[spambayes-dev] RE: [Spambayes] Stamina-RX

[Justin Mason]

Tony Meyer writes:
> Does anyone know what the story with these is?  Is this some sort of very
> subtle spam?  I notice that the spambayes filter for spambayes at python.org
> gives them a very solid unsure (.54 for this one).

My theory is that it's a "priming the pump" attack against greylisting and
similar systems.  ie. send 1 mail first with no content -- which will
always be considered non-spam, in terms of body tokens at least, and will
whitelist the sender somehow; then send the real spam later, possibly
through the same relays with the same headers, so that the whitelisted
sender will get the spam through.  However I'm not certain, I haven't
looked into it at all.

The other possibility is that it's just simply broken spamware ;)

I have the spam body text for that, captured at another address BTW.

Unfortunately I've been deleting the blank spams, thinking the
broken-spamware scenario, in general; the "priming the pump" attack
only occurred to me today.

--j.

> > -----Original Message-----
> > From: spambayes-bounces at python.org 
> > [mailto:spambayes-bounces at python.org] On Behalf Of john-esnp at yahoo.com
> > Sent: Thursday, 16 October 2003 10:30 p.m.
> > To: earl white
> > Subject: [Spambayes] Stamina-RX
> > Importance: High
> > 
> > 
> > 
> > _______________________________________________
> > Spambayes at python.org http://mail.python.org/mailman/listinfo/spambayes
> > Check the FAQ before asking: http://spambayes.sf.net/faq.html
> > 
> 
> =Tony Meyer
> 
> _______________________________________________
> spambayes-dev mailing list
> spambayes-dev at python.org
> http://mail.python.org/mailman/listinfo/spambayes-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 207 bytes
Desc: not available
Url : http://mail.python.org/pipermail/spambayes-dev/attachments/20031016/3e1a26c9/attachment.bin