Nasty Spam Tool

Near Enough Untracable

[xcandyman]

Just read this Wired article about a new tool for spammers that cloak websites that are near enough untracable.

Wired Artcle [wired.com]

" Until now, antispammers have relied on such tools to identify the numeric Internet protocol address behind a website advertised by spam. In the past, shutting down a site used to sell spammed products -- or to rip off gullible online users via phishing schemes -- was often just a matter of notifying the hosting company responsible for the IP address. "

Whois for a untracable website [amail.co.uk]

Refresh the page again and you get different traceroute information everytime.

Say hello to more email spam...... ;-(

[bird]

The mentioned domain resolves to 5 different IPs (hijacked dialup or DSL boxes), and that's all the variation in there. The software installed on those boxes by some worm or virus appears to proxy the requests to the real target. You just need to shut down those proxies instead of the real site.

As the article mentions, an alternative would be to block the DNS service returning those IPs. In this case, the DNS comes from name-services.com, which purportedly is owned by eNom.

I even see a third defense. The owners or ISPs of those hijacked addresses could press criminal charges against eNom for theft of service, and possibly theft of identity. And if the whois entry for name-services.com turns out to be fake, then ICAN could reprimand them for violating the registrar guidelines.

Lots of fun ahead in any case...