Thursday, 29 September 2011 spam

Here's a spam with a twist.
From: skype@[spammer's email redacted for legal reasons]
Date: 29 September 2011 07:23
Subject: New Updates Have Been Released For Skype ! Download Now‏

This is to notify that new updates have been released for Skype.

Following are major new features :

* Up to 5-way group video call.
* Redesigned calling experience.
* Improved video snapshots gallery.
* Improved browser plugins performance on some websites.
* Reduced false positives on browser plugin phone number recognition.
* New presence icons.
* Improved handling of calling attempts made when the user has run out of credit.
* Improved access to sharing functionality

To download the latest version , go to :

Start downloading the update right now and let us know what you think
about it.

Talk soon,

The people at Skype
The email has been sent to an address harvested from the Epsilon data breach. That's not surprising.. what is surprising is that it has been sent through a UK company that specialises in selling mailing lists and sending bulk commercial email. Perhaps dealing in stolen data is an honest mistake, but perhaps the ICO would like to make that determination.

DNS resolution for this site seems to flip between [1&1, UK] and [Ninbo Lanzhong Network Ltd, China]. Of these, the Chinese address is the most interesting with the follow slimeware domains hosted:

If you live in the UK and have the technical expertise to identify the owner of the sending IP address, please consider filing a complaint with the ICO to make sure that they understand the issue.

Monday, 26 September 2011

SMS Spam: "Due to a new legislation, those struggling with debt .."

Some sort of debt management spam this time. You can bet that these people will probably charge a lot for their services, and dealing with spammers is usually a bad idea in any case.
Due to a new legislation, those struggling with debt can now apply to have it written off. For Free information reply INFO or to opt-out text stop. Free Text!
In this case, the spam originated from +447977237820 although these numbers change regularly.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

There's a good article about protecting yourself from unscrupulous debt management companies here.

Sunday, 25 September 2011

Fake jobs: and

Two new fake job domains with a twist, possibly the same scammers who are behind this long-running spam/scam campaign.

Domains were registered just yesterday via a Russian registrar to an address in Spain which is most likely fake:

    Ivan Gonsalez
    Organization: Ivan Gonsalez
    Address: P. de Extremadura 151
    City: Madrid
    State: Madrid
    ZIP: 28011
    Country: ES
    Phone: +34.914641145 

This rabbit hole goes a bit deeper than usual, because the email address has been used before, for the domain

person: Private Person
created: 2011.07.26
paid-till: 2012.07.26
source: TCI has a reputation for being spammy and it looks like a typical romance scam site. As with and, it's odd that a Spanish address is being used for domains that are either Russian TLD or are being registered through a Russian registrar. is hosted on at Ubiquity Server Solutions Atlanta, although it looks like the IP block might be rented out to a company called Nobis Technology Group LLC in Arizona.There are some nasty things going on in that IP neighbourhood according to SiteVet.

What else can we find on It turns out that there's a rich vein of nastiness here. - "Action Financial. All of your financial services in one place."
Chinese registrar, fake WHOIS details. Fake check scam. [1] [2]
Michael L. Walter
Michael Walter
314-849-7082 fax: 314-849-7011
2523 Ash Avenue
Saint Louis MO 63126
NS: and
Chinese registrar, fake WHOIS details. Fake job offers. [3]
Name: Ana Bates
Organization: Ana N. Bates
Address: 789 Pinchelone Street
City: Herndon
Province/state: VA
Country: us
Postal Code: 22090
NS: and - "Adena Finance. All of your financial services in one place."
Chinese registrar, fake WHOIS details.

Eric M. Dillinger
Eric Dillinger
+1.5305125808 fax: +1.5305125808
1467 Hill Croft Farm Road
Sacramento CA 95814
NS: and - "Arrow Financial Group"
Chinese registrar, fake WHOIS details. Money mule scam [4] [5]
William K. Breen
William Breen
606-542-3946 fax: 606-542-3922
62 Meadowcrest Lane
Flat Lick KY 40982
NS: and - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution. [6] [7]
Registrant ID:TOD-42629838
Registrant Name:Gertrude Mcmillan
Registrant Organization:Gertrude D. Mcmillan
Registrant Street1:250 Reynolds Alley
Registrant Street2:
Registrant Street3:
Registrant City:Long Beach
Registrant State/Province:CA
Registrant Postal Code:90808
Registrant Country:US
Registrant Phone:+1.5623772946
Registrant Phone Ext.:
Registrant FAX:+1.5623772946
Registrant FAX Ext.:
Chinese registrar, fake WHOIS details. Malware distribution. [8]

