Wiz's Computer and Website Security Blog

This week, my incoming spam level dropped 1% from last week. Viagra and Cialis spam regained the top position, with Male Enhancement and various Pharmaceuticals filling positions 2 and 3. Diploma spam has almost doubled since last week and many spam templates are using URL shorteners to hide the destination.

For the last two weeks, Spammers have been using a new template that adds huge amounts of space-bar spaces between the spam words in the plain text source code. This is done to evade spam filters. This is followed by HTML content that is identical. However, when HTML is rendered, only one space is shown between words, making the actual spam message readable by a Humans. I have created and published new custom filters for MailWasher Pro users, which easily detect and block this type of spam, whether for diplomas or drugstores.

This past 7 days, spam for various types of unsolicited commercial email (UCE) amounted to 27% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from July 24-31, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 27%; -1% from last week
Number of messages classified as spam: 122
Number classified by my custom spam filters: 112
Number and percentage of spam according to my custom blacklist: 9
Number classified as spam by the Bayesian Learning filter: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 0
Number of spam messages seen, reported to SpamCop & manually deleted: 21

The actual percentages of spam by category follow below.

The order of spam categories, according to the highest percentages, is as follows:

Fake Viagra and Cialis: 24.79%
Male Enhancement scams: 20.66%
Pharmaceuticals (totally unlawful to import into the USA): 11.57%
Diploma Spam: 9.09%
Other Filters (with small individual percentages): 7.44%
My Custom Blacklist: 7.44%
Weight Loss Scams (e.g. HCG): 5.79%
Counterfeit Watches: 4.96% (double from last week!)
Known Spam Domains (mostly .RU): 2.48%
Non-English Language spam (apparently, Spanish and French): 2.48%
URL Shortener Spam Link (updated for any short url): 1.65%
Thunderbird User-Agent spam template: 1.65%

This week I made 7 updates and/or additions to my custom filters:

.BR, .CN, .RU .UA Domain Link,
Casino Spam,
Image Spam #11,
Pump and Dump Scam,
URL Shortener (Spam) Link.
New Filter: Drugstore with spaced words.
New Filter: Thunderbird Spam.

I made 0 additions to my custom Blacklist this week:

There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Posted by Wiz at 3:38 PM | Permalink

back to top ^

On July 30, 2011, at 13:29 EST, I reported a spam email for illicit pharmaceuticals, via SpamCop. Just over one hour later, at 14:36, I received notice from the web host responsible for the spamvertised domain, that they had suspended that account. Their notice included my SpamCop report, in its entirety. The domain had a .RO extension, signifying Romanian.

The reason I got such a fast and pleasant result was because the hosting company for that .RO domain is not actually located in Romania, where the SpamCop complaint would have fallen on blind eyes, but in Great Britain. My sincere thanks and shout out goes to the admins at UK2.NET, for quickly terminating the spam domain: oil-shop.ro.

To be certain, I ran the spam domain name through WannaBrowser and sure enough, it delivered a 302 redirect to the web host's home page. The spamvertised website was indeed removed!

This is at least the 6th spam domain I have helped get terminated, in the past month or so. It does pay to report bad actors and spammers. There are hosts and registrars out there who don't turn a blind eye to abuse reports. I am finding more every time I file abuse reports.

Every spam or website abuse report counts. ISPs, hosts and registrars are listening, in growing numbers. Let your complaints be heard. Join SpamCop and submit spam emails as soon as you see them. The faster spam is reported, the sooner action like this can be taken by those who hold the ends of the plugs in their hands. It's up to us little guys, the targets of spam and scams, to report this abuse to those responsible, so that they can pull the plugs on the domains and spamming customers under their control.

FYI: I use MailWasher Pro to intercept, identify, report and delete spam email, before it can be downloaded to my desktop email client: Windows Live Mail 2011. I have an entire page describing MailWasher Pro. I even write and share my own spam filters, which are used by MailWasher.

Posted by Wiz at 3:43 PM | Permalink

back to top ^

In 2009 I wrote about trackback spammers using scripts they have installed on servers owned by Ubiquity Server Solutions and Nobis Technology Group before. After 1.5 years they still haven't cleaned up this abuse. It seems that every day or two I see numerous POST attempts to my blog, which are either comment or trackback spam.

I'd like to let the people installing these scripts targeting my blog know, that in my case, their efforts are futile. That is because I run a Perl based Movable Type blog and these spam scripts assume that the target is running on a more common, but less secure, PHP driven blog, usually Wordpress.

It appears that if one uses WordPress as their blog software, a simple POST command is sufficient to post comments or trackbacks to that blog page. Not so with Movable Type! With MT, one must visit a particular scripted page to submit a comment or a trackback. Not only must they have valid credentials to submit, but anything submitted is held until the owner of the blog approves that submission. It goes without saying that nobody in his or her right mind is going to approve spam comments or trackbacks!

I take matters one step farther: I do not accept either comments or trackbacks on any of my blog articles. It says so right at the top of every page on this blog. Yes, I have the scripts installed to do comments and trackbacks, but, they are disabled in the Dashboard. I can't even comment om my own posts. If the time ever comes where I feel like allowing public comments, it will only be from people holding approved credentials and then, all comments would be held for moderation. Nothing would ever get posted that was in any way spammy!

