Porn site beeg.com hacked, aadserver.com and malware sites to block

This summary is not available. Please click here to view the post.

Something evil on 66.96.195.32/27

Another bad bunch of IPs hosted by Network Operations Center in Scranton following on from yesterday, this time 66.96.195.32/27 which seems to be more of the same thing.

The exploit kit in question is the Goon EK, as shown in this URLquery report. It seems that it spreads by malicious SWF files being injected into legitimate websites (I think this one, for example).

The easiest thing to do would be to block traffic to 66.96.195.32/27, but I can see the following malicious websites active in that range (all on 66.96.195.49):

uvz.akovikisk.com
ovfvr.akovikisk.com
qn65l.akovikisk.com
ac1e0.alessakyndraenho.com
8dyh.akovikisk.net
y6aoj.akovikisk.net
0hzl.akovikisk.info
cx6n.akovikisk.info
xdxr2.akovikisk.info
where.hotspotingtram.org

Experience with this particular type of exploit kit shows that the bad guys will rotate IPs in the block, so blocking the entire /27 is advised.

At present that consists of just three domains to block, although I suspect there will be more:

akovikisk.com
alessakyndraenho.com
hotspotingtram.org

prospectlist.com / prospectlist.co.uk spam

Never buy email marketing services from spammers.. unless you want your website suspended and reputation trashed. Here's a grubby little spammer using the domains prospectlist.co.uk and prospectlist.com to drive traffic to their grubby little business.

From:     Prospectlist prospectlist@cardwellmarketing.ctml2.com
Reply-To:     sarah.brazier@cardwellmarketing.co.uk
Date:     20 March 2014 10:00
Subject:     Here's the Deal!
Signed by:     ctml2.com

! DOUBLE YOUR TOP 50 CLIENTS!

*Give us the details of your best clients and we will find an additional 50*

ProspectList is the best business partner to supply up to date and accurate data, for you to use on direct mailing or telemarketing campaigns. PLUS, as we are now part of the Cardwell Group, we can even carry out your campaigns for you– offering a One Stop service.

WHY CHOOSE PROSPECTLIST?

With a database of over 2.6 million UK businesses, along with senior decision maker contacts, telephone numbers and emails, we can offer a comprehensive database on many business sectors. Our file is fully compliant to DMA guidelines, is tele-researched, has an update cycle of just 12 months and is ready for you to access TODAY!

CALL US NOW ON 01926 462 917 TO FIND OUT HOW YOU CAN BENEFIT FROM:

Direct Mail | Telemarketing  |  Email Lists  | International Data  |  Consumer Data

Bespoke Researched Data  |  Email Broadcasting  |  Mailing Fulfilment  |  Telemarketing

CONTACT US BY EMAIL
   

REQUEST A CALLBACK

2.6 million trading UK businesses                      Senior decision makers

Fully compliant with MPS/TPS/CTPS                 900k emails

12 months update cycle on 98% of our file       2.1 million contacts

If this email doesn't display properly, you can view it in your web browser

ProspectList | One Athena Court | Athena Drive | Warwick | CV34 6RT
If you no longer wish to receive emails from us, please follow this link

ProspectList claim to be compliant with DMA guidelines, but I certainly never opted-in to this crap. However the DMA is a prime example of why self-regulation fails.. it is run by the direct marketers themselves and in my opinion their regulations don't go far enough to protect people from this sort of unsolicited bulk email.

I've never heard of ProspectList or the Cardwell Group, and they would probably argue that everything they are doing is legal and above board yadayada. I certainly won't be sending any business their way though.

The domain in use for the spam is email.prospectlist.co.uk which forwards to prospectlist.com.
Let's have a look at the WHOIS details to see who exactly is responsible for this domain:

Registrant Name: Ian Merriman
Registrant Organization: Cardwell Intelligence Limited
Registrant Street: Cardwell House, Hook Norton Road
Registrant City: Chipping Norton
Registrant State/Province:
Registrant Postal Code: OX7 5SB
Registrant Country: GB
Registrant Phone: +44.8451306634
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ian.merriman@cardwellmarketing.co.uk

The site is hosted on 176.32.230.28 (Heart Internet, UK). The email is sent through mail132.sgml3.com (37.221.219.132).

Evil network: OVH Canada / r5x.org / Penziatki (updated)

I've covered OVH Canada and their black hat customer r5x.org aka "Penziatki" before. They consistently host exploit kits, and the way that the bad hosts are spread over OVH's network looks like a deliberate attempt at snowshoeing.

The following blocks in the OVH range have hosted malware from this customer. Some of the IPs are identified through my own research, others through OSINT from others, notably Frank Denis, @ReverseChris and #MalwareMustDie.

