Sponsored by..
Tuesday, 20 November 2012
5.estasiatica.com / 66.228.57.248
BLNX.L shares takes a dump
So it's quite amusing to see Blinx shares take a dump and drop 10% today. Why? Because of their associate with Michael Richard Lynch, a director of Blinkx and also former CEO of Autonomy Corporation, who finds himself in the centre of a massive row with new owners HP. HP have written off 87% of the value of their acquisition over alleged false accounting practices.
Presumably BLNX.L shareholders are worried that some of the toxic effects of this meltdown will also impact them. If these as-yet unproven allegations prove true, then who knows..
"Don't forget about meeting tomorrow" spam / hamasutra.ru
This spam leads to malware on hamasutra.ru:From: Lula Stevens [mailto:JolieWright@shaw.ca]
Sent: 20 November 2012 05:57
Subject: Don't forget about meeting tomorrow
Don't forget this report for meeting tomorrow.
See attached file. (Internet Explorer file)
In the sample I have seen, there is an attachment called Report.htm with some obfuscated javascript leading to a malicious payload at [donotclick]hamasutra.ru:8080/forum/links/column.php hosted on the following IPs:
82.165.193.26 (1&1, Germany)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
216.24.196.66 (Psychz Networks, US)
Plain list:
82.165.193.26
202.180.221.186
203.80.16.81
216.24.196.66
Monday, 19 November 2012
"Southwest Airlines" spam / headerandfooterprebuilt.pro
This fake Southwest Airlines spam leads to malware at headerandfooterprebuilt.pro:Date: Mon, 19 Nov 2012 19:33:04 +0000
From: "Southwest Airlines" [no-reply@luv.southwest.com]
To: [redacted]
Subject: Southwest Airlines Confirmation: 5927NI
[redacted] 2012-11-19 86KY9Z INITIAL SLC WN PHX0.00T/TFF 0.00 END AY3.50$SLC2.50 1445164773311 2013-11-22 1655 2012-11-20 Depart SAN LEONARD CITY UT (SLC) at 8:08 PM on Southwest Airlines Arrive in PHOENIX AZ (PHX) at 9:02 PM
You're all set for your traveling!
My Account | Review My Itinerary Online
Check Up Online | Check Flight Status | Change Flight | Special Offers | Hotel Deals | Car Deals
Ready for lift-off!
Thanks Southwest for your travel! You can find everything you need to know about your booking below. Happy voyage!
Upcoming Cruise: 11/20/12 - SLC - Phx Knight
The malicious payload is at [donotclick]headerandfooterprebuilt.pro/detects/quality_flyes-ticket_check.php hosted on 198.27.94.80 (OVH, US). There are probably other Bad Things on that IP address, I just can't see them yet.. blocking it would be a good precaution.
"W-1" spam / 5.chinottoneri.com
From: Administrator [mailto:administrator@victimdomain.com]In this case, the link bounces through two hacked legitimate sites to end up at [donotclick]5.chinottoneri.com/links/landing-philosophy_dry-suspende.php hosted on 50.61.155.86 (Fortress ITX, US). VirusTotal detections are pretty low. I suspect that there are many other malicious sites on this IP, blocking it would be wise.
Sent: 19 November 2012 14:50
Subject: To All Employee's - Important Address UPDATE
To All Employee's:
The end of the year is approaching and we want to ensure every employee receives their W-1 to the correct address.
Verify that the address is correct - https://local.victimdomain.com/details.aspx?id=[redacted]
If changes need to be made, contact HR at https://hr.victimdomain.com/update.aspx?id=[redacted].
Administrator,
http://victimdomaincom
"End of Aug. Statement Reqiured" spam / bamanaco.ru
This spam leads to malware on bamanaco.ru:Date: Mon, 19 Nov 2012 03:55:08 -0500
From: ups [admin@ups.com]
Subject: Re: FW: End of Aug. Statement Reqiured
Attachments: Invoices-1119-2012.htm
Hallo,
as reqeusted I give you inovices issued to you per oct. 2012 ( Internet Explorer/Mozilla Firefox file)
Regards
The malicious payload is at [donotclick]bamanaco.ru:8080/forum/links/column.php hosted on the following IPs:
203.80.16.81 (MYREN, Malaysia)
216.24.196.66 (Psychz Networks, US)
These IPs have been used to deliver malware several times recently, you should block access to them if you can.
