NEWS FROM THE LAB - Tuesday, September 7, 2010

Facebook Spam Worm Links to "Mobile Entertainment" Posted by Sean @ 11:59 GMT

The survey spam worm that spread across Facebook yesterday was posted to profile Walls "via Mobile Web".

In here the lab, we're always interested in all things mobile, so we took another look at All Facebook's post. In an update, they show that the spam was also spreading via messages.

And there is a link visible in the screenshot pointing to artcentertransportation.com:


That site is registered to a "Jane Doe" and is hosted in the USA by Dynamic Dolphin. Visiting the URL from Finland simply redirects to another site called Wixawin (via tracklead.net) which offers "Mobile Entertainment". And what kind of entertainment do they offer?

The kind that could cost you upwards of �17.50 per month in subscription fees.

This is what you'll see if you attempt to visit Wixawin with our Mobile Security Browsing Protection enabled.

Mobile Security Browsing Protection

The affiliate ID that appears to be behind much of this mischief is: "affiliateid=WANE". Perhaps the spam was being posted via Mobile Web so that it included the necessary referrer?

In any case, let's hope that the affiliate network revokes whatever leads this spammer may have made.