A lose is yolk despotism
Results 1 to 9 of 9

Thread: A lose is yolk despotism

  1. #1
    Banned
    Join Date
    Aug 2001
    Location
    Yes
    Posts
    4,424

    A lose is yolk despotism

    OK... that title doesn't make any sense, but that's kind of the point

    For about two months now, we've been getting spam. Not that unusual, but the details are...

    - The spam comes to Comcast e-mail accounts. We have three of them (all set up on different computers - two using Outlook Express, one using Thunderbird as the e-mail client), and all three accounts are getting the spam.

    - The "To:" field is never one of our addresses, and is always different (it's always a @comcast.net addy, though).

    - Each of our addresses gets around 3 to 5 spam messages per day.

    - Titles of spam include:
    "i'll cathy that diagonal banquet"
    "some indonesia a handkerchief"
    "you break a catholic walking"
    "totemic a myocardial but dwelt away"
    "I'll humboldt my countenance"

    Sounds like that surrealist word generator someone here (aspman?) has in his signature... it's obviously the same "thing"...

    - The "From:" field is always different, and also sounds like a random (name) generator:
    "Bethany Silve <P_vbah@cnetco.com>"
    "Buddy Stewart <YHouser2@emtds1.nsc.com>"
    "Buddy Jernigan <QLawanda@merr.com>"
    "Casey Stapleton <EN.zqc@ezy.net>"

    - The message: there seem to be three categories:

    1. A simple link - here's literally what one of those says:
    1,22
    V L X A P V C A e a m r I I L v n b o A A I i a i z G L U t x e a R I M ra
    n c A S
    3,32 3,75
    http://www.ericasometi.com
    2. A picture that doesn't show (because the source is screwed up) with a weird url like

    http://\atexq%2enet%2e<.4w4okap1%2ego2zchoice.info/#terioq.info followed by a bunch of cr*p like the following

    Why you see we wasnt aware sir returned the waiter still apologetically as
    if we can help it I think we had better take a little breathing time In the meanwhilethe intimacy between her and Alec and to watch it with uneasiness And now I must confess
    calculated to overturn the augustuss plans Padgetts plans said the cameraman stroking his face
    with a handsome purse of moneyand a portmanteau and tenderly dismissed upon my expedition
    Mr Neely was anyways particular We can give Mr Nickerson seventy two sir if placid satisfaction Now I have found it "You may not be surprised to hear Annie "
    I had no pleasure in thinking any more of the grave old broad leaved aloe trees which remained
    That aint a sort of man to see sitting behind a coach box is it though said Mabel in my ear
    but the days of my inhabiting there were gone and the old time was past I was heavier at
    Aint you said the waiter Young gentlemen is generally tired of beef and mutton
    Yes she said I think he does himself no good by the habit that has increased upon him since I first came here
    and having an immense four post personnel in it which was quite a little landed saltwater
    you should like it And I am very well persuaded that whatever you do Brittney will always be By the by and letters from Mr Jack Molina said the datum
    of me appeared so deserving of my gratitude and my old love for him overflowed Then I saw as though all the intervening time had been cancelled and I were still standing
    for nobody stood in any awe of me at all the chambermaid being utterly indifferent
    wSOCdJbvlKlTivA39v09y5Ps5NM17XRFYXduHAsp7ARZmpdio9ucPG1sZ1BjgFUU9xd9DYe4sra59xAnSlqYsdm3yg
    easy negligence which I have reason to remember very well became a real presence to me
    3. "Genuine spam" (links to sites selling fake stuff... rolex21.com... that kinda crap)
    The thing here is that the gibberish text is similar to the one in the previous case, but the picture seems to have been scanned in... part of the text looks like it was ripped out of the printer/fax/whatever before it could print properly...


    I haven't really looked into all of it (because it's too much ), but I was just wondering if anyone else has recently seen anything like this... I'd be happy to forward some of the crap for analysis...

  2. #2
    Senior Member
    Join Date
    Sep 2001
    Posts
    118
    Never heard of that before. Perhaps it's a new way they're trying to get past spam filters?
    Got Root?



    This user powered by Linux.

  3. #3
    AO Senior Cow-beller
    Moderator
    zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    Neg,
    I've been receiving this sort of Spam into my spambait accounts for a few years now. I've a few unsubstantiated theories on what is it...
    [list=1][*]"Background noise" junk spam (lol) with the intention of skewing or confusing hueristic spam detection systems[*]"Recon spam" sent to determine if an email account is valid[/list=1]

    When I was still a common user of POP3 based email providers, I was a big fan of MailWasher from Firetrust. I used it to delete spam on the server, and send bounce messages to the origination point of spam. After a few weeks of this, I started seeing these spam messages you describe. I would also get messages of the sort that were supposed to look like legitimate correspondence with a subject or opening sentence like "Why did you bounce my message?"

    I have no doubt that many of the international spam groups subscribe to all the anti-spam products and services, just as users do, so they can get an inside track on how they are being tracked and defeated. I assume these spammers do this as some form of business, so it would be stupid NOT to reconoiter the enemy, as it where.

    I've never heard of an acceptable explanation for this sort of spam. But I can tell you I get a bunch of it.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore

  4. #4
    Senior Member IKnowNot's Avatar
    Join Date
    Jan 2003
    Posts
    792
    I've noticed something wrong with Comcast's SMPT servers for a while now.

    I get “ similar “ addressed emails to me, but not actually addressed to me.

    Example:
    if my email address was nospam_ at_comcast_dot_net,
    I would get emails addressed to nospasm_at_comcast_dot_net

    I receive this from other email servers, but never before on Comcast.

    They used to be good at filtering this stuff out, only giving a person email destined for the actual email account it was sent to. But for the fast few months a lot of the above type garbage gets through.

    Somebody at Comcast is dropping the ball!
    " And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes

  5. #5
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Neg:

    The big bit you quoted is there to mess with Bayesian filters. It ups the word count with normally acceptable words thus reducing the overall spam score of the message.

    We too have started getting messages that have bill@mydomain.com in the To: field, (who doesn't exist), but they are delivered to Joe@mydomain.com, (who does exist and receives the mail). I haven't bothered to look into why because there is a secondary To: field IIRC and have to this point assumed that it was being delivered by this field yet showing the other one. I will probably have to look into this now....

    I am also seeing a lot of spam from names that appear to be generated by a word generator. I saw one yesterday that was from "Redistributes O. Perspiring"..... WTF???? This has become noticable in the last 2 weeks or so and whatever they are doing now it is beating the spam filter more often.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  6. #6
    Senior Member
    Join Date
    Nov 2005
    Posts
    115
    Originally posted here by IKnowNot
    Example:
    if my email address was nospam_ at_comcast_dot_net,
    I would get emails addressed to nospasm_at_comcast_dot_net

    They used to be good at filtering this stuff out, only giving a person email destined for the actual email account it was sent to. But for the fast few months a lot of the above type garbage gets through.
    Is this stuff easily avoidable by using the SPF DNS entries and SPF checking? Wouldn't that be standard to implement on big networks???

    Why arm the alarm on your car if you aren't even going to lock the doors?

    Al

  7. #7
    Banned
    Join Date
    Apr 2003
    Posts
    1,146
    Originally posted here by alleyCat
    Is this stuff easily avoidable by using the SPF DNS entries and SPF checking? Wouldn't that be standard to implement on big networks???

    Why arm the alarm on your car if you aren't even going to lock the doors?

    Al
    Since we aren't seeing the complete email headers, it is hard to speculate on why they are getting through. I see a few similar things, but I mostly get the variations on the Nigerian scam. I do most of my email on Comcast via the browser (when I'm on the laptop), where there is a "report as SPAM" button on the Inbox. Reporting those keeps the number of junk items to a minimum. I've had the same Comcast email for several years now and get minimal cr*p mail.

    I agree with Zencoder, this looks a lot like recon spam. I suspect that responding to the links or replying to complain will generate the "we got a live one" activity on the part of the spammers.

    This last week I looked into a credit union phishing email. The link in the email was from a site in China. The site was an Apache-based system, that wasn't very well secured, as it turns out. I was able to traverse directories and saw the setups for about 50 different scams. Some of the site names looked similar to the second link in Negative's post. The site even showed statistics. Thousands of people from all over the world were actually putting information into this site.

    Since the security of the site was suspect, I suppose it will be hacked or owned soon.

    I'll check it Monday to see if it is still there.

  8. #8
    AO Senior Cow-beller
    Moderator
    zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    Good stuff rapier57. In so far as "recon" spam, I attribute it to a sort of port scan...
    Code:
    Send a spam-probe to all the various minor iterations of some-guy&#64someuri.sometld
    Do the 'bounce' replies all follow an exact format?
    Which are anomylous?
    Probe them.
    Are they still anomylous, do they match the attributes of the previous bounce messages?
    Spam all anomylies and good addresses found.
    That sounds like a lot of work...but thats the beauty of computers.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore

  9. #9
    Banned
    Join Date
    Apr 2003
    Posts
    1,146
    I checked the site today and it is pretty cleaned out. The server is still there, but everything is gone. Since I filed with the feds, I can't say for sure if they had an impact or if someone with better Apache hacking abilities than I killed their site. Fortunately, I still have the printed statistics report.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •