It’s been over a month since we wrote about fake Twitter email messages, and if it worked once for scammers/spammers, they’ll certainly try it again. Commtouch labs is seeing large quantities of – you guessed it – fake Twitter email messages, similar to the one here:
How can the uninitiated determine that it’s not a real message from microblogging service Twitter? Well, the typo in the subject and body give the first clue (it should say “2 direct messages” not “message” in the singular – but that’s just petty). The really easy way to tell is to simply mouse over the “twitter” URL and look for the real URL that will show up either at the bottom of the window, or right over the cursor, depending on your email program. If the real URL is not a Twitter URL, then it’s definitely a scam.
I can’t even tell you what this particular message was trying to get from its recipient since by the time I clicked the link — less than 24 hours after it had been received — the link was already dead. Past fake Twitter messages have been pharmacy spam, but since the site was already taken down it may have been phishing. A short-lived landing page is also a surefire sign that the email is not legit. Real web sites typically keep their landing pages around for a long time — practically forever, in fact — since no marketer wants to take the chance that someone will open their mail several weeks after its been sent and execute the sought-after act of clicking through, and then have this enchanted potential customer land on a non-existent page. Spammers, phishers and scammers, however, are always trying to outrun security software and the law, and one of the ways they try to do so is to keep their sites up for a very short time. The flood inboxes with messages linking to the ephemeral spam/scam/phish landing page, and anyone that they can convince to click through in the short time the page is live, clicks, anyone after that short time the site is taken down has been saved from the scam or pharmacy/replica site simply by being slow to open their email.
Update: 26 April
We found a live site from the continuing attacks – as before the Twitter notifications lead to pharmacy sites such as the one shown below (note the Easter branding).