On Fri, 2006-01-27 at 17:13 -0800, Kelson wrote: > John Fleming wrote: > > This is a new one for me. Today I've received some mail with "hey john" > > in the subject, and the mail otherwise appears blank. It didn't contain > > a virus, or it would've been discarded by ClamAV. > > > > Are these familiar to you guys? What's the point of them? Headers of > > one below: Thanks! - John > > I've been seeing a lot of these over the last two days. In each case > it's "hey LHS-of-address" So I've seen a lot of "hey kelson" and "hey > webmaster". I thought "hey postmaster" was funny, but then I saw "hey > mailer-daemon" > > Most of them have been blank, like the one you saw. What's interesting > is that they aren't actually empty -- they're multipart/alternative > messages containing both HTML and plaintext parts -- it's just that > there's no content in either of them. > > I did see one that had some text and an attached image, but I didn't pay > much attention to it and discarded it after training Bayes & reporting > to Razor. Nothing really stood out about it, so I don't remember the > topic, and I'm not 100% certain it was one of these and not another > piece of spam that showed up in the search for "Subject: hey" > > My guess is that it's just a broken or misconfigured mailer. It's > sending incorrectly, or the spammer forgot to paste in the body of the > message, or something.
I wonder if perhaps it's just some sort of probe. Maybe they send out a bunch of them and then make a note of the ones which don't bounce. Those are then used for the "real" spam. Thoughts? TC