Richard J. Aguilar
Richard Aguilar
+1.2523933705 fax: +1.2523933705
3458 Green Acres Road
Swansboro NC 28584
NS: and - "Surprise!!!"
Chinese registrar, fake WHOIS details. Probably malware distribution.
Lincoln P. Miller
Lincoln Miller
+1.4156774378 fax: +1.4156774378
813 Boring Lane
San Francisco CA 94108
NS: and
Chinese registrar, fake WHOIS details. Fake job offers [9] [10]
Name: Fletcher Leach
Organization: Fletcher C. Leach
Address: 180 Deer Ridge Drive
City: Millburn
Province/state: NJ
Country: us
Postal Code: 07041
NS: and - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [11] [12]
Registrant ID:TOD-42637428
Registrant Name:Ernest Thomas
Registrant Organization:Ernest R. Thomas
Registrant Street1:228 Riverside Drive
Registrant Street2:
Registrant Street3:
Registrant City:Athens
Registrant State/Province:GA
Registrant Postal Code:30606
Registrant Country:US
Registrant Phone:+1.7068186834
Registrant Phone Ext.:
Registrant FAX:+1.7068186834
Registrant FAX Ext.:
Chinese registrar, fake WHOIS details. Malware distribution [13] [14]
Justin R. Martinez
Justin Martinez
+1.3235224026 fax: +1.3235224026
2898 Evergreen Lane
Pomona CA 91766
NS: and - "Surprise!!!"
Chinese registrar, fake WHOIS details. Malware distribution [15]
Name: Paula Huerta
Organization: Paula A. Huerta
Address: 3993 Payne Street
City: Hillsville
Province/state: VA
Country: us
Postal Code: 24343
NS: and

Querying the namesevers reveals some more domains that look worth blocking as well. In total, blocking the following related domains will probably be a very good thing to do.

Friday, 23 September 2011 injection attack in progress

Thousands of sites are currently being hit by an injection attack pointing to a domain registered to someone using the infamous domain for email.

   James Northone
   +1.5168222749 fax: +1.5168222749
   128 Lynn Court
   Plainview NY 11803

The site is hosted on which is the equally infamous Netserv Consult SRL in Romania. hosts the following sites:

These domains are pretty familiar, having previously been hosted in Lithuania. This marks them out as the same people behind the infamous LizaMoon attack.

Netserv Consult SRL host a wide variety of bad sites. Blocking ( - will probably do you no harm.

Thursday, 22 September 2011

Evil network: Relikts BVK / Sagade Ltd (

One of the most persistently evil IP ranges on the net, Sagade Ltd appears to deal exclusively with criminals and it is hard to find any legitimate customers at all. Despite the arrest of two people closely related to Sagade, the netblock seems to be very much active and still up to its old tricks.

Sites in this block are used for injection attacks, malware distribution, phishing and money mule recruitment.

The contact details for this block are:

inetnum: -
netname:        Sagade
descr:          users
country:        LV
admin-c:        AK6804-RIPE
tech-c:         AK6804-RIPE
status:         ASSIGNED PA
mnt-by:         andrejskaminskis-mnt
source:         RIPE #Filtered

person:         Andrejs Kaminskis
address:        Latgales 32/34, Rezekne, Latvia
phone:          +37127580487
nic-hdl:        AK6804-RIPE
mnt-by:         andrejskaminskis-mnt
source:         RIPE #Filtered
descr:          users
origin:         AS52055
mnt-by:         andrejskaminskis-mnt
source:         RIPE #Filtered

This gives the "Sagade" netname, Digging deeper into AS52055 gives:

aut-num:        AS52055
as-name:        Relikt
descr:          SIA "Relikts BVK"
org:            ORG-SB308-RIPE
import:         from AS15626 accept ANY
export:         to AS15626 announce AS52055
admin-c:        AK6804-RIPE
tech-c:         AK6804-RIPE
mnt-by:         RIPE-NCC-END-MNT
mnt-by:         andrejskaminskis-mnt
mnt-routes:     andrejskaminskis-mnt
changed: 20110601
source:         RIPE

Was the block transferred from Sagade to Relikts BVK? Possibly. RIPE gives the following contact details:

SIA "Relikts BVK"
Latgales 32/34
LV-4601 Rezekne

phone:   +37127580487
fax:  +37125390001
e-mail:  reliktbvk (at) gmail (dot) com
So, what's so evil on the  Relikts BVK / Sagade Ltd block. Here are some examples: (
Injection attacks [1] [2] [3] (
Injection attacks [4] [5] (
Injection attacks [6] [7] (
Injection attacks [8] [9] [10] (
Injection attacks [11] (
Injection attacks [12] (
Injection attacks [13] (
Malware distribution [14] [15] (
Malware distribution [16]  [17] [18] (
Malware distribution [19] (
Phishing [20] (
Injection attacks [21] (
Malware distribution [22] [23] (
Malware distribution [24] [25] [26] (
Malware distribution [27] (
Malware distribution [28] 

Clearly, blocking access to is an excellent idea, or use the list of domains at the end of the post. You can download a full list of current Relikts / Sagade hosted site from here [csv] with myWOT ratings attached.

What is amazing about this operation is that they still have upstream providers who are happy to allow this clearly criminal operation to continue.

Fake jobs:

Another fake job offer, part of this long-running series of spam/scam emails.

From: Spam Victim
Sent: 21 September 2011 20:18
To: Spam Victim
Subject: Current Vacancy


Solicitamos personal de cofianza para trabajo a largo plazo en la seccion financiera.
Estudiantes, amas de casa etc...
tambien pueden conseguir trabajo en la empresa, el trabajo no toma mucho tiempo, requiere de mucha responsabilidad.

No es marqueting! Ni nada parecido.
Trabajamos con mas de 10 paises del mundo para hacer nuestras transferencias.
La empresa se dedica a hacer transferencias de dinero local y internacional.

Sus datos personales favor enviar al correo electronico:

Deje su telefono movil para que nuestro operador se contacte con usted.

En espera de sus curriculums,  Ana Sykes

The email appears to come "from" the spam victim (here's why). The domain was registered just yesterday to an "Alexey Kernel" at a fake address in the Ukraine.

Some other "reply to" addresses are:

Subjects include "Current Vacancy", "Job Offer - Flexible Hours", "Get a New Job Today", "Current Open Position", "Administrative Assistant Vacancy" and "Employment Opportunity". Oddly, the subject is in English even though the body of the message is in Spanish.

The jobs offered will be money laundering and other illegal activities. If you have any samples that are different, please consider sharing them in the Comments. Thanks!

Wednesday, 21 September 2011 Joe Job is a site that is critical about politics in the Ukraine, and names several individuals and governmental bodies in connection with alleged wrongdoing.

Obviously, they have upset somebody because there is currently a Joe Job campaign against the site, presumably in an attempt to have the site shut down:

Subject: {Snuff filmes|Snuff films}
From: david -at-
Reply-To: dossieruacom -at-

{Hi!|Hello!|Good day!}
You can {see|watch|download} child {pron|porn} and snuff {filmes|films} now for free and without registration.
Just email us what do you want to see (child {pron|porn} or some snuff {filmes|films}) and we will
send you back what did you ordered. Only hardcore cam murders, children fukcing,
awesome bloody maniacs and vrigins may brind you a lot of brillian hours! This is
happened in reality and no any montage so be the one who seen this!

Contact us to pay for pron:
politblok -at-

In this case, the email came from a server called, a wholly legitimate domain that appears to have been hacked, hosted at Node 4 in the UK. The mail originates from (also Node 4). An examination of the mail headers indicates that it may originally have come from, an IP address in Milan, probably a compromised PC. is a political blog. There is no evidence at all that it is involved in distributing pornography or illegal material. If you receive an email of this nature, you should report it to the abuse address of the sender's IP, it is probably not worth bothering's web host.

Evil network: RONET / (

RONET (aka. seems to be a new netblock occupying the ( - range. This block has several sites recently moved from Netserv Consult SRL (who have a very bad reputation), all of which appear to be involved in criminal activity.

