<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
   <channel>
      <title>Spamnation</title>
      <link>http://www.spamnation.info/</link>
      <description>A weblog about spam.</description>
      <language>en</language>
      <copyright>Copyright 2008</copyright>
      <lastBuildDate>Sat, 05 Jul 2008 08:39:43 -0500</lastBuildDate>
      <generator>http://www.sixapart.com/movabletype/?v=3.2</generator>
      <docs>http://blogs.law.harvard.edu/tech/rss</docs> 

            <item>
         <title>Storm drops the dots</title>
         <description><![CDATA[<p>As mentioned yesterday, the <a href="/blog/archives/2008/07/theres_life_in_the_old_worm_ye.html">Storm worm has been sending 4th of July-themed spam</a>.  I commented then that the worm gives itself away by using dotted-IP notation in the URLs it sends. It seems that the developers are aware of this weakness: the latest run of Storm worm spam uses actual domain names.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/07/storm_drops_the_dots.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/07/storm_drops_the_dots.html</guid>
         <category>Malware</category>
         <pubDate>Sat, 05 Jul 2008 08:39:43 -0500</pubDate>
      </item>
            <item>
         <title>There&apos;s life in the old worm yet</title>
         <description><![CDATA[<p>Lately, a malware newcomer  has been getting all the attention, with claims that <a href="http://www.vnunet.com/vnunet/news/2220320/srizbi-claims-world-largest-botnet">Srizbi may have assembled the world's largest botnet</a>. However, the Storm worm is still out there, and <a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9106498&intsrc=hm_list">predictions of Independence Day spam sent by the Storm worm</a> have proven correct.</p>

]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/07/theres_life_in_the_old_worm_ye.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/07/theres_life_in_the_old_worm_ye.html</guid>
         <category>Malware</category>
         <pubDate>Fri, 04 Jul 2008 11:56:25 -0500</pubDate>
      </item>
            <item>
         <title>In Soviet Russia</title>
         <description><![CDATA[<p>Some spammers apparently have a sense of humor. Some of our spam traps were recently hit with a run of test messages with the subject line:</p>

<p class="quote">in sov r bot test you</p>

<p>The spamtrap addresses affected were originally 'scraped' by spiders running on servers rented from Everyone's Internet/EV1Servers, and gather the usual mess of penis enlargement, pills and fake watch spam.</p>

<p>Using a distinctive test message rather than simply sending out another batch of pill spams would make sense if spammers were collecting bounces in order to eliminate undeliverables from their spam lists. This doesn't seem to be the case, however: the 'From' addresses on the messages use randomly-generated addresses at other people's domains, so there's no way for the spammer to collect the bounces. They could monitor the actual SMTP transaction &mdash; but then there's no advantage to using a distinct test message. It's therefore likely that the messages are no more than they appear to be: simply test data used for checking a botnet or trying out a new email module.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/06/in_soviet_russia.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/06/in_soviet_russia.html</guid>
         <category>General</category>
         <pubDate>Mon, 30 Jun 2008 06:37:20 -0500</pubDate>
      </item>
            <item>
         <title>Something old, something new</title>
         <description><![CDATA[<p>After a fairly sharp decline from last year's high, there are signs that stock spam might be creeping up again. We've noticed a slight uptick in the number of symbols advertised, although volumes remain well down. What's interesting is that the new stock spammers appear to be exploring some new tactics.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/06/something_old_something_new.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/06/something_old_something_new.html</guid>
         <category>Stocks</category>
         <pubDate>Sun, 29 Jun 2008 06:56:56 -0500</pubDate>
      </item>
            <item>
         <title>Blocking SMS spam</title>
         <description><![CDATA[<p>One type of spam that I've been spared so far is SMS spam, where spam messages are sent directly to your cellphone (often very expensive for the recipient). <a href="/stocks/">Stock spammers</a> in the US often use SMS spam, while in places like <a href="http://www.vnunet.com/vnunet/news/2191709/china-punishes-mobile-spammers">China</a> it's already a huge problem. In Britain, <a href="http://www.computerweekly.com/Articles/2008/04/24/230419/two-thirds-of-britons-say-they-have-been-victims-of-mobile.htm">two-thirds of cellphone users have received SMS spam</a>.</p>

]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/06/blocking_sms_spam.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/06/blocking_sms_spam.html</guid>
         <category>General</category>
         <pubDate>Fri, 13 Jun 2008 07:07:54 -0500</pubDate>
      </item>
            <item>
         <title>Future shock</title>
         <description><![CDATA[<p>Jonathan Zittrain, co-author of an excellent <a href="http://papers.ssrn.com/sol3/papers.cfm?abstract-id=920553">study of stock spam</a>, has just released a book called <a href="http://futureoftheinternet.org/">The Future of the Internet - And How to Stop It</a>, available both on paper or as a Creative Commons-licensed download.</p>

<p>The book isn't primarily about spam, but any discussion of the future of the Internet &mdash; which Zittrain sees as potentially bleak, by the way &mdash; must necessarily cover the topic. Zittrain outlines the problem and then talks about responses to the problem in the form of open collaborative grassroots projects. I haven't had time to do more than skim it, but it looks like it might be worth a read, if only as a possible source of new ideas and a way to look at spam as an instance of the larger problems facing the Internet.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/06/future_shock_1.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/06/future_shock_1.html</guid>
         <category>General</category>
         <pubDate>Mon, 09 Jun 2008 13:00:07 -0500</pubDate>
      </item>
            <item>
         <title>Odd spam of the week</title>
         <description><![CDATA[<p>Over the last couple of days, we've seen a number of spams with titles like <q>&lsquo;Amazon.com is down?&rsquo;</q>, <q>&lsquo;Amazon.com crashed&rsquo;</q> and so forth. The body of the spam reads:</p>

<blockquote>Hello! News agency Reuters informs about not to working capacity of a site amazon.com in current of two weeks since June, 9th and corresponding it to falling of share price. Be close at work
with them.</blockquote>

<p>The message contains no URLs, no malware payload, nothing except the text above. It's difficult to tell what the purpose is - a botnet capacity test, a <a href="/stocks/FAQ.html">short-and-distort</a> attempt on AMZN, a test to identify active addresses &mdash; or just another spammer misconfiguration?</p>

<p>It's true that <a href="http://money.cnn.com/2008/06/06/technology/bc.amazondown.ap/index.htm?section=money_latest">Amazon recently had system problems</a> that took it offline for a couple of hours. What's not clear is why spammers want us to know that.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/06/odd_spam_of_the_week.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/06/odd_spam_of_the_week.html</guid>
         <category>General</category>
         <pubDate>Sun, 08 Jun 2008 08:30:39 -0500</pubDate>
      </item>
            <item>
         <title>Justifying the means</title>
         <description><![CDATA[<p>Today's convoluted explanation of why something isn't spam is provided by <span class="domain">rasimport.com.br</span>. Here's a (somewhat free) translation from the Portuguese disclaimer at the end of their messages:</p>

<blockquote>Important Message: Our message is not spam, here's why: email is a form of correspondence equal to a telephone connection or a letter. In Brazil and in the rest of the world, in the same way that no authorization is necessary to send letters or to telephone somebody, it is likewise unnecessary [to have] prior authorization to send emails in whatever form, there is nothing in Brazilian legislation that refers to the practice of spam, ... </blockquote>

<p>At this point the Portuguese becomes quite opaque (so much so that I wonder if it's not their grammar rather than my very limited grasp of Portuguese that's at fault) but they appear to be arguing that in any case, should such a regulation exist, it will be restricted to requiring that the sender provide an opt-out mechanism.</p>

<p>I'm sure you'll all agree that this is a fascinating argument. I look forward with great eagerness to hearing their justification of why they should be allowed to forge my email address in the 'From:' line of the spams that they send out.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/04/justifying_the_means.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/04/justifying_the_means.html</guid>
         <category>General</category>
         <pubDate>Fri, 04 Apr 2008 20:21:11 -0500</pubDate>
      </item>
            <item>
         <title>Sniffing for spam</title>
         <description><![CDATA[<p>A team of European researchers have announced a revolutionary new spam detection technique that promises to change forever how we filter incoming email, and, the researchers claim, could end spam as we know it. I suspect that claim may prove to be overoptimistic, but the technique does sound interesting and their early tests apparently show vanishingly low rates of both missed spams and false positives. What's more, they say that the next version of their detector will reduce the error rate still further.</p>

]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/04/sniffing_for_spam.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/04/sniffing_for_spam.html</guid>
         <category>General</category>
         <pubDate>Tue, 01 Apr 2008 06:58:06 -0500</pubDate>
      </item>
            <item>
         <title>Appropriate</title>
         <description><![CDATA[<p>The operators of the <a href="http://spamnation.info/blog/archives/2007/04/storm_worm_is_back.html">Storm Worm</a> are known for continually revising the messages that they send out to reflect current events, holidays, and so on. I've just seen what looks like a new Storm Worm message with the subject "All Fools' Day". When you think about it, that's rather appropriate.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/03/appropriate.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/03/appropriate.html</guid>
         <category>General</category>
         <pubDate>Mon, 31 Mar 2008 20:15:41 -0500</pubDate>
      </item>
            <item>
         <title>Peru sin Spam</title>
         <description><![CDATA[<p>I'd like to give a quick shout-out or tip-of-the-hat or whatever to <a href="http://perusinspam.wordpress.com/">Peru sin Spam</a> ('Peru without spam'), which is a site with similar goals and methods to ours. As well as covering general spam news, they have a <a href="http://perusinspam.wordpress.com/spammers/">list of Peruvian companies that send spam</a>. Their list includes a number of the pests currently filling my inbox with their junk, including <a href="http://www.spamnation.info/go/domain/thaisbor.com">Thaisbor S.A.C.</a>, <a href="http://www.spamnation.info/go/domain/avanceempresarial.com.pe">Avance Empresarial</a>, <a href="http://www.spamnation.info/go/domain/piramideconsultores.com">Piramide Consultores</a>, and <a href="http://www.spamnation.info/go/domain/educecapacitaciones.com">Educe Capacitaciones</a>, to name only a few (and not forgetting our old friends at <a href="http://www.spamnation.info/go/domain/ilfornolima.com">Il Forno</a>).</p>

