Date: Fri, 26 Jul 2013 21:40:48 +0900 [08:40:48 EDT]
From: eBay [eBay@reply1.ebay.com]
Subject: [redacted] welcome to the eBay community!
Items selected just for you.
View this message in your browser eBay Buyer Protection
ebay™ Fashion Electionics Collectibles Daily Deals Sell To Buy
Welcome to eBay. The simpler and safer way to shop and save.
You've got options when it comes to paying.
Learn more to protect yourself from spoof (fake) e-mails
eBay Inc. sent this e-mail to you at [redacted] because your Notification Preferences indicate that you want to receive general email promotions.
If you do not wish to receive further communications like this, please click here to unsubscribe. Alternatively, you can change your Notification Preferences in My eBay by Privacy Policy and User Agreement if you have any questions.
Copyright © 2013 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc.
eBay Inc. is located at 2145 Hamilton Avenue, San Jose, CA 95125.
The link in the email goes to a legitimate hacked site and then runs one or more scripts from the following list of three:
[donotclick]75.126.43.229/deputy/clodhoppers.js
[donotclick]andywinnie.com/guessable/meteor.js
[donotclick]hansesquash.de/wimples/dunning.js
The victim is then sent to a malware landing page at [donotclick]artimagefrance.com/topic/accidentally-results-stay.php hosted on 184.95.37.110 (Secured Servers LLC, US / Jolly Works Hosting, Philippines). I would recommend blocking 184.95.37.96/28 in this case.
The domain is a hijacked GoDaddy domain, and the following hijacked domains appear to be in the neighbourhood. Ones flagged by Google as malware already are highlighted, although all should be considered as malicious.
184.95.37.100
fiberopticcableguy.com
fiberopticguy.com
guysanford.com
guyscards.com
hi-defhooters.com
y2k-usa.com
184.95.37.109
apparelacademy.com
apparelacademy.net
dragoncigars.net
heavenlycigars.net
libertychristianstore.com
michaelscigarbar.com
michaelscigarbar.net
michaelscigars.net
montverdestore.com
montverdestore.net
montverdestore.org
showmysupport.org
184.95.37.110
2013vistakonpresidentsclub.com
amicale-calvel.com
amicale-calvel.eu
artimagefrance.com
atmiaaustraliaconference.com
1 comment:
I received an almost identical e-mail that I forwarded with header to spoof@ebay.com They claim it to be a legitimate Ebay message! Either someone at Ebay is spamming or they don't know what they are talking about. The spam was sent to an e-mail address that I have not registered at Ebay.com so of course I got suspicious.
Post a Comment