Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris
 
PerlMonks  

Re^2: regex help or pointer to module needed

by Xxaxx (Monk)
on Jun 08, 2004 at 07:54 UTC ( [id://362233]=note: print w/replies, xml ) Need Help??


in reply to Re: regex help or pointer to module needed
in thread regex help or pointer to module needed

Yeah, wouldn't life be grand if they were using the exact same string each and every time.

Unfortunately that is not the case.

The length in characters of the "tags" is variable.
The character base seems to be a..zA..Z0-9 for the most part.
The order of characters is random. Sometimes they look to be random dictionary words.

The location of the insert within words is random. The same spam from the same company on the same day is actually unique on each sending.

One email will have:

asked me about a ne<jkdwe>w home pur</mFKEWEk>chase
another will have:
aske<DFIkdjfd>d me about a new ho</Dklje>me purchase
and as in the example given first:
asked me about a n<KRRAXH>ew home purcha</SZLNG>se
The spam generator seems to take a standard message then insert madeup tags at random.

I am guessing they are using <string> ... </anotherstring> pairs to avoid an existing filter.

In actual fact, anything that will match the sentence given without also including legit html and legit xml will probabaly work. That is anything other than matching the exact phase as given.

In all honesty it hadn't occured to me that someone would think I meant the phrase as given. I'll be more explicit next time.

If you think further and more complete examples would be helpful I can send some along.

This is very elusive spam. Especially since it is coming from hacked computers -- hence the return smtp is legit, the ISPs are not on any blacklist so the email envelope is of no help. At least until the poor schmuck who's computer was owned is blacklisted or blocked.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://362233]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others wandering the Monastery: (5)
As of 2024-03-29 13:40 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found