Help understanding spam source code?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

I'm an HTML noob, so I cannot begin to explain what's going on here.  This
is the source info from an email spam message I received today.  I sincerely
apologize if including this code is poor etiquette.  As you will see if you
view the code in a browser, the source bears no resemblance to what the
browser displays - at least to a someone like me.
I would apprciate ANY insight provided.  I would love to know what's going

Thank you,


<FONT color=#ffffff size=1>The second book begins , "Bienseance de la  it
was assumed that Washington himself ,Mr. Conway found in the  </FONT>
<META content="MSHTML 6.00.2800.1106"

                              <TABLE style="FONT-SIZE: 14px; FONT-FAMILY:
                              width=500 bgColor=black>
                                <TR bgColor=#3333ff>
                                style="FONT-SIZE: 15px; COLOR:
                                style="DISPLAY: none">gave food for his
vivid imagination. </SPAN>e to
                                the Pharmac<SPAN style="DISPLAY:none">the
world over. </SPAN>yMail</TH></TR>
                                <TR bgColor=#cccccc>
style="TEXT-DECORATION:underline"href=" ">PHA<SPAN
                                style="DISPLAY: none">child in his eighth
year," </SPAN>RMA-S<SPAN
                                style="DISPLAY: none">Washington's life that
                                style="DISPLAY: none">a Christmas poem,
</SPAN>comes you!
                                style="DISPLAY: none">trained in that
subject. </SPAN>AGRA</B> as<SPAN
                                style="DISPLAY: none">Washington was fitted
</SPAN> low as <B
                                style="COLOR: #ef0303">$ 10<SPAN
                                style="DISPLAY: none">"True
Happiness,"</SPAN>9.99</B> (3<SPAN
                                style="DISPLAY: none">consideration for
others, his respect for </SPAN>0
                                piI<SPAN style="DISPLAY: none">presentation.
                                <BR><B>ClA<SPAN style="DISPLAY: none">and he
copied them.</SPAN>LlS</B> as low a<SPAN
                                style="DISPLAY: none">the late Moncure D
Conway, was born in </SPAN>s <B style="COLOR: #ef0303">$
                                32<SPAN style="DISPLAY: none">"True
Happiness,"</SPAN>4.00</B> (9<SPAN
                                style="DISPLAY: none">all were early
inculcated in him by precepts </SPAN>0 p<SPAN
                                style="DISPLAY: none">Company </SPAN>iIls),
                                <BR><B>VALl<SPAN style="DISPLAY:
none">comprehension of the fineness of Washington's .</SPAN>UM</B> as low
                                style="DISPLAY: none">The one devoted
to</SPAN>as <B
                                style="COLOR: #ef0303">$ 3<SPAN
                                style="DISPLAY: none">A French edition
</SPAN>41.00</B> (9<SPAN
                                style="DISPLAY: none">comparison of
Washington's Rules </SPAN>0 piI<SPAN
                                style="DISPLAY: none">to a treatise entitled
                                <BR><B>XAN<SPAN style="DISPLAY:
none">biographers have regarded them as formative </SPAN>AX</B> as low <SPAN
                                style="DISPLAY: none">child in his eighth
year," </SPAN>as <B
                                style="COLOR: #ef0303">$ 1<SPAN
                                style="DISPLAY: none">completed his
comparisons </SPAN>30.00</B> (3<SPAN
                                style="DISPLAY: none">appeared at Paris at
least </SPAN>0 piI<SPAN
                                style="DISPLAY: none">Conversation entre les
Hommes," </SPAN>ls), <BR><B>L<SPAN
                                style="DISPLAY: none">Few graduates of
colleges </SPAN>EVlTRA</B> as<SPAN
                                style="DISPLAY: none">and deference to those
deserving such treatment, </SPAN> low as <B
                                style="COLOR: #ef0303">$ 49<SPAN
                                style="DISPLAY: none">of Congress,
.</SPAN>9.99</B> (9<SPAN
                                style="DISPLAY: none">love poems attributed
</SPAN>0 pi<SPAN
                                style="DISPLAY: none">and even his reverence
for his Maker, </SPAN>Ils)
                                and many<SPAN style="DISPLAY: none">trained
in that subject. </SPAN> other <BR><BR>Just try us and
                                you will not be disap<SPAN
                                style="DISPLAY: none">edition appeared at
Pont-a-Mousson in 1617, </SPAN>pointed!

<FONT color=#ffffff size=1>Just as he had , exercises of George Washington,
to their brothers at Pont-a-Mousson.,and of the epoch-making  </FONT>


<P><FONT SIZE=2>--<BR>
No virus found in this incoming message.<BR>
Checked by AVG Anti-Virus.<BR>
Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date:
</FONT> </P>

Re: Help understanding spam source code?

JM wrote:

Quoted text here. Click to load it

Color is white, probably same as your background, and a very small size,
if your background was something other than white. Can you see white on

Quoted text here. Click to load it

Heh. display: none.  Your client won't show it.

Quoted text here. Click to load it

Viagra, eh?

Is this enough info for you to pick out the why?

Quoted text here. Click to load it

Spammer even includes an AVG advertisement.   :-)

So by now, you have decided to turn off all rendering of email in HTML,
correct?  Switched it to Plain Text only?  Many people just bin HTML
mail upon receipt, including me.

   -When motorcycling, never follow a pig truck

Re: Help understanding spam source code?

On Fri, 30 Sep 2005 18:32:41 +0000, JM wrote:

Quoted text here. Click to load it

Yuck, no wonder it's a mess. ;)

I wouldn't worry. It just looks like the kind of nonsense spammers send
out to poison bayesian spam filters.

Jafar Calley
SysAdmin -
See the latest Mars and Saturn images

Re: Help understanding spam source code?

On Fri, 30 Sep 2005 22:47:44 +0200, Jafar As-Sadiq Calley

Quoted text here. Click to load it

Actually a good (i.e. looks at the source, not the result) Bayesian spam
filter is quite strong against this camouflaged spam - better than a
simple keyword spotter. The best performance comes from a filter that's
HTML/CSS aware and knows how to process display:none; but obviously
that's time-consuming to filter.

Binning all HTML email on sight is even better, of course.

Site Timeline