« previous next »
Pages: [1]   Go Down

Author Topic: You've got mail!  (Read 2571 times)

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
You've got mail!
« on: October 09, 2015, 10:00:16 PM »
I started to post about this SPAM earlier today and got side tracked..

Here's a screen shot and most of the raw content:

QUOTE
Return-path: <coltishabsurd@rpk.org>
-
Received: from vs1.inet24.cz (vs1.inet24.cz [31.31.73.217])
 by st11p00im-smtpin020.me.com
-
Received-SPF: fail (st11p00im-smtpin020.me.com: domain of coltishabsurd@rpk.org
 does not designate 31.31.73.217 as permitted sender) but they let it proceed, anyway rolleyes.gif
 receiver=st11p00im-smtpin021.me.com; client-ip=31.31.73.217;
 helo=vs1.inet24.cz; envelope-from=coltishabsurd@rpk.org;
Authentication-results: st11p00im-smtpin020.me.com; spf=fail
 (st11p00im-smtpin020.me.com: domain of coltishabsurd@rpk.org does not
 designate 31.31.73.217 as permitted sender)
 smtp.mailfrom=coltishabsurd@rpk.org; but Apple lets it proceed, also
-
Subject: You have a email that will be deleted in 1 days
Date: Fri, 09 Oct 2015 16:43:50 +0000
From: App Store <coltishabsurd@rpk.org>
-
Authentication-results: st11p00im-smtpin020.me.com; dkim=none reason="no signature"; dkim-adsp=none
x-icloud-spam-score: 32002220  how big a number does it take to get blocked?!
 f=rpk.org;e=rpk.org;is=yes;ir=no;pp=ham;spf=fail;dkim=?;dmarc=?;wl=absent;pwl=absent;clxs=spam;clxl=absent
x-dmarc-info: pass=?; dmarc-policy=(noPolicy); s=; d=

X-CLX-Spam: true
X-CLX-Score: -625
X-CLX-Shades: Junk
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,,
 definitions=2015-10-09_12:,, signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=6 spamscore=6
 suspectscore=5 phishscore=10 adultscore=0 bulkscore=1 classifier=spam adjust=0
 reason=mlx scancount=1 engine=8.0.1-1412110000 definitions=main-1510090179
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
-
Here is found typical <head><html><body> tags
-
<table resultantly="7" width="700" …>Now here are some more rarely seen attributes!
<tr>
<td begetting='54' …>  Someone has a real sense of humor!
<tr prometheus="acquiescence"><td>
<img shallowness='18' ...>
 
<table prolonging="5" ...>
<tr discretely="84"...> Seems extremely discrete for such a short lasting table... dntknw.gif

<div propelled=5 style="font-family: …>
<span style="font-weight:bold">You have a email that will be deleted in 1 days.</span>
-
<a href="http://wanggang123.com/wp-includes/colorer.php" …>Read Now</a>
<br>For more information, see our <a href="http://wanggang123.com/wp-includes/colorer.php" …>frequently asked questions</a>.<br><br>Thanks,<br>App Store Support
</div>
-
<tr underplays="22">
<img effector=2 src="http://images.apple.com/dm/misc/notification1/btm.gif" …></td>
<tr stravinsky=6 ...>
TM and copyright © 2015
<a rooseveltian=65 …>Apple</a> Inc.
<a assailants='74' …>Apple Sales International, Hollyhill Industrial Estate, Cork, Ireland. Company Registration number: 15719. VAT number: IE6554690W</a>.
<a href="http://wanggang123.com/wp-includes/colorer.php" …>Keep Informed</a> /
<a href="http://wanggang123.com/wp-includes/colorer.php" …>Privacy Policy</a>
-
<div prohibit="8" …>If you would prefer not to receive email from Apple, or if you have changed your email address, please <a href="http://wanggang123.com/wp-includes/colorer.php" …>click here</a>.</div>    
and so on…
</table></body></html>


While I'll give the "authors" an A for inventiveness, I have to downgrade their 'coding' skills. A professional is consistent in providing attribute/variable values. Either always use single quotes or double, and never none. nono.gif OTOH, this is one of the most entertaining SPAMs I've ever read!

BTW, do I need to repeat that link again?! I guess "wanggang", "wanggang1", and "wanggang12" were already purchased and they had to go with "wanggang123". wallbash.gif
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Paddy

  • Administrator
  • TS Addict
  • *****
  • Posts: 13797
    • View Profile
    • https://www.paddyduncan.com
You've got mail!
« Reply #1 on: October 10, 2015, 08:33:14 PM »
The silly "coding" isn't coding at all - it's done that way so that the nonsensical words are invisible to anyone who doesn't examine the raw source. It appears to me that it's the spammer's attempt - successful, in this case - to get by the spam filters via Bayesian poisoning.

