Porno site joe jobs

[rconner]

Provocative topic title, eh wot?

Over the past few weeks, I've been getting a lot of spams advertising "CC" (credit cards), "CP" (child porn), and zoophilia, and pointing to a variety of "hookup" websites.

Here's the latest: http://www.spamcop.net/sc?id=z5494071008zb...a47ae13ca7b9c0z

While I'm not sure about the probity of these websites, I don't see any evidence that they are engaging in any of the above, nor that they are the source of the spam mailings. I smell a classic Joe-Job (i.e., try to frame your enemies as kiddie pornographers or thieves). I don't know what's going on, maybe some sort of criminal gang war?

-- rick

[turetzsr]

<snip>

I don't know what's going on, maybe some sort of criminal gang war?

-- rick

..Or perhaps just providing an extra enticement to visit their site, which visit may result in any of various benefits to the spammer, such as "warez" or download of malware or phishing.

[petzl]

Provocative topic title, eh wot?

Over the past few weeks, I've been getting a lot of spams advertising "CC" (credit cards), "CP" (child porn), and zoophilia, and pointing to a variety of "hookup" websites.

Here's the latest: http://www.spamcop.net/sc?id=z5494071008zb...a47ae13ca7b9c0z

While I'm not sure about the probity of these websites, I don't see any evidence that they are engaging in any of the above, nor that they are the source of the spam mailings. I smell a classic Joe-Job (i.e., try to frame your enemies as kiddie pornographers or thieves). I don't know what's going on, maybe some sort of criminal gang war?

-- rick

Just botnet spam looks like it's an attack on your email address (has no meaning)

Include the CBL address in report if you can (from Senderbase)

http://cbl.abuseat.org/lookup.cgi?ip=216.146.110.141

When reporting SpamCop tells one if it's listed in CBL/

216.146.110.141 not listed in dnsbl.njabl.org ( 127.0.0.8 )
216.146.110.141 not listed in dnsbl.njabl.org ( 127.0.0.9 )
216.146.110.141 listed in cbl.abuseat.org ( 1 )
216.146.110.141 is an open proxy
216.146.110.141 not listed in accredit.habeas.com
216.146.110.141 not listed in plus.bondedsender.org
216.146.110.141 not listed in iadb.isipp.com

[Farelf]

...While I'm not sure about the probity of these websites, I don't see any evidence that they are engaging in any of the above, nor that they are the source of the spam mailings. I smell a classic Joe-Job (i.e., try to frame your enemies as kiddie pornographers or thieves). ...

Agree, sounds like a little turf war - couldn't see much future for actual carders, kiddy porn fiends etc. who advertise/recruit through indiscriminate spam.

Alternatively, the site in the example looks pretty suss to me (viewed from a distance) - an "amateur video" clearing-house with all sorts of third parties offering handy download facilities, hello, how would the operator keep it free of CP? - so the "spam" could be intended to harm either/both the spamvertized site and/or the recipient. It doesn't take much of a footprint to excite the computer forensics people these days. Paranoid, I know, and most paranoia is delusional - but logically another possibility.