Trends

First IPv6 Spam Message Caught in the Wild

By Ken Simpson | 4 minute read

Greg Troxel reported on the SpamAssassin users mailing list today that he had received the first spam message sent via IPv6 (the successor to IPv4, the Internet Protocol addressing system).

The anti spam community is very concerned about IPv6 because its enormous address space will enable spammers to have access to a virtually unlimited number of IP addresses, rendering traditional “black lists” obsolete. When spammers start sending through IPv6 in earnest, receivers will have to rely on reputation-based whitelisting, treating new IPv6 addresses with a great deal of suspicion until they establish themselves to be trustworthy.

Could this be the end of Spamhaus and other venerable blacklists? Not so fast. It will take decades for IPv4 to be phased out in favour of the new standard. And until that happens, blocking will remain an indispensable technique for stopping spam.

The raw message looks like this (Link):

Return-Path: 
          
     
     
     
     
            
      
      
      
      
X-Spam-DCC: _DCCB_:_DCCR
            
      
      
      
      
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on fnord.ir.bbn.com
            
      
      
      
      
X-Spam-Level:
            
      
      
      
      
X-Spam-Status: No, score=-4.8 required=1.0 tests=ALL_TRUSTED,AWL,BAYES_95,
            
      
      
      
      
DATE_IN_PAST_12_24,TVD_PH_SUBJ_META autolearn=no version=3.2.5
            
      
      
      
      
X-Original-To: gdt@ir.bbn.com
            
      
      
      
      
Delivered-To: gdt@ir.bbn.com
            
      
      
      
      
Received: from vilab.hit.edu.cn (unknown [IPv6:2001:da8:b800:228:5054:abff:fe10:8e4c])
            
      
      
      
      
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
            
      
      
      
      
(No client certificate requested)
            
      
      
      
      
by fnord.ir.bbn.com (Postfix) with ESMTPS id 86A4C5489
            
      
      
      
      
for 
            
      
      
      
      
        ; Sun, 3 Jan 2010 22:17:03 -0500 (EST) 
       
Received: from vilab.hit.edu.cn (localhost [127.0.0.1]) 
       
by vilab.hit.edu.cn (Postfix) with ESMTP id 8BEF2B10DE1; 
       
Sun, 3 Jan 2010 21:59:27 +0800 (CST) 
       
From: "UN-HABITAT" 
        
        
Reply-To: ups.deliveryservice@hotmail.com 
        
Subject: Notice 
        
Date: Sun, 3 Jan 2010 21:59:27 +0800 
        
Message-Id: <20100103125409.m77170@vilab.hit.edu.cn> 
        
X-Mailer: OpenWebMail 2.53-B2D 
        
X-OriginatingIP: 78.138.3.236 (jcsun) 
        
MIME-Version: 1.0 
        
Content-Type: text/plain; 
        
charset=utf-8 
        
To: undisclosed-recipients:; 
        
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fnord.ir.bbn.com [0.0.0.0]); Sun, 03 Jan 2010 22:17:05 -0500 (EST) 
        Your Attention, 
        After several attempt to reach you, I deemed it necessary and urgent to
contact you with your email and to notify you finally about the
outstanding settlement of your compensation which is being given out by
the United Nations Human Settlements Programme. This compensation is being
made to all victims that have lost their money through any online
transactions or as a result of Scam activities. It has come to our notice
that many of you have lost your money by falling victim to some internet
fraudsters. 
        The United Nations Human Settlements Programme, UN-HABITAT, is the United
Nations agency for human settlements. It is mandated by the UN General
Assembly to promote humanly, socially and environmentally with the goal of
providing adequate shelter for all. 
        As a result of this scam activities spreading over the internet, the
United Nations Human Settlements Programme, UN-HABITAT have decided to get
details of most victims who were previously scammed by these fraudsters. 
        This Human Settlements Programme is design to compensate every one of you
with the sum of $500,000.00 USD to help settle all your debts and start a
new business. 
        We have concluded all the necessary arrangements towards the release of
your settlement Check sum of $500,000.00 USD with the financial committee
of the United Nations Human Settlements Programme in collaboration with
the United Parcel Service LTD (UPS) Nigeria, to deliver the check sum of
$500,000.00 USD which is registered with Ref No: UN014-0157/UPS-UN-HABITAT
to your Compensation Check Parcel. 
        You are therefore to contact the United Parcel Service LTD (UPS) Nigeria,
with the below information in order to claim your compensation check. Take 
        note that we have not pay for the shipment of your Check Parcel as you
will be required to pay the shipping/handling charges for your
compensation check to be deliverd to you. 
        You are required to contact the UPS Courier Service with the below
information 
        Name:
Delivery Address:
Direct Phone number:
Sex:
Country: 
        =================================
United Parcel Service Nigeria LTD
Plot 781 Emeka Anyaoku Street
Area Eleven Garki
FCT-Abuja
Nigeria.
Tel: +234-813-643-9535
Email: ups.deliveryservice@hotmail.com
================================= 
        Accept our regards. 
        Higgins A. Denise
UN-HABITAT Information Office

First IPv6 Spam Message Caught in the Wild

Cut your support tickets and make customers happier