192.95.6.24/29
192.95.6.92/30
192.95.6.196/30
192.95.7.8/30
192.95.7.224/28
192.95.10.16/29
192.95.10.208/28
192.95.12.56/30
192.95.40.240/30
192.95.41.88/29
192.95.43.160/28
192.95.44.0/27
192.95.46.56/30
192.95.46.60/30
192.95.46.132/30
192.95.47.232/30
192.95.47.236/30
192.95.51.164/30
192.95.58.176/30

198.27.96.132/30
198.27.103.204/30
198.27.114.16/30
198.27.114.64/27

198.50.164.240/30
198.50.172.64/30
198.50.172.68/30
198.50.172.72/30
198.50.172.76/30
198.50.177.120/30
198.50.185.64/27
198.50.186.232/30
198.50.186.236/30
198.50.186.252/30
198.50.197.28/30
198.50.197.48/30
198.50.197.52/30
198.50.197.56/30
198.50.197.60/30
198.50.204.240/30
198.50.204.244/30
198.50.212.116/30
198.50.212.172/30
198.50.216.144/30
198.50.219.240/30
198.50.219.248/30
198.50.224.240/30
198.50.231.204/30
198.50.235.196/30
198.50.241.120/30
198.50.242.120/30
198.50.246.240/30
198.50.247.248/30
198.50.247.252/30
198.50.251.168/30
198.50.251.172/30

Given the large number of exploits, you might want to consider a larger pre-emptive block on the OVH Canada ranges if you are in a security-sensitive environment and can live with blocking some of the legitimate sites that OVH also host.

192.95.0.0/16
198.27.0.0/16
198.50.0.0/16

I'll try to keep this blog post updated with more bad OVH Canada ranges as they are brought to my attention. Please consider adding any new information to the Comments if you have some. Thanks!

NatWest "You have received a secure message" spam

This fake NatWest spam has a malicious attachment:

Date:      Wed, 19 Mar 2014 15:14:02 +0100 [10:14:02 EDT]
From:      NatWest [secure.message@natwest.co.uk]
Subject:      You have received a secure message

You have received a secure message

Read your secure message by opening the attachment, SecureMessage.zip. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.

If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the NatWest Bank Secure Email Help Desk at 0131 556 4226.
First time users - will need to register after opening the attachment.

About Email Encryption - http://www.natwest.com/content/global_options/terms/Email_Encryption.pdf

Attached to the message is an archive file SecureMessage.zip which in turn contains a malicious executable SecureMessage.scr which has a VirusTotal detection rate of 8/51.

Automated analysis tools [1] [2] [3] show attempted downloads from the following domains, both hosted on servers that appear to be completely compromised and should be blocked.

199.193.115.111 (NOC4Hosts, US)
droidroots.com
development.pboxhost.com

184.107.149.74 (iWeb, Canada)
2m-it.com
3houd.com

50.116.4.71 (Linode, US)
aulbbiwslxpvvphxnjij.biz
pwoovaijfrsryxeqtgojbuvsvsovkj.com    
ugfmnjojpinembyyprkoptjbtij.info    
nrhpfongapozhpfwkprxohofhq.biz    
byeqdaufqeujvugwczrocihqb.net    
geugypibqsfqirsogeovqwovvgqsfucm.com    
nvyxbmdfiguizcexgluoyxkjsw.ru    
xcvshidqgwotvfetvcydfajnof.com


Recommended blocklist:
199.193.115.111
184.107.149.74
50.116.4.71
droidroots.com
development.pboxhost.com
2m-it.com
3houd.com
aulbbiwslxpvvphxnjij.biz
pwoovaijfrsryxeqtgojbuvsvsovkj.com    
ugfmnjojpinembyyprkoptjbtij.info    
nrhpfongapozhpfwkprxohofhq.biz    
byeqdaufqeujvugwczrocihqb.net    
geugypibqsfqirsogeovqwovvgqsfucm.com    
nvyxbmdfiguizcexgluoyxkjsw.ru    
xcvshidqgwotvfetvcydfajnof.com

Something evil on 64.120.242.160/27

64.120.242.160/27 (Network Operations Center, US) is hosting a number of exploit domains (see this example report at VirusTotal). There appears to be a variety of badness involved, and many of the domains hosted in the range are flagged as malicious by Google or SURBL (report here [csv]).

There appears to be nothing legitimate in this whole range. Domains flagged as malicious by Google are highlighted, ones marked as malicious by SURBL are in italics. I would recommend you block the entire lot.

