theoldwolf

In the last week my journal has been inundated with spam comments from multiple bot accounts. The spam message is always the same:

Hey This is hard for me because I have never done anything like this.. but I have a huge crush on you. I have never been able to tell you for reasons which you would quickly identify as obvious if you knew who this was. I'm really attracted to you and I think you would be wanting to get with *Read FULL Card Here* http://hornylove.unudulmaz.bork [link obfuscated]

The URL redirects to a porn site being run by citysex.com - the WHOIS info is below.

[Querying whois.verisign-grs.com]
[whois.verisign-grs.com]
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
   Domain Name: CITYSEX.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com

   Name Server: DNS5.TNCSERVERS.NET
   Name Server: DNS6.TNCSERVERS.NET
   Status: clientTransferProhibited
   Updated Date: 08-dec-2011
   Creation Date: 06-jan-1999
   Expiration Date: 06-jan-2013

Today's bot accounts were sundzregmemi, owenoo9, wenawe, and dopentingvil. The bots are regularly reported to LiveJournal, and they seem to be working to delete them quickly, but the flood continues.

Things like this are more an annoyance than anything else - I've reported the abuse to Enom, not really hoping that they can do anything about it, or care to, but I've done all I can.

I just wondered if anyone on my F-list has been plagued by similar messages?



EDIT: Based on the consensus expressed in the commentary below, I changed my comment status to "friends only," which stopped the spam cold. I don't like having to do this, but it saves me the constant cleanup.

In my mailbox this morning:





From: "Pharmacy!Express,#1016849 |the gate i am sorry to,"
Subject: FW: 0rdеr# 1016849 Doing her all night with no breaks is a priceless ability'-
To: austral_neo_progressive@yahoo.com, lilreeree1980@yahoo.com

Au t hori s edirid eeems irle leseri on lin e

http://y.ahoo.it/ywVxqG+?/2012/6/and not very clean none of [link obfuscated]

---

Why would anyone with more than a third-grade education, seeing something like this in their mailbox, be prompted to click on the link?

Dear Russian Criminals, please die in slow agony now.

Recently two email addresses which are linked to businesses that I run have been flooded with Russian pharmacy spam. These addresses have been quiet for years, but apparently the spammers were able to scrape them from somewhere. Interestingly enough, both Comcast and Gmail filter these types of ads on the front end, so I never see them, but these two addresses are linked to Hostgator, which has no such front-end spam filters; however, they are kind enough to flag them as spam based on the following criteria:

[URIs: rxsexpills03.ru] Contains an URL listed in 5 separate blocklists
0.0 HK_NAME_DRUGS From name contains drugs
4.4 KB_RATWARE_OUTLOOK_MID KB_RATWARE_OUTLOOK_MID
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[187.114.172.92 listed in bb.barracudacentral.org]
0.0 HTML_MESSAGE BODY: HTML included in message
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.8 LONGWORDS Long string of long words
0.0 TO_IN_SUBJ To address is in Subject
0.0 T_REMOTE_IMAGE Message contains an external image
0.0 SUBJ_OBFU_PUNCT_FEW Possible punctuation-obfuscated Subject: header





The only thing visible in the email are the above images, but behind the images are long strings of random text:

telling offices mattocks meantime you transmutation shown islands dat unto former miracle passengers swilldown let remedy herbstinking traveller comte arrived recall bow nose short bedlam philosophers between stomach expugnatory wolves fine big quod worth put secured arimaspes prisoners longskirted loads roasted jasper arch platonic wolves convocated estienne occidental dingdong. each farthingale packing nick bowl administer delectable woodporter anchovy news cups gave overthrow cups friar archer gave hereafter reckoning thither [...]

These are designed to thwart Bayesian spam filtering, but for the most part are not effective.

Click on the link, and you are redirected to an ever-changing URL, which AVG promptly blocks:



In other words, not only are they trying to sell you worthless, counterfeit drugs and steal your credit card information, but you're also downloading some sort of virus. AVG outlines the nature of the Pharmacy Spam Exploit; Symantec provides a detailed explanation as to how the Pharmacy Spam operation is structured; and the Spamhaus project provides a list of the world's 10 most prolific spammers. I do not doubt that this latest flood of hqiz is coming from one of these operations.

While stemming the tide may seem like an impossible task, it is somewhat comforting to know that there are people out there working on it, and - as can be seen with the Estonian gang - can have success in shutting down illegal operations.

I'm grateful to providers like Comcast who filter this stuff out before it even gets to my computer, and to those working to combat this plague; also to AVG, which provides protection against countless threats and exploits.

Moral: Practice safe computing, don't click on unknown links in email messages, and make sure you have good anti-virus protection running on your machine.

Beware the "Pimsleur Approach". NOTE: This is not about the "Pimsleur Method," which I happen to endorse - it's about a very shady company that has been contracted as an affiliate marketer for that language acquisition system.

We're talking about rampant spamming, and deceptive marketing practices; I must get several of their spam mails each week, and the complaints board are full of unhappy people.

