/tpage.html links?

Discussion in 'malware problems & news' started by baumgrenze, Aug 19, 2011.

Thread Status:
Not open for further replies.
  1. baumgrenze

    baumgrenze Registered Member

    Feb 24, 2005
    I will display my lack of sophistication regarding the web by the question below.

    In the past 2 days I have, via a Yahoo Group and email, seen two messages from a friend, who's computer I believe is infected, each of which contained a link to open that ended in the string "tpage.html."

    One was:


    and the other was


    In each case, the root URL is a legitimate one, ribes.org points to the village of Sant Pere de Ribes in Barcelona province, Catalonia, Spain, and calliopecivita.it points to a Cultural Association "Calliope" in a comune and town in the Province of Chieti in the Abruzzo region of Italy.

    A Google search for the string "-calliopecivita.it-" yields some suspicious looking hits involving "-makequickeasymoneyin.blogspot.com-" and "groups.yahoo.com/group/groupsex_kabisyo/" among others.

    Is it possible that this string "/tpage.html" could be used as a tool to prevent users from accessing such a page. I tried searching in on Google, but, in their wisdom they ignored the slash character, frustrating my attempt to narrow the search.

    I bring this to the attention of the security community in a hope that it may be of some use in furthering the cause of internet security.


  2. stackz

    stackz Registered Member

    Dec 27, 2007
    Sydney Australia
    Both links you mentioned redirect to the same URL, which then redirects to a well known exploit kit.

    /tpage.html has no great significance. It's just the name that was chosen and is an aesthetically 'friendly' name.
    /clickhereformalware.html wouldn't be too enticing. ;)
Thread Status:
Not open for further replies.