欧美三区_成人在线免费观看视频_欧美极品少妇xxxxⅹ免费视频_a级毛片免费播放_鲁一鲁中文字幕久久_亚洲一级特黄

[Spam]垃圾郵件者綱要(Spammer's Compendium)

系統(tǒng) 1963 0

(中文文字來源于“中國數(shù)字部落(DIGIBLOG_ORG) - 無關(guān)緊要的消息”: http://digiblog.org/ )

?

(p.s.: Spammer's Compendium 用實例列舉了垃圾郵件制造者絕大多數(shù)的伎倆,不得不感嘆spammer們的智慧。)

WIRED :雖然垃圾郵件讓所有的人都煩惱,也讓Internet的速度降低了60%,但是殊不知垃圾郵件事實上也蘊涵了很多高科技的成分,尤其是在現(xiàn)在這場發(fā)垃圾和反垃圾的高科技戰(zhàn)斗之中。
除了黑名單之外,目前最被看好的反垃圾方式應(yīng)該就是Bayesian規(guī)則了。通過識別原來的垃圾郵件的內(nèi)容,自動判別下一封Email屬于垃圾郵件的可能性。這幾乎就是人工智能和真人智能的比賽,因為能夠發(fā)出垃圾郵件的人也并非等閑之輩他們往往都自己親自安裝一些最好的反垃圾郵件設(shè)備,比如 Inboxer POPFile ,不斷地調(diào)整自己的發(fā)送技巧以盡可能地躲過被過慮掉的結(jié)果。
一位軟件工程師制作了一份“ 垃圾郵件者綱要(Spammer's Compendium) ”,不斷更新地列舉了垃圾郵件中采用的最奇妙和下流的辦法,比如使用各種非可見的HTML代碼等(如果你是一位業(yè)余垃圾郵件發(fā)送者,看一下應(yīng)該會有不少收獲的)。不過最讓人感到好玩的還要算是使用了最新的一個研究課題-人類閱讀的機制(也就是著名的 Can You Raed Tihs )。所以有些垃圾郵件的內(nèi)容里幾乎沒有一個拼寫正確的單詞,但是你卻可以沒有什么障礙的閱讀,比如 這個 。這些技巧對于Bayesian來說也是一個不小的挑戰(zhàn),當然如果他們漏網(wǎng)了,你確實可以驚嘆一下發(fā)送者的巧妙用心。
這場戰(zhàn)斗是一定要持續(xù)下去的,這些只是垃圾郵件們在超速進化中的一些故事而已。

The Spammers' Compendium

Being a public exposition of tricks,
secret ploys, ruses and techniques
employed by those that send many
scurrilous messages through the ether
using the mysteries of electronics and
other modern marvels to dazzle the eye,
lighten the wallet and clog the recipient.

Background

I gave a talk entitled The Spammers' Compendium at the MIT Spam Conference and decided to keep it updated in a non-Powerpoint form. Hence this page was born.

I last updated it on September 15, 2003

Each entry consists of five items:

What: Simple description of the entry
Popularity: How common the trick is: common, sometimes, rare
Complexity: How complex the trick is: simple, clever, dastardly
Date added: When this entry was made
Example from the wild: Actual example from email seen in the wild

The Tricks

The Big Picture

What: The entire email consists of a small HTML page consisting of an image enclosed in a single hyperlink.
Popularity: Common
Complexity: Simple
Date added: January 17, 2003
Example from the wild:
              <html><img src="http://www.your-info-station.com/Sla/chalkboard.gif"><div><a ><img src="http://www.your-info-station.com/Sla/pitch.gif"></a></html>
            

April 29, 2003: Scott Schram points out that some instances of this are being sent with valid but unrelated text before and after the image.


