You might have noticed that I haven't posted details of any malware spam in the past few days. This is because.. well, there really hasn't been much in the way of malware spam, with only one major campaign in the past three weeks.
When malware spam drops, I notice that fake pharma spam pops up instead, and furthermore malware spam runs are hardly ever at weekends when pharma takes over. And yes.. there's been an uptick of pharma spam lately which follows the pattern.
This malware spam run has been going on for months now, with a few breaks of a few weeks each time. I can't believe that anything fundamental has changed. So stay alert!
Thursday, 24 May 2012
Monday, 21 May 2012
Synovate / Avios "Share your opinion and win an iPad!" spam
Here's an annoying piece of spam:
The bit that says "Who this company is will be revealed at the end of the interview" is particular appalling as the only way to find out who sold your contact details is to do the suvey! Well, not quite.. because the email address Synovate sent to is only used for registration at Avios (formerly Airmiles). So Avios sold on my contact details for the survey.
Oh well, easily fixed. We just need to change the privacy settings in Avios to stop this happening.. oh wait, third party emails don't appear in the "contact preferences" section of their site at all:
So what does their privacy policy say? Well:
Direct Marketing and who your data may be passed to
And why is this spam? Well, in my opinion the email is unsolicited, Avios members cannot apparently opt-out or control these, and the relationship of the recipient to the sender is unclear. Avios and Synovate serious need to clean up their act IMO.
From: Loyalty Research loyaltyresearch@synovate.net
Reply-To: loyaltyresearch@synovate.net
Date: 21 May 2012 08:41
Subject: Share your opinion and win an iPad!
Dear Mr Xxxxx,
We are contacting you from Synovate, an independent market research agency and would like to invite you to take part in a survey on behalf of a leading loyalty rewards programme, that you are a member of.
Your name has been given to us in good faith by this company and their loyalty programme name will be revealed to you at the end of the survey.
As a thank you for your participation we will enter you into a prize draw to win a fantastic iPad. Your opinions will be used to improve products and services.
This survey should take less than 20 minutes to complete, and will close on the 30th May 2012
Please click on the link below to begin the survey (CLICK ONCE ONLY):
https://wbint6web.synovate.net/syn.asp?s=XXXXX&p=XXXXX&i=XXXXX&w=XXXXX
Your identity will not be revealed to any third party
All information that we collect is strictly confidential and participation will not lead to any unsolicited mail, phone calls, or e-mails.
Your name will never be associated with your specific responses as they will be combined with those of other respondents. You can view our privacy policy at: http://www.synovate.com/legal/
If the survey link does not open, close the browser window then copy and paste the link into the address line of a new browser window and press enter.
If you exit the survey unexpectedly or accidentally close your Internet browser, clicking on the link above will allow you to re-enter the survey and continue where you left off.
If you have any comments or questions about this survey, please e-mail loyaltyresearch@synovate.net and include this survey ID number XXXXX along with any correspondence.
Kind regards,
The Synovate Team
This e-mail is being sent to you by Synovate on behalf of a leading customer loyalty company. Synovate and this company attempt to comply with all governmental laws for commercial e-mail. We have contacted you specifically either because you agreed to be on their mailing list to receive correspondence such as this, or you have previously participated in a survey on behalf of this company. Who this company is will be revealed at the end of the interview. If you do not wish to receive further communication from us, please reply to this email and let us know.
Terms & Conditions
1. The prize is a 16gb iPad with wi-fi
2. The prize draw is open to participants of this survey aged 18 or over resident in the UK, excluding employees and past employees of Synovate or anyone materially connected to the administration of the prize draw.
3. Entry to the draw is by completion and submission of the survey. No purchase is required.
4. Closing date for all entries into the prize draw is 30th May 2012 at 12pm. No responsibility will be taken for entries lost, damaged, incomplete or illegible. Proof of submitting will not be accepted as proof of delivery. Entries may be disqualified if incomplete or illegible.
5. Only one entry per person may be submitted.
6. The draw will take place by 30.06.12.
7. The prize will be awarded to the first eligible entry drawn.
8. The winner will be notified in writing by 06.07.12.
9. The winner will receive their prize by post no later than 20.07.12.
10. If a winner cannot be contacted within 14 days from the draw date, an alternative winner will be drawn.
11. The name and county of the winner will be available to anyone sending a stamped addressed envelope to Ipsos, Prize Draw Winner, c/o Toby Rogers, Minerva House, 5 Montague Close, London, SE1 9AY within 28 days of the published closing date.
12. All entrants to the prize draw will be deemed to have accepted the rules.
13. No alternatives to the prize offered will be given.
The bit that says "Who this company is will be revealed at the end of the interview" is particular appalling as the only way to find out who sold your contact details is to do the suvey! Well, not quite.. because the email address Synovate sent to is only used for registration at Avios (formerly Airmiles). So Avios sold on my contact details for the survey.
Oh well, easily fixed. We just need to change the privacy settings in Avios to stop this happening.. oh wait, third party emails don't appear in the "contact preferences" section of their site at all:
So what does their privacy policy say? Well:
Direct Marketing and who your data may be passed to
Your data may be passed to carefully selected companies that distribute Avios or companies that we think may be of interest to you. We may also pass your details to suppliers that process data on our behalf. On occasion we may use and disclose data on a collective basis for marketing and research cases but will not in such cases provide individual customer data.So, you passed my contact details to Synovate for market research purposes, and there's no apparent opt out. Unless perhaps I do it in writing as you can't opt out on the web site..
How to remove yourself from our communication listingsThis is really shabby marketing. Avios haven't breached their own privacy policy as it allows them to sell your contact details on in this way, but most consumers won't be expecting it. You should never, ever click on an unsolicited link like this (because it could lead to malware) and Avios and Synovate should at least make their relationship clear in the email rather than keeping it as a secret until you do the survey.
If you do not wish to receive promotional mailings, simply inform us by writing to the address below. Please note that you may still receive an Avios statement as part of your membership.
Customer Account Management
PO Box 90,
Birchwood,
Warrington,
WA3 7XA.
And why is this spam? Well, in my opinion the email is unsolicited, Avios members cannot apparently opt-out or control these, and the relationship of the recipient to the sender is unclear. Avios and Synovate serious need to clean up their act IMO.
Labels:
Spam
Friday, 18 May 2012
Myspace "Security updates" lead to fake pharma
This is a persistent spam run that has been going for a couple of days:
The link in the email goes to a variety of fake pharma sites, all of which appear to be hosted on 91.212.124.152 in a block registered to one Aleksandr Nikolaevich Nikultsev in the Ukraine. The doesn't seem to be much you would want to visit in 91.212.124.0/24 so blocking the whole lot might be prudent.
These are the sites I can find hosted on 91.212.124.152:
acefsynqe.com
amwafudicbia.com
badgestabmedicine.com
biolpharmacy.com
boquihcu.net
carepharmedical.com
carepharmgroup.com
cialisviagracounterpunch.com
curot.ru
cvaxvaso.com
dietabletouchpad.com
dietprescriptionfat.com
diong.ru
duski.ru
dzepojkarny.com
ecstasyherbal.com
epoth.ru
ettoicbynn.com
familymedicineviagra.com
fdamedicalprescription.mobi
genericsteva.com
healthtabgroup.com
hospitallnessmedical.mobi
kdffg.ru
kdfgd.ru
leibypharmacylevitra.com
levitrabrooklyn.com
levitracontab.com
levitrapause.com
lkdsfh.ru
lkhj.ru
loug.ru
lupp.ru
medicarewelnessdebt.com
medsdietgroup.com
medslevitraleiby.com
medsmedicinegroup.com
movietestworld.com
mymedicaremeds.com
mypharmacyherbal.com
mypharmed.com
mypillhealth.com
mypillmedical.com
mypillsale.com
newcanadatablet.com
newmedpharmacy.com
newpillscare.com
newrxhealth.com
newrxmed.com
newrxmedicine.com
newtabhealth.com
newtabletcare.com
nyctyckap.com
oedy.ru
patientsviagracare.com
phad.ru
pharmacycarepatients.com
pharmacycifrazier.com
pillsmedicalhospital.com
plew.ru
pohjgh.ru
prescriptiondrugslevitra.com
radicalmediadata.com
sdfhsj.ru
sescahpyff.com
sexualevitra.com
sexualpillsmed.com
sexualwelnessmed.com
simjicwar.com
sleaxmobca.com
smoruroy.com
sniggahcar.com
soylovde.com
sreadafet.com
srenusoxhui.com
stationbeta.com
steelevitra.com
storepharm.com
straussrx.com
tamy.ru
tbin.ru
thow.ru
viagrahalfmile.com
vikingsnotdead.com
vjkcvl.ru
vkgtq.ru
walgreenspillsrx.eu
Date: Fri, 18 May 2012 13:44:44 -0700
From: "Myspace" [noreply@message.myspace.com]
Subject: Security updates
myspace
We have recently updated our website to improve our security.
Please follow the instructions to ensure your account is enable and not blocked.
If you need immediate assistance, please contact our support team.
Note: It is important that your personal information is accurate and complete. This information may later be used to help verify the owner of the account. We does not sell or provide your personal information to third party companies.
Thank you for using Myspace!
