Untitled

Oct 18, 2026 00:09 UTC11 hours ago48 lines4642 charsExpires: Never

You are absolutely correct. The email file (`00-CONTROL-no-ghost-ink.eml`) contains **invisible "ghost" characters** designed to be seen by spam filters and AI scanners but rendered invisible to human eyes.
Here is the technical breakdown of how they are doing this, specifically pointing out the two distinct methods used in this file:
### 1. The Primary Method: Unicode "Zero-Width" Characters
The most sophisticated part of this trick is hidden inside a `<span>` tag with `style="display: none; max-height: 0; overflow: hidden;"`.
Inside that invisible container, there is a massive block of encoded text like this:
`E2=80=87=CD=8F=E2=80=87=CD=8F...` and `C2=AD=C2=AD...`
When decoded from URL encoding (the `%xx` or `=` format used in emails) to UTF-8, these characters translate to **Zero-Width Joiners**, **Word Joiners**, and **Soft Hyphens**.
* **The Characters:**
* `E2=80=87` decodes to the **Word Joiner** (`U+2060`). It looks like nothing.
* `CD=8F` decodes to a **Zero Width Non-Joiner** or similar control character depending on the specific byte sequence, often used to break word boundaries for bots without affecting layout.
* `C2=AD` decodes to a **Soft Hyphen**.
* **How it works:**
* **Human View:** Email clients (Gmail, Outlook, Apple Mail) recognize these as formatting characters that do not occupy visual space. They render them as "nothing," effectively creating an invisible paragraph of text.
* **Machine View:** Spam filters and AI classifiers read the raw HTML string. They see thousands of these characters inserted between words or at the end of sentences. This artificially inflates the character count, alters the "keyword density" (if keywords were hidden behind them), and creates a unique pattern that spam algorithms often flag as suspicious, *or* in this case, the sender is likely using this to **trick** the filter into thinking the email has more content or different metadata than it actually does.
*Note: In this specific file, the ghost text appears to be "noise." It might be a test to see if the spam filters flag emails with excessive zero-width characters, or it could be an attempt to hide keywords that were stripped out of the visible view but remain in the raw code.*
### 2. The Secondary Method: Hidden Preview Text
There is also a less sophisticated method used in the `<div id="preview-text">` section:
```html
<span style="display: none; max-height: 0; overflow: hidden;">
12pm ET. No signup, just click the link and you're in.
</span>
```
* **What it is:** This contains actual readable English text ("12pm ET...").
* **How it works:** The CSS `display: none` hides it from the user. However, many email clients (like Gmail) scan this specific area to generate the "Preview Text" or "Snippet" that appears next to the subject line in an inbox.
* **The Goal:** By hiding text here, the sender can include extra keywords or a different call-to-action in the preview snippet without cluttering the actual email body. If the human reads the main body, they see one message; if they only glance at the inbox list, they might see a slightly different hook.
### Summary of the Attack Vector
The user's observation is spot on: **"a machine will see it."**
1. **Invisible Noise:** The sender injected thousands of **Zero-Width Joiners (`U+2060`)** and **Soft Hyphens** into an invisible span. This creates a "digital fog" that machines parse but humans ignore.
2. **Keyword Stuffing (Potential):** If the sender had inserted actual keywords *behind* these zero-width characters, they would be invisible to you but visible to a filter scanning for specific terms, potentially helping the email bypass spam filters by "hiding" the trigger words from human eyes while satisfying algorithmic keyword density requirements.
3. **Preview Manipulation:** They also hid readable text in a hidden span to control what appears in the inbox preview line.
**Why do they do this?**
* **To Bypass Spam Filters:** By hiding keywords inside zero-width characters, spammers hope to trick filters that count keyword frequency but don't render the layout perfectly.
* **A/B Testing:** They might be testing how different "noise" levels affect deliverability rates.
* **Metadata Injection:** To pass hidden data to their own analytics systems without alerting the user.
In this specific file, the presence of `00-CONTROL` in the filename suggests this is a **control group** for an experiment. The sender is likely testing if adding this "ghost ink" changes how the email performs (e.g., does it get flagged more? Does it increase open rates?).

