bumerang.cc spam - possible Joe Job?

As with the writer of the excellent My Online Security blog I had a couple of odd-looking spams that looked like they might be malicious.

The first spam was a bit of a fail as it didn't have the link, the second spam contained a link the the bumerang.cc website.

From:     News
Date:     19 June 2014 21:40
subject:     World Political News

You can see all World Political News at our web site.Just click on link below

Invoice

------

From:     Customer support
Date:     19 June 2014 13:43
Subject:     Your invoice for June 2014

See your invoice for June 2014 by click on link below

Invoice

The link in the second email goes to the amusingly-named www.bumerang.cc/asdaa/sploit.php - amusing because "sploit" is of course slang for "exploit". Although I have seen exploit kits that contain obvious things like this as a sort of joke, it is also a bit obvious don't you think?

But there is no exploit kit at this "sploit.php" location.. it 404s. But in fact I can see no evidence that there has ever been an exploit in this location, this URLquery report from yesterday (the earliest I can find) also shows a 404. So perhaps the exploit has been deleted? Or perhaps it was never there in the first place..

As I mentioned, there are a pair of emails. The one with the working link looks like a fake invoice malspam, but the other one has the subject "World Political News" and the body "You can see all World Political News at our web site.Just click on link below".

It turns out that bumerang.cc is a news site, covering topics of interest in Moldova in the Romanian, English and Russian languages. Unlike most multilingual news sites, the content is different depending on the language.. and the default Russian language part of the site has a lot of articles on the rather corrupt breakaway region of Transnistria which is strongly pro-Russian and which seems to be getting drawn in to the godawful mess that is the Ukraine crisis.

Transnistria has a reputation for corruption and organised crime, so perhaps bumerang.cc has published something that somebody in Transnistria doesn't like. Joe Jobs against sites dealing in Russian politics are quite common, and the messages do bear several hallmarks of being fakes.

Given that there is no evidence of malware on this site, the fishy nature of the spam and the topic areas of the site itself then I am minded to think that this is a Joe Job and bumerang.cc are not behind this spam run.

UPDATE 1 2014-06-24. Another variant..

From:     Bumerang News
Date:     24 June 2014 21:24
Subject:     SENSATION NEWS!Ukraine Will Wage War With Russia

Russia's War Against Ukraine! All at our web site. Just click on link below

">http://www.bumerang.cc/

Even more malware sites to block on 194.28.115.150

More evil sites to block on 194.28.115.150 (Specialist ISP) following on from these:

idi42nga.rr.nu
kprud89entia.rr.nu
hin66gof.rr.nu
iste03dengi.rr.nu
hing30emplo.rr.nu
ize84dso.rr.nu
ind42icat.rr.nu
lack33andw.rr.nu

Yet more malware sites to block on 194.28.115.150

Another batch of malware sites to block on 194.28.115.150 following on from these.. although to be franking, blocking access to 91.211.200.0/22  and 194.28.112.0/22 (Specialist ISP) plus all .rr.nu domains would be even better.

uresre17covered.rr.nu
ented89cable.rr.nu
erstor69msconse.rr.nu
gph46ili.rr.nu
nsu83lti.rr.nu
entl77ymail.rr.nu
rren48tlyvo.rr.nu
ersinq54uiries.rr.nu
sgradu88atevis.rr.nu
arrayt78emperat.rr.nu
ieddis18tribut.rr.nu

More malware sites to block on 194.28.115.150

Yet more malware sites hosted on the same IP of 194.28.115.150 address from black hat host Specialist ISP in Transnistria, in addition to these and these. Blocking their entire ranges of 91.211.200.0/22  and 194.28.112.0/22 could save you a lot of grief.

