[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: stop your mail



Hello,

On Sat, Jul 08, 2017 at 07:50:38PM +0200, Nicolas George wrote:
> These messages are the spam, themselves. The pretend "leave me
> alone" prologue is just to disguise that status and attract your
> attention until you read the quoted text.

I think it is far more likely that these people are responding to
spam that has been sent to them with the list's address as the from
address. The recipients do not know or care that the from address of
an email is not trustworthy¹, nor that they should not respond to
spam, so they just reply to express their anger.

I further hypothesise that this is not actually targeted behaviour
to inconvenience the mailing list specifically. I suspect that
massive lists of real email addresses have been harvested from
public mailing list archives and compromised address books etc and
these are used as from addresses on a random basis. Though it would
have to be one address per spam run rather than a different address
for each individual email, as these seem to come in bursts.

The spammers' motivation is to use an address that is not associated
with them but is a real address so cannot be easily blocked on the
basis of from address alone.

I don't think they care who receives the blowback.

Cheers,
Andy

¹ barring any of the other trusted identity schemes like SPF, DKIM,
  DMARC or crypto signed email.

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

Please consider the environment before reading this e-mail.
 — John Levine


Reply to: