-------- Original Message -------- Subject: Re: stop your mail From: Andy Smith <andy@strugglers.net> To: debian-user@lists.debian.org Date: 2017-07-09
Hello, On Sat, Jul 08, 2017 at 07:50:38PM +0200, Nicolas George wrote:These messages are the spam, themselves. The pretend "leave me alone" prologue is just to disguise that status and attract your attention until you read the quoted text.I think it is far more likely that these people are responding to spam that has been sent to them with the list's address as the from address. The recipients do not know or care that the from address of an email is not trustworthy¹, nor that they should not respond to spam, so they just reply to express their anger.
The "stop your mail" and "PLEASE STOP YOUR MAILS" messages are definitely not created by the owners of the email, though it might be done by a mobile app as suggested.
The proof of this is that they all have nearly the exact same content (some add the list mail, some don't), all being HTML messages formatted the same way.
To be noted that the last two the list received are from email users of Orange France, thus most likely French, and that it is clear from the wording of those messages that they very unlikely to have been written by a French person.
The source of those emails also clearly show that they are not sent by a traditional mailer, but most likely by a java-written automated program on windows, as seen in the message id, which for this last one was
[🔎] 773946604.1112.1499496543913.JavaMail.www@wwinf1f28In this we can see that the system user sending this mail with JavaMail is “www” and that the server sending the message is name “wwinf1f28”. The previous mail of such type (PLEASE STOP YOUR MAILS) was sent by the exact same server, with the following message id:
1662938282.1128.1499496664949.JavaMail.www@wwinf1f28We can thus definitely conclude that those requests to unsubscribe are indeed spam themselves, though it is still really unclear what their true purpose are.