Another batch of malware sites to block on 194.28.115.150 following on from these.. although to be franking, blocking access to 91.211.200.0/22 and 194.28.112.0/22 (Specialist ISP) plus all .rr.nu domains would be even better.
This spam leads to malware on qapskhnxlfuc.info:Date: Thu, 09 Aug 2012 21:25:41 +0200
From: "New order" [30F5DC6@tendbeyond.com]
To: [redacted]
Subject: Verify your order
Dear [redacted],
please verify your order #447256 at http://mailnegnu.com/FlashSoundNew/welcome19205.php?user_id=[redacted]&order_id=1EDDB29B4E
We hope to see you again soon!
Another round of "Your photos" spam is in the offing, with a malicious payload on [donotclick]gorysevera.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following IPs that have been seen several times before lately:
I'm not sure of the particular nature of the spam run involved (it is possibly a UPS themed attack), but there's a campaign underway with a malicious payload on [donotclick]panamamoskow.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following IPs:This is an updated list of evil domains on 194.28.115.150 (Specialist ISP in Transnistria). Blocking all of 194.28.112.0 - 194.28.115.255 (194.28.112.0/22) is the best idea, and blocking traffic to .rr.nu ain't a bad one either. But if you can only block by domains names then this is the latest list of malware-laden sites to avoid:
Date: Tue, 7 Aug 2012 16:34:21 +0200The malicious payload is at [donotclick]remindingwands.org/main.php?page=861097b084221fd although at the moment it is not responding. This site is hosted on 78.87.123.114 (CYTA, Greece) which is a particularly evil IP that has been seen a lot of lately and can safely be blocked.
From: "123Greetings.com" [ecards@123greetings.com]
Subject: New e-card for you.
Vanna amet.diam.eu@lorem.ca has just sent you an ecard from 123Greetings.com
You can view it by clicking here:
http://www.123greetings.com/send/view/999095:
Thanks to our new tracking feature, you can now access all the ecards received by you in the last 14 days.
Use the link below or copy & paste the link into your browser's address bar.
http://www.123greetings.com/connect/track
Or if you prefer you can go to http://www.123greetings.com/ and type your ecard number (0090593007) in the "Search Box" at the top right of the page.
Your ecard can be downloaded for the next 30 days.
Based on user feedback, 123Greetings.com has launched 6 new pages with the best ecards in the Most Popular/ Most Viewed/ Highest Rated/ Latest Additions/ Popular Now and Always There Sections listed on the homepage.
http://www.123greetings.com/top/most_popular.html
http://www.123greetings.com/top/most_viewed.html
http://www.123greetings.com/top/highest_rated.html
http://www.123greetings.com/top/latest.html
http://www.123greetings.com/top/popular_now.html
http://www.123greetings.com/top/always_there.html
If you need any help in viewing your ecard or any other assistance,
please visit our Help/ FAQ section at: http://help.123greetings.com/
We hope you enjoy your ecard,
Your friends at 123Greetings.com
http://www.123greetings.com
We respect your privacy. You will not be receiving any promotional emails from us
because of this ecard. To view our privacy policy, click on the link below:
http://info.123greetings.com/company/privacy_policy.html
Note: This is an auto generated mail. Please do not reply.
If you have any other problem please contact us by clicking on the following link:
http://help.123greetings.com/contact_us.html
This email was sent by 123Greetings.com, Inc., 1674 Broadway, New York, NY 10019.
There's not much to the recurring "Your Photos" spam apart from some terse text and a link. In this case the spam leads to a malicious payload at [donotclick]pussyriotss.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here).
Date: Mon, 6 Aug 2012 17:07:08 +0300
From: "LinkedIn Invitations" [invitations@linkedin.com]
To: [redacted]
Subject: Your friend sent you an invitation to join LinkedIn group.
This is a notification that on August 5, Gage Herring sent you an invitation to become part of their professional network at LinkedIn.
Accept Gage Herring Invitation
On August 5, Gage Herring wrote:
> To: [redacted]
>
> I'd like to add you to my professional network on LinkedIn.
>
> Gage Herring
You are receiving Reminder emails for pending invitations. Unsubscribe.
� 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.
==========
Date: Mon, 6 Aug 2012 10:02:02 -0400
From: "LinkedIn Invitations" [invitations@linkedin.com]
To: [redacted]
Subject: LinkedIn inviation notificaltion.
This is a notification that on August 5, Daniel Martinez sent you an invitation to join their professional network at LinkedIn.
Accept Daniel Martinez Invitation
On August 5, Daniel Martinez wrote:
> To: [redacted]
>
> I'd like to add you to my professional network on LinkedIn.