Although the number of sites is very low at present (just 30), the use of a /23 block indicates the perhaps this will be used for more sites very soon. Blocking preemptively would probably be an excellent idea.

Here are some examples of evilness: []
Money mule scam / fake jobs [1] [2] [3] [4] []
Malware distribution [5] [6] [7] []
Malware distribution [8]  [9]

Other domains are registered with fake WHOIS details which is never a good sign.

The range is registered to:

inetnum: -
netname:         RONET
descr:           FOP Varovaev Leonid Gennadevich
country:         EU
org:             ORG-VARO1-RIPE
admin-c:         AV6418-RIPE
tech-c:          AV6418-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          VAROVAEV-MNT
mnt-routes:      VAROVAEV-MNT
mnt-domains:     VAROVAEV-MNT
source:          RIPE # Filtered

organisation:    ORG-VARO1-RIPE
org-name:        FOP Varovaev Leonid Gennadevich
org-type:        OTHER
address:         H-1120 Budapest,  Street Gabor Denes, 4, Hungary
mnt-ref:         VAROVAEV-MNT
mnt-by:          VAROVAEV-MNT
source:          RIPE # Filtered

person:          Anton Varnai
address:         H-1120 Budapest
address:         Street Gabor Denes, 4
address:         Hungary
phone:           +3614585544
nic-hdl:         AV6418-RIPE
mnt-by:          VAROVAEV-MNT
source:          RIPE # Filtered

% Information related to ''

descr:           RONET
origin:          AS6753
mnt-by:          VAROVAEV-MNT
source:          RIPE # Filtered

Of note is the fact that was only registered two weeks ago with anonymous registration details. Also, note that although the address is in Hungary, the RONET name would indicate that it still has a ROmanian connection.

Another oddity is that the network announces itself as part of AS17088 which is allocated to Currenex, Inc. There seems to be no connection at all between Currenex, Inc and RONET, so perhaps this is an error or some kind of forgery.

You can find a full list of domains and MyWOT ratings in this CSV file. Alternatively, the currently hosted domains are listed below.

Monday, 19 September 2011

Evil network: Alexey Klimenko / UAHOSTER-NET / / GreatHost-ALTNET, AS41390 (

This sordid little corner of the internet came up while investigating some SpyEye C&C servers on

These servers sit in a netblock of ( - and form part of AS41390 (more of which later). The contact details for the block are:

inetnum: -
netname:        UAHOSTER-NET
descr:          PP Alexey Klimenko
country:        UA
org:            ORG-PAK5-RIPE
admin-c:        AK6545-RIPE
tech-c:         AK6545-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-by:         ROWER-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-routes:     ROWER-MNT
mnt-domains:    ROWER-MNT
source:         RIPE #Filtered
organisation:   ORG-PAK5-RIPE
org-name:       PP Alexey Klimenko
org-type:       OTHER
address:        Ukraine, Sevastopol,
address:        Heroev Sevastopola 21-10
phone:          +380994015332
mnt-ref:        ROWER-MNT
mnt-by:         ROWER-MNT
source:         RIPE #Filtered
person:         Alexey Klimenko
address:        Ukraine, Sevastopol,
address:        Heroev Sevastopola 21-10
phone:          +380994015332
nic-hdl:        AK6545-RIPE
mnt-by:         ROWER-MNT
source:         RIPE #Filtered

descr:          GreatHost-ALTNET
origin:         AS41390
mnt-by:         ROWER-MNT
source:         RIPE #Filtered

These details largely match those on the domain which is hosted in the domain.

An examination of the sites on show a high proportion of malware, work-at-home-scams, money mule operations, phishing (especially for VKontakte credentials), fake prescription sites, and dubious pay-per-install schemes. Just about the only sites that don't fit into these categories are porn sites. There seems to be nothing worth visiting in this range, so blocking is probably a good idea.

