Sponsored by..

Showing posts with label India. Show all posts
Showing posts with label India. Show all posts

Tuesday 16 April 2013

Disgraceful Arif Khan / Mak Media spam

For some time now I've been plagued with spam that looks like this:

Date:      Tue, 16 Apr 2013 09:11:37 -0400
From:      "Mesothelioma"
To:      [redacted]
Subject:      Learn The Link Between Asbestos and Mesothelioma

5670242064119134040....02158166418942886316dc91aae549f7.02158166418942886316dc91aae549f7.5670242064119134040..02158166418942886316dc91aae549f7.. 33100457.5670242064119134040..02158166418942886316dc91aae549f7.5670242064119134040..

Learn The Link Between Asbestos and Mesothelioma

Rebosiet riwan ducufaf. 02158166418942886316dc91aae549f7 Rire ti 5670242064119134040 sasah 33100457 totetes 33100457 tela. 33100457 Woc 02158166418942886316dc91aae549f7 esic 02158166418942886316dc91aae549f7 sew 02158166418942886316dc91aae549f7 se 02158166418942886316dc91aae549f7 icin 02158166418942886316dc91aae549f7 icat 33100457 worag 33100457 ne 02158166418942886316dc91aae549f7 tedit 33100457 kodu. 02158166418942886316dc91aae549f7 Eca cehag 33100457 kose. 02158166418942886316dc91aae549f7 Adodiner 5670242064119134040 nure 33100457 bebose aleri ira 02158166418942886316dc91aae549f7 malitu noharie ituror [this crap goes on and on to try to get past spam filters]
The spam is on a variety of topics, but one thing that makes me cross is seeing spam on this particular topic. Why? Well, this particular illness is linked to many high-paying lawsuits, and as a result advertisers can pay out a surprising amount of cash per click estimated here to be worth over $80 for some individual clicks. But in this case, they will be essentially worthless clicks to the advertiser. And who ends up paying for these worthless clicks? Well, ultimately the costs get extracted from the sufferers of this illness from their settlements.

There are three parties involved in this scam. Working backwards, the ads displayed on the landing page are run by Google, the landing page itself is owned by an outfit called Adilizer.com who claim to be based in Texas. But the spamming itself seems to be the work of one Arif Khan who is the CEO of an Indian company called Mak Media.

Let's look at when clicking on the link on that spam gets us..
hxxp:||rng172.fuldbate.us/2437a38863ab64aa3397118536dc91aae549f7
leads to
hxxp:||rng172.fuldbate.us/98F22437a38863ab64aa3397118536dc91aae549f7
leads to
hxxp:||rk3231.com/m/ec.php?k=651&kc=78236&ks=0&pc=547&tt=1&t1=yogesh&t2=&t3=&t4=&u=&u2=
leads to
hxxp:||obmedia.com/m/ec.php?k=651&kc=78236&ks=0&pc=547&tt=1&t1=yogesh&t2=&t3=&t4=&u=&u2=
leads to
hxxp:||www.myown-big-find-tool.com/

The domains myown-big-find-tool.com, obmedia.com and rk3231.com belong to Adilizer and look like they could be some sort of affiliate link. So, we can perhaps assume that Adilizer are not directly responsible for the spam.

The domain fuldbate.us is owned by Arif Khan, and rng172.fuldbate.us is hosted on 198.84.76.172 which is where this spam originates. These are the pertinent WHOIS details for the domain:

Registrant ID:                               FF70EC5B09E3DC10
Registrant Name:                             Arif Khan
Registrant Organization:                     Gravity Media
Registrant Address1:                         Bhopal
Registrant Address2:                         Bhopal
Registrant City:                             Bhopal
Registrant State/Province:                   MP
Registrant Postal Code:                      462001
Registrant Country:                          India
Registrant Country Code:                     IN
Registrant Phone Number:                     +91.9425677527
Registrant Email:                            praveen.shukla4015@gmail.com
Registrant Application Purpose:              P1


"Gravity Media" may or may not exist, but domain WHOIS details are easy to fake. But if we look at who the IP address is allocated to then we can see a bit more information.

