Sponsored by..

Thursday 20 September 2012

Amazon.com spam / webgrafismo.net and 203.91.113.6


This fake Amazon.com spam leads to malware on webgrafismo.net:


Date:      Fri, 21 Sep 2012 03:44:47 +0800
From:      "Adolfo Bruno" [debitst54@uky.edu]
Subject:      Your HD TV Delivered Yesterday

  
Your Orders | Your Account | Amazon.com
Shipping Confirmation
Order #002-9587043-55406590

Greetings [redacted],

Thank you for shopping with us. Wethought you'd like to know that amazon shipped your item, and that this completes your order.. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.
Your estimated shipment delivery date is:

Friday, September 21, 2012

Why tracking information may be unavailable?
    Your order was sent to:

[redacted]
572 9th Ave, App. 2D
S Paolo, TX
United States

This shipment does not have an associated delivery tracking No..

Conveyance Data
  

Sharp XVT3D32, SV 46-Inch 1080p 1000 Hz Cinema 3D LED-LCD HDTV with 3D Blu-ray Player and Two Pairs of 3D Glasses
Sold by secondipity
Condition: used - acceptable
    $740.43
Item Subtotal:     $740.43
Shipping & Handling:     $22.40
Total Before Tax:     $740.43
Shipment Total:     $740.43
Paid by Maestro:     $740.43

Returns are easy. Visit our ON-line Return Center.
If you need urgent assistance with your order, please visit Merchant Contact Form.

We hope to see you again soon!
Amazon.com

Unless otherwise noted, items are sold by Amazon LLC. Learn more about tax and seller information.

This email was sent from a notification-only address that cannot accept incoming email. Please don't reply to this message.

==========

Date:      Thu, 20 Sep 2012 20:51:04 +0100
From:      "Ned@mc2school.org" [Ned@ataonline.com.tr]
Subject:      Re: HDTV Shipped Yesterday

Your Orders | Your Account | Amazon.com                                          
Order Processing Confirmation                                          
Order #002-1662198-01565354                                                                      
Greetings [redacted],

Thank you for shopping with us. Wethought you'd like to know that amazon shipped your item, and that this completes your order.. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.
Your estimated  shipment date is:

Friday, September 21, 2012

Why tracking information may  be not available?
        Your order  was delivered to:

[redacted]
148 S Academy Dr, App. 1D
Albuquerque, KY
United States

This shipment does not have an associated delivery  tracking number.                          

Order                                   

Sony  XVT3D15, SV 42-Inch 1080p 600 Hz Cinema 3D  LCD HDTV  with 3D Blu-ray Player and  Two Pairs of 3D Glasses
Sold by  onner
Condition:  used-new
        $594.65
Item Subtotal: $594.65
Shipping & Handling:   $22.34
Total Before Tax:      $594.65
Shipment Total:        $594.65                                            
Paid by  Discover:     $594.65                                                          
Returns are easy. Visit our ON-line Return Center.
If you need  urgent assistance with your order, please visit Merchant Contact Form.

We hope to see you again soon!
Amazon.com

Unless otherwise noted, items are sold by Amazon LLC. Learn more about tax and shop information.

This email was sent from a notification-only address that cannot accept incoming email. Please don't reply to this message.                     
                                                                                         
The malicious payload is at [donotclick]webgrafismo.net/detects/rates-event_convinced-sent.php hosted on a known bad IP address of 203.91.113.6 (G Mobile, Mongolia). The exploit kit is probably Blackhole 2 given it's characteristics.



If you can block this IP address then I strong advise it. Other malicious sites on the same IP include.

penel-opessong.com
sncahmn.com
xlzones.com
virtual-geocaching.net
afgreenwich.net
cedarbuiltok.net
sowendo.net
thebummwrap.net
allmn-leicncester.net
bode-sales.net
webgrafismo.net

No comments: