This spam appears to be some sort of probing attack, looking for valid email addresses. In this case, the email was send to an address that didn't actually exist.
From: Roy Johnson Roy.Johnson@verif1cationtime4.com
Date: 3 April 2012 06:45
Subject: Info in regard to keeping well.
This is a one time public service message about Attention Deficit
Hyperactivity Disorder (ADHA) and no further emails will be sent.
ADHD (attention deficit hyperactivity disorder), sometimes called ADD
(attention deficit disorder), is linked with hyperactivity, impulsive
behavior, and attention problems in both children and adults. It's
estimated that up to 12 percent of school-aged children and 6 percent of
adults have ADHD, making it harder for them to focus on tasks, manage
their time, control their behavior, or even sit still. There is no
single test to diagnose ADD/ADHD. To reach a diagnosis, a doctor or
specialist may do a physical exam to rule out any physical problems, as
well as ask questions about behavior in certain situations. Treatment is
often a combination of medication and behavioral therapy. The goals of
treatment are to help the person control impulsive behaviors, do better
in school or work, and improve social relationships. Keep well.
This appears to be an attempt to bypass spam filters, and also the relevant spam laws by
apparently not being a commercial email message.
In this case, the spam went through a relay at
174.142.85.218, but the originating IP appears to be
208.115.221.34, a Limestone Networks IP suballocated to a outfit called "24Shells, Feasterville, PA 19053, US" who control a small block of 208.115.221.32/29 (208.115.221.32 - 208.115.221.39) in this range.
So far, I have discovered the following (anonymous) domains and IP addresses connected with this spammer:
174.142.85.218 (iWeb / Listk LLC, Canada)
mx.
verif1cationtime4.com
208.115.221.34 (Limestone Networks, US. Suballocated to "24Shells, Feasterville, PA 19053, US")
mail.
vprtcls3.com
174.142.82.119 (iWeb, Canada)
mail.
3vermethod.com
96.31.93.88 (Noc4Hosts, US)
mx.
verif1cationtime2.com
209.54.55.171 (Native Hosting, US)
mx.
verif1cationtime3.com
216.245.208.34 (24Shells, US)
mail.
2vermethod.com
173.236.84.2 (Singlehop, US)
mx.
4vermethod.com
74.112.248.179 (Triple8, US)
mail.
vprtcls1.com
Out of these IPs,
174.142.85.218 is the most interesting. It belongs to iWeb in Canada (Canada is a great home for spammers) but is suballocated to:
NetRange: 174.142.85.216 - 174.142.85.223
CIDR: 174.142.85.216/29
OriginAS:
NetName: IWEB-CL-T215-200CN-1330
NetHandle: NET-174-142-85-216-1
Parent: NET-174-142-0-0-1
NetType: Reassigned
RegDate: 2010-05-14
Updated: 2010-05-14
Ref: http://whois.arin.net/rest/net/NET-174-142-85-216-1
CustName: ListK LLC
Address: 1200 Abernathy Road
City: Atlanta
StateProv: GA
PostalCode: 30328
Country: US
RegDate: 2010-05-14
Updated: 2011-11-21
Ref: http://whois.arin.net/rest/customer/C02496703
ListK LLC has a website at
listk.com and are based in Atlanta, Georgia (BBB report
here). Their web site gives an indication as to exactly what this spam is about:
NameDiscoverer™ helps clients add net new contacts to their lists by utilizing our proprietary search technology to identify, gather and verify contacts and provide their titles and business email addresses.
SmartSender™ is our state-of-the-art email deployment platform that rotates and pulses emails over multiple servers so your emails never get filtered out as part of a bulk send.
eDNA™ helps companies add fresh, deliverable B2B email addresses to their lists using our proprietary technology - not by matching to an existing, tired list of emails off the shelf.
This describes the spam probe exactly, it is using existing contact details to try to form a valid email address, and then probe it from several different IP addresses to try to bypass spam filters.
In my personal opinion, this is unethical and arguably illegal as the spam is indeed part of a commercial offering. If you receive spam from this outfit, you should report it to their hosting providers. I also recommend complaining to the
BBB if you are in the US.
Just for reference the mail headers involved are as follows:
Received: from mx.verif1cationtime4.com ([174.142.85.218]) by ---------- with esmtp (Exim 4.69) id 1SEwkh-0006gp-2Y for ----------; Tue, 03 Apr 2012 06:58:00 +0100Received: from 208.115.221.34 by mail.3vermethod.com (Merak 8.9.1) with ASMTP id NJW04750 for <---------->; Tue, 03 Apr 2012 01:45:50 -0400Status: Message-ID: <20120403014518.8b1d3b8d2d@3b5e>From: "Roy Johnson" To: ----------Date: Tue, 3 Apr 2012 01:45:18 -0400X-Priority: 3X-Mailer: SkillCasterMIME-Version: 1.0X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ----------X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=disabled version=3.2.5Subject: Info in regard to keeping well.Content-Type: text/plain; charset="us-ascii"Content-Transfer-Encoding: 7bitDelivered-To: ----------
Another fake HP scan spam email leading to malware. This one follows the new technique of putting a malicious HTML (HP_Scan.htm) file inside a ZIP file to reduce the risk of it being blocked, and then it has multiple payload sites to try to get a higher infection rate. Nasty.
