[Via]
Sponsored by..
Thursday, 3 May 2012
Samsung Galaxy S III
[Via]
Facebook spam / chicleart.net
Date: Thu, 3 May 2012 11:57:48 -0300
From: "Facebook" [noreply@facebookmail.com]
Subject: Most recent events on Facebook
Hi xxxxxxxxxx,
You have blocked your Facebook account. You can reactivate your account whenever you wish by logging into Facebook using your old login email address and password. Subsequently you will be able to use the site as before.
Thanks and regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
==================
Date: Thu, 3 May 2012 15:53:38 +0100
From: "Facebook" [noreply@facebookmail.com]
Subject: New comment on your status update
Hi xxxxxxxxxx,
You have blocked your Facebook account. You can resume your account at any time by logging into Facebook with your old login email address and password. You will then be able to use the site as before.
Thanks and regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
==================
Date: Thu, 3 May 2012 14:09:11 +0000
From: "Facebook" [alert@facebookmail.com]
Subject: New comment on your status update
Hi xxxxxxxxxx,
You have deactivated your Facebook account. You can reactivate your account whenever you wish by logging into Facebook using your old login email address and password. Subsequently you will be able to use the site in the same way as before.
Best regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
The malicious payload is on chicleart.net/main.php?page=8decfe38488713cc on 37.59.68.23 hosted by OVH in the UK.
tsnet-china.com / "Klver Industrial Co. Ltd" domain scam.
From: jeff jeff@tsnet-china.com
To:
Date: 3 May 2012 10:02
Subject: Regarding " dynamoo " Dispute
(If you are not in charge of this please transfer this email to your President or appropriate person, thanks)
Dear President,
We are the department of Asian Domain registration service in china, have something to confirm with you. We formally received an application on May 2, 2012. One company which self-styled "Klver Industrial Co. Ltd" were applying to register "dynamoo" as Network Brand and following domain names:
dynamoo.asia
dynamoo.cn
dynamoo.com.cn
dynamoo.com.tw
dynamoo.hk
dynamoo.in
dynamoo.net.cn
dynamoo.org.cn
dynamoo.tw
After our initial checking, we found the name were similar to your company's, so we need to check with you whether your company has authorized that company to register these names. If you authorized this, we will finish the registration at once. If you did not authorize, please let us know within 7 workdays, so that we will handle this issue better. Out of the time limit we will unconditionally finish the registration for "Klver Industrial Co. Ltd".
Best Regards,
Jeff Yang
Registration Dept.
Tel: +862885915586 || Fax: +862885912116
Address:8/F XiYu building No,52 JinDun Road,QingYang District,Chengdu City,China.
The idea here is to panic the domain owner into registering a bunch of worthless domains. Do I really care if someone registers a bunch of Asian domain names (sub of which are on really crappy second level domains)? No, I don't. And neither should you.
Here's the thing: domain registrars for common domains* like this DO NOT carry out these checks. It isn't their responsibility. In reality, they will NOT contact you prior to registration. There is almost definitely no company interested in buying these domains. And remember, there are hundreds of top-level domains.. you could spend a LOT of money securing worthless variations for no reason.
Give this one a wide berth. If you really do want to find a registrar for additional domains, shop around to find a reliable and inexpensive registrar rather than dealing with spammers.
* some "sunrise" registrations for new top-level domains do check trademark ownership when they are launched.
Tuesday, 1 May 2012
Isn't it amazing..
Sometimes people make those connections that you should have seen your case. In this case, the post managed to link together several strands of my own blog that I hadn't managed to do myself.. namely: Inter Financial Ltd, Gary NcNeish and Piradius.net
It looks like Mr McNeish might have his fingers in quite a few spam pies..
"Invitation FACEBOOK" hoax
Subject: Fwd: FW: PLEASE CIRCULATE
PLEASE CIRCULATE THIS NOTICE TO FRIENDS AND FAMILY ON YOUR CONTACT LIST
In the coming days, you should be aware…
Do not open any message with an attachment called:
"Invitation FACEBOOK"
Regardless of who sent it
It is a virus that opens an Olympic torch and burns the whole hard
disc C of your computer
This virus will be received from someone you have in your address book
That's why you should send this message to all your contacts. It is
better to receive this email 25 times than to receive the virus and
open it
If you receive email called: "Invitation FACEBOOK", though sent by a friend,
do not open but delete it immediately
CNN said it is a new virus discovered recently and that has been
classified by Microsoft as the most destructive virus ever
It is a Trojan Horse that asks you to install an adobe flash plug-in.
Once you install it, it's all over. And there is no repair yet for
this kind of virus. This virus simply destroys the Zero Sector of the
Hard Disc, where the vital information of their function is saved
THE INFORMATION HAS BEEN CHECKED WITH SNOPES
http://www.snopes.com/computer/virus/youtube.asp
DO exercise caution with emails that appear to be from Facebook, PayPal, LinkedIn or any one of a variety of services.. you can usually check the true destination of a link in an email by floating the pointer over it. DON'T circulate silly hoaxes like this because it simply wastes everybody's time.
PayPal Spam / 72.46.140.14
Date: Tue, 1 May 2012 14:31:26 +0300
From: "PayPal" [notify@paypal.com]
Subject: RE:You just sent a payment to Enrique Peterson
You just sent a payment
Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Enrique Peterson
wcEnrique22@hotmail.com
Note to Thad Peterson
You haven't sent a note.
Shipping address - confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total $140.00 USD
Payment $60.00 USD
Payment sent to Enrique Peterson
Help Centre | Resolution Centre | Security Centre
This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal Email ID PP1526
The malicious payload is on 72.46.140.14/showthread.php?t=9d77a9163cda8dbe (report here) and is hosted by Versaweb in the US, suballocated to "Silver Knight Enterprises Corp" of Las Vegas.
Update: here is another variant
Date: Tue, 1 May 2012 19:54:34 +0700
From: "PayPal" [notify@paypal.com]
Subject: RE:You just sent a payment to Jame Peterson
You just sent a payment
Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Jame Peterson
wcJame22@hotmail.com
Note to Thad Peterson
You haven't sent a note.
Shipping address - confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total $100.00 USD
Payment $60.00 USD
Payment sent to Jame Peterson
Help Centre | Resolution Centre | Security Centre
This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal Email ID PP1526
Monday, 30 April 2012
LinkedIn spam / 74.91.120.210
Date: Mon, 30 Apr 2012 17:51:37 +0530
From: "LinkedIn reminder" [reminder@linkedin.com]
Subject: LInkedin pending messages
REMINDERS
Invitation reminders:
• From Scott Burwell (Colleague at Nortel)
PENDING MESSAGES
• There are a total of 36 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2010, LinkedIn Corporation.
The malicious payload is at 74.91.120.210/showthread.php?t=9d77a9163cda8dbe (report here) hosted by Nuclearfallout Enterprises in the US.
91.121.84.204 / 64.244.61.40 malware
Blocking access to these IPs would be prudent.
Friday, 27 April 2012
"Amazon.com Password Assistance" spam / healthcarewelbizness.com
Date: Fri, 27 Apr 2012 04:47:10 +0000 (UTC)
From: "Amazon.com" [account-update@amazone.com]
Subject: Amazon.com Password Assistance
We received a request to reset the password associated with this e-mail address. Please follow the instructions below.
Click the link below to complete or cancel request using our secure server:
https://www.amazon.com/ap/forgotpassword?arb=cf4c17ba-4659-06c6-ff0f-58f6e8b50a66
If clicking the link doesn't seem to work, you can copy and paste the link into your browser's address window, or retype it there.
Amazon.com will never e-mail you and ask you to disclose or verify your Amazon.com password, credit card, or banking account number. Thanks for visiting Amazon.com!
healthcarewelbizness.com is hosted on 46.183.216.215 (Dataclub, Latvia) along with a whole load of other toxic websites that are best avoided.
"New message from.." spam / 74.91.114.83
Date: Fri, 27 Apr 2012 07:13:47 -0300
From: KristineLippitt@hotmail.com
Subject: New message from KYLIE NIX
KYLIE NIX 3:01am April 27
Hello!
...
Click here to view full message
View Conversation on Facebook ?� Reply to this email to message KYLIE NIX.
The payload is on 74.91.114.83/showthread.php?t=34c79594e8b8ac0f (report here) hosted by TurkTelecom in Turkey.
CareerBuilder spam / popcows.net
Date: Fri, 27 Apr 2012 10:58:00 -0300
From: Risa@site.careerbuilder.com
Subject: You might be interested in this vacant position.
Hello,
I am a customer service representative at CareerBuilder. I found a vacant position at Security Finance Corporation that you may be interested in based on information from your resume or a recent online application you made on our site. You can review the position on the CareerBuilder site here:
Chief Business Development Officer
We wish you best of luck!
Risa
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
==========
Date: Fri, 27 Apr 2012 18:52:37 +0530
From: Deena@site.careerbuilder.com
Subject: You might be interested in this vacant position.
Hello,
I am a customer service officer at CareerBuilder. I found a position at Security Finance Corporation that you may take interest in based on information from your resume or a recent online submission you made on our site. You can review the position on the CareerBuilder site here:
Customer Service Representative
We wish you best of luck!
Deena
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
The link tries to download from popcows.net/main.php?page=d024eabc8c2bdbfc (70.32.97.205 / Media Temple, US) which is 404ing at the moment, however it is still worth blocking it as a precaution.
LinkedIn spam / 50.116.23.176 and 64.244.61.40
Date: Fri, 27 Apr 2012 16:19:17 +0800The malicious payload is on 50.116.23.176/showthread.php?t=9d77a9163cda8dbe (report here) hosted by Linode in the US. There is a subsequent download attempted from 64.244.61.40/rUPYeVt0.exe which appears to be a legitimate hacked server belonging to cheekyshare.com.
From: "LinkedIn reminder" [reminder@linkedin.com]
Subject: LInkedin pending messages
REMINDERS
Invitation reminders:
• From Scott Burwell (Colleague at Nortel)
PENDING MESSAGES
• There are a total of 50 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2010, LinkedIn Corporation.
Twitter spam / medsdose.com
Date: Thu, 26 Apr 2012 19:43:05 +0000
From: Twitter [c-nfxzlxr=znvy-ba.hf-ae0dc@postmaster.twitler.com]
To: xxxx@xxxx.com
Subject: Unusual activity with your account!
Hi, xxxx@xxxx.com
Our system detected unusual activity associated with your account.
Your account may be temporarily suspended for violations of the Twitter Rules.
We suspend accounts for investigation if we suspect an account has been hacked or compromised.
You need to confirm your email address to regain access to your account.
Once you regain access, you will be able to request a new password for your Twitter account.
You can find information on following automations and permitted following behaviors on the help page:
https://support.twitter.com/
The Twitter Team
Please do not reply to this message; it was sent from an unmonitored email address. This message is a service email related to your use of Twitter. For general inquiries or to request support with your Twitter account, please visit us at Twitter Support.
medsdose.com is hosted on 95.168.193.182 in the Czech Republic, this IP is used for several fake pharma sites and can be safely blocked.
205.251.65.190 / skill.ee malware
The site tries to download a malicious executable from www.skill.ee/4Jw.exe but at the moment that is failing with a 401 error. skill.ee looks like another legitimate hacked site, a common pattern with this type of attack.
Thursday, 26 April 2012
CareerBuilder spam / masterisland.net
Date: Thu, 26 Apr 2012 10:40:58 -0430
From: Vielka@site.careerbuilder.com
Subject: Careerbuilder.com has found a vacant position for you
Hello,
I am a customer service officer at CareerBuilder. I found an open position at Security Finance Corporation that you may take interest in based on details from your resume or a recent online submission you made on our site. You can review the position on the CareerBuilder site here:
Chief Business Officer
Best wishes in your job search!
Vielka
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
=======================
Date: Thu, 26 Apr 2012 17:10:21 +0200
From: Gretchen@site.careerbuilder.com
Subject: Careerbuilder.com has found a vacant position for you
Hello,
I am a customer service representative at CareerBuilder. I found a position at Security Finance Corporation that you may find attactive based on information from your resume or a recent application you made on our site. You can review the position on the CareerBuilder site here:
Chief Human Resources Officer
We wish you best of luck!
Gretchen
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
=======================
Date: Thu, 26 Apr 2012 17:15:13 +0200
From: Vielka@site.careerbuilder.com
Subject: You might be interested in this vacant position.
Hello,
I am a customer service officer at CareerBuilder. I found an open position at Security Finance Corporation that you may take interest in based on information from your resume or a recent application you made on our site. You can review the position on the CareerBuilder site here:
Chief administrative officer
Best wishes in your job search!
Vielka
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
=======================
Date: Thu, 26 Apr 2012 21:09:52 +0530
From: Karen@site.careerbuilder.com
Subject: You might be interested in this position.
Hello,
I am a customer service employee at CareerBuilder. I found a position at Security Finance Corporation that you may be interested in based on details from your resume or a recent online application you made on our site. You can review the position on the CareerBuilder site here:
Chief Financial Officer
Best of luck to you in your job search!
Karen
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092
You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.
The link in the email goes through a legitimate hacked site to a payload on masterisland.net/main.php?page=975982764ed58ec3 (report here) hosted on 70.32.97.205 (Media Temple, US). There seem to be a lot of these spams coming out right now, so this is worth blocking.
LinkedIn spam / 199.115.229.55
Subject: Signal LinkedIn MailThe malware is on 199.115.229.55/showthread.php?t=977334ca118fcb8c (report here) hosted by Volumedrive in the US, which subsequently tries to download further malware from electrosa.com/8zvW2XE.exe (a site that has been used a lot in recent days). That domain and IP are worth blocking.
REMINDERS
Invitation reminders:
• From Scott Burwell (Product Director at SNCF)
PENDING MESSAGES
• There are a total of 44 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2012, LinkedIn Corporation.
Facebook spam / bioldrugstore.com
Date: Thu, 26 Apr 2012 09:33:46 -0700
From: "Facebook" [notification+xxxxxxxxxxx@facebookemail.com]
Subject: Welcome back to Facebook
Hello,
The Facebook account associated with xxxxxxxxxxx was recently reactivated.
If you were not the one who reactivated this account, please visit our Help Center to cancel the request.
http://www.facebook.com/help/?topic=security
Thanks,
The Facebook Team
The payload is a pharma site at bioldrugstore.com hosted on 61.132.200.24 and 111.123.180.9 in China (two IPs that are full of fake pharma stores) and 213.162.209.177 in Spain.
This type of spam run can easily be adapted for malware, so keep an eye out for unexpected Facebook notifications.
Wednesday, 25 April 2012
Facebook spam / 216.119.142.235
Date: Wed, 25 Apr 2012 05:48:16 +0200
From: Facebook [notification+n6vn0x357cp5@facebookmail.com]
Subject: CARMELLA OSBORN wants to be friends on Facebook.
CARMELLA OSBORN wants to be friends with you on Facebook.
CARMELLA OSBORN
Confirm Friend Request
See All Requests
This message was sent to xxxxxxxxxxxx. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
The malicious payload can be found on 216.119.142.235/showthread.php?t=34c79594e8b8ac0f (report here) hosted by A2 Hosting in the US.
Something evil on 85.17.222.80, lpicture.info and ghjvodka.info
There are two injected elements, one is a .in site hosted on 85.17.222.80 [Leaseweb, Netherlands] which could be one of the following:
sds.vaselisa.in
dds.kiriloid.in
drf.yerevano.in
sddr.margarit.in
cd.fancyclu.in
There's a pretty inconclusive Wepawet report here but be assured that these domains have a malicious payload.
The second injection is a reference to lpicture.info which is hosted on 95.168.173.151, this is a Leasweb Germany IP address suballocated to inferno.name who appear to be a Serbian firm fronted in the UK. I strongly recommend blocking all their IP ranges (listed here) if you can. lpicture.info merely forwards to a malicious payload on ghjvodka.info (report here) and that in turn is listed on 37.59.198.55 (OVH, France) along with some other suspect looking sites that lead be to conclude that this IP address is worth blocking too:
ns2.deftheory.org
abcvodka.info
defvodka.info
ghjvodka.info
abcfree.info
ns1.abcfree.info
deffree.info
ghjfree.info
ns1.ghjfree.info
klmfree.info
opqfree.info
ns1.opqfree.info
rstfree.info
uvwfree.info
ns1.uvwfree.info
xyzfree.info
ns1.xyzfree.info
deflocal.info
ns1.deflocal.info
ghjlocal.info
klmlocal.info
noplocal.info
ghjseat.info
klmseat.info
ns1.klmseat.info
This malware seems to be quite good at avoid analysis. But if you can block these IPs then I strongly recommend that you block them.
Something evil on 82.211.45.81 and 82.211.45.82
82.211.45.0/24 doesn't appear to host anything at all apart from these malicious sites and is a good candidate to block.
The hacked GoDaddy accounts have been set to point everything except www. to the server on 82.211.45.81. Hacked domains on this server appear to be:
revolution-clan.com
banknewsdirectories.com
psychicwireless.com
greenbankingemagazine.com
greenbankingemag.com
Many of these hijacked domains are registered to:
BankNews Publications
5115 Roe Blvd, Ste 200
Shawnee Mission, Kansas 66205
United States
It appears that BankNews Publications have lost control of their GoDaddy account.
