 Pages: 1, 2, 3 : All |
 Author |
 Yahoo Geocities grapples with the gorgon (currently 9,172 views) |
| MarkGiles |
| Posted on: Sunday, May 4th, 2008, 10:27pm |
 |
|
Posts: 363
|
|
|
|
|
|
| MarkGiles |
| Posted on: Monday, May 5th, 2008, 7:09pm |
|
|
Posts: 363
|
Geocities is getting hammered whereas Blogspot abuse is declining.
The abuse rate for the past 5 days is compared here
Rank NS Host Listed Active Percent
1 geocities.com 5845 6267 93.27%
2 blogspot.com 1946 1949 99.85%
3 hotmail.ru 15 15 100.00%
|
|
|
|
 |
Reply: 1 - 32 |
|
|
| MarkGiles |
| Posted on: Saturday, May 10th, 2008, 4:28pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 2 - 32 |
|
|
| MarkGiles |
| Posted on: Friday, May 16th, 2008, 2:47am |
|
|
Posts: 363
|
Five days later, the abuse continues unabated. Google Blogspot has allowed the creeps to creep back in, and Yahoo! Geocities seems to be asleep at the wheel.
From the summary page at http://rss.uribl.com/hosters/
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 3945 5268 74.89%
2 blogspot.com 1154 1155 99.91%
3 hotmail.ru 50 53 94.34%
Many of the targets of the Blogspot redirects have been blocked by URIBL blacklisters, but it is really up to these service providers (Yahoo and Google) to clean up their own mess.
Nobody expects Yahoo and Google to be so closely aligned with criminals. They have terms and conditions on these services, why not enforce them? No company, no matter how large and powerful, is above the law that prohibits being complicit with criminals. Why are their legal departments not cracking down on them?
Yahoo is assisting 800 crimes per day . . . |
|
|
|
|
Reply: 3 - 32 |
|
|
| MarkGiles |
| Posted on: Sunday, May 18th, 2008, 3:11am |
|
|
Posts: 363
|
The redirection abusers are getting fed up with Google shutting them down so quickly, and are moving across to Yahoo! because to date Yahoo! Geocities have proven to be inept at dealing with the problem. You can see the change in numbers in today's listing
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 3619 4163 86.93%
2 blogspot.com 771 772 99.87%
3 hotmail.ru 40 45 88.89% |
|
|
|
|
Reply: 4 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, May 29th, 2008, 7:42pm |
|
|
Posts: 363
|
Yahoo Geocities and even better, Google Blogspot, have seen a reduction in the abuse rate over the past 2 weeks. These figures are well down, and although a lot of work has been done to rein in the abuse, there is still plenty of room for improvement. We even have a newcomer surging up the table - nightmail.ru
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 1720 1811 94.98%
2 nightmail.ru 122 122 100.00%
3 blogspot.com 85 85 100.00%
4 hotmail.ru 27 27 100.00%
|
|
|
|
|
Reply: 5 - 32 |
|
|
| MarkGiles |
| Posted on: Monday, June 9th, 2008, 6:42am |
|
|
Posts: 363
|
|
|
|
|
Reply: 6 - 32 |
|
|
| MarkGiles |
| Posted on: Saturday, June 14th, 2008, 1:17am |
|
|
Posts: 363
|
Abuse rates are down for Google Blogspot. What sites are listed as detected in spam, are generally not responding anyway.
Geocities numbers are down also. Most redirections are going to Canadian Pharmacy site - http://westmeant.com, registered with XIN NET.
See http://siteadvisor.com/sites/westmeant.com
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 876 1406 62.30%
2 blogspot.com 247 247 100.00%
3 nightmail.ru 26 31 83.87% |
|
|
|
|
Reply: 7 - 32 |
|
|
| MarkGiles |
| Posted on: Monday, June 16th, 2008, 8:45pm |
|
|
Posts: 363
|
Abuse rates for free services redirection abuse are amazingly low today:
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 194 229 84.72%
2 blogspot.com 77 78 98.72%
3 notlong.com 1 11 9.09%
4 freehostia.com 1 6 16.67%
5 altervista.org 3 3 100.00%
6 by.ru 2 2 100.00%
7 tripod.com 2 2 100.00%
IS this the end for the spammers, or are they tooling up for the next attack? |
|
|
|
|
Reply: 8 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, July 10th, 2008, 7:25am |
|
|
Posts: 363
|
July 10, 2008
Rank NS Host Listed Active Percent
1 geocities.com 262 288 90.97%
2 nightmail.ru 5 176 2.84%
3 blogspot.com 77 78 98.72%
No change from last month, but a big improvement over previous peaks of abuse. Both Yahoo! and Google could cut these back further. After all, Tripod managed to shut the abuse out completely.
