capoccia's Journal: Weird Spam

I did a wacky spam entry a while back. Here's another one.

I recieved one other spam today that was very similar. the chosen letter was "r" instead of "f".

The body of the spam consists of a single letter. This has got to be the height of trying to defeat a bayesian filter. Unfortunately, you can't sell much with a single character, so I'm not sure what this is supposed to accomplish.

Needless to say, I reported it. Here's the spam in full for your viewing pleasure:

Return-Path: <[e-mail]>
Received: from mx02.lax.untd.com (mx02.lax.untd.com [10.130.24.62])
    by maildeliver03.nyc.untd.com with SMTP id AAA92XZL7AWE8TVA
    for <[e-mail]> (sender <[e-mail]>);
    Mon, 13 Oct 2003 10:14:05 -0700 (PDT)
Received: from d226-113-127.home.cgocable.net (d226-113-127.home.cgocable.net [24.226.113.127])
    by mx02.lax.untd.com with SMTP id AAA92XZL4AWF2VUS
    (sender <[e-mail]>);
    Mon, 13 Oct 2003 10:14:02 -0700 (PDT)
Received: from [22.19.25.126] by d226-113-127.home.cgocable.net with ESMTP id <592350-96288> for <[e-mail]>; Mon, 13 Oct 2003 14:08:48 -0400
Message-ID: <n00183i2q$8o--$524x-mn0@rvv12s3>
From: "Shelby Friend" <[e-mail]>
Reply-To: "Shelby Friend" <[e-mail]>
To: [e-mail]
Subject: vise shylork
Date: Mon, 13 Oct 03 14:08:48 GMT
X-Mailer: Microsoft Outlook, Build 10.0.2627
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="EE3BC701FDD38_F"
X-Priority: 3
X-MSMail-Priority: Normal
X-UNTD-UBE: 5
X-ContentStamp: 2:3:3738731135
 
--EE3BC701FDD38_F
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable
 
f
 
--EE3BC701FDD38_F--

sounds like a great way to generate lists?

[SolemnDragon]

if they use a real address to bounce to, they could then generate lists of what does and doesn't get through, ending up with a set of viable email addresses? That's the only use i can think of for it. *shrug* seems like doing it the hard way, though...

sol

Re:sounds like a great way to generate lists?

[capoccia]

thanks for the idea. i made a report to [e-mail] suggesting that [e-mail] might be in use by a spammer seeking to cull his database.

Re:sounds like a great way to generate lists?

[moncyb]

Yes. Another similar idea I had when I read that: maybe they were trying to use a possible loophole in anti-spam laws. I remember hearing a story of telemarketers who would phone cell phones and hang up, then when the victim calls them back to find out what's up, the telemarketer starts a pitch. "You called us, we didn't call you." The spammer could say: you emailed us, we were just telling you what we are about.

BTW, did you get the spam...er...email I sent you about your no comments JE? Or are you just i

yes

[SolemnDragon]

i got your email and promptly went and enabled comments; i owe you a reply. :)

don't worry, you get a point for writing and for what you said.

sol

Re: BeOS

[capoccia]

BeOS was created by the now-defunct Be, Inc. [beincorporated.com]. If you've never heard of BeOS before, here's a quick introduction [archive.org]. The NewbieInfo page [bebits.com] from the BeBits wiki [bebits.com].

The name has some similarities to MacOS and is pronounced similarly. It is the Be Operating System, just like MacOS is the Mac Operating System, not just a strange made-up word with funny capitalization.

If this sounds interesting, you should . There is a free version that can be installed from Windows or Linux. It installs a 500MB file that is used [bebits.com]

vice shylork, exquisite corpse

[spoonyfork]

I did a google on the subject line of your spam, "vice shylork". You know what, it returned 1 hit. Does it make sense in context? Unless you know what an exquisite corpse [exquisitecorpse.com] is, I doubt it. Anyway, here's the site from Google Cache.

Armoire Nilpotent Brahms Oil [216.239.41.104]

WTF, right? The non-cached page [yale.edu] returns random exquisite corpse-like gibberish every time you load it. But don't you think the concidence is a bit odd that something like "vice Shylork" would show up here?

Just who is Bt Garner [mailto] and is he sending you sp

Re:vice shylork, exquisite corpse

[capoccia]

first of all, my subject is "vise shylork", not "Vise shylock".

second, you stumbled upon a spambot trap. if you look at the robots.txt [yale.edu], it's plain:

User-Agent: *
Disallow: /school/

this trap is a common idea similar to sugarplum [devin.com] or wpoison [monkeys.com].

all the good robots follow the robot exclusion standard [robotstxt.org], and the bad ones get spammed. what is a mystery is why a good robot like googlebot would index an excluded area. maybe the robots.txt wasn't in place when google got there.

Re:vice shylork, exquisite corpse

[spoonyfork]

Ooops, perhaps I had google correct the spelling for me. My bad. Anyway, it was a fun adventure even if it was completely fruitless. Cheers.

Re:vice shylork, exquisite corpse

[capoccia]

...it was a fun adventure...
yes it was. that exquisite corpse link was interesting. i hear andrei codrescu on npr now and again. he is one of my favorite people to listen to. just the way his words sound. i haven't heard anyone who chews on their words quite the same way.

Re:vice shylork, exquisite corpse

[spoonyfork]

andrei codrescu ... i haven't heard anyone who chews on their words quite the same way

Yes! I know exactly what you're talking about. I love listening to him speak. From what I remember hearing on NPR, I believe he is Romanian. There is a Romanian girl in my CIS350 class and she "chews her words" in a very cool, sexy way.

Re: Andrei Codrescu is Romanian

[capoccia]

Andrei Codrescu is Romanian [codrescu.com]. As soon as you said that, the first connection was with Nicolae Ceausescu [ceausescu.org]. A lot of the sounds are the same between Codrescu and Ceausescu. When I was at Ohio State University [osu.edu], I took a class on Romanian Culture [ohio-state.edu] from Rodica Botoman [ohio-state.edu]. She is a very interesting person.

Re:vice shylork, exquisite corpse

[capoccia]

i know why google indexed school.
the robots.txt is in the wrong place. it should be in the document root, but bt only has access to his directory. googlebot ignores any robots.txt not in the document root [google.com].