vat19ica.rr.nu
rtr83eaga.rr.nu
utur33esma.rr.nu
rho99dena.rr.nu
sori10gina.rr.nu
spons91orapa.rr.nu
stingh58ousedra.rr.nu
rpci22nsta.rr.nu
slat80edeb.rr.nu
rmil91annob.rr.nu
ttedbr13oadplac.rr.nu
stric59tionac.rr.nu
rsob51stac.rr.nu
tssi48lenc.rr.nu
rned93airc.rr.nu
wishp97roduc.rr.nu
rop67ded.rr.nu
velysu88pported.rr.nu
tow03ard.rr.nu
urist44anford.rr.nu
stim49atesd.rr.nu
ting41peace.rr.nu
reser76veacce.rr.nu
stenn82essee.rr.nu
tro50lle.rr.nu
urech03rysle.rr.nu
rpl51ane.rr.nu
tsre36fere.rr.nu
rsgua98rante.rr.nu
sac11tive.rr.nu
rssol40elyhig.rr.nu
rmee55ting.rr.nu
sdoo02rdaug.rr.nu
rsqbsi32mplersh.rr.nu
ilsa05mpli.rr.nu
tfun34dedmi.rr.nu
rizat57ionmi.rr.nu
rov75isi.rr.nu
topse63curiti.rr.nu
tingsi83llegal.rr.nu
tid69rugm.rr.nu
robert62sultim.rr.nu
tion96gamm.rr.nu
tigato91rsonesm.rr.nu
teract53borlan.rr.nu
teb84ran.rr.nu
turere98presen.rr.nu
ssent69encin.rr.nu
rtro39ommin.rr.nu
ydet43ermin.rr.nu
ute37drin.rr.nu
tadve42rtisin.rr.nu
rre52nwin.rr.nu
ston80esco.rr.nu
shel27lsco.rr.nu
tton77stheo.rr.nu
sgill34ettewo.rr.nu
yield83ingap.rr.nu
wind89scomp.rr.nu
yin78gsp.rr.nu
ssdel12iversp.rr.nu
ustg99ener.rr.nu
steal73gener.rr.nu
sea12tfr.rr.nu
rgye90xpor.rr.nu
urroun55dingpr.rr.nu
riv58erpr.rr.nu
tici69ansr.rr.nu
uncert96aintyr.rr.nu
reque26ncies.rr.nu
ylor83cons.rr.nu
sframe80scarlos.rr.nu
zar00dous.rr.nu
tpro52duct.rr.nu
saryho39pingit.rr.nu
siveu11nlimit.rr.nu
striki53ngbent.rr.nu
state60potent.rr.nu
uff84erst.rr.nu
veacce31ssedrev.rr.nu
tandin81gfairv.rr.nu
ushed29isdrex.rr.nu
sre80pay.rr.nu

Update: a couple of new ones via the ISC:
tentsf05luxfig.rr.nu
ksstar.rr.nu

Malware sites to block on 194.28.115.150

This is an updated list of evil domains on 194.28.115.150 (Specialist ISP in Transnistria). Blocking all of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is the best idea, and blocking traffic to .rr.nu ain't a bad one either. But if you can only block by domains names then this is the latest list of malware-laden sites to avoid:

