Strange phishing email

Question

I received a strange phishing email the other day that seemed to use span tags to encode "hidden" values within the email's body:

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">
    <p>P<span style="color:transparent;font-size:0px">42</span>l<span style="color:transparent;font-size:0px">84</span>e<span style="color:transparent;font-size:0px">35</span>a<span style="color:transparent;font-size:0px">44</span>s<span style="color:transparent;font-size:0px">66</span>e<span style="color:transparent;font-size:0px">42</span> C<span style="color:transparent;font-size:0px">52</span>o<span style="color:transparent;font-size:0px">42</span>n<span style="color:transparent;font-size:0px">42</span>f<span style="color:transparent;font-size:0px">42</span>i<span style="color:transparent;font-size:0px">42</span>r<span style="color:transparent;font-size:0px">12</span>m<span style="color:transparent;font-size:0px">75</span> <span style="color:transparent;font-size:0px">53</span>y<span style="color:transparent;font-size:0px">42</span>o<span style="color:transparent;font-size:0px">42</span>u<span style="color:transparent;font-size:0px">24</span>r<span style="color:transparent;font-size:0px">83</span>s<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">66</span>a<span style="color:transparent;font-size:0px">61</span>c<span style="color:transparent;font-size:0px">42</span>c<span style="color:transparent;font-size:0px">23</span>o<span style="color:transparent;font-size:0px">52</span>u<span style="color:transparent;font-size:0px">55</span>n<span style="color:transparent;font-size:0px">42</span>t<span style="color:transparent;font-size:0px">74</span> <span style="color:transparent;font-size:0px">87</span>i<span style="color:transparent;font-size:0px">61</span>s<span style="color:transparent;font-size:0px">33</span> <span style="color:transparent;font-size:0px">42</span>f<span style="color:transparent;font-size:0px">31</span>i<span style="color:transparent;font-size:0px">11</span>n<span style="color:transparent;font-size:0px">21</span>a<span style="color:transparent;font-size:0px">62</span>l<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">61</span>n<span style="color:transparent;font-size:0px">12</span>o<span style="color:transparent;font-size:0px">43</span>w<span style="color:transparent;font-size:0px">23</span>.<span style="color:transparent;font-size:0px">42</span>
        <br>o<span style="color:transparent;font-size:0px">61</span>p<span style="color:transparent;font-size:0px">32</span>e<span style="color:transparent;font-size:0px">40</span>n<span style="color:transparent;font-size:0px">52</span> <span style="color:transparent;font-size:0px">42</span>a<span style="color:transparent;font-size:0px">82</span>t<span style="color:transparent;font-size:0px">31</span>t<span style="color:transparent;font-size:0px">44</span>a<span style="color:transparent;font-size:0px">49</span>c<span style="color:transparent;font-size:0px">42</span>h<span style="color:transparent;font-size:0px">82</span>m<span style="color:transparent;font-size:0px">33</span>e<span style="color:transparent;font-size:0px">92</span>n<span style="color:transparent;font-size:0px">44</span>t<span style="color:transparent;font-size:0px">42</span>s<span style="color:transparent;font-size:0px">62</span> <span style="color:transparent;font-size:0px">51</span>d<span style="color:transparent;font-size:0px">48</span>o<span style="color:transparent;font-size:0px">82</span>c<span style="color:transparent;font-size:0px">42</span>x<span style="color:transparent;font-size:0px">53</span> <span style="color:transparent;font-size:0px">61</span>h<span style="color:transparent;font-size:0px">47</span>e<span style="color:transparent;font-size:0px">42</span>r<span style="color:transparent;font-size:0px">42</span>e<span style="color:transparent;font-size:0px">62</span> <span style="color:transparent;font-size:0px">71</span>t<span style="color:transparent;font-size:0px">45</span>o<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">42</span>v<span style="color:transparent;font-size:0px">64</span>e<span style="color:transparent;font-size:0px">67</span>r<span style="color:transparent;font-size:0px">94</span>i<span style="color:transparent;font-size:0px">88</span>f<span style="color:transparent;font-size:0px">42</span>y<span style="color:transparent;font-size:0px">93</span> <span style="color:transparent;font-size:0px">45</span>i<span style="color:transparent;font-size:0px">74</span>t<span style="color:transparent;font-size:0px">99</span>.
        <br>
        <br><span style="color:transparent;font-size:0px">42</span>S<span style="color:transparent;font-size:0px">83</span>i<span style="color:transparent;font-size:0px">24</span>n<span style="color:transparent;font-size:0px">89</span>c<span style="color:transparent;font-size:0px">84</span>e<span style="color:transparent;font-size:0px">73</span>r<span style="color:transparent;font-size:0px">62</span>e<span style="color:transparent;font-size:0px">12</span>l<span style="color:transparent;font-size:0px">13</span>y
        <br><span style="color:transparent;font-size:0px">94</span>A<span style="color:transparent;font-size:0px">62</span>p<span style="color:transparent;font-size:0px">62</span>p<span style="color:transparent;font-size:0px">61</span>l<span style="color:transparent;font-size:0px">23</span>e<span style="color:transparent;font-size:0px">24</span></p>
</div>

When the HTML is rendered it looks like this:

And when you extract only the information between HTML tags it looks like this:

P42l84e35a44s66e42 C52o42n42f42i42r12m75 53y42o42u24r83s42 66a61c42c23o52u55n42t74 87i61s33 42f31i11n21a62l42 61n12o43w23.42
o61p32e40n52 42a82t31t44a49c42h82m33e92n44t42s62 51d48o82c42x53 61h47e42r42e62 71t45o42 42v64e67r94i88f42y93 45i74t99.

42S83i24n89c84e73r62e12l13y
94A62p62p61l23e24

Of course the email also contained a word doc attachment that is probably the real payload, but I'm wondering what the point of this weird encoding is, besides just looking cool?

There is a similar post on stackexchange here, but I'm more wondering if anyone has any theories about the encoded sequence of numbers and if it has any meaning.

The number sequence itself is:

4284354466425242424242127553424224834266614223525542748761334231112162426112432342613240524282314449428233924442625148824253614742426271454242646794884293457499428324898473621213946262612324

Answer 1

The purpose of this is to fool automated phishing and spam detection algorithms. The trick is simply to supply text which, when rendered by your browser, is easily recognizable by a human but, when parsed by naïve spam filters, does not contain any recognizable signs of malice. The number sequence doesn't mean anything. It's displayed at 0px with a transparent font, which makes it invisible when rendered. It's just filler to avoid detection and was probably selected by randomly mashing number keys.