Spam

Help A Noobie Out

This morning I got an email telling me that I was getting close to exceeding my bandwidth for the month. Interesting, that’s never happened before. So I checked my stats and sure enough I’ve served up 8.6 Gigs out of my 10 alloted.

Things were running about normal until the 23rd of the month and then usage quadrupled. Normally I was using between 150-200MB a day when all of a sudden it jumped to over 900MB. Visits and hits stayed pretty much the same, but pages went way up. The biggest page served was “/archives/ miatatude/” which is automatically generated when requested.

Further delving into the stats, a lot of external links had web addresses with names like: http://phentermine.us.tt – http://phentermine.dnc.pl – http://phentermine.rocken.de – http://phentermine.220v.org – http://party-poker.dnc.pl – http://www.cialis.wczasy.com – http://hgh.dnc.pl – http://hydrocodone.dnc.pl- http://www.rape.wczasy.com

Next I looked in the raw access logs and found a bunch of entries that looked like this: 210.0.200.2 – – [26/Aug/2005:00:00:08 -0500] “GET /archives/miatatude/ HTTP/1.0” 200 26131 “http://phentermine.us.tt” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 Firebird/0.7” and 148.244.150.58 – – [26/Aug/2005:00:02:00 -0500] “GET /archives/miatatude/ HTTP/1.0” 200 1723287 “http://phentermine.rocken.de” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 Firebird/0.7”

I did some reading up on deciphering that mumbo-jumbo and what is really strange is that both those requests are for the same web page, but for one a lot more info is returned, but the big question is what is going on here? I found like the top ten IP addresses doing this requesting and denied them access so they will get a 403 instead content. What really worries me is this looks a lot like comment spam roaches, you squash one and several more crawl out from the base boards. Am I going to have to check my logs daily and ban IPs until I close every one?

Trickle Down

I haven’t blogged about spam in a while and mainly because for whatever reason, my work email address is not getting the quantities of it it once was. I took Friday off so this morning I had 4 Spam Quarantine Summaries to look through and the highest total was 30. Friday’s was 18 and the average was a pitiful 24. Are they tiring of sending me email because I never answer or is it they have moved on to some other poor schmoe in another cubicle in another company? Pickings are slim for the best come-on, but in amongst the usual free gift cards, laptops and ipods, this one stood out:

smtp@somespecial.com promises me Complimentary Year Supply of Oreos

Your Walmart Gift Card is here.

Ever since the last time I wrote about the quantity of spam at work seemed to be averaging over a hundred a day, it quickly fell back down near an average of 50 a day. Well now we have sunk to a new low. Saturday morning’s summary email reported just 34 messages, Sunday’s had 37 and this morning’s a paltry 25. The new spam attention getter subject is today’s post’s title. I noticed a smattering of them earlier last week, but it came on strong Saturday as it was the subject of 14 out of 34 emails. Then it showed up six more times in Sunday’s report, but disappeared on Monday’s. Is that the end? I’ll let you know when I get back from shopping at Walmart…

This Is A Deal?

I have been getting my daily status report at work about how many spams Postini has stopped and we have crept up to over the 100 mark and pretty much stayed there since early April. I haven’t said much about the spam recently, mainly because it is literally the same old shit, but apparently I was wrong.

One new way the spammers have to grab your attention is to mix a random city with a random newspaper name, i.e. Woodbine Enquirer or Las Vegas Tribune to lend some authority to their junk. I need to get something like that spam title generator for the title of my blog, might give it some internet cred.

And it seems backgammon is the new poker, as I got a half dozen invites to $10,000 tournaments today alone but none mentioning Texas Hold ‘Em. I wonder who Bravo will get to host Celebrity Backgammon?

Here is my favorite email from over the weekend: bnyykpe@doramail.com is offering Wndows Millenium $50. Who would possibly be tempted to buy a 6 year old operating system and arguably the worst version of Windows since version 2.0? For fifty bucks? Don’t they know how much C$ALIS I can get for that much money?

I Still Get Letters & Some Times I Get Lucky

At a rate of about 70 a day here at work, but I don’t see them, just part of the subject line in my daily digest from Postini. Mostly I just delete that email, but today, one near the top caught my eye: WOW, got laid 3 times this week from francisca.wiley_ky@excite.com. Not that I thought, hey, I should get in on that, but just the two word combo of “got laid.”

A little over a week ago an anonymous reader left a well thought out and insightful critique of my blogging style on my Dahlonega to Home post. He also suggested that perhaps I should “make a notation every time I got laid.” Being the smart ass I am, I commented back that I already do that on my other blog, briangetslaid.blogspot.com. Of course I had just made up the name on the spot, but being the smart ass I am, I spent the next 15 minutes actually making up a blogspot blog by that name. I think I’ll go add that email to it…

Monday Morning Mailbag

You know, as it turns out I don’t have anything better to do than maually count the spam…68 Friday, 74 Saturday & 70 Sunday.

Here is another ploy that doesn’t work when trying to get by Postini, really, really long subjects: saloonkeeperradiocarbonsmudgychimneynightshirtacquiescentdogmatic from Robin Gilbert and skylinecortegekiddediscriminablehaitiaforementionedblip from Rene Doty didn’t make it to my inbox.

Anyone who takes the stock advice for an unsolicited email with the subject line of Savvy players wOuld be wise tO |0ad up early or Our h0t picks triple 0n excel|ent b0unce deserves what they get.

Gladiator Porno Movie Star?

I haven’t given a count of my work spam for a while and that is because they have changed to format in which I get the daily spam sandwich from Postini. It used to come in a spiffy html formatted email with the total emails right at the top. Now it is in plain text, and they dropped the email count. I have stupider things to do with my life than to count them, but I usually still glance through all the titles though. There is the miniscule chance there might be some real mail in there, but mostly I enjoy the ways they try and slip through the net. This morning there were at least 6 double emails. The sender, subject and time received were identical, I even went to the Postini site and compared the contents, they were identical too. Did they figure they could fool the filters by sending more than one?

Anyway, my favorite spam email for today was from venebw@telia.com with the subject of Tiberius Erectus – Rock her all night long.