A new spamming botnet seems to be on the scenes, distinguishing itself with an extremely high spam volume, a great diversity of email subjects, and an amazingly diverse collection of URLs, mostly hosted on compromised websites.
Four of the top six spam subjects in the past 36 hours came from this new botnet:
• Obama’s policies affecting unemployed
• Change your life in 60 seconds.
• Recently got a job offer?
• Have you ever considered working on the internet?
When we used the Malcovery Spam Data Mine to review the sending IP addresses, we found that these messages had come from more than 23,000 different IP addresses.
Just for the “Obama’s policies” subject, we saw 296 unique URLs advertised just this morning before 8:00 AM! Here are some of the Top URLs for that spam message.
count machine path
38 www.ghostsquad.altervista.org /cellchickengrahamwilliams/
36 rundeecke.bplaced.net /connectiondevicejamesbailey/
35 sungoldcoast.com /assistantelegantjasonedwards/
35 www.coloniasunidas.com /conflictarticlephilipwood/
35 www.cocheenminiatura.altervista.org /arrestautumndanielhill/
34 protetyk.ovh.org /engineercorealanspencer/
33 www.ghostsquad.altervista.org /cellchickencraigdavies/
32 guildrampage.com /besickendwaynemiller/
32 cuorebravo.com /armyeastkevinspencer/
31 www.curiosando.altervista.org /clockconflictjohnking/
31 www.divorcecamp.com /equalatmospheregeoffreycooper/
31 6sejc.com /associatealliedadrianthomas/
When we check for other websites advertised in spam, JUST FOR SPAMMING IP ADDRESSES THAT SENT THE FOUR SUBJECTS ABOVE, and ONLY FOR THE PAST 36 hours, we find that 3,849 distinct URLs were spamvertised a total of 1,217,196 times – only counting the spam in our Spam Data Mine!
A great variety of subject lines were used in addition to the four top ones above. By “theme” there were:
Oprah and Celebrity subjects:
- Oprah Winfrey Reveals That She Has A Sister Named Patricia
- Kourtney & Kim Take NY
- Oprah’s big secret: she has a sister
- Oscar 2011: What To Expect
- Ivanka Trump Has A Baby Bump
- Ellen DeGeneres secret
- Rapid-Fire Fitness: Katy Perry
- Release Your Soul with Pamela Anderson
- Your morning fashion and beauty report: Reese Witherspoon
- Anne Hathaway find out how
Fitness subjects:
- Fitness: Love the 30s!
- Body and Soul women’s weight loss
- Healthy Hollywood
- Miracle Diet or Scam
- Sorry, guys, these fitness classes aren’t for you
- No workout, lose weight
- Miracle or science?
- Get fit
- Women try to balance fitness, safety
- No diet just weight loss
- Workouts for Women
Silly “fwd” and “re” subjects:
- Fwd: private
- Fwd: hey
- Fwd: question
- Fwd: hello
- Re: important
- Re: hey
- Fwd: deal
- Fwd: ?
- Fwd: information
- Fwd: …
- Fwd: business
- Fwd: answer
- Fwd: help
News Subjects:
- Fox investigates claim
- Fox News investigates: “Change your life in 60 seconds!”
- Need some money? Fox News wants to help
- BBC: Online giant Google, worth over 100 billion dollars..
- Unemployed? Fox! Investigates.
- TBS breaking news
Random number weight loss subjects:
- She lost 54 lb in 3 weeks.
- She lost 46 pounds in 3 weeks.
- She lost 53 lbs in 3 weeks.
- (etc.)
And there are still “Work at Home” scam versions, even though the URLs now take you to weight loss websites instead:
Home Maker Dad claims investigated by Fox
Work from home Dad claims investigated by TBS
Work from home Mom claims investigated by CNN USA
Home-Maker Mom claims investigated by Fox!
Work from home Mom claims investigated by Fox News
Work from home Mother claims investigated by BBC
Work at home Mom claims investigated by TBS
Work-from-home Dad claims investigated by CNN
Stay-at-home Mom claims investigated by Yahoo!
Stay home Mother claims investigated by TBS
Home-Maker Dad claims investigated by CNN USA
Homemaker Mom claims investigated by BBC
Stay home Father claims investigated by Fox
Stay home Mom claims investigated by CNN
Stay at home Mother claims investigated by Fox!
Stay home Dad claims investigated by CNN!
Work-at-home Dad claims investigated by CNN
Stay home Mom claims investigated by BBC
Work-at-home Mom claims investigated by Fox!
Work-at-home Mom claims investigated by CNN!
Work-from-home Mom claims investigated by BBC
Work at home Mother claims investigated by BBC USA
Work-at-home Mom claims investigated by BBC USA
Stay at home Mom claims investigated by Fox!
Homemaker Mother claims investigated by CNN
Work at home Mother claims investigated by ITV
Homemaker Father claims investigated by CNN!
Stay at home Mother claims investigated by TBS
Work-at-home Dad claims investigated by Fox
Home Maker Mom claims investigated by ITV
Home Maker Father claims investigated by Fox
Work-at-home Dad claims investigated by BBC USA
Homemaker Mother claims investigated by CNN USA
Work at home Dad claims investigated by Fox News
Work from home Dad claims investigated by BBC USA
Home-Maker Father claims investigated by Fox News
Home-Maker Mother claims investigated by Fox News
What do those pages do when you visit them?
On Monday morning, they sent you to a website with information about a new “Work at Home” program that you could learn about for the low low low price of $100.
But today, they are sending you to a page that proclaims:
Breakthrough Diet Exposed: Celebrity Doctor Uncovers The “Holy Grail of Weight Loss”
This is an on-going campaign that has recently advertised various miracle weight loss products including Raspberry Drops, Green Coffee Bean Extract, and now, “Garcinia Cambogia Featured on TV”
The method for doing this is the use a tiny javascript to set the “parent location href” equal to com-independentvoice.net (or one of many other redirector pages) and passing an “indexer.php?a=225783&c=job” parameter along with the new address. This causes the browser to go to that page and look up the job offer, which displays the weight loss miracle of the day by forwarding the visitor to the path “/diet/GarciniaCambogiaDiet/”
Trying to leave the website generates pop-up messages like these:
Several great clues that these guys are not legitimate including:
The domain is registered by UKRNames.com (Ukrainian Domain Name Registrar of Ill Repute)
The IP address, 201.182.92.166, is hosted at AS52284, Panamaserver.com, claiming to be in Panama.
That IP is also “naturaldietforyou1.com” as well as:
Burnfatandgetflatstomach1.com
Rapidfatlossnatural1.com
Getbestdietsecret1.com
Howtoloseweightquicklyexercises.com
Howtoloseweightfastwithexerciseanddiet.com
Easistnaturalwaytoloseweight.com
Com-work24.net
Finance-reports.com-work24.net
Com-newslocal6.net
Finance-reports.com-newslocal6.net
Com-cbc.net
Finance-reports.com-cbc.net
Finance-reports.com-thestar.net
Com-world-jobnews.net
Com-globejobnews.net
Com-dailylocalnews.net
Finance-reports.com-cnnnewsnet
Com-independentnews.net
Alternativenewsdaily.net
Just picking one of those addresses, com-cnnnews.net was also hosted at:
31.184.192.35
31.184.192.36
81.17.23.40
142.0.72.101
142.0.72.103
176.9.208.121
176.9.208.122
176.9.218.182
185.12.45.102
185.12.45.107
199.91.174.71
199.91.174.72
199.182.168.139
201.182.92.166
More subjects:
Need some money? CNN! wants to help
Fox investigates claim
Fox News investigates: "Change your life in 60 seconds!"
Need some money? Fox News wants to help
BBC: Online giant Google, worth over 100 billion dollars..
Unemployed? Fox! investigates.
TBS breaking news
Lost your job? Fox News wants to help.
CNN! investigates "impossible" claims.
Lost your job? BBC USA wants to help.
CNN! investigates: "Change your life in 60 seconds!"
CNN investigates: "Change your life in 60 seconds!"
Fox!: Online giant Google, worth over 100 billion dollars..
BBC investigates latest claim.
BBC investigates claim
Fox! breaking news
CNN investigates latest claim.
ITV investigates claim
ITV investigates: "Change your life in 60 seconds!"
CNN!: Breaking news!
CNN USA investigates: "Change your life in 60 seconds!"
Unemployed? CNN USA investigates.
Lost your job? BBC wants to know.
Need some money? TBS wants to help
Unemployed? Yahoo! investigates.
Lost your job? CNN USA wants to know.
ITV investigates latest claim.
Yahoo! investigates: "Change your life in 60 seconds!"
TBS: Online giant Google, worth over 100 billion dollars..
Lost your job? CNN wants to know.
Lost your job? TBS wants to help.
CNN!: Online giant Google, worth over 100 billion dollars..
Lost your job? TBS wants to know.
Lost your job? CNN! wants to help.
Lost your job? CNN! wants to know.
Fox!: Breaking news!
Unemployed? Fox News investigates.
Lost your job? ITV wants to know.
Unemployed? TBS investigates.
Need some money? CNN USA wants to help
Lost your job? CNN USA wants to help.
Lost your job? Fox! wants to help.
CNN USA investigates claim
Yahoo! investigates latest claim.
Fox! investigates claim
CNN: Breaking news!
Lost your job? Yahoo! wants to know.
BBC USA investigates "impossible" claims.
Yahoo!: Online giant Google, worth over 100 billion dollars..
Lost your job? Fox! wants to know.
Fox investigates: "Change your life in 60 seconds!"
TBS: Breaking news!
Unemployed? CNN investigates.
Yahoo! breaking news
Need some money? CNN wants to help
Fox! investigates "impossible" claims.
ITV breaking news
Lost your job? Fox News wants to know.
Unemployed? ITV investigates.
BBC USA investigates claim
CNN USA investigates latest claim.
CNN investigates "impossible" claims.
Fox breaking news
Fox: Online giant Google, worth over 100 billion dollars..
Lost your job? Fox wants to know.
ITV: Online giant Google, worth over 100 billion dollars..
Yahoo!: Breaking news!
Need some money? Yahoo! wants to help
BBC USA: Online giant Google, worth over 100 billion dollars..
Lost your job? ITV wants to help.
Need some money? Fox! wants to help
Fox News: Breaking news!
Fox News breaking news
Fox News investigates latest claim.
Yahoo! investigates claim
Fox News: Online giant Google, worth over 100 billion dollars..
Yahoo! investigates "impossible" claims.
CNN USA: Breaking news!
ITV: Breaking news!
ITV investigates "impossible" claims.
BBC USA investigates latest claim.
CNN USA investigates "impossible" claims.
CNN USA breaking news
TBS investigates: "Change your life in 60 seconds!"
BBC USA investigates: "Change your life in 60 seconds!"
Fox investigates latest claim.
BBC USA: Breaking news!
BBC breaking news
Unemployed? BBC investigates.
TBS investigates claim
TBS investigates latest claim.
Need some money? BBC wants to help
BBC: Breaking news!
Need some money? ITV wants to help
BBC USA breaking news
Unemployed? CNN! investigates.
CNN: Online giant Google, worth over 100 billion dollars..
CNN breaking news
Lost your job? CNN wants to help.
Lost your job? BBC USA wants to know.
Lost your job? Fox wants to help.
Need some money? BBC USA wants to help
CNN investigates claim
Fox News investigates claim
Lost your job? BBC wants to help.
Fox! investigates: "Change your life in 60 seconds!"
BBC investigates: "Change your life in 60 seconds!"
Fox: Breaking news!
TBS investigates "impossible" claims.
CNN USA: Online giant Google, worth over 100 billion dollars..
BBC investigates "impossible" claims.
Fox! investigates latest claim.
CNN! investigates latest claim.
Unemployed? Fox investigates.
Fox investigates "impossible" claims.
Lost your job? Yahoo! wants to help.
Need some money? Fox wants to help
CNN! breaking news
Unemployed? BBC USA investigates.
Fox News investigates "impossible" claims.
CNN! investigates claim
Work at home Dad claims investigated
Rapid fire weight loss Salma Hayek
Work-at-home Mom claims investigated
Breaking news for Home Maker Father.
Breaking news for Stay at home Dad.
Breaking news for Home-Maker Father.
Oprah Whinfrey Heads To Paris In Search Of The Perfect Wedding Gown!
Breaking news for Home-Maker Mother.
Breaking news for Work-at-home Mom.
Ellen DeGeneres diet or scam?
Salma Hayek diet or scam?
weight loss Katy Perry
Breaking news for Stay home Dad.
Stay at home Mother claims investigated
Breaking news for Stay home Father.
Stay at home Father claims investigated
Release Your Soul with Anne Hathaway
weight loss Madonna
Breaking news for Work-at-home Dad.
Ellen DeGeneres secret
Rapid-Fire Fitness: Katy Perry
Release Your Soul with Pamela Anderson
Your morning fashion and beauty report: Reese Witherspoon
Anne Hathaway find out how
Work from home Mom claims investigated
Breaking news for Work at home Mom.
Rachel Ray says
Britney Spears Going Harder, More Urgent
Pamela Anderson try to balance fitness, safety
Check out how Natalie Portman did it
Oprah Whinfrey try to balance fitness, safety
Breaking news for Work from home Father.
Ellen DeGeneres weight loss
Breaking news for Homemaker Father.
Homemaker Dad claims investigated