# Has Anyone else been getting these e-mails? **URL:** \ **Category:** Factual Questions\ **Created:** [May 18, 2005, 6:55pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451 "2005-05-18T18:55:05Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![saoirse](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@saoirse](https://boards.straightdope.com/u/saoirse)\ **Post date:** [May 18, 2005, 6:55pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/1 "2005-05-18T18:55:05Z")
I’ve been getting these e-mails at work where the subject line looks like spam for discount drugs (it will say things like such as / iagr/, that sort of thing. ) In the preview pane, though, I can see a series of 8 or 10 lines from a book, apparently a nautical adventure book. They aren’t complete lines, but fragments, as if it were a small square that had been cut out from the page. There doesn’t seem to be anything else in there. I haven’t actually opened one to find out, of course. Is anyone else getting these? What the hell are they? ---
**Author:** ![groman](https://avatars.discourse-cdn.com/v4/letter/g/73ab20/32.png) [@groman](https://boards.straightdope.com/u/groman)\ **Post date:** [May 18, 2005, 7:00pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/2 "2005-05-18T19:00:44Z")
Mixes in Spam characteristics (e.g “Viagra”) with normal letter characteristics, i.e. 10-th grade level english. Designed to poison adaptive spam filters to become worthless and generate so many false positives to be turned off. ---
**Author:** ![saoirse](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@saoirse](https://boards.straightdope.com/u/saoirse)\ **Post date:** [May 18, 2005, 7:09pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/3 "2005-05-18T19:09:07Z")
> [@groman](#): > > Mixes in Spam characteristics (e.g “Viagra”) with normal letter characteristics, i.e. 10-th grade level english. Designed to poison adaptive spam filters to become worthless and generate so many false positives to be turned off. Really? I would be perfectly happy if these messages were filtered. I know using / to make the V in Viagra pervents filters from stopping the message (they look for the word). Plenty of spam makes it through this e-mail system, and plenty seems to get stopped (it’s gone from about 100 a week to 25 since the last one was put in), so it seems like an awful lot of trouble to go through to get spam into a mailbox. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [May 18, 2005, 7:12pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/4 "2005-05-18T19:12:13Z")
It’s not hard to cut and paste some text. And some spam filters consider the percentage of “red flag” words and phrases. Putting a paragraph of gibberish or of actual text from a benign source lowers the percentage and sneaks by. ---
**Author:** ![Earl\_Snake-Hips\_Tucker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/earl_snake-hips_tucker/32/3269_2.png) [@Earl\_Snake-Hips\_Tucker](https://boards.straightdope.com/u/Earl_Snake-Hips_Tucker)\ **Post date:** [May 18, 2005, 7:12pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/5 "2005-05-18T19:12:33Z")
> [@saoirse](#): > > In the preview pane, though, I can see a series of 8 or 10 lines from a book, apparently a nautical adventure book. Yep, for a while I was getting spam with random passages from “20,000 Leagues Under the Sea.” ---
**Author:** ![saoirse](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@saoirse](https://boards.straightdope.com/u/saoirse)\ **Post date:** [May 18, 2005, 7:25pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/6 "2005-05-18T19:25:13Z")
It’s just that they aren’t actually selling anything. There is no discount drug pitch in the body of the email, so where’s the sender’s interest in getting it by the filter? ---
**Author:** ![Myglaren](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Myglaren](https://boards.straightdope.com/u/Myglaren)\ **Post date:** [May 18, 2005, 7:38pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/7 "2005-05-18T19:38:31Z")
> [@saoirse](#): > > It’s just that they aren’t actually selling anything. There is no discount drug pitch in the body of the email, so where’s the sender’s interest in getting it by the filter? Free trojans. (not the condom) ---