You are absolutely correct. The email file (`00-CONTROL-no-ghost-ink.eml`) contains **invisible "ghost" characters** designed to be seen by spam filters and AI scanners but rendered invisible to human eyes.

Here is the technical breakdown of how they are doing this, specifically pointing out the two distinct methods used in this file:

### 1. The Primary Method: Unicode "Zero-Width" Characters
The most sophisticated part of this trick is hidden inside a `<span>` tag with `style="display: none; max-height: 0; overflow: hidden;"`.

Inside that invisible container, there is a massive block of encoded text like this:
`E2=80=87=CD=8F=E2=80=87=CD=8F...` and `C2=AD=C2=AD...`

When decoded from URL encoding (the `%xx` or `=` format used in emails) to UTF-8, these characters translate to **Zero-Width Joiners**, **Word Joiners**, and **Soft Hyphens**.

*   **The Characters:**
    *   `E2=80=87` decodes to the **Word Joiner** (`U+2060`). It looks like nothing.
    *   `CD=8F` decodes to a **Zero Width Non-Joiner** or similar control character depending on the specific byte sequence, often used to break word boundaries for bots without affecting layout.
    *   `C2=AD` decodes to a **Soft Hyphen**.

*   **How it works:**
    *   **Human View:** Email clients (Gmail, Outlook, Apple Mail) recognize these as formatting characters that do not occupy visual space. They render them as "nothing," effectively creating an invisible paragraph of text.
    *   **Machine View:** Spam filters and AI classifiers read the raw HTML string. They see thousands of these characters inserted between words or at the end of sentences. This artificially inflates the character count, alters the "keyword density" (if keywords were hidden behind them), and creates a unique pattern that spam algorithms often flag as suspicious, *or* in this case, the sender is likely using this to **trick** the filter into thinking the email has more content or different metadata than it actually does.

    *Note: In this specific file, the ghost text appears to be "noise." It might be a test to see if the spam filters flag emails with excessive zero-width characters, or it could be an attempt to hide keywords that were stripped out of the visible view but remain in the raw code.*

### 2. The Secondary Method: Hidden Preview Text
There is also a less sophisticated method used in the `<div id="preview-text">` section:

```html
<span style="display: none; max-height: 0; overflow: hidden;">
    12pm ET. No signup, just click the link and you're in.
</span>
```
*   **What it is:** This contains actual readable English text ("12pm ET...").
*   **How it works:** The CSS `display: none` hides it from the user. However, many email clients (like Gmail) scan this specific area to generate the "Preview Text" or "Snippet" that appears next to the subject line in an inbox.
*   **The Goal:** By hiding text here, the sender can include extra keywords or a different call-to-action in the preview snippet without cluttering the actual email body. If the human reads the main body, they see one message; if they only glance at the inbox list, they might see a slightly different hook.

### Summary of the Attack Vector
The user's observation is spot on: **"a machine will see it."**

1.  **Invisible Noise:** The sender injected thousands of **Zero-Width Joiners (`U+2060`)** and **Soft Hyphens** into an invisible span. This creates a "digital fog" that machines parse but humans ignore.
2.  **Keyword Stuffing (Potential):** If the sender had inserted actual keywords *behind* these zero-width characters, they would be invisible to you but visible to a filter scanning for specific terms, potentially helping the email bypass spam filters by "hiding" the trigger words from human eyes while satisfying algorithmic keyword density requirements.
3.  **Preview Manipulation:** They also hid readable text in a hidden span to control what appears in the inbox preview line.

**Why do they do this?**
*   **To Bypass Spam Filters:** By hiding keywords inside zero-width characters, spammers hope to trick filters that count keyword frequency but don't render the layout perfectly.
*   **A/B Testing:** They might be testing how different "noise" levels affect deliverability rates.
*   **Metadata Injection:** To pass hidden data to their own analytics systems without alerting the user.

In this specific file, the presence of `00-CONTROL` in the filename suggests this is a **control group** for an experiment. The sender is likely testing if adding this "ghost ink" changes how the email performs (e.g., does it get flagged more? Does it increase open rates?).