Peter Bromberg's UnBlog

Spam, those unwanted and often annoying emails, can clog your inbox and pose security risks. Here's how to identify and avoid them: **Common Spam Signs:** * **Strange Sender Addresses:** Emails from unfamiliar or suspicious senders. * **Generic Greetings:** Messages starting with "Dear Friend," "Valued Customer," or similar. * **Urgent Requests:** Emails demanding immediate action, often involving money or personal information. * **Too-Good-to-Be-True Offers:** Promises of unrealistic rewards or discounts. * **Poor Grammar and Spelling:** Typos and grammatical errors are common in spam. * **Excessive Exclamation Points and Capital Letters:** Spammers often use these to grab attention. * **Suspicious Links and Attachments:** Avoid clicking on links or downloading attachments from unknown sources. **Protecting Yourself:** * **Use a Reliable Email Provider:** Reputable providers have spam filters to block unwanted messages. * **Be Cautious with Links and Attachment...

Since around 2006, the spammers have been using a technique that essentially gets specific pages ranked high in the search engines for certain search terms. Then when the search engine serves results to an unwitting user, instead the spammer site embeds some script or a an HTTP refresh with a zero time delay, or a 302 redirect into the search result. Here is just one relatively innocuous example (don't click it unless you want to examine the script, which is javascript obfuscated) <script src=" http://cappa.pl/sutra/js/random" ></script>. if embedded in a search result link or description, this will redirect you to some sex site or whatever who has actually PAID for this service. Yes, apparently the search engine hijackers actually make their clients pay for this stuff, in effect getting free money for no effort other than a little javascript programming. This particular little scriptlet currently appears in a google search 11,800 times , 111,000 times in liv...

Those nasty spammers have apparently reappeared, using a private domain registration through GoDaddy. What they do is capture your Windows Live Messenger credentials under the ruse that they will show you all your blocked contacts (which is easy enough to do yourself with libraries like DotMsn - without the security risks). What they don't tell you is that if you do this, your account is now compromised -- and they'll send every one of your contacts a message (since it's your credentials, it appears from you , a trusted contact) that tells you to go visit their site and sucker for it too. There's only one solution if you suckered for it - you have to change your Live.com password immediately . Just look at this: "The longly[sic] awaited feature for MSN Messenger, completely for free[sic]!" When you click on their Privacy page link, you get nada! What a scam. Unfortunately, from reading the newsgroup and forum posts, it appears that thousands of people are ge...

"Am I afraid of high notes? Of course I am afraid! What sane man is not?” -- Pavarotti If you run a blog or website and you are carefully watching your hits, more often than not you should be able to identify bots attempting to do all kinds of nasty, evil things at your site. Many of these absolutely will not obey the Robots.txt file (although they may request it just so they can see if there is any material for nastiness there). They perpetrate all kinds of schemes, trying out SQL Injection attacks, attempting to post blog spam and trackbacks, and the like. Some of the stuff they try (and I have real-time database logging, so it's easy to amuse myself) is either hilarious or pitiful - depending on your frame of reference! Fortunately, it is relatively easy to head these nasties off at the pass -- almost all this junk traffic emanates from IP addresses that don't change. So what I do is I have a BADIP list that's easy for me to edit, and in Global, in Application_PreR...

NOTE: It only took the DNS provider an hour or so to shut these bastards down. Good Riddance! I'm leaving the post up for educational purposes. Don't give out your Windows Live ID (Passport) or other credentials to any site unless you absolutely know who they are. In this case, you are getting a message from a trusted friend to go visit this site. That's social engineering. UPDATE 7/28/2007: These guys are back with a new domain and a new provider, and now they have EVEN MORE "FAQ" like stuff to try and convince you that they aren't "Phishing". TRUST ME: THEY ARE: http://www.messenger-tips.com/ Visit this site: http://msnlive.bounceme.net/ (This domain was TURNED OFF by the DNS provider) it tells you who deleted or blocked you from their MSN (Live) Messenger contacts. BUT DO NOT LOG IN! This is one of the best examples of social engineering I've seen in a while. It looks really professional doesn't it. You are going to log in with your Windo...

One of the primary concerns you will have as a blogger or developer of content sites is filtering porn and spam. The approach I've taken with ittyurl.net is basically to have a database table, "BADWORDS". This gets loaded into a string array at startup, and any time somebody wants to add a link, since the application spiders the page anyway to collect tags and metadata, I run it through my IsBadWord method. The process is very fast and it has worked extremely well. Since about January 2007 when I put up the first beta of the site, I've only had to manually remove three or four links out of the several thousand that users have added on the site. Sometimes the sneaky little scumbags have a redirect to their porn / spam sites from a "nice" page and that of course is something you cannot foresee (unless of course, you want to have your WebRequest follow redirects -- it just goes to show you they will stop at nothing in the dirty tricks department!). Other times...