A Bit of Metrics

Overnight
1422 (100%) email received
760 (~50%) emails had previously seen spam domain
319 (~20%) had blog domains as spam (mostly yahoo & goggle)
441 (~30%) remained

1 other blog
75 trojan horse (ecard.exe) (NOTE: trojan horse have been few in the last 6 months.)
218 chinese domains
4 russian domains
143 (~10%) remained

78 easily id'd as spam
65 (~4%) remaining

44 tagged as character-set "koi8"
21 (~1.5%) remaining

20 tagged as "other" character-sets, direct email solicitation, dead spam, & phone numbers
1 (0.4%) remaining

1 (0.07%) legit email

What may not be apparent is the 4% labeled as "easily id'd as spam" is the only real email that got through and was readable. That is to say, it was in english and it had a URL to click on. It could be said that one had to read the email to figure out it was spam, but the domain name 99 times out of 100 makes not sense - names like rightswell.com and testfoxonline.com.

tc

What do these domains have in common?

In some phish bait for Chase bank this was the real domains people were sent to. The question is why the thin characters? Why are the being use?

il1hh1l.net
il1ih1i.com
jilf11l.com
jilf11l.net
jilf1f1.com
jilf1fl.com

tc

Volume down, but attack continues

groups.yahoo.com, profiles.yahoo.com & googlegroups.com all continue to be used as shills for the spammers. While the total volume of spam is down, the percentage of these shills remains constant, about one-third (1/3).

tc

Direct recruitment

It has been months since I've a direct link to an EXE file but the last two (2) has seen more than 50 emails. Before this it was just an occasional link to a trojan.

Spammers create legit website.

As spammers go, I am not surprised by much - even when they build a legit looking website. So, I am checking bestweba1.com which brings up a website banner big-information.com. A link on the webpage is labeled "free short url". I click it only to find it leads me to my.bestweba1.com, which was my original link (spammed as my.bestweba1.com/9013d6). The webpage then on my.bestweba1.com is the ever standard facade for target or payloads.

tc

Yahoo attack continues.

Its been over a month but spammer are still using groups.yahoo.com to bounce off of. Lately, 25 to 36+% of incoming spam is this. This spam also marks an increase in volume. To be clear, the additional voume is this one domain.

tc

Yahoo under attack

You should know when a website is having problem, financial or otherwise, the spammers will look for weak spots. Off and on for three (3) weeks they have been using groups.yahoo.com as a redirection point. Sometimes being bold enough to to advertise their wares on the main webpage. Bold indeed.

tc