7

I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text:

enter image description here

Why do they contain such weird characters? Is this part of an exploit? Is this to mislead spam filters? Or is it for a different reason?

Improve this question
3
  • That's probably an encoding error, using the wrong character set to display e.g. Windows-1252. If you paste the actual text rather than using an image, I could try transcoding it to Unicode equivalents. If you paste the actual raw .eml content (with headers) in a code block, we might be better equipped to speculate on the email.
    – Adam Katz
    Jul 29, 2019 at 21:04
  • @AdamKatz Once I get home I'll see what I can do. I use Outlook so I'll have to first figure out how to export these mails as EML
    – Nzall
    Jul 30, 2019 at 7:15
  • 2
    I see localized spam from some regions where they basically assume that everyone is using the same character set and so it doesn't have to be explicitly stated, in violation of pertinent email RFCs. Maybe a client which is popular in the region displays it like they expected, and they don't care, or simply didn't notice that it's broken for other recipients.
    – tripleee
    Oct 31, 2019 at 7:29

1 Answer 1

Reset to default
9

Usually those are UTF8 sequences that resemble other characters, without being them.

For example π’•π’‰π’Šπ’” π’”π’•π’“π’Šπ’π’ˆ is not the text "this string", and therefore does not trigger UCE detectors as spam, while you probably read it as "this string", as the sender intended.

On the other hand, it is weirdly encoded, so it can happen that it is decoded incorrectly. And "π’•π’‰π’Šπ’” π’”π’•π’“π’Šπ’π’ˆ" becomes οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½οΏ½ or other mojibake.

Improve this answer
1
  • If you are curious: These are "Maths Alphanumeric Symbols" starting at U1D400. Four byte UTF-8. π–™π–π–Žπ–˜ π–˜π–™π–—π–Žπ–“π–Œ is nearby.
    – gnasher729
    Oct 2 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .