Experiment: There may be confidential content in your search results. Please do not share outside Google.

Well.. this is a weird thing to see when searching YouTube..

"Experiment: There may be confidential content in your search results. Please do not share outside Google." Yeah, I think something went a bit wrong there..

Citibank spam / Statement ID 64775-4985.doc

This fake Citibank spam contains a malicious Word document that leads to malware.

Date:      Thu, 9 May 2013 01:22:21 +0200 [05/08/13 19:22:21 EDT]
From:      CITIBANK [noreply@citybank.com]
Subject:      Merchant Statement

Enclosed DOC is your Citibank Paymentech electronic Merchant Billing Statement. If you need help, please contact your Account Executive or call Merchant Services at the telephone number listed on your statement. PLEASE DO NOT RESPOND BY USING REPLY. This email is sent from an unmonitored email address, and your response will not be received by Citibank Paymentech. Citibank Paymentech will not be responsible for any liabilities that may result from or relate to any failure or delay caused by Citibank Paymentech's or the Merchant's email service or otherwise. Citibank Paymentech recommends that Merchants continue to monitor their statement information regularly. ---------- Learn more about Citibank Paymentech Solutions, LLC payment processing services at Citibank. ---------- THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer. 

The attached document Statement ID 64775-4985.doc contains an exploit (analysis pending) with a VirusTotal detection rate of just 10/46. It appears to exploit a flaw in the RTF converter. I'm not all together sure which flaw it is, but making sure that your copy of Microsoft Office is up-to-date and fully patched will help to mitigate against this sort of threat.

Update: another version is using the filename Statement ID 4657-345-347-0332.doc. It looks like it is exploiting CVE-2012-0158 aka MS12-027.

Amazon.com spam / ehrap.net

This fake Amazon spam leads to malware on ehrap.net:

Date:      Tue, 7 May 2013 22:54:26 +0100 [05/07/13 17:54:26 EDT]
From:      "Amazon.com" [drudgingb50@m.amazonmail.com]
Subject:      Your Amazon.com order confirmation.

Thanks for your order, [redacted]!

Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.

Order Information:

E-mail Address:  [redacted]
Billing Address:
216 CROSSING CRK N
GAHANNA
United States
Phone: 1-747-289-5672

Order Grand Total: $ 53.99
   
Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More

Order Summary:
Details:
Order #:     I12-4392835-6098844
Subtotal of items:     $ 53.99
    ------
Total before tax:     $ 53.99
Tax Collected:     $0.00
    ------
Grand Total:     $ 50.00
Gift Certificates:     $ 3.99
    ------
Total for this Order:     $ 53.99

The following item is auto-delivered to your Kindle or other device. You can view more information about this order by clicking on the title on the Manage Your Kindle page at Amazon.com.
Mockingjay (The Final Book of The Hunger Games) [Kindle Edition] $ 53.99
Sold By: Random House Digital, Inc.
Give Kindle books to anyone with an e-mail address - no Kindle required!

You can review your orders in Your Account. If you've explored the links on that page but still have a question, please visit our online Help Department.

Please note: This e-mail was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.

Thanks again for shopping with us.

Amazon.com
Earth's Biggest Selection

Prefer not to receive HTML mail? Click here

The link in the email goes through a legitimate hacked site and ends up on [donotclick]ehrap.net/news/days_electric-sources.php (report here) hosted on (or with nameservers on) the following IPs:
85.41.88.24 (Telecom Italia, Italy)
98.210.212.79 (Comcast, US)
140.121.140.92 (TANet, Taiwan)
178.175.140.185 (Trabia-Network, Moldova)
197.246.3.196 (The Noor Group, Egypt)
216.70.110.21 (Media Temple, US)

The domains involved indicate that this is the gang behind what I call the Amerika series of spam emails.

Blocklist:
85.41.88.24
98.210.212.79
140.121.140.92
178.175.140.185
197.246.3.196
216.70.110.21
airticketscanada.net
contonskovkiys.ru
curilkofskie.ru
ehrap.net
exrexycheck.ru
fenvid.com
gangrenablin.ru
gatareykahera.ru
janefgort.net
klosotro9.net
mortolkr4.com
peertag.com
smartsecurity-app.com
zonebar.net

Something evil on 151.248.123.170, Part III

I've covered 151.248.123.170 (Reg.ru, Russia) a couple of times in the past month [1] [2], and it's still actively pushing out malware via dynamic DNS domains, many of which are injection attacks on hacked sites.

There are hundreds or possibly thousands of malicious domains on this IP. Blocking them individually is likely to be problematic, the best approach is to block all traffic to 151.248.123.170 or to the Dynamic DNS domains involved.. although this might potentially block access to some legitimate sites.

These are the Dynamic DNS domains being abused (you should consider blocking them in my opinion):
3utilities.com
4mydomain.com
4pu.com
changeip.org
ddns.ms
ddns.us
dns04.com
dsmtp.com
dynamicdns.biz
dynamic-dns.net
freeddns.com
ftpserver.biz
ikwb.com
itemdb.com
jetos.com
lflinkup.net
mefound.com
myddns.com
myftp.org
myfw.us
mypicture.info
mysecondarydns.com
myvnc.com
ninth.biz
no-ip.biz
no-ip.info
no-ip.org
ns01.biz
ns01.info
ns02.us
ns3.name
ocry.com
organiccrap.com
otzo.com
port25.biz
redirectme.net
servebeer.com
serveblog.net
servecounterstrike.com
serveftp.com
servegame.com
servehalflife.com
servehttp.com
servemp3.com
servepics.com
servequake.com
serveusers.com
xxuz.com
youdontcare.com

These are the domains that I can detect on the IP, but there are probably many, many more.
0j6nlxx1.myftp.org
0x0ipb74i.myvnc.com
162u8ugl.servehttp.com
1wupkdyz.no-ip.org
2fwujpyj78.servehttp.com
2j9smce4.myvnc.com
3b51lly0.serveftp.com
3lejjwtbog.no-ip.info
3s5c4v.no-ip.org
3xdt4ejh6.servegame.com
4ur8266w.servebeer.com
6a3wfiznv.servepics.com
6lb311je7.servegame.com
6r69m9b5.serveftp.com
6vdsce2.myvnc.com
7rhw1bpqw.redirectme.net
8dcfv6ba.servepics.com
8f3rkuz.servehttp.com
8k4y6s14g.servequake.com
8kli99kzom.servehalflife.com
8vf9eijal.servehttp.com
9jss9fkfz.servebeer.com
9t2ok1w.servehttp.com
9trcul.3utilities.com
acqdpoqlhtlt.myfw.us
acydtk.itemdb.com
ae6s7iq.servemp3.com
aeqxvegity.changeip.org
agbrtjbdmn.dsmtp.com
ah8d1itwz4.servehalflife.com
ahbedbxyo.myfw.us
aivcdizhr.myfw.us
alspyjnx.serveusers.com
anghootuveg.myfw.us
aqbpswfpj.myfw.us
aqmcuaegy.mefound.com
aqydiv.mefound.com
arziphhrov.dsmtp.com
ass6j8glsg.servehalflife.com
astvrbbad.4pu.com
ataiyhhx.xxuz.com
attxrhs.ns3.name
auhjlwn.ftpserver.biz
aupmbeutcbr.myfw.us
awuddyedd.myfw.us
awxtfktz.youdontcare.com
ayfmlz.changeip.org
aywejlbwn.4pu.com
azxbxx.organiccrap.com
bamwkq.ikwb.com
bawhla.otzo.com
bemtknoufs.4pu.com
bfatsqv.organiccrap.com
bfvidbvewl.mypicture.info
bgmya4t.no-ip.biz
biwqqkzcsa.dynamic-dns.net
bkgeepguwu.youdontcare.com
bnnpvmf.4pu.com
bofapqngse.ddns.us
briirddzbn.myfw.us
btpqyb1p7a.servebeer.com
bzyphcsjcrhs.myfw.us
chlcsqnh.myddns.com
ckbqvlouqe.serveusers.com
cnsycrdv.organiccrap.com
cqunky.xxuz.com
csggbzz.ikwb.com
cttjhki.dynamicdns.biz
cuhadjcnyl.myfw.us
cuimcgv.dns04.com
cundqzpc.youdontcare.com
cuupggih.4pu.com
cvgjzgjabfzz.myfw.us
cwabkfjsh.organiccrap.com
cwfbslqwj.organiccrap.com
cymkwqz.ftpserver.biz
cysbagz.mysecondarydns.com
czbzcx.jetos.com
czjgxkcbf.freeddns.com
czyllsokwi.dynamic-dns.net
ddamrkgie.mypicture.info
ddmvubybx.myfw.us
ddzcvtvglpgb.myfw.us
detnqgkbjahg.myfw.us
dgdgfs.dynamicdns.biz
djgoaf.mysecondarydns.com
dkpdfe.port25.biz
dmfqtxoqvmbe.myfw.us
dnvkizwemfmy.myfw.us
dpwmvwqa.ftpserver.biz
dqmbhghc.itemdb.com
drxjqr.serveusers.com
drzvmd.ns3.name
dtjkin.ns01.info
dukr7abe6.serveftp.com
dumqgfkodvko.myfw.us
dxexzx.port25.biz
eajwozhkn.myfw.us
ecqhffsix.youdontcare.com
edbjaepjg.myfw.us
edefwbh.ftpserver.biz
