Evil network: Latnet Serviss Ltd (latnet.lv) AS2588 (159.148.117.0/24)

Latvia is definitely becoming a problem when it comes to black hat hosting. The 159.148.117.0/24 range (159.148.117.0 - 159.148.117.255) is another malicious block, forming part of AS2588 belonging to Latnet (similar to microlines.lv). At a rough calculation, roughly half the IP address ranges I am currently blocking are based in Latvia.

This bunch of domains is a mix of fake pharma sites, browser exploits, illegal downloads and possibly some hijacked domains. In any case, there is nothing of use here and either blocking the entire IP range, or the list below is probably a good idea.

There's a more detailed file with MyWOT ratings and IP addresses to download here.

Bitssit.com
Solid-pay-gate.com
Bombastats.com
1001meds.info
101doctors.info
101health.info
11doctors.info
333tabs.info
5meds.info
911drugs.info
99pharmacy.info
99pills.info
Abouttabs.info
Actualdrugs.info
Actualtabs.info
Addhealth.info
Addpills.info
Advancedsoft.in
Allpills.info
Anyhealth.info
Anymeds.info
Anytabs.info
Atlanticdrugs.info
Atlantictabs.info
Bestwesthost.info
Bluedoctor.info
Buycheapnow3.info
Buyfdatabs.info
Buygeneric1.info
Buyld.info
Buyonline5.info
Buytramadol5.info
Buytramadolf.info
Buytramadolk.info
Buytramadolp.info
Buytramadolt.info
Buytramadoly.info
Buyxanax1.info
Buyxanaxk.info
Cheap2tramadol.info
Cheaponline2.info
Cheaprt.info
Cheaptramadolh.info
Cheaptramadoli.info
Cheaptramadolss.info
Cheaptramadolw.info
Cheaptramadolz.info
Cheapxanaxz.info
Doctor01.info
Doctorarea.info
Doctordaily.info
Doctorgiant.info
Doctorjones.info
Dogoal.in
Drugs01.info
Drugs12.info
Drugsapple.info
Drugsbasket.info
Drugsblue.info
Drugscenter.info
Drugsclub.info
Drugscompany.info
Drugsdaily.info
Drugsfast.info
Drugsgood.info
Drugslife.info
Drugsreview.info
Drugstoree.info
Fasttabs.info
Fdapillsonline.info
Fulink.in
Fustat.in
Generictramadolb.info
Generictramadolc.info
Generictramadoln.info
Generictramadolr.info
Generictramadolv.info
Genericxanaxn.info
Getonlinehealth.info
Getonlinemeds.info
Haycorn.info
Health911.info
Healthbasket.info
Healthblue.info
Healthgreat.info
Healthlabel.info
Kinghealth.info
Kingpills.info
Knownmeds.info
Knowntabs.info
Labeldrugs.info
Labelhealth.info
Meds01.info
Meds333.info
Meds4him.info
Medsapple.info
Medsarea.info
Medsdaily.info
Medsexpress.info
Medsguard.info
Medshealth.info
Medslife.info
Medslocate.info
Medssearch.info
Mmlist.in
Mmsoft.in
Moderndrugs.info
Modernpills.info
Mxstat.in
Needsdoctor.info
Olstat.in
Online01.info
Onlinecasinosbestusa.info
Onlineow.info
Ordercheapnow6.info
Orderoj.info
Orderonline4.info
Ordertramadold.info
Ordertramadole.info
Ordertramadolj.info
Ordertramadolo.info
Ordertramadolx.info
Orderxanaxx.info
Owndoctor.info
Pacificdoctor.info
Pills007.info
Pills01.info
Pills4him.info
Pills4men.info
Pillsaccept.info
Pillsarea.info
Pillsblue.info
Pillscontrol.info
Pillsdaily.info
Pillsfast.info
Pillsgood.info
Pillslabel.info
Pillslife.info
Pillslocate.info
Pillsoffice.info
Pillsreview.info
Pillssearch.info
Pillstoday.info
Pillsworld.info
Realtabs.info
Rx999.info
Safedoctor.info
Searchtabs.info
Sermyagino.info
Ssmode.in
Ssnews.in
Tabs01.info
Tabs4him.info
Tabs5.info
Tabsaccept.info
Tabsapple.info
Tabsarea.info
Tabscenter.info
Tabsclub.info
Tabscompany.info
Tabscontrol.info
Tabsdaily.info
Tabsexpress.info
Tabsguard.info
Tabsguide.info
Tabslife.info
Tabsoffice.info
Tabspills.info
Tabsreview.info
Tabssearch.info
Tabsworld.info
Todaypills.info
Todaytabs.info
Tramadolonline7.info
Tramadolonlinea.info
Tramadolonlineg.info
Tramadolonlinel.info
Tramadolonlineq.info
Tramadolonlineu.info
Tramadoltramadol1.info
Tramadoltramadol10.info
Tramadoltramadol2.info
Tramadoltramadol3.info
Tramadoltramadol4.info
Tramadoltramadol5.info
Tramadoltramadol6.info
Tramadoltramadol7.info
Tramadoltramadol8.info
Tramadoltramadol9.info
Uiplus.in
Usaapharm.info
Usausaonlinecasinossuper.info
Xanaxonlinee.info
Xanaxonlinel.info
Pupseg.net
Pupseg.org
Pixelstatservice.com
Mybesttubeporn.com
Rowfirst.com
Java-9update.com
Update-00server.com
Hqll.ru
Xacz.ru
Aloa.asia
Vniz.asia
Bbls.ru
Vaseagruzitkorm.com
Vaseajretikru.com
Ewacx.com
Yacver.com
Security-defencing.com
Mypctech.net
1200kb.net
Banfieldsbest.com
Btp-tags.com
Doit-4-u.com
In-ta.net
Media-share.org
Mwcdirect.com
Pixel-pie.com
Planetsoldat.com
Sainser.com
Wnizip.com
Thebestporn.in
Cormoupo.info
Zombie-world.org
Alterparadigma.net
Brickplayer.ru
Chilauter.ru
Compromendes.com
Moretds.org
Danjg.com
Aftui.in
Ammew.info
Armrm.in
Aspow.info
Clasd.in
Coerw.info
Demim.in
Diasw.info
Diaui.in
Expew.info
Eynew.info
Gatui.in
Harui.in
Highw.info
Homow.in
Jenyx.in
Jusui.in
Katre.in
Lisni.in
Manui.in
Marsw.in
Marui.in
Micre.in
Neigw.info
Ningl.in
Nitan.in
Nvenc.in
Nvene.in
Nvild.in
Nvill.in
Pockw.info
Praaw.info
Pulpm.in
Racew.info
Recei.in
Recky.in
Recto.in
Regaw.info
Rendm.in
Sepsd.in
Slovw.in
Socyx.in
Stpsd.in
Synre.in
Thiui.in
Torsw.in
Uianh.in
Volnv.in
Yxiac.in
California-ns.com

UPDATE 2014-06-25:  It's been a long time since I wrote this, and it looks like the block was cleaned up some time ago and now contains some Latvian government sites.

north-europ.com job offer scam

This is a fraudulent job offer originating from an IP address in Vietnam, with a ridiculous salary for doing next to nothing:

Hello message

We are in a hurry to offer you position in the building Company.
In few words our Company provides huge circle of building services like
building, landscaping, interior and exterior design of premises, houses etc.

We offer you:
- career growth
- flexible working day
- minimal requirements to become the part of our team

Job description:
- type of work: part time position
- the place to work: your home office
- territory of work: you area(city)
- salary: 60.000 euro per year + percents of transactions
- principle of work: work with clients/partners getting tasks online

If you are interested please respond with the C.V. or minimal contact data to the e-mail: Allison@north-europ.com


Attention!
We are interested in cooperation to the people who live in Europe.

north-europ.com uses Google to handle its mail and doesn't have a website. The WHOIS details have a very familiar email address of lapatasker@earthling.net.

