Subject: RE: [hackers-il] Spam, spam, wonderful spam

From: Chen Shapira <[email-masked]>
Date: Sun, 9 Jul 2000 12:56:12 +0200

> -----Original Message-----
> From: Gaal Yahas [mailto:[email-masked]]
> Sent: Sunday, July 09, 2000 10:07 AM
> To: [email-masked]
> Subject: [hackers-il] Spam, spam, wonderful spam
> 
> 
> Spammers are starting to work hard on obfuscating their traces. Look
> what I got today: this *appears* not to have been relayed much; and
> the embedded URLs in the message are "encoded" with JavaScript. Quite
> amazing, really. (My POP3 box is on netvision and fortinbras is my
> machine. forum2.org is where mail gets addressed to.)
> 
> Anyone feel like busting their show?

1. The html itself seems fucked up. 
Does it render? 

> <HTML>
> <BODY>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"><html>
> <basehref=3D"http://www.mn285.COME.CC/il2/@216.71.84.44/enter.
> cgi" method=3D=
> "get">

this part is plain illegal.
BTW. was the "=3D" in the original? 

2. The JS defines two functions d() and codeit() 
then uses a third one decode()

in short the JS does nil. 
unless I got something wrong. It is only used in the begining btw. not
called afterwards. 

thanks,
CS.

---

From: Gaal Yahas <[email-masked]>
Date: Sun, 9 Jul 2000 14:45:46 +0300

> 1. The html itself seems fucked up. 

I never tried rendering it :-)

There's the nasty <IMG SRC="an-encoding-of-your-email-address.jpg">
trick that auto-confirms your address doesn't bounce. I never accept
HTML mail.
 
> > cgi" method=3D= "get">

It's quoted-printable, iso-8859-1. =3D is just "=".

> unless I got something wrong. It is only used in the begining btw. not

Hmmm. I didn't attempt to despaghettize it yet. Plus its javascript.

Moose,
Gaal
-- 
believing is seeing
[email-masked]
http://www.forum2.org/gaal/