Saturday, 17 November 2012
J. dee Edwards / jdeeedwards.com scam
From: J. dee Edwards j.edwards@jdeeedwards.comFirstly, the email is sent to an address that ONLY spammers use, which is not a good sign. Secondly, the domain jdeeedwards.com has anonymous WHOIS details and was registered just over a month ago - the site is hosted on 54.247.87.188 (Amazon, Ireland) and looks like this:
Reply-To: j.edwards@jdeeedwards.com
Date: 17 November 2012 16:29
Subject: Edwards contact
Dear Colleague,
We are working with healthcare market companies which would like to hear your opinion.
We would like you to become a member of working group and share your opinion online. Please review your full name, specialty, country and language by clicking on the link http://www.jdeeedwards.com/contact.php?e=[redacted] or replying to the email.
Thank you for your time.
J. dee Edwards HRms
j.edwards@jdeeedwards.com
http://www.jdeeedwards.com
To ensure that our emails reach you, please remember to add j.edwards@jdeeedwards.com to your email address book.
We would like to remind you that J. dee Edwards is committed to safeguarding your privacy and your personal details will not be disclosed to third parties.
If you do not wish to receive please visit: http://jdeeedwards.com/unsub.php?e=[redacted]
Copyright 2012 - J. dee Edwards - 20 Broadwick Street London, UK
J. dee EdwardsNow, there did used to be a company called JD Edwards, but there isn't any more, nor is there a company called J. dee Edwards anywhere in the UK.
Human resources experts
We plan, direct, and coordinate the administrative functions of an organization. We oversee the recruiting, interviewing, and hiring of new staff; consult with top executives on strategic planning; and serve as a link between an organization’s management and its employees.
We are comming soon...
The link in the email is some sort of signup thing, I guess it's the first part of a scam to recruit people for some sort of illegal activity.
Oddly, the email address is an "optional" component, so how are they going to contact you? Maybe it's the tracking code in the link.
Alternatively, you can reply by email and this is the third suspect thing, the mailserver is on 85.206.51.81 in Lithunia (AS8764 / LIETUVOS-TELEKOMAS). AS8764 is a pretty scummy netblock according to Google. 85.206.51.81 is also the IP address the spam was sent from.
So, a non-existent company with a month-old domain sends an email to an address only spammers use, from an email server in a dodgy part of cyberspace. Whatever this is, it is some sort of scam and is definitely best avoided.
Friday, 16 November 2012
Malware sites to block 16/11/12
chelseafun.net
cosmic-calls.net
dirtysludz.com
fixedmib.net
packleadingjacket.org
performingandroidtoios.info
65.131.100.90
75.127.15.39
82.145.36.69
108.171.243.172
218.102.23.220
Thursday, 15 November 2012
Changelog spam / feronialopam.ru
This fake "Changelog" spam leads to malware on feronialopam.ru:Date: Thu, 15 Nov 2012 10:43:59 +0300
From: "Xanga" [noreply@xanga.com]
Subject: Re: Changelog 2011 update
Attachments: changelog-12.htm
Hello,
as promised chnglog attached (Internet Explorer File)
==========
Date: Thu, 15 Nov 2012 05:43:09 -0500
From: Chaz Shea via LinkedIn [member@linkedin.com]
Subject: Re: Changelog as promised(updated)
Attachments: Changelog-12.htm
Hello,
as prmised changelog is attached (Internet Explorer File)
The malicious payload is at [donotclick]feronialopam.ru:8080/forum/links/column.php hosted on a familiar looking bunch of IP addresses that you really should block:
120.138.20.54 (Sitehost, New Zealand)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
Wednesday, 14 November 2012
promotesmetasearch.net promotes malware
This looks like a fake get-rich-quick scam email which is actually intended to distribute malware.
Originating IP is 5.39.101.233 (OVH, Germany). Spamvertised domains are 8mailer.com on 5.39.101.225 (OVH, Germany) and promotesmetasearch.net on 46.249.38.27 (Serverius Holding, Netherlands).
