Re: MSN messenger spam?

["Aryeh Goretsky (home)" <goretsky () gmail com>]

Hello,

My initial thought is that the botnet sending the message
recently changed ownership, perhaps after being hijacked
by a rival or a disagreement in the organization operating
it.

Next thought is the botnet operator had a falling-out with
the upstream entity paying for the IM spam, however, that
does not explain why the operator would choose to cannibalize
the network by doing something that would generate lots of
complaints to the IM service.

I am therefore going with the "hostile takeover" theory.

Regards,

Aryeh Goretsky


At 09:50 AM 12/10/2009, you wrote:
> Content-Transfer-Encoding: 8bit
> From: Alex Lanstein <ALanstein () FireEye com>
> Precedence: list
> MIME-Version: 1.0
> To: "funsec () linuxbox org" <funsec () linuxbox org>
> Date: Thu, 10 Dec 2009 09:35:20 -0800
> Message-ID: <60B0F2124D07B942988329B5B7CA393D020BE87518 () mail2 FireEye com>
> Content-Type: text/plain; charset="us-ascii"
> Subject: [funsec] MSN messenger spam?
> Message: 9
>
> I get a fair amount of MSN messenger spam as I'm sure most 
> do.  Usually it's something like this:

> (8:55:50 PM) aimeebiwileru () hotmail com: hey i'm Lynn, i thought you 
> seemed interesting...add me as a friend if you wanna chat ;] 
> http://www.eHomePartner.net/?profile_ID=xoxLynxox
>
> (8:02:52 PM) daniellezygeb () hotmail com:5 Blowout Clearance Sale on 
> Rolex, Louis Vuitton, and Tiffany and Co! http://lampcool.com
>
> But the last couple days I'm getting this:
>
> (12:21:33 PM) aimeebiwileru () hotmail com: n***** (where that is the "n bomb")
>
> Conversation with beatrizsalafa () hotmail com on 12/7/2009 8:59:52 AM:)
> (8:59:52 AM) beatrizsalafa () hotmail com: n*****
>
> Anyone else seeing this?  What's the purpose of that exactly?

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.