{"id":199,"date":"2007-08-21T06:52:37","date_gmt":"2007-08-21T14:52:37","guid":{"rendered":"http:\/\/www.scamdex.com\/ScamBlog\/?p=199"},"modified":"2012-11-19T09:42:08","modified_gmt":"2012-11-19T17:42:08","slug":"new-email-offers-registration-with-virus-payload","status":"publish","type":"post","link":"https:\/\/scamdex.com\/ScamBlog\/2007\/08\/new-email-offers-registration-with-virus-payload\/","title":{"rendered":"New Email offers Registration (with Virus Payload)"},"content":{"rendered":"<p>I&#8217;ve received several emails today, all matching the same pattern. The email comes iwth a range of subjected and from a range of senders but the enclosed web link, when clicked brings you to the same html, all located on different IP addresses. The few ip addresses I looked up seemed to be typical home computer users which probably means that they are infected machines running spam bots .<\/p>\n<p>Here&#8217;s one &#8211; Subject is &#8216;<strong>Registration Details<\/strong>&#8216;<\/p>\n<blockquote>\n<pre>Greetings,\r\n\r\nWe are so happy you joined Ringtone World.\r\n\r\nUser Number: 8191539133\r\nTemorary Login: user4089\r\nYour Password ID: ce630\r\n\r\nBe Secure. Change your Login ID and Password.\r\n\r\nUse this link to change your Login info: <a href=\"badlink-removed\" rel='nofollow' class=\"moz-txt-link-freetext\">http:\/\/24.14.127.121\/<\/a>\r\n\r\nThank You,\r\nTechnical Services\r\nRingtone World<\/pre>\n<\/blockquote>\n<p>Going to the link brings up this webpage (it also loads a fake video viewer window with no content):<\/p>\n<blockquote><p> If you do not see the Secure Login Window please install our [malware removed]<\/p><\/blockquote>\n<p>Clicking on the link will download the file applet.exe which my Fprot antivirus recognised as a virus but failed to identify the name.<\/p>\n<p><strong>Other subjects<\/strong><br \/>\n&#8216;User Services&#8217;, &#8216;User Info&#8217;, &#8216;Internal Support&#8217;, &#8216;Technical Support&#8217;, &#8216;Registration Details&#8217;<\/p>\n<p><strong>Other Sites<\/strong><br \/>\n&#8216;Pet World&#8217;, &#8216;Ringtone World&#8217;, &#8216;Funny-Files&#8217;,  &#8216;Recipies-Galore&#8217;, &#8216;Ringtone Heaven&#8217; and plenty more.<\/p>\n<blockquote><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve received several emails today, all matching the same pattern. The email comes iwth a range of subjected and from a range of senders but the enclosed web link, when clicked brings you to the same html, all located on different IP addresses. The few ip addresses I looked up seemed to be typical home [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[10,30,29,31],"tags":[],"_links":{"self":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/199"}],"collection":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/comments?post=199"}],"version-history":[{"count":2,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/199\/revisions"}],"predecessor-version":[{"id":821,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/199\/revisions\/821"}],"wp:attachment":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/media?parent=199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/categories?post=199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/tags?post=199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}