**Author:** ![TimeWinder](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@TimeWinder](https://boards.straightdope.com/u/TimeWinder)\ **Post date:** [May 18, 2005, 7:40pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/8 "2005-05-18T19:40:04Z")
> [@saoirse](#): > > It’s just that they aren’t actually selling anything. There is no discount drug pitch in the body of the email, so where’s the sender’s interest in getting it by the filter? …and this is the $64K question. I would guess that roughly a third of my spam looks commercial, but contains no mechanism whatsoever for actually purchasing the product. No link, no phone number, nothing. I have two theories about this, and would be interested in hearing others’. 1. The spam is being sent on behalf of someone else, the sender is incompetent (even by the standards of spammers) or doesn’t care – they get paid per message sent or received, not by purchases. I would think that a ZERO percent sales rate would put them out of business pretty quick, though. 2. Selling isn’t the purpose of these messages at all; they’re looking for bounce rates, virus propagation vectors, pure vandalism, or something like that. But that hardly explains the volume, and many of these messages aren’t even HTML – there’s no way to link back information about receipt at all (or count bounces, since they _always_ have a fake return address). And without attachments, they’re not spreading viruses. Anyone else have ideas? ---
**Author:** ![jnglmassiv](https://avatars.discourse-cdn.com/v4/letter/j/f07891/32.png) [@jnglmassiv](https://boards.straightdope.com/u/jnglmassiv)\ **Post date:** [May 18, 2005, 7:43pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/9 "2005-05-18T19:43:06Z")
> [@Saoirse](#): > > I know using / to make the V in Viagra **pervents** filters from stopping the message _Snicker_ I get them all the time. ¢Ï@Ļ|$ is no stranger to my inbox. ---
**Author:** ![wolf\_meister](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf_meister/32/15202_2.png) [@wolf\_meister](https://boards.straightdope.com/u/wolf_meister)\ **Post date:** [May 18, 2005, 7:49pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/10 "2005-05-18T19:49:42Z")
**Earl** _Yep, for a while I was getting spam with random passages from “20,000 Leagues Under the Sea.”_ 20,000 Leagues? Wow that’s deep !!! Seriously, the spam I receive jumped up to about 100 per day a few months ago. Recently, it is more like 250 per day. And as others have mentioned a lot of that is in German _or_ from E-Mail addresses with .de in the domain name. ---
**Author:** ![saoirse](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@saoirse](https://boards.straightdope.com/u/saoirse)\ **Post date:** [May 18, 2005, 7:51pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/11 "2005-05-18T19:51:04Z")
I can’t figure thaht out, either. As I said, our filter isn’t that good, so I don’t see why anyone would need to screw it up to get their spam through. That’s the only explanation I’ve heard that makes sense, though. As **TimeWinder** said, there are no attachments, and no return. ---
**Author:** ![picunurse](https://avatars.discourse-cdn.com/v4/letter/p/7bcc69/32.png) [@picunurse](https://boards.straightdope.com/u/picunurse)\ **Post date:** [May 18, 2005, 8:19pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/12 "2005-05-18T20:19:26Z")
> [@](#): > > It’s just that they aren’t actually selling anything. There is no discount drug pitch in the body of the email, so where’s the sender’s interest in getting it by the filter? One explaination I’ve heard, is they are hoping the recipent will reply, then they know they have an active e-mail account. > [@](#): > > In the preview pane, though, I can see a series of 8 or 10 lines from a book, apparently a nautical adventure book. They aren’t complete lines, but fragments, as if it were a small square that had been cut out from the page. There doesn’t seem to be anything else in there. I haven’t actually opened one to find out, of course. If you opened it, those words disappear, and the spam sell appears. If you high-light the whole message after opening, they reappear. I have a Mac, and although it isn’t immune to viruses, there are virtually none that affect it. Spyware and adware don’t load either, so I’m able to look at them if I choose. ---
**Author:** ![saoirse](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@saoirse](https://boards.straightdope.com/u/saoirse)\ **Post date:** [May 18, 2005, 8:30pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/13 "2005-05-18T20:30:11Z")
> [@](#): > > If you opened it, those words disappear, and the spam sell appears oo, now we’re talking. This makes sense. I’d like to see that. I think they have Macs at the Library… ---
**Author:** ![postcards](https://avatars.discourse-cdn.com/v4/letter/p/8e8cbc/32.png) [@postcards](https://boards.straightdope.com/u/postcards)\ **Post date:** [May 18, 2005, 8:33pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/14 "2005-05-18T20:33:28Z")
> [@wolf\_meister](#): > > Seriously, the spam I receive jumped up to about 100 per day a few months ago. Recently, it is more like 250 per day. And as others have mentioned a lot of that is in German _or_ from E-Mail addresses with .de in the domain name. Well, no one is this thread mention anything about spam in German, but look at this: [http://www.pcworld.com/news/article/0,aid,120846,00.asp](http://www.pcworld.com/news/article/0,aid,120846,00.asp) ---