eeerrtnzii.ftpserver.biz
ehaxoe.mysecondarydns.com
eifmydan.organiccrap.com
ekmlvqvc.dns04.com
emhkyc.ns3.name
encrtggml.youdontcare.com
eogxekpdtcvb.myfw.us
epllsmxckoo.myfw.us
erygtbkshcz.myfw.us
esmiqsq.mysecondarydns.com
eufdldv.mypicture.info
evbntlv.dynamicdns.biz
evkhegeue.myftp.org
exrjzleph.myfw.us
ezbbhtfo.freeddns.com
ezrzmcnmwkl.myfw.us
ezzbnjwtz.changeip.org
fbwlwfnboll.myfw.us
ferzds.ns01.info
fhlswqcai.4pu.com
fitiioenutsp.myfw.us
fjbcsk.otzo.com
fkvqztwwitsm.myfw.us
fmdetqh.dsmtp.com
fntqexnwhjdz.myfw.us
fqbiankg.ikwb.com
fqguhzwcasmj.myfw.us
fqzbwstxyypa.myfw.us
fryjpao.myddns.com
frzfhndxw.itemdb.com
fum22fhpi.servegame.com
fxkooknk.itemdb.com
fxxpnp.itemdb.com
fyuccxbvon.jetos.com
fzeypa.ns3.name
g5fm891.3utilities.com
gaaemoaa.itemdb.com
gaolppjyq.myfw.us
gblfhdwbegow.myfw.us
gdlvqfak.4pu.com
getbwoedccls.myfw.us
gexurmmntx.changeip.org
gfdwowolvt.myfw.us
gfwmxzpvnp.myfw.us
ggpmov.ddns.us
gidnmygaum.ddns.us
gjsqbsqawb.myfw.us
gnbaamarlyit.myfw.us
gpqfskqe.lflinkup.net
gtvqed.organiccrap.com
gtyvjhvw.port25.biz
gumyfsjo.itemdb.com
gwgz8nz7bu.servepics.com
gwhwyvf.ocry.com
gxdcjg.dynamic-dns.net
gzfbhckcddl.myfw.us
h898k9wo.serveftp.com
hbvqaddxz.myfw.us
hdbbzvxejqn.myfw.us
hdowbe.servehttp.com
hdskfrel.ninth.biz
hdwuuvr.ddns.us
hdzfbnlenp.ninth.biz
hefqgipiv.myfw.us
hfltusb.ocry.com
hgibkcayvxc.myfw.us
hgqsiruxft.myfw.us
hgykiuwwh.organiccrap.com
hopucovetkbn.myfw.us
hpnfoqes.ftpserver.biz
hqvjpdsqa.organiccrap.com
hrwouxktkt.ftpserver.biz
hszdvlv.mefound.com
htensj.xxuz.com
hvdqroibk.port25.biz
hvjmsvfdmeab.myfw.us
hvmkidxvr.dynamic-dns.net
hvywhncmn.itemdb.com
hxqvvy.changeip.org
i74hiyo2y.no-ip.org
iappjftw.itemdb.com
iavvgjkk.ftpserver.biz
idjwfvk.dynamicdns.biz
iftewoyvwpob.myfw.us
ijccqljgr.myfw.us
ilugmefnc.freeddns.com
iqyqszqf.lflinkup.net
iriqvotyaz.ns01.biz
irszbliskh.myddns.com
iskiyiha.ninth.biz
iszibayuer.myddns.com
ithnqo.4pu.com
ituevs.xxuz.com
iub483p4.servegame.com
ivkpydtby.no-ip.org
iwhabdyn.serveusers.com
iypjnpcqw.myfw.us
izdzccr.xxuz.com
jacqvk.lflinkup.net
jaiftyxs.mysecondarydns.com
jaqmastga.itemdb.com
jbtcinyjv.4pu.com
jdfoggkzh.serveusers.com
jeaalexymm.myfw.us
jeldtld.organiccrap.com
jenzxchy.ns01.biz
jflhcqv.ikwb.com
jgbkbtyz.freeddns.com
jirshkrgu.youdontcare.com
jjjpbhx.4pu.com
jlbabnosva.otzo.com
jmiqcslfum.ns01.info
jnpknqp.lflinkup.net
jonaybvvy.itemdb.com
jpqtaqvaln.myfw.us
jpvjaujch.myfw.us
jqkaywyy.myddns.com
jupdsuhoh.youdontcare.com
jw5w8658z.redirectme.net
jxxemgpdyqk.myfw.us
kaavrqisc.myfw.us
kamxaip.mypicture.info
kchergnrxp.myfw.us
kcjbeu.ocry.com
kdeftpvpng.dynamic-dns.net
kejzxgh.4pu.com
knmbrnexxh.mysecondarydns.com
knvspjvyz.itemdb.com
koqlwnbku.serveusers.com
kplfuxjzy.myfw.us
kpvshgdss.ns3.name
krnwhhhtwvh.myfw.us
krwwhoehyl.myfw.us
kukxizdui.4mydomain.com
kycwuhgvc.serveusers.com
kyfmidqmh.4pu.com
kzklrwv.serveusers.com
l1y3o4o.serveblog.net
l2z0i6s1.servehttp.com
lajbbeqj.jetos.com
laqsaui.ns01.info
lclcnkhccdl.myfw.us
ldvdfx.ikwb.com
lhbqxfuvy.ocry.com
ljnanlpatrwd.myfw.us
llbguuda.ikwb.com
llotmdufz.dns04.com
lozbalothmc.myfw.us
lrnqgxgoa.ikwb.com
lsjqlbo.port25.biz
lusvrj.dsmtp.com
luyyyd.mysecondarydns.com
lwnplgpton.dsmtp.com
lwtujojereoi.myfw.us
lxpilprs.myddns.com
lyleqfeq.4pu.com
meuquma.ddns.us
mfdteohcrc.youdontcare.com
mfksblicgi.ocry.com
mfyxqutszl.otzo.com
mikxwsfmj.changeip.org
mkgwgjgwci.ddns.us
mrfltmzyeseg.myfw.us
mrnmqdsxfyze.myfw.us
muqvwvf.freeddns.com
mvdqmecbf.myfw.us
mvjlxlyjp.myfw.us
mvuqao.myddns.com
mwqgxlttg.ns01.biz
mx0t2z.servecounterstrike.com
myhnzszkoe.myfw.us
myijyjux.organiccrap.com
mzikrrzf.jetos.com
mzxkmjmquo.myfw.us
naxfpmhw.ninth.biz
ncywhwofn.dsmtp.com
nczgqdlrys.myfw.us
negkht.changeip.org
nhzgjm.dynamic-dns.net
nmwikbwrxia.myfw.us
nnufbc.dynamicdns.biz
npfhqlsm.dynamic-dns.net
npphmnxy.ddns.us
nqusbcphiby.myfw.us
nrpfyekqlk.dynamic-dns.net
nrqmusuueb.serveusers.com
ntbdeedkj.dsmtp.com
nuzmis.itemdb.com
nxcgynyedfs.myfw.us
oatg31.servehalflife.com
ocrrwieqzlha.myfw.us
ohustyl.mysecondarydns.com
okbriapkfb.mefound.com
okeqqnzcge.myfw.us
oliwkndvyxw.myfw.us
omuiekhqjg.myfw.us
oonfrqcocu.myfw.us
oonqydmt.ikwb.com
opaalghwxqlt.myfw.us
opsypzduo.myfw.us
oqccjqk.ikwb.com
oreywhh.serveusers.com
otcdaq.ns02.us
otnblbzjo.serveusers.com
otrshugxco.dynamic-dns.net
otsgcgz.servehttp.com
outwlswin.4mydomain.com
ouurcv.4mydomain.com
ovamujvhsa.dsmtp.com
owljtjpwb.myfw.us
ownowavbfj.ns01.info
oykqbk5bqf.servemp3.com
oywwrii.organiccrap.com
ozgaoshpd.mefound.com
ozxvjdyz.changeip.org
p9kc1ha4.servemp3.com
panvscen.ddns.us
pcafwnm.ikwb.com
pddcmcvof.mysecondarydns.com
peusfapdz.myfw.us
pjhzlriy.ninth.biz
pjrkvghqg.ocry.com
pjvcoazluq.dsmtp.com
pkyowjrjycw.myfw.us
pluowrgpl.myfw.us
pmkihqq.mypicture.info
ppakfotxhpy.myfw.us
ppmdbwqxcrv.myfw.us
ppsjpvzmjg.serveusers.com
prdjva.otzo.com
ptyxbmzkz.itemdb.com
pwkbuuor.xxuz.com
pwkwxztpaj.myfw.us
pyyxiapoxv.myfw.us
qcwkznq.dsmtp.com
qdfjptc.ns01.info
qfawknwtl.myfw.us
qfvrlt.4pu.com
qhfxww.dns04.com
qiwxwwy.dns04.com
qjhdnvjrn.changeip.org
qmnouatnlelp.myfw.us
qmnrup.mysecondarydns.com
qnljeztgg.changeip.org
qnwycifjfl.myfw.us
qplgaurnspl.myfw.us
qtbxjkot.ocry.com
qvvefzzj.ocry.com
qwwxtgojc.ninth.biz
qxp9xez9.3utilities.com
qzlkluald.myfw.us
qzsoegkp.dsmtp.com
r4g6m2.servehttp.com
ramtaky.4pu.com
rbnumsmbygqb.myfw.us
rcezlgb.ns3.name
rclmhzj.mefound.com
rdhrrxlyu.port25.biz
rebcdbgzic.ftpserver.biz
reoenqybu.myfw.us
rgtyavgys.freeddns.com
rhxiepm.ns3.name
ricznb.port25.biz
rjolnrlnpn.serveusers.com
rkaseooypl.myfw.us
rnordfancw.mefound.com
rnrbdynkblyb.myfw.us
rpbdqzdemsu.myfw.us
rtxektc.xxuz.com
rujaafdzwq.xxuz.com
rutqjnsex.myfw.us
rwscdhnhn.4mydomain.com
rxnirgmhsgwv.myfw.us
rxuvkq.mefound.com
rygsjmlss.dsmtp.com
rzreau.myddns.com
sb0y2h.myftp.org
sbjbuclp.dns04.com
seronwzic.myfw.us
serszgynbi.mysecondarydns.com
sgcdujudgzm.myfw.us
simiawbsilu.myfw.us
sjjcmisyd.mysecondarydns.com
skfynaq.serveusers.com
slcnxx.dynamic-dns.net
slcvzheogxph.myfw.us
smjyq1vm.serveftp.com