The Myspace Team
http://www.myspace.com/
Have questions? Visit our help page. Myspace, 8391 Beverly Blvd, #349, Los Angeles, CA 90048.
� Myspace Inc. All Rights Reserved.
The link in the email goes to a variety of fake pharma sites, all of which appear to be hosted on 91.212.124.152 in a block registered to one Aleksandr Nikolaevich Nikultsev in the Ukraine. The doesn't seem to be much you would want to visit in 91.212.124.0/24 so blocking the whole lot might be prudent.
These are the sites I can find hosted on 91.212.124.152:
acefsynqe.com
amwafudicbia.com
badgestabmedicine.com
biolpharmacy.com
boquihcu.net
carepharmedical.com
carepharmgroup.com
cialisviagracounterpunch.com
curot.ru
cvaxvaso.com
dietabletouchpad.com
dietprescriptionfat.com
diong.ru
duski.ru
dzepojkarny.com
ecstasyherbal.com
epoth.ru
ettoicbynn.com
familymedicineviagra.com
fdamedicalprescription.mobi
genericsteva.com
healthtabgroup.com
hospitallnessmedical.mobi
kdffg.ru
kdfgd.ru
leibypharmacylevitra.com
levitrabrooklyn.com
levitracontab.com
levitrapause.com
lkdsfh.ru
lkhj.ru
loug.ru
lupp.ru
medicarewelnessdebt.com
medsdietgroup.com
medslevitraleiby.com
medsmedicinegroup.com
movietestworld.com
mymedicaremeds.com
mypharmacyherbal.com
mypharmed.com
mypillhealth.com
mypillmedical.com
mypillsale.com
newcanadatablet.com
newmedpharmacy.com
newpillscare.com
newrxhealth.com
newrxmed.com
newrxmedicine.com
newtabhealth.com
newtabletcare.com
nyctyckap.com
oedy.ru
patientsviagracare.com
phad.ru
pharmacycarepatients.com
pharmacycifrazier.com
pillsmedicalhospital.com
plew.ru
pohjgh.ru
prescriptiondrugslevitra.com
radicalmediadata.com
sdfhsj.ru
sescahpyff.com
sexualevitra.com
sexualpillsmed.com
sexualwelnessmed.com
simjicwar.com
sleaxmobca.com
smoruroy.com
sniggahcar.com
soylovde.com
sreadafet.com
srenusoxhui.com
stationbeta.com
steelevitra.com
storepharm.com
straussrx.com
tamy.ru
tbin.ru
thow.ru
viagrahalfmile.com
vikingsnotdead.com
vjkcvl.ru
vkgtq.ru
walgreenspillsrx.eu
Labels:
Fake Pharma,
Spam,
Ukraine
Monday, 14 May 2012
TaxSlayer.com spam / hseclub.net
Date: Mon, 14 May 2012 12:02:23 -0300
From: "Joann Crowley" [alert@taxslayer.com]
Subject: Don't make grave tax mistakes.
View Online | View Mobile | Unsubscribe from TaxSlayer e-mails.
Avoid tax deadline mistakes that delay your tax return
With the tax deadline looming, it is essential to make sure that you prevent any errors on your tax return that could delay the filing and processing of your returns. The IRS recently released a list of their most commonly seen errors.
Read More
FREE TAX ADVICE x96
with TaxSlayer.com
Do you have a tax-related question that you would like to ask someone? Try our newest feature!
Read More Do you need
more time to file?
The deadline for filing your tax return will be April 17th this year. See what you can do if you need more time.
Read More Do you need a last minute deduction?
If you are in need of another tax deduction, you may be able to deduct some or all of your IRA contributions.
Read More
This email was sent to xxxxxxxxx by notification@taxslayer.com.
Click here to unsubscribe from TaxSlayer.com e-mails.
TaxSlayer.com | 610 Ronald Reagan Drive | Evans, GA 30809
Needless to say, this spam isn't from TaxSlayer.com but it leads to malware, this time with a malicious payload at [donotclick]hseclub.net/main.php?page=3d45d0a0fe805ff8 (report here) hosted on 37.59.68.23 (OVH, UK). Blocking that IP will probably do you no harm.
Saturday, 12 May 2012
Nadine Dorries: Where's My Shotgun?
You're not in Florida, Nadine. My MP (who I've never actually seen in the flesh at anything I've been to) Tweets about Reginald D Hunter (after being on Have I Got News For You):
Usually when Tory MPs are involved in online death threats, it's the other way around..
"I have now left the HIGNFY after party. As I looked over my shoulder, Reginald D Hunter was talking to my daughter.#wheresmyshotgunman"
Usually when Tory MPs are involved in online death threats, it's the other way around..
Labels:
Nadine Dorries,
Politics
Friday, 11 May 2012
Scamworld: 'Get rich quick' schemes mutate into an online monster
Here's a long and very detailed article from The Verge on how the current crop of get-rich-quick schemes on the Internet work. If it's a case of tl;dr then you can get a flavour of it from this video:
Labels:
Scams
Thursday, 10 May 2012
Fake job and credit check sites to avoid
A little cluster of spam/scam sites on 95.142.173.176, running a scam related to this one. Avoid.
creditdealmanagement.com
creditlevelreport.com
hotdealsmanagement.com
hotoffermanagement.com
rockingdealmanagement.com
rockingdealmanagements.com
rockingoffermanagement.com
rockingscoremanagement.com
tql-billing.com
The WHOIS details are as follows:
creditdealmanagement.com
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
00545
name:(Sophie Ellis)
mail:(admin@creditdealmanagement.com)
+022.8260898
+022.8260898
Hot Date
creditlevelreport.com
NA
Torrie Ots admin@creditlevelreport.com
+14122666060 fax: +14122666060
123 6th Street
Pittsburgh PA 64213
us
hotdealsmanagement.com
name:(Sophie Ellis)
Email:(admin@creditdealmanagement.com)
tel-- +022.8260898
fax:(+022.8260898)
Hot Date
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
zipcode:00545
hotoffermanagement.com
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
00545
name:(Sophie Ellis)
mail:(admin@creditdealmanagement.com)
+022.8260898
+022.8260898
Hot Date
rockingdealmanagement.com
name:(Niko Irlung)
Email:(admin@rockingoffermanagement.com)
tel-- +022.4860345
fax:(+022.4860345)
Rockinig
Aleje Ujazdowskie 54C
Warszawa
Warszawa,
PL
zipcode:00541
rockingdealmanagements.com
NA
Yawn Paul admin@rockingscoremanagement.com
+14122821060 fax: +14122821060
34G W C Jobs
Pittsburgh PA 64421
us
rockingoffermanagement.com
Niko Irlung admin@rockingoffermanagement.com
+022.4860345
+022.4860345
Rockinig
Aleje Ujazdowskie 54C
Warszawa,
Warszawa,
PL 00541
rockingscoremanagement.com
NA
Yawn Paul admin@rockingscoremanagement.com
+14122821060 fax: +14122821060
34G W C Jobs
Pittsburgh PA 64421
us
tql-billing.com
Aleje Ujazdowskie 87-44
Warszawa
Warszawa,
PL
00540
name:(Dill Nilson)
mail:(admin@tql-billing.com)
+022.8277528
+022.8277528 TQL
creditdealmanagement.com
creditlevelreport.com
hotdealsmanagement.com
hotoffermanagement.com
rockingdealmanagement.com
rockingdealmanagements.com
rockingoffermanagement.com
rockingscoremanagement.com
tql-billing.com
The WHOIS details are as follows:
creditdealmanagement.com
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
00545
name:(Sophie Ellis)
mail:(admin@creditdealmanagement.com)
+022.8260898
+022.8260898
Hot Date
creditlevelreport.com
NA
Torrie Ots admin@creditlevelreport.com
+14122666060 fax: +14122666060
123 6th Street
Pittsburgh PA 64213
us
hotdealsmanagement.com
name:(Sophie Ellis)
Email:(admin@creditdealmanagement.com)
tel-- +022.8260898
fax:(+022.8260898)
Hot Date
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
zipcode:00545
hotoffermanagement.com
Aleje Ujazdowskie 88-44
Warszawa
Warszawa,
PL
00545
name:(Sophie Ellis)
mail:(admin@creditdealmanagement.com)
+022.8260898
+022.8260898
Hot Date
rockingdealmanagement.com
name:(Niko Irlung)
Email:(admin@rockingoffermanagement.com)
tel-- +022.4860345
fax:(+022.4860345)
Rockinig
Aleje Ujazdowskie 54C
Warszawa
Warszawa,
PL
zipcode:00541
rockingdealmanagements.com
NA
Yawn Paul admin@rockingscoremanagement.com
+14122821060 fax: +14122821060
34G W C Jobs
Pittsburgh PA 64421
us
rockingoffermanagement.com
Niko Irlung admin@rockingoffermanagement.com
+022.4860345
+022.4860345
Rockinig
Aleje Ujazdowskie 54C
Warszawa,
Warszawa,
PL 00541
rockingscoremanagement.com
NA
Yawn Paul admin@rockingscoremanagement.com
+14122821060 fax: +14122821060
34G W C Jobs
Pittsburgh PA 64421
us
tql-billing.com
Aleje Ujazdowskie 87-44
Warszawa
Warszawa,
PL
00540
name:(Dill Nilson)
mail:(admin@tql-billing.com)
+022.8277528
+022.8277528 TQL
Labels:
Job Offer Scams,
Spam
Wednesday, 9 May 2012
Something evil on 50.30.47.81
There are a bunch of sites on 50.30.47.81 (Hosting Solutions International, Inc., US) being used to serve Java exploits via injection attacks. Probably worth blocking this one (obviously, don't visit these sites)..
