Jump to content

Recommended Posts

Posted

Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on

Posted
<p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>
That looks like an image map to me also.I don't know about the random words though...
Posted

I agree, it's a mapped image. The random words are to prevent SPAM filters from trapping it. Some of the new SPAM filters look for multiple copies of the same msg as being SPAM, the random words defeat this ability.BTW http://frj2.host2.biz/a.jpg doesn't respond., so maybe they got shut down. :)

Posted
Or they moved to a different server.  :P
Either way, the links in the SPAM won't work. :)
Posted

I just received this today (actually two copies) to my throwaway address. Surprised that is is already "dead." Makes since that t all the random words are simply to avoid various logic algorithym filters - and they would fall at the bottom of the page with a mapped picture probably consuming the visible. And I assume that picture had varous text indicating you should click here for info etc.Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?Ed

Posted
Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?
Correct. B)
  • 2 years later...
Posted

How is this for a late reply.Most likely the sender was checking for valid e-mail addresses for resale to or use by spammers.Sort of like using a beacon. The mail recipient previewing the e-mail either uploads the graphic http://frj2.host2.biz/a.jpg or fails to upload a non-existant graphic, either of which will generate a server log entry on the senders server.The sender simply counts the number of 404's or downloads for http://frj2.host2.biz/a.jpg in his logs and he has a good idea of how may addresses we good in his/her e-mail sent with the link or src of http://frj2.host2.biz/a.jpgOf course, spammers have gotten better at their deed. You might see them using class ID such as img src=3D"cid:ssamtmfcuuaaxrdcwoiatade for a graphic (which might appear to you as a pixel or period in a sentence) or <A HREF=3D"http://MveqM8cw8wfwre8et2qq1vqqjd8q8.empocketgm.com. The alpha-numrics MveqM8cw8wfwre8et2qq1vqqjd8q8 and ssamtmfcuuaaxrdcwoiatade not only serve to feed you the graphic or generate a 404 in error logs, but they also identify which e-mail address received the letter.When you get a seemingly innoculous looking e-mail with no purpose, it ususally has a purpose and will soon be followed up with more spam.

Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on
Guest LilBambi
Posted

Agreed. All the more reason to view emails in plain text and not view images inline. :hysterical:

Posted

Will there ever be coming something ok from a .biz account ?If I spot that I'll go away as fast as I can, if it is an email coming from such account I trash it unread immediately.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...