Re: Curious "spam" (or broken viral payload)...

From: John Washington (jawashin@uiuc.edu)
Date: 01/09/03

  • Next message: J Jewitt: "Odd Shares showing up on workstations" 
    Date: Wed, 08 Jan 2003 23:38:23 -0700
From: John Washington <jawashin@uiuc.edu>
To: "Jay D. Dyson" <jdyson@treachery.net>

    >
    >
    > So, all things considered, am I:
    >
    > 1. looking at the output from a broken mail worm, or;
    > 2. dealing with a second- or third-rate spammer who just doesn't
    > know what the heck he's spewing out, or;
    > 3. receiving an attempted spam mail through a broken web->mail
    > gateway, or;
    > 4. none of the above?
    >
    >
    >
    One possible addition to the list is a spammer trying to verify (I have
    gotten many messages from spammers selling "verified" e-mail addresses)
    that you are a legit address.

    > arro@arro.ru and inform them of the time the error occurred,
    >
    >
    I went to the arro.ru page, and from the looks I would allow the
    possibility that this was an attempt to verify it, and more oddly on the
    front page it has a link with the title "my spam CANCLED" pointing to a
    (seemingly) broken page.

    John Washington

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com