82.211.45.81 will actually resolve for any subdomain at all for these hacked domains, but these are a sample of malicious subdomains hosted on this server:
jiqjmiglxjmedma.greenbankingemagazine.com
xihjpxpomxfjra.greenbankingemagazine.com
eqokikmxjmivxhb.greenbankingemagazine.com
xhfbjaimtcxmymb.greenbankingemagazine.com
hrxjxmesskisnxb.greenbankingemagazine.com
icmiiycxxfmevhxdc.greenbankingemagazine.com
imliismmsfdxtld.greenbankingemagazine.com
iayxdmbrqsmue.greenbankingemagazine.com
frbiptiuimxsmwe.greenbankingemagazine.com
xhbixmhmmipxsnkye.greenbankingemagazine.com
ibimuijzrxqlgmf.greenbankingemagazine.com
eimxgjruxpf.greenbankingemagazine.com
xgbgpuicyxmcsf.greenbankingemagazine.com
ixmfisqirydauf.greenbankingemagazine.com
bmnufhoixlg.greenbankingemagazine.com
hqvqbwmqqimxxmg.greenbankingemagazine.com
axvsiqiyminyug.greenbankingemagazine.com
gfmeivxnpiizfh.greenbankingemagazine.com
cxvrqiorimxgh.greenbankingemagazine.com
emkksximxuwiglh.greenbankingemagazine.com
mxmgohioxwexnyh.greenbankingemagazine.com
ijxeowhxemiumuij.greenbankingemagazine.com
gizhpirtxlmxmmkrj.greenbankingemagazine.com
exvmxopmispfwj.greenbankingemagazine.com
jmisxvxyxkymymsk.greenbankingemagazine.com
mipboqmkhxk.greenbankingemagazine.com
hlxgpiwhmemkmxk.greenbankingemagazine.com
gnmmbuoikxphiml.greenbankingemagazine.com
wehherixammvmsl.greenbankingemagazine.com
mxesvvmjvrmipixl.greenbankingemagazine.com
gmxsgedclvimin.greenbankingemagazine.com
mhvhfxixmauoun.greenbankingemagazine.com
xmltmwnixunvjo.greenbankingemagazine.com
xiegvmslxpqxiicp.greenbankingemagazine.com
miexxiivpfrcstmp.greenbankingemagazine.com
ixxevkmeipurmnp.greenbankingemagazine.com
emhxxjikflnimyp.greenbankingemagazine.com
ixicqgodvmisgq.greenbankingemagazine.com
gxcoximiwdidyjhq.greenbankingemagazine.com
exhymgkixnilbr.greenbankingemagazine.com
gcjnigxxmgvkir.greenbankingemagazine.com
hbjpmjfwmvidmxir.greenbankingemagazine.com
xeftvrmijbjr.greenbankingemagazine.com
imgximffxnzhhemr.greenbankingemagazine.com
cqimhvmrxrmbnr.greenbankingemagazine.com
xifmcxfairyuymt.greenbankingemagazine.com
mxhlieitefmkpt.greenbankingemagazine.com
xmfxiignkgefzlu.greenbankingemagazine.com
mmfimxggguihjxyu.greenbankingemagazine.com
thiqxxtgisqobmiv.greenbankingemagazine.com
dmxinxeoesimxivmjpv.greenbankingemagazine.com
foxfqgqaimkrv.greenbankingemagazine.com
mcbhxyxnikwrhw.greenbankingemagazine.com
bjetxchegicmiy.greenbankingemagazine.com
xfxpizijvmmsrqiy.greenbankingemagazine.com
gxrimhyukcxmiujy.greenbankingemagazine.com
mhmxjnpincxqly.greenbankingemagazine.com
iesqabdoumximz.greenbankingemagazine.com
ihmmlxgpyykvmz.greenbankingemagazine.com
hncrpmvdxibixmxa.greenbankingemag.com
cjkximmyjmgixvbza.greenbankingemag.com
himrnxxzwoiumza.greenbankingemag.com
gumiivcoiexfvmc.greenbankingemag.com
iihxmxrlyizympzc.greenbankingemag.com
mgifxrmvjmid.greenbankingemag.com
fimbigxycwibfme.greenbankingemag.com
hrxijizjivtjcmf.greenbankingemag.com
mmgobixyixhemqyig.greenbankingemag.com
lkqjimmimxgng.greenbankingemag.com
gsnxmimxixfsqihymkh.greenbankingemag.com
bjaxieuamimvxvph.greenbankingemag.com
mesxxlhiosh.greenbankingemag.com
ihjuxbmfkxznixh.greenbankingemag.com
mfhkcifavyxxh.greenbankingemag.com
hsmxmmndvxigxsidij.greenbankingemag.com
zsmbdqvbimbxrik.greenbankingemag.com
jxumeqpvhipixk.greenbankingemag.com
jyzxmxktxipl.greenbankingemag.com
mhupgmtgixkbn.greenbankingemag.com
zexrmixhxqvtsrin.greenbankingemag.com
goxixmggdxrdmpn.greenbankingemag.com
meirqvmmxjjxqkio.greenbankingemag.com
hirqrexuxixadmo.greenbankingemag.com
bxlfiszdqdxmixrip.greenbankingemag.com
hqucyipjmoxmp.greenbankingemag.com
ixhrhjmvllifxgmr.greenbankingemag.com
alvpvmboxixgsu.greenbankingemag.com
immhrnjpomieijxu.greenbankingemag.com
eailofxsmlwxaw.greenbankingemag.com
hrbfigxmkgy.greenbankingemag.com
mihskdifqfnxmcxy.greenbankingemag.com
mehjuxipsnbib.revolution-clan.com
hmjujigmkxfgxb.revolution-clan.com
gxqemihgmxfmtec.revolution-clan.com
mailbfhqcxqnc.revolution-clan.com
hxlilulrxmmqvc.revolution-clan.com
xeiaocohgixjme.revolution-clan.com
ltmxmjpxrmopioe.revolution-clan.com
idbkkgmjxymkipf.revolution-clan.com
cixvitmkguocxf.revolution-clan.com
hxpmvviqqpixiag.revolution-clan.com
fmxrxvmwimnzhiyig.revolution-clan.com
mfaoodswxixiekxg.revolution-clan.com
fmexxnnuiqihmfh.revolution-clan.com
imgjoxmrutfihj.revolution-clan.com
caxilhipuqumhmj.revolution-clan.com
igrjonnqgxximximj.revolution-clan.com
zkziwmijjxhobxmj.revolution-clan.com
mxwyxspkzbjmipk.revolution-clan.com
hxtsvxvtifmvirk.revolution-clan.com
gmsixlmqohxxql.revolution-clan.com
mhsjwmiehbxpiln.revolution-clan.com
emhinyyybqfxo.revolution-clan.com
jsxkmlxbxjreiq.revolution-clan.com
mmjvxexmyiravxnq.revolution-clan.com
xxacnrzimihhxayq.revolution-clan.com
xfhioimkynmltfs.revolution-clan.com
gebdxeivxhmls.revolution-clan.com
