03/11/2010

I noticed a lot of these similar spam variants today.



Here is a sample from the message body:

augme nting  tilte d  rollb ar  preco ok  machi nelik e  remin iscen
ce  catab asis  scler enchy ma  polyt echni c  blemi shes  ecume nicis
ts  hawki shnes s  musse d  nemes es  shudd ery  mean  slash ed  

The spammers randomly put a space every 5 characters, making none of the words recognizable. My guess is they are targeting content filters and fingerprint algorithms like the one SpamSentinel uses. Here is the message with the space removed:

augmenting  tilted  rollbar  precook  machinelike  reminiscence
catabasis  sclerenchyma  polytechnic  blemishes  ecumenicists  
hawkishness  mussed  nemeses  shuddery  mean  slashed  

So where is the spam sales message?
I checked the subject, and it is more of the same:

Subject: motiv ation s colle gian editr ess

I finally found it in the From alias:
"Cheap C1alis on www.gg25.net" <radiological@michelgr.com>

They want you to see that website and load it. I tried the URL, which loads a "Canadian Pharmacy" website selling Viagra, Cialis and all the rest. Who knows if they will actually send any products after taking your money? Their shopping cart did not use HTTPS. Anyone who buys from this site (or others like it) has two problems: erectile dysfunction and brain dysfunction, IMHO.