Spam question

Jim Cohen · Post by **Jim Cohen** » 20 May 2005 3:35 pm

Can someone please 'splain to me the purpose of all the jumbled up words that I often find in the spam I receive? For example, I got one today that was, as usual, advertising Viagra, but after the advert, it included the following text:

Heart next song. Before shall body year. Say through, door fight. Hand at out case, let. Reach measure, go dry, off eye. Base moment correct dry smile. Great sign turn. Went need once hot oh fly. His, told green. Right fight sense you, laugh. Few product unit special, drop felt body. Children music, do, music book. Head will feet man. Kept stood notice hold time cow probable. Place tell food stood.

What's all that stuff for? [This message was edited by Jim Cohen on 20 May 2005 at 04:35 PM.]

Ken Lang · Post by **Ken Lang** » 20 May 2005 5:12 pm

Sounds like the copy writer was on something a little more spacey than Viagara.

Winston Street · Post by **Winston Street** » 20 May 2005 5:40 pm

Jim, I don't know what it means I get the same crap also. And sometimes if you go below and highlight some of this type of garbage there will be more stuff written in white letters that you can only see by highlighting the rest of the page.

Bill Llewellyn · Post by **Bill Llewellyn** » 20 May 2005 6:08 pm

I think it's an attempt to get by some spam filters. If the message has enough "normal" words in it, the filter lets it by. (But that's just my theory.)

Marty Pollard · Post by **Marty Pollard** » 20 May 2005 7:47 pm

I asked this a while back. It's actually interesting to read these (a few anyway).

I'm w/Bill; I think it makes the mail appear to have a text body.

NEW!!!
Prescription Mycoxafloppin!!!

Al Marcus · Post by **Al Marcus** » 20 May 2005 8:10 pm

I even got spam mail in German. I couldn't read it , of course.....al

------------------
My Website..... www.cmedic.net/~almarcus/

Howard Tate · Post by **Howard Tate** » 20 May 2005 9:35 pm

If you do a google or other search on a subject with any of those words in it, the site the spammer wants you to go to may be included in the search results. That's what I think and I'm not the smartest guy in town.

------------------
Howard, 'Les Paul Recording, Zum S12U, Vegas 400, Boss ME-5, Boss DM-3
http://www.Charmedmusic.com

Ray Minich · Post by **Ray Minich** » 20 May 2005 10:14 pm

Can you say "Bayesian Filter" (I probably mispelled Bayesian but my stats book is 15 miles away). This word string is designed to pass thru and be accepted by a Bayesian filter of the type used in a spam filter. The material was covered in a recent issue of Dr. Dobbs Journal.

Bill Llewellyn · Post by **Bill Llewellyn** » 21 May 2005 7:20 am

Bobby D. Hunter · Post by **Bobby D. Hunter** » 25 May 2005 11:15 am

I am not only doing security for the SGF, but am also involved in the Spam Fighting Community.

Spammers use various tactics to evade spam filters on email servers, and on the recipients' computers. These filters include Bayesian Learning Filters, as mentioned previously, as well as Spam Assassin, which is often installed by your web host or ISP.

I use Mailwasher Pro to filter out spam. It uses a combination of Bayesian and user created filters, plus Sender Blacklists and DNS Blocklists.

The tactic that the OP posted is very common and is usually ignored by any good spam detection program. Gibberish text doesn't fool anything but the most basic spam filters. I set Mailwasher Pro to scan at least the first 300 lines of text, and most of the gibberish is right at the beginning of most spams. The actual pitch is encoded in html code, so your email reader (client) will ignore the plain text (gibberish) and display the (spam) html content only.

When I do get a spam email that eludes my filters I instantly forward it to SpamCop, from Mailwasher Pro. SpamCop's parsers ignore the garbage and locate the spamveritzed website's URL, even if it was sent in base64 coding. I have yet to receive and report a spam email that SpamCop couldn't parse and report to the spammers upstream providers.

If you want to learn about fighting spam I recommend that you add the SpamCop newsgroup to your newsreader (Outlook Express, etc). The URL is: news.spamcop.net
The best group there is: "spamcop"
Spam Emails should only be posted to: "spamcop.mail"

I am an expert with Mailwasher Pro, and have my own page about it on my server, at: www.wizcrafts.info/mailwasher.html . There are links there to download it, buy it, or renew FirstAlert subscriptions, and to my own custrom filter set.

------------------
Bobby D. Hunter
Security for SGF
Hunting down Slimeball Game
Reporting member of SpamCop
[This message was edited by Bobby D. Hunter on 25 May 2005 at 12:19 PM.]