Sponsored by..

Monday, 8 April 2013

"M&I Bank bankruptcy" spam / ighjaooru.ru

I've never heard of M&I Bank but this is quite an old school spam campaign that leads to malware on ighjaooru.ru:

Date:      Mon, 8 Apr 2013 -01:41:06 -0800
From:      Coral Randolph via LinkedIn [member@linkedin.com]
Subject:      Re: Fwd: M&I Bank bankruptcy

Hi, bad news.

M&I Bank bankruptcy
The malicious payload is at [donotclick]ighjaooru.ru:8080/forum/links/column.php (report here) hosted on a whole load of IPs:
72.167.254.194 (GoDaddy, US)
80.246.62.143 (Alfahosting, Germany)
91.191.170.26 (Netdirekt, Turkey)
93.187.200.250 (Netdirekt, Turkey)
94.103.45.34 (ANKARAHOSTING, Turkey)
208.94.108.238 (Fibrenoire, Canada)

Blocklist:
72.167.254.194
80.246.62.143
91.191.170.26
93.187.200.250
94.103.45.34
208.94.108.238
hillaryklinton.ru
hiskinta.ru
humaniopa.ru
ifikangloo.ru
ifinaksiao.ru
ighjaooru.ru
igionkialo.ru
ijsiokolo.ru
ilianorkin.ru
illuminataf.ru
imanraiodl.ru
imbrigilia.ru
itriopea.ru
ivanikako.ru
ixxtigang.ru
izamalok.ru
izjianokr.ru
iztakor.ru

No comments: