Spamhuntress

I got one of the most elegant fake comments I’ve seen so far:

I couldn’t understand some parts of this article Coping with joe jobs, but
I guess I just need to check some more resources regarding this, because
it sounds interesting.

The comment is just a set text, with a variable for the title of the post. So they’re scraping that and inserting it into the text of the comment. Presumably they only send one comment per blog.

The domain they’re pushing is this:

vacation.myadventuretraveltours.com

When I loaded that address, I got an ad covering the whole page. Ads by adspopup. Looks like a deal where it’s covering the page, but there’s a close ad X there. But the page itself is typical spam content anyway.

I got two spam e-mails (to two of my main addresses) advertizing pokerloco, a Swedish (they say Costa Rica, but nobody’s fooled by that) owned poker site.

The spam originated from Ukraine and Russia:

81.21.14.3
78.85.26.6

But here’s the wrinkle. The HTML in the file was a bit tricky, and I wasn’t sure the images would load. So I checked, and found that when viewed in an HTML browser/viewer, you’d only see an image flogging a stock (CHINA YOUTV CORP) from one of these sites:

mediapix.ru
imgnation.net
The pokerloco e-mail looks as though it’s an e-mail sent from them to one of their customers, somebody by the name of Anders. And it was written in Swedish. It might have been cribbed from somewhere, then used to confuse spam hunters.