xinthesidersdown.com
sweepstakesandcontestsdo.com
ens122zzzddazz.com
ssi11fica.rr.nu
ari55nea.rr.nu
sre13vea.rr.nu
tartis78tscolla.rr.nu
djust16scotla.rr.nu
courie90rhydra.rr.nu
idaysc65artera.rr.nu
x1010thta.rr.nu
ealis86ticeva.rr.nu
sfl20ewwa.rr.nu
rece76iptsb.rr.nu
xvarfo29urdayec.rr.nu
res11tric.rr.nu
ake60rsc.rr.nu
like90varyc.rr.nu
popre01versed.rr.nu
atr56aid.rr.nu
mentme03talsind.rr.nu
rasvi52llage.rr.nu
inglon03grange.rr.nu
senior78custome.rr.nu
sbandb46aninve.rr.nu
surpr54iseove.rr.nu
tes364rdaf.rr.nu
seamer47icadiff.rr.nu
veryt17hingof.rr.nu
ailway42staging.rr.nu
didat35egraph.rr.nu
nals02south.rr.nu
tampas71overei.rr.nu
ekendd69espitei.rr.nu
funct78ionali.rr.nu
artyi03nflati.rr.nu
ofess10ional.rr.nu
ful26qual.rr.nu
var64iabl.rr.nu
ins62ail.rr.nu
orig10inall.rr.nu
ulty75cream.rr.nu
lco16mpan.rr.nu
refi88nedn.rr.nu
ariney05aleteen.rr.nu
ital10namen.rr.nu
ymi87nin.rr.nu
olddo85esgoin.rr.nu
reque83ntlyin.rr.nu
atchp64ension.rr.nu
ional93phaco.rr.nu
eathin54gcashdo.rr.nu
ati31ngpo.rr.nu
atsda53ngero.rr.nu
ein77gyo.rr.nu
getth82rowapp.rr.nu
tsoc11ketp.rr.nu
vin04gup.rr.nu
tsroy47alpar.rr.nu
eri56orar.rr.nu
andsto57cksstar.rr.nu
train59tsafer.rr.nu
ariae54ither.rr.nu
eighbo02rsbarr.rr.nu
ing80entr.rr.nu
brown74emphas.rr.nu
sto32rybs.rr.nu
ncom24pares.rr.nu
ctab59uwes.rr.nu
spr71ings.rr.nu
ssig49nals.rr.nu
ght91ers.rr.nu
elop28ments.rr.nu
acons09olidat.rr.nu
omp25let.rr.nu
tinc31omeu.rr.nu
cello11rassu.rr.nu
pre86view.rr.nu
ns1.hoperjoper.ru
ns2.hoperjoper.ru

xinthesidersdown.com injection attack in progress

There is currently an injection attack using a script pointing to [donotclick]xinthesidersdown.com/sl.php  doing the rounds. The malicious code is hosted on 194.28.115.150, the same IP address as used in this attack yesterday.

Something evil on 194.28.115.150 and lasimp04risoned.rr.nu

The following domains appear to be part of an ongoing injection attack (using lasimp04risoned.rr.nu at present). They are hosted by black-hat web host Specialist ISP in Transnistria. Block the IP range of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is a very good idea as this is one of the worst netblocks I know of.

aelis30greek.rr.nu
aff29ili.rr.nu
aljo73hnsto.rr.nu
ambers00supplem.rr.nu
ano98the.rr.nu
appoin62tmentba.rr.nu
asciia28rmcover.rr.nu
ati92oni.rr.nu
ation82gamma.rr.nu
avia83resou.rr.nu
bear37sall.rr.nu
bitr07aryc.rr.nu
bles41steve.rr.nu
carrie01rskans.rr.nu
che59mica.rr.nu
chn34olo.rr.nu
comme17rcial.rr.nu
cons63isten.rr.nu
cos69tbu.rr.nu
cov59erm.rr.nu
cthu85srisc.rr.nu
ctsc60anli.rr.nu
eates01publi.rr.nu
ection18depres.rr.nu
elew72isst.rr.nu
enedm79ultina.rr.nu
enegat43ivecon.rr.nu
engag75edfol.rr.nu
enge75sfra.rr.nu
enormousw1illa.com
ens122zzzddazz.com
entio21nsamba.rr.nu
esgen48erally.rr.nu
eside00ntwin.rr.nu
fee89edi.rr.nu
gra98desi.rr.nu
hitam41ultime.rr.nu
hoperjoper.ru
iab35ilit.rr.nu
ialac93idcod.rr.nu
icans11deskto.rr.nu
ident08winner.rr.nu
impo82rtse.rr.nu
int99onin.rr.nu
ion68you.rr.nu
ited51pala.rr.nu
ive23lit.rr.nu
kpo82stp.rr.nu
lasimp04risoned.rr.nu
lighte93dnickel.rr.nu
limina94tedefi.rr.nu
mainglobilisi.com
mals30ynta.rr.nu
mpa89qaut.rr.nu
mtube-ssl.com
ncomp97aredli.rr.nu
neou44slypa.rr.nu
ngsin45dividu.rr.nu
nstitu42tional.rr.nu
nting91uncle.rr.nu
nusi60ngmus.rr.nu
ocat47edha.rr.nu
ocum04entat.rr.nu
oneflo30orcall.rr.nu
onsco10mdexpo.rr.nu
ort26ibm.rr.nu
ort53hori.rr.nu
ovie26tther.rr.nu
pxm-tube.com
qtr49exis.rr.nu
raff60icke.rr.nu
rlyspa21rcleona.rr.nu
rsm95ario.rr.nu
scue08doral.rr.nu
selle33rsjunk.rr.nu
sicb79enef.rr.nu
sor52tium.rr.nu
ssic2061thligh.rr.nu
ssmo24king.rr.nu
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
syno98nepet.rr.nu
takeo46versav.rr.nu
tanswe24ringni.rr.nu
tarts63exten.rr.nu
timel08arges.rr.nu
tiona82lclos.rr.nu
tormco48nstitu.rr.nu
tssign51stechno.rr.nu
vada86subje.rr.nu
velit30eratu.rr.nu
viv17eddr.rr.nu
whyi70splay.rr.nu
yint60eres.rr.nu
ysoci94alspec.rr.nu
zbol42lahg.rr.nu