Invisible Ink

What: Use of white text on a white background containing words designed to confuse a filter.
Popularity: Common
Complexity: Clever
Date added: January 17, 2003
Example from the wild:
              <font color="white" size="-1">search words: suspensory obscurearistocratical meningorachidian unafeared brahmachari</font>
            

The Daily News

What: Insert a piece of current news in a bogus HTML tag.
Popularity: Rare
Complexity: Clever
Date added: January 17, 2003
Example from the wild:
              <Despite statements last week from chief U.N. inspector Hans Blix thatfull cooperation was expected from Iraq, Iraqi Foreign Minister NajiSabri lashed out at the United Nations in a 19-page letter to Secretary-General Kofi Annan written in Arabic. In it, Sabri repeated previousclaims that Iraq has no weapons of mass destruction and that the inspectionsare just a false pretense for the United States and Britain to attack hiscountry. Sabri assailed U.N. Security Council resolution 1441, adopted November 8, that called for Iraq to give immediate, unfettered access to weapons inspectors. Iraq "is being subjected to terrorism for more than30 years from international and regional powers," he wrote. "And Iraq's under a daily aggression represented in the terrorism of the U.S. and Britain throughthe imposition of the no-fly zones." Iraq has shot at U.S. and British aircraftrepeatedly in the no-fly zones since they were established after the PersianGulf War, and coalition aircraft have fired on Iraqi bases in response. Inthe most recent action, coalition aircraft struck a mobile radar systemSaturday in the southern no-fly zone, according to the U.S. Central Command. The Iraqi News Agency said the aircraft fired on civilian and servicefacilities. After Iraq fired on U.S. and British planes last week, U.S.officials said the attacks constituted a "material breach" of Resolution 1441,which could trigger a meeting of the U.N. Security Council at which theUnited States could call for military action against Iraq>
            

Hypertextus Interruptus

What: Split words using HTML comments, pairs of zero width tags, or bogus tags
Popularity: Common
Complexity: Clever
Date added: January 17, 2003
Examples from the wild:
              milli<!-- xe64 -->onaireFi</n>nd N</n>ew </n>Fri</n>end</n>sVi<b></b>agraF<XYZ>r<XXYA>ee
            
September 15, 2003: Another example comes from Tim Peters, this uses a Microsoft-only HTML tag <comment> to insert ignored text into the word Viagra:
              Via<comment>6q5r7</comment>gra
            

Slice and Dice

What: Use a table to send words through as individual letters arranged top to bottom but read left to right
Popularity: Rare
Complexity: Dastardly
Date added: January 17, 2003
Example from the wild: ( picture )
              <table cellpadding=0 cellspacing=0 border=0><tr><td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="Courier New, Courier, mono" size=2>?<br>U<br>?<br>O<br>a<br>?<br>D<br>u<br>a<br>?<br>N<br>?<br>B<br>d<br>?<br>N<br>?<br>C<br>?<br>C<br>w<br>?<br>1<br>?<br>?<br>?<br>1<br>?<br>C<br>S<br></font></td></tr></table></td><td><table cellspacing=0 cellpadding=0 border=0><tr><td><fontface="Courier New, Courier, mono" size=2>???<br>?N?<br>???<br>bta<br>nd?<br>???<br>ipl<br>niv<br>nd?<br>???<br>o?r<br>???<br>ach<br>ipl<br>???<br>o?o<br>???<br>onf<br>???<br>ALL<br>ith<br>???<br>?-?<br>???<br>???<br>???<br>?-?<br>???<br>all<br>und<br></font></td></tr></table></td><td><table cellspacing=0 cellpadding=0 border=0><tr><td><fontface="Courier New, Courier, mono" size=2>???<br>I?V<br>???<br>in?<br>the<br>???<br>oma<br>ers<br>lif<br>???<br>equ<br>???<br>elo<br>oma<br>???<br>ne?<br>???<br>ide<br>???<br>?NO<br>in?<br>???<br>3?1<br>???<br>???<br>???<br>2?1<br>???<br>?24<br>ays<br></font></td></tr></table></td><td><table cellspacing=0 cellpadding=0 border=0><tr><td><font face="CourierNew, Courier, mono" size=2>??<br>?E<br>??<br>a?<br>?a<br>??<br>s?<br>it<br>e?<br>??<br>ir<br>??<br>rs<br>s?<br>??<br>is<br>??<br>nt<br>??<br>W?<br>da<br>??<br>?2<br>??<br>??<br>??<br>?2<br>??<br>?h<br>?a<br></font></td></tr></table></td>
            

