Sponsored by..

Thursday 12 January 2012

"John Dillinger" / "Apple Store - Important information about your Apple ID"

This email was actually sent by Apple, apparently to a famous bank robber, John Dillinger.

Date: Thu, 12 Jan 2012 01:37:23 +0000 (GMT)
From: Apple [appleid@id.apple.com]
Subject: Apple Store - Important information about your Apple ID

    Apple Online Store   
Order Status     Account     Help    
   
   
Dear John Dillinger
Welcome to the Apple Online Store. We wanted to share some information with you about your Apple ID, which allows you to personalize your Apple Online Store experience and helps you access other Apple resources.
Your Apple ID is your current email address.  You can use the password you created when you set up your account online. If you forget or need to reset your password, go to My Apple ID.
By using your Apple ID on the Apple Online Store, you have access to your account information online.  You can save carts until you're ready to place an order, check the status of or change your order, track your shipments, view your order history, maintain your account information, check Apple Gift Card balances, and much more.
Additionally, your Apple ID gives you access to other Apple resources, including:
• Buying music, movies, TV shows, and more at the iTunes Store
• Buying or downloading applications for your iPod touch or iPhone using the App Store
• Ordering photos and photobooks through iPhoto
• Registering your Apple products
• Accessing support for your products from AppleCare
• Getting One to One personal training and other services at an Apple Retail Store
Sign in to Your Account, to take advantages of the benefits of your Apple ID on the Apple Online Store. To learn more about your Apple ID, visit the Your Account section of online Help.
We also want you to know that the security of your personal information is important to us.  For more information on how Apple protects your personal information, please refer to the Apple Customer Privacy Policy.
Thank you for choosing Apple,
The Apple Store Team
http://store.apple.com
1-800-MY-APPLE


Indeed, an Apple account has been created for this email address. But not by me. Upon inspection, the Apple account has no information in it apart from the "John Dillinger" name, and it's a simple matter to reset the password to thwart whatever it going on here.

The email is quite genuine, coming from an Apple IP (17.254.6.195) and with all the links pointing to Apple and not another site. And it seems that I am not alone in receiving this email.

If you have had the same email, please consider letting me know in the comments!

Tuesday 10 January 2012

"Our chances to win an action are higher than ever" spam / clredret.ru

A weird spam, leading to a malicious download at clredret.ru/main.php via a random hacked site.
Date:      Tue, 9 Jan 2012 08:39:05 +0300
From:      victimname@gmail.com
Subject:      Re: Our chances to win an action are higher than ever.

We discussed it with the administration representatives, and if we confess our non-essential faults to improve their statistics, the key cause will be closed due to the lack of the government interest to the action We have prepared your declaratory text for the court. Please read it carefully and if anything in it dissatisfies you, inform us.

Speech.doc 489kb


With Respect To You
Jeramiah Cohen

As mentioned earlier, clredret.ru is on 46.249.37.22 (Serverius Holdings, Netherlands) and that IP is well worth blocking.

Redret domains to block 10/1/12

After a quite couple of weeks, the Redret spam has started again using the domains and IPs listed below. Some are familiar, some are new. In some cases blocking whole IP ranges is the best idea.

46.249.37.22 (Serverius Holdings, Netherlands)
clredret.ru

46.249.37.109 (Serverius Holdings, Netherlands)
cpredret.ru

67.215.3.153 (GloboTech Communications, California)
ckredret.ru

79.137.237.63 (Digital Network JSC aka DINETHOSTING, Russia. Block 79.137.224.0/20)
crredret.ru
ctredret.ru
czredret.ru

79.137.237.67 (Digital Network JSC aka DINETHOSTING, Russia. Block 79.137.224.0/20)
ciredret.ru
coredret.ru

79.137.237.68 (Digital Network JSC aka DINETHOSTING, Russia. Block 79.137.224.0/20)
caredret.ru
cdredret.ru
cfredret.ru
cgredret.ru
csredret.ru

89.208.34.116  (Digital Network JSC aka DINETHOSTING, Russia. Block 89.208.32.0/19)
ajredret.ru
akredret.ru
alredret.ru
amredret.ru
apredret.ru
aredirect.ru
arredret.ru
asredret.ru
baredret.ru
biredret.ru
bvredret.ru

91.220.35.38 (Zamanhost, Ukraine/Russia. Block 91.220.35.0/24)
aaredret.ru
abredret.ru
acredret.ru
adredret.ru
bredirect.ru
credirect.ru
dredirect.ru
eredirect.ru

91.222.137.170 (Delta-X Ltd, Ukraine. Consider blocking 91.222.136.0/22)
chredret.ru
cjredret.ru

94.199.51.108 (23VNet, Hungary)
bkredret.ru
bpredret.ru
bxredret.ru
byredret.ru

95.163.89.193 (Digital Network JSC aka DINETHOSTING, Russia. Block 95.163.64.0/19)
aeredret.ru
afredret.ru
agredret.ru
ahredret.ru
airedret.ru
bbredret.ru
bcredret.ru
bdredret.ru
beredret.ru
bfredret.ru
bgredret.ru
bhredret.ru

95.163.89.200 (Digital Network JSC aka DINETHOSTING, Russia)
bwredret.ru
bzredret.ru

109.70.26.36 (Parked at RU-SERVICE Ltd ISP)
iredirect.ru

No IP at present
anredret.ru
aoredret.ru
aqredret.ru
atredret.ru
auredret.ru
avredret.ru
awredret.ru
axredret.ru
ayredret.ru
azredret.ru
bjredret.ru
bmredret.ru
bnredret.ru
bqredret.ru
brredret.ru
btredret.ru
buredret.ru
cbredret.ru
ccredret.ru
ceredret.ru
cmredret.ru
cnredret.ru
cqredret.ru
cvredret.ru
cwredret.ru
cxredret.ru
cyredret.ru
fredirect.ru
gredirect.ru
hredirect.ru
jredirect.ru
kredirect.ru
lredirect.ru
mredirect.ru
nredirect.ru
oredirect.ru
predirect.ru
qredirect.ru
rredirect.ru
sredirect.ru
tredirect.ru
uredirect.ru
vredirect.ru
wredirect.ru
xredirect.ru
yredirect.ru
zredirect.ru

Airline ticket spam / ckredret.ru

Despite a whole pile of Redret malware spam at the end of the year, the past couple of weeks have been very quiet. However, a new campaign has started up directing visitors via a hacked legitimate site to ckredret.ru/main.php which is hosted on 203.170.193.102 (IDC Cyberworld, Thailand).

