BBB Spam / 108.178.59.11

This fake BBB spam leads to malware on 108.178.59.11:

Date:      Mon, 24 Sep 2012 18:39:47 +0530
From:      "BBB Complaint activity report" [B1A41D3F@onlinepcexpert.net]
Subject:      BBB Case #9833204



Dear business owner, we have received a complaint about your company possible involvement in check cashing and Money Order Scam.

You are asked to provide response to this complaint within 7 days.

Failure to provide the necessary information will result in downgrading your Better Business Bureau rating and possible cancellation of your BBB accreditation status.

Complaint ID#9833204

Council of Better Business Bureaus
3033 Wilson Blvd, Suite 600
Arlington, VA 22201
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

==========


Date:      Mon, 24 Sep 2012 08:25:00 -0300
From:      "Better Business Bureau" [792375B2@mbdservices.com]
Subject:      BBB Complaint activity report

Dear business owner, we have received a complaint about your company possible involvement in check cashing and Money Order Scam.

You are asked to provide response to this complaint within 7 days.

Failure to provide the necessary information will result in downgrading your Better Business Bureau rating and possible cancellation of your BBB accreditation status.

Complaint ID#360343

Council of Better Business Bureaus
3033 Wilson Blvd, Suite 600
Arlington, VA 22201
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

The malicious payload is on [donotclick]108.178.59.11/links/anybody_miss-knowing.php (Singlehop, US) which is most likely a Blackhole 2 kit. This IP address has been used in other attacks and should be blocked if you can.

LinkedIn spam / 69.194.201.21

This fake LinkedIn spam leads to malware on 69.194.201.21:

Date:      Sat, 22 Sep 2012 15:16:47 -0500
From:      "Reminder" [CC8504C0E@updownstudio.com]
Subject:      LinkedIn: New messages awaiting your response

LinkedIn
REMINDERS

Invitation reminders:
From Emilio Byrd (Insurance Manager at Wolseley)

PENDING MESSAGES

There are a total of 88 message(-s) awaiting your response. Go to InBox now.

This message was sent to [redacted]. This is an occasional email to help you get the most out of LinkedIn.

Adjust your message settings.

LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission.

2012, LinkedIn Corporation.

The malicious payload is at [donotclick]69.194.201.21/links/deep_recover-result.php (Solar VPS, US) which appears to be a Blackhole 2 exploit kit. Blocking this IP address would be prudent.

Amazon.com spam / webgrafismo.net and 203.91.113.6

This fake Amazon.com spam leads to malware on webgrafismo.net:

Date:      Fri, 21 Sep 2012 03:44:47 +0800
From:      "Adolfo Bruno" [debitst54@uky.edu]
Subject:      Your HD TV Delivered Yesterday

  
Your Orders | Your Account | Amazon.com
Shipping Confirmation
Order #002-9587043-55406590

Greetings [redacted],

Thank you for shopping with us. Wethought you'd like to know that amazon shipped your item, and that this completes your order.. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.
Your estimated shipment delivery date is:

Friday, September 21, 2012

Why tracking information may be unavailable?
    Your order was sent to:

[redacted]
572 9th Ave, App. 2D
S Paolo, TX
United States

This shipment does not have an associated delivery tracking No..

Conveyance Data
  

Sharp XVT3D32, SV 46-Inch 1080p 1000 Hz Cinema 3D LED-LCD HDTV with 3D Blu-ray Player and Two Pairs of 3D Glasses
Sold by secondipity
Condition: used - acceptable
    $740.43
Item Subtotal:     $740.43
Shipping & Handling:     $22.40
Total Before Tax:     $740.43
Shipment Total:     $740.43
Paid by Maestro:     $740.43

Returns are easy. Visit our ON-line Return Center.
If you need urgent assistance with your order, please visit Merchant Contact Form.

We hope to see you again soon!
Amazon.com

Unless otherwise noted, items are sold by Amazon LLC. Learn more about tax and seller information.

This email was sent from a notification-only address that cannot accept incoming email. Please don't reply to this message.

==========

Date:      Thu, 20 Sep 2012 20:51:04 +0100
From:      "Ned@mc2school.org" [Ned@ataonline.com.tr]
Subject:      Re: HDTV Shipped Yesterday

Your Orders | Your Account | Amazon.com                                          
Order Processing Confirmation                                          
Order #002-1662198-01565354                                                                      
Greetings [redacted],

Thank you for shopping with us. Wethought you'd like to know that amazon shipped your item, and that this completes your order.. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.
Your estimated  shipment date is:

Friday, September 21, 2012

Why tracking information may  be not available?
        Your order  was delivered to:

[redacted]
148 S Academy Dr, App. 1D
Albuquerque, KY
United States

This shipment does not have an associated delivery  tracking number.                          

Order                                   

Sony  XVT3D15, SV 42-Inch 1080p 600 Hz Cinema 3D  LCD HDTV  with 3D Blu-ray Player and  Two Pairs of 3D Glasses
Sold by  onner
Condition:  used-new
        $594.65
Item Subtotal: $594.65
Shipping & Handling:   $22.34
Total Before Tax:      $594.65
Shipment Total:        $594.65                                            
Paid by  Discover:     $594.65                                                          
Returns are easy. Visit our ON-line Return Center.
If you need  urgent assistance with your order, please visit Merchant Contact Form.

We hope to see you again soon!
Amazon.com

Unless otherwise noted, items are sold by Amazon LLC. Learn more about tax and shop information.

This email was sent from a notification-only address that cannot accept incoming email. Please don't reply to this message.                     

                                                                                         
The malicious payload is at [donotclick]webgrafismo.net/detects/rates-event_convinced-sent.php hosted on a known bad IP address of 203.91.113.6 (G Mobile, Mongolia). The exploit kit is probably Blackhole 2 given it's characteristics.



If you can block this IP address then I strong advise it. Other malicious sites on the same IP include.

penel-opessong.com
sncahmn.com
xlzones.com
virtual-geocaching.net
afgreenwich.net
cedarbuiltok.net
sowendo.net
thebummwrap.net
allmn-leicncester.net
bode-sales.net
webgrafismo.net

Federal Tax Payment Spam / soisokdomen.ru

This fake tax payment spam leads to malware on soisokdomen.ru:

Date:      Thu, 20 Sep 2012 09:10:47 -0300
From:      Badoo [noreply@badoo.com]
Subject:      Re: Fwd: Tax Payment COM1684-645 is failed.

Hello,



Your Federal Tax Payment has been rejected.

Please, check the information and refer to Code I 94 to get details about

your company payment:



http://www.eftps.gov/section794/P9367027



JACINTA Stout,

The Electronic Federal Tax Payment System

The malicious payload (probably Blackhole 2) is at [donotclick]soisokdomen.ru:8080/forum/links/column.php hosted on the following familiar looking IP addresses:

213.135.42.98
50.56.92.47
203.80.16.81


Blocking these would be prudent.

ADP Spam / 69.194.192.203

This fake ADP spam email leads to malware on 69.194.192.203:

Date:      Thu, 20 Sep 2012 14:25:24 +0300
From:      "ADPClientServices" [ABD331056@losblancoba.com.ar]
Subject:      ADP Urgent Notification - Debit Draft

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services

The malicious payload is at [donotclick]69.194.192.203/links/deep_recover-result.php (probably Blackhole 2.0) hosted by Solar VPS in the US. This IP has been used for malware before recently, blocking it would be prudent.

UPS Spam / denegnashete.ru

This fake UPS spam (or is it USPS.. or LinkedIn?) leads to malware on denegnashete.ru:

Date:      Tue, 18 Sep 2012 08:01:39 +0100
From:      LinkedIn Connections [connections@linkedin.com]
Subject:      UPS: Your Package H7022585958
Attachments:     UPS_ID7683348.htm


You can use UPS Services to:

Ship Online
Schedule a Pickup
Open a UPS Team Account
      

Welcome to UPS CUSTOMER SERVICES

OI, [redacted].

Dear Customer , We were not able to delivery the postal package

Please print out the invoice copy attached and collect the package at our department.

Best Regards , UPS .com Customer Services.
  
      

Copyright 2011 United Parcel Service of America, Inc. USPS Services, the Your usps Customer Services brandmark, and the color brown are trademarks of United Parcel Service of America, Inc. All rights reserved.

Please do not reply directly to this e-mail. Your USPS .us Customer Services will not receive any reply message. For questions or comments, visit Contact UPS.

We understand the importance of privacy to our customers. For more information, please consult the USPS Team Privacy Policy.

This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.

The malware can be found at [donotclick]denegnashete.ru:8080/forum/links/column.php which is the same as found on this attack..   

"Scan from a Hewlett-Packard ScanJet" spam / denegnashete.ru

This fake printer spam.. or Craigslist spam.. leads to malware on denegnashete.ru:

From: craigslist - automated message, do not reply [mailto:robot@craigslist.org]
Sent: 18 September 2012 11:44
Subject: Re: Fwd: Scan from a Hewlett-Packard ScanJet #97273

A document was scanned and sent to you using a Hewlett-Packard HP18412598P


Sent to you by: SIDNEY
Pages : 7
Filetype(s): Images (.jpeg) View

Location: not set.
Device: P91162592KLLD

The malicious payload is at [donotclick]denegnashete.ru:8080/forum/links/column.php (report here) hosted on the same IPs as found here.

IRS spam / xlzones.com

More IRS themed spam, this time leading to malware on xlzones.com:

From: Internal Revenue Service [mailto:papillaq9@wonderware.com]
Sent: 18 September 2012 15:22
Subject: Your IRS federal tax payment has not been accepted
Importance: High


Your Federal Tax transaction (ID: 1550573369185), recently sent from your bank account was returned by The Electronic Federal Tax Payment System.
Not Accepted Tax transfer
Tax Transaction ID:     1550573369185
Reason ID    See details in the report below
Income Tax Transaction Report    tax_report_1550573369185.doc (Microsoft Word Document)

Internal Revenue Service P.O. Box 996 Davis 99627 NY 

The malicious payload can be found at [donotclick]xlzones.com/detects/char-storing-hate.php and [donotclick]xlzones.com/maintain/java.jar (report here) hosted on the familiar IP address of 203.91.113.6 (G Mobile, Mongolia). Block this IP if you can.. also beware of these other malicious domains on the same server:
centennialfield.net
blue-lotusgrove.net
virtual-geocaching.net
afgreenwich.net
cedarbuiltok.net
thebummwrap.net
bode-sales.net
cat-mails.net
xlzones.com

"Photos" spam / diareuomop.ru

This spam leads to malware ondiareuomop.ru:

From: Carleen Garrett
Sent: Tuesday, September 18, 2012 3:17:33 PM
Subject: Photos

Hi,
as promised your photos - http://flyershot.com/gallery.htm

The payload is at [donotclick]diareuomop.ru:8080/forum/links/column.php hosted on the following IPs:
50.56.92.47
203.80.16.81
46.51.218.71

These IPs are a subset of the ones found here. Block 'em if you can.

Intuit.com spam / kerneloffce.ru

This fake Intuit.com spam attempts to load malware from kerneloffce.ru:

Date:      Mon, 17 Sep 2012 08:54:50 -0600
From:      "Mason Jordan" [LillieRoell@digitalnubia.com]
Subject:      Your Intuit.com software order.
Attachments:     Intuit_Order_A49436.htm

Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-130-1601 ($4.79/min).
ORDER INFORMATION

Please download your complete order id #1197744 from the attachment.(Open with Internet Explorer)
�2012 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.

The malicious payload is at kerneloffce.ru:8080/forum/links/column.php which was hosted on 46.51.218.71 (Amazon, Ireland) until it got nuked. The following domains and IP addresses are all related:

moskowpulkavo.ru
omahabeachs.ru
kerneloffce.ru
46.51.218.71
50.56.92.47
62.76.188.246
62.76.190.50
87.120.41.155
91.194.122.8
132.248.49.112
178.63.51.54
203.80.16.81

IRS Spam / virtual-geocaching.net

This spam leads to malware on virtual-geocaching.net:

Date:      Mon, 17 Sep 2012 11:28:14 -0600
From:      Internal Revenue Service [tangierss4@porterorlin.com]
Subject:      IRS report of not approved tax transfer

Your State Tax transfer (ID: 30062091798009), recently sent from your checking account was returned by Internal Revenue Service payment processing unit.