>
> Daniel Martinez
You are receiving Reminder emails for pending invitations. Unsubscribe.
� 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.
This fake PayPal spam leads to malware on spb-koalitia.ru:Subject: Welcome to PayPal - Choose your way to pay
Welcome
Hello [victim],
Thanks for paying with PayPal.
We congratulate you with your first Paypal money transfer. But we have hold it for the moment because the amount is over the security borders of our rules.
Here is what we have on file for you. Take a second to confirm we have your correct information.
[reciptient]@victimdomain.com
Confirmation Code
1509-3962-8257-3886-7087
Transfer Information
Amount: 18217.81 $
Reciever: Marcie William
E-mail: [another-recipient]@victimdomain.com
Accept Decline
Help Center | Security Center
Please don't reply to this email. It'll just confuse the computer that sent it and you won't get a response.
Copyright 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal Email ID PP9335
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________
From: UL05 UL05@app12.sarvdns.org
Reply-To: UL05@app12.sarvdns.org
Date: 3 August 2012 17:26
Subject: Accident Injuries
Auto Axident
Claim Comfort
Home
Injury / Claim types
Contact Us
Welcome
Header Image
We are the accident claim specialists, offering free advice, downloads and access to top no win no fee personal injury solicitors.There are many types of Personal Injury like
Road Traffic Accident
Work Accident
Accident at Sea
Aircraft Accident
Faulty Product Accident
Hairdressing Accident
Holiday Accident
Medical Negligency Accident
Public Place Accident
Did you have an injury in the last two years?
If yes, Apply for Compensation below.
Apply for Claim here
Step 1
RTA ( SELF MEDICATING CLAIMANT )
[snipped]
© Copyright 2012 autoaxident.com. All Rights Reserved.
Powered by SARV Mail
Click here to unsubscribe
from: AnnieThomas alaska05@rediffmail.com
date: 6 August 2012 08:15
subject: Re: RTA - Injuries
Awaiting your reply.
Annie Thomas
From: "Swati"[alaska05@rediffmail.com]
Sent: Sat, 04 Aug 2012 14:11:40
Subject: RTA - Injuries
Dear Mr. Xxxx Xxxx
Thanks for sending us your message.
Please send your contact phone number and address.
Also if you have time please fill up form available at www.autoaxident.com and press continue button instead of submit to get the full claim form to be filled.
Upon receipt of your phone number solicitor Mr. Lamb Brook will contact you for compensation for your injury
---
Annie Thomas
Customer Care Executive
Auto Accident Claim Company
London
Phone No. +44 20 3286 4645
Website - www.autoaxident.com
Another AT&T spam, this time leading to a working malicious payload on searchlesswebwasher.info:Date: Fri, 3 Aug 2012 16:54:24 +0100
From: "AT&T Online Services" <alert@email.att-mail.com>
Subject: Your AT&T bill is ready to be paid now.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
att.com | Support | My AT&T Account
<td style="padding: 0px 10px 0px 10px;" width:34%="" valign="top">
Your online bill is ready to be viewed
Dear Valued Customer,
A new bill for your AT&T account is ready.
Any operations completed after your bill period expires will not be shown in the bill amount listed directly below. If you have made a recent payment, please refer to the current balance on the Account Overview and the Bill & Payments pages.
Service Account ending in Bill Amount Due Date
Internet and Home Phone 3 $808.32 08/06/2012
Log in to online account management to view your bill and bill notices, maintain your email account or make a payment. If you are not registered for online account management, you must do so to view and print your full bill and bill notices at www.att.com/managemyaccount.
Log in to online account management to view your bill, maintain your email account or make a payment.
Thank you for choosing AT&T. We value your business and look forward to serving you!
Thank you,
AT&T Online Services
www.att.com
Contact Us
AT&T Support - quick & easy support is available 24/7.
Moving Soon?
Stay connected with AT&T. Visit us online at att.com/move.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
AT&T Online Services
Get more time to do what you want. What would you do?
Show me how
Automatic Payments
Save time and pay your monthly bill automatically!
Sign up now
Special Offers
Visit our Special Offers to check out our best promotions.
Learn more
Online Information
AT&T Community
Repair
Home Phone
Special Offers
PLEASE DO NOT REPLY TO THIS MESSAGE
All replies are automatically deleted. For questions regarding this message, refer to the contact information listed above.
�2012 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks contained herein are the property of their respective owners.