64.120.242.160/27
asifctuenefcioroxa.net
hukelmshiesuy.net
asifctuenefcioroxa.com
asifctuenefcioroxa.info
bmyahymenylag.com
bmyahymenylag.info
bmyahymenylag.net
briejttobaintwank.com
briejttobaintwank.net
cethadendalbuof.com
cethadendalbuof.info
cethadendalbuof.net
chebuecanuoc.com
chebuecanuoc.info
damaumrloiazsste.com
damaumrloiazsste.info
damaumrloiazsste.net
edjadehegile.com
edjadehegile.info
estebapenghiossewla.com
estebapenghiossewla.info
estebapenghiossewla.net
georgxoianeqnafoni.com
julynoonicl.com 
blejythecounyful.com
blejythecounyful.net
hanogaveleoy.com
lalaghoaujrnu.info
blejythecounyful.info
briejttobaintwank.info
bychemarlottelan.com
bychemarlottelan.info
bychemarlottelan.net
cunideaflphiae.com
cunideaflphiae.info
cunideaflphiae.net
edjadehegile.net
exyniosehyn.com
exyniosehyn.info
exyniosehyn.net
govlawsdepartment.com
griceumilldevake.com
hanogaveleoy.info
hanogaveleoy.net
harihbisovynangel.com
harihbisovynangel.info
harihbisovynangel.net
hukelmshiesuy.com
hukelmshiesuy.info
kpiaroleeom.com
kpiaroleeom.info
kpiaroleeom.net
lalaghoaujrnu.com
lalaghoaujrnu.net
lawsdepartment.com
lawsdepartmentgov.com
lawsdepartmentgov.net
lawsdepartmentlog.net
lawsdepartmentlogs.net
lawsgovdepartment.com
lawsgovdepartment.net
loryneanlauwvev.com
loryneanlauwvev.info
loryneanlauwvev.net
musxiiccharinbul.com
musxiiccharinbul.info
musxiiccharinbul.net
odtoidcatcarat.com
onivbyeylaxyver.com
onivbyeylaxyver.info
onivbyeylaxyver.net
uxsiekebergatki.com
uxsiekebergatki.info
uxsiekebergatki.net
westemarqannoriw.com
westemarqannoriw.info
westemarqannoriw.net

More OVH Canada hosted exploit kits

I've been a bit tardy with this look at the new OVH Canada ranges exposed by Frank Denis so some of these domains may already been dead.

Yesterday Frank identified three new OVH Canada ranges being used to host the Nuclear EK, again the customer is "r5x.org / Penziatki"

198.50.212.116/30
198.50.131.220/30
192.95.40.240/30

Update: also 192.95.51.164/30 according to this Tweet.

A full list of everything I can find is here [pastebin] but the abused domains that I have identified are:

shallowsvent.ru
riastrait.ru
chasmdell.ru
bararete.ru
overlooktableland.ru
volcanogully.ru
oceanhollow.ru
lavaisthmus.ru
overhangcoastline.ru
archipelagoriver.ru
coralreeflagoon.ru
rivermainland.ru
latitudebayou.ru
playacaldera.ru
morainegulch.ru
loesslakebed.ru
landformvale.ru
domehillside.ru
arroyogulch.ru
firthswamp.ru
coastmound.ru
atolllava.ru
passcove.ru

At a mininum I recommend that you block those IP ranges and/or domains.

Given the extremely poor reputation of these OVH Canada ranges, I would suggest blocking the following network ranges if you have a security-sensitive environment and are prepared to put up with the collateral damage of blocking some legitimate sites:
198.27.0.0/16
198.50.0.0/16
192.95.0.0/16

Something evil on 192.95.6.196/30

Another useful tip by Frank Denis on evil in the OVH Canada IP ranges, suballocated to their black hat customer "r5x.org / Penziatki", this time on 192.95.6.196/30.

The following domains should be considered as dangerous and I would recommend blocking them as soon as possible:
shoalfault.ru
addrela.eu
backinl.org

A full list of the domains I can find in this /30 can be found here [pastebin].

Given the extremely poor reputation of these OVH Canada ranges, I would suggest blocking the following network ranges if you have a security-sensitive environment and are prepared to put up with the collateral damage of blocking some legitimate sites:
198.27.0.0/16
198.50.0.0/16
192.95.0.0/16

Salesforce.com "Please respond - overdue payment" spam

This fake Salesforce spam comes with a malicious attachment. Well, actually two malicious attachments..

Date:      Mon, 17 Mar 2014 16:12:20 +0100 [11:12:20 EDT]
From:      "support@salesforce.com" [support@salesforce.com]
Subject:      Please respond - overdue payment
Priority:      High Priority 2

Please find attached your invoices for the past months. Remit the payment by 01/9/2013 as outlines under our "Payment Terms" agreement.

Thank you for your business,

Sincerely,
Alvaro Rocha

This e-mail has been sent from an automated system.  PLEASE DO NOT REPLY.

The information contained in this message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify your representative immediately and delete this message from your computer. Thank you. 

Attached are two archive files quickbook_invoice_89853654.rar and quickbook_invoice_8988561346654.zip which in turn contain the same malicious executable quickbook_invoice.scr which has a VirusTotal detection rate of 8/49. Automated analysis tools [1] [2] [3] don't give much of a clue as to what is going on here, although you can assume that it is nothing good..