amibxpmvxjizqmvht.revolution-clan.com
igevqsxmnxqdmiit.revolution-clan.com
hmxjmiiugnxrhou.revolution-clan.com
meiqpqixrhamxzu.revolution-clan.com
hpiixmflehmmv.revolution-clan.com
xamiyicvhlxmiuov.revolution-clan.com
bshmmvxmvngixv.revolution-clan.com
ximxelmimdariya.banknewsdirectories.com
xihreeumnkkb.banknewsdirectories.com
xfgngivmpinmlb.banknewsdirectories.com
hxmrvtgfivivb.banknewsdirectories.com
eipcnxptdmximc.banknewsdirectories.com
mfrixougkoixmoc.banknewsdirectories.com
lxiqxmckvfe.banknewsdirectories.com
mfimgoexrmxkrliie.banknewsdirectories.com
epijmmqfqorxie.banknewsdirectories.com
fiihgxgeexmdvxme.banknewsdirectories.com
hzdxvktqcimxe.banknewsdirectories.com
fihlysaiajxmf.banknewsdirectories.com
cyismxdeixorrf.banknewsdirectories.com
gmsvijiqpxuxxmsrf.banknewsdirectories.com
migsoowwmrbxf.banknewsdirectories.com
wvixxyqemxf.banknewsdirectories.com
ijraqaymmmixbg.banknewsdirectories.com
migydrxjietrmg.banknewsdirectories.com
maxmiuxynjuiyg.banknewsdirectories.com
gifkkxiejimeah.banknewsdirectories.com
hqymxltxxiymztk.banknewsdirectories.com
lrmbkemoxpumil.banknewsdirectories.com
lmruitlmoxbbxil.banknewsdirectories.com
fievxumflwumnl.banknewsdirectories.com
mgeooxipnimpwl.banknewsdirectories.com
mgsrbgnnmiinixxl.banknewsdirectories.com
ibxevkxnkxvmnyl.banknewsdirectories.com
grmxbxximpomilfizl.banknewsdirectories.com
ihvmqxxmixkmgnqbn.banknewsdirectories.com
eymmnmzoihxnhxn.banknewsdirectories.com
mhpmiyrpciixvmko.banknewsdirectories.com
glxlzxkimizkmilmo.banknewsdirectories.com
xcjuvlmimisuklxo.banknewsdirectories.com
ihqxkiompoixqjp.banknewsdirectories.com
ijpixxmxwokpcipp.banknewsdirectories.com
gqveemmjoiexp.banknewsdirectories.com
fepxmehilsxkgq.banknewsdirectories.com
hpmiuvdxdimiuxbr.banknewsdirectories.com
grprpxmvrmoimr.banknewsdirectories.com
mxomwibexks.banknewsdirectories.com
hxipmtiaxyslxlms.banknewsdirectories.com
xihxjolxstjmits.banknewsdirectories.com
emkkdxmxykfiys.banknewsdirectories.com
maxfvubvisqmmbt.banknewsdirectories.com
eemimqmfgnilsxiju.banknewsdirectories.com
jiswfixzydxmkxv.banknewsdirectories.com
gitxipmcmhbuxmsw.banknewsdirectories.com
imhomjflumixysw.banknewsdirectories.com
icfrmirfynxmay.banknewsdirectories.com
cxiajrmuxugmrhy.banknewsdirectories.com
amlxxkbselyoiy.banknewsdirectories.com
fbomuvlimcjbxxiy.banknewsdirectories.com
hmxoigtxrnifmikmy.banknewsdirectories.com
ifmunqxvmorsa.psychicwireless.com
ibjcxymktdqnmximb.psychicwireless.com
hlliwutmbxmxvb.psychicwireless.com
jbximmiskbxamxqec.psychicwireless.com
xjiaursmvcoixc.psychicwireless.com
idkifjufidxmjfe.psychicwireless.com
idkmrxqkposxtme.psychicwireless.com
efqfxnqjeismif.psychicwireless.com
xxhalhimsxhisvoif.psychicwireless.com
xfmsoppgmijwmxif.psychicwireless.com
frmnxukmcaixlf.psychicwireless.com
hihhxeumtmkamf.psychicwireless.com
bpmxkieeehxyxf.psychicwireless.com
xiihcjhrmoxfndg.psychicwireless.com
xhmmgrkvoqvig.psychicwireless.com
mhrmmxxndxiknntg.psychicwireless.com
xixgvjvlqymwxg.psychicwireless.com
mixxbmvzlhksmzg.psychicwireless.com
imhxbgqgmvgyxidh.psychicwireless.com
ieirocexviomeh.psychicwireless.com
xftiimyeksmrmxaj.psychicwireless.com
xaltixqgmegqhj.psychicwireless.com
Update: it seems that the adjacent IP, 82.211.45.82, is also hosting a similar set of malicious sites.
xmwyrwhkqlhpm.magasinez-en-vrac.com
fmyyxxhgthyr.magasinez-en-vrac.com
hfiuqgcixyoy.magasinez-en-vrac.com
wqkxgkpxxmiukyr.cashbackdevil.com
fixolsmhiahjs.cashbackdevil.com
Tuesday, 24 April 2012
LinkedIn Spam / leckrefotzen.net
Date: Tue, 24 Apr 2012 16:31:34 -0300
From: "Russ Connor" [enviousnessi07@linkedin.com]
Subject: LinkedIn Reminder
REMINDERS
Invitation notifications:
? From Chaney Cameron (Your Colleague)
PENDING MESSAGES
? There are a total of 3 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. � 2010, LinkedIn Corporation.
The link in the message goes to a malware site at leckrefotzen.net/main.php?page=b7ff54d52bf8dd24 (report here) hosted on the familiar IP address of 41.64.21.71 in Egypt. Blocking this IP address would be an excellent idea. Or you could just block linkedin.com emails altogether which would be no great loss either.
nikjju.com injection attack in progress
Registrant Contact:
JamesNorthone
James Northone jamesnorthone@hotmailbox.com
+1.5168222749 fax: +1.5168222749
128 Lynn Court
Plainview NY 11803
us
JamesNorthone
James Northone jamesnorthone@hotmailbox.com
+1.5168222749 fax: +1.5168222749
128 Lynn Court
Plainview NY 11803
us
The hotmailbox.com domain is a sign of evil, and these are likely to be the "LizaMoon" crew who have been very active over the past couple of years. nikjju.com is hosted on 31.210.100.242 (INTER NET BILGISAYAR LTD STI, Turkey although blocking the domain will help as well because these malicious sites tend to be highly mobile.
