Daily spam briefing

 

  • November 17, 2008  The The Casino Spam Terrorist circulate a number of spam comments to advertise the junk website at beneficialcraps.com.  If you see a URL including freehostia.com, be advised not to visit it.  A cyber criminal circulates dozens of spam posts with a junk domain sensibledebt.com.



  • November 16, 2008  The The Casino Spam Terrorist continues to circulate hundreds of spam comments to advertise the junk website at thebleckjack.com.  A webmaster hires a spammer to advertise its fake SEO website at seo-ninja.com.  The webmaster at xboxoffer.com circulates spam posts to advertise its website.

      Today's spam sponsor of the day is the website at onlinepharmacy.vg.


  • November 15, 2008  The The Casino Spam Terrorist group circulates hundreds of spam comments to advertise the junk websites at the21bj.com, onbleckjack.com, oncasino21.com and the21blackjack.com.  The daily number of spam posts outreaches 700 and 800 for the first time.  If you are a webmaster, you are advised to block the following IP address on the ground of circulating spam posts: 195.2.253.70



  • November 14, 2008  If you see hyperlinks to freehostia.com , run away as fast as you can.  Many subdomain websites hosted there are used to redirect Internet users to scam websites.  Also, stay away from lycos.nl, lycos.es and other international Lycos domains.  Nowadays, Lycos free websites means scam websites.



  • November 13, 2008  An organized cyber criminal group uses hundreds of junk websites created at Freehostia (freehostia.com) to send Internet users to AdultFriendFinder.com, Antivirus 2009 (proffesional-scan.com) and others.2008  Beware of a spam-sponsoring junk website at relativedebt.com.



  • November 12, 2008  The spam sponsor of the day is the website at onlinepharmacy.vg .  Abuse at Adobe forums (Netherlands General Discussion) continues with more than 500 spam posts.



  • November 11, 2008  Beware of a junk spam-sponsoring SEO website at onairpr.com.  Abuse on Google Groups and Lycos continue.



  • November 10, 2008  The spam sponsor of the day is the website at shop-1.medsshop-online.com.  Beware of a scam website hosted at spideradd.ws.  "And now I am going to let you STEAL a copy of this Ground-Breaking New System for FREE!"  If this idiot knows it, the world already knows it.  Do you see an office address and a phone number at this website?



  • November 9, 2008  A junk pharmacy website hosted at pipills.com sponsors a large spam campaign.  A Russian game website hosted at the domain of lineage-game.ru also sponsors a large spam campaign.



  • November 8, 2008  More consistent abuse at Google Groups.



  • November 7, 2008  More abuse at Google Groups.



  • November 6, 2008  Abuse at Google Groups and Google Notebook for casino and pharmacy spam continues.  The Casino Spammer continues to make a mess with the domain of thenolimittexasholdempoker.com and others.



  • November 5, 2008  Beware of a junk casino website hosted at the domain of topgiocarepoker.com.



  • November 4, 2008  Beware of a junk casino website at texasholdnpoker.com.  Exploitation at Palmer College of Chiropractic (palmer.edu) continues.





  • Palmer College of Chiropractic affiliate spam Source: MacHouse   Palmer College of Chiropractic affiliate spam Source: palmer.edu  




  • November 3, 2008  A spam terrorist group exploits Yahoo! Groups (health.groups.yahoo.com/groups/) to advertise junk online pharmacy store hosted at itsdrugstore.com.



    A spam terrorist group exploits professor'swebpage at Palmer College of Chiropractic (palmer.edu) to redirect Internet users to a junk online pharmacy store hosted at approved-medication.com.


  • November 2, 2008  Beware of a Russian spam terrorist with the IP address of 87.225.34.100  Exploitation at Ohio State University Fisher College of Business website continues, sending Internet users to a junk online pharmacy store at canadian-drugs-shop.com.



  • November 1, 2008  Beware of OEM software scam ex Russia at oemstore.biz and cheapoemstore.com.  Spam terrorists misrepresent Olsen Twins at members.fotki.com to redirect Internet users to a fake PornTube website.  Spam terrorists exploit Adobe website to redirect Internet users to a junk pharmacy website at abcmedstore.com.