Date:      Tue, 9 Jan 2012 08:33:24 +0700
From:      sales1@victimdomain.com
Subject:      Re: Your Flight N US966-282315527

Dear Customer,



FLIGHT NUMBER 5821-5704164

DATE/TIME : JANUARY 23, 2011, 16:12 PM

ARRIVING AIRPORT: WASHINGTON DC INT. AIRPORT

PRICE : 552.06 USD



Download your ticket here:

VIEW



KAYCEE Ramirez,

American Airlines

Right at the moment the site is failing to resolve, but that could simply be a loading issue. Blocking the 203.170.193.102 IP address would be a good idea as it will stop any other malicious sites on the same server.

Friday 6 January 2012

"Elavon 2012 Update" phish

Elavon deals with payment processing. This email is not from Evalon.

From: "Elavon, Inc." [sobolan@myvirtualmerchan-02.com]
Date:Fri, 06 Jan 2012 16:09:48 +0100
Subject: Urgent-Notification

--Elavon 2012 Update--
Dear Customer,

We regret to inform you that your retail merchant account is locked.
To re-activate it please download the file attached to this e-mail and update your login information.

2012 Elavon Inc,
-Please note only RETAIL account are locked-
-Example : Market Segmet : Retail-

Attached is a file called myvirtualmerchant_login.html which is the phish itself, displaying the following screen.

The form itself sends the details to mail.xinsanjing.com on 220.189.213.181. (HangZhou XinSanJing Food Co. Ltd. China) which is possibly a hacked server. In this case the email originated from 209.91.252.206 in Puerto Rico.

If you use Elavon's services, watch out for this phish.

Thursday 29 December 2011

"Your Changelog UPDATED" / cjredret.ru

Another spam, another "redret" domain. This time the spam is a "changelog" one, the malicious payload is on cjredret.ru/main.php.

Date:      Thu, 29 Dec 2011 07:59:51 +0200
From:      accounting@victimdomain.com
Subject:      Re: Fwd: Your Changelog UPDATED

Hello,

as promised chnglog updated -: View Changelog

Carey CATHERINE

The site is hosted on 91.222.137.170 (Delta-X, Ukraine), the same IP address as yesterday. If you don't have any reason to send traffic to the Ukraine, blocking access to 91.222.136.0/22 might be prudent.

Wednesday 28 December 2011

"HP Officejet" spam / chredret.ru

More spam pointing to a malicious web page at chredret.ru/main.php (after redirecting through a legitimate but hacked site), but this time using the old "HP Officejet" approach.


Date:      Wed, 28 Dec 2011 05:32:16 +0700
From:      VG2EBrady@gmail.com
Subject:      Re: Fwd: Re: Scan from a HP Officejet #8056528

A document was scanned and sent to you using a Hewlett-Packard JET SK868691M



Sent to you by: SHEA
Pages : 3
Filetype: Image (.jpeg) View

Location: GDOSO.1.3TH
Device: OP685S9OD6236672

The domain chredret.ru  was used in this spam run yesterday, but now the server has moved from 46.249.37.22 to 91.222.137.170 (Delta-X, Ukraine). I don't know Delta-X at all, but the SiteVet and Google reports are not good, so you might want to consider blocking the entire range 91.222.136.0/22.

Tuesday 27 December 2011

Contract spam / chredret.ru

Another fake "contract" spam leading to malware, hosted on chredret.ru .

Date:      Tue, 27 Dec 2011 06:06:18 +0700
From:      "Destinee Mills"
Subject:      The variant of the contract you've offered has been delcined.

After our legal department studied this contract carefully, they've noticed the following mismatches with our previous arrangements. We've composed a preliminary variant of the new contract, please study it and make sure that all the issues are matching your interests
NEW_Contract.doc 44kb


With best wishes
Destinee Mills
Another name used on the spam is "Ramiro Howell", although there are probably hundreds of fake names. The malicious payload is at chredret.ru/main.php, hosted on 46.249.37.22 (Serverius Holding BV, Netherlands). This is the second "redret" domain in this /24, so blocking 46.249.37.0/24 might be prudent.

Thursday 22 December 2011

NACHA Spam / cgredret.ru

More NACHA spam, this time pointing to cgredret.ru (which we've seen before) which delivers a malicious payload.

Date:      Thu, 22 Dec 2011 03:37:35 +0530
From:      "NACHA"
Subject:      ACH Transfer rejected

ACH transaction, initiated from your checking account, was canceled.



Canceled transaction:



Transfer ID: B2793447923US

Transfer Report: View



GALINA Gunter

NACHA - The Electronic Payment Association

cgredret.ru has moved since yesterday and is now on 79.137.237.68. Unsurprisingly, it is now on Digital Network JSC in Russia (aka DINETHOSTING). Block access to 79.137.224.0/20 if you can.

Wednesday 21 December 2011

"Hello! Look, I've received an unfamiliar bill.." / cgredret.ru

The spam tsunami continues, this one is a reworking of one seen last month, but with a new payload site.

Date:      Wed, 21 Dec 2011 06:43:07 +0700
From:      "MERLYN Spicer" [sales1@victimdomain.com]
To:     
Subject:      Need your help!

Hello! Look, I've received an unfamiliar bill, have you ordered anything?
Here is the bill

Please reply as soon as possible, because the amount is large and they demand the payment urgently.

Looking forward to your answer



Fingerprint: 2ccc03a5-e19549f7

The malicious payload is on cgredret.ru which I catalogued yesterday (although it didn't have an IP address then). The IP is now 206.72.207.156 (Interserver Inc, USA) along with some other malicious sites. Block the IP rather than the domain if you can.

*redirect.ru sites to block

These are another part of the "redret" series of malware sites being promoted by spam, and are worth blocking proactively.

109.70.26.36 (Parked)
iredirect.ru

89.208.34.116 (Digital Network JSC aka DINETHOSTING Russia, block 89.208.32.0/19)
aredirect.ru

91.220.35.38 (Zamanhost Ukraine, block 91.220.35.0/24)
bredirect.ru
credirect.ru
dredirect.ru
eredirect.ru

No IP allocated
fredirect.ru
gredirect.ru
hredirect.ru
jredirect.ru
kredirect.ru
lredirect.ru
mredirect.ru
nredirect.ru
oredirect.ru
predirect.ru
qredirect.ru
rredirect.ru
sredirect.ru
tredirect.ru
uredirect.ru
vredirect.ru
wredirect.ru
xredirect.ru
yredirect.ru
zredirect.ru

BBB Spam / curvechirp.com

Yet more BBB spam, this time with a different malicious domain - curvechirp.com, hosted on 184.171.248.47 at TMZHosting LLC, Florida. This range is suballocated from Hostdime and has been seen a few days ago with another attack, so blocking all access to 184.171.248.32/27 is probably prudent.

Payload page is at curvechirp.com/main.php?page=111d937ec38dd17e, at the moment the page is not responding (possibly due to being overloaded as it looks like a cheap VPS).