This last one is kind of interesting, because a) it's all in French and b) it contains a virus. The malware attempts to download an exploit kit from [donotclick]vodkkaredbuuull.chickenkiller.com/trm/requesting/requesting-pass_been_loaded.php which is kind of unfriendly, hosted on the same IP address.
The WHOIS details show a completely different name and address from the one quoted on the email:
Florence Buker
florence_buker05@rockfan.com
7043 W Avenue A4
93536 Lancaster
United States
Tel: +1.4219588211
Clearly the owner of promotemetasearch.net is up to no good, and I would suggest the Anthony Tomei connection might well be completely bogus.
From: Anthony Tomei admin@8mailer.comYou should probably regard the domain chickenkiller.com as compromised and blog it. Additionall, allt he following IPs and domains are related and a probably malicious.
Reply-To: info@promotesmetasearch.net
To: donotemail@wearespammers.com
Date: 14 November 2012 18:22
Subject: launch of
Dear Future Millionaire,
Making $100,000 per month is not hard. In fact, there are 2 ways you accomplish this easy task of making money in a short period of time.
The first way is to...
Click HERE for the complete article>
Anthony Tomei is an Expert Internet Network Marketer. Anthony is known as the Master Marketer and practically gives away all of his secrets, methods and marketing techniques.
This email was sent by Promotes Metasearch, 710 E. Steve Wariner Dr., Vancouver, BC g1x3h4
Click here to unsubscribe
46.249.38.21
46.249.78.23
46.249.38.27
deficiencieshiss.net
personaloverly.net
spaceyourfilesbig.chickenkiller.com
vodkkaredbuuull.chickenkiller.com
firefoxslacker.pro
personaloverly.net
wowteammy113.org
logicalforced.org
flashkeyed.org
incidentindie.org
sufficeextensible.org
laughspadstyle.org
check-update.org
softtwareupdate.org
internallycontentchecking.org
cordlesssandboxing.org
westsearch.org
perclickbank.org
trayscoffeecup.org
agreedovetails.org
commencemessengers.org
dfgs453t.org
disappointmentcontent.org
whiskeyhdx.org
uhgng43fgjl82309dfg99df1.com
rethnds732.com
odiushb327.com
a6q7.com
makosl.com
noticablyccleaner.com
leisurelyadventures.com
invitedns.com
srv50.in
flacleaderboard.in
frwdlink.in
tgy56fd3fj.firm.in
warrantynetwork.co.in
kclicksnet.in
reelshandsoff.info
scatteredavtestorg.info
ap34.pro
trafficgid.pro
stop2crimepeople.pro
huge4floorhouse.pro
exportlite.pro
weeembedding.pro
layer-grosshandel.pro
firefoxslacker.pro
s1topcrimefor.pro
opera-soft.pro
brauser-soft.pro
mp3soft.pro
pornokuca.net
licencesoftwareupda.net
settlementstored.net
licencesoftwareuppd.net
compartmentalizationwere.net
seniorhog.net
coinbatches.net
isnbreathy.net
mrautorun.ru
askedvisor.ru
srv50.biz
vimeosseeing.biz
threatwalkthrough.biz
promotemetasearch.net
Tuesday, 13 November 2012
"End of Aug. Statmeent" spam / veneziolo.ru
Date: Tue, 13 Nov 2012 12:27:15 -0500The malicious payload is at [donotclick]veneziolo.ru:8080/forum/links/column.php hosted on the same IPs seen earlier today, the following IPs and domains are all related:
From: Mathilda Allen via LinkedIn [member@linkedin.com]
Subject: Re: End of Aug. Statmeent required
Attachments: Invoices12-2012.htm
Good morning,
as reqeusted I give you inovices issued to you per sept. (Internet Explorer format)
Regards
41.168.5.140
62.76.46.195
62.76.178.233
62.76.186.190
62.76.188.246
65.99.223.24
84.22.100.108
85.143.166.170
87.120.41.155
91.194.122.8
103.6.238.9
120.138.20.54
132.248.49.112
202.180.221.186
203.80.16.81
207.126.57.208
209.51.221.247
213.251.171.30
216.24.194.66
canadianpanakota.ru
controlleramo.ru
denegnashete.ru
forumibiza.ru
kiladopje.ru
lemonadiom.ru
limonadiksec.ru
monacofrm.ru
moneymakergrow.ru
omahabeachs.ru
peneloipin.ru
rumyniaonline.ru
uzoshkins.ru
veneziolo.ru
"Your flight" spam / monacofrm.ru
These spam email messages lead to malware on monacofrm.ru:From: sales1@victimdomain.com [mailto:sales1@victimdomain.com]
Sent: 13 November 2012 04:04
Subject: Fwd: Your Flight A874-64581
