Re: (no subject)

"Kurt Magnusson" <[email protected]> Mon, 15 Mar 2004 14:12:37 -0300
Newsgroups gmane.ietf.asrg.filtering
Message-ID <[email protected]>
Laird,

>I'll second that. Moreover, there are several ways of writing URLs
>besides the obfuscation methods you noted. One can replace
>www.pornosite.com with the IP address 123.456.789.123, or replace the
>dotted quad with one of an infinite supply of equivalent numbers which
>don't contain dots. One can add any garbage in front of an '@' sign.

There is still a limit before a URL stop working. There is a maximum level 
of camoflage and even if I see a Viagra seller with a lot of money, buying 
noncens domains in bulk, I have seen rather few really advanced camoflaged 
URL's since I started to collect URL's last spring.

.....
>Overall, the devil is in the details.
>
>Now besides just agreeing with your post, I think there's another
>obvious line of attack for spammers. Why set up their own X domains?
>All they really need is a web server which displays the product's,
>shall we say, "attributes" ;-) When they have a network of thousands
>of spam sending zombie machines, then they can also have thousands of
>zombie web servers who can serve the ads. So they don't even need
>their own X domains at all.

Well, then we are deep in trouble, but there is a light in the tunnel ;-). 
How many of the, by Spamhous identified, spammers is capable of this?

What we have seen during the last year, is that most spammers hang on by a 
thread, i.e. do they have the economy to expand to use a multi-system attack 
pattern, buy 10-20 domains for every campaine. Put the economical less 
viable out of business and let the goverments handle the big ones, because 
when the small disapperes, the big ones get more visiable and is easier 
trackable.

I have a process for my collected spams, that takes out the info I want from 
the spams, as the top line sender info (is often a bit more accurate than 
the From:-line), smtp routing lines and for the time being, the URLs. It 
gives a pretty good track of them.

Regards Kurt

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail