"JavaRealm Software" job offer scam

JavaRealm Software (javarealm.com) is a wholly legitimate software development company from the Ukraine. This fraudulent job offer uses the "JavaRealm" name and the name "Sergey Skugarev" which does appear to be similar to an employee of JavaRealm who is not involved in this scam.

---

Subject: looking for employees

Hello Sir/Madam.

I Sergey Skugarev, Director of JavaRealm Software specializes in innovative IT solutions and complex software projects development.

My company based in Ukraine. We've earned ourselves a reputation of a reliable and trustworthy partner working successfully with a number of West European companies and providing them with reliable software development services in financial and media sectors. Unfortunately we are currently facing some difficulties with receiving payments for our services. It usually takes us 10-30 days to receive a payment and clearing from your country and such delays are harmful to our business. We do not have so much time to accept every wire transfer.

That's why we are currently looking for partners in your country to help us accept and process these payments faster. If you are looking for a chance to make an additional profit you can become our representative in your country. As our representative you will receive 8% of every deal we conduct. Your job will be accepting funds in the form of wire transfers and forwarding them to us. It is not a full-time job, but rather a very convenient and fast way to receive additional income. We also consider opening an office in your country in the nearest future and you will then have certain privileges should you decide to apply for a full-time job. Please if you are interested in transacting business with us we will be very glad.

Please contact me for more information via email: javarealm.jobinfo@gmail.com

and send us the following information about yourself:

1. Your Full Name as it appears on your resume.
2. Education.
3. Your Contact Address.
4. Telephone/Fax number.
5. Your present Occupation and Position currently held.
6. Your Age

Please respond and we will provide you with additional details on how you can become our representative. Joining us and starting business today will cost you nothing and you will be able to earn a bit of extra money fast and easy. Should you have any questions, please feel free to contact us with all your questions.

Thank you,
Sergey Skugarev ,
JavaRealm Software

---

This is a straightforward money mule scam. We have seen this type of scam targeting Ukranian companies before, here and here. Avoid this one at all costs.

Stupid but sophisticated "Lloyds TSB" phish

Spammers are generally pretty stupid. This particular phish looks pretty normal to being with:

Customer Service department
Lloyds TSB Bank
September 26th, 2008


To all business and personal customers

We would like to inform you about recent change in Lloyds TSB terms and conditions of banking services. Lloyds TSB has updated terms and conditions for both business and personal customers. Each customer should read and accept current terms and conditions.
Failure to accept new terms and conditions may lead to blocking of current services. Such as loans, credit cards, online banking, savings accounts, bill payments. Take a moment to read through new terms and conditions. There are two convenient ways to request updated terms and conditions. You can request them by mail or use online banking to confirm the new terms of service. Please follow the link below to review and confirm updated terms and conditions.
www.lloydstsb.com/terms

Thank you for banking with the most trusted UK bank,
Lloyds TSB Customer Service Team

We know that this is a phish because a) it was sent to a harvested address and b) Lloyds TSB don't send out emails like this. So a typical next step would be to check the source code to find where the phishing site is.

So the only hypertext link in the document is to http://www.lloydstsb.com which is the real Lloyds TSB bank. A closer look shows an attempted image load from http://lloydstlb.com/images/logo_lloydstsb.gif which is the phishing site hosted on a botnet. The domain is registered to BIZCN.COM who seem to have taken over this sort of business from Estdomains.

The fake site looks pretty convincing.. even if no-one will click through to it.

The login screen looks authentic too.

The next step looks exactly like the genuine login. The "memorable information" prompt asks for 3 letters from a longer passphrase, specifically letters 1, 3 and 5.

But guess what, when you enter the information it tells you that you did it incorrectly and asks for letters 2, 4 and 6 instead. So now they have letters 1-6.

Blah blah blah..

But what's this at the bottom? Yup, more characters from the memorable phrase are needed..

Finally, a confirmation:
So, like many modern phishing sites the actually web site is very credible looking, even the domain name looks reasonable if you only glance at it. Fortunately for the intended victims, the idiots have messed up the spam and.. this time at least.. nobody will get this far.

"App LLC Group." scam

Another ridiculously worded scam job offer, essentially identical to this one.

Subject: How for short time to earn $1200 in a week? Read!

"Sucky sucky long time five dollar" to you too.

HELLO EVERYONE!

Woot!

Please take your time and read about this genuine offer, job position.Make money
spending only few hours a day, if you are located in Australia! This position either
can replace your current job, or can be as an extra income for you. Denmark
successful company - Apple Sales Group brought this opportunity for you.
Advertisement itself is brought to you via Google ads (Paid advertisement, assigning
e-mail business account). The most convenient and smart position for anybody who has
couple hours a day, Monday-Friday. You will be able to make 1400+ AUD a week! It's
either - you do want to participate in this, or - you do not, that's what makes it a
genuine offer and worth reading and finding out more. If you meet requirements - do
not hesitate to receive full information:

1400 AUD? You said $1200 a moment ago. Are we talking US$ or AU$? At least I know it's "Genuine" because you said so twice. Shame about the really bad English, all the Danish people I know speak English very well.

