 Pages: 1 |
 Author |
 Google Groups Abuse - the new gorgon (currently 4,420 views) |
| MarkGiles |
| Posted on: Friday, January 30th, 2009, 8:10pm |
 |
|
Posts: 363
|
Over the last week in January 2009, Google Groups has come under a concerted attack from spammers.
February will see whether the monolithic Google Corporation is nimble enough to grapple with its gorgon.
Using free services to set up redirections to the usual illegal pharmacies and fake watch scams is nothing new. It is a spammer tactic that is well documented and understood. These days, the combination of honeypots (or spamtraps) and the rapid development of spam source and spam URL blocklists have become a potent force in filtering the spam, that is reaching epidemic proportions.
Spammers create a few hundred of these "straw men" sites, that redirect to the site that they want to keep out of the URL blocklists. So in their spam, they will use one of these hundreds of straw men sites, which they expect to have a life cycle of only a few hours. By rotating through hundreds of such straw men sites, the actual target web site never gets exposed in the spam, and evades the blocklists.
In the past week, the spammers have hit on Google Groups as an easy target for their abuse.
Let's work through one example out of the thousand live sites out there. First, the spammer creates a Google Group called
http://aanatoli04124sb.googlegroups.com
If you go there, you find nothing. But then he adds a link in that group to a particular web site
http://aanatoli04124sb.googleg.....kXU5InE09W2o0GCSVgCQ
Click on that, and you will end up at a Prestige Replicas scam site, exposed at http://spamtrackers.eu/wiki/index.php/Prestige_Replicas
To attempt to hide the actual site, it is contained within a frame, so it does not show in the address bar. The actual frame is at http://dicemall.com/
That's the one that they are trying to protect from blocklists.
McAfee has some site advisories on this piece of work at htp://siteadvisor.com/sites/dicemall.com
There is more information about this whole operation, together with several hundred examples of spammed googlegroops.com URLs, at http://spamtrackers.eu/wiki/index.php/Hosters
All that Google needs to do, is to write a never ending program to scan through all of its Google Groups, matching on a pattern of behaviour, and killing each group that matches.
Existing sites that list the abuses are at the above Spam Trackers Wiki, and at the URIBL blocklistsite:
http://rss.uribl.com/hosters/googlegroups_com.html
That site currently lists 98.44% - 1008 of 1024 active subdomains listed in last 5 days on googlegroups.com..
That tells you that 98.44% of new Google Groups created in the last 5 days are for this scam, and are in breach of Google's Terms of Service.
Personally, I do not believe that Google is in the business of sponsoring crime. I believe that they will notice the problem, and act quickly to resolve it.
If they don't, the egg is all over their face.
|
|
|
|
|
|
| MarkGiles |
| Posted on: Sunday, June 14th, 2009, 1:01am |
|
|
Posts: 363
|
|
|
|
 |
Reply: 1 - 6 |
|
|
| MarkGiles |
| Posted on: Tuesday, June 16th, 2009, 7:35pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 2 - 6 |
|
|
| MarkGiles |
| Posted on: Tuesday, June 16th, 2009, 7:44pm |
|
|
Posts: 363
|
Google has taken action, too little, too late, too ineffective
.
Google has gone public with a confession that it is knowingly supporting crime:
http://groups.google.com/support/bin/answer.py?hl=en&answer=141369
Now they pop up a warning message, saying that you have the option to view a spammed site. But Google, this is NOT A SPAMMED SITE. It is an ILLEGAL pharmacy fraud run by the Internet's #1 most wanted criminal organization, the one that pollutes the Internet with its Canadian Pharmacy spams for a web site that is clearly illegal.
Sponsorship of crime is abominable. That a company like Google can indulge in it is reprehensible, and places Google on the same level as the criminals behind Canadian Pharmacy. Go hide your heads in shame. |
|
|
|
|
Reply: 3 - 6 |
|
|
| MarkGiles |
| Posted on: Sunday, June 21st, 2009, 10:50pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 4 - 6 |
|
|
| MarkGiles |
| Posted on: Tuesday, June 23rd, 2009, 5:48pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 5 - 6 |
|
|
| MarkGiles |
| Posted on: Saturday, July 18th, 2009, 5:45pm |
|
|
Posts: 363
|
|
|
|
|
Reply: 6 - 6 |
|
Pages: 1 |
Logged
Locked Board