snediezzlsq.myfw.us
snozgi.organiccrap.com
sopnxhpyjb.port25.biz
sozsybvook.myfw.us
sozuzt.ddns.us
sqdgixmrki.dynamicdns.biz
sqqttryu.itemdb.com
swvgvgldodz.myfw.us
swxxruj.dynamicdns.biz
szsitxy.4pu.com
taokofzze.dynamic-dns.net
tbpsuzdk.port25.biz
tbrfrz.lflinkup.net
tcdcyjxit.ddns.ms
tcutixej.ikwb.com
tfqvhdg.otzo.com
tfywivnfc.myfw.us
tlasuq.itemdb.com
tlggqcgx.ftpserver.biz
tmipoitnfj.myfw.us
tq5wmetanb.servecounterstrike.com
tqzhbfaoy.ns02.us
tsxkxilw.ikwb.com
tufslzazbs.mypicture.info
tuvyov.changeip.org
uegnytqslcm.myfw.us
uelrmywt.ddns.us
uftmrikaydi.myfw.us
ugrhad.dynamic-dns.net
umogoraqz.myfw.us
unkcwjcrmh.otzo.com
utcdmox.dynamic-dns.net
uttptbyvgr.organiccrap.com
uucnwdbptssb.myfw.us
uufqumjr.youdontcare.com
uw35u18.servemp3.com
uwivsj.mefound.com
uwoyvvwvz.myfw.us
uyblrr.dsmtp.com
uyubmke.ns02.us
uzaqlbvvw.ninth.biz
vajoznzefrpt.myfw.us
vawhnrazl.organiccrap.com
vbgbbbjkr.mefound.com
vbhxqbwpt.myfw.us
vdbcdlmwie.port25.biz
ve57fs4.no-ip.org
vgyxuawyxb.myfw.us
vhfemrmovaiq.myfw.us
viptao.ddns.us
viqvti.ns01.info
vktlhllldxz.myfw.us
vpogbb.ns01.info
vpxnbn.organiccrap.com
vtzetcj.ftpserver.biz
vyjhuhol.ftpserver.biz
vysanjugba.changeip.org
wbgavjt.port25.biz
wbhglzsnqe.mypicture.info
wbjnmudcekl.myfw.us
wcxqvknrd.myfw.us
wenrtsjzbc.myfw.us
wfgjxiai.jetos.com
wfjktwnlfx.4mydomain.com
wgolucqns.myfw.us
whaumhrm.organiccrap.com
whpiiimwpodx.myfw.us
whsdoygqm.myfw.us
wilompgsaf.myfw.us
wjdakob.serveusers.com
wkbmaebigy.xxuz.com
wlrdvucbw.myfw.us
wmfqnjimufe.myfw.us
wmhvxsyex.dynamic-dns.net
wmjjdhqfev.myfw.us
wmnrrskry.myfw.us
wnxran.itemdb.com
wpjbcs.ns3.name
wtaumavodr.mysecondarydns.com
wthsard.dsmtp.com
wtriylabiccu.myfw.us
wuamrecon.myfw.us
wzjaaohoigzj.myfw.us
wzkjljfhfx.myfw.us
xcltzwbpmf.4mydomain.com
xfhhefpp.ns01.info
xicrkcb.dynamic-dns.net
xjtkbawsfc.ninth.biz
xkfrazfa.changeip.org
xkxbhbnc.organiccrap.com
xlhppgpktfrq.myfw.us
xosjtax.itemdb.com
xrjwwo.dsmtp.com
xtjypuoa.ftpserver.biz
xtkwuntrv.organiccrap.com
xufntdrj.ns01.info
xujepnjhas.dns04.com
xvsfuixww.organiccrap.com
xwnnmn.ns01.info
xygvilyksie.myfw.us
xzbqujbaj.ocry.com
xzphozmjxqsd.myfw.us
ybcpncmnea.ddns.ms
ydadyu.serveusers.com
yffrfdbkaq.myfw.us
yirlmqgnl.ns3.name
yjrpzzveovi.myfw.us
ynoljubnwos.myfw.us
ynskejsvl.myfw.us
ypccsuwr.ns3.name
yqkdkhqlei.ns01.info
yrtbvvytij.myfw.us
ys9hh20i.servehttp.com
yupbgt.4pu.com
yvwyrbgaji.serveusers.com
yxkudyzfnuv.myfw.us
yywgvpqrpeym.myfw.us
yzmgroem.changeip.org
yzytnygb.ftpserver.biz
yzzihzpo.mysecondarydns.com
zbauqs.ns01.info
zbirjhbbwb.ocry.com
zc287xl.servepics.com
zcauzvzqm.ftpserver.biz
zenxdduid.myfw.us
zhdlzrwzlw.myfw.us
zhudyeczk.myfw.us
zixxjxpc.mefound.com
zjbihpktdn.myfw.us
zkaowad.ddns.ms
zklseo.ddns.us
zmrycmomb.jetos.com
znfrriscgl.myfw.us
zphazatgvuob.myfw.us
zqt4wnw.myftp.org
zrizzrhxcmy.myfw.us
zrqkczmec.dynamic-dns.net
ztvbimxeq.myddns.com
zviwqprs.dynamic-dns.net
zwnovqmrquml.myfw.us
zxjczhjvq.otzo.com
zyttqhhvc.ns3.name
zzifxrfob.dynamicdns.biz
zznbfpbjpqpm.myfw.us