Privacy Policy
This terse spam leads to malware on moskow-carsharing.ru:From: [redacted]The malicious payload is at [donotclick]moskow-carsharing.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here) hosted on the following IPs:
Sent: venerdì 3 agosto 2012 17:09
To: [redacted]
Subject: Your Photos
Hi,
your photos - http://www.[redacted].com/upload.htm
These fake AT&T spam emails lead to an attempted malware page at globixlowerright.org:Date: Fri, 3 Aug 2012 11:03:52 -0300The link goes through a legitimate (but hacked) site and attempts to load a malware page at [donotclick]globixlowerright.org/main.php?page=6df8994172330e77 (report here) but at the moment it is not resolving as the domain appears to have been de-registered.
From: "AT&T Online Services" [att-services@email.att-mail.com]
Subject: Pay your AT&T bill online
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
att.com | Support | My AT&T Account
<td style="padding: 0px 10px 0px 10px;" width:34%="" valign="top">
Your online bill is ready to be accessed
Dear Esteemed Customer,
A new bill for your AT&T services is prepared.
Any transactions completed after your bill period expires will not be shown in the bill amount listed directly below. If you have made a recent payment, please refer to the current balance on the Account Overview and the Bill & Payments pages.
Service Account ending in Bill Amount Due Date
Internet and Home Phone {LET:0 $460.46 08/06/2012
Log in to online account management to view your bill and bill notices, maintain your email account or make a payment. If you are not registered for online account management, you must do so to view and print your full bill and bill notices at www.att.com/managemyaccount.
Log in to online account management to view your bill, maintain your email account or make a payment.
Thank you for choosing AT&T. We value your business and look forward to serving you!
Thank you,
AT&T Online Services
www.att.com
Contact Us
AT&T Support - quick & easy support is available 24/7.
Moving Soon?
Stay connected with AT&T. Visit us online at att.com/move.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
AT&T Online Services
Get more time to do what you want. What would you do?
Show me how
Automatic Payments
Save time and pay your monthly bill automatically!
Sign up now
Special Offers
Visit our Special Offers to check out our best promotions.
Learn more
Online Information
AT&T Community
Repair
Home Phone
Special Offers
PLEASE DO NOT REPLY TO THIS MESSAGE
All replies are automatically deleted. For questions regarding this message, refer to the contact information listed above.
�2012 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks contained herein are the property of their respective owners.
Privacy Policy
==========
Date: Fri, 3 Aug 2012 10:25:59 -0300
From: "AT&T Online Services" [att-services@email.att-mail.com]
Subject: Your AT&T bill is ready to be viewed
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
att.com | Support | My AT&T Account
<td style="padding: 0px 10px 0px 10px;" width:34%="" valign="top">
Your online bill is ready to be accessed
Dear Valued Customer,
A new bill for your AT&T account is ready.
Any transactions made after your bill period expires will not be reflected in the bill amount listed directly below. If you have made a recent payment, please refer to the current balance on the Account Overview and the Bill & Payments pages.
Service Account ending in Bill Amount Due Date
Home Phone 1 $718.25 08/06/2012
Log in to online account management to view your bill and bill notices, maintain your email account or make a payment. If you are not registered for online account management, you must do so to view and print your full bill and bill notices at www.att.com/managemyaccount.
Log in to online account management to view your bill, maintain your email account or make a payment.
Thank you for choosing AT&T. We value your business and look forward to serving you!
Thank you,
AT&T Online Services
www.att.com
Contact Us
AT&T Support - quick & easy support is available 24/7.
Moving Soon?
Stay connected with AT&T. Visit us online at att.com/move.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
AT&T Online Services
Get more time to do what you want. What would you do?
Show me how
Automatic Payments
Save time and pay your monthly bill automatically!
Sign up now
Special Offers
Visit our Special Offers to check out our best promotions.
Learn more
Online Information
AT&T Community
Repair
Home Phone
Special Offers
PLEASE DO NOT REPLY TO THIS MESSAGE
All replies are automatically deleted. For questions regarding this message, refer to the contact information listed above.
�2012 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks contained herein are the property of their respective owners.
Privacy Policy
==========
Date: Fri, 3 Aug 2012 15:17:49 +0200
From: "AT&T Online Services" [att-services@email.att-mail.com]
Subject: Your AT&T bill is ready to be paid now.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
att.com | Support | My AT&T Account
<td style="padding: 0px 10px 0px 10px;" width:34%="" valign="top">
Your online bill is ready to be viewed
Dear Valued Customer,
A new bill for your AT&T services is prepared.
Any payments made after your bill period ends will not be shown in the bill amount listed directly below. If you have made a recent payment, please refer to the current balance on the Account Overview and the Bill & Payments pages.