MIME is Money

What: Send two part MIME document, text/plain part contains bogus text, text/html part contains the spam message
Popularity: Rare
Complexity: Very clever
Date added: January 17, 2003
Example from the wild:
              ------=_NextPart_001_2D3DF_01C29D73.26716240Content-Type: text/plain;The modes of letting vacant farms, the duty of supplying buildings and permanentimprovements, and the form in which rent is to be received, have all been carefullydiscussed in the older financial treatises. Most of these questions belong topractical administration, and are, moreover, not of great interest in modern times.Certain plain rules, may, however, be stated. The claims of successors to the latetenant should not be overlooked; it is better for the tenure to be continued withoutbreak, and therefore the question of new letting ought rarely tooccur.------=_NextPart_001_2D3DF_01C29D73.26716240Content-Type: text/html;<p><b><font face=Arial>Now is the perfect time to get a mortgage,and we have a simple and free way for you to get started.</font></b></td>
            
September 15, 2003: This trick seems to be getting more common.

L O S T i n S P A C E

What: Insert spaces between letters to make words unrecognizable.
Popularity: Common
Complexity: Simple
Date added: January 17, 2003
Examples from the wild:
              M O R T G A G EF*R*E*E V捍扐扜扲扐 O*N*L*I*N*E
            

Enigma

What: Use URL encoding to hide URLs
Popularity: Rare
Complexity: Clever
Date added: January 17, 2003
Example:
              http://7763631671/obscure.htmhttp://0xCeBF9e37/obscure.htmhttp://0316.0277.0236.067/obscure.htmhttp://3468664375@3468664375/o%62s%63ur%65%2e%68t%6D
            

Script Writer

What: Keep HTML body of email in a Javascript that fires when the email is opened
Popularity: Rare
Complexity: Clever
Date added: January 17, 2003
Example from the wild:
              <HTML><HEAD><SCRIPT LANGUAGE="Javascript"><!-- var Words="%3CHTML%3E%0D%0A%3CHEAD%3E%0D%0A%3CTITLE%3E%3C/TITLE%3E%0D%0A%3CMETA%20HTTP-EQUIV%3D%22Content-Type%22%20CONTENT%3D%22text/html%3B%20charset%3DBig5%22%3E%0D%0A%3CMETA%20HTTP-EQUIV%3D%22Expires%22%20CONTENT%3D%22Sat%2C%201%20Jan%202000%2000%3A00%3A00%20GMT%22%3E%0D%0A%3CMETA%20HTTP-EQUIV%3D%22Pragma%22%20CONTENT%3D%22no-cache%22%3E%0D%0A%3C/HEAD%3E%0D%0A%3CFRAMESET%20ROWS%3D%22100%25%2C0%22%20FRAMEBORDER%3DNO%20BORDER%3D%220%22%20FRAMESPACING%3D0%3E%0D%0A%3CFRAME%20SRC%3D%22http%3A//203.204.53.231/a1_K_2/e12w_k2/a_w_a_0__2k-1_second%22%20NAME%3D%22AMENU%22%20SCROLLING%3DAUTO%20MARGINHEIGHT%3D0%20MARGINWIDTH%3D0%3E%0D%0A%3CFRAME%20SRC%3D%22%22%20SCROLLING%3DNO%20noresize%3E%0D%0A%3C/FRAMESET%3E%0D%0A%3CNOFRAMES%3E%0D%0A%3C/NOFRAMES%3E%0D%0A%3C/HTML%3E%0D%0A?functionSetNewWords() { var NewWords; NewWords = unescape(Words); document.write(NewWords);} SetNewWords(); // --> </SCRIPT> </HEAD> <BODY> </BODY> </HTML>
            

Ze Foreign Accent

What: Replace letters with numbers or use nonsense accents
Popularity: Common
Complexity: Simple
Date added: January 17, 2003
Example from the wild:
              V1DE0 T4PE M0RTG4GEF醤t醩t扃 -- e醨n m鮪閥 thr魎gh un琿lle鐃ed judgments
            

