Dynamoo's Blog

freead.name / mybar.us / toolbarcom.org / adsnet.biz

2010-07-29T15:08:00.000+01:00

A slightly novel attack, found injected into a Javascript library and using freshly-registered domains. The attack uses obfuscated Javascript to send visitors to one of the following domains: myads.name, adsnet.biz, toolbarcom.org, mybar.us, freead.name, and to the front of this is appended a subdomain of vagi., vain., vale., vars., vary., vasa., vaut., vavs., viny., viol., vrow., vugs., vuln.

Phishing domains on M247 Ltd

2010-07-29T09:29:00.001+01:00

I've never heard of M247 Ltd before today until their network came up as providing infrastructure for this scam. A few IPs over from that server is another one at 89.238.165.197 which contains three phishing sites: Ibloqin.com Lloydststb-offshore.com Nbtibank.com The sites are currently only displaying "Suspended" if you visit them.. this means nothing though, and it's a fairly common scammer

"eurjobs.org" fake job offer

2010-07-29T09:17:00.000+01:00

There are a lot of these going on at the moment, this is another fake job offer trying to rope unsuspecting applicants into doing something illegal. Date: 29 July 2010 08:23 Subject: Representatives Wanted Civilities I am a manager of the HR department of a large multinational company. Our company covers a wide range of businesses: - supporting business in Europe and other countries –

"west-epec.com" fake job offer

2010-07-28T15:07:00.000+01:00

This is some sort of money laundering or parcel reshipping scam. The domains west-epec.com was registered just yesterday but it appears not to be resolving properly. Date: 28 July 2010 13:36 Subject: vacancy #876 I am writing to you in the name of the corporation the Human Resources department of which I represent. Our enterprise has a lot of different lines of business. -real property -

LAPO LOAN COMPANY LIMITED

2010-07-28T09:11:00.000+01:00

Scams evolve in much the same way as plant or animal life. Unsuccessful scams become extinct, very successful ones tend to explode in numbers to the point of over population. In between are a number of scams that inhabit ecological niches where there is just enough return to make them worthwhile. From: LAPO LOAN COMPANY LIMITED. Reply-To: lapo.loancompany1@gmail.com

Evil network: Najada Ltd, AS49544 (91.216.122.0/24)

2010-07-27T09:29:00.001+01:00

This story from Brian Krebs caught my eye, a quick bit of background digging on check-crypt.com revealed a whole new Evil Network in Moldova called Najada Ltd on AS49544 (91.216.122.0/24). The IP address range of 91.216.122.0 - 91.216.122.255 appears to have no legitimate sites at all, featuring fake businesses (including a bunch supposed to be in Finland), illegal downloads and sites with

"Paul Badji: Treat As Urgent" email

2010-07-27T09:01:00.001+01:00

Paul Badji is a real diplomat at the UN, this email is NOT from Paul Badji. The UN's name has been used this way before, notably with Ban Ki-moon's name attached. This email is probably the usual Advance Fee Fraud approach, using a couple of links to reputable websites to try to make it look more authentic. Avoid. Unusually for what appears to be an African scam, the originating IP is 89.39.24.2

Sophos has a fix for .LNK flaw

2010-07-26T18:22:00.001+01:00

Install this, if you don't know why you should, then watch this video first.. then install it.

Welcome to "Joomla!" email links to malware

2010-07-26T15:30:00.000+01:00

A variant on this malware-laden email, this particular approach pretends to be from Joomla and even goes as far as to fake some of the headers to avoid detection. From: no_reply_forum@joomla.org [mailto:no_reply_forum@joomla.org] Sent: 26 July 2010 15:57 Subject: Welcome to "Joomla!" Welcome to Joomla! forums Please keep this e-mail for your records. Your account information is as follows: -

"Thank you for registering with ImageShack." mail leads to virus

2010-07-23T15:36:00.000+01:00

A fairly crude attempt to get clickthroughs to a virus infected site: From: ImageShack Registration Date: 23 July 2010 15:46 Subject: Thank you for registering with ImageShack. --------------------------------------------------- Thank you for registering with ImageShack. --------------------------------------------------- Your username: confidingjc Your password:

Romance Scams

2010-07-23T12:30:00.000+01:00

A couple of interesting news stories recently illustrate the dangers of "Romance Scams" or Dating Scams which illustrate the dangers involved. In one, a woman called Brenda Parke details how she was ripped off by a fraudster to the tune on £57,000.. and kudos to her for having the courage to come forward and shine a light on this activity. But this isn't the only case, a recent BBC Crimewatch

"TOYOTA CAR LOTTERY" scam

2010-07-23T12:12:00.001+01:00

A ridiculously long and horribly written scam email about winning a Toyota, email relayed through 60.251.190.235 in Taiwan, but apparently soliciting replies to an email address in Hong Kong while claiming to be based in Thailand. It is (of course) some sort of Advanced Fee Fraud. Incidentally, the +(66)896734792 telephone number is Thailand and is well known for being connected with scams.

amanda.lee@blackberry.co.za is not offering a free BlackBerry

2010-07-22T09:48:00.000+01:00

A variation on this hoax email analysed at Hoax-Slayer indicates that someone has a grudge against Research in Motion (who make the BlackBerry range of smartphones) in South Africa. There's a watermarked image stolen from Mobile Gazette to go with it (who are nothing to do with the hoax).. now with a blurry couple of photos from people claiming that they have their free BlackBerry. This is just

Hotbar.com deceptive installation.. again.

2010-07-21T17:46:00.000+01:00

Hotbar.com probably needs no introduction as an unpleasant piece of Slimeware, picked up from the ruins of Zango by a Washington State company calling itself Pinball Corporation. Traditionally, companies like Zango and Pinball work on a pay-per-install basis for their software, and recruit affiliates to get the software installed on end user's machines. Anyone who deals with affiliate marketing

"Pollux Enterprise Ltd" money mule scam

2010-07-17T20:22:00.001+01:00

Pollux Enterprise Ltd appears to be a genuine company in Hong Kong. This email claims to be from Pollux Enterprise Ltd, but isn't.. it's a Money Mule scam which is basically money laundering. Email originates from 95.154.240.2 which appears to be Turkish, not Hong Kong. Avoid. From: Pollux Enterprise Ltd pollux.recruit@gmail.comReply-To: pollux.recruit@gmail.com Date: 17 July 2010 20:15 subject:

Mystery Shopper Scam from "Shoppers Guide Ltd"

2010-07-17T17:49:00.000+01:00

Mystery shopper scams aren't exactly rare, but they're not as obvious a scam as some others. The basic idea is that once you get roped in, then eventually the sting will come with you laundering stolen money or an advanced fee fraud. There are some details about typical mystery shopper scams here. The spam originates from 82.128.2.21 in Nigeria. From: ADAM SCOTT mystery.shopperonline33415@

"Put your PC in your pocket and use it anywhere, anytime!"

2010-07-15T12:32:00.000+01:00

I don't normally republish press releases, but this looks pretty cool. I've used Paragon software before and it seems to do what it says on tin. What this appears to be a a fully featured VM package which consumers can use for free, so it definitely might be worth trying out.. IRVINE, CA, July 12, 2010 – It’s time to upgrade to a new operating system, but the thought of all the unknown issues

The BBC News site sucks

2010-07-15T10:47:00.003+01:00

I've kept schtum about the BBC News redesign for a couple of days as I suspected that my dislike of it was just because it was different from the layout that they've had for some time (I moaned about the last redesign too). It does seem that I'm not alone though as a comment on the bottom of this Reg article indicates: Widespread criticism of the redesign in the blogsphere over its confusing

"Your craiglist account requires attention!!"

2010-07-13T11:17:00.000+01:00

A fairly obvious phish: From: noreply@craigslists.org Date: 13 July 2010 08:29 Subject: Your craiglist account requires attention!! Please follow the link bellow to avoid expiration of your Account https://www.craigslist.org/account/update Thank you for using our servicesThe link in the email actually goes through your.totalinternethost.com/bb.html before bouncing to

2010-07-11T16:26:00.000+01:00

I received this mail "from" a contact's web mail account.. well, I say "from", it was actually a dial-up account in Nigeria (41.155.100.234 in this case). Subject: HELP!!! Hello, I'm sending this short email with panic in my heart, the situation of things here right now seems so tensed and frighting because I'm stranded here, apparently l was stuck here in LONDON ENGLAND with family

Dear Robert Allen and Bob Gatchel.. please shove it where the sun don't shine.

2010-07-11T10:15:00.002+01:00

I guess it was naive of me to think that I wouldn't see any more Bob Gatchel spam, but this great big steaming turd of a spam ended up in my inbox promotion some other crap. From: robertallen1 robertallen1@ewiadvisor.com Reply-to: jan@multiplestreamsofincome.com Date: 25 June 2010 04:21 subject [Redacted], Your Mining Gold with Ebay CD At Absolutely No Cost From Robert Allen Hi [

Evil network: Pegashosting Network / pegashosting.com 178.162.135.0/24 (AS28753)

2010-07-11T06:25:00.001+01:00

Hosting a very large number of sites offering fake job (such as hiring-westunion.com), Pegashosting Network of Kiev in the Ukraine uses the IP range 178.162.135.0 - 178.162.135.255, and appears to have no obvious legitimate sites whatsoever. Part of a larger block allocated to netdirekt e. K., AS28753 has a pretty horrible reputation.Pegashosting is only a part of that though, and the main drive

hiring-westunion.com scam email

2010-07-11T06:02:00.001+01:00

This scam email is recruiting people for money laundering and other criminal activities using the fraudulent domain hiring-westunion.com: From: Molly Leary Date: 11 July 2010 01:23 subject: Open Positions Greetings I’m addressing you on behalf of the HR department of a large company. Our company covers a wide range of businesses: - real estate – accounts opening – undertaking services – etc.

Evil network: AS29106 (91.213.174.0/24) / VOLGAHOST

2010-07-07T11:44:00.001+01:00

AS29106 (91.213.174.0 to 91.213.174.255) is a rogue network that appears to host no legitimate sites whatsoever. It appears to be actively involved in malware distribution. The Google Safe Browsing Diagnostic for AS29106 says: What happened when Google visited sites hosted on this network? Of the 283 site(s) we tested on this network over the past 90 days, 19 site(s), including, for example,

"Blackberry Storm Promotion" scam email

2010-07-06T11:17:00.004+01:00

is fake email appears to have been created to flood an innocent party's mailbox with spam and generate unwanted phone calls (the number may well be a real one belonging to RIM in South Africa). BlackBerry / Research In Motion are nothing to do with this email, it is a hoax.. please ignore it and do not try to contact "Amanda". More on this scam here. Subject: Blackberry Storm Promotion.