---
title: "Spammers Think Outside the Box to Get Past Your Spam Filter | DuoCircle"
description: "As crazy as it is to believe, spammers would not keep throwing out spam unless they got a return on their investment."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/"
---

Quick Answer

Spammers continually evolve techniques to evade filters because the campaigns are profitable. A current pharma-spam tactic uses hex-encoded IP addresses in URLs (web browsers decode hexadecimal, octal, integer, and DWORD IP formats) to bypass URL blocklists that pattern-match human-readable URLs. The hex link redirects through HTTP 301/302 hops to a payment-processing landing page. Defense against this kind of evolution: filtering that updates frequently (hourly, not weekly), URL evaluation at click time rather than just at delivery, and reputation systems that score newly registered domains and unusual URL encoding higher risk regardless of payload.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fspam-filtering%2Fspammers-think-outside-the-box-to-get-past-your-spam-filter%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Spammers%20Think%20Outside%20the%20Box%20to%20Get%20Past%20Your%20Spam%20Filter&url=undefined%2Fblog%2Fspam-filtering%2Fspammers-think-outside-the-box-to-get-past-your-spam-filter%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fspam-filtering%2Fspammers-think-outside-the-box-to-get-past-your-spam-filter%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fspam-filtering%2Fspammers-think-outside-the-box-to-get-past-your-spam-filter%2F&title=Spammers%20Think%20Outside%20the%20Box%20to%20Get%20Past%20Your%20Spam%20Filter "Share on Reddit") [ ](mailto:?subject=Spammers%20Think%20Outside%20the%20Box%20to%20Get%20Past%20Your%20Spam%20Filter&body=Check out this article: undefined%2Fblog%2Fspam-filtering%2Fspammers-think-outside-the-box-to-get-past-your-spam-filter%2F "Share via Email") 

![Spam Filter](https://media.mailhop.org/duocircle/images/2020/09/dkim-selector-7336.jpg) 

As crazy as it is to believe, _spammers would not keep throwing out spam unless they got a return on their investment_. So, while it might seem unlikely that someone would fall for the **fake pill spam** that has been going around forever, somebody must be falling for it or it would have died out a long time ago.

Of course, **spam filters** have gotten better at detecting these bogus fake pill emails, but that hasn’t seemed to deter really clever spammers. They must get one heck of a return on their spam to be this persistent. _In the war against spam, and the never-ending sequence of move and countermove between spammers and those who don’t want to see spam_, the spammers have started to think outside the box to slip their spam past your spam filter.

[![Spam Filter](https://media.mailhop.org/duocircle/images/2020/09/dmarc-report-7337.jpg)](https://media.mailhop.org/duocircle/images/2020/09/dmarc-report-7337.jpg)

According to an [article](https://www.bleepingcomputer.com/news/security/drug-spammers-start-using-new-technique-to-bypass-spam-filters/) on Bleeping Computer, “Actors behind a pill **scam campaign** are trying a new technique, _betting on unconventional representation of URLs in spam messages to keep them undetected by **email protection** systems and URL blocklists_. The spammers are pushing anything from coronavirus face masks, anti-bacterial UV lamps, pills to improve concentration, for losing weight, for acid reflux, prostate, vertigo, vitiligo, or for correcting vision problems.”

It’s really a clever tactic. Rather than using a standard URL readable by humans, _the spammers use a URL with a bunch of hex code instead which gets translated to an IP address_. “While using the hexadecimal system to encode IP addresses is not a new technique, it is uncommon in pharma spam campaigns. Web browsers accept and decode this format along with others (octal, integer or DWORD). The chain of events after clicking the hex-encoded IP address goes through several intermediate HTTP 301 and HTTP 302 redirects before landing on the final page that integrates legitimate, third-party payment gateways to process transactions via credit card or PayPal. The researchers say that _encoding the IP addresses in emails is an evolution in pharma related spam operations_.”

[![multi-tiered anti-virus filtering](https://media.mailhop.org/duocircle/images/2020/09/spf-record-generator-7338.jpg)](https://media.mailhop.org/duocircle/images/2020/09/spf-record-generator-7338.jpg)

So, what’s the answer if you’re determined to keep this type of spam out of your inbox? Enterprise grade spam filtering like that available from [DuoCircle](/). _Spam filtering from DuoCircle includes commercial anti-spam and multi-tiered anti-virus filtering, with customizable rules updated hourly_. Those **frequent updates** are the key. With the spam landscape changing constantly, you need a spam filter that learns and updates just as fast. And that’s what you get with DuoCircle.

DuoCircle [spam filtering](/email/spam-filtering) is cloud-based, which means _it integrates seamlessly with your on-premises or **hosted email**_. It also means there’s no hardware or software to buy and no maintenance ever. _One low fee gets you unlimited users and unlimited inbound messages_. Try it **risk free for 60 days** and never see a fake pill email again.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Spam Filtering 5m  A Guide On Email Gateway: What It Is And The Importance Of A Secure Email Gateway  Mar 4, 2021 ](/blog/spam-filtering/a-guide-on-email-gateway-what-it-is-and-the-importance-of-a-secure-email-gateway/)[  Spam Filtering 5m  Anti-Spam Filters and How They Work  Jun 19, 2020 ](/blog/spam-filtering/anti-spam-filters-and-how-they-work/)[  Spam Filtering 1m  CERT Advisory Symantec and Norton Critical Vulnerability  Jul 6, 2016 ](/blog/spam-filtering/cert-advisory-symantec-norton-critical-vulnerability/)[  Spam Filtering 3m  Cloud-Based Spam Filtering Protects Your Company  Sep 10, 2018 ](/blog/spam-filtering/cloud-based-spam-filtering-protects-your-company/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Spammers Think Outside the Box to Get Past Your Spam Filter","description":"As crazy as it is to believe, spammers would not keep throwing out spam unless they got a return on their investment.","url":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/","datePublished":"2020-09-23T20:24:37.000Z","dateModified":"2025-05-23T15:31:50.000Z","dateCreated":"2020-09-23T20:24:37.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/"},"articleSection":"spam-filtering","keywords":"","wordCount":460,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/dkim-selector-7336.jpg","caption":"Spam Filter","width":700,"height":439},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Spam Filtering"},{"@type":"ListItem","position":3,"name":"Spammers Think Outside the Box to Get Past Your Spam Filter","item":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Spam Filtering","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Spammers Think Outside the Box to Get Past Your Spam Filter","item":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Spammers Think Outside the Box to Get Past Your Spam Filter","description":"As crazy as it is to believe, spammers would not keep throwing out spam unless they got a return on their investment.","url":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/","datePublished":"2020-09-23T20:24:37.000Z","dateModified":"2025-05-23T15:31:50.000Z","dateCreated":"2020-09-23T20:24:37.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/spam-filtering/spammers-think-outside-the-box-to-get-past-your-spam-filter/"},"articleSection":"spam-filtering","keywords":"","wordCount":460,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/dkim-selector-7336.jpg","caption":"Spam Filter","width":700,"height":439},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```