Look at their website:



Most people sign up for the $9.95 offer without reading the (†) box, which states:

† Pimsleur Rapid Fluency Purchase Program:
One month after you receive your Quick & Simple you'll begin receiving 30 day trial copies of advanced Pimsleur courses in the language you selected. Each course is yours to try for 30 days. You'll receive a new course once every 60 days. For each course you keep we'll bill you in four monthly payments of $64. Remember, there's never an immediate obligation to buy any course because of the 30-day trial period provided with each shipment. And you may cancel future shipments at any time by calling 1-877-802-5283. See Key Details.

The "Key Details" spell out in greater detail your obligation to receive and be charged $256.00 for each additional course they send you, the first 30 days after you place your initial order, and every 60 days thereafter.

Yes, it's all there on the website, but cleverly hidden in small, gray type which most people won't read. The complaints boards are rampant with people being charged recurring fees, difficulty obtaining refunds, rude customer support agents (a hallmark of shady operators who bully unhappy customers), and of course, the unbridled spamming.

Stay far away from this company. I'll be writing more about the actual Pimsleur Method later, but if you want to check it out, just head for your local library. It's a good bet they have several of the beginner courses there for you to check out for free and see if you like the method. If you can't find anything at your branch, go directly to Pimsleur's site - they offer a free lesson with each language so you can see how it works. If you decide you like the method, head over to Amazon where you can usually find the courses at a significant discount.

Just don't have anything to do with this sleazy "Pimsleur Approach" outfit.

This has been a public service announcement from The Old Wolf.

Rather than restricting Unsolicited Commercial Email (UCE), the CAN-SPAM act of 2003 was effectively a blanket permission for spammers to ply their trade. I have noticed that while many email providers, including mine (Comcast) have effective up-front spam filters, a good deal continues to slip through, mostly those consisting of random alphabet-soup headers and an image.

I wish the act included this verbage:

Every unsolicited commercial email must contain the following words in plain text in the body of the message: 'This may be an unsolicited commercial email.'

Harsh penalties would apply to all spammers who fail to include this disclaimer. This would allow spammers to continue to operate (legally, if not morally) under the existing act, and would give consumers the tool needed to filter out such hqiz if they do not wish to receive it. Legitimate vendors could then give their customer base the opportunity to white-list them, or to "opt-in" rather than forcing them to opt out of further mailings.

I hate spam with a passion, and would love to see it eliminated altogether.

Apparently the raft of spam I mentioned in my last post is an attempt by an internet troll to get my goat - he or she or it [subsequently referred to as (s)he-it] has moved from posting annoying drivel on the webcomic forum that I frequent, to individual attacks on various members. This is legally actionable, if only there were a way to identify the wretched loser.

Today I received an email from a clairvoyant that - instead of offending me - gave me a good laugh to start the day. You can see it here. Apparently (s)he-it signed me up for a bunch of different nonsense using sophomoric names. The result was, in this case, excruciatingly funny.

I can only hope that at some point karma pays this pathetic waste of human cytoplasm back for the negativce energy (s)he-it is pumping into the universe.

So here's this in my mailbox:





>

Looked authentic enough, but when I clicked it, I was grateful I hadn't been drinking anything.

( Punchline behind the cut )
Silly spammers...

Every now and then you find a company that has a soul as well as a bottom line. I reported another Nigerian Spammer to the relevant ISP, and today got this back from Outblaze:

Thank you for contacting the outblaze.com abuse desk.

The account you reported is now terminated, along with today's quota of sundry other Nigerian generals, bankers, engineers, attorneys and relatives of dead dictators.

Outblaze is one of the largest providers of webmail services in the world. As a responsible ISP, we hate spam, and we do not allow our network to be abused by spammers.

There is only one thing that we hate more than spammers - 419 (nigerian) scam artists abusing our systems.

I love it. These guys get a huge thumbs up from me.

Over the last month or so, my mailbox has been flooded with spam from two predominant sources. One is the ever-present Canadian Pharmacy, which comes with a bunch of baysian-bypassing garbage, and then a distorted image prompting me to type "www.ba36.com" (or whatever this week's URL is) into my browser. I've seen this sort of garbage before, but for a long while Comcast managed to filter most of it out. I hope they get on top of this one.

The second is more puzzling. The headers will vary (the last one said "$1K Wal-Mart Gift Card"), but the message is usually blank, and consists only of an attached file with the following characteristics:

Named "hello recipient -re-cbhra".
The last letters change regularly.
Always 3K in size, although the actual length varies
Seem to contain random garbage, with the exception of the first characters, which are always (in HEX) "86 d9 a5 6e 87 72"
AVG Free never detects a virus in the attachment.

I've gotten 13 of these since the 10th of August, and it's just the geek in me that wonders what the purpose of these emails is...

As to the spammers... give me about 30 minutes with them, tied to chairs in a deserted hangar somewhere in the middle of Nevada... and a cattle prod.