*You are 18+ y/o
*You are Reliable and Enthusiastic person.
*You Have 2-3 Hours a Day of Your Spare/Free Time, Monday-Friday(Saturday).
*You Are Located in United Kingdom/Ireland.
*You Have Access to Internet 2-3 Hours A Day, Monday-Friday(Saturday).

Didn't you just say Australia? These are different countries, you know.

Reference:
"The Most Creative Opportunity of The Month" - "Two Time" Magazine, quote by Angela
Roer.
"Consider This Opportunity" - "Behind The Truth" Magazine, quote by Marcus Stowee.

"I can't believe I was so stupid" - "State Penitentiary newsletter", quote by hapless money mule victim.

To receive full information reply only to e-mail: apple.swed404@gmail.com
with subject "More Information" and one of our representatives will assist you
shortly.
Thank you for your interest and Good Luck!


Best Regards,
App LLC Group.

Apple.Swed404? Sweden? I thought you said you were based in Denmark? App LLC? That wasn't the company name you gave earlier.

Originating IP is 95.57.7.182 in Kazakhstan. That country has featured in these fake job offers before (here and here).

"Recovery KEYS for your account" trojan

Another day, another ZIP-in-EXE trojan with a lot of spaces in it.

Subject: Recovery KEYS for your account

Good afternoon, [victim]

There are the keys to recover your personal account. In order to use them later,
please, preserve them in a sure place.

Sincerely, Dick Riddle

Attachment: the_Keys.zip

The ZIP files contains an EXE that looks like a Word document, The_Keys.doc[88 spaces].exe. Worryingly, VirusTotal detects nothing at all. The trojan is cleary related to this one and this one.

"Colorado Business Bank - Network Security and Monitoring"

These banks get more obscure all the time, but still carry the same sort of malicious payload.

---

Subject: Colorado Business Bank - Network Security and Monitoring
From: "Colorado Business Bank Account Service" alert@cobizbank.com

COLORADO BUSINESS BANK NOTICE:

Colorado Business Bank has registered our secure Web sites with VeriSign and use VeriSign Server IDs.
VeriSign Server IDs enable you to verify the authenticity of our secure Web site and to communicate with our Web site securely via SSL (Secure Sockets Layer) encryption.

Proceed to customer service department>>

Sincerely, Everett Torres.
Copyright - Colorado Business Bank, a part of COBIZ BANK.

---

VirusTotal detections are the usual mixed bag. Most detections seem to be generic (e.g. W32/Packed_FSG.D, TR/Crypt.FSPM.Gen, Trojan.Win32.Packed.gen, TrojanDownloader:Win32/Suceret.gen!A)

Dating scams and 79.135.168.*

We've seen this type of dating scam several times before. No good will come of engaging "Chantel" in conversations as she doesn't really exist. It will be some fat sweaty Russian bloke probably.

Subject: hi from chantel

hello, I am pretty russian girl, bored tonight.
would you like to chat with me and see my pics?
if so then email me at echantel39@officialsup.com

This is hosted on 79.135.168.36 which has been fingered before for fraud. Allegedly, the netblock is registered to an outfit in the Lebanon:

inetnum: 79.135.168.0 - 79.135.168.255
netname: LB-NET
descr: Lebanon private dedicated service
country: LB
admin-c: MHB1111-RIPE
tech-c: MHB1111-RIPE
remarks: abuse mailbox: moh.b@lubnannetworks.biz
status: ASSIGNED PA "status:" definitions
mnt-by: SISTEM-NET-MNT
source: RIPE # Filtered

person: Mohamed Baga
address: Basha Garden bldg, 5th floor LB
address: Jisr El Bacha Main Road
address: Beirut - Lebanon
e-mail: moh.b@lubnannetworks.biz
remarks: abuse mailbox: moh.b@lubnannetworks.biz
phone: +961 1 512341
nic-hdl: MHB1111-RIPE
source: RIPE # Filtered

% Information related to '79.135.160.0/19AS44097'

route: 79.135.160.0/19
descr: Sistemnet Telecom
origin: AS44097
mnt-by: Sistem-Net-MNT

But just a few IP addresses away is another netblock that we have seen before in Turkey. The whole netblock is a complete sewer and is listed on the Spamhaus DROP List. There are 2000+ domains in this /24 block, but just for brevity I will list the ones on this server - avoid them all.