Myspace spam / newprescriptionmedical.com
Date: Tue, 24 Apr 2012 20:13:58 -0700
From: "Myspace" [noreply@message.myspace.com]
Subject: Account Cancellation
myspace
Your request to cancel your Myspace account has been received.
You must follow this link to complete or cancel your request.
You will receive an email shortly with instructions for confirming that you wish to cancel.
Thank you for using Myspace!
The Myspace Team
http://www.myspace.com
Have questions? Visit our help page. Myspace, 8391 Beverly Blvd, #349, Los Angeles, CA 90048.
� Myspace Inc. All Rights Reserved.
newprescriptionmedical.com is hosted on 95.168.193.182 (Supernetwork, Czech Republic) along with a bunch of other fake pharma sites and is worth blocking.
US Airways Spam / 208.117.43.8
Date: Tue, 24 Apr 2012 20:12:38 +0700
From: "US Airways - Reservations" [reservations@myusairways.com]
Subject: Please confirm your US Airways online registration.
You can check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying abroad). After that, all you have to do is print your boarding pass and head to the gate.
Confirmation code: 749251
Check-in online: Online reservation details
Flight
6138
Departure city and time
Washington, DC (DCA) 10:00PM
Depart date: 4/5/2012
We are committed to protecting your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.
US Airways, 111 W. Rio Salado Pkwy, Tempe, AZ 85281 , Copyright US Airways , All rights reserved.
====================
Some other subjects include:
Confirm your US airways online reservation.
US Airways online check-in confirmation.
The malicious payload is on 208.117.43.8/showthread.php?t=73a07bcb51f4be71(report here). Blocking this IP would probably be a good idea.
Pizza spam / 208.117.43.8
Date: Tue, 24 Apr 2012 02:21:42 +0800The malware is hosted on 208.117.43.8/showthread.php?t=34c79594e8b8ac0f (report here) hosted by Steadfast Networks in the US. There's also an attempted download of an executable from electrosa.com/8zvW2XE.exe on 188.40.0.195 (Hetzner, South Africa) although this looks like a legitimate hacked site.
From: "ORSO`s Pizzeria"
Subject: Re: Fwd: Order confirmation 93278
You've just ordered pizza from our site
Pizza Ultimate Cheese Lover's with extras:
- Ham
- Italian Sausage
- Chicken
- Black Olives
- Green Peppers
- Pineapple
- Easy On Cheese
- Extra Sauce
Pizza Italian Trio with extras:
- Italian Sausage
- Pork
- Chicken
- Diced Tomatoes
- Black Olives
- Easy On Cheese
- Easy On Sauce
Pizza Spicy Sicilian with extras:
- Italian Sausage
- Pork
- Diced Tomatoes
- Onions
- Jalapenos
- Easy On Cheese
- No Sauce
Pizza Meat Lover's with extras:
- Italian Sausage
- Black Olives
- Black Olives
- Black Olives
- No Cheese
- Easy On Sauce
Pizza Triple Meat Italiano with extras:
- Ham
- Beef
- Black Olives
- No Cheese
- Easy On Sauce
Pizza Ultimate Cheese Lover's with extras:
- Italian Sausage
- Pepperoni
- Onions
- Onions
- No Cheese
- Easy On Sauce
Drinks
- Carling x 3
- Hancock x 3
- Dr. Pepper x 4
Total Due: 131.51$
If you haven't made the order and it's a fraud case, please follow the link and cancel the order.
CANCEL ORDER NOW!
If you don't do that shortly, the order will be confirmed and delivered to you.
With Respect
ORSO`s Pizzeria
Monday, 23 April 2012
"Scan from a HP ScanJet" spam / 199.15.252.136
From: CheyanneDelasancha@hotmail.com
Date: 23 April 2012 13:18
Subject: Re: Fwd: Scan from a HP ScanJet #352369989
A document was scanned and sent to you using a Hewlett-Packard QJet 8125331KSent to you by: CAMERON
Pages : 9
Filetype(s): Images (.jpeg) Download
Location: MSK.3FL.
Device: DEV674O1JF7863855Mailprint: 1169d03a-fe6923a5 =
A document was scanned and sent to you using a Hewlett-Packard QJet 8125331K
Sent to you by: CAMERON
Pages : 9
Filetype(s): Images (.jpeg) Download
Location: MSK.3FL.
Device: DEV674O1JF7863855
Mailprint: 1169d03a-fe6923a5
The malicious payload is on 199.15.252.136/showthread.php?t=34c79594e8b8ac0f (report here) hosted by Electric Postage in the US.
Ning "Sign in Issue" spam / mycanadarx.com
From: Ning Help Center [mailto:helpcenter@ning.com]mycanadarx.com is hosted on 95.168.193.182 in the Czech Republic with a whole load of other fake pharma sites.
Sent: 23 April 2012 17:22
Subject: Sign In Issue
Hello!
Thanks for contacting us. We're writing to let you know we've received your message.
We strive to respond to tickets about issues as quickly as possible.
To provide us with additional details or updates, you can simply Login to Your Account.
Please be sure to leave the subject and body of this email in place. If you are able to resolve the issue, please let us know!
Many common issues are explained in http://help.ning.com/?faq=3800.
Thanks again!
The Ning Team
Summary:
ref:_00D80cCLt._50040JSbrh:ref
"Welcome to LiveJournal" spam / dietpharmacyeat.com
Date: Sun, 22 Apr 2012 04:21:28 +0000
From: "LiveJournal.com" [do-not-reply@livejournal.com]
Subject: Welcome to LiveJournal
Congratulations! Thanks for creating a new journal at LiveJournal!
Please click here to complete validation and set your primary email*
(If you are unable to click on the link, copy and paste code into your browser window.)
Code: 33416121.5p9rmuuyqvzp7tw
All the best,
The LiveJournal Team
http://www.livejournal.com/
* About your primary email address: Your first validated email address (also known as primary email) is the only way to confirm that you own the journal, so please use only your most secure email address. If you chose a less secure address in the process of registration, we recommend that you change it and confirm your new address.
In this case, the fake pharma site is dietpharmacyeat.com. Always check the link carefully before clicking on this type of email, it might not be as it seems.