Wanted: Seer. To work on Åland.. wherever that is.

This made me chuckle (click to enlarge):

Åland incidentally is a pretty interesting place if you know your history and has it's own internet TLD of .ax despite being part of Finland. Where they all speak Swedish. Frankly, if there's the sort of place you might actually find a seer then Åland is it.

Anyway, if living on Swedish-speaking demilitarized neutral island near Finland appeals to you can you can predict the future, then you can find a job application here.

Something evil on 173.255.200.91

173.255.200.91 (Linode, US) is exhibiting the characteristics of the Neutrino Exploit kit [see URLquery and VirusTotal reports). Attempts to analyse the malware seem to be generating 404 errors, but this could simply be a defensive mechanism by the malware on the server.

I can see the following domains on the server, ones flagged by Google for malware are highlighted. I would recommend blocking all domains on this server however, or simply block the IP address.

3dgamess.com
allcityhotels.com
allnewshere.com
anewschannel.com
backlinkfinder.com
backlinkhunter.com
cycling-infos.com
cycling-infos.info
cycling-infos.net
cycling-infos.org
dover-road.com
dover-road.info
dover-road.net
dover-road.org
dubuinc.com
dubuinc.info
dubuinc.net
dubuinc.org
ehotelguide.com
essentiale-water.com
essentiale-water.info
essentiale-water.net
essentiale-water.org
favoritewatches.com
fiveandsixandseven.com
fiveandsixandseven.net
imbiss-directory.com
imbiss-directory.info
imbiss-directory.net
imbiss-directory.org
imbiss-restaurants.com
imbiss-restaurants.info
imbiss-restaurants.net
imbiss-restaurants.org
jab-servers.com
jab-servers.info
jab-servers.net
jab-servers.org
komedidukkani.com
li210-91.members.linode.com
opengolfguide.com
paris-online-guide.com
paris-online-guide.info
paris-online-guide.net
paris-online-guide.org
rome-online-guide.com
rome-online-guide.info
rome-online-guide.org
shinebaby.info
shinebaby.org
toplumailgondermeprogrami.com
whereismysiteongoogle.com
wordpressthemes1.com

The malicious domains appear to be registered to the same person, but as the email address seems to bear no relation to the person's name then they may well be fake:
owner-name: Hans Funfell
owner-address: Mohrenstrasse 55
owner-city: Berlin
owner-state: DE
owner-country: DE
owner-postcode: 10117
owner-telephone: +49.89789200
owner-fax:
owner-email: jowiams779@gmail.com

A quick bit of Googling came up with exactly zero people called "Hans Funfell" (of course if you do it now there will be a match..)

A look at the wonderful, weird world of retro phones

How many of these do you remember?

Somewhere in my collection I actually have a Motorola ROKR E1, the disastrous result of a joint venture between Apple and Motorola. There's also a Nokia 9300i, Nokia 770, Nokia 7380 and Nokia N91. Yeah.. I own a lot of phones. Quite a lot of them are weird.