|
|
|
|
|
Reply: 9 - 32 |
|
|
| MarkGiles |
| Posted on: Sunday, July 13th, 2008, 5:04am |
|
|
Posts: 363
|
July 13, 2008 and the numbers are at an all time low
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 geocities.com 108 120 90.00%
2 nightmail.ru 2 115 1.74%
3 blogspot.com 19 19 100.00%
4 by.ru 3 3 100.00% |
|
|
|
|
Reply: 10 - 32 |
|
|
| MarkGiles |
| Posted on: Monday, July 14th, 2008, 5:14am |
|
|
Posts: 363
|
A day is a long time on the Internet. July 14 has an even lower abuse rate (under 75) :
Top Hosters with URIBL Listed subdomains for the last 5 days
Rank NS Host Listed Active Percent
1 nightmail.ru 1 103 0.97%
2 geocities.com 64 73 87.67%
3 altervista.org 3 4 75.00%
4 blogspot.com 4 4 100.00%
5 by.ru 2 2 100.00% |
|
|
|
|
Reply: 11 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, July 17th, 2008, 6:27pm |
|
|
Posts: 363
|
3 days later, July 17, it looks even cleaner, only 50 listed
Rank NS Host Listed Active Percent
1 geocities.com 32 42 76.19%
2 altervista.org 11 15 73.33%
3 blogspot.com 4 4 100.00%
4 pochta.ru 3 3 100.00% |
|
|
|
|
Reply: 12 - 32 |
|
|
| MarkGiles |
| Posted on: Saturday, July 19th, 2008, 6:28pm |
|
|
Posts: 363
|
They are at it again, but they are changing their tune. The gorgons of course. What was previously the tune of Canadian Pharmacy , has now been augmented with the notorious My Canadian Pharmacy,
Geocities is under another abuse attack. This is what it looks like, taking the site list from trusty old spammy tracker, http://rss.uribl.com/hosters
# Domain Date/Time Added
#2 barbarabyomttn.geocities.com Sat, 19 Jul 2008 21:52:59 +0000
#3 helenbfcyyra.geocities.com Sat, 19 Jul 2008 21:52:51 +0000
#4 patriciabqgxmuh.geocities.com Sat, 19 Jul 2008 21:52:43 +0000
#5 patriciataqgwnz.geocities.com Sat, 19 Jul 2008 20:54:15 +0000
#6 karennijceok.geocities.com Sat, 19 Jul 2008 20:51:37 +0000
#7 karenbofzruy.geocities.com Sat, 19 Jul 2008 20:51:15 +0000
#8 elizabethaofiint.geocities.com Sat, 19 Jul 2008 20:50:51 +0000
#9 patriciajlenmbn.geocities.com Sat, 19 Jul 2008 20:49:28 +0000
Each of these redirects to a My Canadian Pharmacy site, (<< click for the criminal evidence) like one of these respectively
fuisdoekwobs.com
distrinct.net
dloymcoijruy.com
deasfroistek.com
ionzicdiswa.com
wadertraide.com
ionzicdiswa.com
deasfroistek.net
And how is the redirection done? With tired old obfuscated java script.