    Aleksandr Lapatau
    Email: lapatasker@earthling.net
    Organization: Private person
    Address: Lenina, 34, 8
    City: Minsk
    State: Minskaya
    ZIP: 456123
    Country: BY
    Phone: +375.172427204

Infrastructure is in various locations around Russia. Avoid.

There's more to this than meets the eye..

This is a straightforward money mule pitch, so nothing very interesting in the message itself..

From: james roberts <jamesroberts02@sify.com>
Reply-to: james.roberts@sify.com
Date: 24 August 2010 13:13
subject: JOB OFFER:APPLY IF YOU ARE INTERESTED.
   

  Hello,
      
        My name is JAMES ROBERTS , a designer also the Manager of JAMES ROBERTS FABRIC and Consultant live and work here in United Kingdom,will you like to work online from home and get paid without affecting your present job?
          
        Actually I need a representative who can be working for the company as online book-keeper. We make lots of supplies to some of our clients in the USA/CANADA/EUROPE, for which I do come to USA/CANADA/EUROPE to receive payment and have it cashed after I supply them raw materials. It’s always too expensive and stressful for me to come down and receive such payment twice in a month so I therefore decided to contact you.
      
        I am willing to  pay you 10% for every payment receive by you from our clients who makes payment through you.   Please note you don't have to be a book keeper to apply for the job.
      
        Kindly get back to me as soon as possible if you are interested in this job offer with your details:
      
        FULL NAMES...................
        ADDRESS ..................
        STATE..................
        ZIPCODE................
        COUNTRY................
        PHONE NUMBER(S)........
        GENDER.................
        AGE....................
        OCCUPATION.............
          
        Yours Faithfully,
     
        JAMES ROBERTS

But the headers tell an interesting story..

Received: from mail.pna.ps ([213.244.123.84])
    by ********** with esmtp (Exim 4.69)
    id 1Onsd0-0004Yt-Jc
    for **********; Tue, 24 Aug 2010 13:29:22 +0100
Received: from User (unknown [60.18.167.17])
    by mail.pna.ps (Postfix) with ESMTPA id ED6A94476F;
    Tue, 24 Aug 2010 15:12:09 +0300 (IDT)

You can only really trust the last hop before it hits your mail server (in truth, not always then either). That IP is 213.244.123.84 which is indeed mail.pna.ps.

So what the heck is .ps? Well, it turns out to be the TLD for Palestine, and the PNA is the Palestinian National Authority, with servers that look to be based in Ramallah on the West Bank.  So, it looks like the PNA mail servers are either insecure or compromised.

Did you even know that Palestine had a TLD of its own? I didn't.. so I guess this spam has tought me something!

Weird scam mashup makes little sense

This is a weird mashup of an FBI scare scam and a lottery scam, spelling out very clearly that it is really an advanced fee fraud. It makes no sense.. why would the FBI be informing you that you had won the lottery in the UK anyway? Bin it.

From: Federal Bureau Of Investigation <soundsit@btconnect.com>
Date: 2010/8/13
Subject: *Alert*
To:

FEDERAL BUREAU OF INVESTIGATION

Anti-Terrorist and International Fraud Division

601 4th Street NW, Washington, DC 20535

Attn: Beneficiary

RE: AUTHETICATED LOTTERY WINNINGS

This is to officially inform you that it has come to our notice and we have thoroughly completed an Investigation with the help of our Intelligence Monitoring Network System that you legally won the sum of $850,000.00 US Dollars from a Lottery Organization in the United Kingdom. During our investigation we discovered that your e-mail won the Lottery from an online balloting system and we have authorized this winning to be authentic and paid to you via a Certified Cashier's Check. Normally, it will take up to 15 business days for an International Check to be cashed by your local bank. We have successfully come to an agreement with this organization on your behalf that funds are to be drawn from a registered bank within the United States of America so as to enable you cash the check instantly without any delay, henceforth the stated amount of $850,000.00 US Dollars has been deposited with Chase Manhattan Bank.

We have completed this investigation and you are hereby approved to receive the winning prize as we have verified the entire transaction to be Legitimate, Safe and 100% risk free of scams and frauds of any nature, due to the fact that the funds have been deposited at Chase Manhattan Bank you will be required to settle the following bills directly to the lottery claims agent in-charge of this transaction whom is located at the liaison office of the Lottery Organization in Washington, DC. According to our records, you are required to pay for the following:

(1) Deposit Fee's (Fee's paid by the organization for the deposit into Chase Manhattan Bank)

(2) Cashier's Check Conversion Fee (Fee for converting the EFT into a Certified Cashier's Check)

(3) Shipping Fee's (The charge for shipping the Cashier's Check to your nominated destination)

The total amount is $349.99 (Three Hundred & Fourty Nine United States Dollars & Ninety Nine Cents). We have tried our possible best to have the lottery organization deduct the $349.99 from your lottery winning but the funds have already been deposited at Chase Manhattan Bank and cannot be accessed by anyone apart from you the winner. Therefore you will be required to pay the needed funds to your lotto claims Agent in-charge of this transaction. The payment will NOT reflect at the Chase Manhattan Bank with the given transaction code (US8976-003) until you have covered the processing fees needed.

In order to proceed with this transaction, Click Here (ericaclain@gala.net) to contact your claims agent Mrs. Erica Molin .You may be required to call her for verbal verification and e-mail her with the following informations:

FULL NAME:

LOCAL ADDRESS (INCLUDING CITY/STATE/ZIPCODE):

AGE/GENDER/OCCUPATION:

CONTACT PHONE NUMBERS (CELL & HOME):

You will also be required to request details on how to pay up the required $349.99 in order to immediately ship your prize of $850,000.00 USD via Certified Cashier's Check drawn from Chase Manhattan Bank, Also include the following transaction code in order for her to immediately identify this transaction: US8976-003. This letter will serve as proof that the Federal Bureau Of Investigation is authorizing you to pay the required $349.99 ONLY to your claims agent via the information in which she shall send to you upon your request, if you do not receive your winning prize of $850,000.00 US Dollars we shall be held responsible for the loss and this shall invite a penalty of $3,000 which will be made PAYABLE ONLY by you (The Winner).

Robert Anderson, Jr.

Special Agent in Charge

NOTE: In order to ensure your check gets delivered to you ASAP, you are advised to immediately contact Mrs. Erica Molin (ericaclain@gala.net) via contact information provided above and make the required payment of $349.99 to information in which she will provide you.

"Spam King Leo Kuvayev Jailed on Child Sex Charges"

A spammer.. and a kiddy fiddler (allegedly), notable Russian spammer Leo Kuvayev has been jailed on remand on charges of raping 50 children. I hear that Russian prisons are not very nice..

More at Krebs on Security.

Battle.Net / WOW Phish domains

I don't play World of Warcraft of Starcraft..but lots of people do and Blizzard accounts (used for playing the game online) are often a target for phishers. Why? Well, these accounts can be resold and are worth real money.

This post at the Sunbelt software blog caught my eye.. but knowing that fake WOW / Blizzard sites don't tend to travel alone I did some digging and came up with a whole batch of them on neighbouring IPs.

