Page 1 of 9

Report joe-jobs here.

Posted: Thu Jan 17, 2013 11:09 am
by Boonsiri
For a description see: http://en.wikipedia.org/wiki/Joe-job

Very short: a joe-job is a message that is made to look like spam, to damage the reputation of someone who is the victim not the sender of that message.

Recently there has been a sharp increase in joe-jobs against domains (mostly) in Eastern Europe, that have content in a local language. The victims are varied: a pawn shop in Estonia that provides loans with cars as collateral, political and other blogs, and all kinds of online-shops.

It seems that a group of criminal spammers from that area have found a new source of income. Using the Spambots they already control, they offer paid service for any business or organization, which wants to damage a competitor (or enemy) by destroying their reputation. This reputation damage is carried out, by sending millions of fake spam-messages, that look like they were send by the website that is in fact the victim of that joe-job-campaign.

More specific information on joe -jobs, and advice on how to respond to them is at: https://www.mywot.com/wiki/Joe-job

Please submit samples of new joe-jobs in this thread.

RE: Report joe-jobs here.

Posted: Thu Jan 17, 2013 11:26 am
by Boonsiri
The most recent victims of such joe-job are the forums swimpool.biz and swimpool.cc. Both domain are also under a DDOS attack.
http://www.mywot.com/en/scorecard/swimpool.biz and http://www.mywot.com/en/scorecard/swimpool.cc

RE: Report joe-jobs here.

Posted: Fri Jan 18, 2013 10:34 pm
by alphacentauri
Still lots for narkoff.com

RE: Report joe-jobs here.

Posted: Sun Jan 20, 2013 8:39 am
by Boonsiri
narkop.me is spammed with a subject specially designed to get the attention of anti-spammers: "Legal Cocaine forum".
The site does NOT offer cocaine (in Russian кокаин); do not do what spammers want you to do.
Read http://en.wikipedia.org/wiki/Joe-job.

RE: Report joe-jobs here.

Posted: Sun Jan 20, 2013 1:21 pm
by Boonsiri
Continuing joe job against narkoff.com, a forum on legal drugs in Russian language: clearly not seeking a world-wide audience.

RE: Report joe-jobs here.

Posted: Mon Jan 21, 2013 8:49 pm
by Boonsiri
Continuing joe job against legalki.com, another forum on legal drugs in Russian language: clearly a domain that is most unlikely to seek a world-wide audience.

RE: Report joe-jobs here.

Posted: Tue Jan 22, 2013 4:44 am
by Boonsiri
ord-ua.com is a blog on political issues in the Ukraine, written in Russian. If you got spam with a link to this blog, it was not sent by ord-ua.com....

RE: Report joe-jobs here.

Posted: Wed Jan 23, 2013 6:50 pm
by Boonsiri
Another victim is aromavip.net. This is a Russian site in Russian language, which offers "Smoking blends and mixes of elite tobacco", with prices in rubles only. Another domain that has nothing to gain from a world-wide spam-campaign.

re: aromavip.net | ord-ua.com

Posted: Wed Jan 23, 2013 7:40 pm
by c۞g
IMO, the place to report Joe-job attacks are with the sites that detect them as spam / spammer

If for example, Joewein lists a domain, WOT will automatically reference
SURBL - Site blacklisted at jp.surbl.org (jwSpamSpy + Prolocation sites)
since this is a trusted source.
Attempting to increase a site's reputation to "counter attack" the trusted source will not raise the site's reputation until that reference is removed.

BTW, Joewein is not the only list this domain is blacklisted at; re:
http://multirbl.valli.org/lookup/aromavip.net.html

Checking: ord-ua.com
http://multirbl.valli.org/lookup/ord-ua.com.html

RE: re: aromavip.net | ord-ua.com

Posted: Thu Jan 24, 2013 5:27 am
by Boonsiri
<quote user="c۞g">
IMO, the place to report Joe-job attacks are with the sites that detect them as spam / spammer[/quote]Good thinking. I have sent a request for advice on white-listing to multirbl.valli.org.