Disposable-Domains?

I received the article below, but it's hardly worth more than "press release" status. It's difficult to say what spammers do with their domains. No one has done an analysis of cost-to-purchase vs. profit-margins. In fact, from my own records 24-48 hours is about the most use spammers can make of open domains. Beyond that it must still be profitable to do this.

Any way here is that article, and it's link:

Spammers Moving To Disposable Domains
http://it.slashdot.org/story/10/07/14/1726241/Spammers-Moving-To-Disposable-Domains

tc

SSN (Social Security Number) Scan

This came across my desk several days ago. Undoubtably some people have fallen for this.

TC

Hello, Did you know that you are entitled to a NEW Social Security Number if someone else has damaged your credit? Call 1 (888) 400 XXXX for FREE details! Get a New Start After ID Theft Get Peace of Mind Fast, Easy and Reliable If you have negative credit because of someone else's actions - you are entitled to a new SSN. Find out details by contacting us today! Call to Get FREE Information 1 (888) 400-XXXX

Javascript trap

This base64 clip should familiar. Spammer or spammers have fallen in love with. Over 200 in a few days.

PHNjcmlwdCB0eXBlPSd0ZXh0L2phdmFzY3JpcHQnPmZ1bmN0aW9uIG5YKCl7fTt6PSJ6IjtuWC5w

Evil Code or evilc0de

This was the payload in spam:

http://194.154.164.103/~ftp@pacenoge.org/wmjbbf.html

I went to:

http://194.154.164.103/~ftp@pacenoge.org

It redirects to:

http://evilc0de.blogspot.com

Includes:

* linux (18)
* mixed (18)
* tutorial (20)
* vulnerabilities (106)

More bogus technical support

The sample below is an example of .... well a trojan horse. Oh this is annoying.

tc

---

Dear use of the xxxxxx.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox xxx@xxxxxx.com settings were changed. In order to apply the new set of settings open this file:

http: / / irai.nerim.net/settings.exe

Best regards, xxxxxx.com Technical Support.

It's a phishing time of the year.

The latest in phishing, likely to infect the unsuspecting, is the follow.

>Dear taxpayer,The Federal income tax is a progressive tax, meaning that the more you earn, the higher your tax rate. Your tax rate depends not just upon your taxable income, but also upon your filing status (single, married filing jointly, etc.).You're in a higher tax bracket because:- your annual income for the last tax year has increased.Please review your annual tax report immediately

Life is marvelous. The link is in .kr (south korea).
naughty, naughty.

tc

Spammers abandon China?

Hardly. It's worth noting that the use of chinese domains has fallen off. Dot ru (.ru) has taken its place. Yipe!

Is this related to google's threat to leave China? We'll see.

tc