NACHA spam / eminakotpr.ru

More fake NACHA spam, this time leading to malware on eminakotpr.ru:

Date:      Wed, 13 Feb 2013 05:24:26 +0530
From:      "ACH Network" [risk-management@nacha.org]
Subject:      Re: Fwd: ACH Transfer rejected

The ACH transaction, initiated from your checking acc., was canceled.

Canceled transfer:

Transfer ID: FE-65426265630US

Transaction Report: View

August BLUE

NACHA - The National Automated Clearing House Association

The malicious payload is at [donotclick]eminakotpr.ru:8080/forum/links/column.php hosted on:

46.175.224.21 (MAXNET Lukasz Hamerski, Poland)
91.121.57.231 (OVH, France)
202.72.245.146 (Railcom, Mongolia)

The following IPs and domains are all related and should be blocked:
46.175.224.21
91.121.57.231
202.72.245.146
bananamamor.ru
damagalko.ru
dekamerionka.ru
dfudont.ru
disownon.ru
dmpsonthh.ru
dmssmgf.ru
dumarianoko.ru
egihurinak.ru
elistof.ru
emaianem.ru
emalenoko.ru
eminakotpr.ru
enakinukia.ru
epianokif.ru
epilarikko.ru
epiratko.ru
esekundi.ru
esigbsoahd.ru
estipaindo.ru
evskindarka.ru
evujalo.ru
exiansik.ru
exibonapa.ru

Malware sites to block 13/2/13

These malicious sites appear to be part of a Waledac botnet. I haven't had much time to analyse what exactly what it going on, but here is one example from [donotclick]merwiqca.ru/nothing.exe: URLquery, VirusTotal, Comodo CAMAS, ThreatExpert.

I'm still working on IP addresses (there are a LOT), but these are the domains that I have managed to identify.. it is probably not an exhaustive list though.

afxeftof.ru
ahtiagge.ru
ajgijuap.ru
amxylkap.ru
apnifosa.ru
aqqajofi.ru
atxembef.ru
awetefid.ru
azvaebyn.ru
bakuzbuq.ru
bangurec.ru
bowbiluk.ru
bugfivin.ru
citpoloj.ru
copapjid.ru
didcufun.ru
dikojnah.ru
diqnawug.ru
diteqciq.ru
dubfoluc.ru
dohjapju.ru
dufyhive.ru
dyrzaqfu.ru
dyxketam.ru
ecrihgep.ru
egygumlo.ru
epejanhi.ru
ewenhugi.ru
fachejyp.ru
fawsilom.ru
fedvojvy.ru
fytfotlo.ru
gegwikaf.ru
guphumsa.ru
gybebeho.ru
gyvolnac.ru
gywquroz.ru
hikutcur.ru
ikbyznod.ru
ixfocgaf.ru
jiwviqpa.ru
jizugqux.ru
joljihuk.ru
junedles.ru
jureetse.ru
lafdamow.ru
linsubby.ru
linyaqor.ru
liwmiccu.ru
liwuwquh.ru
merwiqca.ru
narzoquc.ru
nozwyhvi.ru
nylzudwo.ru
nypmivhy.ru
nyzvelew.ru
ocbiccan.ru
ojvectyk.ru
ophirjih.ru
owideker.ru
papcybop.ru
pegkowoz.ru
picifcym.ru
pypwalve.ru
qiqwoxki.ru
qysmahku.ru
qysriloh.ru
rabpabyr.ru
racapsyq.ru
raguhloc.ru
rehvuwib.ru
rulwusyc.ru
secegbiw.ru
sedfibyr.ru
soduvnec.ru
solhusny.ru
sumjecyg.ru
syofzaim.ru
tijenric.ru
todqenym.ru
towmidar.ru
tubtihiv.ru
tunzovnu.ru
ugnyspyr.ru
vacrajak.ru
vehyfgor.ru
viackipa.ru
vibewpav.ru
voxyqjyc.ru
wowrizep.ru
xitydjeg.ru
xyjiekfe.ru
ypvudhek.ru
zazzeqan.ru
zehyqjol.ru
zempakiv.ru
zyqutfeb.ru
fpyyb.axcakqif.ru
gipwf7i.zempakiv.ru
gkca7nkr.tyryfpix.ru
boomsco.com
larstor.com
newrect.com

NACHA spam / thedigidares.net

This fake NACHA spam leads to malware on thedigidares.net:

Date:      Wed, 13 Feb 2013 12:10:27 +0000
From:      " NACHA" [limbon@direct.nacha.org]
Subject:      Aborted transfer

Canceled transaction
The ACH process (ID: 648919687408), recently sent from your bank account (by you), was canceled by the other financial institution.

