« Blog Comment Spam | Main | Captcha Gotcha »

May 20, 2006

The last few days, I've been pummeled by inane messages originating from South Korea. Except for the IP of the sending machine, they're all the same:

Received: from 128.121.100.64 ([211.215.229.186]) by dannyg.com (8.12.11.20060308) id k4KEVVOI056048 for <[redacted]@dannyg.com>; Sat, 20 May 2006 08:31:31 -0600 (MDT)
Received: from (HELO snz) [56.85.171.193] by 128.121.100.64 id 5oU5HG53z7u5; Sat, 20 May 2006 17:26:41 +0300
Message-ID: <w$-10-14m$a-52496@d7c963>
From: "ahjlj" <asjkj@co.kr>
Reply-To: "ahjlj" <asjkj@co.kr>
To: [redacted]@dannyg.com
Date: Sat, 20 May 2006 17:26:41 +0300
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="54C31DD8B_3"
X-Priority: 3
X-UIDL: \8@"!!$`!!N

--54C31DD8B_3
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable

.

--54C31DD8B_3--

If I were to view this in my email reader, it's message body would be a single period. Period.

The IP addresses of the source machines spewing this nonsense are all in blocks managed by Hanaro Telecom from Seoul, South Korea. They are also in blocks listed in several blocklists because they are believed to be residential addresses handed out to dial-up or broadband (DSL or cable) users.

What are these messages, you may ask? My guess is that they are either test messages to see if compromised PCs are ready to relay spam or they are supposed to contain spam messages but have been misprogrammed.

This kind of activity is what leads many an email administrator in non-Asian countries to block all incoming email for countries such as South Korea and China.

[As a side note, this is my 200th posting to the Spam Wars Dispatches blog. Thanks very much for reading.]