theHammer Posted December 21, 2003 Share Posted December 21, 2003 Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on Quote Link to comment Share on other sites More sharing options...
SonicDragon Posted December 21, 2003 Share Posted December 21, 2003 <p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>That looks like an image map to me also.I don't know about the random words though... Quote Link to comment Share on other sites More sharing options...
Ed_P Posted December 21, 2003 Share Posted December 21, 2003 I agree, it's a mapped image. The random words are to prevent SPAM filters from trapping it. Some of the new SPAM filters look for multiple copies of the same msg as being SPAM, the random words defeat this ability.BTW http://frj2.host2.biz/a.jpg doesn't respond., so maybe they got shut down. Quote Link to comment Share on other sites More sharing options...
Rons Posted December 21, 2003 Share Posted December 21, 2003 Or they moved to a different server. Quote Link to comment Share on other sites More sharing options...
Ed_P Posted December 21, 2003 Share Posted December 21, 2003 Or they moved to a different server. Either way, the links in the SPAM won't work. Quote Link to comment Share on other sites More sharing options...
theHammer Posted December 21, 2003 Author Share Posted December 21, 2003 I just received this today (actually two copies) to my throwaway address. Surprised that is is already "dead." Makes since that t all the random words are simply to avoid various logic algorithym filters - and they would fall at the bottom of the page with a mapped picture probably consuming the visible. And I assume that picture had varous text indicating you should click here for info etc.Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?Ed Quote Link to comment Share on other sites More sharing options...
Ed_P Posted December 21, 2003 Share Posted December 21, 2003 Now the picture was therefore to be displayed upon viewing the e-mail which would activate the hyperlink. The hotspots would then be active to activate any click - correct?Correct. Quote Link to comment Share on other sites More sharing options...
Bob_in_KS Posted March 7, 2006 Share Posted March 7, 2006 How is this for a late reply.Most likely the sender was checking for valid e-mail addresses for resale to or use by spammers.Sort of like using a beacon. The mail recipient previewing the e-mail either uploads the graphic http://frj2.host2.biz/a.jpg or fails to upload a non-existant graphic, either of which will generate a server log entry on the senders server.The sender simply counts the number of 404's or downloads for http://frj2.host2.biz/a.jpg in his logs and he has a good idea of how may addresses we good in his/her e-mail sent with the link or src of http://frj2.host2.biz/a.jpgOf course, spammers have gotten better at their deed. You might see them using class ID such as img src=3D"cid:ssamtmfcuuaaxrdcwoiatade for a graphic (which might appear to you as a pixel or period in a sentence) or <A HREF=3D"http://MveqM8cw8wfwre8et2qq1vqqjd8q8.empocketgm.com. The alpha-numrics MveqM8cw8wfwre8et2qq1vqqjd8q8 and ssamtmfcuuaaxrdcwoiatade not only serve to feed you the graphic or generate a 404 in error logs, but they also identify which e-mail address received the letter.When you get a seemingly innoculous looking e-mail with no purpose, it ususally has a purpose and will soon be followed up with more spam. Curiosity of course killed the cat but I also have the disease. Following is the beginning HTML content of some spam just received (I viewed as text and was unwilling to try viewing as HTML). The ASCII, for which I include but about 10%, just continued with random words. Unfortunately my HTML knowledge is limited to that used for a simple web site. I am just guessing but was this a mapped picture with hot spots but I cannot ascertain the hyperlinks? A better question might be just what is this spam attempting - certainly not selling me anything?Ed<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=1252"><title>New Page 1</title></head><body><p align=3D"center"><a href=3D"http://frj2.host2.biz/cpi/"><map name=3D"FPMap0"><area href=3D"http://frj2.host2.biz/cpi/o/" coords=3D"2, 278, 449, 299" sh=ape=3D"rect"><area href=3D"http://frj2.host2.biz/cpi/" shape=3D"default"><area href=3D"http://frj2.host2.biz/cpi/" coords=3D"0, 0, 10000, 10000" sh=ape=3D"rect"></map><img border=3D"0" src=3D"http://frj2.host2.biz/a.jpg" w=idth=3D"450" height=3D"300" usemap=3D"#FPMap0"></a></p>decennial billiken midge crewel decry raffia canterelle fallow burlap nab =clarinet aromatic tardy liechtenstein narrate trend lusty ascomycetes cura=and on and on and on Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted March 7, 2006 Share Posted March 7, 2006 Agreed. All the more reason to view emails in plain text and not view images inline. Quote Link to comment Share on other sites More sharing options...
striker Posted March 7, 2006 Share Posted March 7, 2006 Will there ever be coming something ok from a .biz account ?If I spot that I'll go away as fast as I can, if it is an email coming from such account I trash it unread immediately. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.