Thursday, January 10, 2008
This blog post contains the words "V6J" and "5C6" Posted by Mikko @ 14:16 GMT |

Got spam. Surprise surprise.

This time the link wasn't pointing to the spammer's website directly. Instead, it was pointing to Google:

January 1

So, it's making a Google search for the words V6J and 5C6 on a page that contains thereseason.com in the URL.

January 2

There can't be many pages like that on the net.

The link ends with "btnI=745". On Google, the btnI directive causes the I'm feeling lucky feature to activate and Google redirects the user to the first search result.

As a end result, clicking the spam link takes the user to a spam drugstore.

January 3

It's interesting to note that such spam links can be hijacked. All you need to do is to create a page that contains the words V6J and 5C6 and has "thereseason.com" in the URL — and have it pop up as search result #1 in Google.

There's lots of this spam going around. Also, the discount percentages of these guys seem to vary wildly…

January 4

<<< Phishing from the Storm Botnet