An Example—Dissecting a Spam Network
Now let’s see how these tools can be used in the real world. This section shows how you can figure out the structure of a sophisticated spam operation. A point that I will stress here and throughout the book is how valuable it can be to have multiple examples of an email or a web site. Even though the details may differ, the similarities between them can be very revealing.
For a while last year I was getting a lot of spam emails that all
had a similar underlying appearance. The products being offered varied,
as did the name of the Sender, but they clearly had a common origin. The
From addresses all had the form
<somebody>@stderr.<somedomain>.com and they
all had the same mechanism for unsubscribing from their mailing list. So
I collected a bunch of messages that fit this pattern and made a list of
the web sites they were directing me to. At first glance these seemed to
be a diverse group but as I added more examples the domain names started
to take on a similar form. That was my motivation to investigate further
and start to run dig on the
hostnames. Table
2-3 shows a small sample of the results from that survey, sorted
by IP address.
Table 2-3. Hostnames with similar IP addresses
Hostname | IP address |
|---|---|
| |
| |
| |
| |
| |
Get Internet Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