  • October 31, 2008  Abuse on Google Groups continues with affiliate spam ads.



  • October 30, 2008  Be advised to block the following IP addresses to reduce spam posts. 194.8.74.10, 194.8.75.103, 194.8.75.107, 194.8.74.11, 194.8.75.175, 194.8.75.212, 194.8.75.214, 194.8.75.239, 194.8.75.245 and 194.8.75.247.



    An organized spam terrorist group exploits Google Groups in a large scale once again.  Epic Games' website is exploited for pharmacy spam.




  • Google Groups casino spam Source: Spam Database   Google Groups casino spam Source: anolimits texasholdempoker.com   Junk casino website anolimitstexasholdempoker.com anltexasholdem.com Source: Epic Games pharmacy spam




  • October 29, 2008  A notorious casino spammer circulates a ton of spam comments to forward Internet users to junk websites at anotherbingo.com and atexasholdpoker.com.  Be advised to stay away from junk websites at demya.com and betvegasvic.com that are advertised by a notorious Israeli spammer.  Block the IP addresses of 212.235.92.162 and 212.235.92.182, which are used by the Israeli spammer.



  • October 28, 2008  As of October 28 (GMT), 3 most abused free web hosting providers are 101FreeHost.com (101freehost.com), Site Booth (sitebooth.com) and Phreesite.com (phreesite.com).  These 3 free web hosting providers are involved with 30% of spam posts entering our database.



  • October 27, 2008  Search engine marketing company turning into a spam sponsor...  PR Snipe, the website hosted at the domain of prsnipe.com is really a spam sponsor after all.



    PR Snipe spam sponsor prsnipe.com Source: MacHouse   PR Snipe spam sponsor prsnipe.com Source: PR Snipe  




    Spam abuse on Google Groups continues in a large scale.  SONY Pictures discussion boards exploited for pharmacy spam...



  • SONY PICTURES boards pharmacy spam Source: MacHouse   SONY PICTURES boards pharmacy spam Source: SONY Pictures  




  • October 26, 2008  Abuse on Google Groups continues.  Be advised to avoid visiting a spam-sponsoring junk website hosted at the domain of theecrucials.com.  Be aware of a spam-sponsoring junk casino website hosted at the domain of apkoer.com.



  • October 25, 2008  Beware of junk websites hosted at the domains of ebrilo-ebrilo.us, ebrilo-ebrilo.org, ebrilo-legal.us, ebrilo-legal.net, legal-ebrilo.org and possibly more.  Beware of spam-sponsoring casino websites hosted at the domains of anolimitstexasholdempoker.com and anltexasholdem.com.



    Junk casino website anolimitstexasholdempoker.com anltexasholdem.com Source: Spam Database   Junk casino website anolimitstexasholdempoker.com anltexasholdem.com Source: anolimits texasholdempoker.com   Junk casino website anolimitstexasholdempoker.com anltexasholdem.com Source: anltexasholdem.com




    Beware of spam-sponsoring online pharmacy store hosted at the domain of bestdrugsforyou.com.  Why do you have to buy drugs at a junk website run by Indians?



  • bestdrugsforyou.com spam Source: Spam Database   bestdrugsforyou.com spam Source: bestdrugsforyou.com  


  • October 24, 2008  A few weeks ago, GigaZu was the unanimous No.1 free hosting provider being abused and used as a redirection point to spam-sponsoring websites.  Today, GigaZu doesn't even make the top five list. The 3 most abused free hosting providers today are Site Booth (sitebooth.com), Phreesite.com (phreesite.com) and 101FreeHost.com (101freehost.com).  More than 14% of spam comments contain at least one hyperlink to a junk website hosted at any of the three.



    top abused free hosting providers sitebooth.com phreesite.com 101freehost.com Source: sitebooth.com   sitebooth.com phreesite.com 101freehost.com Source: phreesite.com   sitebooth.com phreesite.com 101freehost.com Source: 101freehost.com




    Brides.com falls victim to profile spam, redirecting Internet users to Total Secure 2009 and a fake PornTube website at main-porn-hub.com.




