Bogus Domain URL

Though I'd take a second to show one of these Bogus URLs

The user will see:

https://www.bxs.com/inview/

but the HTML hides the actual URL. Which is:

http://www.bxs.inview.session04380.
certificate-logon2008.serial48992743-0009.csdv5.com/login.htm

What may not be apparent to the causal user is that the actual domain you are sent to is:

csdv5.com

For those making the realization a bit late, they might be subject to all the common Microsoft Internet Explorer Exploit. And while Microsoft does diligently turn out patches to deal with this issue, one can only wonder why they must continue to use tape and bubble gum to engineer their final products.

The Godaddy.com Spam Connection

Godaddy.com claims to be the "the world's No. 1 ICANN-accredited domain name registrar ..". This begs the question, "how can they make money and hardly charge anything for domain registration?" Perhaps being owner of WildWestDomains.com might be a clue, but perhaps just metaphorically.

Just the same, it is worth noting that one of the classic methods of running a website is to run it as a secondary domain (or subdomain). A good example is mail.yahoo.com. Yahoo.com, of course, is the classic web search index website. Mail.yahoo.com is the subdomain (or secondary domain) that specializes in email, via the web.

What may not be obvious to people is that you can use any name as a subdomain. It can even be a group of letters, that are meaningless; such as yip.yahoo.com. To add to this you can even have a subdomain such as, asdf.yahoo.com.

At this point you might wonder why this is even important. Well, as it happens, you can configure the webserver (serving the subdomain) to work with a wildcard.

To make it clear, here is an example:

Say you have xxx.com. This website has a standard "parked" webpage, and advertisement.

Say then that www.xxx.com does the same thing.

Then with the wildcard configuration xxx.xxx.com, yyy.xxx.com and asdf.xxx.com could all do the same thing, and that thing would be complete different from the first two websites.

This may not seem important except that THE SPAM CONNNECTION IS if you park a domain or perhaps use a "free DNS" service, you will never know about this until you try it out.

Why would you care about this?

Most spams that you receive are trying to sell you something. To have you make a purchase they need to have a webserver somewhere that consumates the transaction. On the web, it makes little difference what the name of the domain is, or subdomain for that matter.

Still not clear?

If you've bought something from ebay, you might have noticed that any credit card transaction does not happen on ebay. Usually it will be cash, or "paypal.com".

The point being, one website can show you the catalog, another can do the transaction. In the end, buy-a-rolex.xxx.com is no different than buy-a-rolex.com, except that you might own xxx.com and never know about this. And if you ever plan to use or sell the domain, you might find it has been blacklisted. In which case, your domain might be worthless.

Glossary - What are we talking about

• Payload marker - Every piece of useful spam has a payload. This could be a URL, a domain name, a Stock Symbol, or and email address.
• Payoff domain - the website, or websites, that take your money that was followed as part of a spam
  
• Phishbait - the actual email used to fool the addressee into a nefarious act. In practice, the bait contains legitimate and contrived components to appear legitimate.
  
• Phishing - the act of using unsolicted email for nefarious acts where by the addressee unwillingly or unknowinly participates in another nefarious act
• Spammer - person or entity that engages in the transmission of spam.
• Spam - unsolicted email with the purpose of engaing the recipent with a solicitous transaction or fraudulent activity.
• Added 2008-12-03
• Domain dumping - whereby incoming spam (plural) is using more than one (1) domain per spam (singular) email. In some cases, the domains in question are not seen together again. In some cases, the domains are not seen in the same 48 hour period again. This may be caused by a programming glitch.
  
• IP dumping - from time to time spammers will use IP numbers instead of domain names when sending spam. The appearance is that they might be moving those hosts, therefore any open use of their IP numbers is unimportant.
• Added 2009-03-16
• Idle spam time - that being the time when spammer are apparently not actively sending spam, but letting the bots do the work. (Next added 2010-07-30) Weekends and long holiday weeks are the most common.
  
• Added 2009-04-27
• Free web shill - Any domain that hosts a website for free. In some cases, they will use the provided domains names, but in most cases they will provide a secondary domain name - much like blogs do. For that matter, many blogs are serving the same use for spammers, but we might call them Free blog shills. (In this case we want the old english meaning, as in to cover up the true purpose or meaning. It is a shill because most people do not understand subdomains, hence to the unknowing it appears a primary domain.)
• Added 2009-08-08
• URL wrapping - Using HTML encoded in the message, usually a plain text and an HTML encoded in the same message, the payload is hidden as the HREF. The URL then is made sufficently long such that the URL needs to wrap on a second line, usually by quoted-printable.
• Added 2010-07-30
• Reverse Captcha - When spammers are trying to find the real humans with images, the reverse of finding bots with images.
• Added 2010-09-22
• Double Blind Encoding - an HTML document encoded in base64 with a snippet of javascript encode it hexidecimal. This requires a three (3) step decoding. 1) decode the base64 2) decode the javascript 3) decode the HTML
  
• URL bounce - By in large, the payload sends the user to a URL that bounces them to the payoff. The URL could be a single webpage, or a domain, or script that replies with an HTTP (protocol) "Location", or an HTML link.
  
• JavaScript Jump - This a method or technique of URL Bouncing. The psuedo-javascript code (usually the payload or payoff) goes in the "HEAD" and the javascript is loaded in the "BODY" - usually from a legitimate domain.

aTypical Filter Run

Started with 419 emails
after first-run 284 handck (checks only the most recent additions)
second filter 105 handf (sorts out white, then deletes previous blogspot,ip,foreign language, then moves remaing mail to black or workarea)
17 white list
66 black list
22 neither
third filter 76 rm-do (checks archive of previous domains)
17
42
17
hand filtering 23 harvest-blog, harvest=2E, harvest-http[2,3]
2 (many being bounces)
12 (10 being bounces)
9

All remaining email were hand inspected.

---

2008-04-04

Today incoming mail filter as such:
Start 1134
First pass 844
second 552
final 331

TOP Ten IP by Usage

NOTE: It should be apparent that these IP are for virtual domains. As such, if you go directly to the IP you will get a generic website. I will post the websites, once I figure out how to sort them.

689 IP 216.34.131.135
149 IP 118.129.65.92
119 IP 118.129.65.87
63 IP 211.244.22.240
54 IP 220.113.33.37
40 IP 58.83.8.19
28 IP 210.14.131.10
27 IP 116.122.193.212
13 IP 124.254.2.231
10 IP 218.10.17.229

Summary of First Domain Check.

Some more numbers.

For domain names there are

TOTAL     3663
-----
ALIVE     1543   ~42.2%
DEAD       946   ~25.8%
NO PING   1174   ~32.0%

They resolve to the following numbers

Total number of IPs is       461
Total number ALIVE is        254   ~55.1%
Total number DEAD is          89   ~19.3%
NO PING                      118   ~25.6%

Some Links

http://www.maildr.com/
http://www.unmailable.com/
http://www.unmailed.com/

Check if your IP is listed on a blacklist
http://whatismyipaddress.com/staticpages/index.php/is-my-ip-address-blacklisted


Hey Papa Bear!
http://www.schneier.com/blog/