Here are some samples:


Date:      Wed, 21 Dec 2011 13:37:00 +0100
From:      "Better Business Bureau" [manager@bbb.org]
Subject:      BBB complaint processing
Attachments:     betterbb_logo.jpg

Attention: Owner/Manager

Here with the Better Business Bureau informs you that we have been filed a complaint (ID 54838460) from one of your customers with respect to their dealership with you.

Please open the COMPLAINT REPORT below to view the details on this question and suggest us about your opinion as soon as possible.

We are looking forward to your prompt reply.

Regards,

Gerard Johnson

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

========

Date:      Wed, 21 Dec 2011 14:41:50 +0200
From:      "Better Business Bureau" [info@bbb.org]
Subject:      Urgent notice from BBB
Attachments:     betterbb_logo.jpg

Attn: Owner/Manager

Here with the Better Business Bureau informs you that we have been sent a complaint (ID 67732970) from a customer of yours with respect to their dealership with you.

Please open the COMPLAINT REPORT below to view the details on this case and inform us about your point of view as soon as possible.

We hope to hear from you shortly.

Sincerely,

Theresa Morris

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

BBB Spam / curcandle.net

Yet more BBB themed malware spam this morning, bouncing through a couple of hacked servers to a malicious payload on curcandle.net (174.136.1.223, Colo4Dallas). Blocking access to the IP will also block any other evil domains on the same server.

The payload is on curcandle.net/main.php?page=111d937ec38dd17e although right at the moment it is 404ing. However, the spam run is just 30 minutes old so perhaps it is still under construction.

Some samples:


Date:      Wed, 21 Dec 2011 09:55:02 +0100
From:      "Better Business Bureau" [manager@bbb.org]
Subject:      BBB information regarding your customer’s complaint
Attachments:     betterbb_logo.jpg

Good afternoon,

Here with the Better Business Bureau informs you that we have been sent a complaint (ID 54715375) from one of your customers with respect to their dealership with you.

Please open the COMPLAINT REPORT below to obtain the details on this matter and inform us about your opinion as soon as possible.

We are looking forward to your prompt reply.

Sincerely,

Rebecca Wilcox

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

============

Date:      Wed, 21 Dec 2011 09:54:50 +0100
From:      "BBB" [alerts@bbb.org]
Subject:      Your customer complained to BBB
Attachments:     betterbb_logo.jpg

Attn: Owner/Manager

Here with the Better Business Bureau notifies you that we have been sent a complaint (ID 44513446) from one of your customers with respect to their dealership with you.

Please open the COMPLAINT REPORT below to obtain more information on this question and inform us about your opinion as soon as possible.

We are looking forward to hearing from you.

Regards,

Theresa Morris

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

============

Date:      Wed, 21 Dec 2011 08:54:38 +0000
From:      "BBB" [service@bbb.org]
Subject:      Better Business Bureau complaint
Attachments:     betterbb_logo.jpg

Attention: Owner/Manager

Here with the Better Business Bureau would like to notify you that we have received a complaint (ID 10822005) from one of your customers related to their dealership with you.

Please open the COMPLAINT REPORT below to obtain more information on this question and inform us about your position as soon as possible.

We are looking forward to your prompt reply.

Kind regards,

Theresa Morris

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

============

Date:      Wed, 21 Dec 2011 09:33:03 +0000
From:      "BBB" [manager@bbb.org]
Subject:      BBB complaint report
Attachments:     betterbb_logo.jpg

Attn: Owner/Manager

Here with the Better Business Bureau notifies you that we have been sent a complaint (ID 10942308) from one of your customers in regard to their dealership with you.

Please open the COMPLAINT REPORT below to obtain more information on this question and let us know of your position as soon as possible.

We hope to hear from you very soon.

Faithfully,

Arnold Melendez

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

a*redret.ru domains to block

More malware domains to block, being promoted through malicious spam emails:

89.208.34.116  (Digital Network JSC Russia aka DINETHOSTING. Block 89.208.32.0/19 as it is all toxic)
ajredret.ru
akredret.ru
alredret.ru
amredret.ru
apredret.ru
arredret.ru
asredret.ru

91.220.35.38 (Zamanhost, Ukraine. Block 91.220.35.0/24)
aaredret.ru
abredret.ru
acredret.ru
adredret.ru

95.163.89.193 (Digital Network JSC Russia. Block 95.163.0.0/16 or 95.163.64.0/19)
aeredret.ru
afredret.ru
agredret.ru
ahredret.ru
airedret.ru

No IP allocated
anredret.ru
aoredret.ru
aqredret.ru
atredret.ru
auredret.ru
avredret.ru
awredret.ru
axredret.ru
ayredret.ru
azredret.ru

b*redret.ru domains to block (updated)

Another set of "Redret" domains, the b*redret.ru series is used in malware distribution. It has some new IP addresses since the last time.

89.208.34.116 (Digital Network JSC Russia aka DINETHOSTING. Block 89.208.32.0/19 as it is all toxic)
baredret.ru
biredret.ru
bvredret.ru

91.228.133.120 (Inter-Treyd LLC, Russia. Recommend blocking 91.228.133.0/24)
blredret.ru
bsredret.ru

94.199.51.108 (23VNet Hungary)
bkredret.ru
bpredret.ru
bxredret.ru
byredret.ru

95.163.89.193 (Digital Network JSC Russia. Block 95.163.0.0/16 or 95.163.64.0/19)
bbredret.ru
bcredret.ru
bdredret.ru
beredret.ru
bfredret.ru
bgredret.ru
bhredret.ru

95.163.89.200 (Digital Network JSC Russia)
bwredret.ru
bzredret.ru

No IP at present
bjredret.ru
bmredret.ru
bnredret.ru
bqredret.ru
brredret.ru
btredret.ru
buredret.ru

Tuesday 20 December 2011

c*redret.ru sites to block (updated)

These "Redret" domains serve up malware and are promoted by spam, some of them have moved around since last week so consider this an updated list.

46.249.37.109 [Serverius Holding B.V, Netherlands]
cpredret.ru

79.137.237.63 [Digital Network JSC, Russia aka DINETHOSTING. Recommend blocking 79.137.224.0/20]
crredret.ru
ctredret.ru
czredret.ru

79.137.237.67 [Digital Network JSC, Russia]
ciredret.ru
coredret.ru

79.137.237.68 [Digital Network JSC, Russia]
caredret.ru
csredret.ru

91.195.11.42 [UkrStar ISP, Ukraine. Recommend blocking 91.195.10.0/23]


206.72.207.156 [Interserver Inc, United States]
cdredret.ru
cfredret.ru

Not hosted at present
cbredret.ru
ccredret.ru
ceredret.ru
cgredret.ru
chredret.ru
cjredret.ru
ckredret.ru
clredret.ru
cmredret.ru
cnredret.ru
cqredret.ru
cvredret.ru
cwredret.ru
cxredret.ru
cyredret.ru

BBB Spam / financestuff.serveblog.net

Here's another BBB Spam leading to malware..

