Silent noise - about spam, trojans and other nasty stuff

Another one who let go too early.
Fresh spam. Well relatively fresh, from one inbox yesterday (parts of it):

Subject: %SI_subj

What if you could %SI2_rnd10 your desire and %SI2_rnd11 by just %SI2_rnd12 %SI2_rnd13 step?
What if this step was %SI2_rnd14, %SI2_rnd15 and side-effect-free?

There is %SI2_rnd16 solution!
%SI2_rnd17 %SI2_rnd18 use %SI2_rnd20 to give their %SI2_rnd20 %SI2_rnd21 night fire!

If there are no %SI2_rnd22, why refusing to take one pilule before %SI2_rnd23?

%SI2_rnd24 of men did it – You can do it too!

Interesting. Checking it out.

Maybe more later.

I mostly write about what others already have written about, I am a kind of parasite.

Today I spotted this one in my RSS-reader from the Sunbelt blog, titled " New rogue: Presto TuneUp":
http://sunbeltblog.blogspot.com/2009/05/presto-tuneup.html

I steal and quote from that blogposting:

64.213.140.69 Prestotuneup com
64.213.140.69 update1.prestotuneup com
64.213.140.69 update2.prestotuneup com

Fresh spam in today, subject: "BlueMountain e-Card : Someone thought about you".

Yeah, someone is thinking about infecting your computer.

Obfuscating the link:
h||p://0x55.0xee.000000051.0000221/i/BlueMountain&2009&05.card=LoveScreen. php
0x55.0xee.000000051.0000221 decodes to 85.238.41.145 and the IP is listed in the SBL for reasons similar to this spamrun.
The setup is almost identical.
service.net.ge is behind 85.238.41.145.

Some of them, others do of course exist too.

I stumbled across two new ones registered today, 15infinput.com and binnet11.net.
One of the IPs that shows up in connection with those is 69.66.237.74.

Here is an example using bfk.de from 69.66.237.74 (all of those are not active):

Only a few words this time.

007aff.com has been replaced by 007-aff.com. Same guys.
The replacement for bulker.biz? (Pure speculation).

Latest domain taking orders: ksdjhfnkejrnkfjekrjnfkejrnkj.com

One branch of the setup can be traced back to JustThinkMedia.
aka edirectsoftware, earncashfastwithgoogle.com, creditreportamerica.com, wu-yisource.com etc.