Yeah, wouldn't life be grand if they were using the exact same string each and every time.

Unfortunately that is not the case.

The length in characters of the "tags" is variable.
The character base seems to be a..zA..Z0-9 for the most part.
The order of characters is random. Sometimes they look to be random dictionary words.

The location of the insert within words is random. The same spam from the same company on the same day is actually unique on each sending.

One email will have: 

asked me about a ne<jkdwe>w home pur</mFKEWEk>chase

[download]
another will have: 
aske<DFIkdjfd>d me about a new ho</Dklje>me purchase

[download]
and as in the example given first: 
asked me about a n<KRRAXH>ew home purcha</SZLNG>se

[download]
The spam generator seems to take a standard message then insert madeup tags at random.

I am guessing they are using <string> ... </anotherstring> pairs to avoid an existing filter.

In actual fact, anything that will match the sentence given without also including legit html and legit xml will probabaly work. That is anything other than matching the exact phase as given.

In all honesty it hadn't occured to me that someone would think I meant the phrase as given. I'll be more explicit next time.

If you think further and more complete examples would be helpful I can send some along.

This is very elusive spam. Especially since it is coming from hacked computers -- hence the return smtp is legit, the ISPs are not on any blacklist so the email envelope is of no help. At least until the poor schmuck who's computer was owned is blacklisted or blocked.

In reply to Re^2: regex help or pointer to module needed by Xxaxx
in thread regex help or pointer to module needed by Xxaxx

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.