[spambayes-dev] Interesting Google Alerts output

skip at pobox.com skip at pobox.com
Mon Jan 4 00:14:33 CET 2010


I've had a Google Alerts search set up for SpamBayes for quite awhile.
Recently, I've begun getting output such as this
>>>>> "ga" == Google Alerts <googlealerts-noreply at google.com> writes:

    ga> === Google Blogs Alert for: SpamBayes ===

    ga> 71544 | Panthershoes12.ezua.com
    ga> By admin
    ga> Test and Computations per 14 CFR 21.303 and Aero Parts Mart Dwg. Author:
    ga> haypo: Recipients: Rhamphoryncus, ola, gregory.p.smith, haypo, jcea,
    ga> pitrou, sserrano: Date: 2008-08-20.14:06:15: SpamBayes Score: 0.0847759
    ga> Manufactured by Wiha. ...
    ga> <http://panthershoes12.ezua.com/2010/01/71544/>
    ga> Panthershoes12.ezua.com
    ga> <http://panthershoes12.ezua.com/>

    ga> 72872 | Divisionshoes15.25u.com
    ga> By admin
    ga> Author: ncoghlan: Recipients: barry, erson, non, exarkun, ncoghlan, pitrou:
    ga> Date: 2008-09-09.15:29:38: SpamBayes Score: 1.17516e-10: Marked as
    ga> misclassified Christopher Bibbo, DO, DPM Marshfield Center 1000 N OAK AVE
    ga> MARSHFIELD, ...
    ga> <http://divisionshoes15.25u.com/2010/01/72872/>
    ga> Divisionshoes15.25u.com
    ga> <http://divisionshoes15.25u.com/>

Note that it appears to be some sort of mailing list archive, though look at
the date in the message and the apparent date in the URL.  Whenever I click
the links given I get a 403 Forbidden response.  Both ezua.com and 25u.com
seem to be owned by ChangeIP.com (also jkub.com, which appears in another
search result not shown above).  Their homepages advertise free dynamic dns.
If this is some sort of spam setup it's hard for me to see how the spammers
might benefit from it.

Skip


More information about the spambayes-dev mailing list