193.169.87.247 ("PE Ivanov Vitaliy Sergeevich", Ukraine) is currently serving up scareware claiming that the victim's PC is locked, using the following domains:
a1751.com
b4326.com
d2178.com
f1207.com
h5841.com
k6369.com
The scareware is multilingual and detects the country that the visitor is calling from. In this case I visited from the UK and got the following:
Europol EUROPEAN CYBERCRIME CENTRE Europol EC3
All activities of this computer have been recorded. All your files are encrypted.
ATTENTION!
All your files are encrypted to prevent their distribution and use.
Due to violations of the law, your browser has been blocked
because of at least one of the reasons below.
1. You have been subjected to violation of Copyright and Related Rights Law and illegally using or distributing copyrighted contents such as Video, Music or\and Software (files were found in your browser's temporary files and your documents), thus conflicting with Article 1, Section 8, Clause 8 of the Criminal Code of the United Kingdom.
Article 1, Section 8, Cause 8 of the Criminal Code states a fine or two hundred minimal wages or a deprivation of liberty of two to eight years.
2. You have been viewing or distributing prohibited Pornographic contents: Child Porno photos and such, were found in browser's temporary files and your documents.
Thus, you are violating article 202 of the Criminal Code of the United Kingdom. Article 202 of the Criminal Code states a deprivation of liberty of four to twelve years.
3. Illegal access has been initiated from your PC without your knowledge or consent, your PC may be infected with malware, thus you are violating the law of Neglectful Use of your Personal Computer. Article 210 of the Criminal Code declares a fine of up to £50,000 and/or deprivation of liberty of four to nine years.
Pursuant to the amendment of the Criminal Code of the United Kingdom of May 28, 2011, this law infringement (if it is a first time offence) may be considered as conditional in case you pay the fine.
To unlock your computer and avoid other legal consequences, you are obliged to pay a release fee of £200, payable through Ukash (you must purchase the Ukash card and enter the code). You can buy the card at any store or gas station, payzone or paypoint.
Find the nearest epay or payzone location.
Go to any location with a PayPoint or Payzone terminal.
Ask for Ukash: £200.00 (one voucher code).
Please note: Fine can only be paid within 12 hours. As soon as 12 hours expire, the possibility to pay the fine is lost forever. All your PC data will be detained and criminal's procedure will be initiated against you if the fine will not be paid!
The text varies depending on the country the visitor is in, for example URLquery
displays the text in Norwegian.
The bad guys use subdomains to obfuscate the domain somewhat, so instead of just getting
f1207.com (for example), you get
europol.europe.eu.id176630100-8047697129.f1207.com instead which looks a little more official. You can see some more examples
here.
All the domains in use are registered through scam-friendly registrar BIZCN to:
Registrant Name: Zhong Si
Registrant Organization: Xicheng Co.
Registrant Street: Huixindongjie 15 2
Registrant City: Beijing
Registrant State/Province: Chaoyang
Registrant Postal Code: 101402
Registrant Country: cn
Registrant Phone: 01066569215
Registrant Phone Ext:
Registrant Fax: 01066549216
Registrant Fax Ext:
Registrant Email: zhongguancun@yahoo.com
Now, I would normally suggest that the WHOIS details were fake but a
Google search for the email address shows that it has been active for over two years including
this injection attack I documented in September 2011. It is possible therefore that
Zhong Si and
Xicheng Co are actually responsible.
193.169.87.247 is regiesterd to "PE Ivanov Vitaliy Sergeevich" (i.e.
Vitaliy Ivanov or
Виталий Сергеевич Иванов) as follows:
organisation: ORG-IV2-RIPE
org-name: PE Ivanov Vitaliy Sergeevich
org-type: OTHER
address: 42-A Tobolskaya street, office 230, Kharkov, Ukraine
mnt-ref: MNT-IV25
mnt-by: MNT-IV25
source: RIPE # Filtered
193.169.87.247 forms part of 193.169.86.0/23
AS48031 which has a
so-so reputation according to Google, it does look like there are a lot of legitimate sites in the neighbourhood as well as these malicious ones.
Recommended blocklist:
193.169.87.247
a1751.com
b4326.com
d2178.com
f1207.com
h5841.com
k6369.com
Update: a similar attack has also taken place on
193.169.86.250 on the same netblock.