Speaking in Tongues

What: Large nonsense words designed to mess up CRC based spam identification
Popularity: Common
Complexity: Clever
Date added: January 17, 2003
Example from the wild:
              crecrephaswukutugucrovazichonuprixisluwephimajoq
            

The Black Hole

What: Use of font size 0 to break up words with zero width spaces
Popularity: Rare
Complexity: Clever
Date added: April 1, 2003
Example from the wild:
              V<font size=0>&nbsp;</font>i<font size=0>&nbsp;</font>a<font size=0>&nbsp;</font>g<font size=0>&nbsp;</font>r<font size=0>&nbsp;</font>a
            

A Numbers Game

What: Use HTML entities instead of letters
Popularity: Rare
Complexity: Simple
Date added: April 1, 2003
Example from the wild:
              &#87;&#97;tc&#104; &#68;ogs &#115;&#108;u&#114;p&#32;you&#110;&#103; &#103;&#105;&#114;&#108;&#115;&#32;p&#117;s&#115;
            

Bogus Login

What: Use URL username@host syntax to disguise a URL.
Popularity: Rare
Complexity: Simple
Date added: April 6, 2003
Example from the wild: (this example also use % encoding of the URL to further disguise it)
              <a href="http://10111001100100101001010101010101010100101100101001100110001010101001010101001010100101001010101010011001101010101001010100101001100101010101010101011011010011100110@%68%6B%2E%67%65%6F%63%69%74%69%65%73%2E%63%6F%6D/%6C%6F%76%65%67%69%6C%6C%67%69%6C%6C"><font color="#FFFFFF">Click Here</font></a>
            

Honey, I shrunk the font

What: Use very small (size 1) font to hide bogus text (see also The Black Hole)
Popularity: Rare
Complexity: Simple
Date added: April 6, 2003
Example from the wild: (Notice how the spammer didn't follow the instructions and managed to leave the instructions in the spam :-) (This spam also uses Invisible Ink for these words)
              <p style="margin-bottom: -20"><font size="1" color="#FFFFFF">Random word ofBIG LETTERS with length 1 to 22 TSUTHRXJKVUVBECP</font></p><p style="margin-bottom: -20"><font size="1" color="#FFFFFF">Random word ofsmall letters with length 1 to 16 uyswdgueoclrwlf</font></p><p style="margin-bottom: -20"><font size="1" color="#FFFFFF">Random word ofmixed symbols with length 1 to 27 7y14R484w1m7531X</font></p><p style="margin-bottom: -20"><font size="1" color="#FFFFFF">Your text 9, note,maximum length of tag is 255 symbols</font></p><p style="margin-bottom: -20"><font size="1" color="#FFFFFF"></font></p>
            

No Whitespace No Cry

What: Since many languages separate words with spaces, and since many spam filters do the same this spammer decided that replacing spaces with something else was a good idea.
Popularity: Rare
Complexity: Dumb
Date added: May 15, 2003
Example from the wild:
              DidAyouFknowNyouMcanBgetVprescriptionVmedications prescribedTonlineTwith       NORPRIORRPRESCRIPTIONRREQUIRED!      WeZhaveztheXlargestLselectionLofNprescriptionsNavailableZonline!      LowestzPrices -- NextzDayxDelivery
            

Honorary Title

What: Another way of hiding text in an HTML email by placing it in the <title> which is unlikely to be displayed by the email client.
Popularity: Rare
Complexity: Simple
Date added: May 27, 2003
Example from the wild:
              <title>dinosaur reptile ghueej egrjerijg gerrg</title>
            

Camouflage

What: Like Invisible Ink, but instead of using identical colors (e.g. white on white) use very similar colors.
Popularity: Rare
Complexity: Very clever
Date added: June 2, 2003
Example from the wild: (The colors 1133333, 123939, and 423939 are chosen to be very similar without being the same)
              <table bgcolor="#113333"><tr><td><font color="#123939">those rearing lands</font><br><table><tr><td><br><font color="yellow" size=5><b>Plasticine sex-cartoons.</b></font><br><font color="#423939">eel harness highest</font><br><font color="white" size=3>Absolutely new category of adu1t sites.</td></tr></table><font color="#123939">nobody jets held<br>Northumbria- diamond sleep</font></td></tr></table>
            

