Table manners

In the vast landscape of spammer tricks it’s rare that we see anything genuinely new – or in this case a very new twist on a very old trick called “ascii art”. I no longer even blink at the seemingly infinite spellings of ‘Vi@gra’ encountered on a daily basis. An always familiar technique of spammers is to send out a link to their website but to have the description/sales pitch be obfuscated in some way that makes it less obvious to any machine-based detection. These range anywhere from mis-spelling of words to using images in place of words. Today we saw a new variety where the letters of the text were drawn out using HTML tables.

Here we see the message as it would be displayed in the email:

obfuscated message

Selecting some of the text reveals that each block is made up of a table cell with random text inserted and the background made black:

selected tables

<TABLE cellpadding=10 cellspacing=0>
       <tr><td> </td><td width=100 bgcolor=#222222>and</td><td> </td></tr>
        <tr><td width=20 bgcolor=#222222>and</td><td></td><td></td></tr>
         <tr><td width=20 bgcolor=#222222>and</td><td></td><td></td></tr>
          <tr><td width=20 colspan=2 bgcolor=#222222>and</td><td></td><td></td></tr>

From the point of view of any piece of software this is just a series of table definitions and background colours. But I think even those of us with the worst eyesight would know they are pushing something sexually explicit.