Twitter Profile Links Used For Malware Attacks?

I had an interesting moment this evening while checking my latest Twitter follower emails.  A Twitter account for @DrTwitty had followed me.  I check the profile of everyone who follows me to see whether I want to follow them back straight away, or wait a while before following them back.

This one caught my attention immediately for a few reasons:

1. Relatively new account, hasn’t been tweeting for long
2. The “hot chick” profile picture, typical of spam accounts
3. Claims to be a “Twitter Application Developer” and is promoting a mystery Twitter app
4. Profile link is a tr.im URL that is a direct zip file download link from an IP address.  The IP address has no reverse DNS entry, and a trace disappears into the web with no real clue as to where the server lives other than that the IP is owned by Future Hosting (a US host I’ve never heard of one way or the other).

I downloaded the zip file into a virtual PC I use for just this kind of testing.  It detected no malware, but the zip file itself was found to be corrupted (either a download problem or the original file on their server is corrupted).

Without knowing for sure that Dr Twitty is trying to run some kind of scam or malware attack here I definitely think they are acting in a suspicious manner.  The internet is an automatic “no trust zone” and if Dr Twitty is trying to promote the greatest Twitter application on the planet no one sensible is really going to trust them based on a suspicious Twitter profile and zip file download link like that.

Certainly this is a reminder for all of us exploring Twitter to keep our guard up and not let the excitement of a new medium override the usual caution we need to apply when dealing with strangers online.

If anyone knows anything else about Dr Twitty feel free to leave a comment below.  If I find out any more I will update the post.