• Abgol.com
• Amnocx.com
• Bestsup.com
• Cahla.com
• Cardrealc.com
• Centralrd.com
• Direktmal.com
• Equipyard.com
• Escitatop.com
• Eupoc.com
• Ezshl.com
• Firstlam.com
• Flasheon.com
• Flhnation.com
• Flhplanet.com
• Flhsupplies.com
• Freeldp.info
• Gbizc.info
• Gbladx.info
• Gblhome.info
• Gblwizard.info
• Golbalhobby.com
• Goldenttamil.com
• Goldirecto.com
• Goldpug.info
• Golguia.com
• Golmundo.com
• Golottoclub.com
• Golsitio.com
• Goltierra.com
• Gosfordw.com
• Hlgag.com
• Hollandlopflags.com
• Hyperlam.com
• Jenniferlop.com
• Jflyik.com
• Ldphome.info
• Ldpwizard.info
• Lgbidxx.info
• Lopguide.com
• Meinmal.com
• Miniplushlop.com
• Modhl.com
• Morerd.com
• Moresup.com
• Nitgbx.info
• Officialflh.com
• Officialgbl.info
• Officialldp.info
• Officialshl.com
• Officialsup.com
• Oldpee.info
• Onlineflh.com
• Onlineshl.com
• Onlinesup.com
• Pacanimal.com
• Planetflh.com
• Planetsup.com
• Rdplanet.com
• Revaloplast.com
• Shemalglobal.com
• Shlcentral.com
• Shlnation.com
• Shlsupplies.com
• Shlwizard.com
• Solidgoldent.com
• Soundevelop.com
• Superldp.info
• Superlop.com
• Supplanet.com
• Supwizard.com
• Tapthelop.com
• Theloppet.com
• Upflyp.com
• Uplea.com
• Virtualldp.info
• Virtualsup.com
• Virtuellmal.com
• Wildevelop.com
• Wildpin.info
• Worldpivot.info
• Worldplayservices.info
• Yourldp.info
• Yourlopmen.com
• Yourloprabbit.com

Namesevers are NS1.DROREAL.COM and NS2.DROREAL.COM, both on 79.135.168.36.

"Apollo Business Services" / scam job offer

Spammers are stupid. This job offer scam combines two different offers, both of which are fraudulent. Part one is for "Apollo Business Services". Check out the very strange disclaimer on the bottom.

---

Subject: job offer for you. thanks
From: "Worldmarkettusew" worldmarkettusew@gmail.com

Apollo Business Services part-time opportunity (40/hr)
Dear ,

Apollo Business Services company was established in 2004 by an international team
of financial and marketing experts. We specialize in delivering positive business
results through solving currency exchange problem as well as online payments and
transactions, their tools being innovative solutions, high performance and e-commerce
optimization techniques.

We offer a "work at home" part-time position "Regional Manager". This includes
processing payments between our partners' clients and our company, ensure all personal
data relating to customers is maintained, accurate and kept discreet, identifying
opportunities to improve service delivery.

Position Type: Permanent.
Working hours: 9:00AM - 1:00PM weekdays. Variable overtime is also required.
Occupation Type: part-time (1-5 hours a day occupation).
Salary: $40 per hour.

Professional qualities and skills:

* Scrupulous and diligent;
* Computer literate;
* Good organizational and administrative skills;
* Payment procedures prior experience would be an asset;
* Ability to work independently.

Please REPLY to this e-mail to receive further information and application forms.

Yours sincerely,

Robert Hughley,
HR Manager,
Apollo Business Services
You are receiving this employment opportunity email because you uploaded your resume on CareerBuilder. This email is used for hiring process only to prevent the company from spam messages.
If your employment status has changed or you no longer wish to receive these emails, you can update your privacy and communication preferences from your resume by logging onto CareerBuilder.com:
http://www.careerbuilder.com/jobseeker/emails/emailsubcenter.aspx

Or you can Block this employer from viewing your resume and sending you candidate emails.

This email was sent from Account ID ATXNC91MZIFSAQTSAC7 and by this logged in User U48VA7D999LFKCKNSYZ
DISCLAIMER
The content of this email has been reviewed and approved by CareerBuilder. This email is intended for the use of the individual address named above and may contain information that is confidential, privileged or unsuitable for overly sensitive persons with low self-esteem, no sense of humour or irrational religious beliefs. If you are not the intended recipient, any dissemination, distribution or copying of this email is not authorised and constitutes an irritating social faux pas.

---

Bizarrely, attached to this spam are five other attachments trying to punt a different scam:

---

Dear sir or madam,
My name is Jackie Simons, I am an Advertising Manager at SocMart (www.socmart.com.ua).
The company’s principal activity is investment in residential property of developing
countries.
Our chief objective is to attract foreign investors to the affobadle housing market
of Belorussia,
Russia, Ukraine, Kazakhstan and etc. The housing prices are often high in these
countries and tend to
continuously increase, whereas the quality of the property remains rather low. As
far as we are eager to change the
situation, our company is now focused on attaraction of potential foreign investors
to the available property market
of the former CIS countries. Our three-year experience in the property investment
market has revealed an excessive number
of people willing to invest their funds into developing countries’ residential
property. However, we came across a problem
concerned with bureaucracy, as banking systems of the former CIS countries are
still undeveloped for prompt and effective
international bank transfer service. Lack of proper relations between Western and
Eastern banking systems dealing with
international bank transfer service does not allow us to process promptly our
foreign customers’ investments
(investments are to be on hold during 1-2 months). The fact that property prices are
continuously flactuating has made
it clear that efficiency in investment processing is our priority. Considering the
above we had to recourse to “investment managers”
to accelerate investment processing to the maximum extend. In case you got
interested with our proposal do not hesitate to contact us by e-mail:
worldmarkettusel@gmail.com

---

SocMart is a wholly legitimate Ukranian firm dealing in real estate who are NOT responsible for this spam. Whichever version of this you get, avoid it like the plague.

Added: the following email addresses are being use for this, and probably others:
worldmarkettusef@gmail.com
worldmarkettuse@gmail.com
worldmarkettusel@gmail.com
worldmarkettusew@gmail.com
worldmarkettusey@gmail.com

"Auction Sales Online" job scam

It isn't always clear what the scam is with these fake job offers, but it seems that fraudsters need to recruit a large number of patsies to run their operation. In fact, there is quite a large bogus career network going on here, with "employees" trades between various underground enterprises.

---

Subject: Working Part Time

Auction Sales Online is currently hiring for work at home positions,
in the United Kingdom, part-time and full-time available. The positions
focus on providing administrative assistance in online sales.

Auction Sales Online provides business support, retail distribution,
franchise operations, direct sales, and a variety of auction as well
as accounting and billing services.

Salary:

Part-time: 1,100GBP/month plus commission
Full-time: 2,200GBP/month plus commission

Professional Qualities:

- Customer focused decision maker
- Demonstrates a high level of personal accountability
- Thinks about the team first over personal agendas
- Excellent communication skills

Basic Requirements:

- Internet Access
- Microsoft Office
- Basic Accounting skills

If you are interested in this position please send us an email to
Tracy.Miller@aso-careers.com expressing your interest and we will
forward you the detailed job description and the agreement.

Best regards,
ASO Team

---

This particular job scam references the domain aso-careers.com which has been registered for this purpose. The WHOIS records are almost definitely fake, registered through BIZCN.COM, INC.:

Domain name: aso-careers.com

Registrant Contact:
Sam Lloyd
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us

Administrative Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us

Technical Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us

Billing Contact:
Sam Lloyd supportnewest@safe-mail.net
+1.8827729829 fax: +1.8827729829
81313 po box
New York NY 10016
us

DNS:
ns1.floodinger.com
ns2.floodinger.com

Created: 2008-10-27
Expires: 2009-10-27

floodinger.com is a new one, but the registration details are hidden. ns1.floodinger.com is 67.202.88.243 in the US and 21.214.23.151 which apparently belongs to the Department of Defense (!).

Mail is handled by 12.192.82.225 which we have seen twice before. The Silent Noise blog fingers that as part of the Asprox network. Asprox involvement is hardly news - it's an impressively large underground organisation (presumably with it's own underground lair).. although it is quite possible that Asprox facilities are being used on behalf of a client.

Anyway, avoid unsolicited job offers, and always ask for some real, verifiable contact details. In the UK you can check details at Companies House. For US companies, the state Division of Corporations should have company details, or you can perhaps check at the BBB.

Estdomains is not dead yet

Thanks to Sandi for bringing the not-so-good-news that Estdomains is not quite dead yet. For a moment it looked like ICANN had grown some cojones, but perhaps not.

Estdomains termination was based on the fact the their President, Vladimir Tsastsin, has been convicted of fraud in Estonia. However, Estdomains are attempting to wriggle out of this by saying that Tsastsin didn't do it and he resigned as president some time ago. Bearing in mind that an Estonia court said he DID do it (although he is appealing, but that could take for ever) and that the only proof offered by Estdomains that he resigned looks a bit unconvincing, then the whole excuse looks rather thin.

Of course, the reason why Estdomains should be terminated is their long-running association with organised crime, as documented here and here. Add to that the fact that the company deliberately conceals its identity by using a Delaware corporation as a front (when obviously "Est" is for Estonia), and it is clear that they should have been terminated a long, long time ago.

Persimmon Homes / Marks & Spencers Vouchers Hoax

There is currently a hoax email circulating similar to the following:

Thought this might be useful with Christmas coming up

Marks & Spencer, in conjunction with Persimmon Homes, are giving away free vouchers. Marks & Spencer's are trying word-of-mouth advertising to introduce its products and the reward you receive for advertising for them is free non-refundable vouchers to be used in any M & S store.

To receive your free vouchers by e-mail all you have to do is send this e-mail out to 8 people (for £100 of free vouchers) or 20 people (for £500 of free vouchers). Within 2 weeks you will receive an e-mail with your vouchers attached. They will contact you through your e-mail address.

NB. Please mark a copy to:
Andy.curran@persimmonshomes.com

As it happens, the domain name persimmonshomes.com is incorrect, it would be persimmonhomes.com. But no matter, Persimmon categorically deny that is is anything to do with them:

"Hoax E-mail"

A hoax e-mail is being circulated offering a promotion of free Marks and Spencer vouchers for forwarding the e-mail to colleagues and friends.

Neither Marks and Spencer or Persimmon Homes have made any such promotional offer.

Please delete the hoax e-mail and notify the people to whom you have sent it that it is a hoax.

It turns out that this hoax has been doing the rounds since 2007. There's also an interesting thread about it here.

You can also check out Dynamoo's Email Etiquette page for some advice on what is appropriate to forward and what isn't.

Estdomains is dead

Good riddance to bad rubbish - Estdomains has be de-accredited by ICANN, although it took long enough. If you're a registrar who wants to take on some of the most toxic domain names in the business, then ICANN invites you to apply for them.

More details here. Thanks to Spyware Sucks for the heads-up.

Alex Shafts, CEO / World Wide Domain Names Part II

Yesterday's "Alex Shafts" spam run is the most bizarre I have seen in a long time, and clearly has been quite widespread given the hundreds of visitors who have come to this blog.

1. Spammer appears to have lost his home, so presumably is in financial trouble. That sucks, times are certainly hard for a lot of people.. often through no fault of their own.
2. Spammer discovers affiliate marketing. Done right, this can make you a lot of money.. assuming that you do it right.
3. Spammer decides that LunarPages web hosting affiliate program looks good.
   
4. Spammer rents a server, a mailing list and writes some ad copy. I can quite believe that the spammer bought the mailing list in good faith - often scraped email addresses are mis-sold as opt-in addresses.
5. Now things start to go awry - the spammer's email is not CAN-SPAM compliant. The subject line is deceptive (it is "Notice Regarding Your DOMAIN NAME", the spam is about hosting). There is no physical address on the email, and no opt-out mechanism.
   
6. On the plus side, the spammer is not hiding his identity, and the spamvertised domain of worldswidedomainname.com has what appears to be vaguely valid contact details (although the house currently appears to be empty).
   
7. Now for the REALLY stupid part - the spammer has set up a mailing list to distribute the spam, but there are no restrictions on who can send to it. So when some addresses start to auto-respond, those responses are then re-spammed out to everyone on the list. I have seen dozens of these, but I think that my spam filter has kept out a LOT more.
8. Spammer's affiliate account, hosting and even Yahoo! email address gets nuked from orbit. Kudos to LunarPages and IX Web Hosting for their prompt action.
9. Who knows what will happen next? A LOT of people are really angry about the email storm that this has generated. Some may even take legal action.
   

There's another interesting blog entry about this at Skillett.com which expands on the story some.

So here's the scorecard for this particular bit of affiliate marketing:

• Keeping within the Terms of Service for your affiliate program: FAIL
• Keeping within the Terms of Service for your web host: FAIL
• Technical expertise: FAIL
• Legal compliance: FAIL
• Income generation: FAIL
• OVERALL: FAIL
  

Now if only Ecommerce corporation could shut down the spam coming through 98.130.1.155 then everyone else would have a WIN. As of about 0500 GMT the darned stuff is still coming through..

Alex Shafts, CEO / World Wide Domain Names / LunarPages spam

There's more to this spam than meets the eye.. and be certain that it IS spam and isn't any kind of communication from your domain name registrar:

---

Subject: Notice Regarding Your DOMAIN NAME
From: "Domain Name Support"
Date: Tue, October 28, 2008 5:16 am
To: info@worldswidedomainname.com


*****************************************
Important Notice Regarding Your Domain Name(s)
*****************************************

Dear Webmaster,

According to our records you are the ADMINISTRATIVE CONTACT.

We would like to inform you we have partnered up with LunarPages Web Hosting. We understand you are currently hosting with another provider. But we encourage you to try out LunarPages. LunarPages also has an affiliation program where you can embed banners on your website and earn $65 for every referral.

A little more information about LunarPages; Lunarpages Web Hosting was born from Add2Net in 2000, and has grown rapidly providing Shared Hosting, Dedicated, Reseller, and most recently, VPS Hosting Plans. LunarPages is BBB Accredited and is rated A for excellence. LunarPages also has received many Industry Awards including Web Host Magazines highest level of recommendation. LunarPages is one of the fewest hosting services that provide unlimited transfer and unlimited data storage.

LunarPages can fit your business needs whether you’re a small business or a large company. Join (or lurk about) Community Forums and ask our customers why they host with LunarPages. For more in depth information, news and articles about Web Hosting, Marketing, SEO, Traffic, AdWords, Design, Networking and General Fluff, visit Lunartics Blog (updated daily, sometimes hourly). Our BlogStars consist of a team of more than 20+ industry experts. You may learn something, or simply be entertained.

VISIT LUNARPAGES

If you’re not ready to give LunarPages “Web Hosting” a try just yet, TRY the affiliation program where you can earn hundreds or even thousands a month. Save this email for your records and click the link above for special promos throughout the year.

