Subject: [Asrg] [Q] Malformed Spam.. On the rise??

From: Jim Witte <[email-masked]>
Date: Sat, 20 Nov 2004 20:09:18 -0500

Hi,

   I just got this spam, which is *massively* malformed HTML.  Is this 
becoming more common, because the spam-bot writers are getting 
stupider, or are intervening MTA's trying to cut the spam out but are 
not doing a good enough job?

Jim

> From: [email-masked]
> Date: November 20, 2004 12:53:37 PM EST
>
> SMTPSVC(5.0.2195.6713);
> 	 Sun, 21 Nov 2004 03:49:18 -0400
> Message-ID: <[email-masked]>
> From: "Rosemarie Norton" <[email-masked]>
> To: [email-masked]
> Subject: Some Things 2 Get Before U Go To Vegas
> Date: Sun, 21 Nov 2004 01:50:18 -0600
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary="--2846486998687197970"
>
> ----2846486998687197970
> Content-Type: text/plain;
> Content-Transfer-Encoding: quoted-printable
>
> Selling every prescription u can think of! 
> http://www.barbarism8scarfs.inf=
> o/?Q0yG/f=3D0/yjVu/oaNeq
>
>
> assassin exterminate mezzo lucretia sutton macromolecular tab ogle 
> cambric=
>  calligraph=20
>
> ----2846486998687197970--
>
>

Jim
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 22 Nov 2004 02:38:42 +0100

Jim Witte wrote:
 
> I just got this spam, which is *massively* malformed HTML.

There's no HTML at all in it, you got a single text/plain
part within multipart/alternative.  Just like an election
with only one candidate it's boring but not "malformed".

For more details see RfC 2046 chapter 5.1.4.   Bye, Frank

---

From: [email-masked]
Date: Mon, 22 Nov 2004 20:14:50 +0530 (IST)

> with only one candidate it's boring but not "malformed".

It is a malformed mail because the part after the Date header will be
shown as message body and will not be parsed for header contents.

> Message-ID: <[email-masked]>

This usually happens with newbie spammers.

- Aseem Jakhar