ADP spam / demoralization.ru

This fake ADP spam leads to malware on demoralization.ru:

Date:      Wed, 9 Jan 2013 04:23:03 -0600
From:      Habbo Hotel [auto-contact@habbo.com]
Subject:      ADP Immediate Notification

ADP Immediate Notification
Reference #: 948284271

Wed, 9 Jan 2013 04:23:03 -0600
Dear ADP Client

Your Transfer Record(s) have been created at the web site:

https://www.flexdirect.adp.com/client/login.aspx

Please see the following notes:

    Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).
    Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.


This note was sent to acting users in your system that approach ADP Netsecure.

As usual, thank you for choosing ADP as your business affiliate!

Ref: 703814359


HR. Payroll. Benefits.

The ADP logo and ADP are registered trademarks of ADP, Inc.
In the business of your success is a service mark of ADP, Inc.
� 2013 ADP, Inc. All rights reserved.

The malicious payload is at [donotclick]demoralization.ru:8080/forum/links/column.php hosted on the following IPs:
82.165.193.26 (1&1, Germany)
91.224.135.20 (Proservis UAB, Lithunia)
187.85.160.106 (Ksys Soluções Web, Brazil)

The following IPs and domains are all related:
82.165.193.26
91.224.135.20
187.85.160.106
demoralization.ru
belnialamsik.ru
bananamamor.ru

ADP spam / fsblimitedrun.pro

This fake ADP spam leads to malware on fsblimitedrun.pro:

From:     ADP Transaction Status
Date:     3 December 2012 17:55
Subject:     ADP Major Accounts Processed Case

Valued customer:

 

James lately covered Transaction at your account. Event # 433933082.

     Case Caption: 6CO7

      Incident Substantiation: Download



We at ADP obtain to create a personalized and client focused experience with every client interaction.
Please view transaction changed by
visiting the link below.


Click here - ADP Major Accounts Operation Progress mentioned above

Best Wishes,

     James Brooks

     Vice President of Customer Care Department ADP

     ADP Major Accounts

 

 ***Reminder***

Please remember to complete your Semi-Annual Service Quality Survey!

Our Goal is to ensure you are VERY SATISFIED with each interaction you have with our Service Associates and we ask that you consider your overall experience in the 6 months preceding your receipt of the survey. We strive to provide WORLD CLASS SERVICE and determine our success by your satisfaction with ADP's services.

**********

This e-mail was delivered from an robot account.

Please don't reply to this message. auomatic informational system unable to accept incoming email.

**********

The malicious payload is at [donotclick]fsblimitedrun.pro/detects/survey_success-complete.php hosted on 41.215.225.202 (Essar Wireless Kenya Ltd) along with the following malicious domain: fdic-update-install.info

Blocking access to this IP address would probably be prudent.

ADP Spam / steamedboasting.info

This fake ADP spam leads to malware on steamedboasting.info:

From: ClientService@adp.com [mailto:ClientService@adp.com]
Sent: 26 October 2012 12:03
Subject: ADP Instant Notification


ADP Urgent Warning
Reference #: 31344
Dear ADP Client October, 25 2012
Your Transfer Summary(s) have been uploaded to the web site:
https://www.flexdirect.adp.com/client/login.aspx
Please take a look at the following information:
• Please note that your bank account will be charged within 1 banking day for the amount(s) specified on the Statement(s).
•Please DO NOT reply to this message. automative notification system cannot accept incoming messages. Please Contact your ADP Benefits Specialist.
This note was sent to existing users in your company that approach ADP Netsecure.
As always, thank you for choosing ADP as your business companion!
Ref: 31344

The malicious payload is at [donotclick]steamedboasting.info/detects/burying_releases-degree.php, the initial redirection page has some Cloudflare elements on it which is a bit disturbing. steamedboasting.info is hosted on 195.198.124.60 (Skand Meteorologi och Miljoinstr AB, Sweden).

This is an alternative variant with the same malicious payload:

Date:      Fri, 26 Oct 2012 16:32:10 +0530
From:      "noreply@adp.com" [noreply@adp.com]
Subject:      ADP Prompt Communication


ADP Speedy Notification

Reference #: 27585

Dear ADP Client October, 25 2012

Your Transaction Statement(s) have been put onto the web site:

Web site link

Please see the following notes:

• Please note that your bank account will be charged-off within 1 banking business day for the amount(s) specified on the Protocol(s).

?Please do not reply to this message. automative notification system can't accept incoming mail. Please Contact your ADP Benefits Specialist.

This message was sent to operating users in your company that approach ADP Netsecure.

As always, thank you for choosing ADP as your business partner!

Ref: 27585 [redacted]

ADP spam / 184.164.151.54

Yet more ADP-themed spam, this time leading to malware on 184.164.151.54:

Date:      Fri, 12 Oct 2012 14:48:18 +0530
From:      "ADPClientServices" [ADPClientServices@adp.com]
Subject:      ADP Urgent Notification

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]184.164.151.54/links/rules_familiar-occurred.php (hosted by the ironically named Secured Servers LLC in the US aka Jolly Works hosting of the Philippines).

ADP Spam / 198.143.159.108

Yet more fake ADP spam (there has been a lot over the past 24 hours) is being pushed out. This time there's a malicious payload at [donotclick]198.143.159.108/links/rules_familiar-occurred.php (Singlehop, US).

