Spyware Warrior

[Chao284]

Since CastleCops got shutdown and BroadBandReports discontinued any spam discussions?

Well apparently they have and I need to make notes about a new RBN tatic that seems to be more than bulle-proof, but more like Missle-Proof, and involves forum spam to pharma and such and domains that are under the radar for nearly a long time,

The hosts of the main domains are controled by,

low-price-sites.com
and
allbestlinks.info

hosted by root.lu in Luxembourg, which no one has caught this spam for almost a year and likely one of the Russian Business Network's successful spam operation plan since then,

And also that is not all, it also hosts IPA known as Independent Pharmaceutical Association has turned up Russian Business Network infomation from this DNS server, it too has gone un noticed knowing it is being processed via Message Board and Facebook spam, where the IPs are impossible to track, here is one of their articles on the matter,

http://www.spacequad.com/article.php?story=Russian_Pharma_Spam

And also I wanted to note that rivaclick and ipahere are also affliated with the RBN, using relays(including root.lu) to use Forum Spam as a way to get away from Email and potentional blacklisting, if anything some of these spam sites need to wake up that with the ZeuS and SpyEye rootkit malware on the loose, they will continue to gain new servers and new tatics, much like the Cold War, the DNS Info for this will be posted on the next reply.