Daily Spam #2

Subject: YOU DESERVE THE LOWEST MORTGAGE RATE! 4.375%

From: nnv@google.com

The from address intrigued me... :-) I just had to take a closer look at this one. So here we go:

Tracing the email originator IP ends very fast on a firewall, but the email contains a link to zquote.biz. I did a check on the registrant (Greg Smith in Dayton, Ohio) and a google search on the name and found that this "Greg Smith" is a fake name that has been used for many other spam operations - he owns zquote.biz, stayforquote.biz, goinghere.biz and a few others who have all been flagged as spammer sites.

All these domains have been registered in France with an Italian email address - a lead? No, just more untraceable data.

But the web page on zquote.biz was interesting - it is a form, and the form data has to go somewhere. After digging through their JavaScripts on the site I had the IP number of a server where my data would end up if I would be moronic enough to trust these guys.

A traceroute on this IP number ends at a firewall at cernet.net. The Network Center, China Education and Research Network, Beijing China.