Re: Phisher tricks other phishers into doing the dirty work for him...

In article <fo2fc5$h9r$1@[EMAIL PROTECTED]
>,
Keith F. Lynch <kfl@[EMAIL PROTECTED]
> wrote:
>Marty Helgesen <mnhcc@[EMAIL PROTECTED]
> wrote:
>> Speaking of phi****ng, etc., lately I've been getting spam consisting
>> of a few words, usually including the word "love" and a URL
>> consisting of http:// followed
by four groups of numbers separated
>> by periods.  I prefer not even to click on them, but does anyone
>> know what the perpetrators are up to?
>
>They're giving you the IP address rather than the domain name, perhaps
>in hopes that it will make it more difficult for recipients to figure
>out where to send complaints.

Or probably just because those machines don't have useful DNS addresses.
They're generally compromised end-user machines that are parts of botnets.

>Plus, most spammer websites are hosted in the People's Republic of Spam.

I grabbed the last three spams of the form that Marty Helgesen was talking
about from my inbox. Two geolocated to the USA (a Virginia Comcast
address, and one I'd guess is in Wisconsin), and the third to a dialup
pool
in Russia.

>(I'm still looking for a practical way to get
>procmail to block all messages that mention any URL hosted there.)

Probably would make more sense to use a SURBL (realtime URI blacklist).
SpamAssassin sup****ts SURBL lookups and can easily be run from procmail.

-- 
   Wim Lewis <wiml@[EMAIL PROTECTED]
>, Seattle, WA, USA. PGP keyID 27F772C1