These were the days before the iPhone and Android, where the biggest smartphone fight was still between Microsoft and the all-powerful Nokia. But most people had old-fashioned dumbphones instead.. a lot of which were clamshells. Do you remember them?

LinkedIn spam / guessworkcontentprotect.biz

This fake LinkedIn email leads to malware on guessworkcontentprotect.biz:

From:     LinkedIn Invitations [giuseppeah5@mail.paypal.com]
Date:     2 May 2013 16:49
Subject:     LinkedIn inviation notificaltion.
   
LinkedIn
This is a note that on May 2, Lewis Padilla sent you an invitation to join their professional network at LinkedIn.
Accept Lewis Padilla Invitation
   
On May 2, Lewis Padilla wrote:

> To: [redacted]
>
> I'd like to join you to my professional network on LinkedIn.
>
> Lewis Padilla    
   
You are receiving Reminder emails for pending invitations. Unsubscribe.
© 2013 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA. 

The malicious payload is at [donotclick]guessworkcontentprotect.biz/news/pattern-brother.php (report here) hosted on:
82.236.38.147 (PROXAD Free SAS, France)
83.212.110.172 (Greek Research and Technology Network, Greece)
130.239.163.24 (Umea University, Sweden)
203.190.36.201 (Kementerian Pertanian, Indonesia)

Blocklist:
82.236.38.147
83.212.110.172
130.239.163.24
203.190.36.201
app-smart-system.com
contonskovkiys.ru
curilkofskie.ru
egetraktovony.ru
exrexycheck.ru
fenvid.com
frustrationpostcards.biz
gangrenablin.ru
gatareykahera.ru
guessworkcontentprotect.biz
janefgort.net
klosotro9.net
miniscule.pl
mortolkr4.com
peertag.com
priorityclub.pl
smartsecurity-app.com
zonebar.net

"Your Wire Transfer 07532312 canceled" spam / Receipt on payment ID758-34.exe

This spam message has a malicious attachment:

Date:      Thu, 2 May 2013 03:01:38 +0400 [05/01/13 19:01:38 EDT]
From:      Federal Reserve [alerts@federalreserve.gov]
Subject:      Your Wire Transfer 07532312 canceled

The Wire transfer , recently sent from your bank account , was not processed by the FedWire.
Transfer details attached to the letter.
This service is provided to you by the Federal Reserve Board. Visit us on the web at website
To report this message as spam, offensive, or if you feel you have received this in error, please send e-mail to email address including the entire contents and subject of the message. It will be reviewed by staff and acted upon appropriately 

There is an attachment PAYMENT RECEIPT 01-05-2013.zip which in turn contains the malicious executable Receipt on payment ID758-34.exe which Comodo CAMAS reports has the following checksums:

MD5	652d9919b209562bc8bb79b34e3af47d
SHA1	cb90c55378366d3e8633ee1ea69f02f9e66da722
SHA256	5151bd7722a5fee83edff91b6ff9b32c47ca1ac2eabad87b0639b22851453d62

VirusTotal results are just 18/46.  The Anubis report and ThreatExpert report only give limited information. The ThreatTrack report [pdf] is more detailed and reveals some botnet IPs that the malware calls back to.

"Your Wire Transfer 82932922 canceled" spam / Payment reeceipt.exe / 78.139.187.6

This fake wire transfer spam comes with a malicious attachment:

Date:      Tue, 30 Apr 2013 15:27:44 -0500 [16:27:44 EDT]
From:      Federal Reserve [alerts@federalreserve.gov]
Subject:      Your Wire Transfer 82932922 canceled

The Wire transfer , recently sent from your bank account , was not processed by the FedWire.
Transfer details attached to the letter.
This service is provided to you by the Federal Reserve Board. Visit us on the web at website
To report this message as spam, offensive, or if you feel you have received this in error, please send e-mail to email address including the entire contents and subject of the message. It will be reviewed by staff and acted upon appropriately 

In this case there is an attachment PAYMENT RECEIPT 30-04-2013-GBK-75.zip which contains a malicious executable crafted to look like a Word document called Payment reeceipt.exe . This executable has a so-so VirusTotal detection rate of 29/46.

The malware has the following checksums according to Comodo CAMAS:

Size	371712
MD5	0a3723483e06dcf7e51073972b9d1ef3
SHA1	293735a9fdc7e786b12c2ef92f544ffc53a0a0e7
SHA256	0eb5dd62e32bc6480bae638967320957419ba70330f0b9ad5759c2d3f25753dd

Anubis has a pretty detailed report of what this malware does. In particular, you might want to monitor network traffic to and from 78.139.187.6 (Caucasus Online, Georgia) which seems to be a C&C server. This IP has also been seen here. There are several other IPs involved, but these look like DSL subscribers with dynamic address, so probably a part of a botnet. For the sake of completeness they are:

