You have the complete href URL. After it comes the title which is of course is
Linked-In for the Liinked-In type messages. If you open the PeskySpammer.7z
file you will see all of the messages saved in the subfolders FalseADP-00, and
FalseLinkedIn-00. They are saved AS-IS with no alteration of the contents. IOW
spamLI-00001.eml is what was saved from email.
It is puzzling what they are doing because like you said, it looks like an incomplete
Blackhole. When I first tested them the PHP script did nothing, but I work from
Linux. In terms of OS detection I was incorrectly (and humorously) identified as
Android the other day. Yesterday (2012-09-21), the PHP bit with a "I won't let you
get away" so I don't think the original PHP did anything for OS detection and in
fact did almost nothing at all. I think they are using them to tune where ever they
are heading or for training. Well, that is what it is unless you buy they are so dum
to send to HASH-USER@securemecca.com without knowing what they are doing.
I don't buy that but maybe I over-estimated them (doubtful). So they have enough
stabbed servers to play around with and don't care that they become known. But ...
1. It still gives the domains that already have injections that need to be patched.
Some of them have already fixed (maybe just partially) the problem. Most have
done nothing and probably don't even know about it. I have some multiples per
same domain but strip the multiples of the exact same URL duplicates down to
just one.
2. It gives me the sending IPs of their bot-nets which I am extracting and are in
these files which I now strip the duplicates down to just one:
http://www.securemecca.com/public/PeskySpammer/X-Originating-IP.txthttp://www.securemecca.com/public/PeskySpammer/X-Numeric.txt(there are files of the same names in each of the sub-folders)
Again, they must have enough they don't care if those Windows machines are
fixed or are even so confident that they know nobody will ever get the bright
idea to find those machines to monitor what is going on.
That is not what I came to comment on. What I came to say is that I have shifted
from CRLF -> LF for most files except the original messages (all email is in CRLF).
If on Windows use NotePad++, psPad, Vim or other editors that handle LF only.
That makes it possible for me to update these two files hot (every few hours):
http://www.securemecca.com/public/PeskySpammer/Z-ADP-URLs.txthttp://www.securemecca.com/public/PeskySpammer/Z-LinkedIn-URLs.txtToday it is Linked-In day. Yesterday it was ADP. The day before that it was
Linked-In again and the day before that it was ADP which was the first day. Before
then for over three months I was getting fake pharmaceuticals. My bet is they are
training hacker wannabees in the Anonymous crowd. But they are being so cheeky
it would not surprise me at all that they turn malicious at some point or finally do
what they pretend to be doing now but are not doing - phish.
Ditto for the fake pharmaceuticals. I almost never saw those domains in my regular
accounts as spam.
Maybe the FBI is doing it - just teasing.
Topic: Spam with potentially malicious links (Read 8172 times)