A list of sites can be found at the end of this post, alternatively you can download a list with IP addresses and myWOT rating from here [csv]. resides in AS41390, which appears to consist of three loosely connected blocks:   GreatHost-ALTNET   WorkStone-AltNET    RN DATA DC

Usually, all the networks in an AS belong to the same company. In this case two of them say "Altnet". In fact, we came across Altnet and AS41390 last year when they were hosting crap on the range. They seem to have changed their name since then, and the new "RN DATA DC" block does seem largely clean. Altnet are (or were) a colo, so perhaps the "GreatHost" block is in one of their datacenters.

This is what Google thinks of AS41390:

Safe Browsing
Diagnostic page for AS41390 (RN)

What happened when Google visited sites hosted on this network?

    Of the 180 site(s) we tested on this network over the past 90 days, 4 site(s), including, for example,,,, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2011-09-18, and the last time suspicious content was found was on 2011-09-18.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 4 site(s) on this network, including, for example,,,, that appeared to function as intermediaries for the infection of 57 other site(s) including, for example,,,

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 37 site(s), including, for example,,,, that infected 668 other site(s), including, for example,,,

SiteVet's prognosis is also not very good. It has to be said though that the bulk of the bad activity is in the 256 IPs (and less than 200 sites) in the range. Blocking access to will probably be sufficient, or if you block by domains only then use the following list:

Saturday, 17 September 2011

Fake jobs:, and

Three new domains used to adveritise bogus jobs (which will actually be money laundering or other criminal activities)

The approach is the same as the domains registered two days ago, and indeed this has been going on for several years. The spam may appear to come from your own email address (here's why).

If you have any sample emails using this domain to solicit replies, please consider sharing them in the Comments. Thanks!

Thursday, 15 September 2011

Fake jobs:, and

Three new domains offering fake jobs, targeting US, UK and Canadian victims:

The "jobs" on offer are typically money laundering and other illegal activities, and form part of this long running scam. The emails may appear to have been sent from your own account (here's why).

The domains were registered two days ago to "Alexey Kernel" in Kiev, although this is probably a fake name and address.

If you have samples of spam emails using these domains, please consider sharing them in the comments. Thanks!

Wednesday, 14 September 2011

Some fake Bundeskriminalamt and Bundespolizei sites

Here are some more fake sites pretending to be the Bundeskriminalamt and Bundespolizei (agencies of the German Federal Police) which are probably worth blocking, following on from these. [Sia Vps Hosting, Latvia] [Invalid pointer to] [also on] [also on] [China Motion Network Communication]

Note that is actually the real IP for, but the scammers are pointing their DNS records to it, presumably to cause confusion.

You can safely block access to (Sia VPS) without much fear of losing anything important. The Chinese netblock is more mixed, but blocking at least might be a good idea if you are in Germany.

Injection attack:, and

Three more domains being used in injection attacks today:

The payload is the Sinowal trojan. Malicious software is hosted on which is well-known very dark grey hat host Netserv Consult SRL of Romania. Blocking ( - will probably do no harm.

The (possibly fake) registrant for these domains is:
Registrant Contact:
   Xicheng Co.
   Zhong Si
   01066569215 fax: 01066549216
   Huixindongjie 15  2
   Beijing Chaoyang 101402

Administrative Contact:
   Zhong Si
   01066569215 fax: 01066549216
   Huixindongjie 15  2
   Beijing Chaoyang 101402

Technical Contact:
   Zhong Si
   01066569215 fax: 01066549216
   Huixindongjie 15  2
   Beijing Chaoyang 101402

Billing Contact:
   Zhong Si
   01066569215 fax: 01066549216
   Huixindongjie 15  2
   Beijing Chaoyang 101402
   cn is not the Bundespolizei

Another fake Bundespolizei today, is registered through  a Chinese registrar and then is anonymised through a Chinese WHOIS privacy service

The site doesn't resolve yet, but it is almost identical to which is fingered in this attack. In that case, the fake Bundespolizei site was hosted on which is Netserv Consult SRL in Romania (incidentally, blocking will probably do you no harm).

There's a whole bunch of fake Bundespolizei at the moment, but I'm guessing that this particular bunch of scammers may well try the same thing in other countries very soon.

Tuesday, 13 September 2011

Fake banks on [Proxad, France] is hosting a series of fake banking domains, one of which is detailed by F-Secure.The domains target Finnish and Spanish banks.

The following sites appear to be hosted on that IP:

Some sites might use the following subdomains: kultaraha, solo1, solo2, www and xxx.

