The Hello How Are You Spam Stops

If you’ve been getting these spam emails would you please check and let me know when yours stopped. I doubt it will unlock any secrets, but it would be interesting to see how tightly controlled this army of spammers was.

I just got a blog comment from Richard in the Netherlands.

I have not received any “hello – how are you” spam since 19-09-2010 / 20:28 CET.

That sent me to my spam inbox. The last “hello – how are you” spam was received here Sunday at 2:18 PM EDT (1818 UTC or 2018 CET), ten minutes before Richard’s stopped. Up until that point they had been coming in sporadically sometimes as often as a few a minute other times once every 10-15 minutes.

If you’ve been getting these spam emails would you please check and let me know when yours stopped? I doubt it will unlock any secrets, but it would be interesting to see how tightly controlled this army of spammers was.

Meanwhile I don’t know any more than earlier. This whole thing is a puzzle. We may never know.

4 thoughts on “The Hello How Are You Spam Stops”

  1. The last one I received was also close to 19-09-2010 / 20:28 CET. Although these type emails have been arriving in clumps, but sporadically, for several years. So they may start again –or never.

    Some digging around leads me to suspect that the X-Mras header is only in emails that originate via ‘mail.ru’ ==the largest free e-mail service of the Runet (short for Russian Internet).

    I don’t get much email from ru, so I can’t yet say that the X-Mras header exists only in email from mail.ru, but so far that is the only emails I can find it in.

    So possibly my ‘sort to a special folder’ filter for these ‘H-HAY’ emails simply catches mail from ru… it also may mean that the place of origination for these is via the free email service of the Runet.

    That doesn’t necessarily translate into ‘Russian Spammer’, as Runet is many services (Russian Twitter, email, etc.) and can be used by people from about anywhere.

    On the other hand it does probably mean that these emails are actually originating from the Runet service, if the X-Mras header is in fact tied to mail.ru.

    OK, so that’s about all I’ve come up with.

    Well except for one little theory –just for the ‘Cloak and Dagger’ crowd…

    If you just wanted to communicate a simple message that would reach some one without actually being tied to them, one might just send this exact sort of email, as spam –or perhaps I should say ‘having the appearance of spam’. But as spam that is not very likely to get lost in an email filter… and it would not need (or want) a valid reply to or any return method –or want to link to any website (increase the likely hood of auto-deletion as spam).

    Of course the message is not the ‘How are you’ –that is simply a code phrase that who ever it’s intended for will be able to understand as a message (get out the phrase=message code book).

    I mention this because these type emails have happened over a period of several years, the exact messages are not the same (Hi – How have you been, or Hello – haven’t heard from you in awhile, etc.)

    Not a bad little message drop system, no?

    Don.

Leave a Reply

Your email address will not be published. Required fields are marked *