Subject: anyone up for a little spam analysis?

From: [email-masked] (Lucas Vogel)
Date: Thu, 29 Mar 2001 12:26:34 -0800

I got an interesting piece of spam today, and I'm not entirely sure what
it's doing. 

the source code:

----------------------------------------------------------

Return-Path: <[email-masked]>
Received: from mh7-sfba.mail.home.com ([24.0.95.236])
          by mail1.rdc1.az.home.com (InterMail vM.4.01.03.00 201-229-121)
          with ESMTP
          id
<[email-masked]>
          for <[email-masked]>;
          Thu, 29 Mar 2001 10:00:04 -0800
From: [email-masked]
06:04:27 -0600
Message-ID: <[email-masked]>
To: <[email-masked]>
Subject: The economy needs a 2nd wind                         5078
Date: Thu, 29 Mar 2001 06:04:20 -0600
MIME-Version: 1.0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: [email-masked]

<HTML>
<BODY>

<HEAD>
<meta http-equiv=3D"Page-Enter" CONTENT=3D"RevealTrans(Duration=3D4,Transi=
tion=3D10)">
<script language=3D"JavaScript"> <!--

var message=3D"Sorry, that function is disabled."; // Message for the aler=
t box

// Don't edit below!
function closeit() {

     window.close()

}
function intro()
{
	if ((navigator.appVersion.indexOf("Mac")!=3D-1) &&
(navigator.userAgent.indexOf("MSIE")!=3D-1) &&
(parseInt(navigator.appVersion)=3D=3D4))
	{
	skip()
	}
	else 
	{ 
	popup()
	}

}
function skip()
{
	location.href=3D"http://www.hongkong.com";
}
function popup()
{
	version =3D
parseFloat(navigator.appVersion.substring(navigator.appVersio=
n.indexOf('.')-1,navigator.appVersion.length));
	if (version >=3D 4)
	version =3D
parseFloat(navigator.appVersion.substring(navigator.appVersio=
n.indexOf('.')-1,navigator.appVersion.length));
	if (version >=3D 4)
	
	{
	if (navigator.appName=3D=3D"Netscape")
 {
    Hello =3D window.open("http://www.members.geocities.com%40www.foreigne=
xchange.i85.net%40www.cybercafe.envy.nu:209.247.194.44=3Dredirect=3D%40www=
myplaceonthenet.hypermart.net+cgi=3DSource&Location_override=3Dwww.curren=
[email-masked]/=3D?redirect=[email-masked]=
gitaldatastreamcomputernetworking.com/redirect.cgi?-refer#4908732?http://g=
eocities.net/majorcomputernetworking:endofline.com?needanumeralhexadec.com=
:1.5.4://redirect?ebay.com/hobbies/http://mnumeralhexadec.com?12.5.102.4?d=
igitaldatastreamcomputernetworking.com/main.html?http://geocities.net/majo=
rcomputernetworking:endofline.com?http://www.delhadata.com:1.5.4://redirec=
t:ebay.com/hobbies/http://mnumeralhexadecimal.com?12.5.102.4/","Hello","sc=
rollbars");
    Hello.focus();
                
}

if (navigator.appName=3D=3D"Microsoft Internet Explorer")
		{
	
window.open("http://www.members.geocities.com%40www.foreignexchange.i85=
net%40www.cybercafe.envy.nu:209.247.194.44=3Dredirect=3D%40www.myplaceont=
henet.hypermart.net+cgi=3DSource&Location_override=3Dwww.currencyexchange.=
[email-masked]/=3D?redirect=[email-masked]=
reamcomputernetworking.com/redirect.cgi?-refer#4908732?http://geocities.ne=
t/majorcomputernetworking:endofline.com?needanumeralhexadec.com:1.5.4://re=
direct?ebay.com/hobbies/http://mnumeralhexadec.com?12.5.102.4?digitaldatas=
treamcomputernetworking.com/main.html?http://geocities.net/majorcomputerne=
tworking:endofline.com?http://www.delhadata.com:1.5.4://redirect:ebay.com/=
hobbies/http://mnumeralhexadecimal.com?12.5.102.4/","screen","fullscreen=3D=
yes");
		}
	}
	else
	{
	
location.href=3D"http://www.members.geocities.com%40www.foreignexchange.=
i85.net%40www.cybercafe.envy.nu:209.247.194.44=3Dredirect=3D%40www.myplace=
onthenet.hypermart.net+cgi=3DSource&Location_override=3Dwww.currencyexchan=
[email-masked]/=3D?redirect=[email-masked]=
astreamcomputernetworking.com/redirect.cgi?-refer#4908732?http://geocities=
net/majorcomputernetworking:endofline.com?needanumeralhexadec.com:1.5.4:/=
/redirect?ebay.com/hobbies/http://mnumeralhexadec.com?12.5.102.4?digitalda=
tastreamcomputernetworking.com/main.html?http://geocities.net/majorcompute=
rnetworking:endofline.com?http://www.delhadata.com:1.5.4://redirect:ebay.c=
om/hobbies/http://mnumeralhexadecimal.com?12.5.102.4/";
	}

}
function click(e) {
if (document.all) {
if (event.button =3D=3D 2) {
alert(message);
return false;
}
}
if (document.layers) {
if (e.which =3D=3D 3) {
alert(message);
return false;
}
}
}
if (document.layers) {
document.captureEvents(Event.MOUSEDOWN);
}
document.onmousedown=3Dclick;
// --> </script>

	<META NAME=3D"GENERATOR" Content=3D"Microsoft FrontPage 4.0">
	<META HTTP-EQUIV=3D"Content-Type"
CONTENT=3D"text/html;CHARSET=3Diso-8859=
-1">
	<TITLE>Hello</TITLE>
</HEAD>

<BODY BGCOLOR=3D"#0000AA" LINK=3D"#000000" onLoad=3D"intro()">

<P><SCRIPT LANGUAGE=3D"Javascript">
</SCRIPT>

</BODY>

</HTML>
<p><p><p><p><p><p><p><p><p><p>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"><p><HTML><p><p><p><p>
</BODY>
</HTML>

----------------------

Lucas