Not Accepted Tax transaction
Tax Transaction ID:     30062091798009
Reason of rejection     See details in the report below
Federal Tax Transaction Report     tax_report_30062091798009.doc (Microsoft Word Document)

Internal Revenue Service 3192 Aliquam Rd. Davis 71320 VA 

The malicious payload is at [donotclick]virtual-geocaching.net/main.php?page=7de3f5c4200c896e (report here) on 203.91.113.6 (G Mobile, Mongolia) as used in this recent attack and several others.

IRS spam / thebummwrap.net

This fake IRS spam leads to malware on thebummwrap.net:

From: Internal Revenue Service [mailto:fascinatesh07@deltamar.net]
Sent: 17 September 2012 15:30
Subject: Your federal tax transaction has been not accepted


Your State Tax transaction (ID: 60498447771657), recently initiated from your bank account was canceled by The Electronic Federal Tax Payment System.
Not Accepted Tax transaction
Tax Transaction ID:     60498447771657
Rejection code    See details in the report below
Income Tax Transaction Report    tax_report_60498447771657.doc (Microsoft Word Document)

Internal Revenue Service Ap #822-9450 Cum Avenue Edmond 33020 MI

The malicious payload is at [donotclick]thebummwrap.net/main.php?page=7de3f5c4200c896e hosted on 203.91.113.6 (G Mobile Mongolia) which has been used several times recently for evil purposes.

At the moment, the following sites seem to be active on the server, all can be assumed to be malicious.

thebummwrap.net
centennialfield.net
blue-lotusgrove.net
afgreenwich.net
bode-sales.net
cat-mails.net
nitor-solutions.net

Spam with numbers and "hi" in it..

There seems to be a lot of this about today..

Date:      Mon, 17 Sep 2012 08:39:16 -0300
Subject:      Re: 89898877282500

Hi

The numbers vary in each email, from single digits to quite long sequences. The body text is always "Hi", nothing appears to be hidden or malicious in any way. One characteristic is that the recipient is not usually the one in the "To" field as the spam is using the BCC field to suppress recipients.


The emails are not harmful, but obviously there is something going on. One possibility is that this is a probing attack, where an outside source is attempting to enumerate live mailboxes or collate server responses for further use. A short email like this will get passed through many spam filters, so (for example) it could be that the attacker is looking for SMTP responses that indicate a real mailbox to spam again later rather than a dead one.





If you have any other ideas, then please share them in the Comments :)

ADP spam / 46.249.37.122

This fake ADP spam tries to load malware from 46.249.37.122:

From: ADP_Online_Invoice_DoNotReply@adp.com ADP_Online_Invoice_DoNotReply@adp.com
Date: 13 September 2012 14:29
Subject: ADP Invoice Reminder

Your latest ADP Dealer Services Invoice is now available to view or pay online at ADP Online Invoice Management .

To protect the security of your data, you will need to enter your ID and password, then click on Access your Online Invoice Management account.

Total amount due by September 13, 2012

$17202.04

If you have already sent your payment please disregard this friendly reminder and Thank you for choosing ADP.

Questions about your bill?

Contact David Nieto by Secure Mail.

Note: This is an automated email. Please do not reply. 

After clicking the link bouncing through a couple of redirectors, the victim ends up at [donotclick]46.249.37.122/links/systems-links_warns.php which appears to be generating a 404 error (although it could be fake). This could be a legitimate but hacked server as it is also the IP address for a proxy service called dutchprox.com. In any case, you might decide you want to block the IP just in case.

US Airways spam / blue-lotusgrove.net

A couple of samples of a fake US Airways spam email leading to malware on blue-lotusgrove.net:

Date:      Tue, 11 Sep 2012 15:32:42 -0300
From:      "US Airways - Reservations" [reservations@myusairways.com]
Subject:      Please confirm your US Airways online registration.
   
You can check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying internationally). Then, all you need to do is print your boarding pass and proceed to the gate.

Confirmation code: 592499

Check-in online: Online reservation details

Flight

6840    
Departure city and time

Washington, DC (DCA) 10:00PM

Depart date: 9/12/2012    

We are committed to protecting your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.

US Airways, 111 W. Rio Salado Pkwy, Tempe, AZ 85281 , Copyright US Airways , All rights reserved.

==========


Date:      Tue, 11 Sep 2012 23:29:14 +0700
From:      "US Airways - Reservations" [intuitpayroll@e.payroll.intuit.com]
Subject:      US Airways online check-in.

you {l2} check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying {l3}). {l4}, all you {l5} to do is print your boarding pass and {l6} to the gate.

confirmation code: {digit}

check-in online: online reservation details

flight

{digit}    
departure city and time

washington, dc (dca) 10:00pm

depart date: 9/12/2012    


we are committed to protecting your privacy. your information is kept private and confidential. for information about our privacy policy visit usairways.com.

us airways, 111 w. rio salado pkwy, tempe, az 85281 , copyright us airways , all rights reserved.

The malicious payload is at [donotclick]blue-lotusgrove.net/main.php?page=559e008e5ed98bf7 (report here) hosted on 203.91.113.6 (G Mobile, Mongolia), the same IP used in this attack. The following domains are on the same server, they can all be considered to be malicious:


padded.pl
spiki.pl
fruno.pl
nextbox.pl
omariosca.com
hemiga.com
decorera.com
seneesamj.com
unitmusiceditior.com
likenstendarts.com
flatbuzz.com
morepic.net
dushare.net
blue-lotusgrove.net
nitor-solutions.net
gsigallery.net
atfood.ru
indyware.ru
advia.kz
iowa.kz
autumn.kz
wet.kz

FedEx spam / dushare.net and gsigallery.net

Two fake FedEx campaigns today, with a format similar to the one found here but with different payload sites of dushare.net and gsigallery.net

In the first case, the malicious payload is at [donotclick]dushare.net/main.php?page=c82ec1c8d6998cf0 (report here) hosted on 203.91.113.6 (G Mobile, Mongolia). In the second case the payload is at [donotclick]gsigallery.net/main.php?page=2bfd5695763b6536 (report here) also hosted on 203.91.113.6.

The following domains are on the same server and should also be treated as being suspect.

padded.pl
spiki.pl
fruno.pl
nextbox.pl
omariosca.com
hemiga.com
decorera.com
seneesamj.com
obweesysho.com
unitmusiceditior.com
likenstendarts.com
flatbuzz.com
morepic.net
atfood.ru
indyware.ru
advia.kz
iowa.kz
autumn.kz
wet.kz
dushare.net
gsigallery.net

FedEx spam / studiomonahan.net

This somewhat mangled looking fake FedEx spam leads to malware on studiomonahan.net:

Date:      Thu, 6 Sep 2012 11:00:28 -0600
From:      BillingOnline@fedex.com
Subject:      Your Fedex invoice is ready to be paid now.