Evil network revisited (again): Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist ISP is a black hat hosting company in Transnistria that I have covered before. Things have been a bit quiet on that front for a while until today when the malware site enswdzq112aazz.com came to my attention.

A lot of the bad sites have migrated from Specialist recently, but one unusual thing about Specialist is that all the sites are bad sites. So where are all those bad sites now?

These sites are still hosted by Specialist ISP:

194.28.112.11
cliffordtravel.biz

194.28.113.26
sekurepays.org

194.28.114.102
ation72histor.rr.nu
comm98andsp.rr.nu
doutl31inesst.rr.nu
earni61ngunde.rr.nu
enormousw1illa.com
ens122zzzddazz.com
ensm60erch.rr.nu
enswdzq112aazz.com
eorge00gamee.rr.nu
ggesti51ngbina.rr.nu
globalpoweringgathering.com
globalpoweringgatheringit.com
globalpoweringgatheringon.com
h102-114.net.lan-rybnitsa.com
hoperjoper.ru
iess70elec.rr.nu
ift72hbot.rr.nu
ilto27nint.rr.nu
infoitpoweringgathering.com
infoitpoweringgatheringit.com
infoitpoweringgatheringon.com
inful07commi.rr.nu
lessthenaminutehandle.com
lessthenaseconddeal.com
llowe31dmeth.rr.nu
mail.sweepstakesandcontestsinfo.com
ns1.hoperjoper.ru
ns2.hoperjoper.ru
root.sweepstakesandcontestsinfo.com
sical59lymemo.rr.nu
sokoloperkovuske.com
sokoloperkovuskeci.com
sokoloperkovuskedi.com
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
tyco93uplin.rr.nu
wbesnancer.org

Bad sites that have moved elsewhere:

46.4.31.134 (Hetzner Online Germany)
boskoop2nepal.info
bossal.info
bramrozafestival.info
brand-central.info
childsurvival.info
creedenceclearwatersurvival.info
damesfutsal.info
datadigital.info
farmsurvival.info
haaglandia-futsal.info
hvdwal.info
josal.info
kadefestival.info
literatuurfestival.info
mvanderwal.info
noordelijkkoorfestival.info
oordfestival.info
paulvosdewael.info
petstotal.info
rebootfestival.info
spankabel.info
stiltefestival.info
tinkel-bel.info
vetstival.info
vicl.info
worldfuneral.info

199.59.241.235 (Bodis LLC, China)
2ti0pv3y.ru
bim6xe3t.ru
nl6fa53.com
twqhde3i.ru

The majority of other sites are parked or don't resolve. It is not surprising at all to see the Hetzner and Bodis are taking up the slack. You may want to block those IP addresses or even their whole netblocks.

Evil network revisited: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist Ltd is a small Black Hat hosting company in Transnistria, a breakaway part of the former Soviet Republic of Moldavia. No UN members recognise Transnistria, and effectively it sits beyond the reach of international law enforcement. Quite a handy place for criminals to do business then.

I first wrote about this block last year, but it recently came into my sights again as the host for a very widespread injection attack using the lilupophilupop.com domain.

Since last year the number of malicious sites has dropped, but there is still not a legitimate site in sight. Most of the bad sites are currently on 194.28.114.102 but you should block access to 194.28.112.0/22 (194.28.112.0 - 194.28.115.255) if you can, because this range of IP addresses is nothing but trouble.

A list of sites hosted in this range is at the end of this post, or you can download a CSV with the MyWOT ratings and IP addresses from here.

Google's prognosis of this block is pretty horrible:

Safe Browsing
Diagnostic page for AS48691 (SPECIALIST)

What happened when Google visited sites hosted on this network?

    Of the 44 site(s) we tested on this network over the past 90 days, 1 site(s), including, for example, rthur87seeks.rr.nu/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2011-12-12, and the last time suspicious content was found was on 2011-12-12.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 15 site(s) on this network, including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that appeared to function as intermediaries for the infection of 190 other site(s) including, for example, teas.com.au/, rogersplus.ca/, cicomra.org.ar/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 30 site(s), including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that infected 2524 other site(s), including, for example, jri.ir/, psu.ac.th/, longoservice.it/.

The WHOIS details for the bloack are:

inetnum:         194.28.112.0 - 194.28.115.255
netname:         Specialist-ISP-PI2
descr:           Specialist, Ltd.
country:         MD
org:             ORG-SL206-RIPE
admin-c:         VP2841-RIPE
tech-c:          AB16163-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          SPECIALIST-MNT
mnt-routes:      SPECIALIST-MNT
mnt-domains:     SPECIALIST-MNT
source:          RIPE # Filtered

organisation:   ORG-SL206-RIPE
org-name:       Specialist, Ltd
org-type:       OTHER
descr:          Specialist, Ltd, Rybnitsa, MD
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
phone:          +373-693-18189
phone:          +373-777-65071
fax-no:         +373-555-43073
mnt-ref:        MONITORING-MNT
abuse-mailbox:  abuse@lan-rybnitsa.com
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

person:         Vladimir Pilan
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
fax-no:         +373-555-43073
nic-hdl:        VP2841-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

person:         Anatoly Belitsky
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-65071
fax-no:         +373-555-43073
nic-hdl:        AB16163-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

route:          194.28.112.0/22
descr:          Specialst-route2
origin:         AS48691
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

Some domains and sites hosted in this block are:



ation72histor.rr.nu
blogsvk.ru
cliffordtravel.biz
comm98andsp.rr.nu
doutl31inesst.rr.nu
earni61ngunde.rr.nu
ensm60erch.rr.nu
eorge00gamee.rr.nu
ggesti51ngbina.rr.nu
globalpoweringgathering.com
globalpoweringgatheringit.com
globalpoweringgatheringon.com
h102-114.net.lan-rybnitsa.com
hoperjoper.ru
iess70elec.rr.nu
ift72hbot.rr.nu
ilto27nint.rr.nu
infoitpoweringgathering.com
infoitpoweringgatheringit.com
infoitpoweringgatheringon.com
inful07commi.rr.nu
lessthenaminutehandle.com
lessthenaseconddeal.com
lilupophilupop.com
lilypophilypop.com
llowe31dmeth.rr.nu
mail.lilupophilupop.com
mail.sweepstakesandcontestsinfo.com
ns1.hoperjoper.ru
ns2.hoperjoper.ru
root.sweepstakesandcontestsinfo.com
sekurepays.org
sical59lymemo.rr.nu
sokoloperkovuske.com
sokoloperkovuskeci.com
sokoloperkovuskedi.com
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
sweepstakesandcontestsnow.com
tyco93uplin.rr.nu
wbesnancer.org
welcometotheglobaliscom.com
welcometotheglobalisnet.com
welcometotheglobalisorg.com
zevkblog.ru

Evil network: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

This summary is not available. Please click here to view the post.