This spam leads to malware on hamasutra.ru:From: Lula Stevens [mailto:JolieWright@shaw.ca]
Sent: 20 November 2012 05:57
Subject: Don't forget about meeting tomorrow
Don't forget this report for meeting tomorrow.
See attached file. (Internet Explorer file)
This fake Southwest Airlines spam leads to malware at headerandfooterprebuilt.pro:Date: Mon, 19 Nov 2012 19:33:04 +0000
From: "Southwest Airlines" [no-reply@luv.southwest.com]
To: [redacted]
Subject: Southwest Airlines Confirmation: 5927NI
[redacted] 2012-11-19 86KY9Z INITIAL SLC WN PHX0.00T/TFF 0.00 END AY3.50$SLC2.50 1445164773311 2013-11-22 1655 2012-11-20 Depart SAN LEONARD CITY UT (SLC) at 8:08 PM on Southwest Airlines Arrive in PHOENIX AZ (PHX) at 9:02 PM
You're all set for your traveling!
My Account | Review My Itinerary Online
Check Up Online | Check Flight Status | Change Flight | Special Offers | Hotel Deals | Car Deals
Ready for lift-off!
Thanks Southwest for your travel! You can find everything you need to know about your booking below. Happy voyage!
Upcoming Cruise: 11/20/12 - SLC - Phx Knight
From: Administrator [mailto:administrator@victimdomain.com]In this case, the link bounces through two hacked legitimate sites to end up at [donotclick]5.chinottoneri.com/links/landing-philosophy_dry-suspende.php hosted on 50.61.155.86 (Fortress ITX, US). VirusTotal detections are pretty low. I suspect that there are many other malicious sites on this IP, blocking it would be wise.
Sent: 19 November 2012 14:50
Subject: To All Employee's - Important Address UPDATE
To All Employee's:
The end of the year is approaching and we want to ensure every employee receives their W-1 to the correct address.
Verify that the address is correct - https://local.victimdomain.com/details.aspx?id=[redacted]
If changes need to be made, contact HR at https://hr.victimdomain.com/update.aspx?id=[redacted].
Administrator,
http://victimdomaincom
This spam leads to malware on bamanaco.ru:Date: Mon, 19 Nov 2012 03:55:08 -0500
From: ups [admin@ups.com]
Subject: Re: FW: End of Aug. Statement Reqiured
Attachments: Invoices-1119-2012.htm
Hallo,
as reqeusted I give you inovices issued to you per oct. 2012 ( Internet Explorer/Mozilla Firefox file)
Regards
From: J. dee Edwards j.edwards@jdeeedwards.comFirstly, the email is sent to an address that ONLY spammers use, which is not a good sign. Secondly, the domain jdeeedwards.com has anonymous WHOIS details and was registered just over a month ago - the site is hosted on 54.247.87.188 (Amazon, Ireland) and looks like this:
Reply-To: j.edwards@jdeeedwards.com
Date: 17 November 2012 16:29
Subject: Edwards contact
Dear Colleague,
We are working with healthcare market companies which would like to hear your opinion.
We would like you to become a member of working group and share your opinion online. Please review your full name, specialty, country and language by clicking on the link http://www.jdeeedwards.com/contact.php?e=[redacted] or replying to the email.
Thank you for your time.
J. dee Edwards HRms
j.edwards@jdeeedwards.com
http://www.jdeeedwards.com
To ensure that our emails reach you, please remember to add j.edwards@jdeeedwards.com to your email address book.
We would like to remind you that J. dee Edwards is committed to safeguarding your privacy and your personal details will not be disclosed to third parties.
If you do not wish to receive please visit: http://jdeeedwards.com/unsub.php?e=[redacted]
Copyright 2012 - J. dee Edwards - 20 Broadwick Street London, UK
J. dee EdwardsNow, there did used to be a company called JD Edwards, but there isn't any more, nor is there a company called J. dee Edwards anywhere in the UK.
Human resources experts
We plan, direct, and coordinate the administrative functions of an organization. We oversee the recruiting, interviewing, and hiring of new staff; consult with top executives on strategic planning; and serve as a link between an organization’s management and its employees.
We are comming soon...
This fake "Changelog" spam leads to malware on feronialopam.ru:Date: Thu, 15 Nov 2012 10:43:59 +0300
From: "Xanga" [noreply@xanga.com]
Subject: Re: Changelog 2011 update
Attachments: changelog-12.htm
Hello,
as promised chnglog attached (Internet Explorer File)
==========
Date: Thu, 15 Nov 2012 05:43:09 -0500
From: Chaz Shea via LinkedIn [member@linkedin.com]
Subject: Re: Changelog as promised(updated)
Attachments: Changelog-12.htm
Hello,
as prmised changelog is attached (Internet Explorer File)
From: Anthony Tomei admin@8mailer.comYou should probably regard the domain chickenkiller.com as compromised and blog it. Additionall, allt he following IPs and domains are related and a probably malicious.
Reply-To: info@promotesmetasearch.net
To: donotemail@wearespammers.com
Date: 14 November 2012 18:22
Subject: launch of
Dear Future Millionaire,
Making $100,000 per month is not hard. In fact, there are 2 ways you accomplish this easy task of making money in a short period of time.