And In The Right Corner

What: Adding a legitimate but odd word at the far right of the subject line (typically preceded with lots of spaces and tabs). The word is design to poison a Bayesian filter and alter the spam's hash value.
Popularity: Rare
Complexity: Clever
Date added: June 18, 2003
Example from the wild: (Thanks for Gary Robinson for pointing this one out)
              Subject: FEATURED IN MAJOR MAGAZINES                                   algorithmic
            

A Form of Desperation

What: Hiding text by placing it in the name of a hidden form field
Popularity: Rare
Complexity: Clever
Date added: June 24, 2003
Example from the wild:
              Get The <font color="#FF0000"> LOWE<input type="hidden" name=gfrtde>ST PR<inputtype="hidden" name=zawsxd>ICE </font> On Your N<input type="hidden" name=plkmju>ew Car
            
September 15, 2003: Another example came in from Darren J. Young that uses the value tag and fills it with a phrase from current events:
              <input type=hidden value="The Los Angeles Film Critics on Saturday picked 'About Schmidt,' the drama starring Jack Nicholson, as the year's top movie, splitting the two major critics' awards so far as the 2002 Hollywood movie awards season heads into a pivotal week with more honors ahead.">
            

It's Mini Marquee!

What: Using the <marquee> tag the spammer can hide text in a tiny unobtrusive square.
Popularity: Rare
Complexity: Fairly Clever
Date added: July 9, 2003
Example from the wild:
              <marquee bgcolor="white" height="8" width="8">Did you ever play that gamewhen you were a kid where the little plastic hippo tries to gobble up allyour marbles?</marquee>
            

You've been framed

What: Using the <noframes> tag the spammer can hide text and break up words.
Popularity: Fairly Common
Complexity: Fairly Clever
Date added: September 15, 2003
Example from the wild:
              Ere<frame><noframes>ywl55</noframes></frame>ctions
            

Control Freak

What: Use of non-printing characters, especially in the Subject and especially NUL to mess up filters that use 0 terminated strings.
Popularity: Rare
Complexity: Clever
Date added: September 15, 2003

Don't Cramp My Style

What: Enclose text within <style> tags to hide it from user but confuse filters.
Popularity: Very Rare
Complexity: Fairly Clever
Date added: September 15, 2003
Example from the wild:
              <style>RANDOM</style>
            

Common Encodings

Many spam emails use quoted printable and base64 encoding on top of the tricks outlined on the right. Any spam filter needs to be able to understand both of these and MIME nested encoding (e.g. base64 on top of quoted printable). A quoted printable example from the wild (used the Black Hole trick):
              V<font size=3D0>?</font>i<font size=3D0>?</font>a<fo=nt size=3D0>?</font>g<font size=3D0>?</font>r<font size=3D0>&nbs=p;</font>a
            
