« 419ing Within One's Means | Main | 419er Lacking Basic Training »

February 22, 2009

It was obvious during the height of election-time Obamania that malware distributors would invoke Obama as a way to trick email recipients to opening infectious attachments or clicking through links whose destinations were just as dangerous. That medz spammers would also use Obama is not unexpected.

It just feels rather creepy.

I saw medz spams with the following bait:

Subject: Support Obama, buying from us
Subject: Barak [sic] caught nude

These were just two of a series that had a wide variety of Subject: lines. Nearly every one I saw had a different spamvertised domain name, all registered and hosted through Chinese companies (I'm still not convinced there isn't an American behind the whole thing). As in earlier campaigns reported here, the domain names are composed of two English words that have no relation to each other.

The format for the messages that arrived overnight included three lines of text and a URL. The three lines of text were pulled from a laundry list of interchangeable, generic marketing messages. Here is a sampling from ten messages (items repeated have the number of times they appeared in parentheses):

• Always quick response and quick shipment for you. (5)
• Amazing quality and speed of service whenever you want 24 hours a day, 7 days per week. (2)
• Choose our huge company with absolute superb service.
• Most of our customers become regular ones thanks to our service and price level. (2)
• Online company with the rich history and unstained reputation. (3)
• Our delivery is always made within short timelines to the joy of our clients.
• Our main function and main advantage is to save your money on our products.
• Our support team will surprise you with the quickness and competence.
• Private, secure, convenient - these are the words of our customers!
• Really fast and prompt delivery in combination with the best online prices. (5)
• We guarantee total confidentiality and a good service to our clients.
• We have a wide range of the popular brands, come and check it yourself!
• We have no hidden fees and we welcome you make profitable purchases!
• We have top-quality products for surprisingly low cost. (2)
• We will ship faster than anybody else to the point you indicate.
• Well-being of our clients is extremely important for us. (2)

As each email message is composed, the sending (botnetted) computer plugs in the three statements at random. Occasionally, of course, random means that the same statement gets repeated more than once in the same message.

Yawn.