Transaction ID:     648919687408
Cancellation Reason     Review additional info in the statement below
Transaction Detailed Report     Report_648919687408.xls (Microsoft/Open Office Word Document)


13150 Sunrise Street, Suite 100 Herndon, VA 20174 (703) 561-1200

� 2013 NACHA - The Electronic Payments Association

The malicious payload is at [donotclick]thedigidares.net/detects/irritating-crashed-registers.php (report here) hosted on:

134.74.14.98 (City College of New York, US)
175.121.229.209 (Hanaro Telecom, Korea)



The following IPs and domains are linked and should be blocked:
134.74.14.98
175.121.229.209
albaperu.net
capeinn.net
thedigidares.net
madcambodia.net
micropowerboating.net
dressaytam.net
acctnmrxm.net
albaperu.net
live-satellite-view.net
dressaytam.net

Something evil on 192.81.129.219

It looks like there's a nasty case of the Blackhole Exploit kit on 192.81.129.219 (see example). The IP is controlled by Linode in the US who have been a bit quiet recently. Here are the active domains that I can identify on this IP:

17.soldatna.com
17.coloryourpatiowholesale.com
17.silvascape.com
17.dcnwire.com
17.canyonturf.com
17.kdebug.com
17.soldatnacapital.com
17.swvmail.com
17.drycanyon.com
17.wolfmountaingroup.com
17.designerbiochar.com
17.easygardencolor.com
17.devicelogics.com
17.springwoodventures.com
17.designersoils.com
17.drdos.com
17.wolfmountainproducts.com
17.soldatnainvestments.com
17.themulchpit.com
17.soleradevelopment.com
17.silvasport.com
17.scenicdesign.us
17.dailyexpress.us
17.canyonturf.net
17.southwesttelecom.net
17.wlfmtn.net
17.coloryourpatio.net
17.designersoils.net
17.scenicdesign.biz

Changelog spam / emaianem.ru

This changelog spam leads to malware on emaianem.ru:

Date:      Tue, 12 Feb 2013 09:11:11 +0200
From:      LinkedIn Password [password@linkedin.com]
Subject:      Re: Changlog 10.2011

Good day,

changelog update - View

L. KIRKLAND

=================


Date:      Tue, 12 Feb 2013 05:14:54 -0600
From:      LinkedIn [welcome@linkedin.com]
Subject:      Fwd: Re: Changelog as promised(updated)

Good morning,

as prmised updated changelog - View

L. AGUILAR

The malicious payload is at [donotclick]emaianem.ru:8080/forum/links/column.php and is hosted on the same servers as found here.

IRS spam / micropowerboating.net

This fake IRS spam leads to malware on micropowerboating.net:

Date:      Tue, 12 Feb 2013 22:06:55 +0800
From:      Internal Revenue Service [damonfq43@taxes.irs.gov]
Subject:      Income Tax Refund TURNED DOWN

Hereby we have to note that Your State Tax Refund Appeal ({ID: 796839212518), recently has been RETURNED. If you believe that IRS did not properly estimate your case due to misunderstanding of the fact(s), be prepared to serve additional information. You can obtain refusal to accept details and re-submit your appeal by browsing a link below.

Please enter official website for information

Internal Revemue Service
Internal Revenue Services United States, Department of Treasury
9611 Tellus. Av.
Hours of Operation: Monday-Friday, 11:30AM - 16:30PM your local time.


==============================


Date:      Tue, 12 Feb 2013 15:00:35 +0100
From:      Internal Revenue Service [zirconiumiag0@irs.gov]
Subject:      Income Tax Refund NOT ACCEPTED

Hereby we hav to inform that Your Income Tax Refund Appeal ({ID: 46303803645929), recently has been CANCELED. If you believe that IRS did not properly estimate your case due to misapprehension of the fact(s), be prepared to equip additional information. You can obtain non-acceptance details and re-submit your appeal by browsing a link below.

Please browse official site for more information

Internal Revemue Service
Internal Revenue Services United States, Department of Treasury
3192 Aliquam Rd.
Hours of Operation: Monday-Friday, 11:30AM - 16:30PM your local time.


