Spamit.com...OOPS!!! Thanks to M86

[wahnula]

From:

http://www.m86security.com/labs/i/SpamI ... .1244~.asp

The unusual feature of the spam was that some of the “Click here” links were all messed up and, instead of an http link, had references to SpamIt.com in the href attribute.

Morons! They just cemented their relationship to the criminal enterprise, nothing secret about this goof-up! Well done M86.

[BillyShaft]

That's awesome...

[tacoma43]

...nothing secret about this goof-up!

...unless it was a deliberate "mistake" perpetrated by Spamit's competition.

[spamislame]

That means one of two things:

1) An amateur or newbie
2) Someone who's done this before, but who is in a hurry and therefore stupidly sloppy.

This happens frequently enough that I currently side with #2. Seriously I see this mistake every few weeks now.

SiL

[meep]

I found that blog entry interesting, and I think it just being sloppy on the spammer's part, hence the name of this subforum: "Sloppy, Lazy and Stupid Spammers"

[AlphaCentauri]

I've actually been getting quite a lot of those.

[ahoier]

Now wouldn't that be odd, a "joe job" attack against Spamit.com? :) A big spammer war...lol.

I mean, it could be possible....hehe. Or at least a very dumb/newbie who doesn't know how to use proper templates.....but why would they even have their own affiliate site in the possible template options.

Looks like someone found a "bug" in their mailer/software....hgahaha, That is, if it is not a joe-job of sorts ;)

[AlphaCentauri]

Actually, it wasn't that odd to see {Spamit_Subj}, since I had previously seen {Sancash_Subj}

The mailing software is chosen by the mailer, I would think, and he may be mailing for several affiliate programs. The spam would not be identical for each one, so he'd want his mailing program to be loading the correct information to merge with the spam he's going to send.

[Benzyl]

For the last few weeks I've had my inbox filled with large amounts of pharma spam that due to the 300K image attachments has resulted in enough bulk to prevent any more mail getting in after about two days at a time. I had been dumping it quickly to allow normal service to resume but a quick check today revealed that the link address on many of them was - http://www.mail.o2.co.uk/cp/ps/Mail/{_spamit_04.03.10} so maybe they are just incredibly sloppy recently or all the old hands baled out leaving their setups to even more clueless idiots?