Spam from your old friend's email

Internet Storm Center reports spammers are using abandoned emails account to send spam to the contact lists in that account.

http://isc.incidents.org/diary.html?storyid=9457

tc

Blind Double Encoding

Hmm...
an HTML document encoded in base64 with a snippet of javascript encode it hexidecimal.

This may not have been the first time I've seen this.

Reverse Captcha

Captcha, should you forget, is "Completely Automated Public Turing test to tell Computers and Humans Apart".

So, Spammers are trying to get the human part, not the "computer" part. Yes many many anti-spam tools will check your text thoroughly, but images - that can be tricky. So as might be expected, spammers from time to time attempt this. The image on the right is such an example.

Notice how nicely the letters (fonts) curve the page with the drug names. Notice the clear instructions on what to do. Notice the bright clear red arrow.

Apparently, asking someone to type versus click is a big deal. Otherwise I might see more of these than once a year. Otherwise this spam deserves little notice. Then again, you never know.

tc

Disposable-Domains?

I received the article below, but it's hardly worth more than "press release" status. It's difficult to say what spammers do with their domains. No one has done an analysis of cost-to-purchase vs. profit-margins. In fact, from my own records 24-48 hours is about the most use spammers can make of open domains. Beyond that it must still be profitable to do this.

Any way here is that article, and it's link:

Spammers Moving To Disposable Domains
http://it.slashdot.org/story/10/07/14/1726241/Spammers-Moving-To-Disposable-Domains

tc

SSN (Social Security Number) Scan

This came across my desk several days ago. Undoubtably some people have fallen for this.

TC

Hello, Did you know that you are entitled to a NEW Social Security Number if someone else has damaged your credit? Call 1 (888) 400 XXXX for FREE details! Get a New Start After ID Theft Get Peace of Mind Fast, Easy and Reliable If you have negative credit because of someone else's actions - you are entitled to a new SSN. Find out details by contacting us today! Call to Get FREE Information 1 (888) 400-XXXX

Javascript trap

This base64 clip should familiar. Spammer or spammers have fallen in love with. Over 200 in a few days.

PHNjcmlwdCB0eXBlPSd0ZXh0L2phdmFzY3JpcHQnPmZ1bmN0aW9uIG5YKCl7fTt6PSJ6IjtuWC5w

Evil Code or evilc0de

This was the payload in spam:

http://194.154.164.103/~ftp@pacenoge.org/wmjbbf.html

I went to:

http://194.154.164.103/~ftp@pacenoge.org

It redirects to:

http://evilc0de.blogspot.com

Includes:

* linux (18)
* mixed (18)
* tutorial (20)
* vulnerabilities (106)