==============================

Date:      Tue, 12 Feb 2013 15:13:37 +0100 [09:13:37 EST]
From:      Internal Revenue Service [idealizesmtz@informer.irs.gov]
Subject:      Income Tax Refund TURNED DOWN

Hereby You notified that Your Income Tax Outstanding transaction Appeal (No: 8984589927661), recently was CANCELED. If you believe that IRS did not properly estimate your case due to misapprehension of the fact(s), be prepared to deliver additional information. You can obtain refusal of acceptance details and re-submit your appeal by using a link below.

Please enter official site for information

Internal Revemue Service
Internal Revenue Services United States, Department of Treasury
P.O. Box 265
Hours of Operation: Monday-Friday, 11:30AM - 16:30PM your local time. 

The malicious payload is on [donotclick]micropowerboating.net/detects/pending_details.php (report here) hosted on:

175.121.229.209 (Hanaro Telecom, Korea)
198.144.191.50 (Chicago VPS, US)

The following IPs and domains should be blocked:
175.121.229.209
198.144.191.50
micropowerboating.net 
morepowetradersta.com
asistyapipressta.com
uminteraktifcozumler.com
rebelldagsanet.com
madcambodia.net
acctnmrxm.net
capeinn.net
albaperu.net
live-satellite-view.net

eFax spam / estipaindo.ru

This fake eFax spam leads to malware on estipaindo.ru:

From: messages-noreply@bounce.linkedin.com
Sent: 12 February 2013 04:10
Subject: Efax Corporate

Fax Message [Caller-ID: 181999356]

You have received a 44 pages fax at Tue, 12 Feb 2013 05:10:03 +0100, (944)-095-3172.

* The reference number for this fax is [eFAX-101609258].

View attached fax using your Internet Browser.

________________________________________
© 2013 j2 Global Communications, Inc. All rights reserved.
eFax is a registered trademark of j2 Global Communications, Inc.

This account is subject to the terms listed in the eFax Customer Agreement. 

The malicious payload is at [donotclick]estipaindo.ru:8080/forum/links/column.php (report here) hosted on:

46.175.224.21 (Maxnet Lukasz Hamerski, Poland)
91.121.57.231 (OVH, France)
202.72.245.146 (Railcom, Mongolia)

The following IPs and domains can be blocked:
46.175.224.21
91.121.57.231
202.72.245.146
enakinukia.ru
dekamerionka.ru
evskindarka.ru
exibonapa.ru
dmssmgf.ru
epianokif.ru
elistof.ru
dmpsonthh.ru
esekundi.ru
egihurinak.ru
exiansik.ru
disownon.ru
epilarikko.ru
damagalko.ru
dumarianoko.ru
emalenoko.ru
epiratko.ru
evujalo.ru
bananamamor.ru
dfudont.ru
estipaindo.ru
emaianem.ru

Something evil on 46.165.206.16

This is a little group of fake analytics sites containing malware (for example), hosted on 46.165.206.16 (Leaseweb, Germany). Sites listed in  red   have already been tagged by Google Safe Browsing diagnostics, presumably the others have stayed below the radar.

adstat150.com
cexstat20.com
katestat77.us
kmstat505.us
kmstat515.us
kmstat530.com
lmstat450.com
mptraf11.info
mptraf2.info
mxstat205.us
mxstat570.com
mxstat740.com
mxstat760.com
rxtraf25.ru
rxtraf26.ru
skeltds.us
vmstat100.com
vmstat120.com
vmstat140.com
vmstat210.com
vmstat230.com
vmstat320.com

NACHA Spam / albaperu.net

This fake NACHA spam leads to malware on albaperu.net:

Date:      Mon, 11 Feb 2013 11:39:03 -0500 [11:39:03 EST]
From:      ACH Network [reproachedwp41@direct.nacha.org]
Subject:      ACH Transfer canceled

Aborted transfer
The ACH process (ID: 838907191379), recently initiated from your checking account (by one of your account members), was reversed by the other financial institution.