Here's a sample - #2 geocities.com/barbarabyomttn
document.write(String.fromCharCode(50+(10),(116)-1,(102)^(5),(122)^(8),97+(8),111+(1),114+(2),(64)-2,(115)^(7),105+(6),(121)-9,38+(8),(113)-5,(113)-2,(100)-1,95+(2),(115)^(7),(106)-1,(112)-1,(120)-10,56+(5),(32)^(7),(106)-2,113+(3),(117)^(1),109+(3),(60)^(6),(51)-4,38+(9),(111)-9,(124)^(9),(108)-3,(123)^(8),92+(8),105+(6),(103)^(2),99+(8),118+(1),(120)-9,(105)-7,109+(6),39+(7),(98)^(1),(101)^(10),(108)^(1),42+(5),(46)^(9),(63)^(4),(54)^(10),42+(5),(112)^(3),(98)^(1),(120)-6,(104)^(1),(118)^(6),(119)-3,53+(9)));
This decodes into this simple request
<script>top.location='http://fuisdoekwobs.com/';</script>
Here's another sample #3 geocities.com/geocities.com
document.write(String.fromCharCode((66)-6,(114)^(1),(103)^(4),(123)-9,(109)-4,111+(1),(126)^(10),(56)^(6),(123)-7,(107)^(4),(119)-7,41+(5),(111)^(3),(104)^(7),(105)^(10),91+(6),113+(3),(112)-7,(109)^(2),(106)^(4),(58)^(7),(46)-7,(110)-6,(115)^(7),106+(10),(119)^(7),(68)-10,(46)^(1),(55)-8,(103)-3,(114)-9,(117)^(6),(125)^(9),(123)-9,95+(10),102+(8),(107)-8,(126)-10,(47)-1,(117)-7,94+(7),106+(10),(54)-7,(45)-6,51+(8),(63)^(3),(51)-4,(116)^(7),(102)^(5),104+(10),(114)-9,(120)-8,113+(3),(54)^(8)));
which decodes into
<script>top.location='http://distrinct.net/';</script>
Here is another #4 geocities.com/patriciabqgxmuh
document.write(String.fromCharCode(50+(10),(120)-5,(104)-5,(117)^(7),(108)^(5),(121)^(9),(123)-7,57+(5),(114)^(6),104+(7),(122)^(10),45+(1),102+(6),(114)-3,97+(2),(107)-10,(124)^(8),96+(9),(104)^(7),(118)-8,57+(4),(49)-10,(105)-1,(121)-5,(122)-6,(119)^(7),(50)^(8),(41)^(6),45+(2),99+(1),(110)^(2),(112)-1,(122)-1,(105)^(4),(107)^(8),101+(10),100+(5),97+(9),(120)^(10),(118)-1,(113)^(8),(50)-4,(97)^(2),109+(2),107+(2),45+(2),(45)^(10),56+(3),(59)^(7),(46)^(1),(122)^(9),(108)-9,112+(2),104+(1),(113)^(1),(117)^(1),(63)-1));
and this decodes into
<script>top.location='http://dloymcoijruy.com/';</script>
Now, how much intelligence does t take to write a quick piece of robotic code that scans through the sites on Geocities, detecting this pattern of obfuscation? The pattern is easy enough . .
document.write(String.fromCharCode( followed by lots of ( and ) and - and + and , and ^ interspersed with 1, 2 or 3-digit numbers - nothing else until it comes to the terminating ;
Every matching redirection page then gets the treatment it deserves.
No problem for the boffins employed at Yahoo. Or do they employ buffoons? |
|
|
|
|
Reply: 13 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, July 24th, 2008, 8:53pm |
|
|
Posts: 363
|
Here is another break-down of redirection abuse used on Yahoo's Geocities. Starting from the spammed URLs as trapped and reported at the listed subdomains on geocities.com we find these (extracted)
#4 werzmayqpqw.geocities.com Wed, 23 Jul 2008 23:14:02 +0000
#5 sqnkrcfefa.geocities.com Wed, 23 Jul 2008 23:13:56 +0000
#6 eyuobqdzyfys.geocities.com Wed, 23 Jul 2008 03:24:43 +0000
#7 elliottnash66.geocities.com Wed, 23 Jul 2008 02:49:34 +0000
#8 byznffnayh.geocities.com Wed, 23 Jul 2008 02:24:30 +0000
#9 mkhmertrbf.geocities.com Wed, 23 Jul 2008 02:22:36 +0000
These sites redirect to http:coatyes.com, a Canadian Pharmacies illegal fake pharmacy fraud.
http://geocities.com/sqnkrcfefa/
The resident redirection code on that site has
var jjsgdzn='rwyzuxdamjisxvtxlz';var nhzxq=0;var gcnqf, tacti, muiggvt='4E041A081C081041010B07140D17131D515838160F1B261B16081D1E4B4D0F1F1A1C030D5C03160A5B140B020C1E001C16581C0A091C524A595D1D0C1011574546101717000109095C1416175243584E1E091B1A08024A';tacti='';var dtmyw;for( gcnqf=0;gcnqf < muiggvt.length;gcnqf+=2){dtmyw = unescape( '%' + muiggvt.substr( gcnqf,2));tacti += String.fromCharCode( dtmyw.charCodeAt(0) ^ jjsgdzn.charCodeAt(nhzxq++) );if ( nhzxq >= jjsgdzn.length ) nhzxq = 0;}document.write(tacti);
which decodes to | Code |
<script language="JavaScript">window.top.location.href = 'http://coatyes.com';</script>
|
Another example for URL http://geocities.com/werzmayqpqw/
var esut='uaynyebaaweddgizxwrdup';var rwieasf=0;var pqbl, annwslh, cobvt='49121A1C101516410D160B0311060E1F45553805031126020B070911405F161E0B000B10470E17075C081A1314151001174B0A13041145594440010E0C07484B5A131A000D171C164C020E1A425F58481A190A1E02104B';annwslh='';var rnzpxtw;for( pqbl=0;pqbl < cobvt.length;pqbl+=2){rnzpxtw = unescape( '%' + cobvt.substr( pqbl,2));annwslh += String.fromCharCode( rnzpxtw.charCodeAt(0) ^ esut.charCodeAt(rwieasf++) );if ( rwieasf >= esut.length ) rwieasf = 0;}document.write(annwslh);
which decodes to | Code |
<script language="JavaScript">window.top.location.href = 'http://coatyes.com';</script>
|
The decoded result is the same, but the obfuscated Java Script is different. However, it follows a clearly discernible pattern. There is fixed code and there is variable code. It occurs between a starter containing
| Code | <script language="JavaScript" type="text/javascript"> |
and a trailer containing
One way to deal with this problem - you could remove all of the white spaces, and reduce all of the variable alphabetic and numeric strings to an * for example. You would get | Code |
for*='*';var*=0;var*,*,*='*';*='';var*;for(*=0;*<*.length;*+=*){*=unescape('%'+*.substr(*,*));*+=String.fromCharCode(*.charCodeAt(*)^*.charCodeAt*++));if(*>=*.length)*=*;}document.write(*);
|
This pattern will be the same for all of these obfuscated scripts. It would be so easy to scan through all the pages on Geocities, and every page that matches the pattern is placed in "not available" status. By running an automated pattern matching routine continuously, all of these types of redirection pages can be removed as soon as they are loaded.
|
|
|
|
|
Reply: 14 - 32 |
|
|
| MarkGiles |
| Posted on: Saturday, August 16th, 2008, 8:18pm |
|
|
Posts: 363
|
August 16
Reviewing the success of Google Blogspot and Yahoo! Geocities in the battle against the redirector gorgon -
Rank NS Host Listed Active Percent
1 narod.ru 5 86 5.81%
2 blogspot.com 36 41 87.80% (All disabled)
3 geocities.com 11 36 30.56% (Half disabled)
4 bay.livefilestore.com 27 27 100.00%
This represents a major improvement by the big two. Google and Yahoo! redirections are no longer subject to the rampant abuse of the past. |
|
|
|
|
Reply: 15 - 32 |
|
|
| MarkGiles |
| Posted on: Wednesday, April 8th, 2009, 7:24pm |
|
|
Posts: 363
|
This one is back, as seen at http://rss.uribl.com/hosters/
| Code |
Rank NS Host Listed Active Percent
1 geocities.com 7714 7833 98.48%
2 blogspot.com 6900 6975 98.92%
3 spaces.live.com 1141 1144 99.74%
4 pochta.ru 695 1006 69.09% |
7,714 redirection sites on Yahoo! Geocities. That makes a juicy target.
That's worth a visit to http://help.yahoo.com/l/us/yahoo/geocities/abuse.html to fill in the form, referring them to the list of sites to remove for breach of terms of service. Give them the link at http://rss.uribl.com/hosters/geocities_com.html and tell them to remove the whole darn lot. And tell them to patch their site creation with a decent CAPTCHA that defeats the CAPTCHA breaker at decapture.com.
Redirection targets include illegal gambling casinos( Star Winners), fraudulent pharmacies (Canadian Healthcare),(Dr.MaXman), (Acai Power Slim) and even software piracy http://geocities.com/thompsonxutezy91/ > (Euro Software) |
|
|
|
|
Reply: 16 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, April 9th, 2009, 9:06pm |
|
|
Posts: 363
|
It has got worse. A whole lot worse. Yesterday there were 7,714 violations of Yahoo Geocities terms of service by criminal abuse of the free hosting to redirect to ilicit spammed sites. Today, it stands at 99.31% - 12,453 of 12,539 active subdomains listed in last 5 days on geocities.com.. [ http://rss.uribl.com/hosters/geocities_com.html ]
You can compare the worst abused free hosting services at http://rss.uribl.com/hosters/
Rank NS Host Listed Active Percent
1 geocities.com 12467 12553 99.31%
2 blogspot.com 5608 5700 98.39%
3 pochta.ru 624 1011 61.72%
4 spaces.live.com 836 837 99.88%
5 livejournal.com 323 325 99.38%
6 narod.ru 39 42 92.86% |
|
|
|
|
Reply: 17 - 32 |
|
|
| MarkGiles |
| Posted on: Wednesday, April 15th, 2009, 10:58pm |
|
|
Posts: 363
|
Could it get any worse still?
http://rss.uribl.com/hosters/ shows how Yahoo Geocities is failing to cope with abuse of its free hosting service.
Rank NS Host Listed Active Percent
1 geocities.com 17984 18707 96.14%
2 interia.pl 351 531 66.10%
3 livejournal.com 478 487 98.15%
4 pochta.ru 380 380 100.00%
5 eu.interia.pl 233 373 62.47%
6 narod.ru 151 184 82.07%
7 w.interia.pl 85 109 77.98%
McAfee Site Advisor reviews of over 22,000 redirector pages tell the story.
* http://www.siteadvisor.com/sites/geocities.com/watsonvabyqu88
Quoted Text A new Geocities host site is spammed to unsuspecting victims twice every minute of the day. Spam honey-pots have found more than 18,800 redirection sites on Yahoo's Geocities in the past 5 days. Why should Yahoo expect to maintain any hope of a good reputation in the marketplace, and retain share value for its stockholders? Geocities, Yahoo's free hosting service, is being abused by cyber-criminals who create spammed hosting sites, breaking the Geocities terms and conditions. You can convince Yahoo that this is not a good idea. Go to http://help.yahoo.com/l/us/yahoo/geocities/abuse.html and fill in their report form. Show them what sites to suspend for breaches of their Terms of Service - referring them to http://rss.uribl.com/hosters/geocities_com.html and insist that they erase all the redirections to criminal sites. Also, demand that they make the creation of new sites more restrictive so it will not be outwitted by the CAPTCHA workarounds that criminals commonly use. Redirection targets include illegal gambling casinos (Star Winners), fraudulent pharmacies (Canadian Healthcare,ED Pill Store, Dr.MaXman, Acai Power Slim) and even software piracy http://geocities.com/thompsonxutezy91/ >> Euro Software. The criminal evidence is found at http://spamtrackers.eu/wiki. Yahoo must take immediate action to stop their continued support for crime. |
|
|
|
|
|
Reply: 18 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, May 14th, 2009, 2:45am |
|
|
Posts: 363
|
Geocities is back in the abuse bucket, grappling with the gorgon again:
This is the site review for http://sweetextra.com - a redirection target from geocities.com abuse over the past week.