Dear Customer,
FLIGHT NR: 1173-8627
DATE/TIME : JAN 27, 2013, 19:15 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 520.40 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
NAOMI PATTON,
==========
From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn
Sent: 13 November 2012 05:18
Subject: Re: Fwd: Your Flight A943-6733
Dear Customer,
FLIGHT NR: 360-6116
DATE/TIME : JAN 26, 2013, 14:12 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 997.25 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
Adon Walton,
==========
Date: Tue, 13 Nov 2012 08:20:21 +0400
From: accounting@victimdomain.com
Subject: Re: Your Flight A230-63955
Attachments: FLIGHT_TICKET_A04897499.htm
Dear Customer,
FLIGHT NR: 43070-0328
DATE/TIME : JAN 24, 2013, 12:19 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 323.97 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
SHERILYN BREWER,
==========
Date: Tue, 13 Nov 2012 02:14:56 +0700
From: LinkedIn Password [password@linkedin.com]
Subject: Re: Your Flight A13-6235
Attachments: FLIGHT_TICKET_A56970327.htm
Dear Customer,
FLIGHT NR: 7504-638
DATE/TIME : JAN 20, 2013, 18:10 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 089.74 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
ROSANA Gallo,
The malicious payload is at [donotclick]monacofrm.ru:8080/forum/links/column.php hosted on the following IPs:
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
216.24.194.66 (Psychz Networks, US)
The Mongolian and Malaysian IPs have been used several times for malware attacks, 216.24.194.66 looks like a new one. Blocking them all would probably be prudent.
Added:
There's a Wire Transfer spam using the same payload too:
From: Amazon.com [mailto:account-update@amazon.com]
Sent: 13 November 2012 08:08
Subject: Fwd: Re: Wire Transfer Confirmation
Dear Bank Account Operator,
WIRE TRANSFER: FED8979402863338715
CURRENT STATUS: PENDING
Please REVIEW YOUR TRANSACTION as soon as possible.
Monday, 12 November 2012
Cableforum.co.uk hacked?
NatWest : Helpful Banking
Dear Valued Member ;
To prevent unauthorized access to your accounts, your online service has been temporarily locked. No further log in attempts will be accepted.
This is a procedure that automatically occur when an invalid information is submitted during the log in process.
Please follow the provided steps below to confirm your identity
and restore your online access:
https://www.nwolb.com/Brands/NWB/images/backgrounds/widepod_header_bottom_purple_login.gif
© Legal Info – Security
© 2005-2012 National Westminster Bank Plc
This is a standard NatWest phish. It doesn't originate from Cableforum.co.uk or its servers, but it is sent to an address ONLY used for Cableforum, so it must have leaked out somehow.
So.. dutifully I pop across to Cableforum.co.uk and (changing my password en route) find the appropriate forum. It seems that the problem has already been spotted:
Here's one example:
So I received this email today:
Quote:
Date: Fri, 2 Nov 2012 10:15:08 -0400
From: NatWest Online [helpdesk@nwolb.com]
To: [removed]
Subject: Please Review Your Contact Details!!!
Dear Valued Member ;
To prevent unauthorized access to your accounts, your online service has been
+temporarily locked. No further log in attempts will be accepted.
..etc...
The email was sent to an address I've only used to register on Cable Forum and is a series of random characters that spammers wouldn't just 'guess'. Just wondering if anyone else has had this email?
That's odd. That's exactly the same as me. And then there's another one:
I had two emails sent to both the addresses registered here on Cable Forum. Not sure why the earlier thread was so hastily closed?
Slightly off topic, why can I not edit my email address here?
When I attempt to change it I get this: The email address you entered is already in use. If you have forgotten your password, please click here.
I have not forgotten my password, I was trying to change it as well as my email.