The (fake) registrant details are:
  Admin Name........... Arthur Williams
  Admin Address........ lake tarson 41
  Admin Address........
  Admin Address........ new york city
  Admin Address........ 90121
  Admin Address........ NY
  Admin Address........ UNITED STATES
  Admin Email..........
  Admin Phone.......... +1.802716100

Blocking access to would probably be a good idea if you have Spanish or Finnish users.

Injection attack:, and

There is currently a Sinowal injection attack doing the rounds, redirecting traffic to the following domains on

There may well be other domains on the same server, blocking traffic to would probably be prudent. The payload is being analysed (I will post an update later), but detection rates are not good.

Fake "" email

International Service Check ( is a legitimate mystery shopping company based in Germany. This email claims to come from International Service Check, but does not and it will be some sort of mystery shopping scam instead.

From: INTERNATIONAL SERVICE CHECK / Multisearch GmbH <>Subject: Application for New Mystery Shoppers.
Date: 12 Sep 2011 17:10:21 -0500

We have a mystery shopping assignment in your area and we would like you to participate"

INTERNATIONAL SERVICE CHECK / Multisearch GmbH is accepting applications for qualified individuals to become mystery shoppers. Its fun and rewarding,
and you choose when and where you want to shop. You are never obligated to accept an assignment.
There is no charge to become a shopper and you do not need previous experience. After you sign up, you will have
access to training materials via e-mail, fax or postal mail.


INTERNATIONAL SERVICE CHECK / Multisearch GmbH is the premier mystery shopping company; serving clients across America with over 500,000
shoppers available and ready to help businesses better serve their customers. Continual investment in the latest internet and
communication technologies coupled with over 16 years of know-how means working with INTERNATIONAL SERVICE CHECK / Multisearch GmbH is a satisfying and
rewarding experience.

Secret shopping as been seen on ABC NEWS, NBC NEWS, L.A.TIMES.
Mystery Shopping provides an insight into what happens when hard won prospective buyers are in contact with your sales and
customer service teams. INTERNATIONAL SERVICE CHECK / Multisearch GmbH’s range of Mystery Shopping services cover every aspect of the customer experience –
on-site and face-to-face, on the telephone and electronically, through your website.

We conduct evaluations by personal visits and/or by E-mail. "Mystery Shoppers" are independent contractors that conduct
"shops", complete online evaluation forms and get paid "per assignment".
We consider our shoppers part of our extended team. Most of our staff, including management, still Mystery Shop
and are aware of the challenges and rewards. We negotiate the best possible compensation for our
shoppers and will not accept business that is unfair to our team. If we wouldn't accept the shop, we don't expect you to.

Stores and organizations such as The Gap, Wal-Mart, Pizza Hut, and Bank. One amongst many others pay for Secret Shoppers to
shop in their establishments and report their experiences. On top of being paid for shopping you are also allowed to keep
purchases for free. INTERNATIONAL SERVICE CHECK / Multisearch GmbH NEVER charge fees to the shopper. Training, tips for improvement, and shopping
opportunities are provided free to registered shoppers. Mystery shoppers are either paid a pre-arranged fee for a particular shop, a
reimbursement for a purchase or a combination of both.

We boast super fast payouts and expect high quality reporting in return to keep our clients satisfied.

We hold a strong belief in the fact that nothing is more important than the customers perceptions and this can
only be realized using "real consumers" (YOU) to perform evaluations. The same cannot be said for using
industry insiders or people from within the company, as their opinions are naturally subjective and biased. The
only opinions that count are ones of real consumers since they are the ones making purchases.

You will be required to interact with the shop clerk.

The assignment will pay $150 per assignment

If you feel you are a good candidate, then fill out the application form below
to this email ( and we will get back to you shortly with the assignment:


Full Name :
Street Address:
Zip Code:
Cell Phone Number:
Home Phone Number:
Current Occupation:
Email Address:


Days/Hours Available


Hours Available: from _______ to ______

We await your urgent response.

Sincerely yours,
Adele Green.
© 2011 INTERNATIONAL SERVICE CHECK / Multisearch GmbH   All Rights Reserved.
If you accept this job offer, then you will not be dealing with International Service Check.

