Another joe-job war

To judge by four messages that I just received, Screen Name Forum (screennameforum.com) has apparently upset someone. I'm not quite sure what Screen Name Forum is or does, because their site is so broken on all the browsers that I prefer to use and so laden with flashing bouncing ads that I can't be bothered to look at it, but I'd guess that they just canned one of their users and he or she isn't happy about it.

The messages that came in begin with the words 'Dear Phisher', and try hard to portray Screen Name Forum as "kings of the elite phishing underground". The message goes on:

We urge you to get a vip membership at our forums so that you can freely buy and sell phished login and passwords to other members of the site. It is only a few bucks per month and you can be on your way to making lots of loot by logging into other people's accounts and well, you know the rest.

For some reason, joe-jobbers always have to try just a little too hard. While I don't know anything about Screen Name Forum — their entry at the increasingly useful aboutus.org makes them sound like they're squarely located in what a friend of mine refers to as The Idiot Web, but doesn't make them sound particularly sinister — there's something about the language of this message that just screams 'joe-job'.

Moreover, the four messages were all sent to just one of my email accounts, an account which is used uniquely for sending out spam reports. None of my other collection addresses received a single copy. Obviously, the sender is targeting particular addresses that he thinks can be counted on to instantly call for the termination of the apparent offender (and he may have hit the mark: I can no longer get through to Screen Name Forum, so either they've been pulled or he's followed up the joe-job with a DDoS attack).

The interesting part for me is not the joe-job itself: we've seen joe-jobs before. It's the fact that someone has apparently compiled a list of addresses belonging to anti-spammers and made it available. I've known for a while that my reporting address had come to the attention of a spammer — probably passed on to them by some clueless ISP — and been added to spam lists. But apparently the spammer didn't just blindly throw the address onto their general list; they also recognized that it belonged to someone who was likely to report spam and added it to a separate list.

There could be more than one reason for having such a list. It might be that its main purpose is to allow spammers to clean their main mailing list of any addresses likely to get them into trouble. In this case, the joe-jobber may just be creatively using the 'scrub' list as his destination list. But it might also be that the list is being marketed as part of a 'joe-job in a box' package. Either way, it seems that the spammers are paying attention to this stuff, and putting at least a little effort into 'intelligent' management of their mailing lists.

Tags: , ,


weblognewsstocksstatstoolsnoteslinksmisc