack started last week with a different range of sending addresses in the 188.8.131.52/28 (OVH, France / VertVPS, Canada) range sending victims to a spamvertised site of www.morehex.us which was configured in the same way. All those sites have now been suspended. Email subjects in that case were:
Whoever is running these spam servers has taken enormous pains to hide their identity, and they are also well-resourced enough to be able to rent server farms for a short period until they get terminated.
I've seen the following domains and IPs in the spam I have received myself, no doubt there are other domains and IPs too.
Looking more deeply into the /27 also yields some more domains, all of which have fake or anonymous WHOIS details: