All of these spam mails with up-to-date subjects were sent from Russian email addresses. They pretend to be a newsletter mail from MSN.
Who is behind the campaign?
The analysis of the linked “Canadian Pharmacy” websites shows that there are only four companies involved in registering the domains and all used domains were registered during the last few days only.
The identified linked domains are:
- usuallife.com
- extolbell.com
- peopleeasy.com
- flairfew.com
- sugarspoke.com
- themreply.com [offline]
- seemlychief.com [offline]
- givingvery.com [offline]
- allownine.com [offline]
- quartwin.com [offline]
- maxistood.com [offline]
The registrars are:
- China Springboard Inc (China)
- BIZCN.COM, INC. (China)
- BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD (China)
- 35 TECHNOLOGY CO., LTD (China)
All websites are hosted on the same server, which is located in China. However, the hosting server changes. Since the beginning of the research, we found two suspicious servers already: 119.88.56.123 and now 61.136.59.69.
The over 900 analysed subject lines included 825 unique last words, all starting with “a” (examples marked italic in the list below). The use of lexical words at the end of a normal subject line is one countermeasure scamsters implement to try to avoid anti-spam filters with the usage of harmless words.
Here are some examples of last week’s topicality spam appearance:
- 200,000 flood Shanghai Expo preview acoustics
- Air travel updates amid volcanic ash addibility
- Alain Robert: Living on the edge adamances
- Apple posts record quarter accordingly
- AT&T unveils Buzz.com aerobatics
- Cairo reporter on the city’s best actifier
- China pays tribute to quake victims acarpous
- China under growing currency pressure alamos
- Chrysler in $143M profit aitch
- Conservatives unveil manifesto acnodes
- Country profile: Georgia aglets
- Cricket: IPL is hit by corruption claims agnails
- Enjoy a glass of Georgian wine acatholic
- Eruption's disruption to business actualist
- Fears volcano chaos will continue advising
- Football: Bayern smash seven goals afters
- Football: Inter fight back to stun Barca accommodated
- Football: Lyon target win over Bayern adenological
- Fraud Case upstages Goldman results agrestic
- Georgia's 47-year-old prima ballerina agednesses
- ‘Glee’ + Madonna = perfection accesoiries
- Goldman Sachs was top Obama donor abdications
- Golf: Obama plays more golf than Bush abietineous
- Golf: Ochoa announces her retirement aerogen
- Guru's family releases a statement adaunt
- Jin and Sun reunite on 'Lost' abilo
- Many teens send 100-plus texts a day acrolith
- Mumbai's most haunted locations accension
- Navy SEAL’s trial opens adonin
- Officials defend ash cloud flight ban acridanv
- On Patrol in Kandahar abelite
- Outsider opens up UK election adjoint
- Poland to hold June 20 vote aiel
- Republic of Georgia's unique ballet afferent
- Sport left grounded by volcano aerophysics
- Striving to play perfect Macau game acidulating
- ‘Sudden’ split for Mel Gibson agrimony
- Susan Boyle writing memoir accouchement
- Test your knowledge of Georgia acetaniside
- UK party sweary campaign adynamy
- UK regulator launches Goldman probe absolve
- Uncorking Georgia's wine heritage acutely
- United in sorrow in Poland afeard
- Unseen Unesco World Heritage Sites airspeed
- Volcano ash affects air travel acoluthic
- Warsaw: 1,000 miles from home absurdist
- What will Facebook announce today? Acinary
- Who loves the Democrats? afterwhile
- Wind farm fight splits Cape Cod adjuratory
- World's top woman golfer retires acidic
- Zaza Pachulia: Georgia basketball hero acrobatholithic
This covers a broad range of interests! Be careful: Curiosity kills the cat.