58.64.158.233
Ba11ile.net
Baititle.net
Eu-batile.net
Eu-battlie.net

58.64.158.238
Barittle.net
Bartiile.net
Bartlie.net
Bartllie.net
Barttirle.net
Barttle.net
Blizzte.net
Eu-de-battle.net
Bliizte.net
Blrttle.net
Battrlie.net
Bartzle.net
Battiale.net
Barttlie.net

58.64.158.240
Usbatt1ee.net

58.64.158.244
De-bartle.net

Registrant details are:

  Name           : Ji XiaoWei
  Organization   : Ji XiaoWei
  Address        : LiShui Dengtalu 25
  City           : LiShui
  Province/State : Zhejiang
  Country        : CN
  Postal Code    : 323700
  Phone Number   : 86-0578-7245132
  Fax            : 86-0578-7245132
  Email          : qnpv@163.com

These are all fake, so avoid

"Your Free Money with Grants 4 CD Set At Absolutely No Cost From Robert Allen"

I quite enjoy this spammy crap I get from Robert Allen, in all its breathless uselessness, from a company that only rates a D+ from the BBB.

Hello Conrad,

One day we must talk about where you got your mailing list from.

It’s Robert Allen checking in with some MAJOR NEWS for you!

Major news? You've discovered you have some horrible terminal disease that causes you to die through continuous pustulant eruptions? No? Shame.

I am very excited to announce an amazing new program that reveals how anyone can quickly and easily get FREE MONEY from the Government.

What, you want me to become a failed bank?

No technical jargon or complicated procedures, simple, straight forward advice and methods on how to locate the free money that you are entitled to.

Which government is this exactly?

Best of all, you can get your own copy of this hot, new course for free.

Why do I feel that there will be a catch?

Read on … because this is exciting!

This must be a definition of "exciting" that I wasn't previously aware of.

My friend and colleague Rex Hudson just put the finishing touches on his brand new, “FREE MONEY with GRANTS” audio training course, and I’ve convinced him to give you, a free copy of this info packed 4 disc audio library!

How did that go? "Rex, I'd really like to send a free copy of this training course to Conrad!" "Oh Robert, I'm not really sure I want to do that!" "Oh come on Rex, he's a great guy!" "Oh alright then Robert".

Over the course of his long and varied investment career, Rex has held SEC licenses for Stock, Bond, Insurance, Options and Commodities.   As an MBA and the VP of Investments for a National Bank he also held a Municipal Bond Principle License and operated as a Registered Investment Advisor.  As the investment manager Rex held discretionary investment authority on over $850 Million in assets.  The bottom line is Rex knows money!

He's a stockbroker and banker, basically. But now he works for the "Enlightened Wealth Institute" as "Vice President of Training" which is a bit of an interesting career move.

Now you can have a chance to learn from the master – and get his best, proven techniques for getting FREE MONEY from the GOVERNMENT.

I did say he was a banker.

Rex’s FREE MONEY with GRANTS is your one stop source for BILLIONS of dollars that is ready, available, and waiting to be claimed! This easy to listen and easy to follow 4 disc audio program tells you exactly what to do to find your share of this FREE MONEY.

Dollars? Can I have pounds instead?

FREE MONEY with GRANTS audio program contains simple plan for putting
cash in your hands. And this is FREE MONEY THAT YOU NEVER HAVE TO
PAY BACK!

Champagne does taste so much better when it has been paid for by the taxpayer.

Find out how to get free money grants from Uncle Sam!
Find out how to get free money grants from private foundations!
Find out how to borrow money with government guarantees!
Discover the huge opportunity in selling to the government!

I don't have an Uncle Sam. Wait, Robert.. you didn't think I was American did you?

These are some of the best kept secrets of our government – and now you will know there are BILLIONS OF DOLLARS sitting, waiting to be claimed. And MILLIONS of people are eligible to receive free money from the government.

Honestly, no.. I don't think these are the best kept secrets of the US Government. I mean, they probably even have leaflets and stuff.

The FREE MONEY WITH GRANTS audio program is your ultimate guide to getting your share of free money from the government.

You can keep shouting FREE MONEY WITH GRANTS all you like but you are still not going to convince me. Actually, I'm starting to get a headache now.

Rex’s “FREE MONEY with GRANTS” quick cash program could easily retail $69.95,
but in true “Nothing Down” fashion, I’ve arranged for you to get this fantastic new 4 CD audio training course for FREE … not even shipping and handling!

Nearly seventy dollars? Well, you can put whatver price on it you like.. it doesn't mean that it will sell. Look at the bidding wars going on for these items.. oh wait, they're not even shifting for 99 cents. And by "nothing down" I guess you mean that I don't have to pay anything NOW for them.. but what about later?

All you have to do is dial toll free 1-888-384-4047 RIGHT NOW and let me know where to ship your course! That’s it … it’s as simple as that!

Please ship it firmly up your own backside.

I am very excited about Rex’s “FREE MONEY with GRANTS” 4 CD audio training
program and I look forward to sending you your FREE COPY!
Massive Success,

Wicked!

Robert Allen
P.S. Don’t Wait! Call toll free 1-888-384-4047 RIGHT NOW. This offer is NOT going to last forever. Rex is only allowing us to give away a very limited number of these hot courses. So act now so you don’t miss out! Get your copy today!

I'll pass if it's OK with you.

Please note that product prices and availability are limited time offers and are subject to change.  We respect your privacy.  To remove yourself from this mailing list, click http://www.ewimail.com/unsubscribe.aspx or reply to this message with “unsubscribe” as the subject line or write us at Enlightened Wealth Institute, LC, 5072 N 300 W Provo, UT 84604

But apparently you don't respect my intelligence by sending me this crap.

Evil network: MAXHOSTING Services / GlobalNET Bosnia (AS42560 / 77.78.239.0/23)

This summary is not available. Please click here to view the post.

"Thank you for scheduling your online payment" email leads to malware

The spammers seem to be busy today, using an old trick of embedded a spam in a template lifted from a legitimate business. This particular one is from Chase bank in the US, they key "hook" they use to get people to click is:

Thank you for scheduling your recent credit card payment online. Your ($USD) $117.00 payment will post to your credit card account (CREDIT CARD) on 08/06/2010. 

This seems to be exactly the same attack as used here and here, although in this case the intermediate site had already been cleaned up and the malicious payload could not be delivered.

Best Buy "Thank You, Your Anti-Virus Protection Plan has been renewed" email leads to malware

To prove that the Bad Guys have a sense of humour at least, this fake email claims to be a renewal subscription for Webroot:

From: Best Buy Subscription Software [mailto:noresponse@softwaresubscription.bestbuy.com]
Sent: 06 August 2010 11:23
Subject: Thank You, Your Anti-Virus Protection Plan has been renewed

Dear [victim]

Your Webroot Spysweeper with AntiVirus Product Protection Plan has been successfully renewed and charged to the credit card you have on file with us. With this automatic renewal, you will continue to have uninterrupted anti-virus software protection on your PC for another year plus these great benefits:

òÀâ Best in Class Security Software
òÀâ No hassle automatic renewals makes sure that you will never go unprotected
òÀâ Receive all version updates free of charge
òÀâ Cancel at any time and received a refund for any unused months of protection
òÀâ Simple Customer Support, Call 1-888-BESTBUY with any questions

-------------------------------------------------------------
Here are the details of your renewed Protection Plan:
-------------------------------------------------------------
Product: Webroot Spysweeper with AntiVirus Product
Protection Plan: Annual
Best Buy Serial Number: WBR00AV000044180817
Transaction Date: 7/19/2010
Renewal Price: $43.54


If you have any questions about your protection plan or your recent renewal, please contact our Customer Support Team at 1-888-BESTBUY (1-888-237-8289), and ask for the Subscription Software Team.

Thank you again for your business, and being a Best Buy Customer.

Sincerely,

Best Buy Stores, L.P.

ddd

Payload and approach seem to be exactly the same as this one, with a Bredolab dropper. Again, it routes through yummyeyes.ru and you should look for the same log entries of .ru:8080 and /x.html to make sure you are clean.