This brings me back to the title of this article. A majority of the failed attempted spam comments and trackbacks are emanating from IP space under the control of Ubiquity Server Solutions. In the last few days I have logged several attempts coming from various IP addresses covered by the following CIDR ranges: 173.234.124.0/22, 173.234.172.0/22 and 173.234.184.0/22. All of these CIDRs are part of the entire Class C network assigned to Ubiquity and Nobis: 173.234.0.0/16.

Note: This CIDR is not the only one assigned to Ubiquity Servers. They hold several other ranges.

So, they're spamming your blogs ... Let's block them from your Apache hosted websites...

If you have a blog or website hosted on a shared Apache Web Server and you are allowed to use .htaccess overrides, and are being spammed by scripts coming from IP space within the range of 173.234.0.0 - 173.234.255.255, you can deny access to every IP within that range, or to some of the more specific IP ranges listed above, by adding one of the following directives to your .htaccess file:

Note: These directives use Mod_Access, which is allowed by almost every web hosting company.

Block all of Ubiquity's 173.234/16 Class C:

<Files *>
order deny,allow
deny from 173.234.0.0/16
</Files>

Or, for one or more individual and narrower CIDR ranges:

<Files *>
order deny,allow
deny from 173.234.124.0/22 173.234.172.0/22 173.234.184.0/22
</Files>

Or, you may want to just block individual IP addresses that are spamming your blog or guestbook:

<Files *>
order deny,allow
deny from 173.234.127.93 173.234.174.195 173.234.186.113
</Files>

The above listed IP addresses are actual addresses used to try to POST spam to my blog. They were obtained from my access logs of July 25, 2011.

The result shown to any person or script that is covered by the deny from directives is a 403 Forbidden.

When I investigate some of these POST spam attacks I often find they are coming from an unconfigured website on a shared, or dedicated server. Due to certain lax security measures, hackers are able to inject timer operated scripts, known as Cron Jobs, into web spaces that are not well secured, or whose login credentials were harvested by a keylogger Trojan on the domain owner's computer. If you have patience and want to fight back, file an abuse report with the abuse department of the web hosting company. Sometimes this results in halting the spam script and education of the site owner. Other times, it leads directly to the termination of a hosting account leased by the spammer him or her self.

One can decipher where to send abuse reports by running a Whois inquiry on the IP address, through DomainTools.com

PS: I have yet to find that blocking the entire Class C of 173.234.0.0/16 has blocked any actual visitors to my website (I can tell the difference). But, I cannot guarantee that this won't happen to someone, somewhere, some day. ISPs are wheeling and dealing for new IP addresses all the time, as their broadband customer base grows.

If you are worried about blocking innocent visitors who might someday come from an IP that is on a blocklist (a list of blocked IP addresses or CIDRs) - and if your host allows you to use Mod_Rewrite Directives (full overrides), there is another method that may work for you. I will cover this in a forthcoming article.

In the meantime, secure your blog scripts. Make sure you are using the most current version of the blog software. Choose a hard to guess, non-dictionary password for the blog's admin account. Also, keep the best legitimate anti malware program you can afford on any PCs that are used to login to your blog or website. Scan often. You do not want to allow a keylogger to steal all of your login credentials!

Posted by Wiz at 4:29 PM | Permalink

back to top ^

This week, my incoming spam level was just 1% lower than last week. However, the types of spam have begun to change in order of percentages by category. Some previously strong categories have dropped way down as spammers find them unprofitable.

Spammers are using a new template that adds huge amounts of spacebar spaces between the spam words in the plain text source code. This is followed by HTML content that is identical. However, when HTML is rendered, only one space is shown between words, making the actual spam message readable by a member of the Human Race. Writing a filter for this trick is trivial. I already have one for Diploma Spam using the multiple spaces and am in the process of creating another for pharmacy spam.

This past 7 days, spam for various types of garbage amounted to 28% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from July 17-24, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 28%; -1% from last week
Number of messages classified as spam: 124
Number classified by my custom spam filters: 115
Number and percentage of spam according to my custom blacklist: 5
Number classified as spam by the Bayesian Learning filter: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 4
Number of spam messages seen, reported to SpamCop & manually deleted: 22

The order of spam categories, according to the highest percentages, is as follows:

Male Enhancement scams: 20.97%
Fake Viagra and Cialis: 20.97%
Pharmaceuticals (unlawful to import into the USA): 13.71%
Weight Loss Scams (e.g. HCG): 9.68%
URL Shortener Spam Link: 8.06%
Diploma Spam: 5.65%
Other Filters (with small individual percentages): 4.84%
My Custom Blacklist: 4.03%
DNS Blacklisted Servers (e.g. SpamCop, Spamhaus): 3.23%
Counterfeit Watches: 2.42% (Way down from last week!)
Known Spam Domains: 2.42%
.BR, .CN, .RU, .UA spam domain links: 2.42%
Non-English Language spam (Bad Robot !): 1.61%

This week I made 6 updates and/or additions to my custom filters:
Updated (for huge # spaces around words) and split Diploma Spam into 3 filters
Diploma Spam [B plain text],
Pharmaceuticals [S],
Re: or Fw: Spam,
URL Shortener Spam Link,
Work At Home Scam

I made 1 addition to my custom Blacklist this week:
[email protected] (use at your own discretion!)

There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Posted by Wiz at 2:41 PM | Permalink

back to top ^

Lately I have been seeing spam that uses my first name or nickname in the subject and message body. The majority of these spam messages are for work at home scams. The last time this happened it came from a compromised Hotmail account belonging to a friend. The email came from that Hotmail account and was composed by spambots that had taken over the account after guessing or stealing the password.

The new spam that contains my first name or nickname is not coming from Hotmail, nor is it going to a Hotmail account. This behavior was predicted a month or two ago, after hackers broke into numerous email databases and stole usernames, real names and email accounts associated with them.

I am revealing this now to protect my readers from being tricked into clicking on links contained in emails that address them by their personal or nick names. It used to be that only trusted contacts had our actual names, but, that has changed this year. No email addressing you by name can be trusted 100% until you verify that it really came from the sender it claims to be from. Furthermore, some spam addressing us by our names doesn't pretend to come from known senders. It uses your name to get you to read the contents and click on the links without second thought, as though sent by some forgotten friend or contact.

If you receive an email message that refers to anything work related, but doesn't positively come from someone you would expect to send you such a message, it is possibly a scam. Watch for keywords related to working at home, making more money, or anything involving money or work.

With so many people out of work and looking for jobs online, work at home scams are rampant. Most I have examined have a link to a fake website that looks like a television station news site. They include seeming positive reviews from happy people who supposedly used their method. However, everything on those websites is bogus. They are created from templates distributed by criminal spammers, placed on botted PCs, or hosted by spam-friendly web hosts in places like China, Romania, Russia and Serbia. You are asked to pay for materials and leads that may never arrive.

Whether you receive anything in the mail or not, your personal legal name, address and credit/debit card information will go into a database maintained by criminals who are in the money laundering business. Later on you may be contacted by members of these cyber crime organizations and be solicited for a "Money Mule" position. Money Mules are typically people who are tricked thinking they are performing a paying work at home job for a legitimate company. Many are used as a one-time conduit to process stolen funds that are deposited into their bank accounts, after which they send them on to a foreign recipient, then await the promised commission - which often never arrives.

What the Mules don't (usually) know is that the money they are processing was stolen by a Zeus or SpyEye Trojan - that was planted on a computer that was used to conduct financial transactions by innocent employees of small, medium and large size companies. Once the theft is noticed and reported to authorities, the Police follow the money, directly to the Mule used to transfer it out of the Country. Then they come for YOU!

Money Laundering is a Federal crime in the US and Canada. Money Mules are usually caught and prosecuted, then fined and sometimes imprisoned, for participating in these scams, whether knowingly or unknowingly. Don't fall for Work At Home scams, or money transfer "jobs" offered by online companies, or unsolicited email.

A good email spam filter can identify work at home and money mule scams before you are tricked into opening the email in your desktop email client. I happen to write spam filters for one of the foremost desktop spam detection applications in the World: MailWasher Pro. My custom spam filters detect most work at home and money mule come-ons and flag or auto delete them.

Posted by Wiz at 4:30 PM | Permalink

back to top ^

This week my spam percentage has increased slightly, to 29%, up 2% from last week. The subjects are exactly the same as they have been for the last year. Spammers are still pushing bogus male enhancement herbals, like the MaxGentleman, Chinese replica watches, counterfeit Cialis and Viagra, various illicit prescription pharmaceuticals, HCG weight loss scams, lottery and work at home scams.

Pharmaceutical spammers are still hosting their websites in Romania and are still using mostly .RU domains (Russian). All are advertising that they sell prescription drugs without the required prescription. Some are still falsely claiming to be "non-USA licensed pharmacies" - of which there is no such thing. The drugs they sell are counterfeit and both dangerous and unlawful to import into the USA or Canada.

This past 7 days, spam for various types of garbage amounted to 29% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from July 10-17, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 29%; +2% from last week
Number of messages classified as spam: 117
Number classified by my custom spam filters: 104
Number and percentage of spam according to my custom blacklist: 6
Number classified as spam by the Bayesian Learning filter: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 19

The order of spam categories, according to the highest percentages, is as follows:

Male Enhancement scams: 28.83%
Counterfeit Watches: 17.12%
Other Filters (with small individual percentages): 9.91%
Pharmaceuticals (unlawful to import into the USA): 9.01%
Fake Viagra and Cialis: 9.01%
Weight Loss Scams (e.g. HCG): 5.41%
My Custom Blacklist: 5.41%
Lottery Scams: 3.60%
Known Spam Domains: 2.70%
Work at Home Scams: 2.70%
.BR, .CN, .RU, .UA spam domain links: 2.70%
URL Shortener Spam Link: 2.70%
.DNS Blacklisted Servers (e.g. SpamCop, Spamhaus): 0.90%

This week I made 4 updates and/or additions to my custom filters:
Diploma Spam (added area code 832),
Known Spam Domains (added perfectdeliveries.com),
Unlicensed Prescription Drugs (added Avandia),
Work At Home Scam

I made 0 addition to my custom Blacklist this week:

There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Posted by Wiz at 3:37 PM | Permalink

back to top ^

This is my third article (see links at end) this calendar year about email archiving solutions for small and medium sized businesses. If you own or administer a business that uses email as an important tool for doing business, these articles will be of high importance to you and your IT staff. Today's article is about choosing the right email archiving software.

