Another payload slinger

In past spammers have used the cgi from various commerical website to redirect the payload. Today is another example with log.go.com

http ://log.go.com/log?srvc=wczl&goto=http: //idknxn.konpafus.cn

I should note this start over the weekend.

tc

Massive breakdown at interia.pl

A few days ago I note my filter working too well. As a matter of fact, they were working correctly. It appears that interia.pl (a polish website) is the latest. I had registered it early but since it was polish, or at least foreign to me, I paid it no attention. It appears to be just another blogging site that will work well as a shill. The only issue is that I missed most of the subdomains they have been using.

tc

Today, 04-15-2009, I'm adding that I have a list of over 700 sub-domains in less than 24 hours.

tc

found filter bug

Somehow google.com had made it into filter. Which accounted for my 90+% trappings. Temporarily fixed it by removing it.

tc

add livejournal.com

It appears they have captcha on livejournal.com broken. It was a creeping start, but late last night they cranked up the subdomains coming my way. I have not reviewed their system. I'll take a look later.

tc

Filters working too well.

Since late last night my filters are capturing 90% of the spam. It is hard to believe. In any case, I expect them (the spammers) back by Sunday - late.

tc

geocities tumbles & china is abandoned

In what appears to be the biggest break through of the year for spammers, the geocities Captcha is broken. Broken to the extend that they have abandoned chinese domains, and are now using in-place -- geocities.

I have reviewed the Captcha they are using and it appears they could have the repair in hand by the end of the weekend. It is now Friday. The question is: Will they? This is a cat and mouse game, and one has to wonder what Yahoo is up to. (Yahoo being the owner of geocities.)

In any case, it appears the spammers are on the run and will likely try a new tactic within three (3) weeks.

tc

Geocities falls

It appears that the Captcha has been broken at geocities and groups.yahoo as they been flooding my inbox with those URLs.