SpamPal v1.594
URLBody v0.06
URLBody is probably failing to parse certain URLs
containing |, >, [, ] etc.
These are apparently valid hostnames, as they resolve
in IE and even a tool such as nslookup. Spammers are
using them because they don't parse well with tools
that are designed to lookup the URLs. Here are a couple
of examples from recent spams:
www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com
www.ww|www<]livesturnonmillionccumulatej].slideaffinity.com
www.ww|www<[mamanikolaiwantedfemigrateg[.anytimeclock.com
To see that they resolve, you can try it with a dos
command:
C:\> nslookup
"www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com"
Output:
[...]
Non-authoritative answer:
Name:
www.ww|www<]upstairseddierecriminatekfourfoldo].attentivoffer.com
Address: 202.177.27.53