The first way is to...
Click HERE for the complete article>
Anthony Tomei is an Expert Internet Network Marketer. Anthony is known as the Master Marketer and practically gives away all of his secrets, methods and marketing techniques.
This email was sent by Promotes Metasearch, 710 E. Steve Wariner Dr., Vancouver, BC g1x3h4
Click here to unsubscribe
Date: Tue, 13 Nov 2012 12:27:15 -0500The malicious payload is at [donotclick]veneziolo.ru:8080/forum/links/column.php hosted on the same IPs seen earlier today, the following IPs and domains are all related:
From: Mathilda Allen via LinkedIn [member@linkedin.com]
Subject: Re: End of Aug. Statmeent required
Attachments: Invoices12-2012.htm
Good morning,
as reqeusted I give you inovices issued to you per sept. (Internet Explorer format)
Regards
These spam email messages lead to malware on monacofrm.ru:From: sales1@victimdomain.com [mailto:sales1@victimdomain.com]
Sent: 13 November 2012 04:04
Subject: Fwd: Your Flight A874-64581
Dear Customer,
FLIGHT NR: 1173-8627
DATE/TIME : JAN 27, 2013, 19:15 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 520.40 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
NAOMI PATTON,
==========
From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn
Sent: 13 November 2012 05:18
Subject: Re: Fwd: Your Flight A943-6733
Dear Customer,
FLIGHT NR: 360-6116
DATE/TIME : JAN 26, 2013, 14:12 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 997.25 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
Adon Walton,
==========
Date: Tue, 13 Nov 2012 08:20:21 +0400
From: accounting@victimdomain.com
Subject: Re: Your Flight A230-63955
Attachments: FLIGHT_TICKET_A04897499.htm
Dear Customer,
FLIGHT NR: 43070-0328
DATE/TIME : JAN 24, 2013, 12:19 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 323.97 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
SHERILYN BREWER,
==========
Date: Tue, 13 Nov 2012 02:14:56 +0700
From: LinkedIn Password [password@linkedin.com]
Subject: Re: Your Flight A13-6235
Attachments: FLIGHT_TICKET_A56970327.htm
Dear Customer,
FLIGHT NR: 7504-638
DATE/TIME : JAN 20, 2013, 18:10 PM
ARRIVING AIRPORT: SAN-DIEGO AIRPORT
PRICE : 089.74 USD
Your bought ticket is attached to the letter as a scan document .
To use your ticket you should print it.
ROSANA Gallo,
From: Amazon.com [mailto:account-update@amazon.com]
Sent: 13 November 2012 08:08
Subject: Fwd: Re: Wire Transfer Confirmation
Dear Bank Account Operator,
WIRE TRANSFER: FED8979402863338715
CURRENT STATUS: PENDING
Please REVIEW YOUR TRANSACTION as soon as possible.
NatWest : Helpful Banking
Dear Valued Member ;
To prevent unauthorized access to your accounts, your online service has been temporarily locked. No further log in attempts will be accepted.
This is a procedure that automatically occur when an invalid information is submitted during the log in process.
Please follow the provided steps below to confirm your identity
and restore your online access:
https://www.nwolb.com/Brands/NWB/images/backgrounds/widepod_header_bottom_purple_login.gif
© Legal Info – Security
© 2005-2012 National Westminster Bank Plc
This is a standard NatWest phish. It doesn't originate from Cableforum.co.uk or its servers, but it is sent to an address ONLY used for Cableforum, so it must have leaked out somehow.
So I received this email today:
Quote:
Date: Fri, 2 Nov 2012 10:15:08 -0400
From: NatWest Online [helpdesk@nwolb.com]
To: [removed]
Subject: Please Review Your Contact Details!!!
Dear Valued Member ;
To prevent unauthorized access to your accounts, your online service has been
+temporarily locked. No further log in attempts will be accepted.
..etc...
The email was sent to an address I've only used to register on Cable Forum and is a series of random characters that spammers wouldn't just 'guess'. Just wondering if anyone else has had this email?
I had two emails sent to both the addresses registered here on Cable Forum. Not sure why the earlier thread was so hastily closed?
Slightly off topic, why can I not edit my email address here?
When I attempt to change it I get this: The email address you entered is already in use. If you have forgotten your password, please click here.
I have not forgotten my password, I was trying to change it as well as my email.
Spammers don't "pick" anything. Their software generates emails at random and, yes, that includes strings_of_gibberish @yourdomain.and
This site has not sold your email address.
This site has not been hacked, cracked or compromised.
The end.
Thread closed.
Threads of the same topic that have been closed should not be re-opened/re-created no matter what the circumstances are.which prompted a response from the original reporter:
This issue cropped up several months ago and I will repeat what was said then...
We do not believe our systems have been compromised. There was no evidence to suggest an intrusion or breach took place. If anyone has any *Strong* Evidence to suggest other wise then contact us using the contact link below.
Thank you.
