skreidle: (Default)
skreidle ([personal profile] skreidle) wrote2004-02-02 07:36 pm

Strange spam

Recently I've been getting strange spam, which seems to serve no purpose. The format for the subject will be "Re: [random letters] [random phrase]" with a body of random words. However, I've realized that the body is almost a Best of Word of the Day, so I thought I'd share two recent examples:


From: Chung <zxbkpfdhlgw@cnnic.net.cn>
To: [various Cornell addresses]
Subject: Re: CR, the strangely dressed

condensible nymphomania carp betel hibernate ounce fresno t entranceway harlan rent experiential allusion solstice kent conundrum cowboy counterexample million prosody


From: Irving <ewgxkzqcm@canada.com>
To: [Cornell address]
Subject: Re: XDDWCZ, the procurators order
CC: [various Cornell addresses]

bisexual surjective cheekbone rummage unipolar transmutation rehearsal meritorious thorpe calder idolatry turf bedspread jess brainchildren indubitable kentucky illegal manitoba penalty announce anatomy blot

possibility

[identity profile] eitri.livejournal.com 2004-02-02 12:48 am (UTC)(link)
chances are that they're two-part messages, both plain text and html. i'd imagine your mail app is only displaying the plain text portion. if you view the source of the messages, if you can, you'll most likely see the actual content, not that you necessarily want to...

Re: possibility

[identity profile] skreidle.livejournal.com 2004-02-03 08:46 am (UTC)(link)
Yeeeah.

Recent one has some xhtml headers, a graphic and link to a "free cable tv! no more pay!" with </words> interjected to fool filters, and a massive set of real words, I suppose to fool the filters further, looking like a lot of English and thus not spam. Laaaame.

(I'm still using Eudora, execpt it's the Mac version at the moment.)

Re: possibility

[identity profile] eitri.livejournal.com 2004-02-03 12:33 pm (UTC)(link)
actually, x-html is probably eudora specific markup. eudora, for some reason, adds specific tags to email messages, all of which start with 'x-'. (if it were xhtml, without the dash, that'd be different) i'd imagine that the email is a simple html one, but i guess it doesn't matter too much.

Re: possibility

[identity profile] skreidle.livejournal.com 2004-02-03 05:10 pm (UTC)(link)
Latest one, following the standard header, we have:

Content-Type: text/html;
Content-Transfer-Encoding: 7Bit

<x-html><!x-stuff-for-pete base="" src="" id="0" charset="iso-8859-1/macintosh"><HTML><HEAD>
<BODY>
<p>Fr</millennium>ee Ca</permalloy>ble% TV</p>
<a href="http://www.303hosting.com/cable/">
<img border="0" src="http://www.303hosting.com/fiter1.jpg"></a>
taxicab euterpe rube metamorphosis neve welsh vainglorious scurvy adhesive holly exclusionary auxiliary decimate downhill brass parse cleanup <BR>

[more random words]

</BODY>
</HTML>

</x-html>

Nice, eh?

[identity profile] liandriel.livejournal.com 2004-02-02 01:18 am (UTC)(link)
I find those only slightly less entertaining than the ones which have randomly selected portions of actual stories. Of course, what stinks about the stories is that they invariably leave you hanging after a paragraph or so. ;p

Re:

[identity profile] skreidle.livejournal.com 2004-02-03 08:41 am (UTC)(link)
Hm! Haven't gotten any of those.
ext_157778: (Default)

[identity profile] deusinnomen.livejournal.com 2004-02-02 06:35 am (UTC)(link)
Yeah, actually, I've been trying to fine tune my SpamAssassin setup to nail these damned things. The first guy was right, they're multi-part messages. The second one is a "Content-Type: text/html" message that contains a spam message.

But yeah, any email that's "[A-Z]{2,8}, word word word" is a spam. ;)

Re:

[identity profile] skreidle.livejournal.com 2004-02-03 08:53 am (UTC)(link)
Apparently Eudora doesn't like displaying x-html, which is what the real content of these seems to be--still interspersed with </words> to break up spam triggers.

And, yes. :)

[identity profile] lanikei.livejournal.com 2004-02-02 08:17 am (UTC)(link)
yeah i used to be pretty satisfied with yahoo's spam blocker but the last week or two, while its obviously catching a ton, it's not getting some that seem pretty obvious. i'm starting to get pissed.

Re:

[identity profile] skreidle.livejournal.com 2004-02-03 08:54 am (UTC)(link)
Well, obvious to your eye, but spammers are getting pretty devious at circumventing known spam-filtering algorithms. Fuckers.

Re:

[identity profile] lanikei.livejournal.com 2004-02-03 09:25 am (UTC)(link)
right, i understand that. i don't really blame yahoo, spammers are nefarious creatures. but still sucks.