"MediaWiki Mail" Spam / carewelhealth.com
Date: Sun, 22 Apr 2012 16:09:12 +0000
From: MediaWiki Mail [wiki@wikimedia.org]
Subject: Account details on Wikipedia
Wikipedia
Someone (probably you, from IP address 105.191.258.285) requested a reminder of your account details for Wikipedia. The following user account is associated with this e-mail address: xxxxxxxxxxx
This reminder will expire in 7 days.
If you didn't initiate the request on Wikipedia, feel free to cancel this message and uncheck the "Reminder" checkbox in your account.
Thanks, and once again Welcome!
http://en.wikipedia.org
Of course, the IP address of 105.191.258.285 is invalid, but most people probably won't be looking too closely. Keep an eye out for this type of spam. it might well lead to something nastier than a fake Viagra merchant.
I love this..
St George's Day and the 30th Anniversary of the ZX Spectrum.. Google have managed to combine both into one logo.. I love it!
Friday, 20 April 2012
NACHA Spam / 85.25.189.174
From: CarleySpan@hotmail.com
Date: 19 April 2012 21:25
Subject: Your ACH transaction N73848938
The ACH credit transfer, initiated from your checking acc., was canceled by the other financial institution.
Canceled transaction:
Transaction ID: A7635857812UA
ACH Report: View
LINDSEY Zimmerman
NACHA - The Electronic Payment Association
The malicious payload is on 85.25.189.174/showthread.php?t=34c79594e8b8ac0f hosted by Intergenia / PlusServer in Germany. Avoid.
New Blogger interface: It's all too horrible to contemplate.
There are a lot of companies at the moment doing a similar thing.. making over their tried and tested (but tired) old software interfaces and coming up with something pastel-ly and awful. Or perhaps I'm just a Luddite?
Update: you can share your feedback on the Blogger forum which is full of similar complaints.
LinkedIn spam / mysalepharmacy.com
From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn Email Confirmation
Sent: 20 April 2012 09:54
Subject: Please confirm your email address
Click here to confirm your email address.
If the above link does not work, you can paste the following address into your browser:
https://www.linkedin.com/e/vAIspiNMa9UrLxwLy8OkxtE3ZZ5hfZkRMg0f2bmzDWANi
You will be asked to log into your account to confirm this email address. Be sure to log in with your current primary email address.
We ask you to confirm your email address before sending invitations or requesting contacts at LinkedIn. You can have several email addresses, but one will need to be confirmed at all times to use the system.
If you have more than one email address, you can choose one to be your primary email address. This is the address you will log in with, and the address to which we will deliver all email messages regarding invitations and requests, and other system mail.
Thank you for using LinkedIn!
--The LinkedIn Team
http://www.linkedin.com/
© 2012, LinkedIn Corporation
Personally, I hate LinkedIn emails. Blocking everything that appears to be from linkedin.com will not have any adverse impact on your life.
Thursday, 19 April 2012
LinkedIn Spam / springrheumatology.net
Date: Thu, 19 Apr 2012 19:34:55 +0100
From: "Callie Holland" [donor@linkedin.com]
Subject: LinkedIn Invitation from your co-worker
REMINDERS
Invitation notifications:
? From Patrick Mcdaniel (Your co-worker)
PENDING MESSAGES
? There are a total of 2 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. � 2010, LinkedIn Corporation.
=========================
Date: Thu, 19 Apr 2012 14:57:47 -0300
From: "Jane Gaston" [lulu9@linkedin.com]
Subject: LinkedIn Reminder
REMINDERS
Invitation reminders:
? From Solomon Goff (Your Colleague)
PENDING MESSAGES
? There are a total of 2 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. � 2010, LinkedIn Corporation.
The malicious payload is at springrheumatology.net/main.php?page=9e32768587b0d9a8 (report here) hosted on the familiar IP address of 41.64.21.71 in Egypt, a very good IP address to block.
"Scan from a Xerox W. Pro" spam / 184.22.115.24
From: MollieFaw@hotmail.com [mailto:MollieFaw@hotmail.com]
Sent: 19. april 2012 10:40
Subject: Re: Fwd: Fwd: Scan from a Xerox W. Pro #55048919
A Document was sent to you using a XEROX SuperJet 036582425.SENT BY : MIRIAM
IMAGS : 97
FORMAT (.JPG) DOWNLOAD
DEVICE: 69972L7ODS736028L
In this case the malicious payload is on 184.22.115.24/showthread.php?t=34c79594e8b8ac0f (report here) which is hosted by HostNOC in the US.
Tuesday, 17 April 2012
"Hello. Thank you for contacting us!" spam
Date: Date: Tue, 17 Apr 2012 14:49:18 -0400
From: Customer center [anfinnegan@pasadena.net]
Subject: [#3143] Ticket
Hello. Thank you for contacting us!
Your information has been changed and we should be in touch with you soon.
Proceed to Site.
Ticket code: fi5FFkG
You should expect a personal reply within the day or even sooner - as we answer most email within a few hours.
fff
"Scan from a Hewlett-Packard ScanJet 719606" / 173.44.136.197
This fake HP scan email leads to malware on 173.44.136.197.
The malware is on 173.44.136.197/showthread.php?t=34c79594e8b8ac0f (report here) hosted by JSC Media in Canada.
Date: Tue, 17 Apr 2012 09:21:07 +0530
From: HaileyWeeth@hotmail.com
Subject: Re: Fwd: Scan from a Hewlett-Packard ScanJet 719606
A document was scanned and sent to you using a Hewlett-Packard JET ON22536593S
Sent to you by: LERA
Pages : 4
Filetype: Image (.jpeg) View
Location: NPSK1.4FL.
Device: OP594S3OD1420493
Mailprint: ca5b83c7-2d5b8888
The malware is on 173.44.136.197/showthread.php?t=34c79594e8b8ac0f (report here) hosted by JSC Media in Canada.
