Server too busy on some kind of phishing sites?

  • Thread starter Thread starter Duh_OZ
  • Start date Start date
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Someone sent me a few links of suspicious links, but all I get is
'server too busy' so cannot figure out if they are trying to
distribute malware or just trying to gather personal intel.
Click to expand...

Forgive me for stating the obvious, but if they're "suspicious links"
why do you want to click on them?

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBTPexw6RseRzHUwOaEQIFbwCgwpVG+tMzlzuf0xfLBmSlkAA8NeYAoKBS
BUpDHeWeyqbtEJYIH2/iJe+p
=6Cnl
-----END PGP SIGNATURE-----

--
Laura Fredericks
PGP key ID - DH/DSS 2048/1024: 0xC753039A

usenet flamewars:
http://www.queenofcyberspace.com/usenet/

Remove CLOTHES to reply.
 
Laura Fredericks said:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Forgive me for stating the obvious, but if they're "suspicious links"
why do you want to click on them?
Click to expand...

To obtain the suspicious content.

Because he ...
 
To obtain the suspicious content.

Because he ...
Click to expand...

Wanted to see what the hook was!

Assuming it was malware, first to see if Kaspersky would catch it
(before a download attempt I use a "view-source:link" ) and then if
not flagged by 'K, download it and submit it to VT.

Moot of course since I could not access either.
 
To obtain the suspicious content.

Because he ...
Click to expand...

Wanted to see what the hook was!

Assuming it was malware, first to see if Kaspersky would catch it
(before a download attempt I use a "view-source:link" ) and then if
not flagged by 'K, download it and submit it to VT.

Moot of course since I could not access either.

***
Probably just "ThinkPoint" scareware.
***
 
Duh_OZ said:
Someone sent me a few links of suspicious links, but all I get is
'server too busy'
Click to expand...

I can connect but both servers take ages to respond.
so cannot figure out if they are trying to
distribute malware or just trying to gather personal intel.
Click to expand...

Could be either/both, a way of adding you to spam lists, or a scam to
lighten your wallet but they want you to "join" to find out.
One uses a Skype hook: hxxp://www.skype-2011-support.net
Click to expand...

Redirects to:
h**p://www.voip-2010-instant-download.net/index.asp?aff=13340
Following a "join" link:
h**p://www.voip-2010-instant-download.net/join.asp
redirects to:
h**ps://secureonline.ru/p05/join.aspx?siteid=5686&product=152&cli=7&descriptionid=skype1&lng=en
redirects to:
h**ps://secureonline.ru/p05/(S(ar5t01jusdlnzm45l4nhzc55))/join.aspx?siteid=5686&product=152&cli=7&descriptionid=skype1&lng=en

- - -
Step 1

Create your login

 Make worldwide calls to anyone now! Get instant access by filling in
 the information below:

 Your E-mail: [ ]
 Confirm E-mail: [ ]

 Download Instructions will be sent to this email. Your personal info
 is kept confidential.

Contact information

 First Name: [ ]
 Last Name: [ ]
 Country/Region: [ ]

[ ] Yes, I wish to receive discount coupons, special offers or promotions
 about other products  [Proceed to Next Step]
- - -
The other Adobe:  hxxp://www.adobe-2011-downloads.net
Click to expand...

Redirects to:
h**p://www.new-2011-pdf-download.com/1/
Following a "join" link:
h**p://www.new-2011-pdf-download.com/join.asp
redirects to:
h**ps://secureonline.ru/p05/join.aspx?siteid=5704&product=pdf&cli=7&descriptionid=pdf1&lng=en
redirects to:
h**ps://secureonline.ru/p05/(S(ijuzky55o55p3tunvd1ri5bo))/join.aspx?siteid=5704&product=pdf&cli=7&descriptionid=pdf1&lng=en

Gives the same login creation page as before but the first sentence is:
"Get the best PDF Manager available today!"
Click to expand...

====================
Thanks: i was finally able to get to one of the pages but took 5
minutes to load.

I did find this write-up about it:
http://blog.mxlab.eu/2010/09/14/mal...at-2010-pdf-reader-and-voip-addons-for-skype/
http://tinyurl.com/2ep7p5j

I changed the subject to add an *OT* as it is just a spoof site to
collect intel and not deliver any malicious code (or so it seems).
 
Back
Top