bogus email arrived

[David W. Hodgins]

On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman <DLipman~nospam~@verizon.net> wrote:

> From: "JIP" <JIP@xxnospamxxy1.com>
>> The only content of the mail was the link as below
>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu

> Spam not malware.

Are you sure? It loads
https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js

If I'm reading it correctly, it would be a bad idea to visit the above site with
javascript enabled, and then go to login to facebook, event if you've closed
the above site.

I've seen similar scripts targeting yahoo, msn, etc.

I think you have to clear the broswser cache and restart the browser to get
rid of the script.

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

[David H. Lipman]

From: "David W. Hodgins" <dwhodgins@nomail.afraid.org>

> On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman
> <DLipman~nospam~@verizon.net> wrote:
>
>> From: "JIP" <JIP@xxnospamxxy1.com>
>>> The only content of the mail was the link as below
>>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
>
>> Spam not malware.
>
> Are you sure? It loads
> https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js
>
> If I'm reading it correctly, it would be a bad idea to visit the above
> site with
> javascript enabled, and then go to login to facebook, event if you've
> closed
> the above site.
>
> I've seen similar scripts targeting yahoo, msn, etc.
>
> I think you have to clear the broswser cache and restart the browser to
> get
> rid of the script.
>
> Regards, Dave Hodgins
>

It's possible I could be wrong but a retest still didn't come up with
anything.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[~BD~]

David H. Lipman wrote:
> From: "David W. Hodgins" <dwhodgins@nomail.afraid.org>
>
>> On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman
>> <DLipman~nospam~@verizon.net> wrote:
>>
>>> From: "JIP" <JIP@xxnospamxxy1.com>
>>>> The only content of the mail was the link as below
>>>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
>>
>>> Spam not malware.
>>
>> Are you sure? It loads
>> https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js
>>
>> If I'm reading it correctly, it would be a bad idea to visit the above
>> site with
>> javascript enabled, and then go to login to facebook, event if you've
>> closed
>> the above site.
>>
>> I've seen similar scripts targeting yahoo, msn, etc.
>>
>> I think you have to clear the broswser cache and restart the browser
>> to get
>> rid of the script.
>>
>> Regards, Dave Hodgins
>>
>
> It's possible I could be wrong but a retest still didn't come up with
> anything.
>

It resolves to here: http://news861.com/

Then it has a mind of its own when clicking on other tabs! Interesting!

This is a screenshot of the product being promoted:
http://i45.tinypic.com/v2xxmb.jpg