I’ve received several emails today, all matching the same pattern. The email comes iwth a range of subjected and from a range of senders but the enclosed web link, when clicked brings you to the same html, all located on different IP addresses. The few ip addresses I looked up seemed to be typical home computer users which probably means that they are infected machines running spam bots .

Here’s one – Subject is ‘Registration Details‘

Greetings,

We are so happy you joined Ringtone World.

User Number: 8191539133
Temorary Login: user4089
Your Password ID: ce630

Be Secure. Change your Login ID and Password.

Use this link to change your Login info: http://24.14.127.121/

Thank You,
Technical Services
Ringtone World

Going to the link brings up this webpage (it also loads a fake video viewer window with no content):

If you do not see the Secure Login Window please install our [malware removed]

Clicking on the link will download the file applet.exe which my Fprot antivirus recognised as a virus but failed to identify the name.

Other subjects
‘User Services’, ‘User Info’, ‘Internal Support’, ‘Technical Support’, ‘Registration Details’

Other Sites
‘Pet World’, ‘Ringtone World’, ‘Funny-Files’, ‘Recipies-Galore’, ‘Ringtone Heaven’ and plenty more.