Spam from online pharmacy masked in emails with fiends and account review requests


MX Lab, http://www.mxlab.eu, is intercepting emails with subjects like “Victoria Wright is now your friend”, “Account details on Wikipedia”, “Habbo user “Elisabeth” has sent you a message” that leads to online pharmacies. The people behind those campaigns are hiding the URL in emails with friends requests or review account messages.

Wikipedia -> WikiPharmacy

The first sample is sent from the spoofed email address “MediaWiki Mail >wiki@wikimedia.org>” with the subject “Account details on Wikipedia” with the following body:

Wikipedia

Someone (probably you, from IP address 108.252.120.111) requested a reminder of your account details for Wikipedia. The following user account is associated with this e-mail address: *****@*****.nl

This reminder will expire in 7 days.
If you didn’t initiate the request on Wikipedia, feel free to cancel this message and uncheck the “Reminder” checkbox in your account.

Thanks, and once again Welcome!

http://en.wikipedia.org

Here is a screenshot:

The URL inside the message will lead towards hxxp://carewelhealth.com/.

Foursquare and Habo -> Canadian HealtCare&Mall

The first sample is sent from the spoofed email address “foursquare <noreply@foursquare.com>” with the subject “Victoria Wright is now your friend” with the following body:

Hey there – Just a heads up that Victoria Wright has approved your friend request on foursquare.
View their profile: https://foursquare.com/user/65894379

Have fun!
– Your friends @ foursquare

Here is a screenshot:

The second sample is sent from the spoofed email address “Habbo Hotel <auto-contact@habbo.com>” with the subject “Habbo user “Elisabeth” has sent you a message” with the following body:

Hello, ****@****

Habbo user “Elisabeth” has sent you a message.

Please click on the link below to open the Message View page:

http://www.habbo.com/public_content/messages/696faae46e1/read?userid=993352

Here is a screenshot:

The URL inside the message will lead towards hxxp://biolgenerics.com/.

One Response to Spam from online pharmacy masked in emails with fiends and account review requests

  1. business lists says:

    Hi! I could have sworn I’ve visited this website before but after browsing through a few of the articles I realized it’s new to me. Regardless, I’m definitely delighted I stumbled upon it and I’ll be book-marking it and checking back often!

Follow

Get every new post delivered to your Inbox.

Join 314 other followers

%d bloggers like this: