HTMLHelp Forums > Suspicious Code from an Email

Full Version: Suspicious Code from an Email - Assist, Please

HTMLHelp Forums > General Interest > Off Topic

Copper Sparrow

Aug 9 2008, 03:22 AM

Greetings, folks!

I received a 'Chain Letter' (grr

) on a community site, of which I am a member, and it contained some suspicious code. After scanning through the html, I saw some unrecognizable strings, and wondered if anyone might be able to put my mind at ease.

Also Noteworthy:

When loading the text (which I did twice, using two different editors), I got 2 (TWO) identical security popups, which stated: "You are about to view pages over a secure connection. Any information you exchange with this site cannot be viewed by anyone else on the web..." etc.

...Now, why would ANY connection need to be made in order to view the document? For the pictures? Perhaps, but, the pictures don't actually load...

--The url for both of the pictures is¹:

http://f540.mail.yahoo.com/ya/download?mid=1%5f217734%5fAPQkvs4AAB9LSGFK7AWPYhvQ9mw&pid=3&fid=Inbox&inline=1

-Which seems odd unto itself.

Anyway, moving on.

html of the Email:

CODE

<HTML><HEAD>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<font face="Times New Roman" size="3"><span style="font-size: 12pt"></span></font></p><div><div><div><div><div><div><div style="margin-bottom: 5pt"><div><div><div><div><div><div><div><div><div><div><div style="margin-bottom: 5pt; margin-left: 3.75pt"><div><div><div><div><div><div><div><div><div><div><div><div style="margin-bottom: 5pt; margin-left: 3.75pt"><div><div><div style="margin-left: 3.75pt"><div><div style="margin-bottom: 5pt"><div><div><div><div><div><div><div><div style="margin-bottom: 5pt; margin-left: 3.75pt"><div><div><div><div><div><div><div><div style="margin-bottom: 5pt"><div style="margin-bottom: 5pt; margin-left: 3.75pt"><div><div style="margin: 0px; padding: 0px; text-align: center"><font face="Times New Roman" size="3"><span style="font-size: 12pt">�<img src="http://f540.mail.yahoo.com/ya/download?mid=1%5f217734%5fAPQkvs4AAB9LSGFK7AWPYhvQ9mw&pid=2&fid=Inbox&inline=1" border="0" width="28" height="30" /></span></font><strong><font color="#a11f12" size="6"><span style="font-weight: bold; font-size: 24pt; color: #a11f12"><br />Hello, Pretty Lady!</span></font></strong><span class="EC_ecececececapple-converted-space"><strong><font color="#a11f12" size="5"><span style="font-weight: bold; font-size: 18pt; color: #a11f12">�</span></font></strong></span><font color="#a11f12" face="Arial" size="4"><span style="font-size: 13.5pt; color: #a11f12; font-family: Arial"><br /></span></font><font color="#a11f12" size="5"><span style="font-size: 18pt; color: #a11f12"><br />THIS IS A TOAST ...<span class="EC_ecececececapple-converted-space">�</span><em><span style="font-style: italic">TO US</span></em><span class="EC_ecececececapple-converted-space">�</span>... FOR THE MEN WHO HAVE US, THE LOSERS<span class="EC_ecececececapple-converted-space">�</span><br />WHO HAD US, AND THE LUCKY PEOPLE WHO WILL MEET US!!<span class="EC_ecececececapple-converted-space">�</span></span></font><em><font color="#a11f12" face="Arial" size="4"><span style="font-size: 13.5pt; color: #a11f12; font-style: italic; font-family: Arial"><br /></span></font></em><em><font color="#a11f12" size="5"><span style="font-size: 18pt; color: #a11f12; font-style: italic"><br />You have been hit.</span></font></em><span class="EC_ecececececapple-converted-space"><font size="5"><span style="font-size: 18pt">�</span></font></span><font color="#a11f12" size="5"><span style="font-size: 18pt; color: #a11f12"><br />You have been considered one of the 10 prettiest ladies with a kind, warm and loving heart. � Once you have been hit, you have to hit 10 pretty ladies with kind, warm and loving hearts. � If you get hit again you know you're really pretty and kind. �<span class="EC_ecececececapple-converted-space">�</span><em><span style="font-style: italic">If you fail to forward this, you'll have ugliness for 10 years.</span></em><span class="EC_ecececececapple-converted-space">�</span>� So hit 10 pretty ladies to let them know they are pretty -- both on the<span class="EC_ecececececapple-converted-space">�</span><br />Inside and the outside � and that they are loved and cared for.<span class="EC_ecececececapple-converted-space">�</span><br /><br />SEND THIS TO PRETTY LADIES, TO BRIGHTEN THEIR DAY, INCLUDING THE ONE WHO SENT IT TO YOU! � REMIND LADIES TO BE INFORMED, AWARE AND BE CHECKED FOR THEIR HEALTH'S SAKE. � TELL THEM THAT NO ONE WANTS TO LOSE THEM � AFTER ALL, THEY ARE PRETTY LADIES WITH KIND, WARM LOVING HEARTS��</span></font><font color="#a11f12" face="Arial" size="4"><span style="font-size: 13.5pt; color: #a11f12; font-family: Arial"><br /></span></font><font color="#a11f12" size="5"><span style="font-size: 18pt; color: #a11f12"><br />All you are asked to do is keep this circulating (even if to one person).<span class="EC_ecececececapple-converted-space">�</span></span></font><font size="5"><span style="font-size: 18pt"><br /></span></font><img src="http://f540.mail.yahoo.com/ya/download?mid=1%5f217734%5fAPQkvs4AAB9LSGFK7AWPYhvQ9mw&pid=3&fid=Inbox&inline=1" border="0" width="28" height="30" /><strong><font color="#a11f12" size="5"><span style="font-weight: bold; font-size: 18pt; color: #a11f12"><br />In <span class="yshortcuts">memory</span> of anyone you know that has been struck by <span class="yshortcuts">cancer</span>.</span></font></strong>
</div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div></div></div>
</div></div></div></div></div></div></div></div></div>
</BODY></HTML>

