Are you receiving Empty or "Hi" emails?

Published: 2014-10-24. Last Updated: 2014-10-24 14:10:02 UTC
by Kevin Liston (Version: 1)
15 comment(s)

    I wanted to perform a little unscientific information gathering, I'm working with a small group who think they're being specifically targeted by these, while I think it's more widespread and opportunitistic.  If you've recently received these no content probe emails, or a simple "Hi" message, please send a simple comment below in this format:

  • Industry
  • Order of magnitued in size (e.g. <10, <100, <1000)
  • Sending domain

    Feel free to use our comment page to add extra analysis comments here: https://isc.sans.edu/contact.html

Keywords:
15 comment(s)

Comments

I run a small mail server with about a dozen domains and several hundred addresses, with malware/spam attempts numbering in the thousands per day.
I have not seen any of these empty emails, but do use very aggressive filtering. If you can post some of the source IP addresses or mail headers it might be helpful. I could then check to see if any of the IP addresses have matches. I presume some others may be able to do the same.
We aren't seeing them now, but were about a month ago. We would see two or three a day and this continued for a couple weeks.
I would agree with Jeff. We were getting these a few months ago, but I have not seen these types of emails for at least a month.
Seen them before. They would be sporadic in volumes. Sometimes a few and other times in the hundreds.
Yes i've seen it several times so far..

industry: Consulting (even once on my personal GMAIL)
Magnitude: <10
Sending domain: GMAIL

The senders are potentially sending emails from India and the US from what i recall in the email headers.
Adding in some from other channels

industry: Financial
Size: < 100,000

industry: financial
size: <1000
multiple domains

Industry: healthcare

Industry: healthcare
sending domain: AOL
included link
Industry: Healthcare
Size: <50000
We are seeing a ton of those in the last month
health science/medical devices
<10
From gmail.com
Industry: Architecture/Engineering/Construction
Size > 1000
Domains - gmail, others

Diary Archives