Best Regards,

Alex Shafts, CEO

World Wide Domain Names

If you are the domain administrator of more than one domain account, you may receive this notice multiple times.
-------------------------------------------------------------------

All rights reserved.

---

Who the heck is Alex Shafts? And who are "World Wide Domain Names"? Certainly nobody I do business with. So let's see who is sending this first of all. A look at the mail headers will be interesting:

X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on blade2.cesmail.net
X-Spam-Level:
X-Spam-Status: hits=0.9 tests=HTML_MESSAGE,URIBL_RHS_DOB version=3.2.4
Received: from unknown (192.168.1.88)
by blade2.cesmail.net with QMQP; 28 Oct 2008 05:27:00 -0000
Received: from mail500.opentransfer.com (98.130.1.155)
by ********** with SMTP; 28 Oct 2008 05:27:04 -0000
Received: (qmail 624 invoked by uid 399); 28 Oct 2008 05:16:47 -0000
Mailing-List: contact info-help@worldswidedomainname.com; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Post:
List-Help:
List-Unsubscribe:
List-Subscribe:
Delivered-To: mailing list info@worldswidedomainname.com
Received: (qmail 618 invoked by uid 399); 28 Oct 2008 05:16:47 -0000
X-Originating-IP: 68.230.241.45
Received-SPF: none (mail500.opentransfer.com: domain at worldswidedomainname.com does not designate permitted sender hosts)
identity=mailfrom; client-ip=68.230.241.45;
envelope-from=;
X-Authority-Analysis: v=1.0 c=1 a=J2IRbVyBMHeSdsxzcmgA:9
a=21DexejRGg20G2OFDxsA:7 a=V6NLHKsM1nmveCJf-9nhvT6W67oA:4 a=htsp1cwEuSoA:10
a=6-9Fr_h7AAAA:8 a=Vm2oXCpbAAAA:8 a=n4JkmEeXAAAA:8 a=W_LaJHSTY1FKiyaM68cA:9
a=aa2LJqmKak3HsCtWz3EA:7 a=2hL6MRTsiU3c-Xv2ucuIwzcZna0A:4 a=ojskhZjZVJUA:10
a=pM-imOxlMqoA:10 a=fd-QgsGfzTIA:10 a=AfD3MYMu9mQA:10
X-CM-Score: 0.00
Message-ID: <802858ce0ad3496e988f0c3c39bc0060@alex>
From: "Domain Name Support"
To:
Subject: Notice Regarding Your DOMAIN NAME
Date: Tue, 28 Oct 2008 01:16:39 -0400

The originating IP address is 68.230.241.45 which is Cox Communications.. but we also have a domain name of worldswidedomainname.com. The WHOIS details for that domain match the sender's name:

Registrant:
Alex Shafts
504 LEONARD AV
Las Vegas, NV 89106
US

Domain name: WORLDSWIDEDOMAINNAME.COM

Administrative Contact:
Shafts, Alex worldsdomainnames@yahoo.com
504 LEONARD AV
Las Vegas, NV 89106
US
702.5431469
Technical Contact:
Shafts, Alex worldsdomainnames@yahoo.com
504 LEONARD AV
Las Vegas, NV 89106
US
702.5431469

Registrar of Record: TUCOWS, INC.
Record last updated on 24-Oct-2008.
Record expires on 25-Oct-2009.
Record created on 25-Oct-2008.

This domain is just a couple of days old which sets the alarm bells ringing. A Google search for "504 Leonard Av" comes up with a couple of YouTube videos [1, 2]. It turns out to be a foreclosure sale, OK that really sucks for Mr Shafts but it is no excuse to sent out spam.

So, what is this spam trying to get you to do? Is it important? Nope. It's actually just spam for the LunarPages affiliate program. Web hosting affiliate programs can be big earners - in this case LunarPages pay $65 per sign-up. Not bad, but all this email is trying to do is get you to sign up for web hosting. It is in no way an official notice from your registrar.

We know that desperate situations lead to desperate actions, but sending out spam and what is basically deceptive advertising is not going to help.

Added: just to prove himself a bigger idiot, the mailing list that he created to send out the spam ALSO accepts email from absolutely anyone so now there's a real shitstorm of comments, autoreplies and bouncebacks. What a plonker.

Added: check out the comments to this post, also this blog entry has more details. I have made a follow-up entry here explaining the problem in more detail.

"Ferrasano Ferrosan" scam email

Another scam job offer, this time it looks like money laundering. The email is perhaps unintentionally funny, and has a few new social engineering twists.

Subject: Internet Brings a Job Position that Changes Peoples Lives!

Err yeah, money laundering can lead to a prison sentence for the hapless money mule.

Greetings to Everyone in UK! You Have a Lifetime Opportunity to Start making up to 700 GBP per Week, Getting Paid Daily!

Wow.. *everyone* in the UK? That's some spam run.

