[spambayes-dev] RE: [Spambayes] Stamina-RX
jm at jmason.org
Thu Oct 16 17:55:42 EDT 2003
Tony Meyer writes:
> Does anyone know what the story with these is? Is this some sort of very
> subtle spam? I notice that the spambayes filter for spambayes at python.org
> gives them a very solid unsure (.54 for this one).
My theory is that it's a "priming the pump" attack against greylisting and
similar systems. ie. send 1 mail first with no content -- which will
always be considered non-spam, in terms of body tokens at least, and will
whitelist the sender somehow; then send the real spam later, possibly
through the same relays with the same headers, so that the whitelisted
sender will get the spam through. However I'm not certain, I haven't
looked into it at all.
The other possibility is that it's just simply broken spamware ;)
I have the spam body text for that, captured at another address BTW.
Unfortunately I've been deleting the blank spams, thinking the
broken-spamware scenario, in general; the "priming the pump" attack
only occurred to me today.
> > -----Original Message-----
> > From: spambayes-bounces at python.org
> > [mailto:spambayes-bounces at python.org] On Behalf Of john-esnp at yahoo.com
> > Sent: Thursday, 16 October 2003 10:30 p.m.
> > To: earl white
> > Subject: [Spambayes] Stamina-RX
> > Importance: High
> > _______________________________________________
> > Spambayes at python.org http://mail.python.org/mailman/listinfo/spambayes
> > Check the FAQ before asking: http://spambayes.sf.net/faq.html
> =Tony Meyer
> spambayes-dev mailing list
> spambayes-dev at python.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 207 bytes
Desc: not available
Url : http://mail.python.org/pipermail/spambayes-dev/attachments/20031016/3e1a26c9/attachment.bin
More information about the spambayes-dev