49

I get plenty of scam mail, but the scam mail from predatory journals has a unique habit of using odd substitutes for normal roman letters. For example;

You Are Inᴠіtҽd to Pυbliѕհ Your Original Ɍҽsҽαrch with Us

Other scams don't do this. They just make their appeal in normal characters. For example;

URGENTBUSINESSPROPOSAL

Bad grammar, but no funky letter substitutes. So what are the funky letter substitutes meant to achieve? Is it supposed to evade a spam filter? It seems like it would be really easy to filter for, because no normal person does that. Is it supposed to look more credible? How could that look more credible?

I am fascinated and mystified.

Improve this question
6
  • 70
    Seeing this in small type on the HNQ sidebar, I spent way more time than I should have trying to wipe away the dust speck next to the e in "substitutes".
    – Russell Borogove
    Jun 29, 2021 at 19:29
  • 3
    @RussellBorogove me too
    – KingLogic
    Jun 30, 2021 at 0:36
  • 25
    Probably a good follow-up question for a stack like Information Security would be, "It's been 25 years since the founding of the Mail Abuse Prevention System... why are we still suffering from trivial unicode character substitutions?"
    – Join JBH on Codidact
    Jun 30, 2021 at 2:55
  • 6
    @JBH As it happens, I find that spam filters make too many false positives. I get lots of important emails with very bad English (not always due to second language challenges; some professors are just too cool to care about their spelling, I admire that confidence), and spam filters tend to trip up on them. So the spam filter might have caught either of my examples, had it been turned on.
    – Clumsy cat
    Jun 30, 2021 at 10:50
  • 3
    A mostly technical challenge with tolerable and easy solutions to some, an unsolved problem with only impractical or disrespectful solutions to others. Just imagine the person with the canonically non-latin-script name when told by the spam filter to write their name like a "normal person does".
    – anx
    Jul 1, 2021 at 0:51

3 Answers 3

Reset to default
74

"Unicode-obfuscation" (link to pdf) is a common spam-filter evasion technique that is not unique to publishing scams. Your sample is not representative, so it only appears as if other scams don't use the technique as well. (Anecdotally, I also receive publishing spam that does not use unicode obfuscation, almost every day.)

Improve this answer
8
  • 7
    But why would they use visible substitutes? Inᴠіtҽd can just as easily be Inᴠіtеd(Cyrillic е). Incompetent scammers?
    – Eugene
    Jun 29, 2021 at 19:20
  • 83
    Nope, competent scammers selecting for incompetent targets. Someone who doesn't notice "ҽ" is statistically more likely to fall for the scam.
    – Russell Borogove
    Jun 29, 2021 at 19:28
  • 40
    @Eugene See also survivorship bias: you don't see the ones that are successfully caught by the spam filter.
    – avid
    Jun 29, 2021 at 20:12
  • 13
    @RussellBorogove Not to mention targets who are stupid enough to think "hey, these guys really need somebody to help them with their English, and I could be the person to do that."
    – alephzero
    Jun 29, 2021 at 20:33
  • 5
    @RonJohn so you work when you're tired and/or have poor eyesight which means you are less likely to read any nasty fine print. Not a HUGE bonus for scammers, but its helpful to get someone with the same issues whos maybe that tad less sceptical
    – Hobbamok
    Jun 30, 2021 at 12:28
52

This paper (Arxiv PDF Link) argues that it is indeed done to prevent spam filters.

From their conclusion:

Moreover, we tested this method with a Microsoft Business email. We first sent an email containing a lot of keywords frequently encountered in spam emails, and this email was flagged as spam. Then we sent the same email, with some of the characters replaced by their “visually equivalent” characters from Cyrillic alphabet, and this email was delivered to the Inbox. This suggests that this method can currently bypass existing spam filters.

Improve this answer
3
  • 12
    Actually I guessed this was the answer but didn't have the evidence. Good on both of you. I think it is (or was) used in some scams that obfuscate URLs also. Very dangerous. But maybe the system weeds it out now.
    – Buffy
    Jun 29, 2021 at 11:17
  • 7
    @Buffy you're right: en.wikipedia.org/wiki/IDN_homograph_attack
    – Jeroen
    Jun 29, 2021 at 11:46
  • 2
    I had some really nifty examples from a couple years ago, when it was common to receive threatening emails from someone claiming to have my password, and videos of me watching <topic redacted> on my computer while <action redacted>. (I don't have a camera on my computer.) There was large scale use of visually similar characters in these blackmail messages to avoid my email's spam filters (and it worked). Unfortunately I've deleted the emails...
    – Mike Maxwell
    Jul 1, 2021 at 22:20
1

You already describe the goal: Evade the spam filter.

The question is why this letters, and as brought up in the comments, why not homoglyphs that cannot be distinguished.

There are two answers, which are related to each other.

  • A spam filter may already be trained to detect a homoglyph unicode e in a word that uses ascii letters and may not be trained for the substitutes you're seeing.
  • You are only seeing the successful spam mails, due to the survivorship bias. Spammers are trying all kinds of tricks and the trick in this e-mail is a trick that is not filtered effectively, yet.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .