Report joe-jobs here.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Sat Apr 19, 2014 6:45 am

Subject: Why Internet was born?/PORN!/Best porn Targeted domain: h2porn.com. As mentioned in a comment by [url=https://www.mywot.com/en/scorecard/h2porn.com/comment-77870957 t=_self]mmoni[/url] the 'spam' subjects have also included the typical joe-job subject of child pornography. A comment by [url=https://www.mywot.com/en/scorecard/h2porn.com/comment-77878941 t=_self]mysurfingbird[/url] from April 4th shows that the site recently has displayed a disclaimer that it was a victim of spam send through a 3rd party.
Alleged spam was mostly sent through yet unidentified botnets, but also through the Slenfbot, which has a long reputation of being abused for joe-jobs, as is shown in several of the earlier comments listed above this one.
Unnamed botnet:
http://cbl.abuseat.org/lookup.cgi?ip=86.57.219.70
Slenfbot:
http://cbl.abuseat.org/lookup.cgi?ip=86.47.229.33 ;
http://cbl.abuseat.org/lookup.cgi?ip=212.57.180.40 .

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu May 08, 2014 2:30 am

Subject: Headlines and Kuzbass Novokuznetsk/News Of Kuzbass/
Novokuznetsk Internet TV
Targeted domain: nk-tv.net. Targeted domain is Russian Novokuznetsk Internet TV which features regional news, and will therefore not send worldwide spam. The site also has an announcement on the site about a spam attack. Quoting the site's statement:
Website NK-TV.NET has been attacked by anonymous hacker forces. The meaning of the attack is hundreds of SPAM messages upcoming to a big range of random e-mail addresses. These messages contain advertisement of our site. The goal of hacker is to make recipients of SPAM be nervous and start complaining about NK-TV.NET to provider that hosts our server. They hope that provider will delete our site as a spam source.
We officially claim, that we have not ordered such cruel type of advertising.

May 5 we appealed to police with the request to find and punish the hackers.

We are very sorry. Thank you for your patience.
Click [url=http://imageshack.com/a/img838/6327/72o7r.jpg t=_self]here[/url] for a screenshot of this message from NK-TV.NET (in English and in Russian) at Imageshack.

As usual the joe job is using compromised systems that are part of yet undefined botnets:
http://cbl.abuseat.org/lookup.cgi?ip=178.125.196.131 as well as through the ZeroAccess botnet, also known as Sirefef:
http://cbl.abuseat.org/lookup.cgi?ip=185.6.25.239 .


Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Thu Jun 12, 2014 8:27 pm

Subject: No taxes no problems! / Say NO to taxes! Say YES to bitcoins with dedicatedpool.com!
Targeted domain: dedicatedpool.com, which is a domain about "mining" of virtual money (like Bitcoin).
Enormous amounts of messages are being send, as always through systems that are part of spambots. In this joe job the forged sender names come as unlikely as "s_p_a_m_m_i_n_g@thumpernet.com".
It should be remembered that senders of real spam go to great lengths to obfuscate the messages in such a way, that those will not be too easily recognized as spam. Joe jobs like these however are always using subjects, content or forged addresses that intend to cause that they will be considered to be spam, and will be reported as such.
Inclusion in this joe job list as always only is meant to inform that a domain is targeted by a joe job. It is not an opinion on whether the domain is "good" or "bad". The scorecard of the [url=https://www.mywot.com/en/scorecard/dedicatedpool.com t=_self]domain[/url] as well that of the sub-domain [url=https://www.mywot.com/en/scorecard/dark.v2.dedicatedpool.com t=_self]dark.v2.dedicatedpool.com[/url] reflect that this has been recognized as a joe job.

NotBuyingIt
Posts: 6560
Joined: Fri Mar 11, 2011 6:21 pm

reputation of pohudeu.com attacked

Post by NotBuyingIt » Wed Aug 27, 2014 2:54 am

A joe-job spam campaign to destroy the reputation of pohudeu.com ([url=https://www.mywot.com/scorecard/pohudeu.com t=_self]scorecard[/url]) has been reported to the InBoxRevenge forum. Details are at http://ksforum.inboxrevenge.com/viewtopic.php?p=64811#p64811

NotBuyingIt
Posts: 6560
Joined: Fri Mar 11, 2011 6:21 pm

RE: Report joe-jobs here.

Post by NotBuyingIt » Fri Aug 14, 2015 4:17 pm

A joe-job spam campaign to destroy the reputation of bestmoverstoronto.ca ([url=https://www.mywot.com/scorecard/bestmoverstoronto.ca t=_self]scorecard[/url]) has been reported to the InBoxRevenge forum. The spam is being chiefly directed to email addresses that are very likely to detect it and report it as spam and very unlikely to use movers' services in Toronto. (I have no opinion about the site itself.)

alphacentauri
Posts: 3291
Joined: Mon Nov 02, 2009 12:52 pm

RE: Report joe-jobs here.

Post by alphacentauri » Sat Aug 15, 2015 4:48 pm

<quote user="notbuyingit">
A joe-job spam campaign to destroy the reputation of bestmoverstoronto.ca ([url=https://www.mywot.com/scorecard/bestmoverstoronto.ca t=_self]scorecard[/url]) has been reported to the InBoxRevenge forum. The spam is being chiefly directed to email addresses that are very likely to detect it and report it as spam and very unlikely to use movers' services in Toronto. (I have no opinion about the site itself.)
[/quote]

I gave the site a green rating because it's red now and there's no way to post a comment without rating. My comment:
Obvious victim of a joe job:
Sent to email addresses on known spam-reporter lists
No attempt to conceal the domain name of the "sponsor" website
No affiliate link to provide credit to the spammer.

Wonder what Best Movers Toronto did to make criminals want to retaliate? Good work, whatever it was.

But please don't make joe-job victims' lives any harder by reporting them or downvoting them on WOT. Use your head when you suddenly get a bucketload of spam with links that meet the above criteria.

alphacentauri
Posts: 3291
Joined: Mon Nov 02, 2009 12:52 pm

RE: Report joe-jobs here.

Post by alphacentauri » Mon Oct 05, 2015 1:58 am

Lots of messages showing up today for europe-pharm.com. They have blocked traffic from the spammed link, so it's unlikely they are benefiting. The site was registered in 2009, not typical for sites that send multiple copies of spam to spam traps.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Wed Aug 24, 2016 2:12 pm

Subject: Ukrainian women are waiting to meet you . Chat online
Targeted domain: epochta.com.ua. This domain - email marketing and SMS mailing - was created over 10 years ago and has a good reputation. It is unlikely that the domain would suddenly start spamming a "Ukrainian brides"-site, and they would most certainly NOT use their own domain name to spam not existing content.

Boonsiri
Posts: 268
Joined: Tue Jun 14, 2011 10:06 am

RE: Report joe-jobs here.

Post by Boonsiri » Mon Dec 11, 2017 4:42 pm

Subject: [phishing]Best ICO or Best ICO
The domain Indahash.com is engaged in social media and was created on 2015-05-01, and in that over 2,5 year has no reputation of spamming. The 1st 3 mails I got (subject phishing]Best ICO) included in the body of the alleged "spam" the link:
hxxps://safebrowsing.google.com/safebrowsing/report_phish/ .
It is unlikely that an actually spamming site would use "phishing" in the subject, and moreover encourage reporting as phishing by including that link at Google.
The most likely explanation is that this is a joe-job against the domain indahash.com with or withoout the sub-domain /ico.

Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests