Anatomy of a Spam E-Mail

SPAM! IT'S ONE OF THE BIG TRESSPASSERS IN OUR DAILY INTERNET LIFE... Many of us have a bad morning of full inbox with unwanted mails resulting in a full select and delete. Why do these junk slip from the spam/bulk folder in your mail agent to your inbox?

Lets find it out.

SENDER eg."Iverson Vernie":

An implausible name that sounds human to computers if not people. This helps to offset the "spamminess" of the message. Plus it is in capital letters which also helps to bust the scoring systems often used to spot spam.

E-MAIL ADDRESS eg."eieeeyuuyuioeeiiayi@fleetlease.com:

Clearly fake. All the letters before the @ sign come from the top line of the keyboard starting at the left. The spammer generated this e-mail addresses by running their finger along that line when putting the spam run together.

However, this could provide useful forensic information when tracing spam campaigns or spam groups. Another clue is given by the fact that the company owning the domain, Fleetlease, rents vehicles - there's no reason to think it is really pushing pills.

SUBJECT

Bad spelling marks it as spam as does the exclamation point. But it avoids mentioning what the message is actually about which might help it sneak past some spam filters.

BODY IMAGE

The body of the message is actually an image rather than text. Again this is another trick to defeat spam filters which find it impossible to view what is in bitmap or jpegs.

This image was called from another computer based in Hungary. The net service offered by this company is free which is probably why it is being used as a source for these images. Spammers hate paying for anything.

It could also be a checking mechanism which records which e-mail address responded. "Live" addresses are much more valuable than ones that never react.

ASSOCIATED WEBSITE

This is apparently linked to a company in Wisconsin, but the details held on the net about it are likely to be fake given that there is evidence the server is physically located in South Africa. The server hosting this site hosts another 90, most of which are touting drugs

...