       
    FedEx Billing Online - Ready for Payment

        fedex.com        
       

<td wid="th="10"" rowspan="2">

Hello [redacted]
You have a new not paid bill from FedEx that is ready for payment.

The following ivoice(s) are ready for your review :

<table border-top="1px solid #000" solid="" #000"="" border-left="1px solid #ccc" border="-bottom="1px" height="55" width="473">
<td= class="resultstableheader">
Invoice Number
7215-17193


To pay or review these invoices, please sign in to your FedEx Billing Online account by clicking on this link: http://www.fedex.com/us/account/fbo

Note: Please do not use this email to submit payment. This email may not be used as a remittance notice. To pay your invoices, please visit FedEx Billing Online, http://www.fedex.com/us/account/fbo


Thank you,
Revenue Services
FedEx


   


    This message has been sent by an auto responder system. Please do not reply to this message.

The content of this message is protected by copyright and trademark laws under U.S. and international law.
Review our privacy policy. All rights reserved.

Subjects spotted so far include:

Pay your Fedex invoice online.
Your Fedex invoice is ready to be paid now.
Please pay your outstanding Fedex invoice.
Your Fedex invoice is ready.

The malicious payload is found at [donotclick]studiomonahan.net/main.php?page=2bfd5695763b6536 (report here) hosted on 206.253.164.43 (Hostigation, US). The server contains the following suspect domains which should also be blocked:

fireinthesgae.pl
joncarterlope.pl
storuofginezi.com
usagetorrenen.com
dinitrolkalor.com
comercicalinz.com
studiomonahan.net
globusbusworld.su
jordanpowelove.su
appropriatenew.su
cdfilmcounderw.su
studiomonahan.net

Nokia Lumia 920

This is nice. If you've been waiting a long time for Nokia to come up with something competitive in the smartphone market then the wait might be over, because the Lumia 920 is certainly as good as the best of them.

Perhaps the interesting thing is Windows Phone 8, based on the same core as the desktop version. It holds out the promise of eventual Active Directory integration and easier management for corporates. And it's a lot, lot sexier than a BlackBerry.

[via]

"Records passed to us show you're entitled to a refund.." SMS Spam (again)

These spammers are at it again:

Records passed to us show you're entitled to a refund approximately £2560 in compensation from mis-selling of PPI on your credit card or loan.Reply INFO or stop

The sending number is +447876628983 (although they will change this). Bearing in mind that I have never been mis-sold PPI, I can pretty much disregard this as a scam. Except, rather more seriously the implication is that the spammers are prepared to submit a fraudulent refund claim on your behalf, which is something rather more serious.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

Fake HMRC spam leads to multi-phish

Here's something I haven't seen before.. it starts with an email:

From: HM Revenue & Customs [mailto:refund.request@hmrc.gov.uk]
Sent: 05 September 2012 14:27
Subject: Tax Refund Alert - Action Required



How to complain, ask for a review or make an appeal
Review process update
Review process - the first 12 months. Find out more
Claim Your Tax Refund Online
We identified an error in the calculation of your tax from the last payment, amounting to £ 859.00. In order for us to return the excess payment, we need to confirm a few extra details after which the funds will be credited to your specified bank account. Please click "Refund Me Now" below to claim your refund:
Refund Me Now
We are here to ensure the correct tax is paid at the right time, whether this relates to payment of taxes received by the department or entitlement to benefits paid.
Best Regards,
HM Revenue & Customs Refund Department
•    See also
•    Appeal and review news
•    Working and paying tax
•    Pensioners
•    Find a form
•    Complaints factsheet C/FS (PDF 67K)
•    Feedback

HM Revenue and Customs are the UK tax collecting agency, so this is basically a tax refund. The link goes to a somewhat authentic looking page.

The phishing site in this case is in Korea (durideco.co.kr in this case). The interesting part is the drop-down menu in the middle that the victim is meant to use to select their bank. There are 17 different UK banks to choose from. Each one leads to an individual phishing page for each bank, for example:

or

I won't bother pasting all the pictures here, but some of the pages are very good and a few don't work at all (e.g. Northern Rock, which doesn't really exist any more).

This is quite a clever approach. Normally a phishing email is a "one bank per phish" affair.. it's no use sending someone a Barclays phish if they're with HSBC. In this case pretty much all the major UK banks are covered in one email which is really quite sneaky..

Something evil on 195.225.55.130

These domains are pushing some sort of malware or other (possibly fake antivirus). It's hard to tell exactly what nastiness is here, but given that these are all recently registered domains with fake WHOIS details then it's certainly not going to be anything good.

Whatever it is, it seems to be promoted via spam and requires the correct User Agents and Referrer data to trigger. Sites are hosted on 195.225.55.130 (Dako Systems, Netherlands)

spokanesimplified.org
safetygold.org
businsideessfolowinggate.org
reservetri.org
cardreform.org
swapopen.org
businessfolowingdoor.org
smokersinsurancelinesguns.org
smokerslifeonlinesguns.org
smokerslifeoverlinesguns.org
livesstorytiderss.org
wiredesert.org
mylittallbeizz.org
gunslinzmouses.info
criticstocks.info
largusliananumbers.info
livesstorytiders.info
mailhostsboot.info

LinkedIn spam / 108.178.59.26 and myasuslaptop.com

This fake LinkedIn spam leads to malware on 108.178.59.26 and myasuslaptop.com:

Date:      Tue, 04 Sep 2012 10:43:03 +0100
From:      "noreply" [noreply@linkedin.com]
Subject:      Link LinkedIn Mail

LinkedIn
REMINDERS

Invitation reminders:
• From Charlie Alexander (Mexico Key Account Director at Quanta)


PENDING MESSAGES

• There are a total of 5 messages awaiting your response. Visit your InBox now.

Don't want to receive email notifications? Adjust your message settings.

LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2012, LinkedIn Corporation.

