May 20, 2006Infuriating [Nearly] Empty Korean Spam
The last few days, I've been pummeled by inane messages originating from South Korea. Except for the IP of the sending machine, they're all the same:
Received: from 126.96.36.199 ([188.8.131.52]) by dannyg.com (184.108.40.20660308) id k4KEVVOI056048 for <[redacted]@dannyg.com>; Sat, 20 May 2006 08:31:31 -0600 (MDT)
Received: from (HELO snz) [220.127.116.11] by 18.104.22.168 id 5oU5HG53z7u5; Sat, 20 May 2006 17:26:41 +0300
From: "ahjlj" <firstname.lastname@example.org>
Reply-To: "ahjlj" <email@example.com>
Date: Sat, 20 May 2006 17:26:41 +0300
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
If I were to view this in my email reader, it's message body would be a single period. Period.
The IP addresses of the source machines spewing this nonsense are all in blocks managed by Hanaro Telecom from Seoul, South Korea. They are also in blocks listed in several blocklists because they are believed to be residential addresses handed out to dial-up or broadband (DSL or cable) users.
What are these messages, you may ask? My guess is that they are either test messages to see if compromised PCs are ready to relay spam or they are supposed to contain spam messages but have been misprogrammed.
This kind of activity is what leads many an email administrator in non-Asian countries to block all incoming email for countries such as South Korea and China.
[As a side note, this is my 200th posting to the Spam Wars Dispatches blog. Thanks very much for reading.]Posted on May 20, 2006 at 08:20 AM