Sponsored by..

Showing posts with label Asprox. Show all posts
Showing posts with label Asprox. Show all posts

Monday 8 September 2008

"Job Opportunity at Luksus" / luksus-jobs.org scam

Luksus Media is a wholly legitimate Finnish company, but this attempt to recruit a money mule does not come from Luksus, just from a company trying to trade on its name.

This scam is being run by the same people behind the Asprox SQL injection attacks that have been doing to rounds (more information after the email).




Subject: Job Opportunity at Luksus

We have reviewed your resume and would like to introduce you to our
current vacancy.
Luksus, with headquarters in Helsinki, Finland, serves the luxury
lifestyle and offers unparalleled access to the finest luxury
goods. We offer a unique mix of brands, partnerships, and product
expertise. We are currently hiring, work at home positions, to
provide administrative assistance with sales in North America.
Candidates for the job should possess excellent organizational
skills as well as the ability to efficiently multi-task. Ideal
candidates have a strong focus on day-to-day operational
excellence. The candidate should be motivated, proactive, be able
to learn and adapt quickly.

Other duties include, but are not limited to:

* Incorporating effective priorities for the virtual office function
* Administer day-to-day financial responsibilities for clients
* Reporting online daily
* Preparing brief summary reports, and weekly financial reports

Salary part-time (3 hours per day, Monday-Friday): $1,200/month,
plus commission.

If you are interested in this position please send us an email to
Sandra.Collins@luksus-jobs.org expressing your interest and we will
forward you the detailed job description and the working agreement.

Thank You,
Luksus Team



Normally, WHOIS data is pretty useless, but sometimes the email address can give a clue:

Domain ID: D153950800-LROR
Domain Name: LUKSUS-JOBS.ORG
Created On: 28-Aug-2008 11: 34: 57 UTC
Last Updated On: 28-Aug-2008 14: 23: 25 UTC
Expiration Date: 28-Aug-2009 11: 34: 57 UTC
Sponsoring Registrar: Bizcn.com, Inc. (R1248-LROR)
Status: CLIENT TRANSFER PROHIBITED
Status: TRANSFER PROHIBITED
Registrant ID: orgfm19923291709
Registrant Name: Fero Muia
Registrant Organization: Fero Muia
Registrant Street1: 3213 po box
Registrant Street2:
Registrant Street3:
Registrant City: New York
Registrant State/Province: NY
Registrant Postal Code: 12310
Registrant Country: US
Registrant Phone: +1.9917721121
Registrant Phone Ext.:
Registrant FAX: +1.9917721121
Registrant FAX Ext.:
Registrant Email: druid00091@aol.com
Admin ID: orgfm19923292728
Admin Name: Fero Muia
Admin Organization: Fero Muia
Admin Street1: 3213 po box
Admin Street2:
Admin Street3:
Admin City: New York
Admin State/Province: NY
Admin Postal Code: 12310
Admin Country: US
Admin Phone: +1.9917721121
Admin Phone Ext.:
Admin FAX: +1.9917721121
Admin FAX Ext.:
Admin Email: druid00091@aol.com
Tech ID: orgfm19923293349
Tech Name: Fero Muia
Tech Organization: Fero Muia
Tech Street1: 3213 po box
Tech Street2:
Tech Street3:
Tech City: New York
Tech State/Province: NY
Tech Postal Code: 12310
Tech Country: US
Tech Phone: +1.9917721121
Tech Phone Ext.:
Tech FAX: +1.9917721121
Tech FAX Ext.:
Tech Email: druid00091@aol.com
Name Server: NS1.RELEASEBPB.COM
Name Server: NS2.RELEASEBPB.COM


druid00091@aol.com is an address being used to register today's latest SQL injection domains too, proving that they are linked. releasebpb.com is a set of name servers which are only associated with malware domains, ns1.releasebpb.com is on 194.150.120.47 on ns2.releasebpb.com is on 20.31.85.15.

This type of fraud doesn't use a website to entice people, but it is looking for an email response. In this case, email is delivered to mx.luksus-jobs.org on 12.192.82.225 which is on the AT&T network.

It's hard to tell which of these IPs are part of the Asprox botnet and which ones are rented (usually with fake credit card details). Nonetheless, it gives a glimpse into just how large and efficient these operations can be.

Thursday 4 September 2008

Asprox: jic2.ru

Another new addition to the list of Asprox domains is jic2.ru, again registered via Naunet, so block this or check your logs for access. Again, searching your logs for ".ru/script.js"will help locate suspect activity.

Tuesday 2 September 2008

Asprox: 2b24.ru

These domains seem to be today's current Asprox SQL Injection domains - check for them in your logs or block them. 2b24.ru seems to be new, the rest have been around for a few days. The exploit is still using a script called script.js to run.

