<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="http://blogs.technet.com/utility/FeedStylesheets/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/"><channel><title>Blog Spam / Phishing / Harvesting</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx</link><description>Many Blogs are receiving feedback with links to the following URL - DO NOT FOLLOW THIS LINK(that's why I've left off the http:// prefix) "cool12xp.s20.xrea.com". Typical entries have the title of "Great article" with text along the following lines: "Great</description><dc:language>en-GB</dc:language><generator>CommunityServer 2.1 SP1 (Build: 61025.2)</generator><item><title>re: Blog Spam / Phishing / Harvesting</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx#267201</link><pubDate>Sat, 20 Nov 2004 19:14:00 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:267201</guid><dc:creator>William Luu</dc:creator><description>Yeah it's just blog spam, nothing malicious. They're just trying to boost their websites' Google Rank. &lt;br&gt;&lt;br&gt;It could very well be one of those bots/scripts doing the rounds. I've seen something like what you've mentioned posted as comments on other blogs out there as well.&lt;br&gt;&lt;br&gt;Which leads me to suspect it's an automated attack.&lt;br&gt;&lt;br&gt;The non-ascii characters are actually Chinese characters. The site is basically promoting some &amp;quot;free&amp;quot; online movie downloads.&lt;br&gt;&lt;br&gt;I think this is more spam, than a security issue, so you probably won't see it on a security website. &lt;br&gt;&lt;br&gt;Or perhaps it could even be a host of many machines that have been infected, once infected they are &amp;quot;activated&amp;quot; and go browsing through many blogs and in an automated way, attempt to spam them? &lt;br&gt;&lt;br&gt;Ah, who knows? I'm just speculating here (as in the above paragraph), so it could really be anything really.&lt;br&gt;</description></item><item><title>Blog Spam / Phishing / Harvesting</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx#267504</link><pubDate>Sun, 21 Nov 2004 14:26:00 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:267504</guid><dc:creator>.Net Adventures </dc:creator><description /></item><item><title>Blog SPAM</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx#267789</link><pubDate>Mon, 22 Nov 2004 11:05:00 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:267789</guid><dc:creator>Steve Lamb's WebLog</dc:creator><description /></item><item><title>re: Blog Spam / Phishing / Harvesting</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx#267881</link><pubDate>Mon, 22 Nov 2004 22:43:00 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:267881</guid><dc:creator>Sam</dc:creator><description>I'd say it's spam, too - I see loads of these in comments/guestbooks lately, some plain advertising (buy viagra), some 'great site, look at mine', one even with a crude joke.&lt;br&gt;&lt;br&gt;'They' try everything to get more audience. And who can really say if a post is 'real' or 'hidden advertising'. &lt;br&gt;Even my post here could just be a try to get more audience to my site, how would you know?&lt;br&gt;&lt;br&gt;conclusion: I don't have a guestbook anymore. pity.&lt;br&gt;&lt;br&gt;Sam</description></item><item><title>Blog Spam / Phishing / Harvesting</title><link>http://blogs.technet.com/steve_lamb/archive/2004/11/20/267194.aspx#354668</link><pubDate>Tue, 18 Jan 2005 01:10:00 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:354668</guid><dc:creator>.Net Adventures </dc:creator><description /></item></channel></rss>