  • Brides.com spam profile PornTube Total Secure Antivirus 2009 Security Center Source: brides.com   Brides.com spam profile PornTube Total Secure Antivirus 2009 Security Center Source: thesystemcheck.com   Brides.com spam profile PornTube Total Secure Antivirus 2009 Security Center Source: main-porn-hub.com


  • October 23, 2008  The insurance spammer uses the domain of (reallycarinsurance.com to advertise junk websites/webpages.  An organized spam terrorist group abuses Google Groups extensively once again.  Beware of spam-sponsoring junk casino websites hosted at the domains of hugeruleta.com and ijugarcasino.com.  Beware of the junk websites hosted at the domains of ebrilojr.com, ebrilojr.net, ebrilojr.name, ebrilojr.org, ebrilojr.us.




  • groups.google.com casino spam Source: groups.google.com   groups.google.com casino spam Source: groups.google.com   groups.google.com insurance spam Source: groups.google.com




  • October 22, 2008  Abuse on free websites mainly hosted at and/or by XLHost continues at a greater scale.  The Washington Times website continues to fall victim to spam profiles.  Spam profile abuse at hi5.com, a popular social networks website (2nd most popular website in Thailand and Portugal, 3rd and 7th most popular in Peru and Mexico, respectively, according to Alexa Traffic Details), continues to become a threat to Internet users.  Beware of junk webpages hosted at jneb1.us, jneb2.us, johnebr.net, johnebr.org and johnebr.com.




  • profile spam The Washington Times Source: www.washingtontimes.com   groups.yahoo.com pharmacy spam Source: groups.yahoo.com   spam profiles hi5.com Source: www.hi5.com


  • October 21, 2008  An organized spam terrorist group continues to circulate hundreds of spam posts daily to forward Internet users to various free websites, many of which are hosted at and/or by XLHost.com of Columbus, Ohio, USA.  Planet Photoshop falls victim to a series of spam profiles, forwarding Internet users to a junk online pharmacy website at approved-medication.com.




  • profile spam Planet Photoshop approved-medication.com Source: www.planetphotoshop.com    




  • October 20, 2008  The insurance spammer uses two domains (inclusivepolicy.com and propercover.com) to advertise junk websites/webpages.  An organized spam terrorist group uses several different IP addresses (194.8.75.239, 194.8.75.245, 194.8.75.214, 194.8.75.212) possibly within the same intranet to circulate a great deal of spam posts.  These IP addresses are traced to Dragonara Alliance Ltd. They mainly exploit free websites (US state name + us + dot com, dot net... like oregonus.net and utahusa.org) created by the same organization.  These US-state free web providers (with a total of a few dozens of them) are all traced to web servers, which are probably hosted at and/or by XLHost.com of Columbus, Ohio, USA.  The insurance spammer circulates junk spam posts with new domains (realinsurer.com and vipinsurer.com).  The IP address he/she uses most frequently is 62.37.112.100.



    Spammer terrorists have stopped exploiting the free host providers at gigazu.com and netfirms.  They now actively exploit a series of free website providers hosted at and/or by XLHost of Columbus, Ohio, USA.


  • October 19, 2008  Watch out for a junk pharmacy website hosted at the domain of http://indian-drugs.co.cc.  This junk pharmacy website is advertised by a spammer whose IP address is 194.165.42.49The insurance spammer continues to make a mess by advertising the website at the domain of ushabitatinsure.com.  One IP address that this spam terrorist uses is 212.58.4.129.  A spammer with the IP address of 195.2.253.70 continues to circulate spam comments containing a fake domain name (an 8-digit-number plus dot com).  Example: 443070.com.  A new domain that the insurance spammer now uses is gothomeinsure.com.


  • October 18, 2008  If you run a blog/forums website, be advertised to block the IP address of 195.2.253.70, which is the origin of a series of junk posts that contains URLs like http://www.821927.com/675969.html.  Beware of a fake Pamela Anderson sex tape website hosted at theadultcorp.com with help of Netlog (netlog.com) and Bebo (www.bebo.com).  The insurance spammer circulates spam posts with the domain of onshebanginsure.com and various IP addresses to make a mess.