The email originates from a server at which belongs to Fivecube Pte in Singapore (the server is physically in California), although most likely this is either a compromised server or a customer. An examination of the mail headers indicate that it may originate from, a Cable One subscriber in Seminole, Oklahoma. The Reply-To address is althought this is probably fake, so do not assume that it really is someone of that name behind it.

Monday, 12 September 2011 is not the Bundespolizei is a fake domain pretending to be the Bundespolizei (German Federal Police). It appears to be part of a malware scam that has been around for a while, where the victim is told that they have done something illegal and need to pay a fine to the police.

The text of the message might vary, but the last scam domain  was used in conjunction with a message that read:

Es ist ungesetzliche Tätigkeit enthüllt
Ein Vorgang illegaler Aktivitäten wurde erkannt.
Das Betriebssystem wurde im Zusammenhang mit Verstoßen gegen die Gesetze der Bundesrepublik Deutschland gesperrt! Es wurde folgender Verstoß festgestelltt: Ihre IP Adresse lautet "x.x.x.x" mit dieser IP wurden Seiten mit pornografischen Inhalten,Kinderpornographie, Sodomie und Gewalt gegen Kinder aufgerufen Auf Ihrem Computer wurden ebenfalls Videodateien mit pornografischen Inhalten, Elementen von Gewalt und Kinderpornografie festgestellt! Es wurden auch Emails in Form von Spam, mit terroristischen Hintergründen, verschickt. Diese Sperre des Computers dient dazu, Ihre illegalen Aktivitäten zu unterbinden.
Ihre IP: x.x.x.x
Location: XXXXX
Um die Sperre des Computers aufzuheben, sind Sie dazu verflichtet eine Strafe von 100 Euro zu zahlen. Sie haben zwei Möglichkeiten die Zahlung von 100 Euro zu leisten.

    1) Die Zahlung per Ukash begleichen:
    Dazu geben Sie bitte den erworbenen Code in das Zahlungsfeld ein und drücken Sie anschliessend auf OK (haben Sie mehrere Codes,so geben Sie Diese einfach nacheinander ein und drücken Sie anschliessend auf OK) Sollte das System Fehler melden,so müssen Sie den Code per Email ( versenden.
    2) Die Zahlung per Paysafecard begleichen:
    Dazu geben Sie bitte den erworbenen Code (gegebenfalls inkl. Passwort) in das Zahlungsfeld ein und drücken Sie anschliessend auf OK (haben Sie mehrere Codes,so geben Sie Diese einfach nacheinander ein und drücken Sie anschliessend auf OK) Sollte das System Fehler melden,so müssen Sie den Code per Email( versenden.
This roughly translates as:

It is illegal activity revealed
An operation of illegal activity has been detected.
The operating system was blocked in connection with Violating the laws of the Federal Republic of Germany! It was festgestelltt following violation: Your IP address is "xxxx" with the IP were pages containing pornography, child pornography, bestiality and violence invoked against children on the computer were also video files containing pornography, found elements of violence and child pornography! There were also emails sent in the form of spam, with terrorist backgrounds. This serves to lock the computer to stop your illegal activities.
Your IP: x.x.x.x
Location: XXXXX
To unlock the computer, you have to pay a penalty verflichtet of 100 €. You have two ways to make the payment of 100 €.

     1 pay) Payment via Ukash:
     You enter the acquired code into the payment box and then press OK (you have multiple codes, enter this simply a sequence, then press OK) If the system is wrong, you have the code by email ( ship.
     2) The payment by paysafecard to pay:
     You enter the acquired code (if necessary including password) into the payment box and then press OK (you have multiple codes, enter this simply a sequence, then press OK) If the system is wrong, so you must send the code by email (

A €100 fine for terrorist likes and download child pornography? Obviously this is nonsense, but the victim might well try to pay to get rid of the trojan.

The is quite interesting to look at. First, there is the WHOIS record:

    Steffen Schüssler
    Organization: Hostmaster T-Systems
    Address: Vahrenwalder Strasse 240-247
    City: Hannover
    State: Hannover
    ZIP: 30159
    Country: DE
    Phone: +49.43171633486
    Fax: +49.43171633486

It looks legitimate enough. T-Systems is the hosting division of Deutsche Telekom, and the email address looks legitimate at first glance.. but wait, it says and not which can't be right.

