MX Lab, http://www.mxlab.eu, started to intercept a large spam campaign with the subject “Twitter – You have X unread message(s)”, where the X is a number from 1 to 3,  that leads to the U.S. Drugs web site. This campaign is slightly different from the previous campaign at the end of February 2011 but leads to the same pharmacy site.

The campaigns is send from the spoofed email address “Twitter <twitter-message-RECIPIENT=DOMAIN@postmaster.twitter.com>” where the recipients email address is included in the from address.

An example of the email:

The final destination of the URL:

More information regarding this site can be found at http://spamtrackers.eu/wiki/index.php/US_Drugs.

• Spam from Canadian pharmacy masked as “Delivery Notification”
  MX Lab, http://www.mxlab.eu, started to intercept a new spam campaign by email with the subject ”Delivery Notification”. What appears at first as a simple email notification is in fact a s...
• iTunes abused in spam campaign that redirects users to online pharmacy
  MX Lab, http://www.mxlab.eu, started to intercept a spam campaign that is abusing iTunes to redirect users to the online site of Pharmacy Express. The email messages comes from the address iTunes Stor...
• Dissecting the Exploits/Scareware Serving Twitter Spam Campaign
  Yesterday's exploits-serving campaign spreading across Twitter, using automatically registered accounts "pinging" random Twitter users with links to the campaign, is worth profiling due to its state o...
• Twitter and YouTube Spam Campaign in Disguise
  We have seen several spam emails recently disguising itself as a legitimate email from Twitter and YouTube. Sample Twitter Spam Email --------------------------------------------------------------...
• Twitter Password Spam Campaign
  We have witnessed that using Social Networking as a theme for spammed emails is a very effective way of tricking users to execute malware in their system. This time, malware authors used Twitter, a s...
• Is Kian Egan leaving Westlife or has he been Twitter hacked?
  Kian Egan, a singer with the Irish boyband Westlife, has been forced to deny that he is leaving the chart-topping pop group after statements were posted on his Twitter account. Egan had over 60,000 fo...
• Unfollowed Me rogue application spreads virally on Twitter
  Once again Twitter users are finding themselves hit by a fast-infecting attack, more commonly encountered by their Facebook-using cousins: a rogue application spreading virally across the network. Tho...
• The cake is a lie.
  Delicious cake - for years, the symbol of a reward never to materialise.This sad trend continues with the upcoming release of Portal 2, which - as you would expect - is prompting a rash of utterly fic...
• The Increasingly Shapeshifting Web
  Short URL services are problematic, and they are becoming even more so in combination with IP location technologies.From twitter.com earlier today:If you look closely, you'll notice it's one spambot, ...
• Facebook Events, Credits, and Passwords Being Used for Attacks
  Facebook has expanded its range of service offerings, making the site so much more than a place where users can interact with one another. It has been said several times that Facebook is bound to repl...