The malicious payload (report here) is at [donotclick]108.178.59.26/bv6rcs3v1ithi.php?w=6de4412e62fd13be (Singlehop, US) in a block 108.178.59.0/26 suballocated to a person in Italy.  A further malicious download is attempted from [donotclick]myasuslaptop.com/updateflashplayer.exe which appears to be a legitimate (but hacked site).

My personal preference with any emails purporting to be from LinkedIn is to block them at the perimeter. As far as most businesses are concerned it is simply a playground for recruiters trying to poach your staff..

"QuickBooks Security Update" spam / roadmateremove.org

This fake Intuit spam leads to malware on roadmateremove.org:

Date:      Tue, 28 Aug 2012 11:04:30 -0400
From:      "Intuit Payroll Services" [intuitpayroll@e.payroll.intuit.com]
Subject:      QuickBooks Security Update

You will not be able to access your Intuit QuickBooks without updated Intuit Security Tool (IST™) after 31th of August, 2012.

You can update Intuit Security Tool here.

After a successful download please run the setup for an automatic installation, then login to Intuit Quickbooks online to check that it is working properly.

This email was sent from an auto-notification system that can't accept incoming email. Please don't reply to this message.

You have received this business communication as part of our efforts to fulfill your request or service your account.
You may receive this and other business communications from us even if you have opted out of marketing messages.

Terms, conditions, pricing, features, and service options are subject to change. View our complete Terms of Service.

The malicious payload is at [donotclick]roadmateremove.org/main.php?page=9bb4aab85fa703f5 (report here) hosted on 89.248.231.122 (Mastak Telecom / JSC Quickline, Russia) along with these other malicious sites:

roadmateremove.org
restoreairpowered.net
allhugedeals.net
classic-poems.net

You can pretty safely assume that 89.248.231.122 is a bad server and should be blocked.

"Federal Tax Payment" spam / videomanipulationccflbacklit.pro

This spam attempts to load malware from videomanipulationccflbacklit.pro although at the moment the domain is not resolving:

Date:      Mon, 27 Aug 2012 18:15:37 +0300
From:      "Internal Revenue Service" [irs@service.govdelivery.com]
Subject:      Federal Tax transaction canceled

Your Tax transaction (ID: 849395748011), recently sent from your checking account was canceled by the your financial institution.

Rejected Tax transfer
Tax Transaction ID:     849395748011
Return Reason     See details in the report below
FederalTax Transaction Report     tax_report_849395748011.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========

Date:      Mon, 27 Aug 2012 16:41:45 +0200
From:      "Internal Revenue Service" [irs@service.govdelivery.com]
Subject:      Rejected Federal Tax payment

Your Tax transaction (ID: 13394702616857), recently initiated from your bank account was returned by the your Bank.

Rejected Tax transfer
Tax Transaction ID:     13394702616857
Reason for rejection     See details in the report below
Tax Transaction Report     tax_report_13394702616857.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========


Date:      Mon, 27 Aug 2012 16:41:35 +0200
From:      "Internal Revenue Service" [support@govdelivery.com]
Subject:      Federal Tax payment canceled

Your Tax transaction (ID: 7227784606474), recently initiated from your bank account was returned by the The Electronic Federal Tax Payment System.

Rejected Tax transfer
Tax Transaction ID:     7227784606474
Reason for rejection     See details in the report below
FederalTax Transaction Report     tax_report_7227784606474.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

I've seen a few .pro domains in spam recently, but they seem to get shut down quite quickly. I thought this TLD was meant to have more careful vetting?

Malware sites to block 27/8/12

A small bunch of IPs and domains spotted in recent malicious spam campaigns that you might want to block..

24.171.200.91
50.116.38.138
89.248.231.122
109.164.221.176
173.234.9.17
184.107.119.39
199.167.138.113
200.29.107.84
allbooksbest.com
allhugedeals.net
basicsmarkeddown.pro
bikeslam.net
classic-poems.net
markelink.net
market-panel.net

UPS "End of Aug. Stat. Required" Spam / panalki.ru

This fake UPS spam leads to malware on panalki.ru:

Date:      Fri, 17 Aug 2012 06:50:08 -0400
From:      "Global Express" [ups-services@ups.com]
Subject:      Re: FW: End of Aug. Stat. Required
Attachments:     Invoices-26-2012.htm

Hallo,

as reqeusted I give you inovices issued to you per july.

Regards

The malicious payload is at [donotclick]panalki.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on a bunch of familiar looking IP addresses which should be blocked if you can.

50.56.92.47 (Slicehost, US)
190.120.228.92 (Infolink, Panama)
203.80.16.81 (Myren, Malaysia)

"Scan from a Hewlett-Packard ScanJet" spam / anapoli.ru

More fake printer spam, this time leading to malware on anapoli.ru:

Date:      Thu, 16 Aug 2012 12:20:25 +0500
From:      Mariah Gunn via LinkedIn [member@linkedin.com]
Subject:      Fwd: Scan from a Hewlett-Packard ScanJet #88682504
Attachments:     HP_scanDoc.htm

Attached document was scanned and sent



to you using a Hewlett-Packard HP 90027P.

SENT BY : SAVANNAH
PAGES : 1
FILETYPE: .HTML [Internet Explorer File]

The malicious payload is on [donotclick]anapoli.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on a bunch of familiar looking IP addresses:
50.56.92.47 (Slicehost, US)
190.120.228.92 (Infolink, Panama)
203.80.16.81 (Myren, Malaysia)

mskoblastionline.ru - malicious spam goes nuts

The malicious spam pushers are trying very hard today to drive traffic to their malware site on mskoblastionline.ru with a variety of familiar-looking spam emails:

Date:      Wed, 15 Aug 2012 01:20:05 -0400
From:      CarinaRue@mail.com
Subject:      Fwd: Wire Transfer (1408EA58)
Attachments:     Wire_Transfer_N839.htm

Dear Operator,

WIRE TRANSACTION: AC-961141236714971

STATUS: CANCELLED

You can find details in the attached file.

==========

Date:      Wed, 15 Aug 2012 10:51:49 -0500
From:      "LEILANI Roe" [RoeRmLEILANI@hotmail.com]
Subject:      Fwd: Re: Wire Transfer Confirmation
Attachments:     Wire_Transfer_N839.htm

Dear Operator,

WIRE TRANSACTION: AC-6427060719674502

STATUS: CANCELLED

You can find details in the attached file.

