Info: Stock spammers go to remarkable lengths for stealth
I'm not currently tracking pump and dump stock spamming, mostly because there's just so much of it. I note in passing, however, a new stage in a trend that's been going on for some time.
It used to be that stock spammers would just send their spam in perfectly plain and readable ways. They then started to corrupt some of the more readily identifiable parts of the spam, such as the "forward looking statements" boilerplate disclaimer that many of them include, so as to lessen the number of spam filters that would catch them on this. More recently again, they have started embedding spaces and punctuation into the stock name itself, so as to prevent searches on that stock name turning up all the spam that winds up being archived on the web. Some of them have chosen to embed their entire message in an image -- a technique which is also popular among the pill spammers, but note that the stock spam is usually just plain text rendered as an image. This also prevents any part of the text from being used as filter-fodder, and prevents the archived spam from being searchable on the web.
The final stage in this progression that I wish to note is one recent stock spam (pumping "Advanced Powerline Technologies, Inc." [APWL]) which not only encodes the entire text as an image, but breaks up that image into a grid of smaller sub-images. I'm not entirely sure what additional benefit this is supposed to have (from the perspective of the scumbag who is sending it), but it could be an attempt to foil my recent habit of archiving such images on the Stock Spam blog. Previously, it was just a simple case of "save the image and upload it to the blog", but since it's no longer a single image, this technique wouldn't work -- additional effort would be required.
As I've said, I'm not tracking stock spam at the moment anyhow, so this doesn't actually impact me. It's interesting to watch the arms race between scammers and scam-busters progress, though.
No comments:
Post a Comment