%rwhois V-1.5:003fff:00 rwhois.hostwinds.com (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:Hostwinds Block-198.84.76.172/32
network:Auth-Area:198.84.76.172/32
network:Network-Name:Mak Media Network
network:IP-Network:198.84.76.172/32
network:IP-Network-Block:198.84.76.172 - 198.84.76.172
network:Customer Organization:Mak Media
network:Customer Address;I:Plot N0 4 , Kerma Tower
network:Customer City;I:BHopal
network:Customer State/Province;I:Madhya Pradesh
network:Customer Postal Code;I:462001
network:Customer Country Code;I:IN
network:Organization;I:Hostwinds LLC
network:Tech-Contact;I:abuse@hostwinds.com
network:Admin-Contact;I:abuse@hostwinds.com
network:Abuse-Contact;I:abuse@hostwinds.com


This reveals the apparently genuine organisation of Mak Media, of which Arif Khan is CEO according to his LinkedIn page. Note that there are several companies of a similar name, but this one seems to be based in Bhopal.


To quote Mr Khan, his background is of:
Intense drive and overachieving mentality with a track record of consistently meeting and exceeding goals. Dedicated work ethic, and intense desire to succeed in achieving an aggressive career and financial growth.

Specialties: Email Marketing, lead generation,database management, email marketing, list management, Email Monetization, Affiliate Marketer!!
In other words, he takes advantage of India's non-existent spam laws and blasts as many mailboxes as he can with crappy affiliate links.

But the spam doesn't come from just one domain and IP. Arif Khan uses hundreds of throwaway .us addresses and multiple IPs. These are the ones I have seen in the past week:
fuldbate.us
excrep.us
buidep.us
xlitisew.us
trunalk.us
ryismeth.us
fjouck.us
duptous.us
certious.us
grembing.us
bablump.us
ghtchity.us
fluitice.us
fjoutte.us
cabatki.us
asatuary.us
echead.us
brooto.us
falert.us
eurness.us
djasynt.us
abubcum.us
emenger.us
ograst.us
hapric.us

Each one comes from a different IP address in the 198.84.76.0/24 range suballocated from Hostwinds to Mak Media. But there's something weird, because Hostwinds haven't allocated a 256-address /24 block at all.. they've allocated 256 /32 blocks of a single IP address each. This is presumably a trick to make sure that the whole /24 range doesn't get blacklisted at once.

If you are plagued with this spam and have the capability to do so, block all incoming email from and web traffic to 198.84.76.0/24 and it should effectively block it for now. And reporting any spam to abuse -at- hostwinds.com will probably do no harm.. although I suspect it will do little good.


"Fiserv Secure Email Notification" spam

This spam has an encrypted ZIP file attached that contains malware. The passwords and filenames will vary.


From: Fiserv Secure Notification [mailto:secure.notification@fiserv.com]
Sent: Tue 16/04/2013 14:02
Subject: [WARNING : MESSAGE ENCRYPTED] Fiserv Secure Email Notification - CC3DK9WJW8IG0F5


You have received a secure message

Read your secure message by opening the attachment, Case_CC3DK9WJW8IG0F5.zip.

The attached file contains the encrypted message that you have received.

To decrypt the message use the following password -  KsUs3Z921mA

To read the encrypted message, complete the following steps:

 -  Double-click the encrypted message file attachment to download the file to your computer.
 -  Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
 -  The message is password-protected, enter your password to open it.

To access from a mobile device, forward this message to mobile@res.fiserv.com to receive a mobile login URL.

If you have concerns about the validity of this message, please contact the sender directly. For questions about secure e-mail encryption service, please contact technical support at 888.979.7673.

2000-2013 Fiserv Secure Systems, Inc. All rights reserved.

In the case of the sample I have seen, there is an attachment Case_CC3DK9WJW8IG0F5.zip which unzips using the supplied password to Case_Fiserv_04162013.exe (note the date is encoded into the filename).

At the time of writing, VirusTotal results are just 5/46. The Comodo CAMAS report is here, the ThreatExpert report here and the ThreatTrack sandbox report can be downloaded from here (this is the most detailed one). This seems to be a Zbot variant.


The bad IPs involved are:
50.116.15.209 (Linode, US)
62.103.27.242 (OTEnet, Greece)
78.139.187.6 (Caucasus Online Ltd, Georgia)
87.106.3.129 (1&1, Germany)
108.94.154.77 (AT&T, US)
117.212.83.248 (BSNL Internet, India)
120.61.212.73 (MTNL, India)
122.165.219.71 (ABTS Tamilnadu, India)
123.237.187.126 (Reliance Communications, India)
176.73.145.22 (Caucasus Online Ltd, Georgia)
186.134.148.36 (Telefonica de Argentina, Argentina)
190.39.197.150 (CANTV Servicios, Venezuela)
195.77.194.130 (Telefonica, Spain)
199.59.157.124 (Kyvon, US)
201.211.224.46 (CANTV Servicios, Venezuela)
212.58.4.13 (Doruknet, Turkey)

Recommended blocklist:
korbi.va-techniker.de
mail.yaklasim.com
phdsurvey.org
vbzmiami.com
user1557864.sites.myregisteredsite.com
50.116.15.209
62.103.27.242
78.139.187.6
87.106.3.129
108.94.154.77
117.212.83.248
120.61.212.73
122.165.219.71
123.237.187.126
176.73.145.22
186.134.148.36
190.39.197.150
195.77.194.130
199.59.157.124
201.211.224.46
212.58.4.13

Friday 22 February 2013

"End of Aug. Stat." spam / forummersedec.ru

This fake invoice email leads to malware on forummersedec.ru:

Date:      Fri, 22 Feb 2013 11:33:38 +0530
From:      AlissonNistler@[victimdomain]
Subject:      Re: FW: End of Aug. Stat.
Attachments:     Invoices-1207-2012.htm

Hallo,

as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer/Mozilla Firefox file)

Regards


The attachment attempts to redirect the victim to a malicious payload at [donotclick]forummersedec.ru:8080/forum/links/column.php (report here) hosted on

84.23.66.74 (EUserv Internet, Germany)
122.160.168.219 (Trackon Couriers, India)

The following IPs and domains are related and should be blocked:
84.23.66.74
122.160.168.219
eiiiioovvv.ru
ejjiipprr.ru
emmmhhh.ru
errriiiijjjj.ru
famagatra.ru
familanar.ru
faneroomk.ru
filialkas.ru
finalions.ru
forummersedec.ru
fuigadosi.ru
fulinaohps.ru
fzukungda.ru

Thursday 21 February 2013

"Efax Corporate" spam / fuigadosi.ru

This fake eFax spam leads to malware on fuigadosi.ru:

Date:      Thu, 21 Feb 2013 -05:24:35 -0800
From:      LinkedIn Password [password@linkedin.com]
Subject:      Efax Corporate
Attachments:     EFAX_Corporate.htm



Fax Message [Caller-ID: 705646877]

You have received a 29 pages fax at Thu, 21 Feb 2013 -05:24:35 -0800, (913)-809-4198.

* The reference number for this fax is [eFAX-806896385].

View attached fax using your Internet Browser.


© 2013 j2 Global Communications, Inc. All rights reserved.
eFax ® is a registered trademark of j2 Global Communications, Inc.

This account is subject to the terms listed in the eFax ® Customer Agreement.

The malicious payload is at [donotclick]fuigadosi.ru:8080/forum/links/column.php (report here) hosted on:

84.23.66.74 (EUserv Internet, Germany)
122.160.168.219 (Trackon Couriers, India)
210.71.250.131 (Chungwa Telecom, China)

The following domains and IPs are malicious and should be blocked:
84.23.66.74
122.160.168.219
210.71.250.131
eiiiioovvv.ru
ejjiipprr.ru
emmmhhh.ru
errriiiijjjj.ru
famagatra.ru
faneroomk.ru
finalions.ru
fuigadosi.ru
fulinaohps.ru
fzukungda.ru

Tuesday 27 November 2012

BeyondTek IT / Beyond Tek IT / beyondtekit.com spam

Here's an annoying spammer.. but who are they exactly?


From:     Nick Snow ---- BeyondTekIT Nick@beyondtekit.com
Date:     27 November 2012 10:24
Subject:     Your IT Jobs - HR

Hello:

The IT market is extremely HOT right now and there is no doubt that, there is a severe shortage of qualified, experienced IT candidates and an over-abundance of IT jobs being advertised by companies all over the country. It seems, most qualified candidates are in such high demand that they are getting multiple offers, which is making it difficult for companies to fill certain positions.