==========


Date:      Wed, 15 Aug 2012 12:31:44 +0300
From:      sales1@victimdomain.com
Subject:      Re: Your Flight US 34-4827
Attachments:     FLIGHT_TICKET_US1650023.htm

Dear Customer,

FLIGHT NUMBER 42463-8276

DATE/TIME : SEPT 27, 2012, 11:12 PM

ARRIVING AIRPORT: SAN-DIEGO AIRPORT

PRICE : 449.06 USD

Your bought ticket is attached to the letter as a scan document .

To use your ticket you should print it.

ESMERALDA KNUTSON,

==========

Date:      Wed, 15 Aug 2012 08:06:14 +0100
From:      Collene Varner via LinkedIn [member@linkedin.com]
Subject:      Fwd: Re: Your Flight US 65-46595
Attachments:     FLIGHT_TICKET_US284399461.htm

Dear Customer,

FLIGHT NUMBER 4108-2738

DATE/TIME : SEPT 21, 2012, 10:15 PM

ARRIVING AIRPORT: SAN-DIEGO AIRPORT

PRICE : 083.97 USD

Your bought ticket is attached to the letter as a scan document .

To use your ticket you should print it.

Abeni PINA,

==========

Date:      Wed, 15 Aug 2012 00:50:03 -0800
From:      LinkedIn [welcome@linkedin.com]
Subject:      Fwd: Better Business Bureau Complaint
Attachments:     Complaint_ID45JG836043169.htm

Good afternoon,

Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 1630630165) from a customer of yours in regard to their dealership with you.

Please open the COMPLAINT REPORT attached to this email (open with Internet Explorer/Mozilla Firefox) to view the details on this issue and suggest us about your position as soon as possible.

We hope to hear from you shortly.

Regards,

KARRI PENA

Dispute Counselor

Better Business Bureau

==========


Date:      Wed, 15 Aug 2012 04:02:26 +0600
From:      Ashley Madison [donotreply@ashleymadison.com]
Subject:      Re: Better Business Bureau Complaint
Attachments:     Complaint_N35XL147712.htm

Good afternoon,

Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 63959031295)
from a customer of yours in regard to their dealership with you.

Please open the COMPLAINT REPORT attached to this email (open with Internet Explorer/Mozilla Firefox) to view the details on this issue and suggest us about your position as soon as possible.

We hope to hear from you shortly.

Regards,

CONNIE DORAN

Dispute Counselor

Better Business Bureau

==========

Date:      Wed, 15 Aug 2012 05:31:19 -0500
From:      LinkedIn Connections [connections@linkedin.com]
Subject:      Re: Fwd: Better Business Bureau Complaint
Attachments:     Complaint_ID61Zu4932887.htm

Good afternoon,

Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 501379901) from a customer of yours in regard to their dealership with you.

Please open the COMPLAINT REPORT attached to this email (open with Internet Explorer/Mozilla Firefox) to view the details on this issue and suggest us about your position as soon as possible.

We hope to hear from you shortly.

Regards,

Romeo Keyes

Dispute Counselor

Better Business Bureau

The malicious payload is at [donotclick]mskoblastionline.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following IPs:


50.56.92.47 (Slicehost, US)
190.120.228.92 (Infolink, Panama)
203.80.16.81 (Myren, Malaysia)


The following IPs and domains are all connected and should be blocked:
50.56.92.47
190.120.228.92
203.80.16.81
spb-koalitia.ru
gorysevera.ru
sergikgorec.ru
mskoblastionline.ru
kefrikin.ru
pussyriotss.ru
ashanrestaurant.ru
panamamoskow.ru
mirdymas.ru

"Federal Tax" spam / wireframeglee.info

This tax-themed spam leads to malware on wireframeglee.info:

Date:      Tue, 14 Aug 2012 15:21:33 +0200
From:      "Internal Revenue Service" [alerts@irs.gov]
Subject:      Rejected Federal Tax transfer

Your Tax payment (ID: 38969777924999), recently sent from your checking account was returned by the The Electronic Federal Tax Payment System.

Rejected Tax transaction
Tax Transaction ID:     38969777924999
Return Reason     See details in the report below
Tax Transaction Report     tax_report_38969777924999.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========

Date:      Tue, 14 Aug 2012 13:31:21 +0000
From:      "Internal Revenue Service" [support@irs.gov]
Subject:      Federal Tax payment canceled

Your federal Tax payment (ID: 903463682456), recently from your bank account was rejected by the your financial institution.

Rejected Tax transfer
Tax Transaction ID:     903463682456
Reason of rejection     See details in the report below
FederalTax Transaction Report     tax_report_903463682456.doc (Microsoft Word Document)


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

==========


Date:      Tue, 14 Aug 2012 14:42:19 +0200
From:      "Internal Revenue Service" [noreply@irs.gov]
Subject:      Your Federal Tax transaction

Your Tax transaction (ID: 80110764248536), recently initiated from your checking account was returned by the your Bank.

Canceled Tax transaction
Tax Transaction ID:     80110764248536
Reason of rejection     See details in the report below
FederalTax Transaction Report     tax_report_80110764248536.doc (Microsoft Word Document)

Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

The malicious payload is at [donotclick]wireframeglee.info/main.php?page=39630332cf486f5a (report here) hosted on 78.87.123.114 (CYTA, Greece) which has been seen several times lately and should be blocked if you can.

"We can not charge your credit card" spam / kefrikin.ru

This spam pretends to be from Amazon. Or UPS. Or perhaps both. Anyway, it leads to malware on kefrikin.ru:


Date:      Tue, 14 Aug 2012 05:26:05 +0200
From:      "ups" [mail@ups.com]
Subject:      We can not charge your credit card
Attachments:     Amazon_Invoice.htm

    Your Account | Help
Your credit card was blocked.
We tried to withdraw money from your credit card, but your bank decline it. In the attachment you will be found a invoice from your last order. Please pay this invoice as soon as possible.

Conditions of Use Privacy Notice � 1996-2012, Amazon.com, Inc. or its affiliates

The attachment Amazon_Invoice.htm is malicious and it attempts to download a malicious script from [donotcick]kefrikin.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following IPs (which have all been used for malware distribution several times):

190.120.228.92
199.71.212.78
203.80.16.81

Even more malware sites to block on 194.28.115.150

More evil sites to block on 194.28.115.150 (Specialist ISP) following on from these:

idi42nga.rr.nu
kprud89entia.rr.nu
hin66gof.rr.nu
iste03dengi.rr.nu
hing30emplo.rr.nu
ize84dso.rr.nu
ind42icat.rr.nu
lack33andw.rr.nu

"Scan from a Xerox WorkCentre Pro" spam / mirdymas.ru

This spam leads to malware on mirdymas.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn Password
Sent: 13 August 2012 08:59
Subject: Fwd: Re: Re: Scan from a Xerox WorkCentre Pro #9484820

A Document was sent to you using a XEROX WorkJet OP578636.


SENT BY : JIN
IMAGES : 1
FORMAT (.JPEG) DOWNLOAD

DEVICE: 109A62DS953L

The malicious payload is at [donotclick]mirdymas.ru:8080/forum/showthread.php?page=5fa58bce769e5c2 (report here) hosted on the following familiar IP addresses:

46.51.218.71 (Amazon, Ireland)
71.89.140.153 (Cloudaccess.net, US)
203.80.16.81 (Myren, Malaysia)

Blocking access to these IPs will prevent other malicious sites on the same servers from being a problem.

Something evil on 178.63.195.128/26

The IP address range 178.63.195.128/26 nominally belongs to grey hat host Hetzner in Germany, although it has been reallocated to a registrant in Israel. This block recently came up as the source for a ZeroAccess infection picked up from 178.63.195.170.

A look at the 178.63.195.128/26 range (178.63.195.128 - 178.63.195.191) shows several suspicious websites with domains apparently generated by DoItQuick (more info here). Most of the domains are too new to have any reputation, although given the live distribution of malware and the randomly chosen names then they are unlikely to be doing anything nice.

Also, I notice that quite a lot of suspect sites have recently been moved from this range to point at 127.0.0.1 instead, a common trick when malcious domains needs to be pointed somewhere else quickly.

The registrant for this block is:

 inetnum:         178.63.195.128 - 178.63.195.191
netname:         R5X
descr:           r5x
country:         DE
admin-c:         TG3863-RIPE
tech-c:          TG3863-RIPE
status:          ASSIGNED PA
mnt-by:          HOS-GUN
source:          RIPE # Filtered

person:          Tomas Gailiavicius
address:         r5x
address:         Kalinina 47-71
address:         188760 Priozersk
address:         RUSSIAN FEDERATION
phone:           +79876960550
nic-hdl:         TG3863-RIPE
mnt-by:          HOS-GUN
source:          RIPE # Filtered

178.63.195.163
altspanning.org
atherosplaylists.org
betasreceivable.org
bringsgrade.org
contenderfilesplitting.org
csidisengage.org
designercomcast.org
encouragesprosuite.org
excellentinvolving.org
firefoxorbitz.org
harvardhqv.org
journalcleanup.org
musicmakingranging.org
ndascontinuum.org
netbiosmediocre.org
originatingcomplicated.org
outlinedpart.org
pantspool.org
preciselycolormatching.org
rantcloned.org
sciencehearted.org
splitnearparent.org
threeparagraphrequirements.org
undeniableblues.org
upscalingfinalproduction.org
vhsintellectual.org
violationsmazes.org
weekendshadows.org
wellthoughtoutestablish.org
workforcefortunately.org

178.63.195.167
builtvaults.org
crystaljacket.org
photomanagementheadhunternet.org
spywareonlyadept.org
starshapedoutstanding.org
static-globe.info

178.63.195.168
bentowe.org
catchespayoff.org
connect4free.in
dvstitems.com
eeechock.org
flyeralone.info
flyersregard.com
free2connect.org
free4connect.org
hatssystem.org
internalpackaged.info
interviewsyamaha.org
operateriot.org
packageswml.info
playerhill.info
successfulmpfs.org
tetrisbroaden.com
zippedjump.com

178.63.195.170
abroad.name
cloud18.name
crimson25.name
dr4ms.name
du5t.name
fakejoke.name
fastservice.name
hlops.name
r0cket.name
ramaro.name
sameday.name
strongalc.name

178.63.195.171
bedtimeblues.org
book-placed.info
bookpart.info
bookpedias.info
bookposters.info
bookposts.info
builderviral.org
jeat-services.info
jeatservices.info
jeatstore.info
jetpremiums.info
jetsbookings.info
krym-house.info
krym-invest.info
krym4x4.info
krymvip-avto.info
krymzakupka.info
netledgerstumblrs.org
teatr-benefis.info
teatrbilet.info
teatrflowers.info
teatrglas.info
teatrgroup.info
trust-spb.info
truthbearers.info
trutrance.info
trworkshop.info
tryfxdata.info

Also these domains appear to be deactivated by pointing them to 127.0.0.1, but you might want to block them just in case:
addonsthoughultrasharp.info
adjustmentsmarginal.info
affectingmacrobiotics.org
alternatelylaughs.info
amalgamie.org
androidstwothirds.info
appleawardwinningstarshaped.info
attractionintrusive.org
aufdeal.info
blurbswatermarks.org
boltsmaking.info
caligarisflipboard.org
circlekidlandias.org
citegologo.org
cleanerspreview.info
collagesenjoyed.info
compensateversamail.info
computercontrolledtelsurf.info
conducivesnag.org
createasimfreemium.info
criesvendor.info
csspoets.info
curiousrebuilding.info
deletingpricelinecom.org
dependentssecond.org
desksorganize.org
didcontinuous.org
discoveredshuts.info
discussioncommentingmonths.info
disqushomepremier.info
embracedpreset.info
endurancescream.info
enforcesfinetune.org
epublishingtodays.info
exploredestabilized.info
extendscrosscountry.org
feedsproxystyle.org
filesyncingenigmatic.org
founderslogin.info
friendshipinterrupt.org
grandmasterpre.org
gunsgml.info
heftyends.info
idlpatterns.org
inboxtie.org
inputsecho.info
invoicedimplementations.info
javacentricunencumbered.org
kevinverizon.info
legalzoomspeak.org
licensedcrispest.org
likingmodule.info
lingeriegiftgiving.org
lodebombermonster.org
machinesruns.info
merchandiseorderingcommerce.org
mixedprone.info
mobileslockeddown.org
mouthmindmanager.org
mydocumentsredirected.info
myspaceatsale.org
namepasswordcobble.info
nanimatedpaperclip.info
notificationloose.org
obihaiwebfriendly.org
omissioncurve.info
onboardstougher.info
onchipimpressively.info
oneoffsynched.info
outshineresearcher.info
ownorcleared.info
pairautoupdate.info
permittighter.org
pimsluernarrating.info
programundo.org
realarcadeextranet.org
reallifeinformation.org
referjustifies.org
relinquishfloated.org
removersitevalidation.info
resettingeyeopening.info
ripoffsfliers.info
roadtripearlier.info
rocfloating.org
sanknowledge.info
selfemployedspeed.info
sierrastorms.org
silenceshalls.info
softpedalswav.info
solitaryorions.org
southmouse.org
specimenfortunate.info
spellingsurfinshield.info
sportsbare.info
stateforbid.org
staticmarkets.org
steveapprovals.org
stumbledunrooted.info
stylizeawarded.info
submenusonlineoriented.info
supplantbriefly.org
suspendersnine.org
textuallythrifty.org
tiabberation.info
touchtypinglower.org
treasuregiftgiving.org
turningcustomized.info
underlinedavira.org
uniquenesstrademarks.info
visibilityprerecorded.info
wavernewlyminted.org
wellasideallotted.org

