During the last 24 hours, I started to received a lot of spam messages based on Google Docs.
The e-mails look like:
From: <random address> To: <me> Subject: Monthly Payments Keep Rising. If you are one of the many homeowners whose payments are high and home values are low, or you are at risk of falling behind or going into foreclosuree, you can get everything back on track today with a loan modification which will revalue youur hoome and base your new payments on the current home value. This will work whether you are behind or current with payments. http://docs.google.com/View?id=dg2mdwtk_0d8wgvzs9
If you click on the link above, you will see:
 |
Then, if you click on the second link, you will connect to http://fgdfgfd5e.cn. The site is hosted in Bengladesh:
inetnum: 115.126.5.0 - 115.126.5.255 netname: BD-TLCM-0182 country: BD descr: Bangladesh Telegraph and Telephone Board , PSTN Service, Data descr: and Internet service provider admin-c: BA137-AP tech-c: BA137-AP status: ALLOCATED NON-PORTABLE changed: hostmaster@bd-telecom.net 20081016 mnt-by: MAINT-BD-TLCM source: APNIC
The root file (“/”) simply redirects to google.com:
HTTP/1.1 302 Found Date: Wed, 10 Dec 2008 11:20:42 GMT Server: Apache/2.2.3 (Unix) PHP/5.1.6 X-Powered-By: PHP/5.1.6 location: http://google.com/ Content-Length: 0 Content-Type: text/html
My first impression was that some malware code could be installed via this URL but nothing. Just a redirect to Google. Anybody has more info? Google started to index the same type of messages in some forums.