More spam today, with a very similar modus operandi as yesterday’s bogus greeting card message. If you want to see the message itself, you can find a two-year-old copy here, word for word. The only difference is that my copy actually linked to a different .COM site with a nonsense name, though the visible text still said us-nma.com (which apparently doesn’t exist anymore).

And this time, I got two of them, from different accounts. One in the morning, one in the afternoon. Presumably from different spam-bots on the same botnet. But strangely enough, the URL contained exactly the same identifier — obviously either a way to identify the e-mail address that the message was delivered to, or more likely an encoded version of the address itself. This one was still running when I used a fake identifier to go there, and it ended up at a fake pharmacy site. Firekeeper didn’t notice any malware infiltration attempts, but that could well be because I’m not allowing the site to run any kind of scripting.

Add to that this article on what’s going on in the malware scene, and you’ve got every right to be paranoid.

At this point, anyone who’s not using Firefox with NoScript is just asking for trouble. And even those of us who are have good reason for paranoia. I think I’m going to set up a second VMware Linux machine just to do my browsing in, so my main machine can’t easily be compromised even if someone does come up with a Linux-targeted attack.