These are very precise reports from people using unique sign-on addresses. You'd think that would be pretty good evidence. So, armed with that you'd expect a concerned "we'll look into it" response. But instead the replies are:
Spammers don't "pick" anything. Their software generates emails at random and, yes, that includes strings_of_gibberish @yourdomain.and
This site has not sold your email address.
This site has not been hacked, cracked or compromised.
The end.
Thread closed.
Threads of the same topic that have been closed should not be re-opened/re-created no matter what the circumstances are.which prompted a response from the original reporter:
This issue cropped up several months ago and I will repeat what was said then...
We do not believe our systems have been compromised. There was no evidence to suggest an intrusion or breach took place. If anyone has any *Strong* Evidence to suggest other wise then contact us using the contact link below.
Thank you.
The only spam I had was today, didn't have any earlier. I did get an explanation from the mod that closed it about how he didn't feel the thread was useful and that it would attract unwanted replies. But I think preventing people from discussing the issue stinks of a cover up (whether it is or not).What's worse is that this isn't the first time that this has been reported. Here's another one:
It would be much better to at least post a link to that thread, or some sort of explanation of what they think is happening rather than a dismissive knee-jerk response that it didn't happen when three people have claimed to receive the same email (and Osem says it happened before). All I want is an explanation about what happened and a promise that security of MY data is important but I don't feel like I'm getting that.
Today I received a not-so-subtle phishing email pretending to come from Santander, sent to my one-off email address associated with my cableforum account. I registered my account in 2009 and it's the first time I get spam/phish on this address. I don't really care if CF was hacked since I used a unique pw/email, but maybe a warning to other users would be the polite thing to do...
But going back even further shows this thread with a lot of evidence that an email address leak has occured. One person who seems to know their stuff points:
Your database has been dumped and the damage is done as far as spam is concerned
now the question is are you
1) going to stick your head in the sand and thow around accusations
or
2) man up and fix the problem
One of the Cableforum team shows just how far they can bury their head in the sand
But seriously, all in all, getting back to the main issue, there is about 5 people receiving it to their CF registered e-mail address and reporting it here so far. Co-incidence, yes but a very weak one.How many people do you think use unique emails for each site? Not many. That sort of evidence is very, very strong.. especially with multiple reports. That comment got this withering rebuke:
It's not a co-incidence at all. The emails are clearly of the same content and arrived within a small interval of each other and to CF-specific registered email addresses. If you're saying this is purely by chance and that all these email addresses were just "guessed" up by some automated program, then you're in denial.But another member of the CF team shows that they just don't understand it at all:
Given the extremely weak evidence provided and this appearing to only affect a very small number of members i.e less than 10, we do not believe that our systems have been breached and as a result we believe this to be the actions of brute force spamming.Really? All these people with unique email addresses report the same spam. And it just gets dismissed?
But if you have the same problem.. forget it. All threads have been closed, creating new threads on the matter has been banned. In denial much?
Clearly there has been a problem for several months, although it isn't clear when such an address leak occurred or what data was taken with it. You should always assume that the passwords have been compromised and change it, plus change it anywhere that you re-use the same password.
Sadly, crap like this happens to good websites. And the best way to deal with it is to be honest and 'fess up so that members can act accordingly. Nobody likes to think that there site has been compromised, but in this case it clearly has been to some unknown extent.
I emailed Cableforum.co.uk to advise them (since new forum threads are banned). Let's see if I get a response..
Update: and other incidents are here and here.. so this isn't really an isolated problem.
Update 2: predictably, raising the issue just gets the thread closed with the phrase "There is nothing to discuss and I am not interested in wild theories and stupid accusations that some how there is a cover up." Which just shows that there is a cover up..
Update 3: and what is really ridiculous is that Cableforum mods are denying it, despite the fact that their site was recently hacked. And it isn't the first time, either.