Avoid.

ADP Spam / 108.61.57.66

There's masses of ADP-themed spam today. Here is another one:

Date:      Thu, 11 Oct 2012 14:53:17 -0200
From:      "ADP.Message" [986E3877@dixys.com]
Subject:      ADP Generated Message

This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.

If you have any questions, please contact your administrator for assistance.


---------------------------------------------------------------------

Digital Certificate About to Expire

---------------------------------------------------------------------

The digital certificate you use to access ADP's Internet services is about to expire. If you do not renew your certificate by the expiration date below, you will not be able to access ADP's Internet services.

Days left before expiration: 3

Expiration date: Oct 14 23:59:59 GMT-03:59 2012

---------------------------------------------------------------------

Renewing Your Digital Certificate

--------------------------------------------------------------------

1. Go to this URL: https://netsecure.adp.com/pages/cert/register2.jsp

2. Follow the instructions on the screen.

3. Also you can download new digital certificate at https://netsecure.adp.com/pages/cert/pickUpCert.faces.

In this case the malicious payload is at [donotclick]108.61.57.66/links/assure_numb_engineers.php  hosted by Choopa LLC in the US. The IP is probably worth blocking to be on the safe side.

ADP spam / 4.wapin.in and 173.224.209.165:

This fake ADP spam leads to malware on 4.wapin.in:

From: ADP.Security [mailto:5BC4F06B@act4kids.net]
Sent: 11 October 2012 14:22
Subject: ADP: Urgent Notification

This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
If you have any questions, please contact your administrator for assistance.

---------------------------------------------------------------------
Digital Certificate About to Expire
---------------------------------------------------------------------
The digital certificate you use to access ADP's Internet services is about to expire. If you do not renew your certificate by the expiration date below, you will not be able to access ADP's Internet services.

Days left before expiration: 3
Expiration date: Oct 14 23:59:59 GMT-03:59 2012

---------------------------------------------------------------------
Renewing Your Digital Certificate
---------------------------------------------------------------------
1. Go to this URL: https://netsecure.adp.com/pages/cert/register2.jsp

2. Follow the instructions on the screen.

3. Also you can download new digital certificate at https://netsecure.adp.com/pages/cert/pickUpCert.faces.

The malicious payload is on [donotclick]4.wapin.in/links/assure_numb_engineers.php hosted on 198.136.53.39 (Comforthost, US).

Another variant of this goes to  [donotclick]173.224.209.165/links/assure_numb_engineers.php (Psychz Networks, US)

ADP Spam / 69.194.194.221

This fake ADP spam leads to malware on 69.194.194.221:

Date:      Sun, 30 Sep 2012 17:31:05 +0200
From:      "ADP Service" [F07EBCC@pop3.rad.net]
Subject:      New transactions

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking

business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any

questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]69.194.194.221/links/marked-alter.php (Solar VPS, US).

ADP spam / 108.178.59.6

This fake ADP spam leads to malware on 108.178.59.6:

Date:      Fri, 28 Sep 2012 13:22:13 +0300
From:      "ADP Notification" [D7443309@phoenixpv.de]
Subject:      Your Transaction Report(s)

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking

business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any

questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]108.178.59.6/links/marked-alter.php (Singlehop, US) which looks like a Blackhole 2 exploit kit or similar.

The malware is hosted on this evil network,  blocking 108.178.59.0/26 would be wise.

ADP Spam / 69.194.193.37

This fake ADP spam leads to malware on 69.194.193.37:

Date:      Thu, 27 Sep 2012 14:47:54 -0430
From:      "ADP Alert" [FDCA492F@atlanticbeddingandfurniture.com]
Subject:      Transaction Report(s)

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking

business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any

questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]69.194.193.37/links/marked-alter.php hosted by Solar VPS in the US.

ADP Spam / 69.194.192.203

This fake ADP spam email leads to malware on 69.194.192.203:

Date:      Thu, 20 Sep 2012 14:25:24 +0300
From:      "ADPClientServices" [ABD331056@losblancoba.com.ar]
Subject:      ADP Urgent Notification - Debit Draft

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]69.194.192.203/links/deep_recover-result.php (probably Blackhole 2.0) hosted by Solar VPS in the US. This IP has been used for malware before recently, blocking it would be prudent.

ADP spam / 46.249.37.122

This fake ADP spam tries to load malware from 46.249.37.122:

From: ADP_Online_Invoice_DoNotReply@adp.com ADP_Online_Invoice_DoNotReply@adp.com
Date: 13 September 2012 14:29
Subject: ADP Invoice Reminder

Your latest ADP Dealer Services Invoice is now available to view or pay online at ADP Online Invoice Management .

To protect the security of your data, you will need to enter your ID and password, then click on Access your Online Invoice Management account.

Total amount due by September 13, 2012

$17202.04

If you have already sent your payment please disregard this friendly reminder and Thank you for choosing ADP.

Questions about your bill?

Contact David Nieto by Secure Mail.

Note: This is an automated email. Please do not reply. 

After clicking the link bouncing through a couple of redirectors, the victim ends up at [donotclick]46.249.37.122/links/systems-links_warns.php which appears to be generating a 404 error (although it could be fake). This could be a legitimate but hacked server as it is also the IP address for a proxy service called dutchprox.com. In any case, you might decide you want to block the IP just in case.