The domain is registered through the Russian registrar Regtime Ltd. The site is hosted on in Latvia. Latvia is pretty much a hotbed of crime, and the AS12578 block has a pretty bad reputation, and the whole range looks quite toxic. As is common with malicious sites such as this, all the mail is handled by Google.

So.. if you see a message soliciting an email reply to or running on the same website then it is malware, and you should try to disinfect your machine using up-to-date antivirus software, or you could try following the instructions here.

Friday, 9 September 2011

Why am I sending myself spam?

One of the most comment questions I get about spam is: "Why am I sending myself spam?" The most common answer to this is: "It's a forgery, you are are not sending yourself spam at all".

This answer requires some explanation, but the most important thing is that when you see spam both "To" and "From" you at the same time then it DOES NOT mean that someone has hacked into your email account. However, if a friend or contact is getting spam email "From" you  then it is quite possible that someone HAS hacked your email account and you should take appropriate action.

These mail forgeries are incredibly simple to do. Part of the problem is that the protocols that email runs on were written in the early 1980s when there was no such thing as email spam. Basically, when one computer connects to another computer to send mail then usually the receiving computer trusts that the sending computer is telling the truth about the sender.

The conversation between the two computers looks something like this:

MAIL FROM: sender@sender.domain
RCPT TO: recipient@recipient.domain
This is the body text of the email.

What might come as a shock is that the sender's email address specified in "MAIL FROM" can be anything at all, including being the same as recipient. This is technically known as spoofing (i.e. it is a form of forgery), and it explains as well why spam often seems to come from nonsense email addresses. There are some ways of stopping spoofing, such as SPF, but they are not very widely used.

One reason why spammers like to send spam "from" the victim is because it will often get through the victim's spam filters. In general, you should not whitelist your own email address in your spam filter for this reason. Fixing spoofing at a filter level is possible, but every email system and spam filter is different and this is really one for experienced IT support people to resolve for you.

I mentioned earlier about a different scenario - one where the mail appears to be "From" a contact. Although superficially it might appear to be similar, in this case it usually means that an email account has been hacked into, typically the person that the mail is "from". If you receive spam from someone you know then the best thing to do is contact them offline and let them know that there's a problem.

Thursday, 8 September 2011

9/11 reflections

You've probably noticed that the tenth anniversary of the September 11th attacks is coming around in a few days time. There's a lot a material around covering all sorts of aspects, but one of the things that I distinctly remember (as a distant observer) was that there were a lot of important things happening, but it was hard to find out what was happening because the 2001-era web couldn't cope with the thirst for information. I wrote about it few days afterwards because it was probably the first time that the web had to deal with such a monumental news story.

In some respects the situation is very different ten years on. News sites are much more resilient, Twitter gives us real-time updates of major events, YouTube can give us raw eyewitness footage just minutes after things have happened. But the recent attacks in Oslo demonstrate just how fragile technology can still be.

Anyway, you can read my thoughts a decade on here if you like.

Tuesday, 6 September 2011

Fake jobs:,, and

Four new domains offering a variety of fake and illegal jobs, part of a very long running series of scam emails.

These fake domains have been set up to solicit replies to bogus job offers, including money laundering and other illegal activities. The emails may appear to have been sent from your own account, but this is a simple forgery and does not mean that your email account has been compromised.

The registrant details are no doubt fake:

    Alexey Kernel
    Organization: Alexey Kernel
    Address: Kreshchatyk Street 34
    City: Kiev
    State: Kiev
    ZIP: 01090
    Country: UA
    Phone: +38.00442794512 

All these domains have been registered in the past couple of days.

If you have a sample spam with one of these in, please consider sharing it in the Comments. Thanks!

Saturday, 3 September 2011

Fake jobs: is another domain being used for offer fake jobs (usually criminal activities such as money laundering). Is is part of this long running scam and is essentially just a variant of registered a few days ago. The domain was registered yesterday to a presumably fake registrant.

One feature of these scam emails is that they appear to come from yourself, this is just a simple forgery and it does not mean that your mail account has been compromised. If you have any examples of spam using this domain, please consider sharing it in the comments.