CircleID

Today we received one of the first phish attempts to be made as a web spam (comment spam/blog spam) attempt.

I wasn't convinced, and thought that perhaps it was a way to gather and verify RELEVANT online identities. Someone put me straight. It's phishing.

I've often in the past had run-ins with the good folks in the anti virus realm back between 1996 and 2005 who thought Trojan horses and then spyware were not part of their business. Years later the AV business people ruled it is part of their business and ran to catch up. Same with botnets.

I've often had friendly discussions with anti spam folks who said phishing isn't part of the spam problem, or interesting to them. Or that if spam is done on a medium other than email, it obviously isn't spam and needs a new name.

They were wrong. I wasn't very smart in how I approached the subject matter, though.

Today, most anti spam experts consider phishing a priority. Today, Trojan horses, bots and spyware are considered a priority with AV-ers.

Web related spam is still in the terminology and turf fighting stage, but with the increasing ROI and interest combined with the decreased success of other mediums over time, we can see the results for our selves.

Where there is ROI, the Bad Guys adapt. The Good Guys are a step behind regardless of faith, as we are inherently reactive. Still, we should stop being surprised. :)

Today, phishing makes the transition to yet another medium, which is comment spam.

Here is a quote of the phish, as it came in the comment spam earlier today:

"HEllo, i just wanted to say, after 3 years of playing neopets, i have gotten bored with it and have decided to quit. insted of letting my neopoints and items just sit there and rot, i am gonna give them away. in my years of playing i have made about 6 million neopints and have a couple million neopoints worth of items. all you need to do is send me your screenname and password so i can put the stuff in your account and a reason stating why i should give you my hard earned items."

So, we start with neopets and move on to the rest. Welcome phishing to yet another distribution channel, the world of comment spam. 

By Gadi Evron, Security Strategist. Visit the blog maintained by Gadi Evron here.

Related topics: Email, Security, Spam