Date:      Tue, 20 Dec 2011 11:45:50 +0100
From:      "BBB" [support@bbb.org]
Subject:      BBB complaint processing
Attachments:     betterbb_logo.jpg

Attention: Owner/Manager

Here with the Better Business Bureau would like to notify you that we have received a complaint (ID 24673594) from your customer with respect to their dealership with you.

Please open the COMPLAINT REPORT below to find the details on this issue and let us know of your point of view as soon as possible.

We are looking forward to hearing from you.

Faithfully,

Katherine Schulte

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

Malware payload in on financestuff.serveblog.net/main.php?page=69dbd5a1e3ed6ae9 on 207.210.65.12 (Global Net Access LLC). Block the IP address if you can.

"Scan from a Xerox WorkCentre Pro" / cfredret.ru

This is a fairly common malware spam, pointing to malicious code on cfredret.ru/main.php.

Date:      Tue, 20 Dec 2011 05:42:20 +0300
From:      victimname@gmail.com
Subject:      Re: Fwd: Re: Scan from a Xerox WorkCentre Pro #2966272

A Document was sent to you using a Xerox WKC1296130.



Sent by: SHIRLEY
Images : 5
Image (.JPEG) Download

Device: UM85256LL6P68270479



bfe116b5-7dcccccc

cfredret.ru is hosted on 78.47.193.36, exactly the same IP address as this BBB themed malware spam. Blocking access to 78.47.198.32/29 is a fabulous idea if you can.

BBB Spam / blumtam.com

More BBB spam, this time attempting to deliver users to a malicious payload on blumtam.com. A couple of samples:

Date:      Tue, 20 Dec 2011 00:34:38 -0800
From:      "BBB" [alerts@bbb.org]
Subject:      Re: your customer�s complaint ID 82235322
Attachments:     betterbb_logo.jpg

Attention: Owner/Manager

Here with the Better Business Bureau would like to inform you that we have been sent a complaint (ID 82235322) from a customer of yours in regard to their dealership with you.

Please open the COMPLAINT REPORT below to obtain the details on this case and let us know of your position as soon as possible.

We hope to hear from you shortly.

Kind regards,

Fernando Grodhaus

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277
and
Date:      Tue, 20 Dec 2011 11:09:23 +0200
From:      "BBB" [alerts@bbb.org]
Subject:      BBB case ID 59988329
Attachments:     betterbb_logo.jpg

Hello,

Here with the Better Business Bureau would like to notify you that we have been filed a complaint (ID 59988329) from a customer of yours related to their dealership with you.

Please open the COMPLAINT REPORT below to view more information on this matter and let us know of your opinion as soon as possible.

We are looking forward to hearing from you.

Faithfully,

Theresa Morris

Dispute Counselor
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

Payload is on blumtam.com/main.php?page=69dbd5a1e3ed6ae9 hosted on 78.47.198.36, a Hetzner AG address suballocated to an outfit called QHoster Ltd in Bulgaria. Blocking access to 78.47.198.32/29 would probably be prudent.

Monday 19 December 2011

DHL malware spam / secure.dhldispatches.com

This DHL themed spam leads to malware:

From: DHL Express
Sent: 19 December 2011 10:03
Subject: DHL Express Dispatch Confirmation

Order number: 9672834463

Your order has now been dispatched and your DHL Express air waybill number is 9672834463.

To follow the progress of your shipment and print invoice for your records, please go to :
http://secure.dhldispatches.com/tracking/

IMPORTANT INFORMATION:
 
DHL Express will deliver your order between 9am-5pm GMT, Monday to Friday. If you are unavailable, DHL Express will leave a card so you can contact them to reschedule.

All orders must be signed for upon delivery.

Please note, we are unable to change the shipping address on your order now it has been dispatched. Your purchase should arrive in perfect condition. If you are unhappy with the quality, please let us know immediately.

Yours sincerely,

Customer Care
www.dhl.com

For assistance email customercare@dhl.com or call 0800 099 27671 from the UK, +44 (0)20 2781 62512 from the rest of the world, 24 hours a day, seven days a week


CONFIDENTIALITY NOTICE
The information in this email is confidential and is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, you must not read, use or disseminate the information. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of DHL Express Deliveries.

secure.dhldispatches.com (hosted on 116.240.194.69, Primus Australia) looks like a DHL page, but it carries a malicious payload which is loads from 118.88.25.36 (Dedicated Servers Australia). Blocking access to both those IPs may be prudent. The Wepawet report for this one is here.

FDIC spam / splatstack.net

More FDIC spam leading to malware, this time at splatstack.net.

Date:      Mon, 19 Dec 2011 05:32:49 -0600
From:      "Greta Bullock"
Subject:      Blockage of your transactions

Attn: Financial Department


By this message we would like to inform you about the latest amendments in the Federal Deposit Insurance Corporation coverage rules. During the period from December 31, 2010 to December 31, 2012 all funds in a "noninterest-bearing transaction account" are provided with a full insurance coverage by the Federal Deposit Insurance Corporation. Please note, that this arrangement is temporary and separate from the Federal Deposit Insurance Corporation's basic insurance rules.

The term "noninterest-bearing transaction account" implies a usual checking account or demand deposit account on which the insured depository institution pays no interest. For more information about this temporary FDIC unlimited coverage, please refer to: http://iimtstudies.com/e3f4e0/index.html

Yours faithfully,
Greta Bullock
Federal Deposit Insurance Corporation


The link goes via a couple of hacked sites to a malicious payload splatstack.net/main.php?page=abfd0d069b45c17e hosted on 173.255.253.115 (Linode). Blocking access to that IP address will probably be prudent.

Scam: "CareerQuick Staffing" / careermanagement.com.ua

This is another take on RockSmith Management scam, linked to these dodgy work-at-home sites, apparently with an Australian connection.

Date:      Mon, 26 Sep 2011 05:48:19 +0530
From:      "Terence Mooney" [terence.mooney@voicecom.co.za]
Subject:      Reminder: Employment Opportunity Followup

Hello

Thank you for submitting your information for potential employment opportunities.
We look forward to reviewing your application, but can not do so until you complete our
internal application.

The pay range for available positions range from $35.77 per hour to $57.62 per hour.
Prior to begin able to be considered, you will first need you to formally apply.
Please go here to begin the process:

http://careermanagement.com.ua/

Also, the following perks are potentially available:

- Paid Time Off
- Health Benefits Package
- Higher than average salaries
- Tuition Reimbursement
- Extensive 401(k)program

Please take the time to follow the directions and complete the entire
application process.


Best Regards,

Rock Smith Management


careermanagement.com.ua is a Ukrainian domain, it is hosted on 85.121.39.3, which is a known black-hat host in Romania (Monyson Grup S.A), although as we said before this appears to be an Australian crew running the scam. The layout of the site echoes careerquickstaffing.com, a site that has already been suspended for spamming.

Friday 16 December 2011

NACHA Spam/ ragsnip.com

Yet another round of fake NACHA spam leading to malware is doing the rounds, this time the payload is on ragsnip.com/main.php?page=111d937ec38dd17e hosted on 207.210.96.226 (Global Net Access LLC, Atlanta). Blocking access to the IP is preferable to the domain as there may be other malicious domains on the same server.

An example spam email from this run (it seems no different to all the other ones):

Date:      Fri, 16 Dec 2011 16:43:21 +0100
From:      "transactions@nacha.org" [transactions@nacha.org]
Subject:      Information on your pending transaction

Attention: Accounting Department

This message contains a report about the ACH debit transfer sent on your behalf, that was detained by our bank:
Transaction #:    007457776956967
Status of the transaction:    pending

In order to resolve this matter, please review the transaction details using the link below as soon as possible.

Faithfully yours,
Kathy Quirk
Accounting Department

NACHA Spam / ragsnub.com

More NACHA spam is doing the rounds, this time redirecting through a legitimate hacked site to ragsnub.com/main.php?page=69dbd5a1e3ed6ae9 on 184.171.248.35 (Hostdime, Florida).

There may be other bad domains on that server, so blocking access to the IP is the safest approach.

Thursday 15 December 2011

NACHA Spam / evrymonthnighttry.com and glasseseverydaynow.com

More NACHA themed spam this morning that redirects victims through a hacked legitimate site to a malware laden page, this time hosted on evrymonthnighttry.com or glasseseverydaynow.com.

These sites are hosted on 46.183.217.119 (Dataclub, Latvia). I can't see anything at all of value in 46.183.216.0/21 so blocking access to all of that range might be prudent.

It also attempts to load an exploit from a site called bbb-complains.org which is not resolving at present.

A couple of example emails:

Date:      Thu, 15 Dec 2011 07:42:51 +0000
From:      "risk.manager@nacha.org" [risk.manager@nacha.org]
Subject:      Your ACH transaction details

Attention: Accounting Department

This message includes an important information regarding the ACH debit transfer sent on your behalf, that was detained by our bank:
Transaction ID:    079788807282357
Transaction status:    pending

In order to resolve this matter, please use the link below to review the transaction details as soon as possible.

Yours faithfully,
Anthony Cooley
Chief Accountant

and

Date:      Thu, 15 Dec 2011 07:30:43 +0000
From:      "alert@nacha.org" [alert@nacha.org]
Subject:      Your pending ACH debit transfer

Dear Sir or Madam,

Please find below a report about the ACH debit transfer sent on your behalf, that was kept back by our bank:
Transaction #:    638798200851317
Status of the transaction:    pending

In order to resolve this matter, please review the transaction details using the link below as soon as possible.

Yours truly,
Kevin Hunt
Chief Accountant

Fake Facebook spam / caredret.ru

More toxic spam.

Date:      Thu, 15 Dec 2011 11:52:56 +0700
From:      Facebook [notification+VGNDUO7NQM4R@facebookmail.com]
Subject:      LUCY Snow wants to be friends on Facebook.

facebook
LUCY Snow wants to be friends with you on Facebook.
   
LUCY Snow

Confirm Friend Request
   
See All Requests
This message was sent to victim@victimdomain.com. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.

Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303 

In this case, the link goes via a hacked legitimate site and gets redirected to a malicious page on caredret.ru/main.php hosted on 79.137.237.67 (Digital Network JSC, Russia aka DINETHOSTING). Block access to 79.137.224.0/20 if you can, there is nothing legitimate hosted here.

FDIC spam / sownload.zapto.org and 63.223.78.19

The spam tsunami continues today with a set of new malware URLs to block. This one allegedly comes from the FDIC in the US.

Date:      Fri, 16 Dec 2011 04:12:15 +0400
From:      "Freeman Ballard" [Freeman.Ballard@campioni.info]
Subject:      URGENT! Security system updates

Dear Sirs,

In order to prevent new cases of wire fraud, we have introduced a new security system. In this connection all the account transactions of our customers have been suspended unless the special security requirements are met.. In order to rehabilitate your account, you need to

Install a special security software. Please use the link below to read the instructions for the installation of the latest security version.

We apologize for the inconveniences caused to you by this measure.
Please do not hesitate to contact us if you have any questions.

Sincerely yours,

FDIC Call Center 1-877-275-3342 (1-877-ASKFDIC)
or Email Address: consumer-service@fdic.gov
8:00 am - 8:00 pm ET; Monday-Friday
9:00 am - 5:00 pm ET; Saturday-Sunday
For the Hearing Impaired Toll Free 1-800-925-4618 / Local (VA) 703-562-2289

The link goes through a legitimate hacked site and tries to direct the user to a malicious page at sownload.zapto.org/main.php?page=db3408bf080473cf hosted on 63.223.78.199 (InfraVPS Network Solutions, Philippines). Blocking the IP address is preferable because there may more other malicious domains on that server.

Wednesday 14 December 2011

Spam: "Cuban car sale rise after law change" / csredret.ru

A weird spam, leading to a malicious payload on csredret.ru

Date:      Wed, 14 Dec 2011 03:50:19 +0900
Subject:      Fwd: VIDEO: Cuban car sale rise after law change

Hi, look in.

VIDEO: Cuban car sale rise after law change

csredret.ru is hosted on 79.137.237.67 at Digital Network JSC in Russia (aka DINETHOSTING). Blocking access to 79.137.224.0/20 is essential if you can do it.

NACHA Spam / financeportal.sytes.net

More NACHA spam this morning, this time the payload is at financeportal.sytes.net/main.php?page=111d937ec38dd17e on 174.140.165.90. Blocking the IP address rather than the domain is probably best as there may be other malicious sites on that server.

174.140.165.90 is on Directspace LLC in Oregon who seem to have a significant problem with malware at the moment, I have seen malicious sites on:

147.140.163.116
147.140.163.118
147.140.165.90
147.140.165.195

You might want to consider blocking Directspace LLC more widely if you are worried.

Tuesday 13 December 2011

"PAYROLL LOGS" Spam

This spam is obviously trying to do something evil, but I'm not quite sure what.


Date:      Tue, 13 Dec 2011 15:23:00 -0600
From:      "Helen Oconnell" [terminationsm@migtel.ru]

Subject:      11122011 PAYROLL INDICES

http://jazzon.nl/YK4VUSWQ.html Please access the URL below to reveal PAYROLL LOGS. It was submitted to you using a Xerox WorkCentre. Pro

==================================================================================================================

Confidential E-Mail: This e-Mail is proposed only for the username to that it is addressed and may be composed data that is intimate or otherwise preserved from exposal.If you have take this email in confusion, please notify the support by respond the present e-Mail and erase the original e-Mail and each copy..