In this case the intermediate step is a hacked site at peninsula.co.nz/x.html but it probably varies.

If you are not in the US, then blocking bestbuy.com at your mail perimeter will do no harm.

"Thanks for planning your event with Evite" mail leads to malware

This summary is not available. Please click here to view the post.

"Shifflett Martin Stores" scam

As far as I can tell, there is no such company as "Shifflett Martin Stores", although there may be legitimate companies with a similar name, but this particular  job offer is a fraud.

From the insistence that potential employees / victims have a bank account with either Wells Fargo or Wachovia indicates that they will probably be accepting wire transfers from bank accounts where the password has been stolen (because transfers between accounts in the same bank are usually immediate).

From: Ceaser <marrrtttiii@yahoo.com>
Reply-To: gapstarrrss11@aol.com
Date: 5 August 2010 07:29
Subject: Help Wanted

 I am  Ceaser Martin, owner of Shifflett Martin Stores  I seek an online virtual assistant to accept payments on my behalf in the United States of America. Requirements  **Applicants must have a Wells Fargo or Wachovia bank account*** You are also eligible to apply if you can open a new Wells Fargo or Wachovia account. Great pay (15% of each payment processed), flexible and will not affect your present employment. Interested and meet the requirements? Send Full Names, Address, Direct Telephone Number and email address to gapstarrrss11@aol.com

Originating IP is 80.8.199.189, an open proxy in Réunion of all places.

"Anatomy Of An Attempted Malware Scam"

If you work in IT Security then malicious ads are a regular pain in the backside.. and you probably wonder why "reputable" ad networks get talked into running them. This article is possibly the best thing I have read on the problem, written from the ad network's point of view. It seems the Bad Guys do go to extraordinary lengths to try to look genuine, but sometimes the simplest checks can reveal that they are not what they seem.

Hat Tip

Evil network: Microlines (microlines.lv), AS2588 (79.135.128.0/19)

Latvia seems to be getting a bad reputation for supporting criminal activity. The latest accomplice is Microlines (microlines.lv) who mix in a large number of bad sites with a few legitimate ones.

Their netblock AS2588 (79.135.128.0/19) actually ranges from 79.135.128.0 - 79.135.159.255, although the badness is concentrated in 79.135.152.0/24, all legitimate web sites are hosted outside of that /24.

I used the MyWOT API to query the reputation of the hosted domains, and it shows a clear differentiation between the /24 and the rest of the /19. You can download a CSV of the analysis from here.

Out of 157 domains looked at, 4 (2.5%) were rated "excellent", 3 (1.9%) were rated "good", 43 (27.4%) were unrated and 107 (68.1%) were "very poor". You might want to block the whole /19 on that basis, certainly you should block 79.135.152.0 - 79.135.152.255 at the very least.

A list of bad domains to block:
Best-scanner-2010.net
First-online-scanner.com
Nameservice-worldwide.com
Scanner2010.com
Scanner2010.org
Scannerglobal.com
Scannerglobal.net
Super-scanner.net
Super-scanner.org
Volunteer-scan.com
Best-scanner-2010.org
First-online-scanner.net
Scanner2010.net
Best-scanner-2010.com
Huisko.cn
Lokisko.cn
First-online-scanner.org
Ad-parking.net
S-powerlink.com
Creatives-labs.com
Brick-layer888.com
Advdefender.com
Goadvdef.com
Advanced-def.com
Advanceddefender.org
Getadvdef.com
Goadvdef2.com
Kavascansecurity.com
Iuysdjerh.com
Lkhysayte.com
Sadangez.com
Evdoilsdus.com
Hhsdgbes.com
Jkhasels.com
Sfahdasjw.com
Maniyakat.cn
Kljdskrza.com
Kipyatok.cn
Head-moron.cn
Youaskedthedomain.cn
Asdagj.com
Banubanasy.cn
Love2coffe.cn
Sadahesz.com
Rebornendkit.cn
Qsfgyee.com
Sakjgeyq.com
Tottaldomain.cn
Salkjyhx.com
Pogodanet.cn
Vipsocks.cn
Mdsget1.com
Opudsjh.com
Sdasfj6.com
Kjast3z.com
Lkfjfuisdh.com
Safniiyew.com
Mjsgsawz.com
Jkhteqa.com
About-joga.ru
Icq4all.net
Bravqwer.com
Ajhsfget.com
Ajytse5.com
Dkeh38oz.com
Fd1a234sa.com
Ilui45iu7.com
Jhrez76.com
Kjdst6ey.com
Lasur8e.com
Sfah3sz.com
Sjb653xz.com
Sadkajt357.com
Fuchroot.com
Gagainco.com
Mcd0nalds.com
B00tlife.com
Dlkasfgatker.com
Klitar.cn
Breenders.com
Directbinary.com
Gasredbox.com
Kaljv63s.com
Kdy7rsxa.com
Lovinezer.com
Mdmasege.com
Rmbtoor.com
Safe3etfejwqf.com
Wdggtwegww.com
S0cksps.com
87jonsonfd.com
Gosrmecalonl16.com
Gosrmecalonl20.com
Gosrmecalonl21.com
Gosrmecalonl3.com
Gosrmecalonl30.com
Gosrmecalonl4.com
Gosrmecalonl5.com
Gosrmecalonl8.com
Gosrmecalonl9.com
Gosrmecalodnl38.com
Gosrmedicalonl13.com
Gosrmedicalonl14.com
Gosrmedicalonl2.com
Gosrmedicalonl20.com
Gosrmedicalonl1.com
Gosrmedicalonl10.com
Gosrmedicalonl11.com
Gosrmedicalonl16.com
Gosrmedicalonl17.com
Gosrmedicalonl19.com
Gosrmedicalonl3.com
Gosrmedicalonl5.com
Gosrmedicalonl6.com
Gosrmedicalonl7.com
Gosrmedicalonl9.com
Gosrmedicalonl18.com
Sweethost.org
Twowildgirls.net
Profithobby.net
Antiviractive.com
Antivirback.com
Antispysp.com
Webantispy.com
Antispymv.com
Antispynew.com
Antispybox.com
Antispyutil.com
Avmirror.com
Antispymega.com
Cyber-deployment.com

"Toyton Ltd" / todayisp.com / dboxs.org scam

We've seen this scam before, an alleged Chinese registrar claims that someone is buying a domain name similar to the one that you want in an attempt to scare you into buying overpriced domains that you do not need.

From: owen@dboxs.org
To: help@[domain name redacted]
Date: 30 July 2010 06:16
subject: [domain name redacted]

Dear [domain name redacted] team,

Our organization received a formal application from a company who is called Toyton Ltd are applying to register "[domain name redacted]" as their domain name and Internet keyword. In order to prevent cyber piracy,Please explain:

1: Whether this company is your IT supplier or distributor.

2: Whether you are interested in registering these domains first to preservation your company’s brand. (.cn .com.cn .net .asia .eu and keyword etc…)

We are now obligated to inform you this issue ,So we will handle the next step after this audit procedure. Pls understand.

Best regards       
Owen
Mww Group
Internet: www.todayisp.com
Internet: www.dboxs.org 
Email: Owen@dboxs.org

Confidentiality Statement:
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not an intended recipient, any disclosure, copying, distribution, or other action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this message in error please be advised of your obligation to immediately notify sender of the error in transmission, and to destroy all associated documentation.

I always love confidentiality statements on spam!

Both domains are Chinese registered and are hosted in Hong Kong. The email comes from a Chinese IP address.