Quoted Text Yahoo supports crime.Spam trap reports at http://rss.uribl.com/hosters/geocities_com.html display 60.06% - 645 of 1074 active subdomains listed in last 5 days on geocities.com. Why does Yahoo support these criminals? Visit http://help.yahoo.com/l/us/yahoo/geocities/abuse.html and fill the form. Show them what sites to suspend for breaches of their Terms of Service. Refer them to http://rss.uribl.com/hosters/geocities_com.html and insist on the removal of the redirections to criminal sites. Also, demand that they make the creation of new sites more restrictive so it will not be beaten by the CAPTCHA workaround at decapture.com. Redirection targets include Canadian Pharmacy on site sweetextra.com, illegal gambling casinos (Star Winners), other fraudulent pharmacies (Canadian Healthcare,ED Pill Store, Dr.MaXman, Acai Power Slim) and even software piracy http://geocities.com/thompsonxutezy91/ >> Euro Software. The criminal evidence is found at http://spamtrackers.eu/wiki. Yahoo needs to act promptly to remove their assistance to these criminals. What registrars sponsor the fraud Canadian Pharmacy? Domain Name: SWEETEXTRA.COM Registrar: XIN NET TECHNOLOGY CORPORATION (China) Whois Server: whois.paycenter.com.cn Referral URL: http://www.xinnet.com Name Server: NS1.SWELLENJOY.COM Name Server: NS2.SWELLENJOY.COM Name Server: NS3.SHYAWARD.COM Name Server: NS4.SHYAWARD.COM Status: ok Updated Date: 06-may-2009 Creation Date: 04-may-2009 And the two name servers that resolve the access? . Domain Name: SWELLENJOY.COM . Registrar: ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (Russia). Domain Name: SHYAWARD.COM . Registrar: XIN NET TECHNOLOGY CORPORATION (China)And they call it a "Canadian" Pharmacy, huh! How is it that these registrars are accredited by ICANN? |
Not surprisingly, Yahoo is throwing in the towel. Spammers 1 - Yahoo 0
Quoted Text Important Announcement
After careful consideration, Yahoo! has decided to close GeoCities later this year.
You can continue enjoying your GeoCities service until then — we just wanted you to let you know about the closure as soon as possible. We'll share more details this summer. For now, please visit the help center for more information. |
It looks like Yahoo Geocities has decided they can't beat the spammers off, and is retiring (dis)gracefully before Yahoo's reputation drops any lower than it already is. How sad. |
|
|
|
|
Reply: 19 - 32 |
|
|
| MarkGiles |
| Posted on: Tuesday, August 4th, 2009, 5:26pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 20 - 32 |
|
|
| MarkGiles |
| Posted on: Wednesday, August 5th, 2009, 5:04pm |
|
|
Posts: 363
|
Yahoo has taken the bull by the horns and shaken its head from side to side. The scammy bull is getting dizzy, but it is not down yet. To try to evade the finger-print detection methods that Yahoo are using to smell out the scammy pages, the wily bull has changed tack -
Now it is slotting its horns into the profiles page for the Yahoo Blog free service:
http://profiles.yahoo.com/blog.....nP4N2ViG_F2kIBLT2h.w
which redirects to the Acai Power Slim fraud, you know, the one that tricks its victims into providing their credit card for a free trial offer, but omits to provide any means to cancel the high monthly payments forever after.
This is covered in detail at http://spamtrackers.eu/wiki/index.php/Acai_Power_Slim
Of course, giving your credit card to criminals is not anything a normal person would do, unless you are having a momentary brain dysfunction.
I presume that the whizz kids at Yahoo are capable of pouncing on this one too, and are ready to put the bull onto the rotisserie. |
|
|
|
|
Reply: 21 - 32 |
|
|
| MarkGiles |
| Posted on: Wednesday, August 5th, 2009, 5:55pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 22 - 32 |
|
|
| MarkGiles |
| Posted on: Sunday, August 9th, 2009, 10:16pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 23 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, August 27th, 2009, 12:31am |
|
|
Posts: 363
|
|
|
|
|
Reply: 24 - 32 |
|
|
| MarkGiles |
| Posted on: Sunday, August 30th, 2009, 1:45am |
|
|
Posts: 363
|
|
|
|
|
Reply: 25 - 32 |
|
|
| MarkGiles |
| Posted on: Friday, September 4th, 2009, 12:24am |
|
|
Posts: 363
|
http://www.siteadvisor.com/sites/groups.yahoo.com/group/niligefylokyvo