The email is a piece of social engineering that relies on you wanting to know how much your colleagues are earning. Click the link and you get redirected to cms-wideopendns.com (a DSL subscriber in Span) then trackorder.commercialday-net.com (in China). It doesn't seem to work properly, but then it might just be resisting the tools I am throwing at it.

In any case.. avoid this one.

NACHA Spam / badthen.com

More NACHA spam, this time leading to a malicious payload on badthen.com. Stupidly (again) the NACHA email appears to come from linkedin.com.

Date:      Wed, 14 Dec 2011 05:36:48 +0900
From:      "LinkedIn" [linkedin@em.linkedin.com]
Subject:      ACH transfer suspended

The ACH transaction (ID: 137297301664), recently initiated from your bank account (by you or any other person), was rejected by the Electronic Payments Association.
Rejected transfer
Transaction ID:     137297301664
Rejection Reason     See details in the report below
Transaction Report     report_137297301664.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association

The malware is on badthen.com/main.php?page=977334ca118fcb8c  hosted on 173.230.130.158 (Linode, US). Blocking the IP address will block any other malware domains on the same server.

Spam: "I found your pictures on my camera yesterday, remember me?" / csredret.ru

Another spam run leading to a malicious payload on csredret.ru (as here)

Date:      Tue, 13 Dec 2011 10:19:58 +0200
From:      "Tomi Mcrae"
Subject:      Hi! This is Tomi

Finally I found your e-mail, I?m not sure whether you remember me, we?ve got terribly drunk, I found your pictures on my camera yesterday, remember me? Party14.jpg 487kb 

The "pictures" link loads the malicious script, hosted at black hat hosts Digital Network JSC aka DINETHOSTING in Russia. Avoid.

You can download your Windows Vista License here / csredret.ru

A Windows Vista licence? No.. it's malware from csredret.ru.

From: sales1@victimdomain.com [mailto:sales1@victimdomain.com]
Sent: 13 December 2011 05:14
Subject: Fwd: Order K93883696


Good morning,


You can download your Windows Vista License here -

Microsoft Corporation

The malicious payload is on csredret.ru/main.php hosted on 79.137.237.67 (Digital Network JSC, Russia aka DINETHOSTING). For about the billionth time in the past few days.. block access to 79.137.224.0/20 on your network if you possibly can.

NACHA Spam / sadjumped.com / downloaddatafast.serveftp.com

 More fake NACHA spam, this time leading to a malicious payload site on downloaddatafast.serveftp.com/main.php?page=977334ca118fcb8c on 173.230.137.34 (Linode, US).

Date:      Tue, 13 Dec 2011 14:15:51 +0100
From:      "LinkedIn" [linkedin@em.linkedin.com]
Subject:      ACH transaction not accepted

The ACH transfer (ID: 82065701523728), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Canceled transfer
Transaction ID:     82065701523728
Rejection Reason     See details in the report below
Transaction Report     report_82065701523728.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association

serveftp.com is related to no-ip.com, if you block that domain then you should probably block serveftp.com as well. Blocking 173.230.137.34 would protect against any other malicious sites on the same server.

Update: another spam run is in progress using a domain sadjumped.com on the same server.

BBB Spam / wonderfulyard.com

The BBB spam is doing the rounds yet again, this time leading to a malicious payload at wonderfulyard.com/main.php?page=111d937ec38dd17e hosted on 81.17.140.161 (Velton.telecom, Ukraine).

Blocking access to that IP address is probably a good idea, I can't vouch for the /24 that it is in though, but you may want to block that too to be on the safe side.

Malware spam: "Have you seen how much money has Cameron spent on his new movie?"

Here's a terse spam, leading to a malicious payload on cpredret.ru/main.php

From: AlfredoMejiaGXInOZ@aol.com
Date: 13 December 2011 04:20
Subject: I’m shocked!
   
Have you seen how much money has Cameron spent on his new movie?
What a graphics, check out the trailer!

Apparently, it refers to James Cameron and not David Cameron. Payload site is hosted on 79.137.237.67 which is the now infamous Digital Network JSC in Russia (aka DINETHOSTING). Blocking 79.137.224.0/20 would be good for your health.

Monday 12 December 2011

Evil network: UkrStar ISP / UKRSTAR-NET AS43473 (91.195.10.0/23)

I've seen a lot of 91.195.10.0/23 in recent days, a range of addresses belonging to UkrStar ISP in the Ukraine. It's a sparsely occupied block, but there appear to be no legitimate sites here and blocking the whole lot could save you some grief.

A list of domains and IP addresses can be found at the end of the post. The WHOIS details for the block as as follows:

inetnum:        91.195.10.0 - 91.195.11.255
netname:        UKRSTAR-NET
descr:          UkrStar ISP
descr:          www.ukrstar.com
country:        UA
org:            ORG-UA98-RIPE
admin-c:        SER50-RIPE
tech-c:         WIRE88-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-lower:      RIPE-NCC-END-MNT
mnt-by:         UKRNIC-MNT
mnt-routes:     UKRNIC-MNT
mnt-domains:    UKRNIC-MNT
source:         RIPE #Filtered

organisation:   ORG-UA98-RIPE
org-name:       UkrStar
org-type:       OTHER
descr:          www.ukrstar.com
address:        Dal'nitskaya 46, room 404
address:        Odessa 65005
address:        Ukraine
phone:          +380482390190
fax-no:         +380482324245
e-mail:         noc@ukrstar.com
admin-c:        SER50-RIPE
tech-c:         WIRE88-RIPE
mnt-ref:        GLOBALNETWORKS-MNT
mnt-by:         GLOBALNETWORKS-MNT
source:         RIPE #Filtered

person:         Sanin Sergey Victorovich
address:        Deribasovskaya str., 12
address:        Odessa 65027
address:        Ukraine
phone:          +380487771551
e-mail:         ser-0@clan-0.com
nic-hdl:        SER50-RIPE
mnt-by:         GLOBALNETWORKS-MNT
source:         RIPE #Filtered

person:         Grigoretskiy Sergey Aalexandrovich
org:            ORG-UA98-RIPE
address:        Dal'nitskaya str., 46, room 404
address:        Odessa 65005
address:        Ukraine
phone:          +380482390190
e-mail:         sg@ukrstar.com
nic-hdl:        WIRE88-RIPE
mnt-by:         GLOBALNETWORKS-MNT
source:         RIPE #Filtered

route:          91.195.10.0/23
descr:          UKRNIC-IP-BLOCK
origin:         AS43479
mnt-by:         UKRNIC-MNT
source:         RIPE #Filtered

