This is a continuation of our earlier write-up on Russian spam related to phone and ICQ numbers. We are continuing to see these messages, but now with a slight transformation. The message body is blank with all of the content, such as phone numbers, summarized in the subject line. This technique can be disadvantageous because of the length limitation for a single line in an email. Most email clients support a maximum of 78 characters per line. Secondly, non-ASCII* characters, such as those used with Russian language emails, are encoded using schemes like Base64 or Quoted Printable. This increases the length of an already long subject line, often resulting in a split over a number of lines. As shown in the below example, the encoded line actually spans three lines. We can now look at two or more such lines in the subject line as additional criteria to filter out these messages.Subject Decoded:
Subject: Реклама в сетиМассовые рассылки от 800р./млн.адресов. Заявки и вопросы по тел. 8 - 499 - 502-15-73Subject Base64 Encoded:
Subject: =?windows-1251?B?0OXq6+Ds4CDiIPHl8ujM4PHx7uL75SDw4PHx++vq6CDu8iAgODAw8C4v?= =?windows-1251?B?7OvtLuDk8OXx7uIuIMfg/+Lq6CDoIOLu7/Du8fsg7+4g8uXrLiA4IC0g?= =?windows-1251?B?NDk5IC0gNTAyLTE1LTczIA==?=
The standard format for encoded words: ” =?charset?encoding?encoded text?=”
And, in the above example:
Below is an example image of the spam message:
Translation of the Subject line: "Advertisement for websites. Massive delivery for 800 rub./million addesses. Order and question by tel. 8-49…"
* American Standard Code for Information Interchange (ASCII) is a coding standard that can be used for interchanging information, if the information is expressed mainly by the written form of English words. (Source: Wikipedia)