SPUTR

Trick naming

Each trick in the Spammers' Compendium has a friendly name (which is intended to be humourous), and also a SPUTR name. SPUTR (Spam/Phish Uniform Trick Repository) is a naming scheme for spammer and phisher content tricks that was first proposed by John Graham-Cumming. More details can be found here.

Each name consists of three '!'-separated parts: a purpose, a name, and a technology.

  • The purpose is the reason for the trick (for example, the trick is used to obscure a URL, or to insert innocent words).
  • The name is derived from the current pejorative name.
  • The technology identifies the way in which the trick is coded (for example, with HTML or MIME).

Purposes

The following table contains a list of 'purposes' that can be used to categorize tricks.

BWO Bad word obfuscation Making it hard for a filter to parse potentially bad words (e.g. Viagra)
GW Good word insertion Adding words likely to confuse a statistical filter.
HB Hash busting Inserting randomness designed to make message hashing hard.
TA Tokenization avoidance Preventing a filter from tokenizing a message.
UH URL hiding Hiding a URL so that a user is fooled into clicking an incorrect link.
UO URL obfuscation Making it hard for a filter to identify a URL and check it against a black list.
WB Web bugs Inserting a beacon that tells the spammer that a message has been read.

Technologies

For a single name there could be multiple tricks using different technologies (e.g. some tricks might be implemented using HTML or CSS), or tricks that are intended for different purposes (words might be inserted to fool a Bayesian filter or to break a hash).

This table shows the 'technologies' that are recognized in the naming scheme:

CSS Use of CSS
HTML Any HTML without using CSS
Javascript Use of Javascript for trickery
MIME Manipulation of MIME
PDF Use of PDF files
Plain Plain text
Image Images (GIF, JPG or PNG)
Flash Macromedia Flash
Audio Any audio file format
Office Any office file format

Poll

Do you use the same password(s) across multiple websites?
I use the same password for all sites
I have a number of passwords but use the same for some sites
I use a different password for each site
I don't sign up to any sites that require a password

Leave a comment
View 4 comments
Jobs Recruit Sidebar

Malware Prevalence

Agent |#######################|
OnlineGames |#################|
Kryptik |#############|
Heuristic/generic |#####|
Heuristic/generic |#####|
 View this month's full report
Virus Bulletin currently has 190,959 registered users.