More malware sites to block on 184.82.162.163 and 184.22.103.202

These domains are on 184.82.162.163 and 184.22.103.202, recently used in some injection attacks.

local-dns.org
lertionk15.be

More malware sites to block on 54.245.115.106

More bad stuff in Amazon's cloud, this time on 54.245.115.106  which already hosts these other malware sites. Block the IP if you can, else block these news domains in addition to these.

fbqdazvojhyc.info
mrqfxznhke.info
wcgqelbpvdn.info
hbiewmkjdytr.info

More malware sites to block on 81.17.24.69

A follow up to this post, 81.17.24.69 (Private Layer Inc, Switzerland) now hosts some additional malware domains that you should block if you can't block the IP address:

ose-para-tek-ines.org
oseparatekines.org
ose-para-tek-ines.net

Intuit.com spam / ashanrestaurant.ru

This fake Intuit spam leads to malware on ashanrestaurant.ru:

Date:      Fri, 10 Aug 2012 09:03:06 -0300
From:      Ashley Madison [donotreply@ashleymadison.com]
Subject:      Your Intuit.com software order.
Attachments:     Intuit_Order-N15090.htm

Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-364-2935 ($1.29/min).
ORDER INFORMATION
Please download your complete order id #3262340 from the attachment.(Open with Internet Explorer)
�2012 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.

The malicious payload is at [donotclick]shanrestaurant.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following familiar-looking IPs that should be blocked if you can:

203.80.16.81
190.120.228.92

"Verify your order" / yrikdhxzwo.org

This spam leads to malware on yrikdhxzwo.org:

Date:      Fri, 10 Aug 2012 13:43:57 +0200
From:      "New order" [8A4EDCFB@williamsvilla.com]
To:      [redacted]
Subject:      Verify your order

Dear [redacted],

please verify your order #809910 at http://simplythebestevents.com/wp-content/plugins/mm-forms-community/upload/temp/tracking17948.php?user_id=[redacted]&order_id=8D17821C359

We hope to see you again soon!

The malicious payload is at [donotclick]yrikdhxzwo.org/main.php?page=3f19233d6515cd5d (the payload is defying analysis at the moment), hosted on 54.245.115.156 (Amazon, US). The domain btgjoulrys.info is also on the same server and can be safely assumed to be malicious.

Fake job domains 10/8/12

A bit of an oddity here - I noticed a marked uptick in people searching for very old fake job domains that had expired. It turns out that the scammers are back (probably the Lapatasker crew), and lazily they have just re-registered their old domains. Current ones doing that rounds that you should avoid are:

americafindjob.com
arbetase.com
career-depart.com
careerin-finance.com
espanajob.com
eurojobbnet.com
eurojobcouk.com
eurojobscouk.com
europ-consult.com
jobbankinusa.com
readycarts.com
top10jobbs.com
ukitcareer.com
usaitcareers.com

wetter.com compromised? oseparatekines.net and 81.17.24.69

The weather site wetter.com is the 25th most popular site in Germany (and nukber 602 in the world) according to Alexa.

Right at the moment there appears to be a compromised ad being served up by billabong3.wetter.com  redirecting to a exploit kit on [donotclick]oseparatekines.net/forum/index.php?showtopic=903878 hosted on 81.17.24.69 which is apparently hosted in Switzerland, belonging to a small netblock as follows:

inetnum:         81.17.24.64 - 81.17.24.95
netname:         CLIENT2391
descr:           CLIENT2391
country:         CH
admin-c:         JP5315-RIPE
tech-c:          JP5315-RIPE
status:          ASSIGNED PA
mnt-by:          KP73900-MNT
source:          RIPE # Filtered

person:          James Prado
address:         Torres De Las Americas Torre C Floor 29 Suite 2901 Panama City, Panama
phone:           +5078365602
nic-hdl:         JP5315-RIPE
mnt-by:          KP73900-MNT
source:          RIPE # Filtered

route:           81.17.16.0/20
descr:           Ripe Allocation
origin:          AS51852
mnt-by:          KP73900-MNT
source:          RIPE # Filtered

The following domains are hosted on that IP address and you should assume they are malicious:
pilotjobsingrash.org
oseparatekines.org
onlineswotchers.org
fishersmansslow.org
oseparatekines.com
swstockhers.com
pilotjobsingrash.in
pilotjobsingrash.info
webswedish.info
oseparatekines.net
onlineswotchers.net

The entire 81.17.24.64/27 range looks suspicious in my opinion. Blocking that range would probably be prudent.

You can see the full script that is being used in the attack here - http://pastebin.com/CMuUm05f

Yet more malware sites to block on 194.28.115.150

Another batch of malware sites to block on 194.28.115.150 following on from these.. although to be franking, blocking access to 91.211.200.0/22  and 194.28.112.0/22 (Specialist ISP) plus all .rr.nu domains would be even better.

uresre17covered.rr.nu
ented89cable.rr.nu
erstor69msconse.rr.nu
gph46ili.rr.nu
nsu83lti.rr.nu
entl77ymail.rr.nu
rren48tlyvo.rr.nu
ersinq54uiries.rr.nu
sgradu88atevis.rr.nu
arrayt78emperat.rr.nu
ieddis18tribut.rr.nu