Transaction ID:     838907191379
Reason of Cancellation     See detailed information in the despatch below
Transaction Detailed Report     RP838907191379.doc (Microsoft Word Document)

                          

13150 Sunrise Drive, Suite 100 Herndon, VA 20172 (703) 561-1600

� 2013 NACHA - The Electronic Payments Association

The malicious payload is at [donotclick]albaperu.net/detects/case_offices.php (report here) hosted on:

175.121.229.209 (Hanaro Telecom, Korea)
198.144.191.50 (Chicago VPS, US)

 The following malicious domains are present on these IPs and should be blocked:
acctnmrxm.net
albaperu.net
asistyapipressta.com
capeinn.net
live-satellite-view.net
madcambodia.net
morepowetradersta.com
rebelldagsanet.com
uminteraktifcozumler.com

British Airways spam / epianokif.ru

This fake British Airways spam leads to malware on epianokif.ru:

Date:      Mon, 11 Feb 2013 11:30:39 +0330
From:      JamesTieszen@[victimdomain.com]
Subject:      British Airways E-ticket receipts
Attachments:     E-Ticket-N234922XM.htm



e-ticket receipt
Booking reference: DZ87548418
Dear,

Thank you for booking with British Airways.

Ticket Type: e-ticket
This is your e-ticket receipt. Your ticket is held in our systems, you will not receive a paper ticket for your booking.

Your itinerary is attached (Internet Exlplorer/Mozilla Firefox file)


Yours sincerely,

British Airways Customer Services

British Airways may monitor email traffic data and also the content of emails, where permitted by law, for the purposes of security and staff training and in order to prevent or detect unauthorised use of the British Airways email system.

British Airways Plc is a public limited company registered in England and Wales. Registered number: 74665737. Registered office: Waterside, PO Box 365, Harmondsworth, West Drayton, Middlesex, England, UB7 0GB.

How to contact us
Although we are unable to respond to individual replies to this email we have a comprehensive section that may help you if you have a question about your booking or travelling with British Airways.


If you require further assistance you may contact us

If you have received this email in error
This is a confidential email intended only for the British Airways Customer appearing as the addressee. If you are not the intended recipient please delete this email and inform the snder as soon as possible. Please note that any copying, distribution or other action taken or omitted to be taken in reliance upon it is prohibited and may be unlawful.

The malicious payload is at [donotclick]epianokif.ru:8080/forum/links/column.php (report here) hosted on:

82.148.98.36 (Qatar Telecom, Qatar)
195.210.47.208 (PS Internet Company, Kazakhstan)
202.72.245.146 (Railcom, Mongolia)

The following malicious domains can also be seen on these IPs:
epianokif.ru
enakinukia.ru
dekamerionka.ru
evskindarka.ru
exibonapa.ru
dmssmgf.ru
epianokif.ru
elistof.ru
dmpsonthh.ru
esekundi.ru
egihurinak.ru
exiansik.ru
disownon.ru
epilarikko.ru
damagalko.ru
dumarianoko.ru
emalenoko.ru
epiratko.ru
evujalo.ru
bananamamor.ru
dfudont.ru

Something evil on 46.163.79.209

The following sites are connected with some ADP-themed malware that has been doing the rounds for the past few days. As far as I can tell, they are some sort of download server for this malware, hosted on 46.163.79.209 (Host Europe, Germany), it all looks quite nasty.

social-neos.eu
cloud.social-neos.eu
quest.social-neos.eu
archiv.social-neos.eu
eyon-neos.eu
international.eyon-neos.eu
ns.eyon-neos.eu
euroherz.eyon-neos.eu

The domains look like they might be legitimate onese that have been hijacked, nonetheless blocking them would be an excellent move.

"Support Center" spam / phticker.com

Not malware this time, but this fake "Support Center" spam leads to a fake pharma site at phticker.com:

Date:      Mon, 11 Feb 2013 06:13:52 -0700
From:      "Brinda Wimberly" [noreply@mdsconsulting.be]
Subject:      Support Center

    Welcome to Help Support Center

Hello,

You have been successfully registered in our Ticketing System

Please, login and check status of your ticket, or report new ticket here

See All tickets
   
Go To Profile

This message was sent to [redacted]. Should you have any questions, or if you believe that you have received this in error please contact us at support center.

