Help understanding spam source code?

Discussion in 'HTML' started by JM, Sep 30, 2005.

  1. JM

    JM Guest

    Hello,

    I'm an HTML noob, so I cannot begin to explain what's going on here. This
    is the source info from an email spam message I received today. I sincerely
    apologize if including this code is poor etiquette. As you will see if you
    view the code in a browser, the source bears no resemblance to what the
    browser displays - at least to a someone like me.
    I would apprciate ANY insight provided. I would love to know what's going
    on.

    Thank you,

    jm




    <FONT color=#ffffff size=1>The second book begins , "Bienseance de la it
    was assumed that Washington himself ,Mr. Conway found in the </FONT>
    <META content="MSHTML 6.00.2800.1106"
    name=GENERATOR>
    <STYLE></STYLE>

    <TABLE style="FONT-SIZE: 14px; FONT-FAMILY:
    Arial"
    width=500 bgColor=black>
    <TBODY>
    <TR bgColor=#3333ff>
    <TH
    style="FONT-SIZE: 15px; COLOR:
    white">Welcom<SPAN
    style="DISPLAY: none">gave food for his
    vivid imagination. </SPAN>e to
    the Pharmac<SPAN style="DISPLAY:none">the
    world over. </SPAN>yMail</TH></TR>
    <TR bgColor=#cccccc>
    <TD>Hello,&nbsp;<B><A
    style="TEXT-DECORATION:underline"href="http://nlmvkdznyx.icybite.info/?58931444Ff1ceZe87c817a97efd6eW1e">PHA<SPAN
    style="DISPLAY: none">child in his eighth
    year," </SPAN>RMA-S<SPAN
    style="DISPLAY: none">Washington's life that
    </SPAN>HOP</A></B> Wel<SPAN
    style="DISPLAY: none">a Christmas poem,
    </SPAN>comes you!
    <BR><BR><B>Vl<SPAN
    style="DISPLAY: none">trained in that
    subject. </SPAN>AGRA</B> as<SPAN
    style="DISPLAY: none">Washington was fitted
    </SPAN> low as <B
    style="COLOR: #ef0303">$ 10<SPAN
    style="DISPLAY: none">"True
    Happiness,"</SPAN>9.99</B> (3<SPAN
    style="DISPLAY: none">consideration for
    others, his respect for </SPAN>0
    piI<SPAN style="DISPLAY: none">presentation.
    </SPAN>ls),
    <BR><B>ClA<SPAN style="DISPLAY: none">and he
    copied them.</SPAN>LlS</B> as low a<SPAN
    style="DISPLAY: none">the late Moncure D
    Conway, was born in </SPAN>s <B style="COLOR: #ef0303">$
    32<SPAN style="DISPLAY: none">"True
    Happiness,"</SPAN>4.00</B> (9<SPAN
    style="DISPLAY: none">all were early
    inculcated in him by precepts </SPAN>0 p<SPAN
    style="DISPLAY: none">Company </SPAN>iIls),
    <BR><B>VALl<SPAN style="DISPLAY:
    none">comprehension of the fineness of Washington's .</SPAN>UM</B> as low
    <SPAN
    style="DISPLAY: none">The one devoted
    to</SPAN>as <B
    style="COLOR: #ef0303">$ 3<SPAN
    style="DISPLAY: none">A French edition
    </SPAN>41.00</B> (9<SPAN
    style="DISPLAY: none">comparison of
    Washington's Rules </SPAN>0 piI<SPAN
    style="DISPLAY: none">to a treatise entitled
    </SPAN>ls),
    <BR><B>XAN<SPAN style="DISPLAY:
    none">biographers have regarded them as formative </SPAN>AX</B> as low <SPAN
    style="DISPLAY: none">child in his eighth
    year," </SPAN>as <B
    style="COLOR: #ef0303">$ 1<SPAN
    style="DISPLAY: none">completed his
    comparisons </SPAN>30.00</B> (3<SPAN
    style="DISPLAY: none">appeared at Paris at
    least </SPAN>0 piI<SPAN
    style="DISPLAY: none">Conversation entre les
    Hommes," </SPAN>ls), <BR><B>L<SPAN
    style="DISPLAY: none">Few graduates of
    colleges </SPAN>EVlTRA</B> as<SPAN
    style="DISPLAY: none">and deference to those
    deserving such treatment, </SPAN> low as <B
    style="COLOR: #ef0303">$ 49<SPAN
    style="DISPLAY: none">of Congress,
    ..</SPAN>9.99</B> (9<SPAN
    style="DISPLAY: none">love poems attributed
    </SPAN>0 pi<SPAN
    style="DISPLAY: none">and even his reverence
    for his Maker, </SPAN>Ils)
    and many<SPAN style="DISPLAY: none">trained
    in that subject. </SPAN> other <BR><BR>Just try us and
    you will not be disap<SPAN
    style="DISPLAY: none">edition appeared at
    Pont-a-Mousson in 1617, </SPAN>pointed!
    </TD></TR></TBODY></TABLE>