  • 2b24.ru
  • cg33.ru
  • cv2e.ru
  • cv32.ru
  • mc2n.ru
  • mj5f.ru
  • oc32.ru
  • vwsc.ru

Monday 1 September 2008

Asprox: cg33.ru, cv2e.ru, cv32.ru, mc2n.ru, oc32.ru and vwsc.ru

Another bunch of Asprox SQL injection domains to block or monitor for, all quite new:

  • cg33.ru
  • cv2e.ru
  • cv32.ru
  • mc2n.ru
  • oc32.ru
  • vwsc.ru
Alternatively, look for .ru/script.js in your logs which should pick up most of them.

Update: here's another one - mj5f.ru

Tuesday 26 August 2008

Asprox: beyry.ru, iopoe.ru, jetp6.ru, nucop.ru, port04.ru and vj64.ru

There's been a slight shift in the characteristics of the current Asprox attack. The javascript called is now script.js rather than ngg.js or js.js, and this goes to a redirect script currently pointing at /cgi-bin/index.cgi?lle on the local domain.

Active domains in this new attack seem to be as follows, new ones are in bold.
  • beyry.ru
  • cb3f.ru
  • cnld.ru
  • iopc4.ru
  • iopoe.ru
  • jetp6.ru
  • loopk.ru
  • netr2.ru
  • okcd.ru
  • nucop.ru
  • port04.ru
  • ueur3.ru
  • vj64.ru
Check your logs or block these domains. Most business outside of Russia and neighbouring countries could probably block the entire .ru TLD with minimal impact. Look also for the CGI sript (/cgi-bin/index.cgi?lle) to find potentially infected client PCs.

Friday 22 August 2008

Asprox: iopc4.ru, jetp6.ru, loopk.ru, netr2.ru and ueur3.ru

The domains used is the Asprox SQL injection attack have been stable for most of the past week, but over the last 24 hours some ne wdomains have been registed, so check your logs and/or block the following:

  • iopc4.ru
  • jetp6.ru
  • loopk.ru
  • netr2.ru
  • ueur3.ru

It is likely that some more will turn up during the course of the day.

Friday 15 August 2008

Asprox: ujnc.ru

Just a single new Asprox domain to list this morning: ujnc.ru which is still using the js.js redirector, i.e. www.ujnc.ru/js.js. All the domains from the past two days are still active too.

Thursday 14 August 2008

Asprox: 3njx.ru, cb3f.ru, cnld.ru, nbh3.ru and okcd.ru

Some more Asprox domains to block or look for in your logs:

  • 3njx.ru
  • cb3f.ru
  • cnld.ru
  • nbh3.ru
  • okcd.ru

Renewed Asprox activity: bcus2.ru, jkn3.ru, juc8.ru and locm.ru

After a quiet few days, Asprox seems to have flared up again (at about 1000 CET) with a new set of malware domains, still launching from a SQL injected js.js file on compromised hosts. Keep an eye out for these domains or block them.

These domains are all very recently registered through naunet.ru, there are probably many more on the way soon.

  • bcus2.ru
  • jkn3.ru
  • juc8.ru
  • locm.ru

Tuesday 12 August 2008

All quiet on the Asprox front?

For the moment the Asprox SQL injection attacks seem to have stopped, although infected sites are still infected and need to be secured as soon as possible.

So, does this mean that the bad guys have given up? Well, no.. but there are probably thousands of sites out there which are still infected, so from that point of view they will still be getting "hits" to their malware sites.

Perhaps the answer is this - the people behind the SQL injection attacks are doing something else. Two very newsworthy events happening over the past few days have been the war in Georgia and the Beijing Olympics. Dancho Danchev reports that the RBN have been actively involved in attacking Georgian sites, including using SQL injection attacks. F-Secure report that Chinese sites have been attacked since the run-up to the Olympics started.

It might well be that these Asprox attacks will be quiet for a couple of weeks, but it is likely that general SQL injection attacks will ramp up again soon.

Saturday 9 August 2008

Asprox: block 91.203.93.4 and js.js

A shift in behaviour from the Asprox botnet - this time all traffic from infected sites is being redirected through a fixed IP at 91.203.93.4. Blocking 91.203.93.0/24 will probably do no harm.

Also, the name of the javascript file has changed to js.js, so look for this in your logs.

The Silent Noise blog is tracking Asprox domains too, with some interesting developments that we haven't had the chance to dig deeper into.

Tuesday 5 August 2008

Asprox domains: 5/8/08

Current Asprox domains to look for in your blogs or block. These have all been active for 3 or 4 days now, which is an unusually long time for this current SQL injection attack.

  • 8hcs.ru
  • 98hs.ru
  • bgsr.ru
  • bywd.ru
  • ibse.ru
  • ncbw.ru
  • nwj4.ru
  • ojns.ru
  • porv.ru
  • uhwc.ru

Saturday 2 August 2008

Asprox domains: 2/8/07

These are the currently active Asprox domains to check for. They are all very recently registrations.

  • 8hcs.ru
  • 98hs.ru
  • bgsr.ru
  • bywd.ru
  • ibse.ru
  • ncbw.ru
  • nwj4.ru
  • ojns.ru
  • porv.ru
  • uhwc.ru

Tuesday 29 July 2008

Asprox domains: 29/7/08

These are this morning's active Asprox domains. New ones are in bold.

  • b4so.ru
  • bce8.ru
  • bjxt.ru
  • bnsr.ru
  • bosf.ru
  • bsko.ru
  • ch35.ru
  • gty5.ru
  • iroe.ru
  • jve4.ru
  • kj5s.ru
  • kjwd.ru
  • kpo3.ru
  • kr92.ru
  • ncb2.ru
  • ncwc.ru
  • nemr.ru
  • njep.ru
  • nmr43.ru
  • oics.ru
  • pfd2.ru
  • po4c.ru

Monday 28 July 2008

Asprox domains: 28/7/08

These seem to be the current Asprox domains to block or check for. New ones are in bold.

  • bs04.ru
  • bce8.ru
  • bjxt.ru
  • bnsr.ru
  • bosf.ru
  • bsko.ru
  • ch35.ru
  • iroe.ru
  • jve4.ru
  • kjwd.ru
  • kodj.ru
  • kpo3.ru
  • kr92.ru
  • ncb2.ru
  • ncwc.ru
  • nemr.ru
  • nmr43.ru
  • oics.ru
  • pfd2.ru
  • po4c.ru
ngg.js still seems to be the name of the javascript file injected into compromised hosts.

Friday 25 July 2008

Asprox domains: 25/7/08

These domains seem to be active today, new ones in bold.

  • bce8.ru
  • ch35.ru
  • iroe.ru
  • jve4.ru
  • kjwd.ru
  • kodj.ru
  • kpo3.ru
  • kr92.ru
  • ncwc.ru
  • nemr.ru
  • nmr43.ru
  • pfd2.ru
  • po4c.ru
One oddity - the URL zvz.cc/forums/8L0/join.upq has been spotted as a redirector for these Javascript exploits. Google list zvz.cc that as a malware infected site, it is hard to tell though if this is just another victim or part of the C&C for the botnet. For the record, these are the WHOIS details.. but they might not mean very much.

Registration Service Provided By: ESTDOMAINS INC
Contact: +1.3027224217
Website: http://www.estdomains.com

Domain Name: ZVZ.CC

Registrant:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Creation Date: 09-Apr-2008
Expiration Date: 09-Apr-2009

Domain servers in listed order:
ns2.zvz.cc
ns1.zvz.cc

Administrative Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Technical Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Billing Contact:
Himpet .Inc
Evgenij Novoberkov (zvz@tut.by)
Stahanov.St 120
Minsk
Missouri,222120
US
Tel. +022.2720771

Status:ACTIVE

Thursday 24 July 2008

Asprox: jve4.ru, nmr43.ru and po4c.ru

Three new Asprox domains that have gone live in the past few hours, probably some more on the way. Either block these or check your logs if you are a network admin.
  • jve4.ru
  • nmr43.ru
  • po4c.ru

Wednesday 23 July 2008

Asprox domains: 23/7/08 - Part II

Just a couple more to add:

  • cgt4.ru
  • kc43.ru

Asprox domains: 23/7/08

A shift in domains used by the Asprox crew - these new domains are all in the .ru TLD and are registered via NauNet (contact details here). ngg.js is still the name of the Javascript file to look for, I suspect that vrcgoo.js might be a new name to keep an eye out for too.

  • 4cnw.ru
  • 4vrs.ru
  • 5kc3.ru
  • 90mc.ru
  • 9jsr.ru
  • bts5.ru
  • chds.ru
  • cvsr.ru
  • d5sg.ru
  • ecx2.ru
  • gb53.ru
  • h23f.ru
  • jex5.ru
  • jvke.ru
  • keec.ru
  • keje.ru
  • kgj3.ru
  • lkc2.ru
  • lksr.ru
For most organisations, blocking the entire .ru TLD will probably do no harm as these are usually always Russian language sites.

Wednesday 16 July 2008

Asprox domains: 16/7/08

The following Asprox SQL Injection domains appear to be active today. New ones are in bold.

  • adwnetw.com
  • adpzo.com
  • ausbnr.com
  • brcporb.ru
  • btoperc.ru
  • cdport.eu
  • cdrpoex.com
  • gbradde.tk
  • grtsel.ru
  • korfd.ru
  • movaddw.com
  • tctcow.com
  • usabnr.com
ngg.js still seems to be the name of the script file. Block these sites and/or check your logs.