Broken or Nonexistent Links

Benzyl · **Posted:** Tue Nov 03, 2009 9:35 am

Refillrx-depot.com no idea what this is other than an unfinished install for the last week or so, Rx shop v1.1.14 installation ? http://farm3.static.flickr.com/2788/4072135712_2d1ec8334c_o.png

Nodus · **Joined:** Fri Jun 15, 2007 7:05 pm **Posts:** 2261

Yeah, I stumbled across that one, too. Probably just an unfinished install, and maybe even forgotten in that. Those name servers have been serving mostly Online Pharmacy domains, so I guess this would have been one as well.

Benzyl · **Posted:** Sat Nov 07, 2009 4:09 pm

Twenty five (more than usual) of the traditional empty emails arrived today with odd from addresses that didn't look like the usual fakes in the form of fryalnab@93-43-221-54.ip93.fastwebnet.it , Urvutyos@static-248-55-224-77.ipcom.comunitel.net , kognadon@c-67-171-179-177.hsd1.or.comcast.net . Not a format I recognise or have seen before. All except for seven were blank and they contained something in an odd format - 93-35-245-29.ip57.fastwebnet.it ,93-42-152-41.ip87.fastwebnet.it , 93-43-209-126.ip93.fastwebnet.it , static-248-55-224-77.ipcom.comunitel.net , ip-21-141.sn-212-90.eutelia.it , c-67-171-179-177.hsd1.or.comcast.net , wimax-client.yota.ru , no idea at all.

Knitter · **Joined:** Tue Oct 14, 2008 8:20 pm **Posts:** 72

Quote:

<td><a title="{eurosoftware_subj_engl}" href="http://{link_EuroSoftware}">Es ist die Zeit angebrochen, zu gelten 
Ihren Kode auf den Rabatt D33W-4786, 30 % auf das Sortiment aus 3000 Programmen</a></td>
</tr>

Tsk, tsk

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

Honestly, if you can't even figure out how to configure your mailing software, what the hell are you doing in this "business"? This thread is now a year old and we keep seeing this mistake being made month over month.

I guess it's just reinforcing the truth: spammers are genuinely stupid people.

Yikes.

SiL

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

This could equally belong in the Dumbest of the Dumb

Quote:

From: "Patty Rich" <quotemanomano@capriservice.com>
Subject: Office Home and Student 2007

Hello. OEM soft (gamerosofaas.net) Thanks Office Home and Student 2007.. Splendid! )))))))

Compelling copy, no question. Who wouldn't immediately click on that?!

But of course in addition, the domain doesn't respond.

Idiots.

SiL

Benzyl · **Posted:** Sat May 01, 2010 4:54 pm

Who knows if this one ever worked (it certainly doesn't currently) http://www.alsamet.com/images/hh/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/installation/index.php . One of my daily HSBC Bank PHISH mails which even if you didn't initially suspect anything was suspect must have supplied a bit of a clue when this filled the address bar.

Nodus · **Joined:** Fri Jun 15, 2007 7:05 pm **Posts:** 2261

Benzyl wrote:

Incomprehensible mess I got sent

Are you absolutely sure there's no URL lurking somewhere in the middle of it, only waiting for to strike at you when you least expect it? :wink:

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

I noticed that it has some froggy's in there

BillyShaft · **Joined:** Tue Jun 16, 2009 11:30 am **Posts:** 71

Fully 2/3 of the mail coming into my "All Lethic, all the time" account have been devoid of links. Apparently they have new admins who have not figured out how to send their junk.

Benzyl · **Posted:** Mon Jun 28, 2010 5:31 pm

I can't even work out what this spammed link could have been intended to be or what mistake must have happened in the transcription, at least it wasn't 127.0.0.1 - http://0.0.0.0/new/index.pl

---

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

Quote:

Subject: Re: Offer
From: "Petrov, Sergey" <[email protected]>
Good Morning,

The Russian Economy is growing very fast and Russian companies and investors are
looking for new business partners from all over the world.

We are sure that our new business directories will be very useful for you to
establish contact with them.

The prices for the directories start from 150.- EUR.

You can find detailed information about our products at our website.

With deep respect,

Sergey Petrov,
ZakMedia.

Way to go, genius.

SiL

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

Another mental giant.

Quote:

Subject: Re: resume Steve J

Dear Prospective Employer,

I applied for your position last week. Could I get an update on my application? Your cooperation will be appreciated in this matter. My resume for your review is http://www.careerbuilder.com/ShareInfo/Resume.aspx?DID=JX98HKW.

Best regards,
Steve Job

Steve Job? Really?

The link of course goes somewhere completely different:

http://payrollserversinstall.com/forum.php?tp=1773b5fa2053528f

Which fails:

Quote:

No input file specified.

It says that no matter what parameters follow the forum.php script.

Attempting to view the domain itself results in an nginx 403 error.

Genius.

SiL

Red Dwarf · **Joined:** Tue Jun 27, 2006 2:01 am **Posts:** 9227

Did you try to decipher the strange script and weird code at that URL?

Code:

<html><body>      <div style="width:0;height:0;overflow:hidden;"></div>
<script>
   function createCSS(selector, declaration) {
<<SNIP TO PREVENT AV ALARMS>>
etc

spamislame · **Joined:** Tue May 09, 2006 9:18 am **Posts:** 5022

Red Dwarf wrote:

Did you try to decipher the strange script and weird code at that URL?

There wasn't any such code at that url when I tried it. Only the text I quoted above. (So clearly he was jumping the gun.)

The good news: My company's ESET installation already instantly flagged it as malicious.

If you can email me what the code is that that page generates I'd certainly be interested but I can already wager it's either a PDF exploit or some modification of a Windows Media exploit based on the use of the hidden div and obfuscated code.

SiL

InBoxRevenge KS Forum

Broken or Nonexistent Links

Who is online