    <FONT color=#ffffff size=1>Just as he had , exercises of George Washington,
    to their brothers at Pont-a-Mousson.,and of the epoch-making </FONT>

    <BR>

    <P><FONT SIZE=2>--<BR>
    No virus found in this incoming message.<BR>
    Checked by AVG Anti-Virus.<BR>
    Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date:
    9/29/2005<BR>
    </FONT> </P>
    JM, Sep 30, 2005
    #1
    1. Advertising

  2. JM wrote:

    > Hello,
    >
    > I'm an HTML noob, so I cannot begin to explain what's going on here.


    > <FONT color=#ffffff size=1>The second book begins ,


    Color is white, probably same as your background, and a very small size,
    if your background was something other than white. Can you see white on
    white?

    > <SPAN style="DISPLAY: none">gave food for his
    > vivid imagination. </SPAN>


    Heh. display: none. Your client won't show it.


    <BR><BR><B>Vl<SPAN
    > style="DISPLAY: none">trained in that
    > subject. </SPAN>AGRA</B> as<SPAN
    > style="DISPLAY: none">Washington was fitted
    > </SPAN> low as <B


    Viagra, eh?

    Is this enough info for you to pick out the why?


    > No virus found in this incoming message.<BR>
    > Checked by AVG Anti-Virus.<BR>
    > Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date:
    > 9/29/2005<BR>
    > </FONT> </P>


    Spammer even includes an AVG advertisement. :)

    So by now, you have decided to turn off all rendering of email in HTML,
    correct? Switched it to Plain Text only? Many people just bin HTML
    mail upon receipt, including me.

    --
    -bts
    -When motorcycling, never follow a pig truck
    Beauregard T. Shagnasty, Sep 30, 2005
    #2
    1. Advertising

  3. On Fri, 30 Sep 2005 18:32:41 +0000, JM wrote:

    > <META content="MSHTML 6.00.2800.1106"


    Yuck, no wonder it's a mess. ;)

    I wouldn't worry. It just looks like the kind of nonsense spammers send
    out to poison bayesian spam filters.

    --
    Jafar Calley
    SysAdmin - http://moonlife-records.com
    --------------------------------------
    See the latest Mars and Saturn images
    http://fatcat.homelinux.org
    Jafar As-Sadiq Calley, Sep 30, 2005
    #3
  4. JM

    Andy Dingley Guest

    On Fri, 30 Sep 2005 22:47:44 +0200, Jafar As-Sadiq Calley
    <> wrote:

    >I wouldn't worry. It just looks like the kind of nonsense spammers send
    >out to poison bayesian spam filters.


    Actually a good (i.e. looks at the source, not the result) Bayesian spam
    filter is quite strong against this camouflaged spam - better than a
    simple keyword spotter. The best performance comes from a filter that's
    HTML/CSS aware and knows how to process display:none; but obviously
    that's time-consuming to filter.

    Binning all HTML email on sight is even better, of course.
    Andy Dingley, Oct 1, 2005
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Rene Pijlman
    Replies:
    22
    Views:
    724
    Fredrik Lundh
    Dec 10, 2003
  2. Sergio Correia
    Replies:
    7
    Views:
    290
    Ben Finney
    Sep 18, 2007
  3. Replies:
    3
    Views:
    478
  4. zax75
    Replies:
    1
    Views:
    1,094
  5. David Binnie
    Replies:
    2
    Views:
    447
    Rich Webb
    May 22, 2009
Loading...

Share This Page