www.gredsa.in
www.bbadkf.in
www.bernitto.in
www.hfsless.in
www.burness.in
www.gredsa.in
www.bbadkf.in
www.bernitto.in
www.hfsless.in
www.burness.in
Labels:
Evil Network,
Injection Attacks
Tuesday, 8 May 2012
Something odd
One of those odd things you see in proxy logs.. in this case, a load of outbound access attempts from guest machine like this:
Obviously, these URLs are malformed because the IP address is listed twice. But one of these stands out:
http://91.230.147.23191.230.147.231/ is clearly "91.230.147.231" twice. This IP belongs to Adevir Invest in Russia, and we've seen that name before. The other IPs seem innocent enough, but this traffic pattern is highly suspicious and I can only assume that these IPs are some sort of C&C server.
If you want to block the correctly formed IPs then they are as follows:
69.60.122.18
85.25.130.12
89.207.129.7
91.230.147.231
174.37.202.166
184.22.165.50
204.45.70.162
207.244.209.239
209.85.148.10
http://69.60.122.18269.60.122.182/
http://85.25.130.1285.25.130.12/
http://89.207.129.789.207.129.7/
http://91.230.147.23191.230.147.231/
http://174.37.202.166174.37.202.166/
http://184.22.165.50184.22.165.50/
http://204.45.70.162204.45.70.162/
http://207.244.209.239207.244.209.239/
http://209.85.148.101209.85.148.101/
http://85.25.130.1285.25.130.12/
http://89.207.129.789.207.129.7/
http://91.230.147.23191.230.147.231/
http://174.37.202.166174.37.202.166/
http://184.22.165.50184.22.165.50/
http://204.45.70.162204.45.70.162/
http://207.244.209.239207.244.209.239/
http://209.85.148.101209.85.148.101/
Obviously, these URLs are malformed because the IP address is listed twice. But one of these stands out:
http://91.230.147.23191.230.147.231/ is clearly "91.230.147.231" twice. This IP belongs to Adevir Invest in Russia, and we've seen that name before. The other IPs seem innocent enough, but this traffic pattern is highly suspicious and I can only assume that these IPs are some sort of C&C server.
If you want to block the correctly formed IPs then they are as follows:
69.60.122.18
85.25.130.12
89.207.129.7
91.230.147.231
174.37.202.166
184.22.165.50
204.45.70.162
207.244.209.239
209.85.148.10
Labels:
Malware
Saturday, 5 May 2012
Fake job offer: HRT F1 TEAM
The HRT F1 Team is a real team engaged in motor racing. This email is not from the HRT F1 Team.
Instead this is a money mule (money laundering) operation which will end up with serious trouble with the police and your bank. Avoid.
Date: Sat, 5 May 2012 16:43:33 +0300
From: "Rebecca Hoffmeister / HRT F1 TEAM" [gormon.82@digiton.ru]
Subject: Job Offer - Payment Department
Hello !
We are a first-rate company specializing in the implementation of accessories for cars. Apart from this primary mission, we also provide full support to our clients during all stages of the purchase of our product, from the resolution of the contract to the payment and delivery of the product to the customer. To that end, the subdivisions of our company form a quite large network.
At the present time, there is one position open in our company as an agent in the department of payment control. The first month of work will be probationary and will include training programs on corporate ethics and also the basics of inspection and control of payment between parties in a transaction.
We guarantee:
- A suitable wage
- We guarantee you sufficient money to be added to your main salary, provided you have a wish to work hard and to follow all our instructions on time
- Benefits package
- Free training
Our requirements for candidates:
- Punctual and diligent fulfillment of directions from the manager
- Ability to effectively organize work time
- Process work requests necessary to maintain an effective payments transfer program
- Close access to the infrastructure of our city
- Uphold a high level of integrity and ethics
- Good time management skills
If you are interested in this position, send us a short resume by e-mail: hrtf1team@juno.com
Rebecca Hoffmeister - Payment Manager
HRT F1 TEAM
Instead this is a money mule (money laundering) operation which will end up with serious trouble with the police and your bank. Avoid.
