Sponsored by..

Tuesday, 4 December 2012

Facebook "You have notifications pending" spam / francese.ru

This fake Facebook spam leads to malware on francese.ru:


Date:      Tue, 4 Dec 2012 03:38:42 +0000
From:      KaseyElleman@victimdomain.com
Subject:      You have notifications pending

facebook
Hi,
Here's some activity you may have missed on Facebook.
SALLIE FELIX has posted statuses, photos and more on Facebook.
Go To Facebook
   
See All Notifications
This message was sent to postinialerts@[redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.

Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303

The malicious payload is at [donotclick]francese.ru:8080/forum/links/column.php  hosted on the following IP addresses:

42.121.116.38 (Aliyun Computing Co, China)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
208.87.243.131 (Psychz Networks , US)
219.255.134.110 (SK Broadband, Korea)

Plain list for copy-and-pasting:
42.121.116.38
202.180.221.186
203.80.16.81
208.87.243.131
219.255.134.110



US Airways spam / attachedsignup.pro

This fake US Airways spam leads to malware on attachedsignup.pro:


From:     US Airways - Booking [reservations@myusairways.com][
Date:     4 December 2012 14:30
Subject:     US Airways online check-in.
  
You can check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying internationally). After that, all you have to do is print your boarding pass and go to the gate.

Purchase code: 183303

Check-in online:  Online booking details

Payment method:  Credit card
Money will be withdrawn in next 3 days
   
Voyage

5990    
Departure city and time

Massachusets MA (DCA) 10:10 AM

Depart date: 12/05/2012    


We takes care to protect your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.

US Airways, 145 W. Rio Salado Pkwy, Tempe, AK 93426 , Copyright US Airways , All rights reserved. 
The payload and IP addresses are identical to this spam doing the rounds today.

"Most recent events on Facebook" spam / attachedsignup.pro

This fake Facebook spam leads to malware on Most recent events on attachedsignup.pro:

Date:      Tue, 4 Dec 2012 15:19:16 +0100
From:      " Facebook Security Team" [fractionallyb9@hendrickauto.com]
Subject:      Most recent events on Facebook

facebook
   
Hi [redacted],

You have closed your Facebook account. You can rebuild your account whenever you wish by logging into Facebook using your current login email address and password. Subsequently you will be able to take advantage of the site as usually.
Please use the link below to reactivate :
http://www.facebook.com/home.php
If this was you, please pass over this informer. If this wasn't you, please secure your account, as some outlaw person may be explore it.
Best regards, The FaceBook Team
Please note: Facebook will never ask for your personal data through email.

This message was sent to [redacted] from your profile details. Facebook, Inc., Attention: Department 437, PO Box 20000, Palo Alto, CA 96906
The malicious payload is at [donotclick]attachedsignup.pro/detects/links-neck.php (report here) hosted on 41.215.225.202 (Essar Wireless Kenya Ltd) which also hosts the probably malicious domain sessionid0147239047829578349578239077.pl

"ARK Bureau" (arkbureau.com) fake job offer

The ARK Architecture Bureau is a genuine company. This fake job offer is not from ARK Bureau, but is some sort of illegal activity such as money laundering.

Update: I didn't look closely enough at the site, I discovered that arkbureau.com is also fake, as is this email. See more below. This is still trying to recruit people for money laundering though.

From: Odette Holcomb [mailto:nbnian@esonchem.co.kr]
Sent: 03 December 2012 12:32
Subject: Help wanted.

POSITION: Customer Assistant

ABOUT COMPANY:
ARK Bureau has served hundreds of clients in the United Kingdom, Poland, France and Germany since 1998.

The firm was created by Lorinda Rogers, a young architect of Canadian origin. From its inception, ARK Bureau.s vision for design and construction was based on system approach, incorporating both building and landscape design. That philosophy has always meant the highest quality for our clients. That.s probably why ARK Bureau enjoys a strong loyalty from the past customers.

Now we have open vacancy in the U.S.: Customer Assistant

RESPONSIBILITIES:
- Process payments from customers;
- Filing invoices, statements and associated documents;
- Meet and exceed performance and time management goals;
- Other duties as required.

GENERAL SKILLS:
- High communication skills;
- Strong problem solving and planning skills;
- Experienced computer & internet user.