Friday, 9 November 2012
Changelog spam / canadianpanakota.ru
This spam leads to malware on canadianpanakota.ru:Date: Fri, 9 Nov 2012 11:55:11 +0530The attachment leads to a malicious payload at [donotclick]canadianpanakota.ru:8080/forum/links/column.php hosted on the following IPs:
From: LinkedIn Password [password@linkedin.com]
Subject: Re: Changlog 10.2011
Attachments: changelog4-2012.htm
Hello,
as promised changelog,(Internet Explorer File)
120.138.20.54 (SiteHost, New Zealand)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
These IPs will probably be used in other attacks, blocking access to them now might be prudent. The following IPs and domains are all related:
120.138.20.54
202.180.221.186
203.80.16.81
canadianpanakota.ru
controlleramo.ru
donkihotik.ru
finitolaco.ru
fionadix.ru
forumibiza.ru
lemonadiom.ru
peneloipin.ru
moneymakergrow.ru
Thursday, 8 November 2012
getyourbet.org injection attack
Registrant ID:TOD-42842658
Registrant Name:ChinSec
Registrant Organization:ChinSec
Registrant Street1:Beijing
Registrant Street2:
Registrant Street3:
Registrant City:Beijing
Registrant State/Province:BJ
Registrant Postal Code:519000
Registrant Country:CN
Registrant Phone:+86.5264337745
Registrant Phone Ext.:
Registrant FAX:+86.5264337745
Registrant FAX Ext.:
Registrant Email:chinseccdomains@yahoo.com
The domain was created on 12th October. The IP address is in Russia (PIN-DEDICATEDSERVERS-NET).
This is a two stage attack, if getyourbet.org is called with the correct referrer parameters then the victim ends up at another server at 64.202.123.3 (Hostforweb, US) that tries to serve up a malicious payload. This server contains a bunch of subdomains from a hacked GoDaddy account.
pin.panacheswimwear.co.uk
physical.oneandonlykanuhura.com
pig.onmailorder.com
picture.onlyplussizes.com
person.nypersonaltrainers.com
pipe.payday-loanstoday.com
I've seen this sort of abuse of GoDaddy domains before, the main "www" domain resolves OK, but the subdomains get pointed elsewhere. There's either a problem with GoDaddy or this is done through a phish.
Anyway, block 64.202.123.3 and 31.184.192.237 if you can to prevent further attacks.
Wednesday, 7 November 2012
Intercompany Invoice spam / controlleramo.ru
This fake invoice spam leads to malware on controlleramo.ru:Date: Wed, 7 Nov 2012 07:29:44 -0500
From: LinkedIn [welcome@linkedin.com]
Subject: Re: Intercompany inv. from Beazer Homes USA Corp.
Attachments: Invoice_e49580.htm
Hi
Attached the corp. invoice for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
Rihanna PEASE
Beazer Homes USA Corp.
The attachment contains obfuscated Javascript that attempts to direct the visitor to a malicious payload at [donotclick]controlleramo.ru:8080/forum/links/column.php hosted on:
103.6.238.9 (Universiti Putra, Malaysia)
203.80.16.81 (MYREN, Malaysia)
209.51.221.247 (eNet, US)
These IP addresses have been used in several attacks recently, and you should block access to them if you can.
Some more samples:
Date: Thu, 8 Nov 2012 08:45:52 +0500
From: Ashley Madison [donotreply@ashleymadison.com]
Subject: Re: Inter-company invoice from Novellus Systems Corp.
Attachments: Invoice_c394579536.htm
Hallo
Attached the intercompany invoice for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
TOVA Link
Novellus Systems Corp.
==========
Date: Thu, 8 Nov 2012 06:31:13 +0530
From: Badoo [noreply@badoo.com]
Subject: Re: Intercompany invoice from Arch Coal Corp.
Attachments: Invoice_i450583.htm
Hallo
Attached the intercompany inv. for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
BETTYE Caldwell
Arch Coal Corp.
==========
Date: Wed, 7 Nov 2012 06:52:01 -0600
From: BrendenHavlicek@hotmail.com
Subject: Re: Intercompany invoice from Brookdale Senior Living Corp.
Attachments: Invoice_q2665.htm
Hallo
Attached the intercompany inv. for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot
NOEMI STEPHENS
Brookdale Senior Living Corp.
Tuesday, 6 November 2012
Apple "Account Info Change" spam / welnessmedical.com
From: Apple [mailto:appleid@id.arcadiadesign.it]
Sent: Tue 06/11/2012 18:30
Subject: Account Info Change
Hello,
The following information for your Apple ID [redacted] was updated on 11/06/2012:
Date of birth
Security question(s) and answer(s)
If these changes were made in error, or if you believe an unauthorized person accessed your account, please reset your account password immediately by going to iforgot.apple.com.