91.195.11.35
ns-free.org
ofpics.com
91.195.11.37
vocporn6.ru
videoxcx-onlina5g.ru
91.195.11.38
pornoxxx-onlina1a.ru
pornoxnx-onlinee1a.ru
porkaxnx-freex1a.ru
pornoxxx-onlinee4a.ru
porkaxcx-onlina2c.ru
pornoxcx-freex4c.ru
pornoxnx-onlina1e.ru
pornoxxx-conline3e.ru
pornoxcx-onlinee4g.ru
porkaxxx-conline3h.ru
91.195.11.39
minimart20.com
biggerthanvoland.com
boysandgirlsforever.com
whatwasinyourheart.com
91.195.11.41
yaxexzg.1dumb.com
costumeuniformporn.net
prettylatinatube.com
schoolgirluniformpics.net
skyinfo.in
streamretro.in
xoticpc.biz
91.195.11.42
curedret.ru
wrghghkfwerhdfghqwhtq.c0m.li
srvads.c0m.li
aangfan.in
floreli.info
certerpen.info
ageoloft.info
zndemstrnctwznskdsw-tsmcyuwaxldenctypzmb.ru
gdhordvl653hklyg.biz
wonderfulwriggle.com

c*redret.ru sites to block

Another bunch of "redret" sites to block, either by domain name or IP. These domains are being used as the payloads for spam emails and leave to a malicious web page.

79.137.237.63 (Digital Network JSC aka DINETHOSTING, Russia - recommend blocking 79.137.224.0/20)
crredret.ru
ctredret.ru
czredret.ru

79.137.237.67 ((Digital Network JSC again)
ciredret.ru
coredret.ru
cpredret.ru

91.195.11.42 (UkrStar ISP, Ukraine - recommend blocking 91.195.10.0/23)
curedret.ru

Unallocated
caredret.ru
cbredret.ru
ccredret.ru
cdredret.ru
ceredret.ru
cfredret.ru
cgredret.ru
chredret.ru
cjredret.ru
ckredret.ru
clredret.ru
cmredret.ru
cnredret.ru
cqredret.ru
csredret.ru
cvredret.ru
cwredret.ru
cxredret.ru
cyredret.ru

Evil network revisited: Specialist Ltd / Specialist-ISP-PI2 AS48691(194.28.112.0/22)

Specialist Ltd is a small Black Hat hosting company in Transnistria, a breakaway part of the former Soviet Republic of Moldavia. No UN members recognise Transnistria, and effectively it sits beyond the reach of international law enforcement. Quite a handy place for criminals to do business then.

I first wrote about this block last year, but it recently came into my sights again as the host for a very widespread injection attack using the lilupophilupop.com domain.

Since last year the number of malicious sites has dropped, but there is still not a legitimate site in sight. Most of the bad sites are currently on 194.28.114.102 but you should block access to 194.28.112.0/22 (194.28.112.0 - 194.28.115.255) if you can, because this range of IP addresses is nothing but trouble.

A list of sites hosted in this range is at the end of this post, or you can download a CSV with the MyWOT ratings and IP addresses from here.

Google's prognosis of this block is pretty horrible:

Safe Browsing
Diagnostic page for AS48691 (SPECIALIST)


What happened when Google visited sites hosted on this network?

    Of the 44 site(s) we tested on this network over the past 90 days, 1 site(s), including, for example, rthur87seeks.rr.nu/, served content that resulted in malicious software being downloaded and installed without user consent.

    The last time Google tested a site on this network was on 2011-12-12, and the last time suspicious content was found was on 2011-12-12.

Has this network hosted sites acting as intermediaries for further malware distribution?

    Over the past 90 days, we found 15 site(s) on this network, including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that appeared to function as intermediaries for the infection of 190 other site(s) including, for example, teas.com.au/, rogersplus.ca/, cicomra.org.ar/.

Has this network hosted sites that have distributed malware?

    Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 30 site(s), including, for example, lilupophilupop.com/, sweepstakesandcontestsinfo.com/, sweepstakesandcontestsnow.com/, that infected 2524 other site(s), including, for example, jri.ir/, psu.ac.th/, longoservice.it/.

The WHOIS details for the bloack are:

inetnum:         194.28.112.0 - 194.28.115.255
netname:         Specialist-ISP-PI2
descr:           Specialist, Ltd.
country:         MD
org:             ORG-SL206-RIPE
admin-c:         VP2841-RIPE
tech-c:          AB16163-RIPE
status:          ASSIGNED PI
mnt-by:          RIPE-NCC-END-MNT
mnt-lower:       RIPE-NCC-END-MNT
mnt-by:          SPECIALIST-MNT
mnt-routes:      SPECIALIST-MNT
mnt-domains:     SPECIALIST-MNT
source:          RIPE # Filtered

organisation:   ORG-SL206-RIPE
org-name:       Specialist, Ltd
org-type:       OTHER
descr:          Specialist, Ltd, Rybnitsa, MD
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
phone:          +373-693-18189
phone:          +373-777-65071
fax-no:         +373-555-43073
mnt-ref:        MONITORING-MNT
abuse-mailbox:  abuse@lan-rybnitsa.com
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

person:         Vladimir Pilan
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-12921
fax-no:         +373-555-43073
nic-hdl:        VP2841-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

person:         Anatoly Belitsky
address:        I. Soltysa 12, Rybnitsa, MD
phone:          +373-777-65071
fax-no:         +373-555-43073
nic-hdl:        AB16163-RIPE
source:         RIPE # Filtered
mnt-by:         SPECIALIST-MNT

route:          194.28.112.0/22
descr:          Specialst-route2
origin:         AS48691
mnt-by:         SPECIALIST-MNT
source:         RIPE # Filtered

Some domains and sites hosted in this block are:



ation72histor.rr.nu
blogsvk.ru
cliffordtravel.biz
comm98andsp.rr.nu
doutl31inesst.rr.nu
earni61ngunde.rr.nu
ensm60erch.rr.nu
eorge00gamee.rr.nu
ggesti51ngbina.rr.nu
globalpoweringgathering.com
globalpoweringgatheringit.com
globalpoweringgatheringon.com
h102-114.net.lan-rybnitsa.com
hoperjoper.ru
iess70elec.rr.nu
ift72hbot.rr.nu
ilto27nint.rr.nu
infoitpoweringgathering.com
infoitpoweringgatheringit.com
infoitpoweringgatheringon.com
inful07commi.rr.nu
lessthenaminutehandle.com
lessthenaseconddeal.com
lilupophilupop.com
lilypophilypop.com
llowe31dmeth.rr.nu
mail.lilupophilupop.com
mail.sweepstakesandcontestsinfo.com
ns1.hoperjoper.ru
ns2.hoperjoper.ru
root.sweepstakesandcontestsinfo.com
sekurepays.org
sical59lymemo.rr.nu
sokoloperkovuske.com
sokoloperkovuskeci.com
sokoloperkovuskedi.com
sweepstakesandcontestsdo.com
sweepstakesandcontestsinfo.com
sweepstakesandcontestsnow.com
tyco93uplin.rr.nu
wbesnancer.org
welcometotheglobaliscom.com
welcometotheglobalisnet.com
welcometotheglobalisorg.com
zevkblog.ru

BBB Spam / eryirs.com

This is the second BBB malware spam run of the day, with a new domain and IP address.