APPLY:
To apply please: arkbureaumanager@nokiamail.com
An alternative version uses the email address of arkbureau_manager@nokiamail.com. The two samples that I have seen have originating IP addresses of 174.52.171.8 (Comcast, US) and 109.173.54.245 (NCNET, Russia).

You should give this fake company a wide berth unless you want to end up in serious trouble with law enforcement.

Update: I had originally assumed from the amateurish spam email that arkbureau.com belonged to a genuine company. However, a search of UK company records shows no such company, the domain was only registered a month ago to an address which is actually consistent with the one on the site:

Domain Name: ARKBUREAU.COM     
                                  
 Registrant:                      
     N/A
    Allen Hart        (arkbureau@aol.com)
    108 Broadwick Street
    London
    London,W1F 8MT
    GB
    Tel. +44.448715283620    
                                  
 Creation Date: 16-Nov-2012 
 Expiration Date: 16-Nov-2013 


Their site is full of stock images (like the one below) which can be found in many other places, most of which appear to be in the US (where they don't have an office).

Fundamentally, the whole thing is a fake. A good-looking fake, but a fake nonetheless.

These contact details are presumably also bogus:
Int'l Customer Care: +1 646 583 0506

Our head office is located in London, UK:

108 Broadwick Street, London, W1F 8MT, UK
Phone: +44(0) 20 3290 1280
Fax: +44(0) 871 528 3620
Email: info@arkbureau.com

Since 2010 we also run a branch in Warsaw, Poland:

Pl. Pilsudskiego 3, 00-078 Warszawa, Poland
Phone: +48 22 208 4722
E-mail: info@arkbureau.com 
Well, a quick Google of "108 Broadwick Street" indicates that it probably doesn't exist. If we get down on the ground with Google Streetview we can see that Broadwick Street only goes up to number 76 which is a bank of cash machines. Also, the quoted postcode of W1F 8MT is wrong, that belongs to somewhere which is quite a walk from Broadwick Street.

Emails to info@arkbureau.com bounce, there is no such user configured on the server.

arkbureau.com itself is hosted on 64.191.88.71 (HostNOC, US). There are several other sites on the same server that look dedicated to either fraud or fake pharma. I would recommend that all of these sites are avoided:

abcforwarding.com
actualcard.net
afpeasttexas.org
agea-usa.com
arkbureau.com
armorebeauty.com
autosales.com.do
beauty-wish-list.info
bestdesignstudios.ru
bestdietpillsreviews.org
buycanadianviagraonline.com
byabovegroundpools.com
canada-cialis.net
canadian-viagra.org
cialis-40-mg.com
cialis-5-mg.org
cialisprofessionals.com
cr-goods.com
ctrlpack.com
curiote.com
debtcptl.com
dioxidesoftware.com
discount-levitra.com
diybeautifulbody.com
encom-fg.com
engagement-rings-gallery.com
executivehomeswaco.com
executivehomeswacotexas.com
fantastic-male-size.com
firstransfer.com
getmattresswarehouse.com
getusedhorsetrailers.com
globalmg.org
godrop.biz
hallgg.pl
happychickengrill.com
heidtgroup.com
hiphopsongs.us
iceraysfancard.com
ixcongroup.com
jaffe-inc.com
livesecurity.pro
livesecuritypro.org
magnitogorsk.ws
myparcelforwarding.com
newboxcenter.com
nhsgroup.net
nowamarket.com
parcelunited.net
paydayloan-assistant.com
plate-flipper.com
politcenter.org
power-meds.com
pragueprivate.com
preventpainnow.org
prolivesecurity.org
propackage.biz
provenlovetabs.com
purchase-tadalafil.com
releasebg.com
rezzonans.net
rezzonans.org
ruskombat.info
rxtabsworld.com
securitylive.pro
shengfangtex.com
stafer.pro
starbuckscorp.com
sterece.com
stuffarea.biz
thefce.com
top-email-software.com
travelscom.net
traversestate.com
trustedmensmeds.com
uniteddigitalmedia.com
usheadway.com
usstyle.org
vendconsulting.com
viacton.com
viagra-super-force.org
virodex.com
virtualizare.net
wedding-bouquets-gallery.com
weddingshoesbridalonline.com
your-drug-blog.com