Labels:
Money Mule,
Spam
Friday, 4 May 2012
USPS Spam / computerpills.net
This fake USPS spam leads to malware on computerpills.net:
The malicious payload is an exploit kit at computerpills.net/main.php?page=beb0bb4c8ebd96e5 hosted on 37.59.68.23 (OVH, UK) which is the same server used in this attack, the payload looks to be the same as the one used in this other attack, with a very low detection rate at VirusTotal of just 3/42.
Date: Fri, 4 May 2012 08:50:52 -0500
From: "Cathryn Small" [USPS_Shipping_Support@usps.com]
Subject: Your USPS shipment postage labels receipt.
Acct #: 0443907
Dear client:
This is an email confirmation for your order of 3 online shipping label(s) with postage. Your credit card will be charged the following amount:
Transaction ID: #1537194
Print Date/Time: 03/15/2012 02:30 PM CST
Postage Amount: $43.70
Credit Card Number: XXXX XXXX XXXX XXXX
Priority Mail Regional Rate Box B # 5153 9371 4727 8289 2238 (Sequence Number 1 of 1)
If you need further information, please log on to www.usps.com/clicknship and go to your Shipping History or visit our Frequently Asked Questions .
You can refund your unused postage labels up to 14 days after the issue date by logging on to your Click-N-Ship Account.
Thank you for choosing the United States Postal Service
Click-N-Ship: The Online Shipping Solution
Click-N-Ship has just made on line shipping with the USPS even better.
New Enhanced International Label and Customs Form: Updated Look and Easy to Use!
* * * * * * * *
This is a post-only message
The malicious payload is an exploit kit at computerpills.net/main.php?page=beb0bb4c8ebd96e5 hosted on 37.59.68.23 (OVH, UK) which is the same server used in this attack, the payload looks to be the same as the one used in this other attack, with a very low detection rate at VirusTotal of just 3/42.
LinkedIn spam / 184.154.220.226
This fake LinkedIn spam leads to malware on 184.154.220.226:
Date: Fri, 4 May 2012 -04:52:32 -0800The malware is hosted on 184.154.220.226/showthread.php?t=34c79594e8b8ac0f (Singlehop, US) which is a very heavily obfuscated exploit page with a not very impressive VirusTotal detection rate of 2/42. Blocking the IP is a good proactive step to stop this from being a problem.
From: LinkedIn Password [password@linkedin.com]
Subject: Reset Your LinkedIn Password
Hi hippy,
Can’t remember your LinkedIn password? No problem - it happens.
Please use this link to reset your password within the next 1 day:
Click here
Then sign in to LinkedIn with your new password and the email address where you received this message.
Thanks for using LinkedIn!
Xvideos.com IP hosting malware C&C servers
This summary is not available. Please
click here to view the post.
Labels:
Android,
Evil Network,
Malware
Thursday, 3 May 2012
How to access The Pirate Bay on Virgin Media
I don't approve of pirating copyrighted material, but I also don't approve of censorship.On balance I think that censorship is the worst of the two, so I was quite annoyed to find that Virgin Media is censoring the Pirate Bay.
Here's a newsflash. Not everything listed on the Pirate Bay is actually subject to copyright. As with many things, it's what you do with a tool like the Pirate Bay that counts. So, let's say that you have a legitimate use for looking at the Pirate Bay and you're a Virgin Media customer (or another UK ISP that has blocked TPB).. how do you do it?
Well, there's a mirror of The Pirate Bay hosted on the same IP address and domain as the UK's Pirate Party at https://tpb.pirateparty.org.uk/. Not many people know that all UK political parties have to be registered at the Electoral Commission, and the Pirate Party is indeed a properly registered political party (click to enlarge)..
Although the technology employed by Virgin Media is perfectly capable of blocking part of a website and leaving the rest accessible, it's quite possible that censoring part of a website belonging to a legally constituted political party might just be a step too far..
Sorry, the web page you have requested is not available through Virgin Media.It isn't Virgin Media's fault (they have a shedload of their own, this is not one of them), but something they've been obliged to do through the courts.
Virgin Media has received an order from the Courts requiring us to prevent access to this site in order to help protect against copyright infringement.
If you are a Virgin Media home broadband customer, for more information on why certain web pages are blocked, please click here.
If you are a Virgin Media Business customer, or are trying to view this page through your company's internet connection, please click here.
Here's a newsflash. Not everything listed on the Pirate Bay is actually subject to copyright. As with many things, it's what you do with a tool like the Pirate Bay that counts. So, let's say that you have a legitimate use for looking at the Pirate Bay and you're a Virgin Media customer (or another UK ISP that has blocked TPB).. how do you do it?
Well, there's a mirror of The Pirate Bay hosted on the same IP address and domain as the UK's Pirate Party at https://tpb.pirateparty.org.uk/. Not many people know that all UK political parties have to be registered at the Electoral Commission, and the Pirate Party is indeed a properly registered political party (click to enlarge)..
