Transcript
1
2
3
4
5
Marketplace Ads for Goods
Marketplace Ads for Services
6
7
Types of Storm C&C Messages
• Activation (report from bot to botmaster)• Email address harvests• Spamming instructions• Delivery reports• DDoS instructions• FastFlux instructions• HTTP proxy instructions• Sniffed passwords report• IFRAME injection/report
8
9
10
Spamalytics
Who is targeted?Who is targeted?
19
• Top 20 domains
• Many Web mail & broadbandproviders, but very long tail
• Campaigns have nearly identicaldistributions
• Same scammers, or targetlists sold to multiplescammers
• Also see spam campaigns sentsolely to test accounts
11
12
13
Courtesy Stuart Brownmodernlifeisrubbish.co.uk
Anatomy of a modern PharmaAnatomy of a modern Pharmaspam campaignspam campaign