Date: Date: Tue, 17 Apr 2012 14:49:18 -0400
From: Customer center [anfinnegan@pasadena.net]
Subject: [#3143] Ticket
Hello. Thank you for contacting us!
Your information has been changed and we should be in touch with you soon.
Proceed to Site.
Ticket code: fi5FFkG
You should expect a personal reply within the day or even sooner - as we answer most email within a few hours.
Date: Tue, 17 Apr 2012 09:21:07 +0530
From: HaileyWeeth@hotmail.com
Subject: Re: Fwd: Scan from a Hewlett-Packard ScanJet 719606
A document was scanned and sent to you using a Hewlett-Packard JET ON22536593S
Sent to you by: LERA
Pages : 4
Filetype: Image (.jpeg) View
Location: NPSK1.4FL.
Device: OP594S3OD1420493
Mailprint: ca5b83c7-2d5b8888
Date: Mon, 16 Apr 2012 08:40:47 -0500
From: CeceliaKosack@hotmail.com
Subject: Order confirmation
You've just ordered pizza from our site
Pizza Triple Meat Italiano with extras:
- Ham
- Ham
- Bacon Pieces
- Pineapple
- Onions
- Easy On Cheese
- No Sauce
Pizza Chicken Supreme with extras:
- Ham
- Jalapenos
- Black Olives
- Extra Cheese
- Extra Sauce
Pizza Hawaiian Luau with extras:
- Pepperoni
- Italian Sausage
- Beef
- Pineapple
- Easy On Cheese
- No Sauce
Pizza Chicken Supreme with extras:
- Italian Sausage
- Bacon Pieces
- Italian Sausage
- Jalapenos
- Diced Tomatoes
- Green Peppers
- Easy On Cheese
- Extra Sauce
Drinks
- Fanta x 4
- Limonade x 6
- Schweppes x 6
- Sprite x 2
Total Charge: 89.70$
If you haven't made the order and it's a fraud case, please follow the link and cancel the order.
CANCEL ORDER NOW!
If you don't do that shortly, the order will be confirmed and delivered to you.
With Best Regards
Pizza by AMERIGO
Date: Mon, 16 Apr 2012 18:26:48 +0900
From: "Fed Ex SUPPORT 36" [support.391@fedex.com]
Subject: FedEx Delivery Confirmation 821630
Attachments: Collect_Letter.htm
ATTENTION!
DEAR USER , Delivery Confirmation: FAILED
PLEASE FILL IN ATTACHED FILE WITH RIGHT ADDRESS AND RESEND TO YOUR PERSONAL MANAGER (Open with Internet Explorer)
With Respect , Your Fed Ex Customer Services
This fake traffic ticket spam leads to malware on vitalitysomer.ru: Date: Fri, 13 Apr 2012 02:46:11 +0600The malware is on vitalitysomer.ru:8080/pages/glavctkoasjtct.php (report here) hosted on the same IP addresses found in this attack.
From: "LUIS MOSES" [Phl8DeB6MG@hotmail.com]
Subject: Fwd: Re: NY TRAFFIC TICKET
New-York Department of Motor Vehicles
TRAFFIC TICKET
NEW-YORK POLICE DEPARTMENT
THE PERSON CHARGED AS FOLLOWS
Time: 8:11 AM
Date of Offense: 25/01/2012
SPEED OVER 50 ZONE
TO PLEAD CLICK HERE AND FILL OUT THE FORM
Fingerprint: 67d251e9-830ebcaf
This spam leads to malware on vanishingmasers.ru:Date: Thu, 12 Apr 2012 15:14:41 -0300
From: "Lidia Polk" [uzbekistanqp39@sterkinekor.com]
Subject: RE: Wire transfer cancelled
Good afternoon,
Wire transfer was canceled by the other bank.
Rejected transaction:
FEDWIRE REFERENCE NUMBER: SK9415179747ODP36641K
Wire Transfer Report: View
The Federal Reserve Wire Network
From: Patrice Burke premonition9@linkedin.com
Date: 12 April 2012 16:33
Subject: LinkedIn Nofitication service message
REMINDERS
Invitation reminders:
• From Kadeem Ruiz (Your classmate)
PENDING MESSAGES
• There are a total of 2 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2010, LinkedIn Corporation.
There are a bunch of domains on 91.230.147.204 being used in injection attacks..This spam leads to malware on wiskonsintpara.ru:From: Marcel Ouellette RaymondKalan@nyc.rr.com
Date: 11 April 2012 13:30
Subject: Re: Wire Transfer Confirmation (FED REFERENCE 42420PP01)
Dear Bank Account Operator,
WIRE TRANSACTION: WIRE-900098281493111
CURRENT STATUS: CANCELLED
You can find details in the attached file.(Internet Explorer file)
Transfer_N883664.htm
Date: Wed, 11 Apr 2012 15:09:48 -0300
From: "Pasquale Nieves" [warthogv@linkedin.com]
Subject: LinkedIn Nofitication service message
REMINDERS
Invitation reminders:
? From Felix Byers (Your Colleague)
PENDING MESSAGES
? There are a total of 2 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. � 2010, LinkedIn Corporation.
From: Yvonne Lewis [mailto:MalikDuenes@choice.net]
Sent: 10 April 2012 12:03
Subject: Dowload your Intuit.com invoice.
Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-367-0794 ($4.49/min).
ORDER INFORMATION
Please download your complete order id #4147367 from the attachment.(Open with Internet Explorer)
©2012 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.
Date: Tue, 10 Apr 2012 19:18:16 +0530
From: "US Airways - Reservations" [usair@myusairways.com]
Subject: Confirm your US airways online reservation.
You have to check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying abroad). Then, all you have to do is print your boarding pass and proceed to the gate.
Confirmation code: 956153
Check-in online: Online reservation details
Flight
1396
Departure city and time
Washington, DC (DCA) 10:00PM
Depart date: 4/5/2012
�
We are committed to protecting your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.
US Airways, 111 W. Rio Salado Pkwy, Tempe, AZ 85281 , Copyright US Airways , All rights reserved.
There have been a helluvalot of malicious spams in the past few days, some using HTML attachments and some using an HTML-in-ZIP attack, for example:
Another fake HP scan spam email leading to malware. This one follows the new technique of putting a malicious HTML (HP_Scan.htm) file inside a ZIP file to reduce the risk of it being blocked, and then it has multiple payload sites to try to get a higher infection rate. Nasty.Date: Fri, 6 Apr 2012 08:29:34 +0200
From: "Hewlett-Packard Officejet 70419A" [JaysonGritten@estout.com]
Subject: Scan from a Hewlett-Packard ScanJet #02437326
Attachments: HP_Document-12-Z1380.zip
Attached document was scanned and sent
to you using a Hewlett-Packard HP Officejet 45211A.
Sent by: MILLIE
Images : 7
Attachment Type: ZIP [DOC]
Hewlett-Packard Officejet Location: machine location not set
Device: OFC347AA3BSX37057762
Date: Thu, 5 Apr 2012 14:10:48 +0000
From: "US Airways - Reservations" [usair@myusairways.com]
Subject: Confirm your US airways online reservation.
you {l2} check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying {l3}). {l4}, all you {l5} to do is print your boarding pass and {l6} to the gate.
confirmation code: {digit}
check-in online: online reservation details
flight
{digit}
departure city and time
washington, dc (dca) 10:00pm
depart date: 4/5/2012
we are committed to protecting your privacy. your information is kept private and confidential. for information about our privacy policy visit usairways.com.
us airways, 111 w. rio salado pkwy, tempe, az 85281 , copyright us airways , all rights reserved.
Date: Thu, 5 Apr 2012 18:54:19 +0700The malicious payload is on 174.140.171.117 (report here) hosted by Directspace in the US. This is the third time in recent days that Directspace have hosted such a site in this range, the others were 174.140.171.173 (here) and 174.140.166.138 (here).
From: "US Airways - Reservations" [support@myusairways.com]
Subject: US Airways online check-in.
You have to check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying internationally). After that, all you need to do is print your boarding pass and go to the gate.
Confirmation code: 610235
Check-in online: Online reservation details
Flight
5266
Departure city and time
Washington, DC (DCA) 10:00PM
Depart date: 4/5/2012
We are committed to protecting your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.
US Airways, 111 W. Rio Salado Pkwy, Tempe, AZ 85281 , Copyright US Airways , All rights reserved.
From: US Airways - Reservations reservations@myusairways.com
Date: 4 April 2012 14:58
Subject: US Airways online check-in.
You should check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying abroad). After that, all you have to do is print your boarding pass and go to the gate.
Confirmation code: 266492
Check-in online: Online reservation details
Flight
0312
Departure city and time
Washington, DC (DCA) 10:00PM
Depart date: 4/5/2012
We are committed to protecting your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.
US Airways, 111 W. Rio Salado Pkwy, Tempe, AZ 85281 , Copyright US Airways , All rights reserved.
