ewv Posted March 17, 2004 Share Posted March 17, 2004 The 3D Mangler Spammer has recently included multiple links to different pages at the same spam domain. The parser ignores the links because there are "too many" even though they are all the same domain: goclick3069rx.biz resolves to 61.145.118.247 ipadm[at]gddc.com.cn, ctsummary[at]special.abuse.net href=3D"http://intellectual.goclick3069rx.biz/g09/ href=3D"http://trimester.goclick3069rx.biz href=3D"http://camel.goclick3069rx.biz/g09/ href=3D"http://dolt.goclick3069rx.biz/g09/ href=3D"http://halloween.goclick3069rx.biz/g09/ href=3D"http://special.goclick3069rx.biz/g09/ href=3D"http://aaa.goclick3069rx.biz/g09/ href=3D"http://adele.goclick3069rx.biz/g09/ href=3D"http://bark.goclick3069rx.biz/g09/ href=3D"http://bark.goclick3069rx.biz/g09/ href=3D"http://czech.goclick3069rx.biz/g09/ href=3D"http://asleep.goclick3069rx.biz/g09/ href=3D"http://staid.goclick3069rx.biz/g09/ href=3D"http://flathead.goclick3069rx.biz/g09/ href=3D"http://deliquesce.goclick3069rx.biz/g09/ href=3D"http://hop.goclick3069rx.biz/g09/ href=3D"http://choose.goclick3069rx.biz/g09/ href=3D"http://goclick3069rx.biz/unsubscribe.ddd Is this behavior of the parser intended? It provides a loophole/reward for spammers -- "do it even more and you escape detection". Link to comment Share on other sites More sharing options...
Wazoo Posted March 17, 2004 Share Posted March 17, 2004 in the back of my mind, it seems to me that the parse used to boil these all down to the common domain, so there may be a change somewhere down the line that stopped this. But yes, in general, the "too many link" did have its purpose once and there were / are some spammes that are doing this type of thing intentionally. Now another side of your situation may also include the context of these links, which isn't shown in your list. Some recent disussions talk of URLs being inserted in the spam but not as a clickable link ... maybe your sample is different? Link to comment Share on other sites More sharing options...
ewv Posted March 18, 2004 Author Share Posted March 18, 2004 Now another side of your situation may also include the context of these links, which isn't shown in your list. Some recent disussions talk of URLs being inserted in the spam but not as a clickable link ... maybe your sample is different? Yes, they are clickable, but the deliberate mangling of the syntax might fool the parser into thinking otherwise. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.