A global spam termination operation launched by CastleCops, the volunteer SIRT Squad is comprised of folks who report spam, investigate spam, and actively work on spam takedown and termination. SIRT is funded by CastleCops. Become a SIRT Squad terminator by reporting spam today!
tembow:
Google Blogspot redirection.
Alleged perpetrator = William Lin, see http://www.siteadvisor.com/sites/anherbal.com
QUOTE
Visits to this fake pharmacy site is provided through the widespread abuse of Google Blogspot redirection. This is a sad
indictment of Google's inability to tackle problems caused by their open framework for creating new blogspot entries.
All you need is a Gmail account, and scammers are offering pre-registered Gmail accounts a million at a time. Direct
quote from the bulkerforum.biz where scammers hang out:
-----
TOPIC: gmail accts, googlepages redirects, blogger redirects
William
Joined: 14 Nov 2007
Posts: 15
Posted: Fri Mar 28, 2008 1:55 pm
Post subject: gmail accts, googlepages redirects, blogger redirects
if you buy in volume please PM me, i have 1~10 mil of gmail accts for selling, 100k googlepags redirect + 100k blogger
redirects.
my ICQ is 407-678-829
-----
William Lin, email address:williamlin89@gmail.com, skype id thealien2006
END QUOTE
Handler Note: 16 May, 2008 09:23:29
tembow:
This is a MAJOR incident. Escalate to Corporate Security.
Each of these 3 samples has a java script obfuscated redirector, and each decodes to
window.top.location.href='http://anherbal.com/';
Suspend every site containing the matching redirection fingerprint:
var {TS}="{TS}";var {TS}=0;var {TS},{TS},{TS}="{HEX}";{TS}='';var
{TS};for({TS}=0;{TS}<{TS}.length;{TS}+=2)
where {TS} is a variable length text string
and {HEX} is a long hexadecimal string comprised of 0-9 A-F
Remove all matching sites. Run continuously as new sites are registered. Check for changes in pattern and adapt.
To monitor for success, check new spammed sites reported at the Geocities URIBL tracker http://rss.uribl.com/hosters/
Further reference: Use the Removal instructions at
http://www.castlecops.com/t221784-SIRT_173979_Blogspot_redirection_with_fingerprint_removal.html
Handler Note: 16 May, 2008 09:26:28
tembow: Generated and sent email spam alert to respective parties.