That being said please let me know if you currently have any hard-to-fill IT positions at  that we could provide candidates for. We can assist with contract, contract-to-hire/temp-to-perm, or permanent positions.

We have candidates available across all technologies and skill-sets, including (this is only a partial list):
Programmers/Developers - Java, C++, .Net, Ruby, Web, Perl, Python, PHP, ColdFusion, etc
Systems Analysts / Business Analysts
QA Engineers/Analysts/Testers
DBA's - SQL Server, Oracle, MySQL, etc
SAP Consultants - Technical, Functional, Techno-Functional, Analysts, Developers
Oracle Consultants - Technical, Functional, Techno-Functional, Analysts, Developers
Data Warehouse/Business Intelligence Developers/Engineers - ETL, SSIS, SSAS, SSRS, Cognos, etc
Project Managers
Systems Administrators - Linux, Window, etc
Executive - CIO, CTO, VP of IT, etc

PS - We have just started offering our clients a business model of hiring off-site developers, who can be your employees but working from our office in India. Please ask me for more details, and I can send you our PowerPoint presentation.

Thank you.

Nick Snow
BeyondTek IT
Tel: 714-572-1544
nick@beyondtekit.com
www.BeyondTekIT.com
The spam (and it is spam) originates from a server on 216.14.62.75 (Telepacific Communications, Los Angeles) which also hosts the beyondtekit.com and beyondtechit.com domains.

So who are BeyondTekIT? (They also spell their name Beyond Tek IT and BeyondTek IT). The WHOIS details for the beyondtekit.com (and beyondtechit.com) are no help because they are anonymised. So, perhaps their website gives a clue.. and indeed they give the following contact details:

BeyondTek IT
1057 E. Imperial Highway, Suite 509
Placentia, CA 92870

Phone: 714-572-1544
Fax:     714-364-9705

General Inquiries:                     info@beyondtekit.com
Candidate Resume Submittals: resume@beyondtekit.com
So, this is a California company. So it must be registered in the State of California? Err.. no. There is no business entity of this name. So let's check out the address.. well, that turns out to be a store called Postal Max that rents out mailboxes.

A bit of hard searching around shows that this is not a US based company at all, but is actually based in India (the email mentions an Indian connection). Their real website is at beyondtech.in and clearly mentions the maildrop address on their contact page.

The WHOIS details for this domain are:

Registrant ID:SB23414228
Registrant Name:Nishant Rastogi
Registrant Organization:One MG
Registrant Street1:23, North Boag Road, TNagar
Registrant Street2:
Registrant Street3:
Registrant City:Chennai
Registrant State/Province:Tamil Nadu
Registrant Postal Code:600017
Registrant Country:IN
Registrant Phone:+91.9444034408
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:mail@onemg.in


I personally wouldn't recommend giving any personal details to spammers, and I certainly wouldn't recommend giving details to a company that seems to spend some effort to conceal who they really are. But, bear in mind that there are no anti-spam laws in India which explains the high level of Indian spam messages (think SEO spam) that we see, so under Indian law they are probably not doing anything wrong, but surely if they are trading as a California entity then they need to be registered?


Monday 6 August 2012

autoaxident.com spam / Lalchand Sobhani

This spam is preying on people in the UK who have had a accident, but it is actually based in India. It starts off with a pitch similar to this one:

From:     UL05 UL05@app12.sarvdns.org
Reply-To:     UL05@app12.sarvdns.org
Date:     3 August 2012 17:26
Subject:     Accident Injuries

Auto Axident
Claim Comfort

    Home
    Injury / Claim types
    Contact Us

Welcome
Header Image

We are the accident claim specialists, offering free advice, downloads and access to top no win no fee personal injury solicitors.There are many types of Personal Injury like

    Road Traffic Accident
    Work Accident
    Accident at Sea
    Aircraft Accident
    Faulty Product Accident
    Hairdressing Accident
    Holiday Accident
    Medical Negligency Accident
    Public Place Accident

Did you have an injury in the last two years?
If yes, Apply for Compensation below.
Apply for Claim here
Step 1
     
   RTA ( SELF MEDICATING CLAIMANT )
     
[snipped]

© Copyright 2012 autoaxident.com. All Rights Reserved.


