Not content with fake meds and exploit etc spam impersonating the likes of Facebook, Twitter, Google and countless others, it seems the fake meds gangs have decided to impersonate Digg now too. Quite why is a bit puzzling, but likely "just because they can". If like me, you have email only displayed in plain text, then you'll see what it is and where its taking you, straight away, else the original HTML version of the email is as per the screenshot on the left.
I've had 3 of these so far, all with different URLs in the emails;
All leading to the same domain, in this case;
Spam has only originated from 2 IPs so far (doubt that's all that is involved, more likely more origins will pop up once more of their spam comes in), as usual.
18.104.22.168 - deimos.surnet.ru - 3239 - 3239 22.214.171.124/20 RU-SURNET Uralsvyazinform, Chelyabinsk branch
126.96.36.199 - server.furnitureinfashion.net - 29550 - 29550 188.8.131.52/18 SIMPLYTRANSIT Simply Transit Ltd
A quick check on the IP the fake meds site resides at, shows around 395 domains that are known to have resided there recently (running a check as I write this, but likely some have already moved elsewhere, indeed a quick glance at the results so far, shows some have moved to 184.108.40.206 for example).
I'll pop a copy of the results on here once the validation has finished, but the list of domains in the meantime;