I’ve received several emails today, all matching the same pattern. The email comes iwth a range of subjected and from a range of senders but the enclosed web link, when clicked brings you to the same html, all located on different IP addresses. The few ip addresses I looked up seemed to be typical home computer users which probably means that they are infected machines running spam bots .
Here’s one – Subject is ‘Registration Details‘
Greetings, We are so happy you joined Ringtone World. User Number: 8191539133 Temorary Login: user4089 Your Password ID: ce630 Be Secure. Change your Login ID and Password. Use this link to change your Login info: http://18.104.22.168/ Thank You, Technical Services Ringtone World
Going to the link brings up this webpage (it also loads a fake video viewer window with no content):
If you do not see the Secure Login Window please install our [malware removed]
Clicking on the link will download the file applet.exe which my Fprot antivirus recognised as a virus but failed to identify the name.
‘User Services’, ‘User Info’, ‘Internal Support’, ‘Technical Support’, ‘Registration Details’
‘Pet World’, ‘Ringtone World’, ‘Funny-Files’, ‘Recipies-Galore’, ‘Ringtone Heaven’ and plenty more.