From Wikipedia:

QUOTE
Depending on the implementation, Bayesian spam filtering may be susceptible to Bayesian poisoning, a technique used by spammers in an attempt to degrade the effectiveness of spam filters that rely on Bayesian filtering. A spammer practicing Bayesian poisoning will send out emails with large amounts of legitimate text (gathered from legitimate news or literary sources). Spammer tactics include insertion of random innocuous words that are not normally associated with spam, thereby decreasing the email's spam score, making it more likely to slip past a Bayesian spam filter.


Not surprisingly, wanggang123.com is a domain registered to a Chinese registrar, though lists Hong Kong in its address (I guess that should make us feel more secure?). The URL is the same for every link on the page, and it redirects to a .ru (Russia) domain selling Viagra.

Of course, who knows what else that site may be up to; for all I know it's malware infested. But interesting marketing technique. Send someone an email from Apple, and then send them to a site selling Viagra. Thinking.gif Yeah! Brilliant! We'll sell lots of it that way!
« Last Edit: October 10, 2015, 08:46:07 PM by Paddy »
Logged
"If computers get too powerful, we can organize them into committees. That'll do them in." ~Author unknown •iMac 5K, 27" 3.6Ghz i9 (2019) • 16" M1 MBP(2021) • 9.7" iPad Pro • iPhone 13

Offline jchuzi

  • TS Addict
  • *****
  • Posts: 3094
    • View Profile
You've got mail!
« Reply #2 on: October 11, 2015, 04:35:04 AM »
The spammers who sell Viagra are obviously hardened criminals.   Devilish2.gif
Logged
Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P700, Photoshop CC, Lightroom CC, MS Office 365

Offline RNKIII

  • Administrator
  • TS Addict
  • *****
  • Posts: 2160
    • View Profile
    • http://
You've got mail!
« Reply #3 on: October 11, 2015, 07:36:08 AM »
QUOTE(jchuzi @ Oct 11 2015, 04:35 AM) <{POST_SNAPBACK}>
The spammers who sell Viagra are obviously hardened criminals.   Devilish2.gif


Obviously a "Rusty & Dusty"  Prarie Home Companion fan...  toothgrin.gif whistling.gif  

Bob K.   rnkiii
Logged
Give a man a fish and you feed him for a day; teach him to
use the Net and he won't bother you for weeks.

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
You've got mail!
« Reply #4 on: October 11, 2015, 08:27:33 AM »
Thanks for the reminder, Bob, the show repeats this afternoon here.

BTW, I think the Admins need to set up a new banning rule for pun abusers... Maybe make them write a 20 page dissertation on Bayesian filter construction. scram.gif

BTW.2: I have six new ones today telling me my "photo is pending approval" and two urging me to read an email from "App Store Support" and "App Store Team". Looks like SpamSieve needs more training, also. Don't just read the text, note/block the domains...

One is interestingly from "Flesh Services"! Since I have a personal weather station and web site the one from "Barometers Albums" raises a bit of pressure to read it... tease.gif
« Last Edit: October 11, 2015, 08:33:47 AM by Xairbusdriver »
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline RNKIII

  • Administrator
  • TS Addict
  • *****
  • Posts: 2160
    • View Profile
    • http://
You've got mail!
« Reply #5 on: October 11, 2015, 08:35:20 AM »
We'll have to put that on the agenda for our next semi-decadeal meeting...

Bob K.   rnkiii
Logged
Give a man a fish and you feed him for a day; teach him to
use the Net and he won't bother you for weeks.

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
You've got mail!
« Reply #6 on: October 11, 2015, 08:40:35 AM »
QUOTE("BK")
Give a man a fish and you feed him for a day; teach him to
use the Net and he won't bother you for weeks.
...until he sends a message to all his Windowz friends with your addy in the To: and/or CC: field... wallbash.gif
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline jchuzi

  • TS Addict
  • *****
  • Posts: 3094
    • View Profile
You've got mail!
« Reply #7 on: October 11, 2015, 10:21:15 AM »
QUOTE(Xairbusdriver @ Oct 11 2015, 09:40 AM) <{POST_SNAPBACK}>
QUOTE("BK")
Give a man a fish and you feed him for a day; teach him to
use the Net and he won't bother you for weeks.
...until he sends a message to all his Windowz friends with your addy in the To: and/or CC: field... wallbash.gif
The correct quote is "Give a man a fish and you feed him for a day. Teach him how to fish and he'll be sitting on his butt drinking beer for a week."

Let's make sure that we're accurate here at TS!  dry.gif
Logged
Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P700, Photoshop CC, Lightroom CC, MS Office 365
Pages: [1]   Go Up
« previous next »