TOKYO (MacHouse) – Several hours ago, a cyber criminal circulated a spam comment around blogs and forums worldwide to advertise a website. It’s a trivial spam act, which actually shocked us at a glance.
Remember the story of a girl who committed suicide after finding out that the love affair she believed in was a total hoax? Her mother found her body in a closet. The spam comment goes
ST. LOUIS (AP) — The mother of a girl who committed suicide at age 13 after being subjected to an Internet hoax says a woman’s conviction in the case shows that people who bully others online will face consequences.
Lori Drew, 49, of O’Fallon, Mo., was convicted Wednesday in federal court in Los Angeles on misdemeanor charges of accessing computers without authorization in a landmark cyberbullying trial, though her lawyer said he still hopes a judge will dismiss the charges against her.
 Screenshot 01 – Source: MacHouse |
 Screenshot 02 – Source: Washington Post |
 Screenshot 03 – Source: Google |
(See Screenshot 01.) The original article was probably written by an Associated Press writer. Almost exactly the same article has been used by many AP contributors including Washington Post. (See Screenshot 02.) You can also find the original article at Google. (See Screenshot 03.) The spammer inserted Equity Research after ‘Drew’s lawyer’ in the 9th paragraph and embedded a hyperlink. The underlying link is http://michaelcwalker.com/.
Let’s find out who is sponsoring this spam operation, using the story of a poor girl in Missouri. The domain of sponsor’s website is michaelcwalker.com. Looking up its WhoIs registration, it looks like registrant’s name is Michael Walker of 2024 Fortunate Rd., Glenside, Pennsylvania, USA. (See Screenshot 04.)
 Screenshot 04 – Source: Domain Tools |
 Screenshot 05 – Source: MacHouse |
Let’s also find out where the spam-sponsoring website is hosted. The domain points to two nameservers, which are ns1.usahostingcafe.info and ns2.usahostingcafe.info. Running a traceroute search on one of them will give us the domain of carohosting.com and the IP address of 76.76.1.22. (See Screenshot 05.) The trace route search doesn’t look like it will end. Anyway, looking up this IP with ARIN’s database, it looks like the website at michaelcwalker.com is hosted by CaroNet (caro.net). (See Screenshot 06. Screenshot 07 shows the index page of CaroNet’s website. Since the trace route search is never conclusive, we are not so sure if CaroNet hosts the website at michaelcwalker.com.
 Screenshot 06 – Source: MacHouse |
 Screenshot 07 – Source: Caro.Net |
Click on the button to watch a short documentation video. 
Click on the button to watch more documentation videos.
