eclectical engineering

Big-name computer-game publisher Eidos Interactive was so excited about the recent release of Tomb Raider: Legend that they sent me not just one, but two unsolicited mailings in the space of three days, and to my office address yet. Maybe I'll get more, who knows (and doesn't Lara look rather goth these days)?

The messages, of course, did not come from Eidos directly but from an outfit apparently known as valuedat.com (the domain registered by a party in Boca Raton, Florida); their mail host operated at IP 207.210.68.2 in a block assigned to Global Net Access (GNAX) of Atlanta.

Eidos fared better with their spamhaus than did Loehmann's (see earlier post), since it managed to stay on the net long enough for me to have a look. The images, web links, and (yes) web bugs were served from hosts in the pyrophylliterequisitioner.com domain (apparently registered to the same crowd in Boca Raton, but hosted at IP address 72.4.161.90 (assigned to Affinity Internet in nearby Fort Lauderdale). This looks like yet another house-of-cards South Florida spam operation.

What I'd really like to know is why Eidos, which controls one of the longest-running and most popular action-game franchises in computer-game history (a series so popular that it spawned two Hollywood blockbuster feature films), would find it necessary to promote this product through indiscriminate spamming. Maybe that's what happens when you put the wrong new management on the job.

For a year or so, I was getting spam from Loehmann's department store with low but consistent frequency (others, apparently, were also getting it). Then, it seemed to have ceased. Now, Loehmann's has returned to darken my inbox courtesy of a new partner-in-spam.

The message came from an outfit using the domain name dentaltestingimagery.com (how's that for a mission-focused, above-board, and descriptive name for a remailer outfit?). They were apparently using a small group of addresses (like 64.69.46.247 for their mail host) provided by the California collocation service CoreExpress. They were running their authoritiative name service (and possibly their websites) from these same addreses as well. Unfortunately for them, by the time I was able to track this mail down, their name service was shut down cold and removed from DNS altogether, taking the rest of the operation with it (including the secret web-bug that was supposed to trip if I opened the message).

Obviously, Loehmann's won't take a hint to stop spamming, so the best we can hope for is that they continue to piss away their ad budget on chickenboners like these.

I really don't care for chain restaurants. Whenever I'm traveling on business (which turns out to be quite a lot just now), I paradoxically tend to feel more at home in a neighborhood joint I've never heard of, than in a local branch of some Humongous Food Chain.

It isn't that the food is bad at chain restaurants -- likely as not, it is just fine (or at least not septic) -- its rather the tense and creepy atmosphere, some sort of admixture of deja-vu (on my part) and smugness (on the part of the staff). It can all be summed up in a question that the wait staff in such places seems to be trained to ask:

Some meathead corporate MBA somewhare probably got himself a corner office for dreaming up this bit of locution. As for me, I'm at a complete loss to know what the purpose of such a question is other than to put the poor customer completely on the defensive.

Are you supposed to say "no" and thereby endure a 20-minute review of the T.J. Fuddleberry's Mission Statement? Should you lie and say "yes" and thereby miss out on the critical instructions to remove your necktie lest the chef cut it off with his butcher knife? Is "yes, I've been here before" the appropriate response if you haven't been to this particular shop, but you have been to another one three exits up the Interstate?

Tonight, I dined at a branch of an upscale restaurant chain, whose name I won't mention here (well, OK, I'll give a link to them). Over comes the waiter with a tray full of condiments and The Inevitable Question. I answered "yes" to cut him off, but he continued anyway; rather than leave the stuff on the table for me, he insisted on asking how I would like "our special sauce" prepared. Jeez, folks, it's just chili paste, sesame oil, and soy sauce -- I think I can manage. God, if I'd let him keep going, I imagine he'd have brought over a coloring book, one crayon, and a bib.

Here are some random responses I've worked up for the next time I'm asked this question (although I'm far too chickenhearted to actually use any of them):

Lately, a few specialists in pharmacy and mortgage spam have been getting a lot of mileage out of a CSS-based trick for obfuscating their HTML markup. They break up their sales pitches every few characters with a <SPAN> of text with its FLOAT attribute set to RIGHT, so that the SPANned text is moved out of the way of the spam pitch and sent to the right side of the line. You will see the pitch as intended (albeit with some extra garbage on the right hand side), while your content-based non-CSS-savvy spam filter will see diddley.

The object appears to be to prevent spam filters from seeing "spammy words" (like "LOWER" as here).