Monday, 16 April 2012
"You've just ordered pizza from our site" / uiwewsecondary.ru
Date: Mon, 16 Apr 2012 08:40:47 -0500
From: CeceliaKosack@hotmail.com
Subject: Order confirmation
You've just ordered pizza from our site
Pizza Triple Meat Italiano with extras:
- Ham
- Ham
- Bacon Pieces
- Pineapple
- Onions
- Easy On Cheese
- No Sauce
Pizza Chicken Supreme with extras:
- Ham
- Jalapenos
- Black Olives
- Extra Cheese
- Extra Sauce
Pizza Hawaiian Luau with extras:
- Pepperoni
- Italian Sausage
- Beef
- Pineapple
- Easy On Cheese
- No Sauce
Pizza Chicken Supreme with extras:
- Italian Sausage
- Bacon Pieces
- Italian Sausage
- Jalapenos
- Diced Tomatoes
- Green Peppers
- Easy On Cheese
- Extra Sauce
Drinks
- Fanta x 4
- Limonade x 6
- Schweppes x 6
- Sprite x 2
Total Charge: 89.70$
If you haven't made the order and it's a fraud case, please follow the link and cancel the order.
CANCEL ORDER NOW!
If you don't do that shortly, the order will be confirmed and delivered to you.
With Best Regards
Pizza by AMERIGO
The malicious payload is at uiwewsecondary.ru:8080/internet/fpkrerflfvd.php (report here) hosted on some familiar IP addresses (a subset of the ones found here):
41.168.5.140 (Neotel, South Africa)
62.85.27.129 (Microlink, Latvia)
83.170.91.152 (UK2.NET, UK)
85.214.204.32 (Strato AG, Germany)
88.190.22.72 (Free SAS / ProXad, France)
89.31.145.154 (Nexen, France)
112.78.124.115 (Sakura Internet, Japan)
210.56.23.100 (Commission For Science And Technology, Pakistan)
211.44.250.173 (SK Broadband, Korea)
219.94.194.138 (Sakura Internet, Japan)
Plain list for copy-and-pasting:
41.168.5.140
62.85.27.129
83.170.91.152
85.214.204.32
88.190.22.72
89.31.145.154
112.78.124.115
210.56.23.100
211.44.250.173
219.94.194.138
"FedEx Delivery Confirmation 821630" spam / pokeronmep.ru
Date: Mon, 16 Apr 2012 18:26:48 +0900
From: "Fed Ex SUPPORT 36" [support.391@fedex.com]
Subject: FedEx Delivery Confirmation 821630
Attachments: Collect_Letter.htm
ATTENTION!
DEAR USER , Delivery Confirmation: FAILED
PLEASE FILL IN ATTACHED FILE WITH RIGHT ADDRESS AND RESEND TO YOUR PERSONAL MANAGER (Open with Internet Explorer)
With Respect , Your Fed Ex Customer Services
The malicious payload is on pokeronmep.ru:8080/pages/glavctkoasjtct.php (report here) which is hosted on the same IP addresses as found in this attack. Blocking them would be worthwhile.
Friday, 13 April 2012
"NY TRAFFIC TICKET " spam / vitalitysomer.ru
This fake traffic ticket spam leads to malware on vitalitysomer.ru: Date: Fri, 13 Apr 2012 02:46:11 +0600The malware is on vitalitysomer.ru:8080/pages/glavctkoasjtct.php (report here) hosted on the same IP addresses found in this attack.
From: "LUIS MOSES" [Phl8DeB6MG@hotmail.com]
Subject: Fwd: Re: NY TRAFFIC TICKET
New-York Department of Motor Vehicles
TRAFFIC TICKET
NEW-YORK POLICE DEPARTMENT
THE PERSON CHARGED AS FOLLOWS
Time: 8:11 AM
Date of Offense: 25/01/2012
SPEED OVER 50 ZONE
TO PLEAD CLICK HERE AND FILL OUT THE FORM
Fingerprint: 67d251e9-830ebcaf
Fake AV sites to block on 64.120.207.108
There are a bunch of fake AV sites on 64.120.207.108 (HostNOC, US) that are active at the moment. You might want to block them :)
informationmonitorcare.info
preventiontoolsscanning.info
on-linecleanersupervision.info
supervisiontesterinspection.info
reliabilitywormsprocesses.info
verifywrecksafety.info
informationmonitorcare.info
preventiontoolsscanning.info
on-linecleanersupervision.info
supervisiontesterinspection.info
reliabilitywormsprocesses.info
verifywrecksafety.info
Thursday, 12 April 2012
Federal Reserve Wire Network spam / vanishingmasers.ru
This spam leads to malware on vanishingmasers.ru:Date: Thu, 12 Apr 2012 15:14:41 -0300
From: "Lidia Polk" [uzbekistanqp39@sterkinekor.com]
Subject: RE: Wire transfer cancelled
Good afternoon,
Wire transfer was canceled by the other bank.
Rejected transaction:
FEDWIRE REFERENCE NUMBER: SK9415179747ODP36641K
Wire Transfer Report: View
The Federal Reserve Wire Network
The payload is on vanishingmasers.ru:8080/pages/glavctkoasjtct.php (report here) which is hosted on some familiar looking IP addresses:
41.168.5.140 (Neotel, South Africa)
62.85.27.129 (Microlink, Latvia)
83.170.91.152 (UK2.NET, UK)
85.214.204.32 (Strato AG, Germany)
88.190.22.72 (Free SAS / ProXad, France)
89.31.145.154 (Nexen, France)
112.78.124.115 (Sakura Internet, Japan)
125.19.103.198 (Bharti Infotel, India)
210.56.23.100 (Commission For Science And Technology, Pakistan)
211.44.250.173 (SK Broadband, Korea)
219.94.194.138 (Sakura Internet, Japan)
Plain list for copy-and-pasting:
41.168.5.140
62.85.27.129
83.170.91.152
85.214.204.32
88.190.22.72
89.31.145.154
112.78.124.115
125.19.103.198
210.56.23.100
211.44.250.173
219.94.194.138
LinkedIn Spam / prospero-marketing.net
From: Patrice Burke premonition9@linkedin.com
Date: 12 April 2012 16:33
Subject: LinkedIn Nofitication service message
REMINDERS
Invitation reminders:
• From Kadeem Ruiz (Your classmate)
PENDING MESSAGES
• There are a total of 2 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2010, LinkedIn Corporation.
The malicious payload is on prospero-marketing.net/main.php?page=5ab26a646c9cf178 (report here) hosted on 85.189.11.134 and 41.64.21.71 which are the same IPs as seen in this attack yesterday.
Subscribe to:
Posts (Atom)