The only spam I had was today, didn't have any earlier. I did get an explanation from the mod that closed it about how he didn't feel the thread was useful and that it would attract unwanted replies. But I think preventing people from discussing the issue stinks of a cover up (whether it is or not).What's worse is that this isn't the first time that this has been reported. Here's another one:
It would be much better to at least post a link to that thread, or some sort of explanation of what they think is happening rather than a dismissive knee-jerk response that it didn't happen when three people have claimed to receive the same email (and Osem says it happened before). All I want is an explanation about what happened and a promise that security of MY data is important but I don't feel like I'm getting that.
Today I received a not-so-subtle phishing email pretending to come from Santander, sent to my one-off email address associated with my cableforum account. I registered my account in 2009 and it's the first time I get spam/phish on this address. I don't really care if CF was hacked since I used a unique pw/email, but maybe a warning to other users would be the polite thing to do...
Your database has been dumped and the damage is done as far as spam is concerned
now the question is are you
1) going to stick your head in the sand and thow around accusations
or
2) man up and fix the problem
But seriously, all in all, getting back to the main issue, there is about 5 people receiving it to their CF registered e-mail address and reporting it here so far. Co-incidence, yes but a very weak one.How many people do you think use unique emails for each site? Not many. That sort of evidence is very, very strong.. especially with multiple reports. That comment got this withering rebuke:
It's not a co-incidence at all. The emails are clearly of the same content and arrived within a small interval of each other and to CF-specific registered email addresses. If you're saying this is purely by chance and that all these email addresses were just "guessed" up by some automated program, then you're in denial.But another member of the CF team shows that they just don't understand it at all:
Given the extremely weak evidence provided and this appearing to only affect a very small number of members i.e less than 10, we do not believe that our systems have been breached and as a result we believe this to be the actions of brute force spamming.Really? All these people with unique email addresses report the same spam. And it just gets dismissed?
This spam leads to malware on canadianpanakota.ru:Date: Fri, 9 Nov 2012 11:55:11 +0530The attachment leads to a malicious payload at [donotclick]canadianpanakota.ru:8080/forum/links/column.php hosted on the following IPs:
From: LinkedIn Password [password@linkedin.com]
Subject: Re: Changlog 10.2011
Attachments: changelog4-2012.htm
Hello,
as promised changelog,(Internet Explorer File)
This fake invoice spam leads to malware on controlleramo.ru:Date: Wed, 7 Nov 2012 07:29:44 -0500
From: LinkedIn [welcome@linkedin.com]
Subject: Re: Intercompany inv. from Beazer Homes USA Corp.
Attachments: Invoice_e49580.htm
Hi
Attached the corp. invoice for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
Rihanna PEASE
Beazer Homes USA Corp.
Date: Thu, 8 Nov 2012 08:45:52 +0500
From: Ashley Madison [donotreply@ashleymadison.com]
Subject: Re: Inter-company invoice from Novellus Systems Corp.
Attachments: Invoice_c394579536.htm
Hallo
Attached the intercompany invoice for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
TOVA Link
Novellus Systems Corp.
==========
Date: Thu, 8 Nov 2012 06:31:13 +0530
From: Badoo [noreply@badoo.com]
Subject: Re: Intercompany invoice from Arch Coal Corp.
Attachments: Invoice_i450583.htm
Hallo
Attached the intercompany inv. for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot for supporting this process
BETTYE Caldwell
Arch Coal Corp.
==========
Date: Wed, 7 Nov 2012 06:52:01 -0600
From: BrendenHavlicek@hotmail.com
Subject: Re: Intercompany invoice from Brookdale Senior Living Corp.
Attachments: Invoice_q2665.htm
Hallo
Attached the intercompany inv. for the period July 2012 til Aug. 2012.(Internet Explorer file)
Thanks a lot
NOEMI STEPHENS
Brookdale Senior Living Corp.
From: Apple [mailto:appleid@id.arcadiadesign.it]
Sent: Tue 06/11/2012 18:30
Subject: Account Info Change
Hello,
The following information for your Apple ID [redacted] was updated on 11/06/2012:
Date of birth
Security question(s) and answer(s)
If these changes were made in error, or if you believe an unauthorized person accessed your account, please reset your account password immediately by going to iforgot.apple.com.
To review and update your security settings, sign in to appleid.apple.com.
This is an automated message. Please do not reply to this email. If you need additional help, visit Apple Support.
Thanks,
Apple Customer Support
TM and copyright © 2012 Apple Inc. 1 Infinite Loop, MS 96-DM, Cupertino, CA 95014.
All Rights Reserved / Keep Informed / Privacy Policy / My Apple ID
From: Keshawn Burns [mailto:MaribelParchment@hotmail.com]The attachment contains some obfuscated Javascript that redirects the visitor to a malicious payload on [donotclick]peneloipin.ru:8080/forum/links/column.php hosted on some IPs that have been used several times before for malware:
Sent: 06 November 2012 05:09
Subject: Scan from a Xerox WorkCentre Pro #47938830
Please open the attached document. It was scanned and sent
to you using a Xerox WorkCentre Pro.
Sent by: Keshawn
Number of Images: 5
Attachment File Type: .HTML [Internet Explorer file]
Xerox WorkCentre Location: machine location not set