Monday, 3 December 2012

"Scan from a Hewlett-Packard ScanJet" spam / somaliaonfloor.ru

This fake printer spam leads to malware on somaliaonfloor.ru:

Date:      Mon, 3 Dec 2012 09:25:59 -0600
From:      Bebo Service [service@noreply.bebo.com]
Subject:      Fwd: Re: Scan from a Hewlett-Packard ScanJet #3838

A document was scanned and sent to you using a Hewlett-Packard HP15310290

Sent to you by: ROSIO
Pages : 8
Filetype(s): Images (.jpeg) View

==========

Date:      Mon, 3 Dec 2012 11:06:22 -0500
From:      "service@paypal.com" [service@paypal.com]
Subject:      Re: Fwd: Scan from a Hewlett-Packard ScanJet 33712789

A document was scanned and sent to you using a Hewlett-Packard HP8220647

Sent to you by: CLAUDIA
Pages : 7
Filetype(s): Images (.jpeg) View
The malicious payload is at [donotclick]somaliaonfloor.ru:8080/forum/links/public_version.php hosted on the same IPs used in this attack.

113.197.88.226 (ULNetworks, Korea)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)

ADP spam / fsblimitedrun.pro

This fake ADP spam leads to malware on fsblimitedrun.pro:

From:     ADP Transaction Status
Date:     3 December 2012 17:55
Subject:     ADP Major Accounts Processed Case

Valued customer:

 

James lately covered Transaction at your account. Event # 433933082.

     Case Caption: 6CO7

      Incident Substantiation: Download



We at ADP obtain to create a personalized and client focused experience with every client interaction.
Please view transaction changed by
visiting the link below.


Click here - ADP Major Accounts Operation Progress mentioned above

Best Wishes,

     James Brooks

     Vice President of Customer Care Department ADP

     ADP Major Accounts

 

 ***Reminder***

Please remember to complete your Semi-Annual Service Quality Survey!

Our Goal is to ensure you are VERY SATISFIED with each interaction you have with our Service Associates and we ask that you consider your overall experience in the 6 months preceding your receipt of the survey. We strive to provide WORLD CLASS SERVICE and determine our success by your satisfaction with ADP's services.

**********

This e-mail was delivered from an robot account.

Please don't reply to this message. auomatic informational system unable to accept incoming email.

**********
The malicious payload is at [donotclick]fsblimitedrun.pro/detects/survey_success-complete.php hosted on 41.215.225.202 (Essar Wireless Kenya Ltd) along with the following malicious domain: fdic-update-install.info

Blocking access to this IP address would probably be prudent.

Wire Transfer spam / panamechkis.ru

This fake wire transfer spam leads to malware on panamechkis.ru:


Date:      Mon, 3 Dec 2012 11:34:38 +0330
From:      HarrisonCrumm@mail.com
Subject:      RE: Wire Transfer cancelled

Dear Customers,

Wire transfer was canceled.



Rejected transfer:

FED NUMBER: 1704196955WIRE580676

Transaction Report: View



Federal Reserve Wire Network
The malicious payload is at [donotclick]panamechkis.ru:8080/forum/links/column.php hosted on:

113.197.88.226 (ULNetworks, Korea)
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)

Of these, 113.197.88.226 seems to be a new one which should be added to your blocklists.

Friday, 30 November 2012

"Copies of Policies" spam / podarunoki.ru

This spam leads to malware on podarunoki.ru:


Date:      Fri, 30 Nov 2012 04:54:30 -0300
From:      Jone Castaneda via LinkedIn [member@linkedin.com]
Subject:      RE: Leonie - Copies of Policies.

Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.

Here is the Package and Umbrella,

and a copy of the most recent schedule.

Leonie Doyle,

==========


Date:      Fri, 30 Nov 2012 02:32:21 -0400
From:      sales1@[victimdomain].com
Subject:      RE: Samson - Copies of Policies.

Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.

Here is the Package and Umbrella,

and a copy of the most recent schedule.

Samson Henry,


The malicious payload is at [donotclick]podarunoki.ru:8080/forum/links/column.php hosted on some familiar IP addresses which should be blocked if you can:

202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)

The following domains are also on the same servers:
gurmanikia.ru
ganiopatia.ru
ganalionomka.ru
genevaonline.ru
podarunoki.ru
binaminatori.ru
ganadeion.ru
dimarikanko.ru
delemiator.ru