To review and update your security settings, sign in to appleid.apple.com.
This is an automated message. Please do not reply to this email. If you need additional help, visit Apple Support.
Thanks,
Apple Customer Support
TM and copyright © 2012 Apple Inc. 1 Infinite Loop, MS 96-DM, Cupertino, CA 95014.
All Rights Reserved / Keep Informed / Privacy Policy / My Apple ID
The fake pharma site (welnessmedical.com) is hosted on 84.22.127.43 along with a bunch of other ones, plus some additional sites one IP over at 84.22.127.44:
medmedsepub.com
newpharmsale.com
virustrapill.com
medicalmedprescription.com
medpillprescription.com
walgreensprescription.com
pilldrugstoregroup.com
medicineonlinephysic.ru
zkflwf.ru
ytti.ru
healthtabstablets.ru
healthcaremedstablets.ru
fitnesspillspharmacy.ru
mycareviagra.pl
diseasepillsmedicine.com
medicareryan.com
cialiswiladen.com
pharmvitamins.com
crashtab.net
healthtabsdrugstore.ru
ghem.ru
jium.ru
epoo.ru
ghas.ru
buymedicinepharmacy.ru
pillpillspharmacy.ru
onlinepharmabuy.ru
Oddly, 84.22.127.43 doesn't seem to be registered at RIPE. No matter, we know who the owner of 84.22.127.0 is:
inetnum: 84.22.127.0 - 84.22.127.7
netname: A84-22-127-0
descr: BLACK OPERATIONS
admin-c: CBMT1-RIPE
tech-c: CBMT1-RIPE
country: NL
status: ASSIGNED PA
mnt-by: MNT-CB3ROB
mnt-lower: MNT-CB3ROB
mnt-routes: MNT-CB3ROB
source: RIPE # Filtered
role: Ministery of Telecommunications
address: One CyberBunker Avenue
address: CB-31337
address: CyberBunker-1
address: Republic CyberBunker
mnt-by: MNT-CB3ROB
admin-c: CBMT1-RIPE
tech-c: CBMT1-RIPE
nic-hdl: CBMT1-RIPE
source: RIPE # Filtered
route: 84.22.96.0/19
descr: R84-22-96-0
origin: AS34109
mnt-by: MNT-CB3ROB
source: RIPE # Filtered
It's our old friends Cyberbunker again, who have registered the block with fake details. How RIPE lets them get away with this I don't know. If you can, I recommend blocking the entire 84.22.96.0/19 range as almost everything here is pretty seedy. You can read more about Cyberbunker's very dark grey hat activities over at Wikipedia if you want more information.
"Scan from a Xerox WorkCentre Pro" / peneloipin.ru
From: Keshawn Burns [mailto:MaribelParchment@hotmail.com]The attachment contains some obfuscated Javascript that redirects the visitor to a malicious payload on [donotclick]peneloipin.ru:8080/forum/links/column.php hosted on some IPs that have been used several times before for malware:
Sent: 06 November 2012 05:09
Subject: Scan from a Xerox WorkCentre Pro #47938830
Please open the attached document. It was scanned and sent
to you using a Xerox WorkCentre Pro.
Sent by: Keshawn
Number of Images: 5
Attachment File Type: .HTML [Internet Explorer file]
Xerox WorkCentre Location: machine location not set
65.99.223.24 (RimuHosting, US)
103.6.238.9 (Universiti Putra, Malaysia)
203.80.16.81 (MYREN, Malaysia)
The following malicious domains are also hosted on the same servers:
forumibiza.ru
kiladopje.ru
donkihotik.ru
lemonadiom.ru
peneloipin.ru
panacealeon.ru
finitolaco.ru
fidelocastroo.ru
ponowseniks.ru
dianadrau.ru
panalkinew.ru
fionadix.ru
SMS Spam: "Records passed to us show you're entitled to a refund approximately £2130"
Records passed to us show you're entitled to a refund approximately £2130 in compensation from mis-selling of PPI on your credit card or loan.Reply INFO or stop
In this case, the sender's number is +447585858897, although it will change as it gets blocked by the networks.
If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.
Subscribe to:
Posts (Atom)