Registrars are not responsible for checking trademarks. If they were then domains registration would take days and cost a fortune.This is simply an attempt to rip you off.

freead.name / mybar.us / toolbarcom.org / adsnet.biz

A slightly novel attack, found injected into a Javascript library and using freshly-registered domains. The attack uses obfuscated Javascript to send visitors to one of the following domains: myads.name, adsnet.biz, toolbarcom.org, mybar.us, freead.name, and to the front of this is appended a subdomain of vagi., vain., vale., vars., vary., vasa., vaut., vavs., viny., viol., vrow., vugs., vuln.

Despite all the combinations (a list is at the bottom of the post if you want to paste it in somewhere), there are only a small number of IP addresses involved:

66.221.212.92
66.221.212.94
66.221.212.96
66.221.212.98
66.221.212.99
69.13.73.203
69.13.73.205
69.13.73.248
69.13.73.250
69.13.154.250
69.13.154.251

All of those IPs belong to C I Host, some seem to have legitimate sites hosted on them.

One one domain (mybar.us) is not anonymised:

Registrar URL (registration services):       www.publicdomainregistry.com
Domain Status:                               clientTransferProhibited
Registrant ID:                               DI_11638984
Registrant Name:                             Andrew Black
Registrant Organization:                     N/A
Registrant Address1:                         555 Taylor Rd.
Registrant City:                             Enfield
Registrant State/Province:                   Connecticut
Registrant Postal Code:                      06082
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +860.7492291
Registrant Email:                            dday.rabbit@gmail.com
Registrant Application Purpose:              P1
Registrant Nexus Category:                   C11

Although the address and phone number are no doubt fake, the email address of dday.rabbit@gmail.com is known.

The next hop uses a subdomain of a legitimate domain registered at GoDaddy that appears to have been phished: out.outdoorkitchendistributors.com - this site is hosted on 94.75.243.31.. it's just worth pausing to note that the legitimate domain specchart.com also appears to have been hijacked via a GoDaddy phish and moved to this server.

The endpoint is a Java exploit on a server at 79.135.152.194 belonging to microlines.lv (AS2588 / 79.135.128.0/19) which appears to be a pretty evil network. How the hell they got a /19 is a mystery when I can't see any verifiably legitimate sites.

If you want to block the intermediate domains, they are:
vagi.adsnet.biz
vain.adsnet.biz
vale.adsnet.biz
vars.adsnet.biz
vary.adsnet.biz
vasa.adsnet.biz
vaut.adsnet.biz
vavs.adsnet.biz
viny.adsnet.biz
viol.adsnet.biz
vrow.adsnet.biz
vugs.adsnet.biz
vuln.adsnet.biz
vagi.toolbarcom.org
vain.toolbarcom.org
vale.toolbarcom.org
vars.toolbarcom.org
vary.toolbarcom.org
vasa.toolbarcom.org
vaut.toolbarcom.org
vavs.toolbarcom.org
viny.toolbarcom.org
viol.toolbarcom.org
vrow.toolbarcom.org
vugs.toolbarcom.org
vuln.toolbarcom.org
vagi.mybar.us
vain.mybar.us
vale.mybar.us
vars.mybar.us
vary.mybar.us
vasa.mybar.us
vaut.mybar.us
vavs.mybar.us
viny.mybar.us
viol.mybar.us
vrow.mybar.us
vugs.mybar.us
vuln.mybar.us
vagi.freead.name
vain.freead.name
vale.freead.name
vars.freead.name
vary.freead.name
vasa.freead.name
vaut.freead.name
vavs.freead.name
viny.freead.name
viol.freead.name
vrow.freead.name
vugs.freead.name
vuln.freead.name

Phishing domains on M247 Ltd

I've never heard of M247 Ltd before today until their network came up as providing infrastructure for this scam. A few IPs over from that server is another one at 89.238.165.197 which contains three phishing sites:

Ibloqin.com
Lloydststb-offshore.com  
Nbtibank.com

The sites are currently only displaying "Suspended" if you visit them.. this means nothing though, and it's a fairly common scammer technique to disguise that the site is active. Avoid.

Update: apparently these have now been nuked from orbit.

"eurjobs.org" fake job offer

There are a lot of these going on at the moment, this is another fake job offer trying to rope unsuspecting applicants into doing something illegal.

Date: 29 July 2010 08:23
Subject: Representatives Wanted
   
Civilities


I am a manager of the HR department of a large multinational company. Our company covers a wide range of businesses:
- supporting business in Europe and other countries
– bank accounts opening and maintenance
– private undertaking services
– etc.

There are vacant positions of regional managers in Europe:
- salary 2.400 dollars + bonus
- 1-2 working hours per day
- flextime


If our offer is interesting for you send us the below information on our e-mail address:
h r @ e u r j o b s . o r g [please delete spaces before sending]
Full name:
Country:
E-mail:
Mobile phone-number:



Attention! We need European residents only.

Please provide you name and contact information in order we can find you for further communication.

The domain is currently not resolving, and is registered to a fake address in the WHOIS details. Perhaps of some interest are the two nameservers for the domain:

ns1.usaportall.com [89.238.165.212 - M247 Ltd, Manchester, UK]
ns2.usaportall.com [191.184.23.131 - Apparently invalid IP allocated to LACNIC]

The no doubt fake registrant details are:

      Kacie Cheverton
      105 FOREST DR
      CATONSVILLE, MD 21228
      US
      Phone: +1.4105668199
      Email: roller@consultant.com

Anyway, beware of unsolicited job offers from people you don't know and can't verify, unless you like prison food.

"west-epec.com" fake job offer

This is some sort of money laundering or parcel reshipping scam. The domains west-epec.com was registered just yesterday but it appears not to be resolving properly.

Date: 28 July 2010 13:36
Subject: vacancy #876

I am writing to you in the name of the corporation the Human Resources department of which I represent.

Our enterprise has a lot of different lines of business.
-real property
-business support
-company dissolution
-private firm service
-etc

There is a vacancy of a Regional manager in Europe:
-compansation package 2.300 euro +bonus
-taskwork

- 'open-leave' schedule


If you have an intention to cooperate with our company, please send your contact information on our e-mail: Darla@west-epec.com
First Name:
Country of living
City
mail address:
Contact telephone number

Remark! Applicants with the permission to work in Europe!

Please let us know you contact information.
Our manager will contact you to provide answers for the questions you are interested at and invite you for brief interview.

The WHOIS details are probably fake, but consistent with a large number of other fake job websites.

    Aleksandr Lapatau
    Email: lapatasker@earthling.net
    Organization: Private person
    Address: Lenina, 34, 8
    City: Minsk
    State: Minskaya
    ZIP: 456123
    Country: BY
    Phone: +375.172427204 

A Google search for that email address shows lots of similar sites. Avoid.

LAPO LOAN COMPANY LIMITED

Scams evolve in much the same way as plant or animal life. Unsuccessful scams become extinct, very successful ones tend to explode in numbers to the point of over population. In between are a number of scams that inhabit ecological niches where there is just enough return to make them worthwhile.

From: LAPO LOAN COMPANY LIMITED. <lapo.loancompany1@gmail.com>
Reply-To: lapo.loancompany1@gmail.com
Date: 28 July 2010 04:07
subject: (Loan Transfet Updated)

Do you need a loan to pay off your bills and clear off your debt? Do you
have an urgent loan or a business loan? You are refused a loan from your
bank or any financial firm? Do you need a loan to pay off your bills or
buying a house? Do you need a loan to start a business? Get anaffordable
loan at a low interest rate of 3%, contact us at:
lapo.loancompany1@gmail.com

Your Name:
Loan Amount:
Loan Duration:
Your phone number
E-mail: lapo.loancompany1@gmail.com

Obviously it's dodgy.. how many loan companies use a free Gmail address? Digging deeper shows that this originates from 41.217.220.212 (mail.zimele.net) in Kenya. What you can't tell is that the email address has been harvested from a data breach (either accidental or deliberate) at 0catch.com.