<p>It's not clear how effective the naming-and-shaming policy operated by both Spamnation and Peru sin Spam actually is. Some of the companies involved &mdash; particularly the ones offering 'management seminars', who are the worst offenders in terms of spam generated &mdash; seem fairly sleazy. Still, it's nice to see someone making the effort and their site is a useful resource.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/03/peru_sin_spam.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/03/peru_sin_spam.html</guid>
         <category>General</category>
         <pubDate>Fri, 28 Mar 2008 07:54:07 -0500</pubDate>
      </item>
            <item>
         <title>Puppies!</title>
         <description><![CDATA[<p>The 2008 Award for Innovation in Advance Fee Fraud goes to the (presumably Nigerian) scammer calling him/herself Mary Ann Wooden and claiming to be an LDS missionary in Africa. Sadly, it seems that Mary Ann's teacup Yorkie terrier hasn't done well in the African climate, and needs a kind person to adopt her.</p>

<p>So far, so plausible ... but Mary Ann claims to have discovered our email <q>&ldquo;through an email surfing Affiliated with the US chamber of Commerce&rdquo;</q>, whatever that means, and her familiarity with the English language is patchy at best. I suspect that if you agree to take this bundle of joy off her hands, there'll be a customs fee to pay, and then another unexpected charge, and then another and ...</p>

<p>Still, going after soft-hearted dog lovers is a master stroke. Well done, "Mary Ann", you obviously have a brilliant career ahead of you.</p> ]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/03/puppies.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/03/puppies.html</guid>
         <category>Scams</category>
         <pubDate>Thu, 20 Mar 2008 07:22:37 -0500</pubDate>
      </item>
            <item>
         <title>Think locally, spam globally</title>
         <description><![CDATA[<p>One of the familiar 'arguments' put forward by spammers trying to defend the indefensible is <q>"It's just one message."</q> (of course, it never is 'just one', but leave that aside for the moment). The usual response is to ask reasonably what would happen if every business in the world felt entitled to send 'just one message'. Of course that could never happen ... or could it?</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/03/think_locally_spam_globally.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/03/think_locally_spam_globally.html</guid>
         <category>General</category>
         <pubDate>Sat, 15 Mar 2008 10:41:56 -0500</pubDate>
      </item>
            <item>
         <title>Scamitations</title>
         <description><![CDATA[<p><q>Imitation is the sincerest form of flattery</q>, they say. Scammers, in particular, are great believers in imitation. The first 419'ers spawned hundreds of others. Money transfer scams, with their higher barriers to entry (to work a money transfer scam, you have to either come up with a plausible fake check or a phish'ed bank account), are rarer, but there are probably at least ten separate money-transfer scam operators currently fishing for victims by email. The 'fake storefront' scam popularized by <a href="http://spamnation.info/go/domain/scammer032.invalid">this scammer</a> has now been picked up by <a href="http://spamnation.info/go/domain/scammer042.invalid">a different scammer</a>. And so on.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/03/scamitations.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/03/scamitations.html</guid>
         <category>Scams</category>
         <pubDate>Wed, 12 Mar 2008 14:42:12 -0500</pubDate>
      </item>
            <item>
         <title>Lazy 419&apos;ers</title>
         <description><![CDATA[<p>A number of visitors to this site can't tell the difference between record pages from our <a href="http://www.spamnation.info/tools/Domain.php">spam-advertised domains database</a> and the actual website of the company in question (yes, I know, I don't understand it either). This means that we get a certain amount of misdirected mail, often from Very Angry People.</p>]]></description>
         <link>http://www.spamnation.info/blog/archives/2008/01/lazy_419ers.html</link>
         <guid>http://www.spamnation.info/blog/archives/2008/01/lazy_419ers.html</guid>
         <category>General</category>
         <pubDate>Fri, 18 Jan 2008 09:44:02 -0500</pubDate>
      </item>
      
   </channel>
</rss>
