Subject: Classmates Organisation.Reunion Website Builder
From: "Classmates Messagebox#329" email@example.com
Dear Classmates customer.
Classmates Day 2009 soon!
Video Invitation from your Classmates "2009 Classmates Day Announcement!" prepared to view.
Reunite Your High School Classmates and Celebrate This Day!
Your Classmates Are Waiting to Hear From You!
Proceed to view Your invitation now>>
With best regards, Lowell Abernathy.
Copyright 1995-2008 Classmates Online, Inc. All Rights Reserved.
Unfortunately, the stupidity of spammer is such the they have messed up the incredibly long URL, and if the users click on the link they'll get nowhere. The spammer is trying to send visitors to a subdomains of clasmatessup.com but they have forgotten the dot before com and instead are sending visitors to clasmatessupcom.
If you go to the effort of correcting the link, you get redirected to a site on a fast flux botnet which prompts you: Can't see the video? please download the Adobe_Player v10 Converter and this leads to a downloaded called AdobePlayer10.exe which actually doesn't appear to be malware (at the moment) as it identifies itself as "IIS Fortezza Setup Utility" which is a security add-on to Microsoft IIS servers, usually called fortutil.exe.
So, it's all kinda strange. Let's have a look at the WHOIS details for the domain:
Domain name: clasmatessup.comOf course, these are fake. The registrar is BIZCN.COM, who are often a registrar of choice for spammers. Of real interest are the name servers, ns1.licence-dsl.com is 18.104.22.168, ns2.licence-dsl.com is 22.214.171.124. 126.96.36.199 is an IP address connected with the Srizbi botnet and is a name server for a whole buncha domains.
Greff Frelos firstname.lastname@example.org
4576810811 fax: 4576810811
8883 Sh Road
New York NY 10003
If you run a corporate mail system, it might well be worth blocking email "from" classmates.com in any case, even if this time the spam is hugely unsuccessful, because all the bad guys will do is repackage it up and send it out again.