SKYPE 2010 e-mails - beware SKYPE USERS

aerostar

Beware of the following email

=========================================
SKYPE VoIP ADDONS UPDATES

This is to notify that new updates have been released for Skype. Following
are major new features:

- Talk more for free via Voice Over IP (VoIP)
- Lower cost when connecting to landlines (much cheaper than Calling Card)
- Record your conversation (better than telephone quality)
- Instant messaging & file-sharing, video calls
- Now available on PSP!
link removed but is skypehyphenhyphen2010dotcom

To check and upgrade, go to Skype Updates Center or copy this link to your
web browser:
skypehyphenhyphen2010dotcom

Skype has changed the way we think of telecommunications.

Thank you for choosing us.

With best regards,

Skype Support

Copy rights Skype 2010 - All Rights Reserved
=============================================

It has nothing to do with skype, the domain is registered to
Registrant ID: ZA5XXWT-RU
Registrant Name: John Terry
Registrant Organization: John Terry
Registrant Street1: 1729 Park Way
Registrant City: London
Registrant Postal Code: H38LA92
Registrant Country: GB

DNS servers in Russia !!!
Postcode is a fake.


If you click on the link it takes you to another site, then onto a Russian site asking for details and will then send you a link for download....all highly suspicious. You can download the SKYPE program from SKYPE direct.

Do not click the unsubscribe link on it either.

DO NOT BE CAUGHT OUT -

The real SKYPE downloads are here
http://www.skype.com/intl/en-gb/get-skype/on-your-computer/windows/

michaelmcguk

It would appear "John Terry" is also involved with this for Adobe Acrobat...

ADOBE PDF READER SOFTWARE UPGRADE NOTIFICATION

This is to remind that a new version of Adobe Acrobat Reader with enhanced features for viewing, creating, editing, printing and internet-sharing PDF documents has been released.

To upgrade your application:

+ Go to adobe-reader-upgrade dot com
+ Get your options, download and upgrade.

DOWNLOAD ADOBE ACROBAT READER

Thanks and best regards,

Ken William

Adobe Acrobat Reader Support

Copy rights Adobe 2010 © All rights reserved
1005 Marrinbird Rd | Merryton | CA | 96523 | USA
Website :


_____________________________
Unsubscribe / Change Profile:
Powered by YourMailingListProvider

nickcardwell

yep got the same emails myself, already reported as spam,

they use a mail server called ymlp33.net (http://www.yourmailinglistprovider.com/)

paulofessex

Got this email today

Hrafnahnef

We came across a very similiar case yesterday.

It is the same fake domain registrant, with a yahoo-emailaddress (dit4free@yahoo.com), +1 800-telephone number (american free of charge number) and this John Terry at 1729 Park Way, registered through nic.ru. The same mailing list provider (ymlp) is used.

The IP address is located in Russia, with a russian DNS and with the nginx web server software (which, not very surprisingly, is a web server software originated from Russia).

Their site (tailoronlinestore dot com) was registered on September 27th, but it all it ever does is redirect (http 302) to tailorstore dot se (our swedish domain).

The mail itself is an *EXACT* copy of one of our old newsletters, in Swedish, but the links are changed to ymlp-links. However, all the link will do a http 302-redirect to our true site. No strange download link at all.

From our findings, it looks like Adobe is also targeted in a very similar John Terry-attack.

We noticed this after a Swedish non-customer alerted us yesterday that she suspected a phishing attack. In our server logs, we have found 1800 attempts during the last couple of days to retrieve the image header in the newsletter, which means it has been read by quite a lot of people considering no direct attack has taken place yet.

Hrafnahnef

Btw, we telneted in to the Russian server with multiple spoofed user agents with known security vulnerabilities, and neither of them made anything but a hard redirect to our Swedish site.