Daley Ponderings

I have been getting a bunch of spam through my contact form over the last couple of days, so I thought I would check out what they are trying to do.  The domain's contact information is protected by privacyprotect.org, so we can't know who they are, though I filled out a form showing them their customer is a spammer, we'll see if they actually do give me the contact information or not.

The code they use to get people to download stuff is pretty neat, though it scared me when the download box popped up on its own, without asking for my confirmation first.  It is claiming to be a video codec installer, though the virus scanner marks it as a "trojan downloader.zlob", whatever that is.  I quickly hit cancel on the download box, so it didn't actually download (or run, which I originally thought it was going to do).

Since I can't resist seeing how the automatic downloading worked, I went to Linux to use wget to download the file.  The results of the research are here: menu.txt.  I have commented their javascript, and removed the references to their site, so it is only looking at files from my site.  I guess it makes sense that spammers can hire coders like anyone else.