Successful company from Norway - Ferrasano Ferrosan Group, Offers an Outstanding Job Position!

Googling for "Ferrasano Ferrosan" brought up exactly zero hits.. except for this post in a few minutes (probably).

This Is a Real Genuine Offer That You've Never Seen before, that Gives You Financial Freedom.

Of course, it isn't a "real genuine offer" at all. It's a scam.

Please Take Couple Minutes to Discover This Amazing Opportunity That Will Change Your Life.

But not change it is a GOOD way.

You Are Being Offered an Outstanding Job Position Called "Fund Operator"!

i.e. a money mule.

Here are Few Requirements Before You Apply:

1. This Offer is for United Kingdom/Great Britain Only.
2. You Have to Have 2-3 hours of spare Time Monday-Friday.
3. You Have to be Enthusiastic About It and Be Able to Provide Us With Best Service.
4. No Past Experience Required/ No School Degree Required!
5. Be Able to Check E-mail 4-5 Times a Day and Stay in Touch With us Throughout the Day if Possible!

6. You need to be gullible.

Company Itself is Based in Norway, although Ferrosan is a worldwide health center that Distributes Businesses All Over the World and We Represent
our Norway Location, Fairly Young, but Successful Organization. With the Help of
Google Advertisements it Was Possible to Deliver This Message to You! Nowadays Internet Makes it Possible for Us to Interact on a Whole New Level.

Ferrosan is a genuine company, but it is based in Denmark. It was founded in 1919. "Google Advertisements"? This must be the upcoming "Google Spam (beta)" then.

Full Information About Position Will be Given in Full Package that You Can Request by E-mail, See Below How to Request Full Package.

I'll give that a miss, thanks.

Some References about Position:

Jeff Sparks states in "In Touch Weekly" magazine: "..Great Britain discovers great
opportunity from FF Group.."

Linda Abramke states in "Forbes" magazine: "..Internet simplifies communication and provides more opportunities..", talking about our job position.

Melissa Richardson states in "Cosmopolitan" magazine: "..New opportunity for single moms or students..", talking about simplicity and reliability of position.

These are all completely fake, of course, it's just another piece of social engineering. Sometimes 419 fraudsters uses references on CNN or the BBC to try to add credibility.

You Will be able to Start Working with Us within 24 hours After You Apply and be
able to Start Making Money Immediately! Anybody can Do It, so Don't Hesitate
and Feel Free to Request Full Information, as It will Change Your Life, you will not
Have to Worry About Finances Anymore!

That "change your life" thing again...

Asprox: 47mode.name, berjke.ru, 81dns.ru

There has been a shift overnight in the domains used in the Asprox SQL injection attack, the ones to look for are:

• 47mode.name
• berjke.ru
• 81dns.ru

Registration for the .ru domains looks like this:

domain: 81DNS.RU
type: CORPORATE
nserver: ns1.81dns.ru. 76.240.151.177
nserver: ns2.81dns.ru. 76.182.187.206
nserver: ns3.81dns.ru. 69.62.229.141
state: REGISTERED, DELEGATED
person: Private Person
phone: +3 212 7721130
fax-no: +3 212 7721130
e-mail: igorlsoloti@yahoo.com
registrar: NAUNET-REG-RIPN
created: 2008.10.23
paid-till: 2009.10.23
source: TC-RIPN

47mode.name is different:

Registration Service Provided By: RESELL.BIZ
Contact: +1.3124476810
Website: http://Resell.biz

Domain Name: 47MODE.NAME

Registrant:
Kimberly Maupin
Kimberly Maupin (pampaser@socialworker.net)
136 Lawndale Lane
Sneads Ferry
North Carolina,28640
US
Tel. +5.9103818739

Creation Date: 21-Oct-2008
Expiration Date: 21-Oct-2009

Domain servers in listed order:
ns3.47mode.name
ns2.47mode.name
ns1.47mode.name

Administrative Contact:
Kimberly Maupin
Kimberly Maupin (pampaser@socialworker.net)
136 Lawndale Lane
Sneads Ferry
North Carolina,28640
US
Tel. +5.9103818739

Technical Contact:
Kimberly Maupin
Kimberly Maupin (pampaser@socialworker.net)
136 Lawndale Lane
Sneads Ferry
North Carolina,28640
US
Tel. +5.9103818739

Billing Contact:
Kimberly Maupin
Kimberly Maupin (pampaser@socialworker.net)
136 Lawndale Lane
Sneads Ferry
North Carolina,28640
US
Tel. +5.9103818739

Status:ACTIVE

It looks like "Kimberly Maupin" might well be a real person living in Sneads Ferry, who's identity has been "borrowed". However, the ZIP code is incorrect and the telephone number appears to be in Bolivia.

Anyway, block these domains or check your logs for them.