Who -or- What would generate such sloppy strings?

...Does Not Compute...

Let's forget for a moment, that the contents of the letter is total ~~crap~~...I mean POO, and that the creator should be taken out back... But, rather, have a look at the coding, and tell me what you see.

I would appreciate any feedback.

Very Sincerely,
Copper Sparrow
__________________________________________________

¹Disclaimer:
This message, all of its contents—including, but not limited to—quotations, original works, links, and coding expresses the views/opinions of the user known as "Copper Sparrow" (here forth known as "the author"), or those of the original author, in such cases as noted otherwise, and not those of htmlhelp.com, LLC (here forth known as HTMLHelp), Invision Power Board©, or its editor(s)/publisher(s) (here forth known collectively as "the companies"); or any partners thereof. This message and all of the material in it is provided on an 'as is' basis, without any guarantees of any kind, express or implied.
Use of this message, and all of its contents is strictly at your own risk. The companies, partners, and author assume no liability of any kind for the content of, or replies to any personal or group text listed in this message, or subsequent replies. Such liability rests exclusively with the reader or respondent (here forth known as the "user").
The user agrees to indemnify and hold harmless the author, the companies, its editor/publisher, or any partners thereof from all costs, expenses, liabilities and damages resulting from, or caused by their use of this message, and all of its contents.

Frederiek

Aug 9 2008, 04:06 AM

Personally, I'd trash such mails immediately as spam.

HTML emails do load images from absolute URL's on the web, or they wouldn't show up.
Anyway, this code seems more like tag soup.

You did get this mail from the community you are a member of? In the header of the email should be able to see where it came from. If it does come from the community, I'd tell them about it, so they can maybe do something about such mails.

pandy

Aug 9 2008, 09:58 AM

QUOTE

Who -or- What would generate such sloppy strings?

Do you refer to the redundant DIVs? Just about any WYSIWYG editor.

Copper Sparrow

Aug 26 2008, 03:20 AM

Thank you for your reply, Frederiek.

If this had come to my "normal" email inbox, yeah, I likely would have trashed it, myself. It however, came to my group inbox from a mushy-save-the-world community of which I am a member. I tend to read all that is sent there by folks in my "friend list", and the sender of this particular message was forwarding it to me (& a few dozen others), so I wanted to be kind enough to read & reply. (yes, I realize how utterly verbose I am...I'm okay with it.)

At any rate, while I know who sent it to me, I've no indication of who the original author is...though...if I were so inclined, I suppose that I could track down that person.

So...thank you for your input, I truly appreciate your time.
_____________________________________________________

I thank you too, pandy, for your reply.

In reference to your question, yes, the redundancy certainly was of particular note. I could see how an editor would screw up perfectly good strings--as they are want to do--but, this one was by far the ugliest I've yet to encounter.

I thank you for your answer, and appreciate you taking the time to help.
_____________________________________________________

Much Goodness, and Squishy Warm-Fuzzies to you both.

CHEERS!

Very Sincerely,
Copper Sparrow
__________________________________________________

¹Disclaimer:
This message, all of its contents—including, but not limited to—quotations, original works, links, and coding expresses the views/opinions of the user known as "Copper Sparrow" (here forth known as "the author"), or those of the original author, in such cases as noted otherwise, and not those of htmlhelp.com, LLC (here forth known as HTMLHelp), Invision Power Board©, or its editor(s)/publisher(s) (here forth known collectively as "the companies"); or any partners thereof. This message and all of the material in it is provided on an 'as is' basis, without any guarantees of any kind, express or implied.
Use of this message, and all of its contents is strictly at your own risk. The companies, partners, and author assume no liability of any kind for the content of, or replies to any personal or group text listed in this message, or subsequent replies. Such liability rests exclusively with the reader or respondent (here forth known as the "user").
The user agrees to indemnify and hold harmless the author, the companies, its editor/publisher, or any partners thereof from all costs, expenses, liabilities and damages resulting from, or caused by their use of this message, and all of its contents.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.