http://ripdonna.{BLOCKED}ot.in

May 21, 2012
 Analysis by: Jonathan Michael Beltran
 URL BLOCKING DATE/TIME: 18 May 2012 01:10:00 PM GMT-8
 RATING: HIGH
 DOMAIN: blogspot.in
 CATEGORY: Disease Vector
 DESCRIPTION:

News of Donna Summer's death, which was reported on May 17, 2012, prompted scammers to ride on this news wave to lure users into survey scams. A Facebook fan page for the artist with the wall post RIP DONNA SUMMER , Go here for here last moment and Funeral picture invited users to click on a link to view the artist's supposed funeral photo. Doing so, a user is led to this URL that urges users to download the photo. The download link {BLOCKED}e.url/{four letters} hosts the file Donna Summer.rar, a supposed archived file of the photos. Since the said URL is a file hosting URL, users are asked whether to download via Regular or Premium service. Choosing the Regular service, users are then led to a page where surveys are listed. Choosing a survey leads to the site {BLOCKED}actory.com/{survey identifier}.



Users are advised to look closely at links before clicking on them. Direct inquiry via news sites are highly encouraged. Trend Micro blocks access to this URL as well as the related URLs and sites in this attack.