Although the technology employed by Virgin Media is perfectly capable of blocking part of a website and leaving the rest accessible, it's quite possible that censoring part of a website belonging to a legally constituted political party might just be a step too far..
Labels:
Censorship,
Virgin Media
Samsung Galaxy S III
I think it's fair to say.. that this is a very, very nice device indeed. Quad-core CPU, Android 4.0, a big HD screen and lots of goodies that will distract you from the (presumably) wallet emptying price. Yes.. it's the Samsung Galaxy S III which is probably the second most anticipated device of the year after the iPhone 5!
[Via]
[Via]
Facebook spam / chicleart.net
These fake Facebook messages lead to malware on chicleart.net:
The malicious payload is on chicleart.net/main.php?page=8decfe38488713cc on 37.59.68.23 hosted by OVH in the UK.
Date: Thu, 3 May 2012 11:57:48 -0300
From: "Facebook" [noreply@facebookmail.com]
Subject: Most recent events on Facebook
Hi xxxxxxxxxx,
You have blocked your Facebook account. You can reactivate your account whenever you wish by logging into Facebook using your old login email address and password. Subsequently you will be able to use the site as before.
Thanks and regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
==================
Date: Thu, 3 May 2012 15:53:38 +0100
From: "Facebook" [noreply@facebookmail.com]
Subject: New comment on your status update
Hi xxxxxxxxxx,
You have blocked your Facebook account. You can resume your account at any time by logging into Facebook with your old login email address and password. You will then be able to use the site as before.
Thanks and regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
==================
Date: Thu, 3 May 2012 14:09:11 +0000
From: "Facebook" [alert@facebookmail.com]
Subject: New comment on your status update
Hi xxxxxxxxxx,
You have deactivated your Facebook account. You can reactivate your account whenever you wish by logging into Facebook using your old login email address and password. Subsequently you will be able to use the site in the same way as before.
Best regards,
The Facebook Team
Sign in to Facebook and start connecting
Sign in
follow the link below :
http://www.facebook.com/home.php
This message was sent to xxxxxxxxx@xxx.xxx. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
The malicious payload is on chicleart.net/main.php?page=8decfe38488713cc on 37.59.68.23 hosted by OVH in the UK.
tsnet-china.com / "Klver Industrial Co. Ltd" domain scam.
This domain scam has been around for years..
The idea here is to panic the domain owner into registering a bunch of worthless domains. Do I really care if someone registers a bunch of Asian domain names (sub of which are on really crappy second level domains)? No, I don't. And neither should you.
Here's the thing: domain registrars for common domains* like this DO NOT carry out these checks. It isn't their responsibility. In reality, they will NOT contact you prior to registration. There is almost definitely no company interested in buying these domains. And remember, there are hundreds of top-level domains.. you could spend a LOT of money securing worthless variations for no reason.
Give this one a wide berth. If you really do want to find a registrar for additional domains, shop around to find a reliable and inexpensive registrar rather than dealing with spammers.
* some "sunrise" registrations for new top-level domains do check trademark ownership when they are launched.
From: jeff jeff@tsnet-china.com
To:
Date: 3 May 2012 10:02
Subject: Regarding " dynamoo " Dispute
(If you are not in charge of this please transfer this email to your President or appropriate person, thanks)
Dear President,
We are the department of Asian Domain registration service in china, have something to confirm with you. We formally received an application on May 2, 2012. One company which self-styled "Klver Industrial Co. Ltd" were applying to register "dynamoo" as Network Brand and following domain names:
dynamoo.asia
dynamoo.cn
dynamoo.com.cn
dynamoo.com.tw
dynamoo.hk
dynamoo.in
dynamoo.net.cn
dynamoo.org.cn
dynamoo.tw
After our initial checking, we found the name were similar to your company's, so we need to check with you whether your company has authorized that company to register these names. If you authorized this, we will finish the registration at once. If you did not authorize, please let us know within 7 workdays, so that we will handle this issue better. Out of the time limit we will unconditionally finish the registration for "Klver Industrial Co. Ltd".
Best Regards,
Jeff Yang
Registration Dept.
Tel: +862885915586 || Fax: +862885912116
Address:8/F XiYu building No,52 JinDun Road,QingYang District,Chengdu City,China.
The idea here is to panic the domain owner into registering a bunch of worthless domains. Do I really care if someone registers a bunch of Asian domain names (sub of which are on really crappy second level domains)? No, I don't. And neither should you.
Here's the thing: domain registrars for common domains* like this DO NOT carry out these checks. It isn't their responsibility. In reality, they will NOT contact you prior to registration. There is almost definitely no company interested in buying these domains. And remember, there are hundreds of top-level domains.. you could spend a LOT of money securing worthless variations for no reason.
Give this one a wide berth. If you really do want to find a registrar for additional domains, shop around to find a reliable and inexpensive registrar rather than dealing with spammers.
* some "sunrise" registrations for new top-level domains do check trademark ownership when they are launched.
Tuesday, 1 May 2012
Isn't it amazing..
Isn't it amazing how everything sometimes comes together. I came across this particularly well researched article at a blog called Cultivated Drivel.
Sometimes people make those connections that you should have seen your case. In this case, the post managed to link together several strands of my own blog that I hadn't managed to do myself.. namely: Inter Financial Ltd, Gary NcNeish and Piradius.net
It looks like Mr McNeish might have his fingers in quite a few spam pies..
Sometimes people make those connections that you should have seen your case. In this case, the post managed to link together several strands of my own blog that I hadn't managed to do myself.. namely: Inter Financial Ltd, Gary NcNeish and Piradius.net
It looks like Mr McNeish might have his fingers in quite a few spam pies..
Labels:
Gary McNeish,
SMS,
Spam,
Tetrus Telecoms
"Invitation FACEBOOK" hoax
There are a lot of genuine malware-laden fake Facebook emails about, but this one is a hoax.. and a very old one at that, going all the way back to the 1990s in one form or another.
DO exercise caution with emails that appear to be from Facebook, PayPal, LinkedIn or any one of a variety of services.. you can usually check the true destination of a link in an email by floating the pointer over it. DON'T circulate silly hoaxes like this because it simply wastes everybody's time.
Subject: Fwd: FW: PLEASE CIRCULATE
PLEASE CIRCULATE THIS NOTICE TO FRIENDS AND FAMILY ON YOUR CONTACT LIST
In the coming days, you should be aware…
Do not open any message with an attachment called:
"Invitation FACEBOOK"
Regardless of who sent it
It is a virus that opens an Olympic torch and burns the whole hard
disc C of your computer
This virus will be received from someone you have in your address book
That's why you should send this message to all your contacts. It is
better to receive this email 25 times than to receive the virus and
open it
If you receive email called: "Invitation FACEBOOK", though sent by a friend,
do not open but delete it immediately
CNN said it is a new virus discovered recently and that has been
classified by Microsoft as the most destructive virus ever
It is a Trojan Horse that asks you to install an adobe flash plug-in.
Once you install it, it's all over. And there is no repair yet for
this kind of virus. This virus simply destroys the Zero Sector of the
Hard Disc, where the vital information of their function is saved
THE INFORMATION HAS BEEN CHECKED WITH SNOPES
http://www.snopes.com/computer/virus/youtube.asp
DO exercise caution with emails that appear to be from Facebook, PayPal, LinkedIn or any one of a variety of services.. you can usually check the true destination of a link in an email by floating the pointer over it. DON'T circulate silly hoaxes like this because it simply wastes everybody's time.
Labels:
Facebook,
Google Streetview,
Hoax,
Viruses
PayPal Spam / 72.46.140.14
This fake PayPal spam leads to malware on 72.46.140.14:
The malicious payload is on 72.46.140.14/showthread.php?t=9d77a9163cda8dbe (report here) and is hosted by Versaweb in the US, suballocated to "Silver Knight Enterprises Corp" of Las Vegas.
Update: here is another variant
Date: Tue, 1 May 2012 14:31:26 +0300
From: "PayPal" [notify@paypal.com]
Subject: RE:You just sent a payment to Enrique Peterson
You just sent a payment
Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Enrique Peterson
wcEnrique22@hotmail.com
Note to Thad Peterson
You haven't sent a note.
Shipping address - confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total $140.00 USD
Payment $60.00 USD
Payment sent to Enrique Peterson
Help Centre | Resolution Centre | Security Centre
This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal Email ID PP1526
The malicious payload is on 72.46.140.14/showthread.php?t=9d77a9163cda8dbe (report here) and is hosted by Versaweb in the US, suballocated to "Silver Knight Enterprises Corp" of Las Vegas.
Update: here is another variant
Date: Tue, 1 May 2012 19:54:34 +0700
From: "PayPal" [notify@paypal.com]
Subject: RE:You just sent a payment to Jame Peterson
You just sent a payment
Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Jame Peterson
wcJame22@hotmail.com
Note to Thad Peterson
You haven't sent a note.
Shipping address - confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total $100.00 USD
Payment $60.00 USD
Payment sent to Jame Peterson
Help Centre | Resolution Centre | Security Centre
This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click "Contact Us" at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal Email ID PP1526
Subscribe to:
Posts (Atom)