In today's business environment, email communication has become an essential tool, especially for small and medium-sized businesses. Laws and regulations related to the retention of email and other types of digital communication have increased, putting most businesses in a tough spot in which to balance their business needs and complying with on-going regulatory requirements. In addition, most small and medium-sized businesses do not have a robust IT department so having to worry about email storage issues, quota limits, eDiscovery laws, and other technical issues related to email takes time away from growing and expanding the business.

Email archiving can help with most of these issues if the right solution is used. As with any type of software, one size does not fit all. Be aware of your business IT environment and your business needs before searching for any email archiving solution.

Here are the features to look out for when searching for the right email archiving solution:

1. The ability to archive one or more databases: I would not want the archiving solution to archive emails to the mail server. This can cause performance issues and cause quota limit issues with the email server. There is no point in implementing something to solve one problem and to then cause another.


2. Users should have offline access to archived emails: Having a company's email archived but not easily accessible by users is a major drawback, and that is why a solid email archiving solution will provide access to email either through the email client or through web access. Users want to be able to access their archives if they are on the road, they have problems with their email client or only have basic web access. Providing offline access ensures continuity for the company and puts minds at rest that all their email, old or new is available with a few keystrokes.


3. Solve the issue with PST files: This type of offline access feature is usually a much better solution than using PST files which are difficult to manage and which put your email at risk as they can be lost once the PST is corrupted. Once you deploy an email archiving solution within the organization, you automatically eliminate the need to use PSTs - meaning goodbye to the headache of having to dig through a store of PSTs manually, goodbye to the risk of losing emails, goodbye the need to do PST backups; and hello to automatic email archiving in a central archive accessible to all which saves your admins priceless time, and the organization money.

Most email archiving solutions come with a variety of features. The ones mentioned here are only the highlights of such software. I would evaluate all email archiving solutions based, at least, on their ability to archive to a database and to allow users both online and offline access to their email archive.

This guest post was provided by Sean McCreary on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. More information: GFI email archiving.

This is the third article about email archiving solutions, posted on this blog. See these previous articles for some background information:

• How to deploy an email archiving solution within your organization


• Mail archiving: Easing the load on your mail server - and yourself!

Posted by Wiz at 12:09 PM | Permalink

back to top ^

It appears that my spam percentage has stabilized at about 27%, plus or minus a few points. The subjects are exactly the same as they have been for the last year. Spammers are still wasting their money spamvertising counterfeit Cialis and Viagra and pushing bogus male enhancement herbals, like the MaxGentleman aka Dr. Maxman and various illicit prescription pharmaceuticals without the required prescription. Knockoff Chinese watches, weight loss herbs, loansharks, and Nigerian advance fee fraud round out the field.

The majority of this week's pharmaceutical spam was for various incarnations of the fake "My Canadian Pharmacy," et al. The domains are all owned by Russians, using cheap domain Registrars in Russia, Czechoslovakia, and other parts of the former USSR, as well as some from a dis-accredited Registrar in Australia. Almost all of the current fake pharmacy domains use either Russian or Chinese Name Servers. At least half of the links in the spam messages for these pharmacies are to .RU (Russian) domain websites, many of which are now hosted by spam friendly hosting companies in Romania.

This past 7 days, spam for various types of garbage amounted to 27% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from July 3 - 10, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 27%; +1% from last week
Number of messages classified as spam: 124
Number classified by my custom spam filters: 116
Number and percentage of spam according to my custom blacklist: 6
Number classified as spam by the Bayesian Learning filter: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 7

The order of spam categories, according to the highest percentages, is as follows:

Male Enhancement scams: 25.20%
Fake Viagra and Cialis: 18.70%
Pharmaceuticals (unlawful to import into the USA): 13.01%
Weight Loss Scams (e.g. HCG): 12.20%
Counterfeit Watches: 12.20%
My Custom Blacklist: 4.88%
Known Spam Domains: 4.07%
Other Filters (with small individual percentages): 3.25%
African Sender Scams: 1.63%
Loan Scams: 1.63%
Non-English Language Spam (French and Spanish): 1.63%
HTML Tricks (to position letters into spam words): 0.81%
.DNS Blacklisted Servers (e.g. SpamCop, Spamhaus): 0.81%

This week I made 1 updates and/or additions to my custom filters:
New filter: .doc attachment (was used in some recent Nigerian 419 Scams)

I made 1 addition to my custom Blacklist this week:
[email protected]

There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

One side note and word of caution:
If you are a member of Facebook and you have set your Notification options to send you emails for everybody who comments after you, on your or somebody else's Wall, or Feed, you probably get a lot of these email notifications. Before you click on the link to "see Comment" or "See Comment Thread," hold your mouse pointer of those (button) links and read the destination URL in the Status Bar. Make sure that the link begins with http://www.facebook.com/... before you click on it. If that part of the domain name is anything else, it is probably a phishing scam.

If you don't know what the Status Bar is, read my article from July 9, 2011, titled How to display and use the statusbar in your email client.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Posted by Wiz at 1:57 PM | Permalink

back to top ^

Prologue

Recently, I have published blog articles describing spam emails containing links to disreputable URLs. I have mentioned in these articles that one means of self defense against visiting obviously bad locations is to hover over a link and read the actual URL of that link - in your email client "Status bar." But, what if there is no Status bar showing in your email reader? How do you reveal it?

This brief technical article will show you how to show a hidden "Status Bar" on the most commonly email clients (in 2011). It also explains why having this bar visible is so important and a brief tutorial on making sense of the details that are displayed when one hovers over a link with their mouse pointer.

Displaying Email Client Status Bars

If you still have Windows XP (or, earlier; shudder the thought), you may have Microsoft's Outlook Express as your default POP3 email client. Others using XP, or Vista, have gotten the message about Outlook Express being deprecated (abandoned) by Microsoft and have moved up to Windows Live Mail (aka: WLM). People using Windows 7 are only offered Windows Live Mail 2011 (and newer, yet to come versions). All three versions have the means of turning the Status Bar on and off.

To show or hide the Status Bar in Outlook Express, Windows Mail (Vista only) and Windows Live Mail for XP and Vista, open the program, go to the menu bar item View, then click to place a check mark in Status Bar. It's that simple!

If you use Windows 7, your version of Windows Live Mail is probably version 2011 (or newer version, yet to come). Your interface is different than Outlook Express and the WLM for XP. To show the Status Bar, open the program, click on the "View" button in the row under the Title Bar, go to the right side and click the button labeled Status Bar. It appears (or disappears) instantly. Done!

If you are using Mozilla Thunderbird as your email client and for some reason the Status Bar is hidden, you can bring it back thusly: go to View > Toolbars > Status Bar and click to check it. The Status Bar will appear instantly.

Other email clients will have their own methods of turning the Status Bar on and off. I recommend leaving it on, all the time. Here's why...

The importance of having a visible Status Bar in your email reader (aka: client)

The main purpose of any Status Bar, whether on a web browser, ftp program, or email client, is to display information about the destination of hyperlinks (commonly called "links"), when you hover over them with your pointer. Secondary purposes include showing the progress of page loads, downloads, error messages, and in the case of email clients, the number of new or read messages and whether you are online or offline.

When you have a Status Bar visible in your desktop email client, anytime you hover over a link, no matter what the text in the email text says, the destination URL will be displayed in the Status Bar. The link might say "Login to your Account," or "I thought you might find this interesting." It might claim to go to a Facebook profile, whatever; it is just text placed between an opening html a href tag and a closing /a tag. The actual destination is only visible if you have a Status Bar, or, if you hover and right-click (option click, not execute click) then copy the link location and paste it into a safe document (or Wannabrowser input -> see * below)

So, if you receive an email from a friend, or contact, and all it contains in the message body is a link, or some odd text and a link, hover over that link and read the URL in the Status Bar. If the URL is a numeric IP address (for example, http://192.168.0.127/whatever), it is probably pointing to a hijacked PC somewhere, which may be hosting a malware exploit kit, or a spam page promoting counterfeit drugs or watches.

However, the use of numeric IP addresses in spam emails is very rare these days. It peaked during the reign of the Storm Botnet, in 2007. Nowadays, spammers can purchase throwaway domain names (from bargain or shady Domain Registrars) so cheaply that they sometimes buy them by the thousand. So, every few days, the domain name shown in spam links changes. But, some are more obvious than others.

Making sense of the domains shown in the Status bar

To me and most North Americans, the most common domain extensions (the 2 to 4 letter part after the period) are .com, .net, .org and .info. Therefore, if you hover over a link in a suspicious email message, and the domain part of the URL ends in .ru, it should set off your alarm bells! That means it is a Russian domain. Unless you are doing business with a legitimate Russian company, or person, I would treat all links going to .ru destinations as absolutely no-go's. Ditto for links pointing to .cn, .kr, .ua, .ro and several other potentially dangerous country code destinations.

<rant>
I write frequently about spam issues and fake pharmacies. Lately, there has been a scourge of Russian domain links leading to variations of the totally fake Canadian Pharmacy. Some are called My Canadian Pharmacy, some Canadian Family Pharmacy, etc. Whatever name they go by; they are all rogue websites, created and managed by Russian and Ukrainian cyber criminals. The drugs they sell are counterfeit and often dangerous to your health. There are zero US licensed off-shore pharmacies. ZERO! It is illegal for US residents to import any prescription drugs, or controlled Schedule 3 or 4 narcotics into the USA, from any other country, including Canada.

The reason I mentioned all of these details about the fake pharmacies, is because they often make bogus claims that they are licensed in the USA. I see such subject lines as "non-USA Licensed Pharmacy." Bullshit! Ain't no such animal! Totally false claim. The web pages one sees, if they are foolish enough to click on links in spam email messages, often contain logos for various alleged accreditations, all of which use stolen graphics, with links leading right back to the same fake website you are already on. Please don't fall for these scams!
</rant>

It is easy to guess that links to foreign domains are likely to fake pharmacies, or counterfeit watch sellers, or worse, to exploit attack sites. But, it is not so obvious in the case of links to .com domains. To get the lowdown on these destinations, without going to them, hover over the link and right-click. Note: If your mouse buttons are purposely reversed, for left handed use, then you would have to left click to get the same result as a right-handed person. Assuming you are right-handed, mouse-wise, right clicking gives you options, rather than executing an action (visiting a link's destination). The option you want is to "Copy the link location."

Tracking suspicious link destinations and gathering intelligence about them

* With the suspicious link URL copied, go to www.wannabrowser.com and paste that link into the "Location" field, replacing the http:// that is already in it. Then for reasons I won't explain, type a dash (-) into the "Referrer" field. Place check marks in the two options: "Show HTTP Response Headers" and "Follow Redirects," then click on the "Load URL" button. (If possible, make a donation for the free service while you are there). The HTML Output of the destination will be displayed in a large text area below and the actual domain name and web page, and IP address of that website will appear on the right side of the input fields, under Request Response Summary. This is very important information which can be used in what are called "Whois" look-ups.

First, look at the source code in the HTML Output field. If the second line begins with: Server: nginx/, you are looking at a free Russian http web server named Nginx that is that favorite of most botnet operators. There are some, but not in my experience, many legitimate websites operating on the Nginx server. 99.99999% of Nginx websites are rogues. 100% of Nginx web server sites that delivered via unsolicited email message links are rogue.

If you continue reading the details of the source code you will probably come to a line that is between Title tags. That is the title of the website that would normally appear in the Title Bar of your browser, if you have actual clicked through to that (phoney) website. The title tag usually reveals all you need to know about the nature of that business. The detective work involves going over to the upper right side, to "Request Response Summary" and copying the name of the final destination domain, then go to www.domaintools.com and paste it into the Whois Lookup input field and click the "Search for Domain" button. The resulting page will tell you much about the domain, including the name of the Registrant and the names of the "Name Servers." In the case of many of the rogue pharmacies, the name servers end in .cn (China) or .ru (Russia). You can use this information to file a complaint with the domain's Registrar and their hosting service. I have frequently used this information to get spam domains suspended.

Using the Status Bar to alert you to Phishing scam links

In addition to links for fake pharmacies and exploit websites, you also have to be wary of Phishing scams. If you receive an email that appears to come from PayPal, or your bank, etc, and it doesn't address you by your proper name, as they normally do, carefully hover over all buttons and links and read the domain part of the URL carefully. While Phishers often register look-alike domains to fool scam recipients, a wary person will spot a fake destination instantly. The actual domain follows the http:// and ends to the left of the first single forward slash (/). The URL may contain www, or it may not. There could be a sub-domain name in front of the actual master domain. This might be the Octopus Juice put there to blind you to the actual destination.

In view of the extent to which scammers are able to register domains with names similar to authentic domains, you should make it a point to save legitimate email fro all financial institutions with which you deal and use them as a reference. If an email claims to be from PayPal, and you are a PayPal member, hover over the links and write down the first part that contains the actual domain (ignore everything after the first single forward slash). Then, go through your saved important email and find a legitimate email from PayPal and hover over the links in it. Compare the domain and sub-domain used and you will see if they are similar, identical, or totally diverse.

Epilogue

All of this identification work is accomplished by means of the Status Bar at the bottom of your email client. Don't operate without it showing. Don't left click to go to a linked website until you identify the location from the Status display and confirm that it is an authentic destination, and not a Phishing scam or link to a rogue pharmacy. Don't click on numeric domain links at all, unless you personally requested them for a specific reason and they were sent by the person or company you requested them from.

These tips should help you make sense of URLs that are actually inside links. following my tips will keep you from making what could be a serious error of judgement which could lead to your computer getting hacked, or you credit/debit card being used to purchase illicit goods. Should you do such a foolish thing, know that criminals now possess your credit/debit card details, your email address and your actual mailing address (probably your actual residence).

Stay safe and practice Safe Hex!

Posted by Wiz at 3:42 PM | Permalink

back to top ^

Most people who see an obvious spam email message, based on the "Subject" or "From" fields, just delete it on sight. I often go one step further and examine the normally hidden source code. This gives me an insight into some tricks employed by criminals to get their spam messages past the spam filters used by many ISPs and email providers. This helps me to develop new, or modify existing spam filters that I publish for MailWasher Pro users.

I have seen many changes in spam composition tactics over the years I have spent fighting spammers. One trick that used to be prevalent a few years ago is making a big comeback right now. That is the use of "ISO Encoding" for the Subject, From and sometimes other fields in the normally hidden email headers. This type of encoding has legitimate uses and senders (like Yahoo), so don't rush to premature conclusions and block everything containing an ISO subject.

What is ISO encoding and why do spammers employ it as an evasion tactic?

ISO is the World-wide International Organization for Standards that establishes common standards for all manner of interoperable systems that are used around the World, to allow them to interact with one another. This includes the standards of email systems and the coding used in email messages. One of the email standards established and defined by ISO is the email header "Codepage" encoding system. This system is used to tell an email client (program/reader) what language the message is written in and how to render the contents when it is opened.

The default Codepage system used in English language email messages is known as ISO-8859-1. It corresponds to the "Latin-1" and "Windows 1251" character sets. If an email is composed without any declaration of Codepage, and is sent through a mail servers assigned to Western languages, it is automatically displayed in English, using the default display of the user's computer.

Since email composed in one language locality is frequently sent to recipients with a different language and alphabet, senders can specify that they are asking those messages to be displayed in the language and alphabet of the recipients. This is where the use of ISO encoding in the email headers comes into play. It is used frequently by International companies in email blasts to numerous recipients around the Globe.

Spam email also benefits from ISO encoding. Here's how:

Many free email systems, like Microsoft's Hotmail, are plagued with "bots" used by spammers to break security challenges (e.g. CAPTCHA), open new free mail accounts using bogus information, then send out spam blasts to the recipients listed in spam databases. They spammers may get only one or two successful spam runs before they trigger alarms at the email provider and the account gets shut down. But, to ensure that the spam actually gets out at all, they have to make sure it isn't blocked by the outgoing email server's spam detection filters. In English speaking Countries, the default spam filters are written in English and match English language words and phrases.

Spammers using these free email providers have learned that one of the easiest ways to avoid having spam messages blocked by outgoing filters is to not use English words and phrases in the From, Reply, or Subject fields. Instead, they are resorting to the use of ISO encoding tricks. The outgoing spam filters look at the hidden headers and well as a snippet of body text, looking for significant matches. Many incoming mail servers also use the same spam detection systems. By using ISO encoding in the From and Subject, one can sneak spam words past many common spam filters.

Once these messages arrive in recipients' inboxes, their email program ("client"), or web-mail browser, translates the ISO codes into the language specified in the Codepage declaration. In the case of ISO-8859-1, the displayed words will be in standard American English. The recipient does not see any of the coding tricks, just the decoded letters and words. The message slipped past anti-spam filters at the sending end and at the receiving email server, both of which look at the headers first and then so many lines of the body text.

Most of the ISO spam messages also use ISO or other encoding tricks, gibberish (salad words) and non-displaying text hidden inside html style tags, in the beginning of the body, moving the actual spam words and links way down, past where most commercial spam filters give up.

If you want to learn more about the use of ISO encoding, as it pertains to spam filters and email, read my extended content.

What does a hidden ISO-8859-1 encoded From or Subject look like?

From: "=?ISO-8859-1?Q?=4D=65=64=73=34=4C=65=73=73?="

Subject: =?ISO-8859-1?Q?=47=45=54=2D=56=31=41=47=52=41=2D=43=49=41=4C=49=53=2D=4C=45=56=49=54=52=41=2D=38=4F=25=2D=30=46=46?=

Translated by your email client, these codes become recognizable words about Meds or online pharmacies, and include the names of popular anti-ED prescription drugs, with registered trademarks being violated by the purveyors of illicit fake pharmacies selling counterfeit pharmaceuticals. See my Spam Issues category of this blog for more articles about various fake pharmacies and the criminals running them.

To see this one must know how to display the headers or source code of the incoming message. If you use a real email "client" - like Outlook Express (deprecated), Windows Live Mail, you can easily display the source code of any message as it sits unopened in your inbox. Just right-click on the message, then move your pointer all the way down to "Properties" and left click to open a box with the properties. Click on the "Details" tab to see the hidden headers, which are shown in a much too small text field. Click on the button labeled "Message Source" and you will have a large, expandable window open, with not just the headers, but the entire source code of everything in the email message.

If you use your web browser to read email, read the article I wrote in 2006 about "How to display the headers of spam/scam emails..." - or check your web-mail "options" or "preferences" links to see how you can display the "full" or "complete" "incoming headers."

Spam fighters who belong to SpamCop use this feature to display, then copy the entire spam message source code, then paste it into a SpamCop report and submit it. I do this with every spam message that makes it past my auto-delete spam filters. Since I also use MailWasher Pro, which screens incoming messages before I download them to my email client, I am able to submit spam directly from the program interface, to SpamCop. I have to acknowledge an email reply and click on its link to actually file the report, as per SpamCop's requirements. However, it saves the time that would be wasted opening the source code, copying it and then logging into SpamCop and pasting it into the report field.

Since MailWasher Pro can read the hidden headers, it is trivial to write a spam filter that detects the use of ISO-8859-1 (as shown above) encoding in the headers and label any message having that encoding as possible spam. When you look at the Subject and/or From columns, in the MailWasher interface, you will see the translated characters and words, as intended by the sender. I simply whitelist any known legitimate senders who use this encoding and automatically delete everything else. It works for me!

Spammers don't just use ISO encoding to display English words. Lately, for reasons as yet unknown, I have been receiving Spanish and French language spam. These messages often make use of a different ISO Codepage for render the accented characters used in these foreign (to me) languages. If some spammer thinks that the recipient reads Oriental he will use one of the Oriental Codepages. You might as well send me Canaanite-Phoenician hieroglyphics as any Oriental character sets!

Again, I was able to write a MailWasher filter that detects accented characters and words common the French and Spanish, but not English. You can read about my MailWasher Spam Filters here. They are free to download, but, donations are very much appreciated!

Posted by Wiz at 1:41 PM | Permalink

back to top ^

Today I traced a spam email claiming to be a message from Facebook Support, with the subject: "Facebook Support has sent you a message." The spam was sent through a hijacked email server belonging to an NTT owned Verio Web Hosting customer's account. The link in the fake Facebook button led to a fake Canadian Family Pharmacy website, hosted in Bucharest, Romania.

This is a known rogue online pharmacy that is part of a huge spam operation run by a Russian spam affiliate program called Eva Pharmacy, which grew out of Bunker.biz. The people behind this spam operation are a tight-knit group of criminals known as Yambo Financials, based in the Ukraine.

The domain name used in the spam run uses JavaScript redirection to take you to the actual website, which, although it claims to be the "Canadian Family Pharmacy," uses the domain name (this time): medicarerxdrugstore.com. A Whois lookup of that domain reveals that it was registered on April 18, 2011, by someone claiming to be (or using stolen identity of) Ekaterina Nevzorova; ul. Turgeneva d.110 kv.19; Krasnodar; Krasnodarskiy kray,350000; Russia.

Clicking through the link in the fake Facebook message leads one to 188.229.97.110, which is a Romanian web host, shown below.

Input URL: http://medicarerxdrugstore.com
Effective URL: http://medicarerxdrugstore.com
Responding IP: 188.229.97.110

Host 188.229.97.110
Location RO RO, Romania
City Bucharest, 10 -
Organization SAFE TELENET SRL
ISP SAFE TELENET SRL
AS Number AS50068 SAFE TELENET SRL

The web page that was displayed claimed to be the Canadian Family Pharmacy, with an address near the bottom of the page, claiming to be: 913 Montreal Road, Ottawa, ON, Canada. This is a non-existent address that has been used since at least 2009 by the same Yambo and Bunker.biz cybercrime gangs to advertise their various fake pharmacies. Everything about the pharmacy is fake, including the drugs they sell, which are produced in counterfeiting factories in India and China.

If you receive an unexpected email claiming to be from Facebook Support, hold your mouse pointer over the link or button (labeled See All Messages, or similar). You will see the actual destination in the status bar on the bottom. If your email client or browser lacks a status bar, hover over the link and right-click, then select Copy Link Location. Open Notepad, or your preferred text editor and paste the link into a new blank document. You will see that the URL does not lead to anything.facebook.com/, but, to either a weird domain name, or a numeric IP address. The message I traced had the numeric IP address: 200.58.119.150, that was for a hijacked computer in Argentina.

I pray that none of my readers will fall for this, or any other fake online pharmacy, whether they claim to be Canadian, American, or from The Borg Collective. They are fake, selling counterfeit drugs and are run by master criminals in the former USSR. If you actually do receive the items you paid them for, you are getting counterfeits, with God knows what ingredients and dosages. Contact your bank, or credit card issuer and request a refund, based on fraud and request a new debit or credit card number (criminals have the card number used to make your purchase on file).

See my Spam Issues articles for more expose's about fake pharmaceuticals spam and the Romanian and Russian connections to most of it.

Posted by Wiz at 1:58 AM | Permalink

back to top ^

Spam levels are continuing to decline, at least in my email accounts. This time last year, my percentage of spam email was 56%. This week, this year, it measured just 26%. That is a 54% decline in 12 months. The spam detected and deleted by MailWasher Pro was mostly for bogus male enhancement pills, which led by a 2:1 margin over other types of pharmaceutical and weight loss scams. Counterfeit watches and Nigerian lottery scams had measurable percentages.

I managed to trace several spam domains with the Russian .RU and some .COM TLD's to Romanian web hosts. Additionally, the SpyEye/Zeus Trojan Tracker, at Abuse.ch has traced down several SpyEye command and control servers to a Romanian hosting company. From Count Dracula to the Zeus and SpyEye Trojans, to fake pharmaceuticals and male enhancement scams, the Romanians have it all covered, with help from Russian Botmasters and master spammers. It is Russian and Romanian spammers who are paying to register and host hundreds of throwaway domain names, used in bot-sent spam blasts, promoting all manner of fake and illicit pharmaceuticals and herbals and exploits.

There was a measureable uptick in the amount of email containing direct links to exploit websites. My "Exploit Link" filter detected and deleted them all (see info on my custom MailWasher Pro filters, further down). Most led to the Zeus or SpyEye bank credential stealing Trojans.

Despite the fact that the volume and percentage of spam is declining right now, the threats contained in what is being sent are becoming more dangerous all the time. More and more spam is being sent after recipients identities are researched by spammers, who buy stolen IDs after break-ins of big company member databases. Others use password breakers to steal weak login credentials to free email systems, then send out spam targeting the entire contact list of the people who own those compromised email accounts. This happens constantly to Hotmail users.

You may have already received spam and scams targeting you by your personal or nickname. Therefore, effective email protection is required to protect your computers, your money and your data. MailWasher Pro is the program I use to detect and delete spam and email-borne security threats. My spam statistics are obtained from the program, showing how effective it is as a spam fighting tool.

This past 7 days, spam for various types of garbage amounted to 26% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from June 26 - July 3, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 26%; -1% from last week
Number of messages classified as spam: 114
Number classified by my custom spam filters: 104
Number and percentage of spam according to my custom blacklist: 6
Number classified as spam by the Bayesian Learning filter: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 11

The order of spam categories, according to the highest percentages, is as follows:

Male Enhancement scams: 32.43%
Pharmaceuticals: 14.41%
Fake Viagra and Cialis: 11.71%
Counterfeit Watches: 9.91%
Weight Loss Scams (HCG): 7.21%
Other Filters (with small individual percentages): 6.31%
My Blacklist: 5.41%
.BR, .CN, .RU, UA Spam Domain Links: 3.60%
Known Spam Domains: 2.70%
Exploit Link: 1.80%
PDF Attachments scams: 1.80%
Lottery Scams: 1.80%
DNS Blacklisted Servers: 0.90%

This week I made 3 updates and/or additions to my custom filters:
.BR .CN .RU .UA Domain Link,
Exploit Link,
URL Shortener (Spam) Link
Work At Home Scam

I made 0 addition to my custom Blacklist this week:

There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Posted by Wiz at 2:45 PM | Permalink

back to top ^