The site appears to be clean from a malware perspective and is hosted on 171.25.190.246 (Verus AS, Latvia) along with these other fake pharma sites:

nislevitra.com
tablethealthipad.com
tivozanibkimedicine.com
marijuanarxmedicine.com
drugstorepharmacycenterline.com
medicalwelhealthcare.com
physicianslnesshealth.com
newhealthpharm.com
gokeyscan.com
medpillsprescription.com
wichigenerics.com
boschmeds.com
pillcarney.com
healthviagraobesity.com
pharmedicinehat.net
rxlevitrainc.eu
tabletdrugipad.eu
pillsphysicpharma.ru
xree.ru
lxie.ru
zeap.ru
tabspharmacytablets.ru
pillsmedicalsrx.ru
poey.ru
ongy.ru
phticker.com

ADP spam / 048575623_02082013.zip

This fake ADP spam comes with a malicious attachment:

Date:      Fri, 8 Feb 2013 18:26:05 +0100 [12:26:05 EST]
From:      "ops_invoice@adp.com" [ops_invoice@adp.com]
Subject:      ADP Payroll Invoice for week ending 02/08/2013 - 01647

Your ADP Payroll invoice for last week is attached for your review. If you have any questions regarding this invoice, please contact your ADP service team at the number provided on the invoice for assistance.

Thank you for choosing ADP Payroll.

Important: Please do not respond to this message. It comes from an unattended mailbox.

In this case there was a ZIP file called 048575623_02082013.zip (this may vary) with an attachment 048575623_02082013.exe designed to look like a PDF file.

VirusTotal identifies it as a Zbot variant. According to ThreatExpert, the malware attempts to connect to the following hosts:

eyon-neos.eu
quest.social-neos.eu
social-neos.eu

These may be legitimate hacked domains, but if you are seeing unexpected traffic going to them then it could be a Zbot indicator.

BBB Spam / madcambodia.net

This fake BBB spam leads to malware on madcambodia.net:

Date:      Fri, 8 Feb 2013 11:55:55 -0500 [11:55:55 EST]
From:      Better Business Bureau [notify@bbb.org]
Subject:      BBB  details about your  cliente's pretense ID 43C796S77

Better Business Bureau ©
Start With Trust ©

Thu, 7 Feb 2013

RE: Issue No. 43C796S77

[redacted]

The Better Business Bureau has been booked the above mentioned claim letter from one of your purchasers in respect of their business contacts with you. The detailed description of the consumer's concern are available for review at a link below. Please pay attention to this subject and let us know about your judgment as soon as possible.

We pleasantly ask you to visit the GRIEVANCE REPORT to reply on this claim.

We awaits to your prompt response.

Best regards
Luis Davis
Dispute Advisor
Better Business Bureau

Better Business Bureau
3073  Wilson Blvd, Suite 600  Arlington, VA 23501
Phone: 1 (703) 276.0100   Fax: 1 (703) 525.8277


This note was sent to [redacted]. Don't want to receive these emails anymore? You can unsubscribe

The malicious payload is at [donotclick]madcambodia.net/detects/review_complain.php (report here) hosted on:

175.121.229.209 (Hanaro Telecom, Korea)
198.144.191.50 (Chicago VPS, US)

The following domains appear to be active on these IPs:
madcambodia.net
acctnmrxm.net
capeinn.net
starsoftgroup.net
live-satellite-view.net
morepowetradersta.com

MMuskatov / OVH malware sites to block

I've mentioned an OVH range of IPs allocated to a mystery  "MMuskatov" a couple of times before (here and here). It seemed like they needed a closer look.

The IP ranges are in the 5.135.67.x block, mostly in small /28 allocations hosted in different OVH datacentres in Europe. They are:
5.135.67.128 - 5.135.67.135
5.135.67.136 - 5.135.67.143
5.135.67.144 - 5.135.67.159
5.135.67.160 - 5.135.67.175
5.135.67.176 - 5.135.67.191
5.135.67.192 - 5.135.67.207
5.135.67.208 - 5.135.67.223
5.135.67.224 - 5.135.67.239
5.135.67.240 - 5.135.67.247

Obviously, that gives an contiguous block of 5.135.67.128 to 5.135.67.247 which is annoying difficult to express in CIDR notation. This is the best I can do:
5.135.67.128/26
5.135.67.192/27
5.135.67.224/28
5.135.67.240/29

If you don't mind a bit of collateral damage then you could simply block 5.135.67.128/25.I

Anyway.. what's so bad about this range? Well, as far as I can see, there are no legitimate sites here at all. But there do appear to be malware sites, suspicious subdomains of hijacked legitimate sites and other nasties. Quite a few have been registered very recently indeed, and to be honest I'm probably missing a lot of sites hosted in this range.

