Where did the spamadvertise sites go?

[dra007]

The majority of spam I have been reporte lately has web advertise sites which parse like this:

Finding links in message body

Recurse multipart:

   Parsing text part

Resolving link obfuscation

http://fannoisy.com/p.php?r=cahek&b=banner

   host fannoisy.com (checking ip) = 221.11.137.42

   host 221.11.137.42 (getting name) no name

http://coffeebopin.com/p.php?r=cahek&b=banner

   host coffeebopin.com (checking ip) = 221.11.137.42

   host 221.11.137.42 (getting name) no name

http://fannoisy.com/de.php

   host fannoisy.com (checking ip) = 221.11.137.42

   host 221.11.137.42 (getting name) no name

So my full reporting has no web advertised sites... I know this has come up in the past, but if spamcop analysis (for the sake of argument) is correct, why are spammers bothering sending this junk at all? Obviously it does not lead to any business other than becoming yet annoyance for reporters like us.

As it happens the links missed by spamcop do indeed lead to existing web sites.

[StevenUnderwood]

dra007:

I don't know about you, but I get 404 Not Found for all 3 sites. And the domain only shows only a blank site for both of them.

[dra007]

dra007:

I don't know about you, but I get 404 Not Found for all 3 sites.  And the domain only shows only a blank site for both of them.

25387[/snapback]

I got all of them live when I tested from the links posted here. Same links parsed to a cnc domain on subsequent parsing! So they may just be unstable, but checking them every time they have unstable behavior makes manual reporting rather cumbersome and takes more time than I want to spend with such junk.

[Neo]

dra007:

I don't know about you, but I get 404 Not Found for all 3 sites.  And the domain only shows only a blank site for both of them.

25387[/snapback]

probably cos the ISP has now removed them.