Physical Address Strangeness in Spam

Ten years ago, Congress passed the "CAN-SPAM Act" (also known as theYou-CAN-SPAM Act, since it defined legal spam and supersedes any stricter state-antispam laws). One of the provisions of the act is that there must be a legitimate physical address in the email. Spammers have long tried different tactics to get around this. In a recent court decision, the District Court in Utah determined, as one part of their opinion, that an email marketer that used remotely-hosted images to show their physical address did not meet this requirement.

As the court noted:

"In a commercial communication through an electronic medium 'clear and conspicuous' is defined as follows: the disclosure must be unavoidable . . . [and][a]ny visual message shall be of a size and shade, with a degree of contrast to the background against which it appears, and shall appear on the screen for a duration and in a location sufficiently noticeable for an ordinary consumer to read and comprehend it."

and

"The question presented to the Court in this case is whether Required Content provided in the emails through a remotely hosted image is clearly and conspicuously displayed. This Court determines that it is not."

So, if remote images are illegal, then spammers ought to put real text addresses in their emails (though the court said nothing about inline images). This is a good thing, as we can use those addresses to filter spam out of our inboxes. Many spammers actually do include a street address already in order to appear to be CAN-SPAM compliant (note that being CAN-SPAM compliant does not preclude it still being spam, only if it's legal or illegal). While legitimate online companies and brick-and-mortar stores will include addresses in a form that's recognizable as an approved Post Office style, many spammers will use a less-recognizable form. Worried about content filters, they try to obfuscate the address in various ways. This obfuscation can be useful in determining the relative spamminess of a message. This post will look at various examples of this.

Some spammers will add their address without obfuscation, and to those, I say thank you, as the person adding to the content filters. Others opt for only slight obfuscation. One example is to replace whitespace with punctuation, like this address:

1158.26th.St.Suite.464Santa.Monica.CA.90403

It's still legible to the human eye, which is what a lot of obfuscation counts on. For a machine though, the possibility of punctuation must be taken into account. Note that there is still a space in this example, so we must also take into account the possibility of spaces in some places and punctuation in others. Besides periods, underscores and dashes are also popular space replacements as in these examples:

6538 Collins_Avenue #95 _Miami Beach, Florida 33141_-
40..Church..St....Pittsburg..Pennsylvania..15223
40_Church_St__Pittsburg_Pennsylvania_15223
489_Wyoming_Ave__Scranton__PA__18503_1408
3000F Danville Blvd. #_151

Note in the last example that there is one space before "Danville", but two spaces before "Blvd.". Extra whitespace is another trick often used. Here's a more extreme example of that:

P O B o x 29 5 02#6 1 1 4 5 | Las Vegas, nv

The human brain can easily remove the extraneous whitespace, compressing the letters into a legitimate address, but a computer doesn't know how to do that as well. Note the box number, "29502", has spaces between some numbers, but not between others. The example also uses a vertical bar symbol instead of a comma before the city, a common, though not Post Office-approved use of punctuation.

The state in this example illustrates another obfuscation tactic, the gratuitous use of lowercase letters. Two-letter state abbreviations should always be uppercase. As another example of gratuitous lowercasing, there is this:

5482 WiIshireBoulevard #239 la, ca 9OO36

Here, "Los Angeles, California" has been shortened to "la, ca". Looking closely at this example, we see another spammer tactic in use, letter substitution. While many people have heard of "Wilshire Boulevard" in Los Angeles, "Wilshire" is not normally spelled with a capital 'I' in place of the lowercase 'l'. Lowercase 'l' is also often replaced with a '1' (one) or '|'(vertical bar). While the following are technically all different, the brain still reads "Wilshire" for all of them in the context of an address.

