Krebs on Security

In-depth security news and investigation

Brian Krebs

  • About the Author
  • About this Blog
  • Clever Gmail Spam Technique

    The message staring out at me from my Gmail inbox said I’d received an update on my previous conversation with a sender named “vaishali”. The “(3)” next to the sender’s name suggested that I had responded to this person before, although I didn’t recognize the name. I clicked anyhow.

    Alas, the message was spam for some company that I won’t mention here. As it happens, Gmail assigned the (3) to the message suggesting a threaded conversation because the sender had sent the same missive three times in a row. I have no way of knowing whether this was some clever new scheme by the spammer or merely an accident, but it certainly seems like an effective way of tricking people into clicking on an e-mail that they might normally just delete.

    Bookmark and Share

    No related posts.

    Tags: gmail, message number, spam, vaishali

    This entry was posted on Monday, January 4th, 2010 at 12:31 pm and is filed under Other, Web Fraud 2.0. You can follow any comments to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

    14 comments

    1. John
      January 4, 2010 at 12:53 pm

      Interesting; I hadn’t thought of multiple spam messages as a technique. I have just attributed it to the inherent cluelessness of the sender.

      My favorite spam messages are those that are sent with intact, as in this one: http://bit.ly/6MWXPU

      Best of luck with your new blog -

      Like or Dislike: Thumb up1 Thumb down1
      • John
        January 4, 2010 at 12:56 pm

        Whoops, looks like WordPress scrubbed my text because I used brackets. Above should read:

        “My favorite spam messages are those that are sent with field names intact, as in this one: http://bit.ly/6MWXPU “

        Like or Dislike: Thumb up2 Thumb down0
    2. qka
      January 4, 2010 at 1:15 pm

      I’m with John. Often, when I get a spam message, I get multiple copies. Sometimes all from the same “sender”, sometimes not. As if they think sending the same message with the same Subject and contents is going to fool anyone.

      Like or Dislike: Thumb up1 Thumb down1
    3. UmIsThisThingOn
      January 4, 2010 at 1:47 pm

      I’ve had this happen to me before – I just deleted the ‘thread’ chalking it up to spam… those crazy kids!

      Like or Dislike: Thumb up2 Thumb down0
    4. MK
      January 4, 2010 at 4:25 pm

      I don’t think it’s that new; it’s happened to me before. I’ve even gotten messages that look like an actual conversation- the subsequent emails “respond” to the previous messages- each containing a bogus link.

      Like or Dislike: Thumb up2 Thumb down0
    5. AlphaCentauri
      January 4, 2010 at 7:02 pm

      That explains a lot. When I’ve gotten a ten or twenty identical 419 messages, I’d been chalking it up to inexperienced users of spamming software. I don’t get much gmail spam (and even less that gets through spam filters), so I didn’t know multiple identical messages would appear threaded. Many 419 spams seem to be attempts to steal victims from scams already in progress, so this technique makes sense.

      Like or Dislike: Thumb up1 Thumb down0
    6. Daniel W. Crompton
      January 5, 2010 at 8:15 am

      For an inexperience gmail user it may seem so, however any conversation I’ve interacted in will contain:
      vaishali, me (3)
      or
      me, vaishali (3)

      Like or Dislike: Thumb up3 Thumb down2
    7. bruce
      January 6, 2010 at 12:37 am

      Sorry Brian for putting the comment in your next story.

      Actually, I see this all the time from strange [spam] senders.

      Thanks for explaining how it occurs.

      Like or Dislike: Thumb up1 Thumb down0
    8. Frank
      January 7, 2010 at 3:20 am

      Brian,

      Gmail groups all replies with their original message, creating a single conversation or thread. While their intentions are honorable the grouping is done based on sender/title not sender/message and you can not turn it off. If you are used to Outlook Gmail’s conversations may drive you nuts. It does me!

      Like or Dislike: Thumb up2 Thumb down1
    9. Jeff H
      January 8, 2010 at 1:57 pm

      Wonder how multiple messages impacts sender reputation if you do not mark them as spam and simply delete them?

      Like or Dislike: Thumb up1 Thumb down0
    10. David Lilja
      January 9, 2010 at 6:53 pm

      Hi,

      I’m with Mr Crompton on this one. Although, I’m a bit behind on my blog reading so I’m catching up and have prepared a screen shot of Gmail showing what the conversations look like – but Crompton beat me to it ;-)

      Anyway, here’s the png:
      http://www.cutpaste.org/gmail_conversation.png

      Best wishes
      –
      David

      Like or Dislike: Thumb up1 Thumb down1
    11. John Stenger
      December 1, 2010 at 6:42 pm

      Based on those “spamhorror” posts, I guess ComCast is worth the money. I rarely get the ham. The same was true with TDS email.

      Quite another story on Hotmail!

      Brian, do email services one pays for do a better job of blocking and filtering out spam or have I just been lucky?

      Ok, Friends, please don’t share my address with your most favorite spammers.

      Thanks

      Like or Dislike: Thumb up0 Thumb down1
    12. John Stenger
      December 1, 2010 at 6:45 pm

      BTW, I’d like to be notified of follow up comments, Brian. I found the link right there below. Thanks.

      Like or Dislike: Thumb up0 Thumb down1