The sites are listed below. Sites listed as malware by Google are listed in  red , sites with a bad WOT rating are listed in  blue (there are no sites listed at both, so I can spare you from purple). You can safely assume that anything not blacklisted has just not been noticed yet. You can download a full list of the sites, IP addresses, WOT rating and the Google prognosis from here.

1aumir.biz
afito.nyxsus.net
agnitumsnuking.net
allrisor.com
analytics-djmusic-online.de
analytics-djmusic-online.info
analytics-djmusic-site.at
analytics-djmusic-site.com
analytics-djmusic-site.de
anarebrelleee.me
apeld.biz
azizmarizish2013.com
azizmarizish2013.info
azizmarizish2013.us
babynicefreelove.org
basicsensorcomfort.info
basteln5.de
bederg.biz
beratopl.sinanfe.com
besprof.samisales.com
bestfor.rotaract4670.org
bopljert.ultuma.com
brasenetworks.info
broki.wem44.com
browser.rainbowstarfish.com
carambala.com
charterd4.de
clomment.calenergy.info
clubs.sandipmistry.com
complexesuluation.info
creamvisitiorfinder.info
daimlerfidelity.info
daisychellenge.info
dasdasd.tss33.com
dasuycompletesuluation.info
dfhiod.biz
dhajbg.biz
djjgurda.com
djjgurda.us
domainsfiverich.com
dotguy.set-god.com
emporiomurmani.info
fakeferarri.info
fastmovekko.net
fbuniverse.net
federewf.org
firepow.l2firepower.com
first.bartych.com
frankmousepo.com
freepokee1.info
freepokee2.info
freepokee3.info
fromza.thirteentoedcat.com
fuchsduhastdiegansgestohlen.info
gertapo.bbcuteonline.com
gfssexcam.org
gfssexcamcum.com
ggty.oops-to.com
goodby.nissisystems.com
goodly.hukmen.com
gussi.info
heart.wheels4salvador.org
hernn.biz
heronew.biz
jagsertowns.com
jbworldtrd.com
joeturismo.com
kiloui.svxr.org
kinodrom.ivanwalker.net
ktxstat240.info
lake.frontsighlitigations.com
lefttendencies.net
lokoier.biz
loveplanetfr.org
lozytose2.de
mapplestory.info
mdopk.biz
meanse.ayesh.asia
mederf.biz
medoew.biz
mikil.hititbett.org
mini.sindiat.com
miniini.iosstore.org
mobile.mathyux.com
mojojojo.info
monoxy3.de
msner.slingthor.com
mybestprojextmm.com
my-res-to.com
myrisor.com
natrium7.de
natural9.de
ndqegsx.efx-capital.com
neregda.biz
nerero.biz
newrisor.com
news.webcam-archives.com
next.spacemonkeypirate.net
ninzaaa.commoninterestgroups.org
oploug.biz
perokil.biz
perstversion.info
poijert.ilaog.com
polocz.biz
powerpuffgirls.ru
price.hollywoodsaloon.us
provertymegastore.info
radarsky.biz
rainbowloveahaji.com
reseder.biz
resscience.com
res-to.com
risorgroup.com
risoronline.com
ronaldo.bangun.org
saledomainornott.biz
saledomainornott.co
saledomainornott.com
saledomainornott.in
saledomainornott.info
saledomainornott.me
saledomainornott.mobi
saledomainornott.net
scienceto.com
sec520.dyndns.info
sec521.dyndns.info
seghiv.biz
sexcamsfreenow.org
sfgjjj.biz
shop-best-good.info
shuttle4.de
sitesfiverich.com
sjbmb.biz
spannend3.de
srghoop.biz
stay.petersmunicipalconsultants.com
sun.frontsightbankruptcy.com
sunari9.de
supermegaextragood.info
swedpuikavrot.info
taste.frontsightblog.com
techntitus.com
termse.sharemomentwith.us
therisor.com
thewholespend.info
tikooo.afropod.com
tj6e8k.com
traespo.smoothasbeauty.com
trenere.biz
tydfghk.biz
ufrere.biz
umpi102.dyndns.info
umpi103.dyndns.info
unusedgb.net
vededd.biz
versetaility.info
vertigoz0ne.info
vertigoz0ne.net
vertigoz0ne.org
vertigozone.net
wdgwber.biz
wergxcb.biz
wryeuy.biz
xrifa.dhzq.net
yherem.biz
zaderf.biz

radarsky.biz and something evil on 5.135.67.160/28

There is currently an injection attack redirecting visitors to a domains radarsky.biz (for example) hosted on 5.135.67.173 (OVH) and suballocated to:

inetnum:        5.135.67.160 - 5.135.67.175
netname:        MMuskatov-FI
descr:          MMuskatov
country:        FI
org:            ORG-OH6-RIPE
admin-c:        OTC15-RIPE
tech-c:         OTC15-RIPE
status:         ASSIGNED PA
mnt-by:         OVH-MNT
source:         RIPE # Filtered

