[Spambayes] [slightly OT] spammer 'random' words that are addressee-related?

[Dave Hall]

On Wed, Jan 14, 2004 at 09:33:30AM -0500, Denis Haskin wrote:
> My wife showed me some spam she got this morning that included the usual 
> 'random' words in the subject, but she was wondering if the words maybe 
> weren't so random.

I too have been suspicious of this.  A lot of "hammy" words appearing either
in the subject or in the message body with a collection of seemingly random
words.  Also, spam "from" names phonetically similar to people I know and 
correspond with frequently.  It still looked random enough I have just wrote
it off as coincidence.

On Monday, one particular word in a group of random words caught my 
attention in a message spambayes classified as unsure.  That word was 
saskatoon (lower case spelling).  Saskatoon is the name of the city I live
in; population a little over 200,000.  

This word would typically be a strong indication of non-spam in my corpus. 
Something to note is the capitalization, all lower case (like all the other
random words in this message).  The normal spelling is capitalized although
I correspond with a few people who have not mastered the art of the caps-
lock key.

> It also occurred to me that perhaps someone else on these lists has a 
> virus which is harvesting this from a local PC and sending it off to a 
> spammer?

For the past 4 years, I've used a "unique" e-mail address for every list I
subscribe to and every web site that I have to register and provide an 
e-mail address.  I know for certain that one of the lists I subscribe to
has the e-mail addresses removed from the web accessible archive where 
typical bots would find them.  I still get a few spams a week to the 
addres I use for one of these lists.  The only way that could happen is if 
a spammer either subscribed to the list or harvested from a subscriber. 

Many of the people I correspond with in my personal e-mail are less than
computer savvy, and use the ususal Outlook Express minus security patches.  
There are several occasions when they've been infected with outlook worm of
the day.  Also many of the same people are still silly enough to forward 
chain letters and other garbage to a dozen people (all appearing in the "to" 
address).  

I think it's possible that there may be "viruses" scanning through an 
outlook "inbox", harvesting e-mail addresses and hammy key words. 

It's highly likely spammers are just signing up for mailing lists and 
harvesting addresses from messages sent to the list.  That may also include
magic keywords.



-- 

Dave

===============================================================
How do I set the laser printer to stun? - yehoodi.com
===============================================================