Spamhuntress

I went by a website today that had a rather nasty payload. After a search on the site that delivered a search result, the page disappeared and a page from amaena.com loaded instead. I’m always very careful when those appear. I close the windows that pop up (I use Firefox with pop up protection) with Alt-F4. Even so, the Winfixer exe file started downloading and was caught by my anti-virus.

The ad was delivered by ad2profit.com

I’ve never in the past experienced a forced download of Winfixer, so I’m wondering what’s up?

Someone added a new page to my wiki today. The name of the page was “Alcohol Intervention”. The content of the page seemed perfectly reasonable. If it had been on topic, it would have passed superficial inspection. But the link to the page was added first, and it was added many link breaks below the content on another page. So… the method was suspect from the get go.

So, here’s someone who made an effort to write a perfectly reasonable page on alcohol addiction, with some credible links at the bottom, mainly to edu and authority sites. Yes, and the spammer’s own domain at the beginning of the article.

But here are some domains associated with this spammer - he’s got links to several at the bottom of the website he spamvertized on my wiki:

druginterventions.net - 205.234.132.159
drugrehabprogram.net - 72.34.32.176
heroin.org - 205.234.146.222
addictiontreatmentcenter.com - 205.234.140.184
floridadrugrehab.com - 205.234.253.132
helpaddicts.com - 75.126.44.60
drugrehabcenter.com - 66.113.130.222
dual-diagnosis.net - 75.126.44.69
addictionsearch.com - 66.225.219.7
detox-center.com - 75.126.44.71

All of these appear to have an 800 number as a payoff. I couldn’t figure out how that worked, until I found evidence that they have a treatment center. I suppose if you called for a free consultation, you might get a hard sell for coming to the treatment center.

This one appears to be owned by someone else, and has a different payoff, but has links to the same network of websites. Incidentally, the website is owned by someone with the same last name as a therapist employed by the same center as the other websites, and a press release about said therapist is pointing to this site:
enhancedhealing.com - 72.41.61.196

But the main bulk of websites either have whois protection, or the whois tends to point to this guy:

(Whois of two domains removed. The owner of the domains says he got scammed by someone he paid to submit to articles directories. He now says this post comes up as the number one result on Google when searching for his name. If you’re curious, his full name is associated with many of these domains anyway, but let’s just assume he’s learned his lesson, and no need to permanently embarass him)
Another domain associated with Gerald, is kgolf.net. It’s been extensively spamvertized, including one January 2006 sighting, here.
It’s a scraper site with Adsense as payoff. The site is currently owned by Gerald, though I can’t say how long he’s owned it without looking at whois history (anyone?).

And the fact that this is probably a real person, is underscored by this press release:

Drug Rehab Launches New Drug and Alcohol Addiction Talk Show

So, who did the spamming? I don’t know. The IP address is from the Phillipines. 61.9.75.136. Also associated with this spam:61.9.75.189 and the username Shamra.

I occasionally find ways to monitor IP space for spam, viruses etc. Here’s one such new way to monitor your IP space:

Project Honeypot’s IP space monitoring

You know, I once notified my neighbor that his machine was compromised because of one of those services. Turns out he had a pirated version of windows (I believe it was windows 2000?). Because of that he didn’t get updates. Let’s just say that machine was doomed. Format c: /s - or something like that.