Date:      Mon, 12 Dec 2011 14:10:59 +0100
From:      "service@bbb.org" [service@bbb.org]
Subject:      BBB assistance Re: Case # 52010425
Attachments:     main_logo.jpg

Attn: Owner/Manager
The Better Business Bureau has been sent the above mentioned complaint from one of your clients on the subject of their business relations with you.
The detailed information about the consumer's concern is contained in attached file.
Please examine this question and let us know about your opinion.
We encourage you to click here to reply this complaint.

We look forward to your urgent response.

Faithfully yours,
Roland Dani
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

The malicious payload is eryirs.com/main.php?page=69dbd5a1e3ed6ae9 which is hosted on 67.211.195.169 (Arima Networks, Canada). Blocking access to 67.211.195.169 is probably a good idea in case there are other malicious sites on the server.

The no-doubt-fake WHOIS details for the domain are:

Damian Masuicca
Damian Masuicca
damott st
lacona
NY
13083
US
Phone:         +1.2022392869
Email Address: stopgop@ymail.com

BBB Spam (again) / lazysit.net and 174.140.163.118

It looks like another BBB themed malware/spam run is on the loose.. there are probably many variations, but here is one that plopped into my spam filter:

Date:      Mon, 12 Dec 2011 10:36:39 +0100
From:      "info@bbb.org" [info@bbb.org]
Subject:      Better Business Bureau Case # 94181989
Attachments:     main_logo.jpg

Attn: Owner/Manager
The Better Business Bureau has got the above-referenced complaint from one of your customers on the subject of their business relations with you.
The details of the consumer's concern are presented in enclosed document.
Please give attention to this issue and advise us of your point of view.
We encourage you to click here to respond this complaint.

We look forward to your urgent attention to this matter.

Yours faithfully,
Stacie Nieves
Better Business Bureau


Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277

This link goes via a couple of legitimate hacked sites to a payload site at lazysit.net/main.php?page=abfd0d069b45c17e on 174.140.163.118. The IP address looks like it might be a legitimate but hacked server, blocking the IP address rather than the domain should block any other malicious sites on the same server.

Friday 9 December 2011

NACHA Spam.. again.. and wonderfulwrench.com

The spammers have been busy today, here's another one leading to malware.

Date:      Fri, 9 Dec 2011 13:28:41 -0300
From:      "The Electronic Payments Association"
Subject:      ACH transaction rejected

The ACH transaction (ID: 870526083755), recently initiated from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Rejected transfer
Transaction ID:     870526083755
Reason of rejection     See details in the report below
Transaction Report     report_870526083755.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association

The malicious payload is on wonderfulwrench.com/main.php?page=977334ca118fcb8c on 46.45.137.205 (Safya Net, Turkey). We saw the same IP range yesterday, so I recommend blocking access to 46.45.137.0/24 at the least, or 46.45.136.0/21 if you want to be a bit more aggressive in your filtering.

"The variant of the contract you've offered has been delcined."

The recent spam avalanche continues:

Date:      Fri, 9 Dec 2011 -01:35:13 -0800
From:      "Josie Carlson" [TateAlmgren@concentric.net]
Subject:      The variant of the contract you've offered has been delcined.

After our legal department studied this contract carefully, they've noticed the following mismatches with our previous arrangements. We've composed a preliminary variant of the new contract, please study it and make sure that all the issues are matching your interests
Contract.doc 64kb

With respect to you
Josie Carlson

SHA512 check sum: [redacted]

This leads to a malicious payload on ciredret.ru/main.php, hosted on 91.195.11.42 (as with this other spam/virus run), so blocking 91.195.10.0/23 (UkrStar ISP, Ukraine) is a very good idea at the moment.

Malware: Your Amazon.com order of "Omron FXB-414M Fat Loss ..." has shipped! / ageoloft.info, floreli.info and certerpen.info

This malware spam leads via a legitimate hacked site to floreli.info or ageoloft.info or certerpen.info, although there are probably more. If you have the names of other payload domains please consider add ingthem in the Comments. Both these sites are hosted on 91.195.11.42.

From: Issac Britt [mailto:delphiniumsfte62@retela.co.jp]
Sent: 09 December 2011 14:05
Subject: Your Amazon.com order of "Omron FXB-414M Fat Loss ..." has shipped!

Hello,

Shipping Confirmation
Order # 649-2723315-2651369

Your estimated delivery date is:
Tuesday, December 13, 2011

Track your package Thank you for shopping with us. We thought you'd like to know that we shipped this portion of your order separately to give you quicker service. You won't be charged any extra shipping fees, and the remainder of your order will follow as soon as those items become available. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.

Shipment Details

Omron FXB-414M Fat Loss Monitor, Black $149.95
Item Subtotal: $149.95
Shipping & Handling: $0.00
Total Before Tax: $149.95
Shipment Total: $149.95
Paid by Visa: $149.95

You have only been charged for the items sent in this shipment. Per our policy, you only pay for items when we ship them to you.

Returns are easy. Visit our .
If you need further assistance with your order, please visit Customer Service.

We hope to see you again soon!
Amazon.com

The payload is on floreli.info/main.php?page=525447c096f8efbf or ageoloft.info/main.php?page=525447c096f8efbf and consists of the blackhole exploit kit leading to the Cridex Trojan.

Blocking the range 91.195.10.0/23 (UkrStar ISP, Ukraine) a good proactive move as several malware attacks have been hosted there in the past few days.

Domains spotted so far:
ageoloft.info
floreli.info
certerpen.info


Some sample email subjects:
Your Amazon.com order of "Omron BTS-829C Fat Loss ..." has shipped!
Your Amazon.com order of "Omron DRM-151A Fat Loss ..." has shipped!
Your Amazon.com order of "Omron FXB-414M Fat Loss ..." has shipped!
Your Amazon.com order of "Omron KGZ-387E Fat Loss ..." has shipped!
Your Amazon.com order of "Omron PNB-885D Fat Loss ..." has shipped!
Your Amazon.com order of "Omron PNH-875H Fat Loss ..." has shipped!
Your Amazon.com order of "Omron REM-787E Fat Loss ..." has shipped!
Your Amazon.com order of "Omron QYM-632R Fat Loss ..." has shipped!
Your Amazon.com order of "Omron UHA-584I Fat Loss ..." has shipped!