« Not All Phish Messages Are Harmless | Main | A Phisher With a Sideline? »

May 01, 2005

For the last couple of weeks I've been seeing spam messages come through for every erectile dysfunction med advertised in the Sunday supplements. That, of course, is nothing new. But what's odd about these messages is that it's clear from the HTML source code behind them that the spammer has gone to great lengths to disguise the text to try to slip through content filters. He breaks up words with all kinds of HTML tags and goes to considerable trouble to fashion an all-text message out of a sort of jumbled HTML table.

But he consistently leaves out one thing I'd expect to see: any link, URL, email address, or other way to contact him to buy his ED drugs. The return (From:) addresses are universally bogus, and the messages are sent through hijacked zombie PCs.

It appears that the messages I'm seeing are cut off before they're completed. There is a telltale "[2" sequence at the end of all of these messages. Perhaps it's only part of his zombie runs that have the glitch, and others get through that have a link (and my filters auto-delete them before I ever see them).

If a good chunk of the messages aren't earning the drugger a dime, that's fine with me. I'd really like it if his return is so low that he feels spamming no longer pays. I'd like it even more if he's paying a spewer on the number of messages accepted for delivery so that he's out money he'll never ever recover. I'm liking this more and more....