RE: [Full-Disclosure] weird worm ?

["Discini, Sonny" <Sonny.Discini@montgomerycountymd.gov>]

Yes, I have seen similar e-mails and yes, this appears to be word list probes 
to see what will and will not pass through your filter. Once they compile a 
reasonable trigger list, they will omit those words from their SPAM messages. 
This also explains why the e-mail is coming from random sources. If it came 
from a real address, they know that any reasonable admin would add the domain 
to their block list.

Fwiw



-----Original Message-----
From: Rapaill [mailto:Max.Rapaille@nbb.be] 
Sent: Tuesday, December 30, 2003 8:32 AM
To: full-disclosure@lists.netsys.com
Subject: RE: [Full-Disclosure] weird worm ?


Hi,

Perhaps some spammers trying to test circumvention of anti-spam filter ? Just 
filling mail with random words to test if this can pass some score-based filter 
like Baysian filter?

If those messages are accepted, they will try later with some advertising for a 
Miracle Pill to make some part of your body bigger ? ;-)

Regards,
Max

-----Original Message-----
From: vogt@hansenet.com [mailto:vogt@hansenet.com] 
Sent: mardi 30 décembre 2003 13:48
To: full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] weird worm ?


Hi everyone -

For days now, I've been receiving weird messages, with a few lines of 
apparently random, garbage text, like this:

highest bailiff nomad father advise heir 
oxygen honorarium allegro reveal wronskian indentation coachmen 
deficient tribute arcturus mitigate bypath 


A

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html