MS08-067

Microsoft Security Bulletin MS08-067 – Critical: Vulnerability in Server Service Could Allow Remote Code Execution (958644)

Let's make it simple: PATCH NOW. Microsoft's say that this can spread from machine to machine without authentication, and reliable exploit code is likely. This makes it the ideal security flaw to hook a worm onto, like Blaster or Sasser.

If you're a corporate user with a firewall DO NOT imagine that the firewall will offer you much in the way of protection. Eventually either a worm-infected laptop will be plugged into your internal network, or possibly a infected machine may breach the firewall when it connects through the VPN. If there is a widespread outbreak and you're not prepared, then shutting off your VPN may buy you some time.

"WorldPay CARD transaction Confirmation" / "Academic Resources Center Inc." trojan

This is a fake email message pretending to be from WorldPay relating to a payment to "Academic Resources Center Inc".

There's an attached ZIP file, The ZIP contains an EXE designed to look like a DOC.. but oddly with an icon that looks like Excel. Of course, this is actually a nasty trojan rather than a real document.

This is one good reason why you should not hide extensions for known file types on your PC - the icon on the left looks like it has the DOC extension, but only because the real EXE extension can been hidden and is revealed on the right.

VirusTotal indicates patchy detection rates including TrojanSpy:Win32/Zbot.gen!C, Trojan.Win32.FraudPack.gle, Trojan-Spy:W32/Zbot.VM, W32/Trojan3.DU, TROJ_FAKEALE.AI plus some generic heuristic detecions.

In this case, the ZIP is called WorldPay_CARD_Transaction_Confirmation_OrderNo76644.doc.zip and the EXE is WorldPay_CARD_Transaction_Confirmation_OrderNo76644.doc.exe but this may be randomly generated.

---

Subject: WorldPay CARD transaction Confirmation
From: "Jana Rivera"

Thank you!Your transaction has been processed by WorldPay, on behalf ofAcademic
Resources Center Inc.
The invoice file is attached to this message.
This is not a tax receipt.
We processed your payment.
Academic Resources Center Inc has received your order,
and will inform you about delivery.
Sincerely,
The AcaDemon TeamEnquiries This confirmation only indicates that your transaction
has been processed successfully. It does not indicate that your order has been
accepted. It is the responsibility of Academic Resources Center Inc to confirm that
your order has been accepted, and to deliver any goods or services you have ordered.

If you have any questions about your order, please email Academic Resources Center
Inc at:followup@acade66Smicresourcescenter.com, with the transaction details listed
above.Thank you for shopping with Academic Resources Center Inc.

---

UPDATE 24/4/09: There's a similar spam run happening again, details are here.

"Better Business Bureaus Account Support" trojan

We have seen quite a lot of variants of this particular trojan recently, mostly aimed at banks. This one passes itself off as a some sort of digital certificate, but according to VirusTotal it is a trojan variously identified as TrojanDownloader:Win32/Suceret.gen!A, Win32.Stration, Trojan-Downloader.Win32.WebDown.10 and a number of other generic detections.

---

Subject: Better Business Bureaus, Attention: Don't leave mail in your mailbox.
From: "Better Business Bureaus Account Support"

Attention Better Business Bureaus Consumers!

We've enhanced web surfing process with new security measures to keep your online
data and personal information safer.
All registered and new BBB consumers must register new software and update contact
information until October 24, 2008.
Please read the following information carefully:

Register your BBB company certificate here>>>

As always, we appreciate your business. And thank you for working with us.

Sincerely, Ila Newell.
2008 Council of Better Business Bureaus

---

6700.cn browser hijack (bad), SUPERAntiSpyware (good)

I've just spent several days investigating a machine with a particularly nasty rootkit infection. Despite throwing several tools at it and rummaging around the hard disk, the rootkit remained. The most obvious sign was a browser hijack pointing at 6700.cn but there were dozens of malware components installed too.

The F-Secure online scanner and ComboFix removed quite a lot of the malware, but hats off to SUPERAntiSpyware which identified and removed the last, tricky part of the rootkit. I haven't come across this application before, but it is definitely worth a look and it has a free trial.

In retrospect, a lot of the rootkit is also plainly visible using Sysinternal Autoruns - the malware components tend to lack "Publisher" details and can be easily identified. You may well need to take the hard disk out and mount it in a USB drive on a second PC, but a word of caution - it is possible to infect the second PC too, so try to avoid using anything mission critical for the cleanup.

"Data request" trojan

Another EXE-in-ZIP-disguised-as-a-DOC trojan, similar to this one.

Subject: Data request
From: "Billy Roark"


Please find the document attached to this message. The report was issued today.
Requested account details have been altered successfully.

Thank you for contacting us.

Respectfully,
Billy

The attachment in this case is called Statement_January-October.zip and contains an executable named Statement_January-October.doc[44 spaces].exe. The blank spaces are designed to push the .exe part of the filename down so that it is invisible.

It is a different binary from yesterday with better detection rates. But the best cure for this is avoidance, and blocking EXEs-in-ZIPs is the best cure.