/tpage.html links?

Discussion in 'malware problems & news' started by baumgrenze, Aug 19, 2011.

Thread Status:
Not open for further replies.
  1. baumgrenze

    baumgrenze Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    10
    I will display my lack of sophistication regarding the web by the question below.

    In the past 2 days I have, via a Yahoo Group and email, seen two messages from a friend, who's computer I believe is infected, each of which contained a link to open that ended in the string "tpage.html."

    One was:

    "-ribes.org/tpage.html-"

    and the other was

    "-calliopecivita.it/tpage.html-"

    In each case, the root URL is a legitimate one, ribes.org points to the village of Sant Pere de Ribes in Barcelona province, Catalonia, Spain, and calliopecivita.it points to a Cultural Association "Calliope" in a comune and town in the Province of Chieti in the Abruzzo region of Italy.

    A Google search for the string "-calliopecivita.it-" yields some suspicious looking hits involving "-makequickeasymoneyin.blogspot.com-" and "groups.yahoo.com/group/groupsex_kabisyo/" among others.

    Is it possible that this string "/tpage.html" could be used as a tool to prevent users from accessing such a page. I tried searching in on Google, but, in their wisdom they ignored the slash character, frustrating my attempt to narrow the search.

    I bring this to the attention of the security community in a hope that it may be of some use in furthering the cause of internet security.

    thanks,

    baumgrenze
     
  2. stackz

    stackz Registered Member

    Joined:
    Dec 27, 2007
    Posts:
    619
    Location:
    Sydney Australia
    Both links you mentioned redirect to the same URL, which then redirects to a well known exploit kit.

    /tpage.html has no great significance. It's just the name that was chosen and is an aesthetically 'friendly' name.
    /clickhereformalware.html wouldn't be too enticing. ;)
     
Thread Status:
Not open for further replies.