Subject: RE: [Asrg] 2a. Analysis - Spam Sample

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Nov 2003 12:53:50 -0800

I think this is a somewhat different case. The Zumabot was designed to
suppress discussion, this seems to be designed to attack.

It is possible that this is another spammer, or it could be some guy with an
inadequately dimensioned sexual characteristic who purchased the product,
was disastisfied and is responding by trying to attack the spammer through
mailing list spam.

This is still spam but it is pretty low tech spam, we don't have evidence
for spam infrastructure. It would be different if this had been sent out to
a couple of million addresses.

		Phill

> -----Original Message-----
> From: Alan DeKok [mailto:[email-masked]]
> Sent: Wednesday, November 12, 2003 3:06 PM
> To: [email-masked]
> Subject: Re: [Asrg] 2a. Analysis - Spam Sample 
> 
> 
> Yakov Shafranovich <[email-masked]> wrote:
> > Below is a spam sample sent directly to the ASRG list and
> > intercepted in the admin interface. My question to you is what
> > purpose does this particular spam serve?
> 
>   Emotional satisfaction.
> 
> > Is this simply a case of two spammers fighting it out, or perhaps an
> > attack on someone?
> 
>   Or crazy people.  It's happened before.
> 
> 	http://www.jaedworks.com/shoebox/zumabot.html
> 
>   Usenet, Turkey, and Armenia...
> 
>   Alan DeKok.
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 12 Nov 2003 16:15:36 -0500

Thanks for the comments,

I don't know how many people this was sent to, perhaps someone in the 
group can check that specific message against Postini or Brighmail. In 
any case, the IP is blacklisted in SPEWS and SpamCop. A quick search on 
Google reveals a bunch of web message boards that have the same or 
similar message, and the email appears in to have been posted on Usenet 
a bunch of times as well. So far it seems that this message is being 
posted to public places such as mailing lists and message boards, and 
not being sent to millions of people.

However, my concern is whether this is a sign that people will begin to 
attack spam via spam, kind of like a story a while back where a virus 
was sent to patch a hole explotiable by another virus.

Yakov