 "MMuskatov" was involved in this attack too, and a quick inspection of 5.135.67.160/28 doesn't look promising, you might want to block it and 5.135.67.144/28 and 5.135.67.192/28 as well. A deeper analysis is in progress.

+20 3 2983245 telepest

For some reason I've been plagued with cold calling telepests recently. This particular one (+20 3 2983245) offered the usual "press 5 to be ripped off" and "press 9 to try to unsubscribe which we will ignore" recorded message about claiming for an accident.

There was a very politely spoken and nice young man on the end of the phone. He seemed a bit perplexed and upset when I told him to f--k off and leave me alone. Good.

I don't know exactly who is behind this nuisance activity, but they were calling a TPS-registered phone from a number in Alexandria, Egypt. Offshoring fraudulent activity like this is quite common, but this is the first time that I've had to swear at an Egyptian. Perhaps the poor guy will consider doing something less scummy instead.

Update: unbelievably, they rang back again. This time I had a chat with another guy, and we had a discussion about my horrible industrial accident when my penis got caught in the shredder at work . There was blood everywhere, it was a real shocker for the other people in the office too. I asked where he was calling from, and he said Cambridge.. so I replied that it was odd that it appeared to be a number from Alexandria, and that he was a lying scumbag and please could he f--k off and never call me again. Oddly enough, he hung up.

FFIEC spam / live-satellite-view.net

This spam attempts to load malware from live-satellite-view.net, but fails because at the moment the domain isn't registered. However, you can expect them to try again.. so watch out for emails like this.

From: FFIEC [mailto:complaints@ffiec.gov]
Sent: 06 February 2013 16:17
Subject: FFIEC Occasion No. 77715


This summons is meant to make advise of file # 77715 which is opened and under interrogative with FFIEC following a accusation of your Financial Institution regarding suspect financial activity on your account.   
A hard copy of this judicial process will be delivered to your business address.
Our institution will forward information to competent government agencies following this accusation.
Information and contacts regarding your Occasion file # can be found at
   Occasion Number: 77715             
Observed by
 Federal Financial Institution Examination Council
   Emily Gray

The attempted download is from [donotclick]live-satellite-view.net/detects/advanced_selected_determines_comparison.php although it fails to resolve. Perhaps the registrar nuked the domain? However, it is possible to tell that the nameservers were ns1.http-page.net and ns2.http-page.net, and up investigate it turns out that all the following IPs and domains are related and should be treated as malicious:
7.129.51.158
31.170.106.17
74.4.6.128
98.144.191.50
175.121.229.209
198.144.191.50
208.117.43.145
222.238.109.66
able-stock.net
capeinn.net
duriginal.net
euronotedetector.net
gonita.net
gutprofzumbns.com
http-page.net
live-satellite-view.net
morepowetradersta.com
ocean-movie.net
starsoftgroup.net
vespaboise.net

inukjob.com fake job offer (also ineurojob.com and hollandsjob.com)

This fake job offer from inukjob.com involves illegal money laundering, and it also seems that the scammers want to use your identity for "correspondence" which normally means things like reshipping stolen goods and identity theft.

From: Victim
To: Victim
Date: 6 February 2013 09:16
Subject: Looking for remote assistants, paid $ 100 per hour helping other people


Good afternoon!

Is it possible for you to spare a few hours a week to the new occupation, which would increase your wages in 2-3 times, without investing a penny?  While you are looking for the trick in this offer, hundreds of your compatriots have already been reaping the benefits of working with us.
This is not a financial pyramid or marketing of any kind. It's about doing simple assignments, not exceed the limits of morals or ethics.

Your gender, age, employment do not matter - the main factors are your diligence and conscientiousness.
Lots of our employees began with a part-time employment and combined with other jobs, but two weeks later,
most of them devoted themselves to our job.