  • October 17, 2008  Spam terrorist (the insurance spammer) uses the domain of bestlifereinsure.com, itfamilyinsure.com and mychildinsure.com to circulate dozens of spam posts.  All these junk insurance websites are hosted by Webair Internet Development, Inc (www.webair.com) with its IP address traced to 69.42.75.109.  The website run by Idaho State University Idaho Accelerator Center (www.iac.isu.edu) may have fallen victim to site cracking to redirect Internet users to a pharmacy affiliate website.


  • October 16, 2008  Beware of a scam investment website hosted at the domain of libertyreserveinvest.org.  Why is it a scam? Do you see an address or a phone number on the website?  Getting a 10% return in one day (3,650% a year) would be like finding a stack of money amounting to $10,000 in the middle of the Wall Street in New York.  Be sensible.


  • October 15, 2008  Watch out junk .cn domains (lenderlocations.cn, offersjesus.cn, lowellboots.cn, corollacastle.cn, hummerswimming.cn, screensaversnative.cn, www.sparechamber.cn...) controlled by an organized cyber criminal group.


  • October 14, 2008  Beware of a malware-distributing fake PornTube website hosted http://xxxporntube.iespana.es


  • October 13, 2008  The spam terrorist hired by a junk casino website at http://www.anothercazinos.com takes the center stage for the stage.


  • October 12, 2008  The websites at us.cyworld.com and conforums.com share the daily spam news of the day, terrorizing the blog/forums community.


  • October 11, 2008  A spammer behind the website at mensportal.us uses the subdomain of medicine to redirect Internet users to junk websites.


  • October 10, 2008  A spam terrorist group uses .cn domains to terrorize the blog/forums community.


  • October 09, 2008  A spammer behind the website at mensportal.us uses the subdomain of rxmeds to redirect Internet users to junk websites while other spammers utilize free hosting services at us.cyworld.com, conforums.com, gigazu.com and others to terrorize the Internet community.


  • October 08, 2008  Spam terrorists terrorize the Internet community through various websites (by.ru, yandex.ru, radikal.ru, ...) hosted at the top domains of .cn and ru.  In addition, beware of the website at abbdfsf.info.


  • October 07, 2008  The Russian spam terrorist behind websites with .cn domains (sinuscheapest.cn, exhibitionyamaha.cn, briefcandy.cn, jewellerygenerator.cn, boeinginterior.cn, speechescycle.cn, persianfactory.cn, elliotelizabeth.cn, subscriptionhilton.cn, dorothytrailers.cn, whiteninground.cn...) takes the center stage for the day.


  • October 06, 2008  Spam terrorists use free hosting service at blogsome.com, gigazu.com, fr33webhost.com, sitebooth.com, 100webspace.net, hostevo.com and others to make a mess.


  • October 05, 2008  The Russian spam terrorist behind websites with .cn domains (elliotelizabeth.cn, dorothytrailers.cn, whiteninground.cn, subscriptionhilton.cn, oldsmobilecommunication.cn, briefcandy.cn, jewellerygenerator.cn, tycooncontract.cn, aliciacovers.cn...) ruins the day.  Beware of junk pharmacy websites hosted with subdomains of menandhealth.us.


  • October 04, 2008  The Russian spam terrorist behind websites with .cn domains (locatedisplay.cn, boeinginterior.cn, statementsclock.cn, sinuscheapest.cn, tycooncontract.cn, exhibitionyamaha.cn, eightemployee.cn, greenwoodapril.cn, greenwoodapril.cn...) combined with those with .ru domains (superpornoweb.ru, excellentxxxpics.ru, besteasyporno.ru, best-porno-party.ru, superexcellentxxx.ru, pornofilmsdirect.ru, xxxdirect.ru) ruins the day.  Beware of junk pharmacy websites hosted with subdomains of menandhealth.us.


  • October 03, 2008  Beware of junk websites hosted at free hosting sites such as those of netfirms.com, free-site-host.com, 1stfreehosting.com, sitebooth.com, hostevo.com, bloglines.


  • October 02, 2008  Beware of dozens of junk websites created at netfirms.com.


  • October 01, 2008  Watch out for junk subdomain websites hosted at .cn domains including wcockwa.cn, oiziiha.cn, hemdaqa.cn, hpnqgxa.cn, cdfxtaa.cn.