You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Giff Hammar <gh...@certifiedparts.com> on 2006/06/06 20:22:29 UTC
All digits
I'm seeing a few e-mails with a subject that contains only digits or is
blank and a body that contains a random number of digits, usually three to
six. There is nothing else in the body. Is anyone else seeing this? New
software a botmaster is trying?
Giff
Giff Hammar
IT Director
Certified Parts Warehouse
http://www.certifiedparts.com <http://www.certifiedparts.com/>
mailto: ghammar@certifiedparts.com
V: 603.516.1707
F: 603.516.1702
M: 603.490.7163
Re: All digits
Posted by Dimitri Yioulos <dy...@firstbhph.com>.
On Tuesday June 06 2006 2:22 pm, Giff Hammar wrote:
> I'm seeing a few e-mails with a subject that contains only digits
> or is blank and a body that contains a random number of digits,
> usually three to six. There is nothing else in the body. Is anyone
> else seeing this? New software a botmaster is trying?
>
> Giff
>
> Giff Hammar
> IT Director
> Certified Parts Warehouse
> http://www.certifiedparts.com <http://www.certifiedparts.com/>
> mailto: ghammar@certifiedparts.com
> V: 603.516.1707
> F: 603.516.1702
> M: 603.490.7163
Yes, I'm seeing those, as well as mail with subject "test xxx" where
xxx is three random letters. Test, huh?
Dimitri
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
Re: All digits
Posted by Stewart <mi...@f8.com.au>.
On 07/06/2006, at 5:54 AM, David B Funk wrote:
> On Tue, 6 Jun 2006, qqqq wrote:
>
>> I have to wonder if a spammer is testing their Zombies since all I
>> have received are from
>> Dialup/broadband customers. Could this be the rain before the
>> flood of spam/virus?
>>
>> QQQQ
>
> I'm voting for this explanation. It started here yesterday and they're
> very predictable in format and source (all from dialup/broadband
> hosts).
> I'm seeing about a dozen per hour.
I'm seeing this too there's a detailed discussion going on the
mimedefang list already and from there the rule i'm about to add is:
>> #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea
>> header __KAM_NUMBER1 Subject =~ /^\d+$/i
>> body __KAM_NUMBER2 /\d{1,6}/
>> header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i
>> meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 +
>> MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5)
>> describe KAM_NUMBER Silly Number Emails
>> score KAM_NUMBER 1.0
(thanks to everyone out there so quick off the mark..)
..S.
Re: All digits
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Tue, 6 Jun 2006, qqqq wrote:
> I have to wonder if a spammer is testing their Zombies since all I have received are from
> Dialup/broadband customers. Could this be the rain before the flood of spam/virus?
>
> QQQQ
I'm voting for this explanation. It started here yesterday and they're
very predictable in format and source (all from dialup/broadband hosts).
I'm seeing about a dozen per hour.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: All digits
Posted by jdow <jd...@earthlink.net>.
From: "qqqq" <qq...@usermail.com>
>I have to wonder if a spammer is testing their Zombies since all I have received are from
> Dialup/broadband customers. Could this be the rain before the flood of spam/virus?
>
> QQQQ
Word is that it may be a test run of a new version of Bagle.
{^_^}
Re: All digits
Posted by qqqq <qq...@usermail.com>.
I have to wonder if a spammer is testing their Zombies since all I have received are from
Dialup/broadband customers. Could this be the rain before the flood of spam/virus?
QQQQ
Re: All digits
Posted by "Steven W. Orr" <st...@syslang.net>.
On Tuesday, Jun 6th 2006 at 14:22 -0400, quoth Giff Hammar:
=>I'm seeing a few e-mails with a subject that contains only digits or is
=>blank and a body that contains a random number of digits, usually three to
=>six. There is nothing else in the body. Is anyone else seeing this? New
=>software a botmaster is trying?
=>
=>Giff
=>
=>Giff Hammar
=>IT Director
=>Certified Parts Warehouse
=>http://www.certifiedparts.com <http://www.certifiedparts.com/>
=>mailto: ghammar@certifiedparts.com
=>V: 603.516.1707
=>F: 603.516.1702
=>M: 603.490.7163
=>
=>
I got a bunch of them today.
Date: Tue, 06 Jun 2006 14:19:34 -0600
From: xxx
To: xxx
Subject: 1545453
5556
Does this qualify as spam or is this a virus or is this something else?
Like Bayes poison? I'm open to suggestions on this one.