Now, most novice users won't know how to inspect mail headers or be able to trace back where the email address came from, but the Gmail thing is a huge red flag. But honestly, the whole pitch is frankly sloppy, badly spelled and unbelievable.. but the thing is that people must fall for this scam (presumably an Advanced Fee Fraud or identity theft gig) from time-to-time, else the scammers wouldn't persevere with it.

Evil network: Najada Ltd, AS49544 (91.216.122.0/24)

This story from Brian Krebs caught my eye, a quick bit of background digging on check-crypt.com revealed a whole new Evil Network in Moldova called Najada Ltd on AS49544 (91.216.122.0/24). The IP address range of 91.216.122.0 - 91.216.122.255 appears to have no legitimate sites at all, featuring fake businesses (including a bunch supposed to be in Finland), illegal downloads and sites with variants of the name Google in them which is never a good sign.

The best thing to do is block traffic to this IP range and/or the domains listed below. Note also that sending abuse reports to abuse@mdhoster.net (who manage the netblock) will possibly be counter productive, so don't bother.

Alliedaeon.com
Softglspace.com
Softglspace.in
A-lot-of-appz.com
Activation-codes.net
Any-filez.net
Arttalksbackblog.com
Blastmovie.net
Check-4-apps.org
Crack-file.net
Crack-serial-numbers.net
Crack-usa.com
Crackandcrack.com
Crackcrack.net
Crackcrackcrack.net
Crackdelivery.net
Crackdownload.net
Crackkeys.net
Crackorginal.net
Crackpatch.net
Crackpatchkeygen.net
Crackprokeygen.net
Crackrapidshare.net
Cracks-explorer.net
Crackserialcode.net
Crackserialkey.net
Crackserialkeygens.net
Crackserialkeys.net
Crackserialnumber.net
Crackserialnumbers.net
Crackshare.net
Cracktrial.net
Crackwin.net
Dlfeed.com
Downloadcracks.net
Etanfilm.com
Fastcrack.net
Fileserialkey.net
Freecrackdownload.net
Freekeygencrack.net
Freeserialkey.net
Fullcrackserial.net
Fullkeygen.net
Fullserialcrack.net
Fullserialnumber.net
Fullserialnumbers.net
Getserial.net
Keygen-crack.net
Keygen-serial.net
Keygenc.net
Keygencrackpatch.net
Keygenerators.net
Keygenforserial.net
Keygenkeygen.net
Keygenned.com
Keygenpatch.net
Keygens-for-soft.org
Keygenserialcrack.net
Keygenserialnumber.net
Keygenserials.net
Keygensite.net
Keygentrial.net
Keygenwin.net
Killtrial.net
Licensekeygen.net
Maximumwarez.com
Microposters.org
Newserialcracks.net
Orginalcrack.net
Patchcrack.net
Registrationcode.net
Registrationkey.net
Registrationkeys.net
Seialkeymaker.net
Serial-codes.net
Serial-crack.net
Serial-key-generator.net
Serial-keygen.net
Serial-keygens.net
Serial-keys.net
Serial-numbers-crack.net
Serialcodesfor.net
Serialcrackcodes.net
Serialcrackkeygen.net
Serialkeycrack.net
Serialkeygencracks.net
Serialkeygenerator.net
Serialkeygenpro.net
Serialkeygens.net
Serialkeynumber.net
Serialkeynumbers.net
Serialnumbercode.net
Serialnumbercrack.net
Serialnumberfor.net
Serialnumberscrack.net
Serialpost.net
Serialserial.net
Shared-fro-you.com
Shared-news.net
Soft-dont-stop.org
Softwareserialnumbers.net
Thecrackserial.net
Trusted-warez.com
Vipcrack.net
Warezpad.net
Wincracks.net
Gegooglee.com
Geogooglefree.com
Googlemaps2.name
Googlemaps3.com
Googlemaps3.net
Seotraffbuss.com
Tracerouteonmap.net
Holopainen-oy.com
Heikkinen-oy.com
Kinnunen-oy.com
Vuorinen-oy.com
Amsterdam-news.org
Onrpg-tds.com
Topsecuritydirect.com
Trinnitti-soft.org
Adwaresoft.org
Citi-online.com
Fesrhyti.com
Lolopingtroll.org
Mxa-host.net
Pussyteenslove.com
Sarahankethere.net
Sexyteentits.info
Shalalopdns.com
Torrentonline.net
Frakinutip.com
Iloverabbits.info
Pezdeshnosti.net
Kansainvalisista.com
Menestys-maksut.com
Finski-pm.com
Estreli-oy.com
Kerava-oy.com
Kaupunki-oy.com
Kuhmo-oy.com
Llogoso.org
Successbizz.org
3423254353446.org
Google-analytice.com
Vk-ont.com
Allvair.org
Ouslier.com
Translate-googlecachecontent.com
Tsbd1984.com
Securitybankingsite.com
Thesecuritybanking.com
Temetoelchile.com
Trolasucia.biz
Global-cache.org
Keygen.in
Keygen.name
Seriall.com
Serialsam.com
Wgetsoft.net
Check-crypt.com
Check-domain.cn
Start-domain.cn
Safe-monitoring-3.in
Mdhoster.net
Routedating.com
Photois.org
Myphotogl.org
Big-moneysystemsell.org
Ad-freepice.org
Club-horse.org
Googlestat.org
Adobe-shockwave.com
Dezdemon.com
Mmsfree.ru
Spy-gsm.ru
Spy4mobile.ru
Spyvk.ru
Statisstics.net
Watchfree.ru
Your-gsm.ru
Gumile.in
Calumbiasoft.biz
Ccsline.net
Financeprogramm.com
Gooble-analytics.com
Hottestchinesebabes.com
Statservice.org
Whitehorce.com
Gorgrengos.com
Mazolfura.com
Zinymenoak.com
Amporno.ru
Vkstyle.net

"Paul Badji: Treat As Urgent" email

Paul Badji is a real diplomat at the UN, this email is NOT from Paul Badji. The UN's name has been used this way before, notably with Ban Ki-moon's name attached. This email is probably the usual Advance Fee Fraud approach, using a couple of links to reputable websites to try to make it look more authentic. Avoid.

Unusually for what appears to be an African scam, the originating IP is 89.39.24.2 in Romania.

From: PAUL BADJI <africacomittee@yahoo.gr>
Reply-To: paulbadji_africaunionworld2@yahoo.com.hk
Date: 24 July 2010 04:18
Subject: Treat As Urgent
   

Greeting to you, I am Mr. Paul Badji Chairman on human right Exercise  Committee (CHREC ) on the Inalienable Rights of the People a member of Africa Union Committee and Special Adviser to Mr. President. Sir, your file appears in my office four days ago Through FMS  Headquarter. that you are the beneficiary  to receive payment of fifteen million British pound on behalf of Late Mrs.Veronica Daniela from Ukraine, Europe, Former Managing Director of Mobile oil and Gas Company Nigeria Ltd. who died in plan crash on Sunday, Oct  22nd, 2005 .

when a Bellview Airline Boeing 737 crashed in the countryside shortly after takeoff from the commercial capital Lagos, 117 people died  .therefore the  Bellview Airline's  management and Mobile oil and Gas Company Nigeria Ltd, has deposited   fifteen million British pound at First Bank Nigeria Plc on behalf of Late Mrs.Veronica Daniela, Signed  approved by secretary of state on Friday 16 2nd July 2010, please confirm the accident  picture to find the true of these site click here: http://www.1001crash.com/index-page-description-accident-Bellview_B737-lg-2-crash-6.html

there for you are to receive this fund in your name as the next of kin which appear in the file, This is to notify you that  the Two companies  have agreed to pay fifteen million British pound to  you  in your name on behalf of Late Mrs.Veronica and to change the decease name to your name. This is regarding the draws organized lately to help individuals whom have lost their earnings in this act.  on Sunday, Oct  22nd, 2005 . . And to build true organizations so as to help the less privileged in the society. you are therefore advised to contact Correspondent paying Bank, First Bank Foreign Remittance Department Chief Director Operations & Services. Requirement is requested by your full Name including your home address, country. And your private telephone number to confirm the file here and to release the fund to you. For more information you are to contact  via Email below.