A base64 example from the wild (note that this used very long base64 lines that do not meet the standard):
              ------=_NextPart_000_60BF_00005753.000048CCContent-Type: text/html;	charset="iso-8859-1"Content-Transfer-Encoding: base64PEhUTUw+PEJPRFkgQkdDT0xPUj0iIzAwMDAwMCI+PC9QPjxQIEFMSUdOPUNFTlRFUj48Rk9OVCAgQ09MT1I9IiNmZjAwMDAiIEJBQ0s9IiMwMDAwMDAiIHN0eWxlPSJCQUNLR1JPVU5ELUNPTE9SOiAjMDAwMDAwIiBTSVpFPTYgUFRTSVpFPTI0PlRoZSBob3R0ZXN0IEdpcmxzIE9ubGluZSE8QlI+DQpTdG9wIHdhc3RpbmcgeW91ciB0aW1lIHdpdGggNSBzZWM8QlI+DQp2aWRlbyBjbGlwcyEgQ29tZSB0byBvdXIgc2l0ZSBmb3I8QlI+DQpGcmVlIEZ1bGwgTGVuZ3RoIE1vdmllcyE8QlI+DQo8QSBIUkVGPSJodHRwOi8vd2NhbWF0ZXVycy5jb20vbC9ibCI+V2h5IHdhaXQsIHNlZSBmb3IgRnJlZTwvQT48L0ZPTlQ+PEZPTlQgIENPTE9SPSIjZmYwMDAwIiBCQUNLPSIjMDAwMDAwIiBzdHlsZT0iQkFDS0dST1VORC1DT0xPUjogIzAwMDAwMCIgU0laRT02IFBUU0laRT0yNCBGQU1JTFk9IlNBTlNTRVJJRiIgRkFDRT0iQXJpYWwiIExBTkc9IjAiPjxCUj4NCjwvUD48UCBBTElHTj1MRUZUPjwvRk9OVD48Rk9OVCAgQ09MT1I9IiNmZjAwMDAiIEJBQ0s9IiMwMDAwMDAiIHN0eWxlPSJCQUNLR1JPVU5ELUNPTE9SOiAjMDAwMDAwIiBTSVpFPTMgUFRTSVpFPTExIEZBTUlMWT0iU0FOU1NFUklGIiBGQUNFPSJBcmlhbCIgTEFORz0iMCI+PEJSPg0KPC9GT05UPjxGT05UICBDT0xPUj0iIzAwMDBmZiIgQkFDSz0iIzAwMDAwMCIgc3R5bGU9IkJBQ0tHUk9VTkQtQ09MT1I6ICMwMDAwMDAiIFNJWkU9NiBQVFNJWkU9MjQgR! kFNSUxZPSJTQU5TU0VSSUYiIEZBQ0U9IkFyaWFsIiBMQU5HPSIwIj48QSBIUkVGPSJodHRwOi8vd2NhbWF0ZXVycy5jb20vbC9yIj5ObyBtb3JlIG1haWwgaGVyZTwvQT48L0ZPTlQ+PC9IVE1MPg0K------=_NextPart_000_60BF_00005753.000048CC--
            

A Complex Example

This is an example of a real email that uses multiple techniques to disguise its contents:
              PGh0bWw+DQo8YSBocmVmPSJodHRwOi8vJTc3JTc3dy5wJTYxJTczJTczNCU2NiU3MmUlNjUlMkVuZXQvcGIzLyIgVDhJPjxGT05UIFNJWkU9NT48Qj4mIzg3OyYjOTc7PCFLND50PCE0YTQ1PmMmIzEwNDs8IVBKMHV1PiAmIzY4OzwhT1UxMGRRPm88IWgzMj5nPCFOWDc4PnM8IUY0NzZ0PiAmIzExNTsmIzEwODs8IXkweDY+dSYjMTE0OzwhV1ZRPnAmIzMyOzwhMW0+eTwhS1NrUD5vPCFvMzVBZT51JiMxMTA7JiMxMDM7PCE0N2ViVTM+ICYjMTAzOyYjMTA1OyYjMTE0OyYjMTA4OyYjMTE1OyYjMzI7PCF5MjU+cCYjMTE3OzwhOFljPnMmIzExNTsmIzEyMTs8ITVSaTQ+JzwhcEdTNj5zJiMzMjsmIzk3OzwhQWgxPnMmIzMyOyYjMTE2OyYjMTA0OzwhMXJKM1JIPmU8IW84V1h1PnkmIzMyOzwhMzU+czwhMFE3ND5jJiMxMTQ7PCFSZnA+ZTwhUGw+YTwhSzQ+bTwhNGE0NT4gJiMxMDI7PCFQSjB1dT5vJiMxMTQ7PCFPVTEwZFE+IDwhaDMyPm08IU5YNzg+bzwhRjQ3NnQ+ciYjMTAxOyYjMzM7PC9mb250PjwvYT48QlI+DQo8QlIgck0wc1JhUHE+PGEgaHJlZj0iaHR0cDovL3d3dyUyRSU3MCU2MSU3MyU3MyUzNGZyZWUlMkUlNkUlNjV0L3BiMy8iIDFySjNSSEJvOFcgdW5TVlQ3PjxGT05UIFNJWkU9ND48Qj48IXkweDY+QyYjMTA4OzwhV1ZRPmkmIzk5OzwhMW0+azwhS1NrUD4gPCFvMzVBZT5IJiMxMDE7JiMxMTQ7PCE0N2ViVTM+ZTwvZm9udD48L2E+PEJSPjxCUj48QlI+PEJSPjxCUj48QlI+PEJSPiYjMTM7JiMxMDsmIzY5OyYjMTA5OyYjOTc7JiMxMDU7PCF5MjU+bCYjMzI7PCE4WWM+QiYjOTc7JiMxMDA7PCE1Umk0Pj88QlIgUlIgMk1PZHZjTT4NCm5vIG1vcmUgPGEgaHJlZj0iaHR0cDovL3JlbW92ZSUyRSU2RGUlNzMlNzNhJTY3JTY1bSU2NW4lNkYlNzcuJTZFZXQvIiBSZnBOUD5DbGljayBIZXJlPC9hPjxCUj4NCjxCUj48L2h0bWw+DQoNCmFQcTgyTU9kICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjTUo=
            
