This fake eFax spam leads to malware on fuigadosi.ru:Date: Thu, 21 Feb 2013 -05:24:35 -0800
From: LinkedIn Password [password@linkedin.com]
Subject: Efax Corporate
Attachments: EFAX_Corporate.htm
Fax Message [Caller-ID: 705646877]
You have received a 29 pages fax at Thu, 21 Feb 2013 -05:24:35 -0800, (913)-809-4198.
* The reference number for this fax is [eFAX-806896385].
View attached fax using your Internet Browser.
© 2013 j2 Global Communications, Inc. All rights reserved.
eFax ® is a registered trademark of j2 Global Communications, Inc.
This account is subject to the terms listed in the eFax ® Customer Agreement.
The malicious payload is at [donotclick]fuigadosi.ru:8080/forum/links/column.php (report here) hosted on:
84.23.66.74 (EUserv Internet, Germany)
122.160.168.219 (Trackon Couriers, India)
210.71.250.131 (Chungwa Telecom, China)
The following domains and IPs are malicious and should be blocked:
84.23.66.74
122.160.168.219
210.71.250.131
eiiiioovvv.ru
ejjiipprr.ru
emmmhhh.ru
errriiiijjjj.ru
famagatra.ru
faneroomk.ru
finalions.ru
fuigadosi.ru
fulinaohps.ru
fzukungda.ru
2 comments:
Hello Conrad.
We just made a report exposing this infector moronz group in here, if you have time please review.
They use base infra in Russia, St Petersburg and Ukraine using NAUNET.RU to grab new domains in daily basis. Operated without harming any of their local citizen which making hard to nail with the local legality/laws...
Post a Comment