Thank you and God bless
Mr. Paul Badji
Special Adviser to Mr. President
Chairman, Committee on the Exercise
of the Inalienable Rights of the People.
Africa Union Committee (AU)
N:B website
Contact Email: badjipaul@rocketmail.com
http://www.africa-union.org/root/au/index/index.htm

Sophos has a fix for .LNK flaw

Install this, if you don't know why you should, then watch this video first.. then install it.

Welcome to "Joomla!" email links to malware

A variant on this malware-laden email, this particular approach pretends to be from Joomla and even goes as far as to fake some of the headers to avoid detection.

From: no_reply_forum@joomla.org [mailto:no_reply_forum@joomla.org]
Sent: 26 July 2010 15:57
Subject: Welcome to "Joomla!"

Welcome to Joomla! forums

Please keep this e-mail for your records. Your account information is as
follows:

----------------------------
Username: haymixer

Board URL: http://cambridge-narrows.ca/
----------------------------

Please visit the following link in order to activate your account:

http://cambridge-narrows.ca/

Your password has been securely stored in our database and cannot be
retrieved. In the event that it is forgotten, you will be able to reset it
using the email address associated with your account.

Thank you for registering.

--
Thanks,
Joomla! Community Forum

cambridge-narrows.ca has been compromised and attempts to load malware from cambridge-narrows.ca/adobe_flash_install.exe

The infected page then also tries to load from thewatches-discount.com:8080/index.php?pid=10 and thecoca-colacompany.com/images/noflash_singlevideo.gif (yes, it really is The Coca-Cola Company).

thewatches-discount.com is multihomed on:
Addresses:  84.16.230.27 [Netdirekt, Germany], 87.106.179.206 [1&1, Germany], 91.121.162.65 [OVH, France], 94.23.224.221 [OVH, France] and 62.212.132.226 [Xenosite, Netherlands]. This gives us a whole batch of dodgy looking sites worth blocking:

84.16.230.27
Applecorn.com
Areadrum.com
Bittag.ru
Blackpr.biz
Bookdisk.ru
Boozelight.ru
Busyspade.com
Chertenok.name
Galneed.ru
Galslime.com
Gigasofa.com
Hillchart.com
Horsedoctor.ru
Jarpub.ru
Lockerz-invite.ru
Marketholiday.ru
Oilrule.ru
Pressurespa.ru
Problemdollars.ru
Raceobject.ru
Roundstorm.com
Sadute.com
Sheepbody.com
Spacememory.ru
Tanspice.com
Tanyear.com
Technaxx.pl
Technaxx.ru
Thecheapviagra.com
Themysite.net
Theviagrapills.com
Tightsales.com
Validplan.com
Waxyblock.com
Yaktrack.ru

87.106.179.206
Ballanteam.com
Splatspa.com
Valbou.com

91.121.162.65
Aionitalian.net
Aionitalian.org
Ashsoftware.ru
Bakedship.ru
Hugejar.com
Inktime.ru
Momhand.ru
Politicalpoets.ru
Taxshelf.ru
Yoursoap.ru
Ashdog.ru
Cornerrat.ru
Mondayring.ru
Relaxedgrape.ru
Warydrunk.ru

62.212.132.226
Bail.nl
Bigeventsbooker.nl
Bouwinkopen.nl
Buyviagraworld.com
Cafemack.com
Cvens.nl
Dateforbusiness.nl
Dealyak.ru
Dekroonvanemmeloord.nl
Diamonddoctor.ru
Directorschaircompany.com
Drunkjeans.com
Earlymale.com
Eventdirectory.nl
Famerule.ru
Familywater.ru
Flevoland-weddingevent.nl
Forum4events.com
Forum4events.nl
Hollandgaatuit.com
Kroonvanemmeloord.nl
Lasteye.com
Liplead.ru
Manamina.nl
Nibourgproductions.nl
Outerrush.com
Prominent-vastgoed.nl
Realgg.nl
Sexysushi.nl
Silencepill.ru
Silencewindow.ru
Sisterqueen.ru
Slaveday.ru
Superjoke.nl
Tintie.ru
Tipbear.ru
Treecorn.ru
Urkinwintersferen.nl
Urkopdeplanken.nl
Vandijk-ict.eu
Zooneed.ru

The other sites on 94.23.224.221 seem to be legitimate.

Sunbelt has a write-up of the last attack with some analysis here.

"Thank you for registering with ImageShack." mail leads to virus

A fairly crude attempt to get clickthroughs to a virus infected site:

From: ImageShack Registration <noreply@yfrog.com>
Date: 23 July 2010 15:46
Subject: Thank you for registering with ImageShack.
   
---------------------------------------------------
Thank you for registering with ImageShack.
---------------------------------------------------

Your username: confidingjc
Your password: 09088066
Your registration link: http://financial-independence.co.za/

Please read this email carefully, it contains important information about your ImageShack account.

Please do not reply to this email, this mailbox is not checked. To report problems use support section of the web site.

---------------------------------------------------
HOW DO I LOGIN?
---------------------------------------------------

Click the 'Login' button located at the top of ImageShack pages in order to login.
Type here your username and password located in this email.

Once you are logged in, you will be presented with your Image Panel.


---------------------------------------------------
HOW CAN I CHANGE MY PASSWORD?
---------------------------------------------------

If you want to change your password, use the following link:
http://financial-independence.co.za/
If you have forgot your password, use the following link:
http://financial-independence.co.za/

---------------------------------------------------
HOMEPAGE
---------------------------------------------------

Your friends can access your public images and slideshows at http://financial-independence.co.za/

---------------------------------------------------
COMMON QUESTIONS
---------------------------------------------------
Answers to common questions: http://financial-independence.co.za/

Sincerely,
The ImageShack Team

financial-independence.co.za might well be a hijacked site, it's hard to tell who owns it as the .CO.ZA WHOIS server isn't working. The site is hosted at 207.45.186.34 [Acenet Inc, Michigan]

This leads to a fake Adobe Flash installed (adobe_flash_install.exe) and an exploit site on diamonddoctor.ru:8080 which does some other nasties. diamonddoctor.ru has minimal WHOIS details:

domain:     DIAMONDDOCTOR.RU
nserver:    ns1.dnsofthost.com.
nserver:    ns2.dnsofthost.com.
nserver:    ns3.dnsofthost.com.
nserver:    ns4.dnsofthost.com.
state:      REGISTERED, DELEGATED, VERIFIED
person:     Private Person
phone:      +7 495 7284001
e-mail:     hop@fastermail.ru
registrar:  NAUNET-REG-RIPN
created:    2010.07.13
paid-till:  2011.07.13
source:     TCI

It's no real suprise to see that it is hosted by Netdirekt on  84.16.230.27, along with these other sites which are good candidates to block:

Blackpr.biz
Chertenok.name
Lockerz-invite.ru
Nemerova.name
Technaxx.pl
Technaxx.ru
Tequieroputa.net
Themysite.net

Of note is that again we're seeing support services going through the dnsofthost.com domain that seems to be only used by the bad guys.

Administrator:
  Dmitriy Ilin depot@infotorrent.ru +7.8127047272
  Dmitriy Ilin
  Yuriya Gagarina pr-kt d.24-1 lit.A
  Sankt-Peterburg,Sankt-Peterburg,RUSSIAN FEDERATION 196211

infotorrent.ru seems to be pretty common to this kind of malware attack.

Anyway, a quick fix for corporate administrators is to block messages with "Thank you for registering with ImageShack." for the time being.

Added: forsight.com.au is also a domain being used in the attack, looks to be another hijacked legitimate domain.

Romance Scams

A couple of interesting news stories recently illustrate the dangers of "Romance Scams" or Dating Scams which illustrate the dangers involved. In one, a woman called Brenda Parke details how she was ripped off  by a fraudster to the tune on £57,000.. and kudos to her for having the courage to come forward and shine a light on this activity.

But this isn't the only case, a recent BBC Crimewatch film reveals more about this operation, leading to a successful capture of a romance fraudster in Ghana. In this case the victim had sent £45,000 already and was about to send a staggering £120,000 before the police intervened.

Although most of the dating scam spam I see is Russian in origin, it is also a major criminal activity in Ghana in particular.

"TOYOTA CAR LOTTERY" scam

A ridiculously long and horribly written scam email about winning a Toyota, email relayed through 60.251.190.235 in Taiwan, but apparently soliciting replies to an email address in Hong Kong while claiming to be based in Thailand. It is (of course) some sort of Advanced Fee Fraud. Incidentally, the +(66)896734792 telephone number is Thailand and is well known for being connected with scams.

From: MR.PAUL WILTON <info@yahoo.com>
Reply-To: organizelottoint39l@yahoo.com.hk
Date: 23 July 2010 10:18
subject: TOYOTA CAR LOTTERY
   
Toyota Car Lottery International Promotions Thailand,
Customer Service Department
Toyota Motor Corporations, Thailand.
92/48 Sathon Nua Rd.
Fl 17 Sathorn Thani 2 Bldg Silom,
Bang Rak,Silom, Bangkok 10500,
Thailand.


                                             TOYOTA  MOTORS CORPORATION INTERNATIONAL
                                             PRIZE NOTIFICATION 2010 NEW CARS PROMOTION

We are pleased to inform you of the result of the just concluded annual final draws held on the IST OF January,2010  by Toyota Motor Company in conjunction with the Japan International Email Lottery Worldwide Promotion,your email address was among the 20 Lucky winners who won US$1,000,000.00 each on the Toyota Motors Company Email Promotion programme dated as stated above.This is from the total price of $20 million United State Dollars ($20,000,000.00usd)shared among the 20 lucky winners,you are therefore approved for a lump payment of US$1,000,000.00 Dollars,in cash ,including a Toyota car which is the winning present /amount for the Second category winners.

However the results were released and declared on the 5TH OF MAY 2010, and your email address attached to ticket number 4500542188(TMPWAYZ20051), with serial number  454-17 drew the lucky number 3,8,13,22, 5, 0,27,41 and bonus number 12,your Reference Number:FLS433/453L/GMSA. The online draws was conducted by a random selection of email addresses from an exclusive list of 35,031 E-mail addresses of individuals and corporate bodies picked by an advanced automated random computer search from the internet. However, no tickets were sold but all email addresses were assigned to different ticket numbers for representation and privacy to make sure the money reaches you.

The selection process was carried out through random selection in our computerized email selection machine (TOPAZ) from a database of over 250,000 email addresses drawn from all the continents of the world. This Email Lottery Promotion is approved by the Japanese Gaming Board and also Licensed by the The International Association of Gaming Regulators (IAGR).This lottery is the 3rd of its kind and we intend to sensitize the general public about toyota motors 2010 new cars(Toyota motors 2010 latest cars).As indicated by the computerized selection machine,your lucky winning number falls within our Asia booklet representative office here in THE KINGDOM OF THAILAND as showed in the coupon.

For security reasons, you are advised to keep your winning information confidential and private until your claim is processed and your money remitted to you in whatever manner you deem fit to claim the prize money and the toyota car your winning present.This is part of our precautionary and security measure to avoid double claiming and unwarranted abuse of this program.In other to claim your US$1,000,000.00 winning prize,which has been deposited with THE MANAGEMENT AND BOARD OF UNITED TRUST BANK BANGKOK BRANCH THAILAND, Remember to indicate your reference Number (FLS433/453L/GMSA) to make sure the  winning  prize US$1,000,000.00 and the Toyota car reaches you intact and complete.

The toyota car shipping documents will be forwarded to you to claim ( A toyota car which is the winning present  for second category winners) in any port of your choice,once your winning amount US$1,000,000.00 processed and transfer to you.
However,you are required to fill the form below,together with the name of the port where your winning present a toyota car should be ship to and send it to the online promotion manager of THE TOYOTA MOTOR CORPORATION for verification and then you will be directed to the paying bank above for immediate process and approval of your winning fund and shipping of your (TOYOTA CAR) where the sum of US$1,000,000.00 has already been deposited in your favor under your email address.

FILL THE FORM BELOW;
NAME:.....................................
AGE:........................................
SEX:........................................
ADDRESS:(RESIDENT ADDRESS ONLY)...............................
YOUR OTHER EMAIL:....................................
PHONE:...................................
OCCUPATION:.........................
AMOUNT WON........................
COUNTRY:...............................
NAME AND ADDRESS OF THE PORT FOR SHIPMENT OF YOUR WINNING CAR ......................
SHORT COMMENT ON OUR PRODUCTS .............................................

Please you are adviced to complete the form and send it immediately to our Promotion manager through email for prompt collection of your fund
(CONTACT PROMOTION MANAGER)
TOYOTA MOTORS FOREIGN SERVICES MANAGER
NAME: Dr. Wong Lee
TELEPHONE: +(66)896734792
EMAIL:organizelottoint39l@yahoo.com.hk

WARNING !!

You are to keep all the winning information away from the general public especially your ticket number and ballot number.(this is important as a case of double claiming will not be entertained) Staff of Toyota Motor Company and the Japanese International Lottery Company are not to partake in this Lottery. Accept my hearty congratulations once again! for being selected among the 20 lucky winners .

Yours faithfully,
MR.PAUL WILTON
(V.P FINANCE)
TOYOTA MOTORS CORPORATION LTD.
www.Toyota.co.th

amanda.lee@blackberry.co.za is not offering a free BlackBerry

A variation on this hoax email analysed at Hoax-Slayer indicates that someone has a grudge against Research in Motion (who make the BlackBerry range of smartphones) in South Africa.

There's a watermarked image stolen from Mobile Gazette to go with it (who are nothing to do with the hoax).. now with a blurry couple of photos from people claiming that they have their free BlackBerry.

This is just a hoax.. nobody is going to send you a €400 smartphone (about 3800 rand) for forwarding a few emails. It probably just exists to harass the company or whoever "Amanda Lee" might be. Don't forward it.

Dear All,
 
Blackberry is giving away  free phones as part of their promotional drive.
 
All you need to do is send a copy of this email to 8 people; and you will receive your phone in less than 24 hrs.
Please note that if you send to more than 20 people you will receive two phones.
 
 
Please do not forget to send a copy to: amanda.lee@blackberry.co.za 
 
With Regards,
 
Amanda Lee (Marketing Manager)
Office Number: 0117838512 

Someone has added to the email:

Hi guys,

This is real we got our phones today , the previous email, had the incorrect email address, should be @blackberry.co.za, and not @blackberry.com

And there are a couple of pictures no doubt ripped from the web:

My best advice is that if you get one, tell the sender that it is a hoax and point them to this post or Hoax-Slayer.