Wilshire
WiIshire
Wi|shire
Wi1shire

The same spammer has also used the following obfuscations for the same address:

5482 WilshireBI\Ivd. #239 LA, CA 90O36
5482 Wilshire.Blvd #239 la,ca-9OO36

Note both the substitutions in Blvd and the gratuitous back-slash in the first example. The second also has a period after "Wilshire", but not after the abbreviation "Blvd".

Other substitutions are also common. A favorite is to replace a capital 'o' with a zero ('0'), since they are so close in appearance in most fonts, but are totally different when a computer reads them. This is especially popular in"P0ST 0FFICE" in all caps when listing a PO box number. Sometimes's a little more obvious, as in the following example:

P0st 0ffice. B0x803338 #85663
Chicago, IL 6O680

Sometimes, if a spammer thinks his emails aren't going through, they'll further obfuscate the address to ridiculous extremes, even to the point of illegibility, as in the following examples:

427 N. Tatnall
Street Suite4-8?5/.4.8
Wilmington, DE1-9?8/0.1

427 N. Tatnall/StSuite 4-8?5/.4.8
Wilmington, DE1-9?8/0.1

PO Box 2:9.5/0'2#.4_8-5)4>8
Las Vegas, NV8:9-1\2/6

28720RoadsideDr.#198Agoura HIllsCA91301

Note the misspelled state names in the following two examples:

2885 Sanford AveS0uth-West ,
Unit #-25434
Grandville,
Mlchlgan 4 9 4 18

1654.High.Holly.Lane.Raleigh.North.Calorlina.

Another favorite trick is spelling out the street number in any combination of upper or lower case:

Thirteen hundredS. Neil St.--Champaign, IL

It seems that observing increasing levels of obfuscation in addresses can be a fairly reliable indicator in determining the level of spamminess of an email. In an effort to get around being blocked, spammers can give away their desperation. These spammers will resort to a combination of tactics, including both extra whitespace and punctuation, and letter substitution, as in these examples:

2 8 8 5 S a n f or d - A v e
S . W e s t ,# - 2 5 4 3 4
G r a n d v l I Ie,
M I

2 8 8 5 S a n f o r d A v e n u e
S o u t h - We s t -
# - 25 4 3 4
G r a n d v i l le , M I 4 9 4 1 8

2 8 8 5 S A N F 0 R D A v e n u e ( S W ) . # 24 5 3 4

4 5 3 1 0 a k C r e e k C t N 0 r t h E a s t
C e d a r R a p l d s , I 0 w a 5 2 4 1 1

I often see these increasing levels of obfuscation in many spammer addresses, while Amazon and other legitimate businesses don't need to resort to such tactics.

A totally different trick is to present a physical address that isn't really an address. Welcome to the world of virtual offices. There are companies that will provide you with not only a physical address you can use as your own, but even telephone answering and snail-mail forwarding services. All without you ever having to be anywhere near that address! While I suppose there may be legitimate business needs for such a thing (for example, someone who runs a business out of their home), it's definitely something spammers like to abuse. The Sanford Avenue addresses in Grandville, MI above are examples of this. I've recorded ten current or former spammers at this address, ranging from injury lawsuit spammers, coupon spammers, and penny stock spammers, to spammers who spam multiple products and are extremely prolific volume-wise. These virtual office spam addresses are another useful gauge of spamminess. If you're too cheap to pay for the whole virtual office setup, you can also just rent a mailbox at a UPS store or Mailboxes, Etc. type place. Change the box number to "Suite" and it looks like you have an office (unless you Google it. Google maps, especially Street View can be invaluable for checking what an address really is). If you spam from your apartment, changing the apartment number to a "Suite" also looks classier than it is.

So, to sum up, physical addresses are required by CAN-SPAM. If you want to at least appear to be legitimate, you have to include one. Including one, whether it really is yours or not, is another piece that can be used in anti-spam-content filters. This is one place CAN-SPAM can actually be useful. Knowing the tricks spammers use to make them hard to parse by machines, yet still (somewhat) legible to the human eye, you can stay one-step ahead in the spammers race.