theHammer Posted December 21, 2003 Posted December 21, 2003 Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on Quote
SonicDragon Posted December 21, 2003 Posted December 21, 2003 <p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>That looks like an image map to me also.I don't know about the random words though... Quote
Ed_P Posted December 21, 2003 Posted December 21, 2003 I agree, it's a mapped image. The random words are to prevent SPAM filters from trapping it. Some of the new SPAM filters look for multiple copies of the same msg as being SPAM, the random words defeat this ability.BTW http://frj2.host2.biz/a.jpg doesn't respond., so maybe they got shut down. Quote
Ed_P Posted December 21, 2003 Posted December 21, 2003 Or they moved to a different server. Either way, the links in the SPAM won't work. Quote
theHammer Posted December 21, 2003 Author Posted December 21, 2003 I just received this today (actually two copies) to my throwaway address. Surprised that is is already "dead." Makes since that t all the random words are simply to avoid various logic algorithym filters - and they would fall at the bottom of the page with a mapped picture probably consuming the visible. And I assume that picture had varous text indicating you should click here for info etc.Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?Ed Quote
Ed_P Posted December 21, 2003 Posted December 21, 2003 Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?Correct. Quote
Bob_in_KS Posted March 7, 2006 Posted March 7, 2006 How is this for a late reply.Most likely the sender was checking for valid e-mail addresses for resale to or use by spammers.Sort of like using a beacon. The mail recipient previewing the e-mail either uploads the graphic http://frj2.host2.biz/a.jpg or fails to upload a non-existant graphic, either of which will generate a server log entry on the senders server.The sender simply counts the number of 404's or downloads for http://frj2.host2.biz/a.jpg in his logs and he has a good idea of how may addresses we good in his/her e-mail sent with the link or src of http://frj2.host2.biz/a.jpgOf course, spammers have gotten better at their deed. You might see them using class ID such as img src=3D"cid:ssamtmfcuuaaxrdcwoiatade for a graphic (which might appear to you as a pixel or period in a sentence) or <A HREF=3D"http://MveqM8cw8wfwre8et2qq1vqqjd8q8.empocketgm.com. The alpha-numrics MveqM8cw8wfwre8et2qq1vqqjd8q8 and ssamtmfcuuaaxrdcwoiatade not only serve to feed you the graphic or generate a 404 in error logs, but they also identify which e-mail address received the letter.When you get a seemingly innoculous looking e-mail with no purpose, it ususally has a purpose and will soon be followed up with more spam. Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on Quote
Guest LilBambi Posted March 7, 2006 Posted March 7, 2006 Agreed. All the more reason to view emails in plain text and not view images inline. Quote
striker Posted March 7, 2006 Posted March 7, 2006 Will there ever be coming something ok from a .biz account ?If I spot that I'll go away as fast as I can, if it is an email coming from such account I trash it unread immediately. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.