Here's a bit snipped directly (and slightly modified for format and anonymity) from one of these spams (widen your browser window to watch the gibberish "stick" to the right margin, and view the source of this page to see how the trick works):

D o ear Home Ow d ne w r ,

Your cr n ed b it doesn't matter to us ! If you O e WN real e e st p at d e
and want IM g ME a DIAT a E cas h h to sp d en e d ANY way you like, or simply wish
to L l OWER your monthly p p ayme j nts by a third or more, here are the de r als
we have T s OD g AY :

$ 4 f 88 , 000 at a 3 u , 67% fi s xed - rat u e
$ 3 w 72 , 000 at a 3 , m 90% v s ariab d le - ra a te
$ 49 z 2 , 000 at a 3 k , 21% inte h res q t - only
$ 24 k 8 , 000 at a 3 , z 36% fi e xed - ra r te
$ 1 e 98 , 000 at a 3 k , 55% vari u able - rat c e

Hu i rry, when these deaI m s are gone, they are gone !

Don't worry about a s pprov d al, your c t red w it will not dis w qua m lify you !

V j isi o t our q site

Sincerely, Ianthe Blanchard

Ap z prov p al Manager

One interesting bit of HTML trivia we learn here is that the <A> hyperlink can be extended across one of these "floated" bits of text as an anchor (I redirected this hyperlink for obvious reasons). This may even be useful to someone someday.

I guess someone was very proud to have figured out how to deploy this trick; seems to me, though, they could have achieved the same result any number of other ways that would not litter the right margin of your browser window with all that cruft.

