« Another Confused Spammer | Main | A 100% Opt-in Only Newsletter. Oh, Really! »
| Home | The Book | Training | Events | Tools | Stats |
Web log archive.
A Dispatch
January 09, 2009
Another Look Inside a Spam MessageA few weeks ago, I wrote about how one spam campaign embedded spam filter hash busting words within an HTML <style> tag to hide the text from view. At the time, I wondered if the words had been carefully selected to help the message get past content filters. A subsequent barrage showed me that the word list was not sacrosanct.
Today, I saw another spew of this campaign, but this time the spammer failed to configure his botnet properly, and some of the inside guts spilled out onto the floor:
From: <Colleen@7{%RND_WRD%}399.com>
To: <[removed]@dannyg.com>
Subject: loved your pics
Date: Fri, 09 Jan 2009 19:32:01 GMT
MIME-Version: 1.0
Message-Id: <8352238119.1090941034596498409@stc.7{%RND_WRD%}647.com>
X-Priority: 3
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Return-Path: Brittany@3{%RND_WRD%}998.com
<html>
<body><br />
waaaaaasup<br>Loved your pics hun..good profile too i would love to chat if your around tonight<br>Add me to your buddylist on msn<br>Lets Chat on YAHOO or MSN Messenger plz. add me [removed]@yahoo.com<Br><br>Talk to you soon!
</body>
<style>
{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};
...[a total of 156 of these]...
{%RND_WRD%};{%RND_WRD%};{%RND_WRD%};
</style>
</html>
Part of the misconfiguration caused the raw HTML and part of a second header to be displayed in the message body. But more revealing is the fact that the spam-sending robot didn't replace the {%RND_WRD%} placeholders with random words from a word list presumably provided by the spammer. It has exactly the same number of slots as there were hash-busting words in the earlier message.
Note, too, that such random words are supposed to be inserted into lines intended to be in the message's header, including return email address domain names and one line (Message-Id:), which—in normal email communications—is commonly added by the initiating email server. This message serves as one more example of how the only header information you can begin to trust is the stuff written by your own receiving server. For the worst spam, everything else in the header is pure fiction.
I'd really prefer that this message be so garbled that no one could make any sense out of it to respond. As it is, I don't know if I'd be hooking up with Juanita (the name in the hidden header that would appear in the inbox From column), Colleen, or Brittany. Or Vladimir.
Posted on January 09, 2009 at 01:13 PM