Removing the base64 encoding reveals the following odd looking HTML.
              <html> <a href="http://%77%77w.p%61%73%734%66%72e%65%2Enet/pb3/"T8I><FONT SIZE=5><B>&#87;&#97;<!K4>t<!4a45>c&#104;<!PJ0uu> &#68;<!OU10dQ>o<!h32>g<!NX78>s<!F476t> &#115;&#108;<!y0x6>u&#114;<!WVQ>p&#32;<!1m>y<!KSkP>o<!o35Ae>u&#110;&#103;<!47ebU3>&#103;&#105;&#114;&#108;&#115;&#32;<!y25>p&#117;<!8Yc>s&#115;&#121;<!5Ri4>'<!pGS6>s&#32;&#97;<!Ah1>s&#32;&#116;&#104;<!1rJ3RH>e<!o8WXu>y&#32;<!35>s<!0Q74>c&#114;<!Rfp>e<!Pl>a<!K4>m<!4a45> &#102;<!PJ0uu>o&#114;<!OU10dQ> <!h32>m<!NX78>o<!F476t>r&#101;&#33;</font></a><BR> <BR rM0sRaPq><ahref="http://www%2E%70%61%73%73%34free%2E%6E%65t/pb3/"1rJ3RHBo8W unSVT7><FONT SIZE=4><B><!y0x6>C&#108;<!WVQ>i&#99;<!1m>k<!KSkP> <!o35Ae>H&#101;&#114;<!47ebU3>e</font></a><BR><BR><BR><BR><BR><BR><BR>&#13;&#10;&#69;&#109;&#97;&#105;<!y25>l&#32;<!8Yc>B&#97;&#100;<!5Ri4>?<BR RR 2MOdvcM> no more <ahref="http://remove%2E%6De%73%73a%67%65m%65n%6F%77.%6Eet/" RfpNP>Click Here</a><BR> <BR></html>aPq82MOd                                cMJ
            
The email uses bad HTML tags to split words (Hypertextus Interruptus), URL encoding to hide the URLs used (Enigma), HTML entities to hide letters (A Numbers Game) and spaces (Lost in Space). Removing the bad HTML used to split words (Hypertextus Interruptus) reveals:
              <html> <a href="http://%77%77w.p%61%73%734%66%72e%65%2Enet/pb3/"T8I><FONT SIZE=5><B>&#87;&#97;tc&#104;&#68;ogs &#115;&#108;u&#114;p&#32;you&#110;&#103; &#103;&#105;&#114;&#108;&#115;&#32;p&#117;s&#115;&#121;'s&#32;&#97;s&#32;&#116;&#104;ey&#32;sc&#114;eam &#102;o&#114; mor&#101;&#33;</font></a><BR> <BR rM0sRaPq><ahref="http://www%2E%70%61%73%73%34free%2E%6E%65t/pb3/" 1rJ3RHBo8WunSVT7><FONT SIZE=4><B>C&#108; i&#99; k H&#101;&#114; e</font></a><BR><BR><BR><BR><BR><BR><BR>&#13;&#10;&#69;&#109;&#97;&#105; l&#32; B&#97;&#100;?<BR RR 2MOdvcM> no more <ahref="http://remove%2E%6De%73%73a%67%65m%65n%6F%77.%6Eet/" RfpNP>Click Here</a><BR> <BR></html>aPq82MOd                                cMJ
            
