{"id":1901,"date":"2013-01-08T10:46:26","date_gmt":"2013-01-08T01:46:26","guid":{"rendered":"http:\/\/www.joewein.net\/blog\/?p=1901"},"modified":"2013-01-08T10:47:22","modified_gmt":"2013-01-08T01:47:22","slug":"the-raspberry-ultra-drops-spammers","status":"publish","type":"post","link":"https:\/\/joewein.net\/blog\/2013\/01\/08\/the-raspberry-ultra-drops-spammers\/","title":{"rendered":"The “Raspberry Ultra Drops” spammers"},"content":{"rendered":"

Large number of abused Yahoo accounts are being used for sending out spam that includes links to hacked websites with PHP code that links to sites selling weight loss products. Typically the mails have multiple recipients, no subject line and a single link in the message body that uses a PHP page, such as <\/p>\n

http:\/\/www.example.com\/images\/stories\/ronnd.php?faze=faze<\/code><\/p>\n

The PHP code redirects to a spam domain, or another PHP page redirecting to a spam domain. Here is a list of some of the spam domains advertised recently:<\/p>\n

12fox-news.com
\n12newsfx.com
\n1newstime.com
\nberryextra.com
\nberryrasps.com
\nberrythins.com
\nbestnewsfx.com
\nbuy-raspberry.com
\nbuyberrysdiet.com
\nchannel6nws.com
\ndiet12news.com
\ndietberryshop.com
\ndietsraspberry.com
\ne-raspberryshop.com
\nefoxnws.com
\nextra5news.com
\nfocsnewss.com
\nfox-nws.com
\nfox5diet.com
\nfox5nws.com
\nfoxclocknews.com
\nfoxfxnws.com
\nfoxnws24.com
\nfx-nwstop.com
\nfxnews12.com
\nfxsclock.com
\nfxsnws12.com
\nfxx-news.com
\ngreencoffeediet.ru
\nhoursfox.com
\ni-foxnews.com
\ni-raspberrys.com
\niclocknews.com
\njustraspberry.com
\nlimitedberry.com
\nlossdietketone.com
\nluxurynws.com
\nnaturalberrys.com
\nnewoclocks.com
\nnews24fox.com
\nnewsfx12.com
\nnewsfx24.com
\nnewsfxs12.com
\nnewsviagrow.ru
\nnowslimberry.com
\nnwscofee.com
\nnwsfox.com
\nnwsfox5.com
\nnwsfxs12.com
\nnwshour.com
\nonraspberry.com
\nonraspberrys.com
\nraspberry-slims.com
\nraspberrybest.com
\nraspberryelites.com
\nraspberryfresh.com
\nraspberryseller.com
\nraspberrysold.com
\nraspberrywinter.com
\nraspdiet.com
\nraspdiets.com
\nraspsberry.com
\nraspsworld.com
\nraspthinberry.com
\nsalesraspberry.com
\nshopraspberry.com
\nslimketone.com
\nslimraspberry.com
\nslimsberrys.com
\nslimsfox.com
\nsoldraspberry.com
\ntopberrydiet.com
\ntrimfatrasp.com
\ntrimraspberry.com
\nultraraspberry.ru\n<\/p><\/blockquote>\n

These domains use Russian name servers such as ns1.dnsmax.ru (219.87.170.82), ns1.dnscentral.ru (219.87.170.82), ns2.dnsmax.ru (89.103.247.13), ns2.dnscentral.ru (89.103.247.13). The use of hacked Yahoo accounts for mailing, of hacked PHP websites to mask the spam domain and the fake references to Fox News are similar to the “Work from home mom” scam<\/a> that has been going around for a while, so they are probably connected.<\/p>\n

My advice: Don’t buy from spammers. Why should you hand your credit card details to a criminal?<\/p>\n","protected":false},"excerpt":{"rendered":"

Large number of abused Yahoo accounts are being used for sending out spam that includes links to hacked websites with PHP code that links to sites selling weight loss products. Typically the mails have multiple recipients, no subject line and … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,2],"tags":[],"class_list":["post-1901","post","type-post","status-publish","format-standard","hentry","category-scams","category-spam"],"_links":{"self":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/comments?post=1901"}],"version-history":[{"count":3,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1901\/revisions"}],"predecessor-version":[{"id":1904,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/1901\/revisions\/1904"}],"wp:attachment":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/media?parent=1901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/categories?post=1901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/tags?post=1901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}