eclectical engineering

	about this web log Some things I know; others I guess; the rest I make up. Richard C. Conner, P.E. my websites: fountain pens all about spam mail	Wed, 26 Apr 2006 Mainsleaze: I get spammed (twice) by Lara Croft Big-name computer-game publisher Eidos Interactive was so excited about the recent release of Tomb Raider: Legend that they sent me not just one, but two unsolicited mailings in the space of three days, and to my office address yet. Maybe I'll get more, who knows (and doesn't Lara look rather goth these days)? The messages, of course, did not come from Eidos directly but from an outfit apparently known as valuedat.com (the domain registered by a party in Boca Raton, Florida); their mail host operated at IP 207.210.68.2 in a block assigned to Global Net Access (GNAX) of Atlanta. Eidos fared better with their spamhaus than did Loehmann's (see earlier post), since it managed to stay on the net long enough for me to have a look. The images, web links, and (yes) web bugs were served from hosts in the pyrophylliterequisitioner.com domain (apparently registered to the same crowd in Boca Raton, but hosted at IP address 72.4.161.90 (assigned to Affinity Internet in nearby Fort Lauderdale). This looks like yet another house-of-cards South Florida spam operation. What I'd really like to know is why Eidos, which controls one of the longest-running and most popular action-game franchises in computer-game history (a series so popular that it spawned two Hollywood blockbuster feature films), would find it necessary to promote this product through indiscriminate spamming. Maybe that's what happens when you put the wrong new management on the job. posted 22:05 Wed, 26 Apr 2006 [/spam] permanent link Mainsleaze: Loehmann's gets a new spamhaus (but might want to stop payment on the check) For a year or so, I was getting spam from Loehmann's department store with low but consistent frequency (others, apparently, were also getting it). Then, it seemed to have ceased. Now, Loehmann's has returned to darken my inbox courtesy of a new partner-in-spam. The message came from an outfit using the domain name dentaltestingimagery.com (how's that for a mission-focused, above-board, and descriptive name for a remailer outfit?). They were apparently using a small group of addresses (like 64.69.46.247 for their mail host) provided by the California collocation service CoreExpress. They were running their authoritiative name service (and possibly their websites) from these same addreses as well. Unfortunately for them, by the time I was able to track this mail down, their name service was shut down cold and removed from DNS altogether, taking the rest of the operation with it (including the secret web-bug that was supposed to trip if I opened the message). Obviously, Loehmann's won't take a hint to stop spamming, so the best we can hope for is that they continue to piss away their ad budget on chickenboners like these. posted 22:03 Wed, 26 Apr 2006 [/spam] permanent link "Have you ever been here before?" I really don't care for chain restaurants. Whenever I'm traveling on business (which turns out to be quite a lot just now), I paradoxically tend to feel more at home in a neighborhood joint I've never heard of, than in a local branch of some Humongous Food Chain. It isn't that the food is bad at chain restaurants -- likely as not, it is just fine (or at least not septic) -- its rather the tense and creepy atmosphere, some sort of admixture of deja-vu (on my part) and smugness (on the part of the staff). It can all be summed up in a question that the wait staff in such places seems to be trained to ask: "Have you ever been here before?" Some meathead corporate MBA somewhare probably got himself a corner office for dreaming up this bit of locution. As for me, I'm at a complete loss to know what the purpose of such a question is other than to put the poor customer completely on the defensive. Are you supposed to say "no" and thereby endure a 20-minute review of the T.J. Fuddleberry's Mission Statement? Should you lie and say "yes" and thereby miss out on the critical instructions to remove your necktie lest the chef cut it off with his butcher knife? Is "yes, I've been here before" the appropriate response if you haven't been to this particular shop, but you have been to another one three exits up the Interstate? Tonight, I dined at a branch of an upscale restaurant chain, whose name I won't mention here (well, OK, I'll give a link to them). Over comes the waiter with a tray full of condiments and The Inevitable Question. I answered "yes" to cut him off, but he continued anyway; rather than leave the stuff on the table for me, he insisted on asking how I would like "our special sauce" prepared. Jeez, folks, it's just chili paste, sesame oil, and soy sauce -- I think I can manage. God, if I'd let him keep going, I imagine he'd have brought over a coloring book, one crayon, and a bib. Here are some random responses I've worked up for the next time I'm asked this question (although I'm far too chickenhearted to actually use any of them): No, I'm so sorry, please forgive me. No, and I'm not even here right now. No, my lawyers told me to stay out pending the litigation. No, but I'm too far away from a good place to eat. No, I couldn't bring myself to come in here before now because my grandma was violently murdered in front of one of these places. No, I haven't been able to get on the work-release program until now. No, but I think I understand the protocol: I pick out some items from this menu, you bring them to me, I eat them, then I pay you. That about right?" Or, to take the affirmative: Yes, I've been here before, have you? Yes, I was the dine-and-dash last Tuesday. Yes, the health department gives me a good expense account. posted 21:41 Wed, 26 Apr 2006 [/observations] permanent link Spam tricks: Obfuscation using CSS "float" attribute. Lately, a few specialists in pharmacy and mortgage spam have been getting a lot of mileage out of a CSS-based trick for obfuscating their HTML markup. They break up their sales pitches every few characters with a <SPAN> of text with its FLOAT attribute set to RIGHT, so that the SPANned text is moved out of the way of the spam pitch and sent to the right side of the line. You will see the pitch as intended (albeit with some extra garbage on the right hand side), while your content-based non-CSS-savvy spam filter will see diddley. The object appears to be to prevent spam filters from seeing "spammy words" (like "LOWER" as here). Here's a bit snipped directly (and slightly modified for format and anonymity) from one of these spams (widen your browser window to watch the gibberish "stick" to the right margin, and view the source of this page to see how the trick works): D o ear Home Ow d ne w r , Your cr n ed b it doesn't matter to us ! If you O e WN real e e st p at d e and want IM g ME a DIAT a E cas h h to sp d en e d ANY way you like, or simply wish to L l OWER your monthly p p ayme j nts by a third or more, here are the de r als we have T s OD g AY : $ 4 f 88 , 000 at a 3 u , 67% fi s xed - rat u e $ 3 w 72 , 000 at a 3 , m 90% v s ariab d le - ra a te $ 49 z 2 , 000 at a 3 k , 21% inte h res q t - only $ 24 k 8 , 000 at a 3 , z 36% fi e xed - ra r te $ 1 e 98 , 000 at a 3 k , 55% vari u able - rat c e Hu i rry, when these deaI m s are gone, they are gone ! Don't worry about a s pprov d al, your c t red w it will not dis w qua m lify you ! V j isi o t our q site Sincerely, Ianthe Blanchard Ap z prov p al Manager One interesting bit of HTML trivia we learn here is that the <A> hyperlink can be extended across one of these "floated" bits of text as an anchor (I redirected this hyperlink for obvious reasons). This may even be useful to someone someday. I guess someone was very proud to have figured out how to deploy this trick; seems to me, though, they could have achieved the same result any number of other ways that would not litter the right margin of your browser window with all that cruft. posted 20:41 Wed, 26 Apr 2006 [/spam] permanent link