Spam from online pharmacy masked in emails with fiends and account review requests
April 23, 2012 1 Comment
MX Lab, http://www.mxlab.eu, is intercepting emails with subjects like “Victoria Wright is now your friend”, “Account details on Wikipedia”, “Habbo user “Elisabeth” has sent you a message” that leads to online pharmacies. The people behind those campaigns are hiding the URL in emails with friends requests or review account messages.
Wikipedia -> WikiPharmacy
The first sample is sent from the spoofed email address “MediaWiki Mail >wiki@wikimedia.org>” with the subject “Account details on Wikipedia” with the following body:
Wikipedia
Someone (probably you, from IP address 108.252.120.111) requested a reminder of your account details for Wikipedia. The following user account is associated with this e-mail address: *****@*****.nl
This reminder will expire in 7 days.
If you didn’t initiate the request on Wikipedia, feel free to cancel this message and uncheck the “Reminder” checkbox in your account.Thanks, and once again Welcome!
Here is a screenshot:
The URL inside the message will lead towards hxxp://carewelhealth.com/.
Foursquare and Habo -> Canadian HealtCare&Mall
The first sample is sent from the spoofed email address “foursquare <noreply@foursquare.com>” with the subject “Victoria Wright is now your friend” with the following body:
Hey there – Just a heads up that Victoria Wright has approved your friend request on foursquare.
View their profile: https://foursquare.com/user/65894379Have fun!
- Your friends @ foursquare
Here is a screenshot:
The second sample is sent from the spoofed email address “Habbo Hotel <auto-contact@habbo.com>” with the subject “Habbo user “Elisabeth” has sent you a message” with the following body:
Hello, ****@****
Habbo user “Elisabeth” has sent you a message.
Please click on the link below to open the Message View page:
http://www.habbo.com/public_content/messages/696faae46e1/read?userid=993352
Here is a screenshot:
The URL inside the message will lead towards hxxp://biolgenerics.com/.
Hi! I could have sworn I’ve visited this website before but after browsing through a few of the articles I realized it’s new to me. Regardless, I’m definitely delighted I stumbled upon it and I’ll be book-marking it and checking back often!