bogus email arrived

[JIP]

Hi

Just had an email arrive, purportedly from a friend who has an aol
webmail account.

The only content of the mail was the link as below
http://www.decordenunta.ro/dfpois.html?aaj=jpteeu

The mail was sent to me and a few others in his address book, but also
to a couple of strange addresses like Canon & John Lewis who werent in
his address book.

I checked and confirmed it was not he who sent the email.

He has now changed the password on his aol account, but can anyone
explain how a mail could have been sent, as if from him, to some
addresses in his address book, and to some addresses he did not have in
his address book.

Many thanks

\jip



--

[David H. Lipman]

From: "JIP" <JIP@xxnospamxxy1.com>

> Hi
>
> Just had an email arrive, purportedly from a friend who has an aol
> webmail account.
>
> The only content of the mail was the link as below
> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
>
> The mail was sent to me and a few others in his address book, but also
> to a couple of strange addresses like Canon & John Lewis who werent in
> his address book.
>
> I checked and confirmed it was not he who sent the email.
>
> He has now changed the password on his aol account, but can anyone
> explain how a mail could have been sent, as if from him, to some
> addresses in his address book, and to some addresses he did not have in
> his address book.
>
> Many thanks
>

Spam not malware.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[JIP]

David H. Lipman wrote:

> From: "JIP" <JIP@xxnospamxxy1.com>
>
> > Hi
> >
> > Just had an email arrive, purportedly from a friend who has an aol
> > webmail account.
> >
> > The only content of the mail was the link as below
> > http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
> >
> > The mail was sent to me and a few others in his address book, but
> > also to a couple of strange addresses like Canon & John Lewis who
> > werent in his address book.
> >
> > I checked and confirmed it was not he who sent the email.
> >
> > He has now changed the password on his aol account, but can anyone
> > explain how a mail could have been sent, as if from him, to some
> > addresses in his address book, and to some addresses he did not
> > have in his address book.
> >
> > Many thanks
> >
>
> Spam not malware.

Thanks David

--

[David W. Hodgins]

On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman <DLipman~nospam~@verizon.net> wrote:

> From: "JIP" <JIP@xxnospamxxy1.com>
>> The only content of the mail was the link as below
>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu

> Spam not malware.

Are you sure? It loads
https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js

If I'm reading it correctly, it would be a bad idea to visit the above site with
javascript enabled, and then go to login to facebook, event if you've closed
the above site.

I've seen similar scripts targeting yahoo, msn, etc.

I think you have to clear the broswser cache and restart the browser to get
rid of the script.

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

[David H. Lipman]

From: "David W. Hodgins" <dwhodgins@nomail.afraid.org>

> On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman
> <DLipman~nospam~@verizon.net> wrote:
>
>> From: "JIP" <JIP@xxnospamxxy1.com>
>>> The only content of the mail was the link as below
>>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
>
>> Spam not malware.
>
> Are you sure? It loads
> https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js
>
> If I'm reading it correctly, it would be a bad idea to visit the above
> site with
> javascript enabled, and then go to login to facebook, event if you've
> closed
> the above site.
>
> I've seen similar scripts targeting yahoo, msn, etc.
>
> I think you have to clear the broswser cache and restart the browser to
> get
> rid of the script.
>
> Regards, Dave Hodgins
>

It's possible I could be wrong but a retest still didn't come up with
anything.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[~BD~]

David H. Lipman wrote:
> From: "David W. Hodgins" <dwhodgins@nomail.afraid.org>
>
>> On Wed, 11 Jul 2012 17:26:48 -0400, David H. Lipman
>> <DLipman~nospam~@verizon.net> wrote:
>>
>>> From: "JIP" <JIP@xxnospamxxy1.com>
>>>> The only content of the mail was the link as below
>>>> http://www.decordenunta.ro/dfpois.html?aaj=jpteeu
>>
>>> Spam not malware.
>>
>> Are you sure? It loads
>> https://s-static.ak.fbcdn.net/rsrc.p...Q9960T8nf3v.js
>>
>> If I'm reading it correctly, it would be a bad idea to visit the above
>> site with
>> javascript enabled, and then go to login to facebook, event if you've
>> closed
>> the above site.
>>
>> I've seen similar scripts targeting yahoo, msn, etc.
>>
>> I think you have to clear the broswser cache and restart the browser
>> to get
>> rid of the script.
>>
>> Regards, Dave Hodgins
>>
>
> It's possible I could be wrong but a retest still didn't come up with
> anything.
>

It resolves to here: http://news861.com/

Then it has a mind of its own when clicking on other tabs! Interesting!

This is a screenshot of the product being promoted:
http://i45.tinypic.com/v2xxmb.jpg