Quick Links: SpywareGuide Greynets Blog | SpywareGuide Product Database | SpywareGuide Company Database | SpywareGuide Categories
SpywareGuide powered by FaceTime Security Labs
Search SpywareGuide Greynets Database & Site
Security Email Alerts & Updates
Search the Blog
 
Recent Posts
Categories
Monthly Blog Archives
Links
Subscribe
Subscribe to this blog's feed
About the Blog
About SpywareGuide Greynets Blog
Link to Us
Link to SpywareGuide.com

« Fake MSN Live Program Steals Login Details | Main | A Blast From The Past Appears On Facebook »

  • Myspace Spam Profiles With Multiple Identities

Here's an interesting twist on the usual fake profile invites I regularly receive on Myspace.

fcprofs1.gif

Normally, you click the link and are taken to a standard fake profile advertising webcams or something of a similar nature. If you refresh the page, you'll see the same content - just like a regular Myspace profile. Well, in this case the code used by the bad guys means the page is no longer static. Refreshing the spam profile will endlessly cycle through a whole raft of fake overlays and images:

http://blog.spywareguide.com/upload/2008/03/fcprofs2-thumb.gif
http://blog.spywareguide.com/upload/2008/03/fcprofs3-thumb.gif
http://blog.spywareguide.com/upload/2008/03/fcprofs4-thumb.gif
http://blog.spywareguide.com/upload/2008/03/fcprofs5-thumb.gif
Click To Enlarge The Above 4 Images

All of the above pop up on the profile link I was sent (you can see the URL remains the same in each screenshot).

How do they do it? Well, they're overlaying the profile page with a large clickable image, a common tactic that was used in the Myspace band hacks from a while ago. Here's the code:

fcprofs6.gif

In other words, a random image (made to look like a Myspace profile) is served from here:

free-hotwebcam(dot)com/Images/00110/KKD90g4aKKXNSTKhUvj04RO7WQDhw(dot)jpg

And clicking it will take you here:

snurl(dot)com/20h89-holo

Which redirects you to

privaterooms(dot)biz/t-main027(dot)html

...before finally leaving the end-user at the eventual destination of teen(dot)livecamfun(dot)com. The curious thing is, why would you bother to make your spam profile pages dynamic in this way? Once you've seen one, you leave it and don't go back. I can't imagine someone revisiting the page simply because the images keep changing...

  • TrackBack

TrackBack URL for this entry:
http://blog.spywareguide.com/mt/mt-tb.cgi/275


Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)


Site EULA | Site Map | Contact Us | About Us | Site and Spyware FAQ | Advertise | RSS Feeds  | Link To Us | SpywareGuide JapanJapanese

© Copyright 2006, FaceTime Communications, Inc. All rights reserved.