Happiness Healthcare Canadian Pharmacy Spam

Hash buster text is featured in different sections of this spam e-mail. The one piece of hash buster text is cleverly hidden in the text/plain version of the message and the actual spam message (containing the other piece of hash buster text) is stored in the text/html version of this multipart/alternative e-mail.

The plain text version is never intended to be shown to the recipient of the e-mail, because it contains, well... only text. No links, no e-mail addresses, nothing. It's main purpose is to randomise the hash sum of the e-mail. In other words, the spammer (or spambot) can keep the HTML version unchanged and only needs to change the text version for each spam e-mail he (or it) sends. This produces a different hash sum each time, so the e-mail won't match the hash sum of e-mails previously marked as spam and can easily bypass a Bayesian spam filter this way. This is quite an old trick used by spammers and most spam filters are able to detect this discrepancy quite easily these days.

But this example takes hash busting a bit further, it places (visible) hash buster text at the end of the e-mail as well. All the hash busting and bypassing techniques are quite useless, because like mentioned earlier, modern day spam filters will frown upon a multipart/alternative e-mail if the content in the plain text version differs from the content in the HTML version of the e-mail. So this is either a stupid spammer or an outdated spambot that's still active on an infected machine.



You can say that again. Will you feel comfortable ordering drugs through a spam e-mail that looks like the inside of a garbage truck?



We deleted some offensive text before publishing this e-mail because we couldn't care less about what the spammer thinks.



This spammer is obviously taking way too many blue pilules.