Search Engine Optimization & Web Hosting Solution

TOKYO (MacHouse) - More than 22 hours ago, an international cyber criminal circulated a spam message titled Homeless man wins lottery. (See Screenshot 01.) The body of the message contains only one sentence. It only says






Click here for the best soccer goals of the century http://http://www.pussi.vnet.ee/r.html

Screenshot 01 - Source: MacHouse

Screenshot 02 - Source: MacHouse

The link shown in the message is what it says is. But you don’t want to click on it. The forwarding website is another fake PornTube website that awaits Internet users with a file possibly containing computer viruses targeting Windows OS users. So if you have received a copy, you probably want to trash it without clicking on the given link to visit a fake PornTube website.

Let’s take a quick look at the the HTML source code of the spam message. The header appears to be manipulated to make it look like a user at refuahhealthcenter.com has something to do with this spam operation. (See Screenshot 02.) The true origin of the spam message is rather the IP address of 87.16.147.82, which belongs to Telecom Italia S.P.A.

Screenshot 03 - Source: pussi.vnet.ee

Screenshot 04 - Source: pussi.vnet.ee

Screenshot 05 - Source: pussi.vnet.ee

If you actually bother to access http://http://www.pussi.vnet.ee/r.html, you will see a static fake error message window that says Video ActiveX Object Error: Your browser cannot display this video file. (See Screenshot 03.) You won’t be forced to download a malicious file at this moment. But if you click any part of the fake error message window, the web browser will keep giving you an error message as shown in Screenshot 04 unless you click on the OK button or force-quit the web browser. Then you will be forced to download a file titled video.exe. (See Screenshot 05.)

Screenshot 06 - Source: Domain Tools

Screenshot 07 - Source: pussi.vnet.ee

Screenshot 08 - Source: pussi.vnet.ee

So where is this scam website hosted? As the top-level domain suggests, it’s possibly hosted in Estonia. There is nothing that you can find out about the identity of the group installing the fake PornTube website by seeing the domain registration. (See Screenshot 06.) That’s because they are most likely using a hacked website to host this fake PornTube website. If you access the root directory (www.pussi.vnet.ee), you will reach a benign website whose title says Unofficial site of Püssi city. (See Screenshot 07-8.)

********** ********** ********** ********** ********** ********** ********** **********

MacHouse is not funded by tax payers' money. We have limited resources. We also need time to sleep and eat just as others. So we will not act as the International police to contact all victims of website abuse. All you have to do is to subscribe to spam messages and spam posts. If we can, why don't you?