spamerの忘れ物
http://www.hart.co.jp/spam/foolspammer.html より
実はこの部分はspammerご用達のバルクメール送信ソフトに指示するマークで、本来なら宛先一件ごとあるいは 数十通送るたびにこの % から始まる変数 %CURRENT_DATE_TIME とか %RNDLCCHAR514 とかを別途用意したデータあるいはランダムな単語や数字に置き換えて偽装を計るために使われます。
手元の溜め込んであるspamから拾った結果
ヘッダ
References: <%CUSTOM_REF>In-Reply-To: <%CUSTOM_REF>
Date: %CURRENT_DATE_TIME
Received: from [208.156.184.72] by 24.15.140.131 with anaconda SMTP;
%CURRENT_DATE_TIMEFrom: "Jerrold Meyers" <%RNDLCCHAR514@hotmail.com>
Subject: ENTERTAINMENT/MEDIA Sector - CYPM Acquisition - To Compete With
DISNEY & PIXAR, %CURRENT_DATE_TIME.Subject: GOT Viagr@,Val?(u)m, X(a)n@x, Som@ Di3t Pills Many M3ds %RND_CHAR[4-15] gelcm psvj izeaph
Subject: Interested in an invitation (%RND_MONTH_DAY_YEAR)
Subject: Re: %RND_UC_CHAR[2-8], blood ran down
Received: from [61.149.142.173] by %CUSTOM_IP with HTTP;
Mon, 01 Mar 2004 14:07:16 +0500X-Originating-IP: [%CUSTOM_IP]
X-MimeOLE: %CUSTOM_MIMEOLE
Message-ID: <%CUSTOM_A0[7-13]-%CUSTOM_A0[3-11]-%CUSTOM_A0[2-6]lbl4cqdy@visi.net>Received: from [24.232.71.36] by %CUSTOM_IP with HTTP;
Received: from (134.130.72.24) pmarzk.theatriccoco.com by Experian ContactMail Build v1.89 (Using MIME::Lite v2.117 ) %RND_VERSION with
X-MIMETrack: Itemize by SMTP Server on SMTP1/Bwcvwils(Release 5.0.11 |%RND_DATE_ONLY) at
本文
%RND_TXTDavenport,%RND_SYB
http://datingilove.com/remove/%RND_DIGIT
[a:http://%RND_URL/?partid=it01]Get Your Low Mortgage
http://supercheap.%RND_FR?M_D?MAIN/gp/d?fault.asp?id=JNL
[a:http://rd.yahoo.com/%RND_WORD/%RND_WORD/%RND_WORD/*http:/www.getsomedealz.com/jf/index.php]Show Me The Lowest Rates
%RND_PHRASE[2]
%RND_WORD %RND_WORD %RND_WORD %RND_WORD %RND_WORD %RND_WORD %RND_WORD%RND_WORD
%RND_DIGIT%RND_LC_CHAR
{%RND:^%}{%RND:^%}{%RND:^%}