Service Account ending in Bill Amount Due Date
Internet access 5 $373.39 08/06/2012
Log in to online account management to view your bill and bill notices, maintain your email account or make a payment. If you are not registered for online account management, you must do so to view and print your full bill and bill notices at www.att.com/managemyaccount.
Log in to online account management to view your bill, maintain your email account or make a payment.
Thank you for choosing AT&T. We value your business and look forward to serving you!
Thank you,
AT&T Online Services
www.att.com
Contact Us
AT&T Support - quick & easy support is available 24/7.
Moving Soon?
Stay connected with AT&T. Visit us online at att.com/move.
<td style="padding: 0px 10px 0px 10px;" width:33%="" valign="top">
AT&T Online Services
Get more time to do what you want. What would you do?
Show me how
Automatic Payments
Save time and pay your monthly bill automatically!
Sign up now
Special Offers
Visit our Special Offers to check out our best promotions.
Learn more
Online Information
AT&T Community
Repair
Home Phone
Special Offers
PLEASE DO NOT REPLY TO THIS MESSAGE
All replies are automatically deleted. For questions regarding this message, refer to the contact information listed above.
�2012 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks contained herein are the property of their respective owners.
Privacy Policy
from: Angela info@gytrademark.com
to: sales@[redacted].com
date: 3 August 2012 03:21
subject: Notice of Internet Intellectual Property
Dear Manager,
(If you are not the person who is in charge of this, please forward this to your CEO,Thanks)
This email is from China domain name registration center, which mainly deal with the domain name registration and dispute internationally in China and Asia.
On July 30th 2012, We received Keyya Ltd's application that they are registering the name "[redacted]" as their Internet Keyword and "[redacted].cn "、"[redacted].com.cn " 、"[redacted].asia "domain names etc.., they are China and ASIA domain names. But after auditing we found the brand name been used by your company. As the domain name registrar in China, it is our duty to notice you, so we are sending you this email to check. According to the principle in China, your company is the owner of the trademark, In our auditing time we can keep the domain names safe for you firstly, but our audit period is limited, if you object the third party application these domain names and need to protect the brand in china and Asia by yourself, please let the responsible officer contact us as soon as possible. Thank you!
Best Regards,
Angela Zhang
General Manager
Anhui Office (Head Office)
Registration Department Manager
Room 1008 Shenhui Building
Haitian Road, Huli Anhui, China
Office: +86 0553 4994789
Fax: +86 0553 4994789
web: www.yg-network.org
Date: Thu, 2 Aug 2012 02:27:38 -0300
From: LinkedIn Password [password@linkedin.com]
Subject: Reset Your LinkedIn Password
Hi altera,
Can’t remember your LinkedIn password? No problem - it happens.
Please use this link to reset your password within the next 1 day:
Click here
Then sign in to LinkedIn with your new password and the email address where you received this message.
Thanks for using LinkedIn!
This fake AT&T spam leads to malware on unboxhibernation.org:From: Tonya Bates [mailto:robot@craigslist.org]
Sent: 02 August 2012 14:08
Subject: Pay your AT&T bill online
Importance: High
att.com | Support | My AT&T Account
Your online bill is ready to be downloaded
Dear Valued Customer,
A new bill for your AT&T account is ready.
Any operations completed after your bill period expires will not be reflected in the bill amount listed directly below. If you have made a recent payment, please refer to the current balance on the Account Overview and the Bill & Payments pages.
Service Account ending in Bill Amount Due Date
Home Phone 6 $355.26 08/06/2012
Log in to online account management to view your bill and bill notices, maintain your email account or make a payment. If you are not registered for online account management, you must do so to view and print your full bill and bill notices at www.att.com/managemyaccount.
Log in to online account management to view your bill, maintain your email account or make a payment.
Thank you for choosing AT&T. We value your business and look forward to serving you!
Thank you,
AT&T Online Services
www.att.com
Contact Us
AT&T Support - quick & easy support is available 24/7.
Moving Soon?
Stay connected with AT&T. Visit us online at att.com/move.
AT&T Online Services
Get more time to do what you want. What would you do?
Show me how
Automatic Payments
Save time and pay your monthly bill automatically!
Sign up now
Special Offers
Visit our Special Offers to check out our best promotions.
Learn more
Online Information
AT&T Community
Repair
Home Phone
Special Offers
________________________________________
PLEASE DO NOT REPLY TO THIS MESSAGE
All replies are automatically deleted. For questions regarding this message, refer to the contact information listed above.
2012 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks contained herein are the property of their respective owners.
Privacy Policy
There is currently an injection attack using a script pointing to [donotclick]xinthesidersdown.com/sl.php doing the rounds. The malicious code is hosted on 194.28.115.150, the same IP address as used in this attack yesterday.