Removing the URL encoding (Enigma) reveals:
              <html><a ><FONT SIZE=5><B>&#87;&#97;tc&#104; &#68;ogs &#115;&#108;u&#114;p&#32;you&#110;&#103; &#103;&#105;&#114;&#108;&#115;&#32;p&#117;s&#115;&#121;'s&#32;&#97;s&#32;&#116;&#104;ey&#32;sc&#114;eam &#102;o&#114; mor&#101;&#33;</font></a><BR> <BR><a ><FONT SIZE=4><B>C&#108;i&#99; k H&#101;&#114; e</font></a><BR><BR><BR><BR><BR><BR><BR>&#13;&#10;&#69;&#109;&#97;&#105; l&#32; B&#97;&#100;?<BR>no more <a >Click Here</a><BR> <BR></html>aPq82MOd                                cMJ
            
Then removing the HTML entities (A Numbers Game) reveals the true message:
              <html> <a ><FONT SIZE=5><B>Watch dogs slurp young girls pussy抯 as they scream for more!</font></a><BR> <BR><a ><FONT SIZE=4><B>Cl i c k Her e</font></a><BR><BR><BR><BR><BR><BR><BR>  Email Bad?<BR> no more<a >Click Here</a><BR> <BR></html> aPq82MOd                                cMJ
            

webmaster@jgc.org, Copyright (c) 1999-2003 John Graham-Cumming

?

?



Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=12733


[Spam]垃圾郵件者綱要(Spammer's Compendium)


更多文章、技術(shù)交流、商務(wù)合作、聯(lián)系博主

微信掃碼或搜索:z360901061

微信掃一掃加我為好友

QQ號聯(lián)系: 360901061

您的支持是博主寫作最大的動力,如果您喜歡我的文章,感覺我的文章對您有幫助,請用微信掃描下面二維碼支持博主2元、5元、10元、20元等您想捐的金額吧,狠狠點擊下面給點支持吧,站長非常感激您!手機微信長按不能支付解決辦法:請將微信支付二維碼保存到相冊,切換到微信,然后點擊微信右上角掃一掃功能,選擇支付二維碼完成支付。

【本文對您有幫助就好】

您的支持是博主寫作最大的動力,如果您喜歡我的文章,感覺我的文章對您有幫助,請用微信掃描上面二維碼支持博主2元、5元、10元、自定義金額等您想捐的金額吧,站長會非常 感謝您的哦!!!

發(fā)表我的評論
最新評論 總共0條評論
主站蜘蛛池模板: 久久久久久国产视频 | 成人久久精品一区二区三区 | 久久久久久综合一区中文字幕 | 欧美精品一区二区三区在线 | 嘿咻免费视频欧美激情 | 日韩精品一区二区三区 | 49pao强力免费打造在线高清 | 奇米4色 | 波多野结衣办公室33分jian情 | 国产精品啪一品二区三区粉嫩 | 亚洲综合色丁香婷婷六月图片 | 国产日韩欧美三级 | 99国产在线精品视频 | 午夜手机福利 | 亚洲国产第一区二区香蕉 | 天天影院在线观看 | 亚洲一区视频在线 | 欧美不卡 | 天天操一操 | 日本在线视 | 中国免费一级毛片 | 精品久久成人免费第三区 | 天天操夜夜夜 | 日本最新中文字幕 | 免费福利视频在线观看 | 日韩av福利 | 观看av | 国产精品天天干 | 成人深夜福利视频 | 欧美日韩xxx | 国产乱码视频 | 欧美电影精品久久久久 | 三级毛片在线看 | 国产综合一区二区 | 色开心婷婷 | 亚洲欧洲日韩国产aa色大片 | 欧美成人在线免费观看 | 夜夜嘿视频免费看 | 国产无遮挡一级毛片 | 国产福利福利视频 | a毛片在线看免费观看 |