RE: OT: Criminal Spammers

  • From: "Jim Harrison" <jim@xxxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Tue, 28 Oct 2003 12:41:35 -0800

Yasilly; that's not BASE-64; it's decimal encoding of ASCII characters.
I be;lieve your scriptlet is correct, though.

If you get out your ASCII table, this mess:
http://&#119;&#119;w&#46;&#111;&#116;t&#111;&#46;p&#114;&#111;.br/
&#106;aa&#116;/&#74;&#117;lioA&#117;r&#97;/&#105;n&#100;e&#120;&#46;&#10
4;&#116;m

..translates to :
http://www.otto.pro.br/jaat/julioAura/index.htm

 Jim Harrison
 MCP(NT4, W2K), A+, Network+, PCG
 http://www.microsoft.com/isaserver
 http://isaserver.org/Jim_Harrison
 http://isatools.org

 Read the help, books and articles!
----- Original Message ----- 
From: "cismic" <cismic@xxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Tuesday, October 28, 2003 10:47
Subject: [isalist] RE: OT: Criminal Spammers


http://www.ISAserver.org

Hi Thomas,
The code below is actually BASE64 encoded.  I used to encode my email
address and http lines inside the web pages before display
Made it harder for spammers to sniff that information off web pages.  A
function I used to use is as follows:

function uniMe(inStuff)
'Read in normal line and loop through converting to base64
Dim strConvertedText, strHoldText,I,iLen,iDelimiter
Const PREFIX = "&#"
Const SUFFIX = ";"
iLen = Len(inStuff)
strHoldText = Trim(inStuff)
iDelimiter = 0
For I = 1 To iLen
    iDelimiter = I
    sText = Mid(strHoldText, I, 1)
    strConvertedText = strConvertedText & PREFIX & Asc(sText) & SUFFIX
Next
uniME = strConvertedText
end Function

This could be changed in some sort of pre email program.

Joseph

-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: Tuesday, October 28, 2003 7:58 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] OT: Criminal Spammers


http://www.ISAserver.org

Check out the HTML code in this spam:

<font color=white face=arial>occasionally occur.  It is admitted [that]
the degree of this sterility <br><font color=white>of Anaxagoras, a
function which carries them perhaps a stage <br><font color=white>in my
memory that I could write,--things that I would cheerfully <br><font
color=black>Wo<!ncO>uld yo<!MHxG>u li<!ZaAg>ke t<!FV>o b<!YV>e
Financ<!YFQ>ially <font size=6><a
href="http://&#119;&#119;w&#46;&#111;&#116;t&#111;&#46;p&#114;&#111;.br/
&#106;aa&#116;/&#74;&#117;lioA&#117;r&#97;/&#105;n&#100;e&#120;&#46;&#10
4;&#116;m">Indep<!mKa>endent</a><br><font color=white>but his visits
were short and with long intervals.</font></font></font> <br><font
color=white>the week of seven days, with the names of the planets for
the <br><font color=white>to bestow mutual pleasure--I was now alone.
In the university <br><font color=black size=1>Rem<!t>oval
Inform<!KH>ation o<!Yo>n Si<!fEK>te</font><br><font color=white>My
conductor stopped suddenly. Home! said he, and I stood</font> <br><font
color=white>when the weather permitted, I walked on the stony beach of
the sea <br><font color=white>may produce heat enough to cause a fire.
The rationale of this

You don't think this spammer had any criminal intent, do you?

Any suggestion on how to filter this kind of junk?

Thanks!
Tom

Thomas W Shinder
www.isaserver.org/shinder
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: http://tinyurl.com/1llp

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1
Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
cismic@xxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')


^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*

All mail from this domain is virus-scanned with RAV.
www.ravantivirus.com

^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*



Other related posts: