full-disclosure - weird worm ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031230143229.000054e3.cat@final-frontier.ath.cx>
From: cat at final-frontier.ath.cx (Dennis Freise)
Subject: weird worm ?

On Tue, 30 Dec 2003 13:48:14 +0100
vogt@...senet.com wrote:

> Hi everyone -
> 
> For days now, I've been receiving weird messages, with a few lines of
> apparently random, garbage text, like this:
> 
> highest bailiff nomad father advise heir 
> oxygen honorarium allegro reveal wronskian indentation coachmen 
> deficient tribute arcturus mitigate bypath 
> 
> 
> Anyone got a clue what this is? There are no attachments to these mails, but
> they keep coming in at a rate of about 1-2 per day, from different sources,
> nobody I know really.
> 
> Anyone else receiving this stuff?
> 
> Makes neither sense as spam nor as a virus - no attachment, no product being
> advertised. The only explanation I can come up with is hoping for people to
> reply ("what?") and thus verifying addresses, but that doesn't fit to the
> pattern of different senders.

I think it's a way the spamers want to defeat spam-filters with
learning capability. You get that mail, your spam-filter sees that it's not spam
and adds it to its database. So that particular eMail-Adress gets lower scores
the next time he sends you REAL spam, and the more likely the chances are that
the spam actually reaches you.

BTW: I'm not getting 1-2 per day of these, I'm getting about 30-50 of them.
Kinda VERY annoying shit :(

-- 
Dennis Freise <cat@...al-frontier.ath.cx>
GnuPG key fingerprint: 2DE8 CCEF 6E20 11D4 3B27  21EC B0BA 1749 D2C8 38ED
Get my public key at : http://www.final-frontier.ath.cx/gpg_public_key.txt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031230/bf34f757/attachment.bin