Smoke, but no gun

Often we here the phrase "smoking gun". In that, we usually mean, "indisputable evidence ". But unless delve deeper into this smoke, the exact meaning is unclear. To be clear, the following HTML fragments provides some clues, but no real evidence.

<a href=3D"http://{oemredir}">
<a href=3D"http://{repredir}">


What may not be clear is that "oemredir" is a shorthand for OEM (Original Equipment Manufacture) RED (redirect), and "repredir" is a shorthand for REP (REPresentative) RED (redirect).

So, yes, the spam is about computer software, and they do use generic text for the spam-ad. A third party is possibley involved sending the spam. The question is the "shorthand" indicates what? Is it important or just a red herring.

Given the odds and frequency of these types of errors, this is significant, but not important.

tc

Always have a spammer plan

Spammer has over the last two (2) days latched on to google docs as a webshill page. Luckily, they use 16 digit numbers to ID the page. The sad part is they are generating thousands of pages.

tc

Sample of IRS.gov phishbait

Taxpayer ID: office-00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):
review tax statement for taxpayer id: office-00000174073547US
Internal Revenue Service

Recent activity - IRS & webshills

For the last several days the spam of note was spoof using the irs.gov in its URL, but of course just another shill. As for the webshills, this morning a wave from a various known free websites (webshills).

tc

Gmail.com Burst

Over the weekend, a drop in volume was noted. Monday a large volume of gmail.com/mailto spams arrived.

I also note for several weeks, ally.com, a new bank with online servies, has been under attack. It appears they have had some success, as these mails continues.

tc

Gmail broken, again.

I should have reported several days ago that the volume of gmail accounts is up significantly. They are using the "job" scam to get personal information.

tc

Some numbers with Yahoo and Google Blogs

blogs sites like those listed below are under heavy attack. The number at the bottom indicates the percentage of spam seen overnight. That's right, nearly 57% is just from those sites. Unsustainable by the spammer and the host sites.

groups.google.com
googlegroups.com
groups.yahoo.com


1674/2939=56.95%