**Author:** ![groman](https://avatars.discourse-cdn.com/v4/letter/g/73ab20/32.png) [@groman](https://boards.straightdope.com/u/groman)\ **Post date:** [May 18, 2005, 10:58pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/15 "2005-05-18T22:58:08Z")
> [@TimeWinder](#): > > Anyone else have ideas? Well as I’ve said, they are hoping this thing gets past your spam filter, you will look at “Viagra”, mark it “Spam” and the spam filter will adapt with the idea “Ok, messages LIKE THIS are spam”. If you do it enough times, legit messages start getting marked as spam, bam you turn off your spam filter and deal with it by hand thereby getting bombarded with advertising. This doesn’t work on individual level, but it’s a sound marketing strategy on a global level. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [May 18, 2005, 11:16pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/16 "2005-05-18T23:16:01Z")
> [@saoirse](#): > > Really? Really. > [@](#): > > I know using / to make the V in Viagra pervents filters from stopping the message (they look for the word). This is just wrong. Filters (especially the adaptive ones) look for _anything_. They don’t care if it’s random symbols, HTML tags, or KOI-8 text (common in Russia, among other places). If it appears in a message you’ve marked as spam, it will become part of the filter and get accounted for next time. [Bayesian filtering, used by Spamassassin and many other filters, is the most common kind of adaptive filtering used against spam.](http://en.wikipedia.org/wiki/Bayesian_filtering) It must be trained to your specific mix of spam and ham (that is, bad email and good email), but after that it is very effective. Anyway, the spam you got tried to make it past Bayesian filters by including ‘good’ text to help it counter all the ‘bad’ text it also has. Bayesian filters will even adapt to this, given enough training. ---
**Author:** ![wolf\_meister](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf_meister/32/15202_2.png) [@wolf\_meister](https://boards.straightdope.com/u/wolf_meister)\ **Post date:** [May 18, 2005, 11:48pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/17 "2005-05-18T23:48:20Z")
**Postcards** Yes, I suppose if I bring up the fact that other people have complained about German spam, I should post a link. - Sorry. [http://boards.straightdope.com/sdmb/showthread.php?t=316750&highlight=German](http://boards.straightdope.com/sdmb/showthread.php?t=316750&highlight=German) ---
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [May 18, 2005, 11:59pm UTC](https://boards.straightdope.com/t/has-anyone-else-been-getting-these-e-mails/304451/18 "2005-05-18T23:59:44Z")
> [@picunurse](#): > > One explaination I’ve heard, is they are hoping the recipent will reply, then they know they have an active e-mail account. This is close, but the spammer doesn’t have to set their hopes that high. A lot of these messages are sent out by people who aren’t selling anything to consumers, but make money by cultivating mail lists to sell to advertisers. They don’t need you to reply to a message to verify that they have a “hot” account – all they need you to do is either open the message or allow it to be displayed in a preview window. If you are using a mail client that allows HTML and displays hotlinked images, this will report back to them. This works like this: Your e-mail address is associated with a string of characters in the in the spammer’s database. A fake image tag is included near the top of the body of the message, which requests an image from a webserver maintained by the spammers that is dedicated to this task alone. The image tag includes the string associated with your e-mail address, and one associated with that particular mass-mailing, like this: \ This doesn’t display as anything, since there’s no actual image to display and the tag specifies that it’s a one pixel by one pixel image. The purpose is just to register as a hit on the server. The spammers can just take the raw logs from the server and run them through some database software, generating a detailed report on which mailings were received by which accounts. They use this information to create more marketable mailing lists. Invalid-but-non-bouncing or impenetrable addresses are culled from the list, and addresses that let a lot of spam in which ends up being displayed get moved up as high-value accounts. This is why it’s important to use a mail client that lets you turn off previewing and lets you disable HTML rendering (or just linked images) except for trusted senders. If you don’t, you’re just going to get more and more spam until your account is unusable.