Quoted Text Can Carol Bartz really kick butt? ("At her previous post atop Autodesk, she remade the business, sharply boosting margins, earnings and revenues and increasing the share price nearly tenfold.") See http://bravisskos.com/topic/?id=19 where AutoCAD 2010 32 and 64 bit, Retail Price: $3995.95 is being fenced at $189.95 and AutoCAD Civil 3D 2010 32 and 64 bit, Retail Price: $8999.95 is fenced at $199.95. Has anyone at Yahoo told her about how they are sponsoring software piracy of Autodesk products? Yahoo staff members might want to sweep this under the carpet - fat chance. Yahoo Groups Redirection Abuse Status, September 2, 2009 - refer http://www.spamtrackers.eu/wiki/index.php/Yahoo_GroupsRedirection Status. See http://spamtrackers.eu/wiki which has the criminal evidence prepared for law enforcement. * Euro Software illegal software piracy grastobins.com shacestours.com bravisskos.com Yahoo's support for redirections to criminal web sites is well known - * http://www.allspammedup.com/2009/07/major-spam-attack-hitting-free-web-services/* http://web.tebweb.com:8080/cgi.....09958025,s=20,#num20* http://ikillspammers.blogspot.com/2009/07/yahoo-groups-wake-up.htmlIf I was at Yahoo and responsible for this mess, I'd be investing in a cast iron neck brace. I wouldn't be answering press inquiries, for fear of a "drop-kick to f*cking Mars" to quote Carol. No need to leak to the press, it's all over the net, Carol! Try drop-kicking the spamming scammer butts, and clean up your own back yard in the process. Old friends at Autodesk will not be amused with these antics, eh. |
|
|
|
|
|
Reply: 26 - 32 |
|
|
| MarkGiles |
| Posted on: Friday, September 4th, 2009, 1:10am |
|
|
Posts: 363
|
http://www.siteadvisor.com/sites/groups.yahoo.com/group/niligefylokyvo
Quoted Text Can Carol Bartz really kick butt? ("At her previous post atop Autodesk, she remade the business, sharply boosting margins, earnings and revenues and increasing the share price nearly tenfold.") See http://bravisskos.com/topic/?id=19 where AutoCAD 2010 32 and 64 bit, Retail Price: $3995.95 is being fenced at $189.95 and AutoCAD Civil 3D 2010 32 and 64 bit, Retail Price: $8999.95 is fenced at $199.95. Has anyone at Yahoo told her about how they are sponsoring software piracy of Autodesk products? Yahoo staff members might want to sweep this under the carpet - fat chance. Yahoo Groups Redirection Abuse Status, September 2, 2009 - refer http://www.spamtrackers.eu/wiki/index.php/Yahoo_GroupsRedirection Status. See http://spamtrackers.eu/wiki which has the criminal evidence prepared for law enforcement. * Euro Software illegal software piracy grastobins.com shacestours.com bravisskos.com Yahoo's support for redirections to criminal web sites is well known - * http://www.allspammedup.com/2009/07/major-spam-attack-hitting-free-web-services/* http://web.tebweb.com:8080/cgi.....09958025,s=20,#num20* http://ikillspammers.blogspot.com/2009/07/yahoo-groups-wake-up.htmlIf I was at Yahoo and responsible for this mess, I'd be investing in a cast iron neck brace. I wouldn't be answering press inquiries, for fear of a "drop-kick to f*cking Mars" to quote Carol. No need to leak to the press, it's all over the net, Carol! Try drop-kicking the spamming scammer butts, and clean up your own back yard in the process. Old friends at Autodesk will not be amused with these antics, eh. |
|
|
|
|
|
Reply: 27 - 32 |
|
|
| MarkGiles |
| Posted on: Sunday, September 6th, 2009, 3:25pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 28 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, September 10th, 2009, 9:44pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 29 - 32 |
|
|
| MarkGiles |
| Posted on: Thursday, September 24th, 2009, 12:20am |
|
|
Posts: 363
|
Over the past week the number of abuses has been dwindling
98 - 14 Sept
121 - 15 Sept
50 - 16 Sept
45 - 17 Sept
86 - 18 Sept
34 - 19 Sept
178 - 20 Sept
15 - 21 Sept
126 - 22 Sept
30 - 23 Sept
17 - 24 Sept
Compare that with figures earlier this month
256 - 4 Sept
372 - 5 Sept
285 - 6 Sept
Maybe, just maybe, we are seeing some action out of the beleaguered team at Yahoo.
Sponsoring redirections to Microsoft and Autodesk software piracy sites ( http://krapobravs.com/ and http://grastobins.com/ ) is not a good look for CEO Carol Bartz, given her connections with both those companies. |
|
|
|
|
Reply: 30 - 32 |
|
|
| MarkGiles |
| Posted on: Tuesday, October 6th, 2009, 5:13pm |
|
|
Posts: 363
|
Just when we thought we were safe, the Geocities abuse raises its ugly head again.