We are in all respects ready to remove all your doubts and help you to understand all details.
Position is called the "Regional Manager".

Functional duties:
- to represent the interests of foreign companies in the region (For example:  providing your address for correspondence.)
- to take control of transactions between the company and the client in your area.

For more information, please, email us attaching your CV, the country and city of residence.
It will considerably increase your chances for employment. Email: Kelsey@inukjob.com

Best Regards,
PR Manager

I've seen another variant with a reply address of Delores@inukjob.com. In all these cases, the email appears to come from the victim (here's why). Let's dig a little deeper into the domain. It turns out that it is registered by scam-friendly Chinese registrar BIZCN.COM.

The WHOIS details are fake:

   Tara Zwilling info@inukjob.com
   315-362-4562 fax: 315-362-4511
   3201 Oak Street
   Syracuse NY 13221
   us

There is no number 3201 Oak Street in Syracuse, New York (see for yourself) and the Zip code is incorrect, it should be 13203 and not 13221.

There's no web site, mail is handled by a server at 31.214.169.94 (Exetel, Germany).  The following mailservers can be found at that IP:

mx.ineurojob.com
mx.hollandsjob.com
mx.inukjob.com

You can assume that all these domains are fraudulent. If we dig a little deeper at the namesevers ns1.ariparts.net (also on 31.214.169.94) and ns2.ariparts.net (8.163.20.161, Level 3, US), then we can also find the following very dodgy domains:

hollandsjob.com
pracapolsk.com
ariparts.net
ineurojob.com

All these domains have fake or hidden registration details and can assume to be part of a scam. Avoid.

Update: Another version, 

Date:     7 February 2013 16:53
Subject:     You can earn an additional $ 200 per day helping your communi

I would like to take this time to welcome you to our hiring process
and give you a brief synopsis of the position's benefits and requirements.

If you are taking a career break, are on a maternity leave,
recently retired or simply looking for some part-time job, this position is for you.

Occupation: Flexible schedule 2 to 8 hours per day. We can guarantee a minimum 20 hrs/week occupation
Salary: Starting salary is 2000 GBP per month plus commission, paid every month.
Business hours: 9:00 AM to 5:00 PM, MON-FRI, 9:00 AM to 1:00 PM SAT or part time (UK time).

Region: United Kingdom.

Please note that there are no startup fees or deposits to start working for us.

To request an application form, schedule your interview and receive more information about this position
please reply to Rene@inukjob.com with your personal identification number for this position IDNO: 6376

Amazon.com spam / salam-tv.com

This fake Amazon email leads to malware on salam-tv.com:

Date:      Tue, 5 Feb 2013 18:32:06 +0100
From:      "Amazon.com Orders" [no-reply@amazon.com]
Subject:      Your Amazon.com order receipt.

    Click here if the e-mail below is not displayed correctly.
   
Follow us:                    
   
   
Your Amazon.com                         Today's Deals                 See All Departments    


Dear Amazon.com Customer,    
       

Thanks for your order, [redacted]!

Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.

Order Details:

E-mail Address: [redacted]
Billing Address:
1170 CROSSING CRK N Rd.
Fort Wayne OH 49476-1748
United States
Phone: 1- 749-787-0001

Order Grand Total: $ 91.99
   
Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More

Order Summary:
Details:
Order #:     C59-2302433-5787713
Subtotal of items:     $ 91.99
    ------
Total before tax:     $ 91.99
Tax Collected:     $0.00
    ------
Grand Total:     $ 90.00
Gift Certificates:     $ 1.99
    ------
Total for this Order:     $ 91.99
       
       
   
Find Great Deals on Millions of Items Storewide
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort from Amazon.com, please opt-out here.

� 2012 Amazon.com, Inc. or its affiliates. All rights reserved. Amazon, Amazon.com, the Amazon.com logo and 1-Click are registered trademarks of Amazon.com, Inc. or its affiliates. Amazon.com, 466 Sally Ave. N., Seattle, MA 71168-8282. Reference: 25090571

Please note that this message was sent to the following e-mail address: [redacted]

The malicious payload should be at [donotclick]salam-tv.com/detects/visit_putts.php but at the moment this domain doesn't seem to be resolving properly. A bit of digging around shows that it may be hosted on 198.144.191.50 (Chicago VPS, US) and the following malicious domains can be traced to that IP address:
morepowetradersta.com
capeinn.net
starsoftgroup.net
salam-tv.com