Single word mails .

[ram <ra...@netcore.co.in>]

Are the spammers testing some new spamtool 
I am getting mails with just a single word like "gushes" "using"  etc 

what is this about  now ? 

Thanks
Ram

Re: Single word mails .

[Matt Kettler <mk...@verizon.net>]

Steven W. Orr wrote:
> On Thursday, Apr 26th 2007 at 01:45 -0400, quoth Matt Kettler:
>
> =>ram wrote:
> =>> Are the spammers testing some new spamtool 
> =>> I am getting mails with just a single word like "gushes" "using"  etc 
> =>>
> =>> what is this about  now ? 
> =>>   
> =>Read the archives for more details, however the general consensus is
> =>it's due to:
> =>
> =>1) a mass run of short-emails to a broader-range of randomly generated
> =>addresses in an attempt to
> =>disover new ones. (aka Rumpelstiltskin attack)
> =>
> =>- OR -
> =>
> =>2) some spammer screwed up their template when they last pushed one out
> =>to their botnet, and as a result the bots are generating emails with no
> =>useful payload.
> =>
> =>Both are quite plausible.
>
> Ok. I have questions:
>
> 1. Should I run these through sa-learn --spam or are these not to be 
> considered as spam?
>   
Why wouldn't you?

Don't over-think your bayes training. If it's undesirable to you, train
it as spam. If it's desirable to you, train it as nonspam.

A lot of folks get caught in the trap of only trying to avoiding
training "bayes poison" or "moderate" spam for fear these less obvious
cases will confuse SA when it gets nonspam mail. Don't over-worry about
that. The chi-squared combining algorithm is really quite good at not
being fooled by tokens that appear in both kinds of mail.

> 2. And also, maybe OT, should these messages be reported to SpamCop?
> We all know they're spam, but to be fair, they're not trying to *sell* us 
> anything, thus providing a basis for not calling them spam.
>
>   
Spamcop uses UBE as their definition of spam. That's Unsolicited Bulk
Email, as opposed to Unsolicited Commercial Email.

http://www.spamcop.net/fom-serve/cache/125.html

So, while these messages are not selling anything, thus not commercial,
they are still unsolicited bulk mail.

Based on that, I say they fit the critera so go ahead and report them if
you like.

Re: Single word mails .

["Steven W. Orr" <st...@syslang.net>]

On Thursday, Apr 26th 2007 at 01:45 -0400, quoth Matt Kettler:

=>ram wrote:
=>> Are the spammers testing some new spamtool 
=>> I am getting mails with just a single word like "gushes" "using"  etc 
=>>
=>> what is this about  now ? 
=>>   
=>Read the archives for more details, however the general consensus is
=>it's due to:
=>
=>1) a mass run of short-emails to a broader-range of randomly generated
=>addresses in an attempt to
=>disover new ones. (aka Rumpelstiltskin attack)
=>
=>- OR -
=>
=>2) some spammer screwed up their template when they last pushed one out
=>to their botnet, and as a result the bots are generating emails with no
=>useful payload.
=>
=>Both are quite plausible.

Ok. I have questions:

1. Should I run these through sa-learn --spam or are these not to be 
considered as spam?

2. And also, maybe OT, should these messages be reported to SpamCop?
We all know they're spam, but to be fair, they're not trying to *sell* us 
anything, thus providing a basis for not calling them spam.


-- 
Time flies like the wind. Fruit flies like a banana. Stranger things have  .0.
happened but none stranger than this. Does your driver's license say Organ ..0
Donor?Black holes are where God divided by zero. Listen to me! We are all- 000
individuals! What if this weren't a hypothetical question?
steveo at syslang.net

Re: Single word mails .

[Andy Spiegl <sp...@spiegl.de>]

Hi Tim,

> Is there a good test for these? 

I don't get many of them, probably because I block them at MTA via
zen.spamhaus.org.  But the ones that do get through are caught nicely
by the BOTNET rules.

Chau,
 Andy.

-- 
 If it ain't broke, improve it.

Re: Single word mails .

["Tim B." <mo...@optonline.net>]

Matt Kettler wrote:
> ram wrote:
>   
>> Are the spammers testing some new spamtool 
>> I am getting mails with just a single word like "gushes" "using"  etc 
>>
>> what is this about  now ? 
>>   
>>     
> Read the archives for more details, however the general consensus is
> it's due to:
>
> 1) a mass run of short-emails to a broader-range of randomly generated
> addresses in an attempt to
> disover new ones. (aka Rumpelstiltskin attack)
>
> - OR -
>
> 2) some spammer screwed up their template when they last pushed one out
> to their botnet, and as a result the bots are generating emails with no
> useful payload.
>
> Both are quite plausible.
>
>
>   
Is there a good test for these? 

The first days run seemed to be related to the german stock market, but 
todays run so far I can not seem to find a common thread as the subject 
is getting the same one word as the body

Re: Single word mails .

[Matt Kettler <mk...@verizon.net>]

ram wrote:
> Are the spammers testing some new spamtool 
> I am getting mails with just a single word like "gushes" "using"  etc 
>
> what is this about  now ? 
>   
Read the archives for more details, however the general consensus is
it's due to:

1) a mass run of short-emails to a broader-range of randomly generated
addresses in an attempt to
disover new ones. (aka Rumpelstiltskin attack)

- OR -

2) some spammer screwed up their template when they last pushed one out
to their botnet, and as a result the bots are generating emails with no
useful payload.

Both are quite plausible.