The spam-trap report at http://rss.uribl.com/hosters/geocities_com.html shows
99.06% - 211 of 213 active subdomains listed in last 5 days on geocities.com.
Only two sites out of 213 were NOT detected in spam!
And where do all of these new spammed Geocities URLs go?
http://www.crossfull.com/index.php = Canadian Pharmacy scam
or else it tries to download a file called "smartdownload.exe" via this code
<meta http-equiv="Refresh" content="1; URL=http://www.goldvipclub.com/smartdownload.asp?affid=19439">
This download has been checked for viruses with this result
File SmartDownload.exe received on 2009.10.06 22:07:57 (UTC)
Result: 11/41 (26.83%)
Loading server information...
Antivirus Version Last Update Result
a-squared 4.5.0.41 2009.10.06 -
AhnLab-V3 5.0.0.2 2009.10.06 -
AntiVir 7.9.1.33 2009.10.06 GAME/Casino.Gen
Antiy-AVL 2.0.3.7 2009.10.05 -
Authentium 5.1.2.4 2009.10.06 W32/Casino.C.gen!Eldorado
Avast 4.8.1351.0 2009.10.06 -
AVG 8.5.0.420 2009.10.04 -
BitDefender 7.2 2009.10.06 -
CAT-QuickHeal 10.00 2009.10.06 Trojan.Agent.ATV
ClamAV 0.94.1 2009.10.05 -
Comodo 2524 2009.10.06 -
DrWeb 5.0.0.12182 2009.10.06 -
eSafe 7.0.17.0 2009.10.06 Suspicious File
eTrust-Vet 35.1.7054 2009.10.06 Win32/CasOnline!Adware
F-Prot 4.5.1.85 2009.10.06 W32/Casino.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.10.06 -
Fortinet 3.120.0.0 2009.10.06 -
GData 19 2009.10.06 -
Ikarus T3.1.1.72.0 2009.10.06 -
Jiangmin 11.0.800 2009.10.06 -
K7AntiVirus 7.10.863 2009.10.06 -
Kaspersky 7.0.0.125 2009.10.06 -
McAfee 5763 2009.10.06 potentially unwanted program CasOnline
McAfee+Artemis 5763 2009.10.06 potentially unwanted program CasOnline
McAfee-GW-Edition 6.8.5 2009.10.06 Heuristic.LooksLike.Game.Casino.I
Microsoft 1.5101 2009.10.06 -
NOD32 4485 2009.10.06 a variant of Win32/CasOnline
Norman 6.01.09 2009.10.06 -
nProtect 2009.1.8.0 2009.10.06 -
Panda 10.0.2.2 2009.10.06 -
PCTools 4.4.2.0 2009.10.06 -
Prevx 3.0 2009.10.07 Medium Risk Malware
Rising 21.49.22.00 2009.09.30 -
Sophos 4.45.0 2009.10.06 -
Sunbelt 3.2.1858.2 2009.10.06 -
Symantec 1.4.4.12 2009.10.06 -
TheHacker 6.5.0.2.032 2009.10.06 -
TrendMicro 8.950.0.1094 2009.10.06 -
VBA32 3.12.10.11 2009.10.05 -
ViRobot 2009.10.6.1972 2009.10.06 -
VirusBuster 4.6.5.0 2009.10.06 -
|
|
|
|
|
Reply: 31 - 32 |
|
|
| MarkGiles |
| Posted on: Friday, October 9th, 2009, 2:01am |
|
|
Posts: 363
|
Latest Yahoo! Geocities sites all redirect to the same target site - crossfull.com - as the concurrent Google Blogger abuse. The target site is in the "US Drugstore" family. The criminal evidence on this fake pharmacy is already posted at
>> http://spamtrackers.eu/wiki/index.php/US_Drugstore << click to view
The rate of abuse is being logged in spam-traps and reported here
>> http://rss.uribl.com/hosters/geocities_com.html << click to view
Yahoo! Geocities and Yahoo! Groups are both under spammer attack at once.
We await some sign of life at Yahoo! to ward off these attacks and to contribute to cleaning up the Internet.
|
|
|
|
|
Reply: 32 - 32 |
|
Pages: 1, 2, 3 : All |
Logged
Locked Board