FANDOM


DefinitionEdit

Spam redirections are used by spammers for several reasons

  1. to fly under the radar (i.e. escape detection) by the automatic spam blocking systems
  2. to avoid getting warnings and red flags against their sites from site reviewing systems
  3. to provide a longer life to otherwise quickly removed spamvertized web sites

FormatsEdit

Free hosting sitesEdit

Redirections can take many forms. Some make use of free hosting services, such as Google's Blogspot and Yahoo's Geocities which allow quick web site set-up. Spammers register hundreds of thousands of sites, set them up, and put in a redirection to the true target web site. Since they do not send spam containing the target site name, they hope to evade detection. These are known as "Hosters" and are well documented by URIBL.COM at the URIBL spam tracking site.

Prefix drivenEdit

Another type of redirection uses the third level domain name, or domain prefix method. Here, a domain name is registered, and the redirection to the target site is triggered by the first letter of the prefix. This method is illustrated with a live example shown in the following tables.


Multiple redirections, May 2008
Prefix Spam Brand Sample domain
A Mr.Long pdandotherb.com
B Canadian Pharmacy prettylast.com
C root directory hotsellingpills.com
D Canadian Healthcare attevm.com
G US Pharmacy drg821.com
H Vegas Casino casino22.net
K Canadian Healthcare attevm.com
P MaxGain+ debentes.com
R SwissWatchesDirect laoje.net
S RXnet 55med.com
T King Replicas huneice.com
V Wondercum fionws.com

Multiple redirections, June 2008
Prefix Spam Brand Sample domain
A Mr.Long pdandotherb.com
B US_Drugstore callsubtract.com
C Federated RX hotsellingpills.com
D Official Generic Pharmacy wehelpyounow.com/cheap_pharmacy
G Canadian Health&Care Mall variable
H Vegas Casino casino22.net
K Worldwide Wholesale Pharmacy yoajlem.com
P MaxGain+ debentes.com
R SwissWatchesDirect greattimewatches.net
S RXnet 55med.com
T King Replicas wegdeange.com
V Wondercum fionws.com

Multiple redirections, August 2008
Prefix Spam Brand Sample domain
A Mr.Long pdandotherb.com
B Canadian_Pharmacy loverspillsbat.com
C Federated RX hotsellingpills.com
D Direct Pharmacy sourcegoodfind.com
G Canadian Health&Care Mall axvojgips.com
H Vegas Casino casino22.net
K Canadian_Drugstore qualityrange.com
P MaxGain+ hujanda.com
R SwissWatchesDirect seewatchnow.com
S RXnet 55med.com
T King Replicas seewatchnow.com
V Wondercum fionws.com

Live examplesEdit

To illustrate using live examples from May 2008, here are a set of spammed domains used for redirecting -

  • ydspread.com
  • yuaccounting.com
  • zanewnovel.com
  • zhbidto.com
  • zjofficial.com

Selecting one of these, here is a sample of spammed prefixed domains


  • bcej.zhbidto.com
  • bczb.zhbidto.com
  • kstz.zhbidto.com
  • kvv.zhbidto.com
  • parc.zhbidto.com
  • pawr.zhbidto.com
  • rpdws.zhbidto.com
  • rved.zhbidto.com
  • tqt.zhbidto.com
  • tuz.zhbidto.com

Note that the redirecting domains reside on a fast-flux botnet, occupying 8 hijacked hosts at a time, refreshing to a new set every 3 minutes:

zhbidto.com.            180     IN      A       81.180.157.127
zhbidto.com.            180     IN      A       89.156.145.103
zhbidto.com.            180     IN      A       121.152.240.95
zhbidto.com.            180     IN      A       24.122.218.63
zhbidto.com.            180     IN      A       67.64.156.156
zhbidto.com.            180     IN      A       67.188.53.61
zhbidto.com.            180     IN      A       68.73.153.25
zhbidto.com.            180     IN      A       76.106.194.40


The configuration in February 2008 can be seen at MaxGain#Redirections

Further readingEdit

  1. Google Blogspot redirection abuse
  2. Yahoo! Geocities redirection abuse

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.