Powered by SARV Mail

Click here to unsubscribe

The spam leads you to a side called autoaxident.com on 174.122.93.250 which appears to belong to Confluence Networks in the UAE. The WHOIS details are privacy protected (never a good sign for this type of site). Nameservers show an Indian connection, they are dns1.bigrock.in and dns2.bigrock.in. The spam is sent through a relay service at 74.117.60.126 (lbsmtp.org, India).

The website has no contact details or privacy policy, it is basically just a collector. However, sending a query does generate a response..

from:     AnnieThomas alaska05@rediffmail.com
date:     6 August 2012 08:15
subject:     Re: RTA - Injuries

Awaiting your reply.

Annie Thomas




From: "Swati"[alaska05@rediffmail.com]
Sent: Sat, 04 Aug 2012 14:11:40
Subject: RTA - Injuries
Dear Mr. Xxxx Xxxx

Thanks for sending us your message.

Please send your contact phone number and address.

Also if you have time please fill up form available at www.autoaxident.com and press continue button instead of submit to get the full claim form to be filled.

Upon receipt of your phone number solicitor Mr. Lamb Brook will contact you for compensation for your injury
---

 Annie Thomas
Customer Care Executive

Auto Accident Claim Company
London
Phone No. +44 20 3286 4645
Website - www.autoaxident.com 

The originating IP was 14.98.247.162 (TATA Indicom, India), so there's the Indian connection again.

Several things don't stand up with this pitch. One of them is the solicitor's name of "Mr. Lamb Brook". That's quite an unusual name, and it probably comes as no surprise to find that there is no such solicitor listed by the Law Society in the UK. Oddly, the telephone number quoted seems potentially valid and is a London number. Update: the name of the law firm is Lamb Brooks and not an individual solicitor, note however that Lamb Brooks are not sending out this unsolicited mail, I suspect that they are not even aware of it.

The email address of "Annie Thomas" alaska05@rediffmail.com also gives some clues. rediffmail.com is almost exclusively used in India, thus confirming that this is an Indian-based scam again, Googling this email address shows several clues with a background of buying and selling leads.

This thread ties the email address up with a user called lalchand38 and this is linked to a Twitter account at https://twitter.com/LCS38 (Lalchand / @LCS38) who appears to be Lalchand Sobhani who also uses an email address of lalchand38@yahoo.com. You can see his dating profile here and there are several other matches on Google for the same email address which show an interesting variety of enterprises including shipping prescription medications from India to the US.


So Annie Thomas is either Lalchand Sobhani or someone working for him. The solicitor in the UK does not exist. Mr Sobhani has gone to some efforts to hide his involvement here too.

What is probably going on here is lead generation through spam. Lalchand Sobhani is probably trying to generate personal injury leads to resell on to others. In any case, dealing with spammers is unlikely to be beneficial and it could lead to you being seriously out of pocket.

Friday 27 February 2009

MikeCahil@gmail.com: "New Jobs"

There are several different layers of fraud and deception when it comes to offering and applying for jobs.

This particular approach is via a spam, and seems to be a deceptive way of offering cheap Indian contractors to companies. India is very much a centre for spam because of very lax laws, in this case "Mike Cahil" is offering to fill roles in a variety of fields, but why would you want to do business with a spammer in any case? Remember the Boulder Pledge.

Originating IP is 59.164.72.134, a subscriber to TATA Communications in India. The netblock is widely listed as being very spammy. A poke around at blacklists indicates that 59.164.0.0/16 is a real spam sewer, and strict mail administrators could consider blocking the entire lot.

From: "Mike Cahil" MikeCahil@gmail.com
Subject: New Jobs

Hi ,

I am doing a check with you, to see if there are any IT or Engineering jobs, I can help you today at [redacted]. I can help fill any Contractor positions or Direct-Hire positions or Contract-to-Hire positions.

Additionally, I can also help in the Accounting / HR / Sales / Management positions too.

Please do reply.

Thanks … Mike

email: [redacted]