64.231.249.250
69.183.226.70
78.139.187.6
81.133.189.232
123.237.234.67

Something evil on 96.126.108.132

These sites are on (or are likely to be created on) 96.126.108.132 (Linode, US) which is a known malware server [1] [2] [3]. Blocking this IP would be wise. Some of the domains are rather.. unusual ;)

0-0-0-0-0-0-0-0-0-0-0-0-0-1-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-10-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-11-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-12-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-13-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-14-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-15-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-16-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-17-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-18-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-2-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-20-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-21-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-22-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-23-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-24-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-25-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-26-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-27-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-29-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-3-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-30-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-31-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-32-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-33-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-34-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-35-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-36-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-37-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-39-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-4-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-40-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-41-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-42-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-43-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-44-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-45-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-46-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-47-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-48-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-49-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-5-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-50-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-51-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-52-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-53-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-54-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-55-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-56-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-57-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-58-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-59-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-6-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-60-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-8-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-0-0-0-0-0-0-0-9-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-1-0-0-1-1-0-0-0-1-0-0-1-0-1-1-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-1-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-0-1-1-1-0-0-1-0-0-1-1-1-0-0-0-0-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-2-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-1-0-0-1-1-0-0-0-1-0-0-1-0-1-1-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-3-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-4-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-0-1-1-1-0-0-1-0-0-1-1-1-0-0-0-0-1-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-5-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-0-0-0-0-1-0-1-1-0-0-0-0-0-1-1-1-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-6-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-0-0-1-1-0-0-0-1-0-0-1-0-1-1-0-0-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-0-1-0-1-0-1-1-1-0-1-0-1-0-0-1-0-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-8-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-9-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-1-0-1-0-0-0-1-1-1-0-0-1-1-1-0-1-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-10-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-1-1-0-0-1-0-0-1-1-1-0-0-0-0-1-1-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-11-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-0-1-1-1-1-0-1-1-1-1-1-1-1-0-1-0-0-1-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-12-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-0-0-0-1-0-1-1-0-0-0-0-0-1-1-1-0-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-13-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-0-0-1-1-1-1-0-0-0-0-1-1-0-1-0-0-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-14-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-0-1-1-0-0-0-1-0-0-1-0-1-1-0-0-1-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-15-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-1-0-0-0-1-0-0-0-0-1-1-1-1-1-1-1-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-16-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-1-0-1-0-1-1-1-0-1-0-1-0-0-1-0-1-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-17-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-1-1-0-1-0-1-0-0-1-1-0-0-1-0-1-0-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-18-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-0-0-1-0-0-0-0-1-0-0-0-1-0-1-1-0-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-20-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-0-1-0-0-0-1-1-1-0-0-1-1-1-0-1-1-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-21-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-0-1-1-0-1-1-0-1-0-1-1-0-0-0-0-1-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-22-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-1-0-0-1-0-0-1-1-1-0-0-0-0-1-1-0-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-23-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-1-0-1-1-1-0-0-1-1-0-1-0-1-1-0-0-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-24-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-0-1-1-1-1-0-1-1-1-1-1-1-1-0-1-0-0-1-0-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-25-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-0-0-0-0-0-1-0-1-1-1-1-1-0-1-1-1-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-26-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-0-0-1-0-1-1-0-0-0-0-0-1-1-1-0-1-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-27-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-0-1-0-1-0-0-1-0-0-1-0-0-0-0-1-1-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-0-1-1-1-1-0-0-0-0-1-1-0-1-0-0-0-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-29-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-1-0-0-1-1-1-1-0-1-0-0-0-1-1-1-0-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-30-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-1-1-0-0-0-1-0-0-1-0-1-1-0-0-1-1-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-31-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-0-1-1-1-0-1-0-1-0-1-1-0-1-1-0-0-1-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-32-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-0-0-0-1-0-0-0-0-1-1-1-1-1-1-1-1-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-33-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-0-0-1-1-0-1-1-1-0-0-1-0-0-1-0-0-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-34-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-0-1-0-1-1-1-0-1-0-1-0-0-1-0-1-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-35-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-1-0-0-0-0-0-1-1-0-1-1-1-0-0-0-0-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-36-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-1-0-1-0-1-0-0-1-1-0-0-1-0-1-0-1-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-37-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-1-1-0-0-1-1-1-1-1-0-1-1-1-0-1-1-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-39-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-0-0-0-1-1-1-0-0-0-0-0-0-0-1-1-0-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-40-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-0-1-0-0-0-0-1-0-0-0-1-0-1-1-0-0-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-41-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-0-1-1-0-1-0-0-0-0-1-0-1-0-0-0-1-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-42-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-1-0-0-0-1-1-1-0-0-1-1-1-0-1-1-1-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-43-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-1-0-1-1-0-1-0-0-1-0-0-1-1-1-0-1-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-44-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-0-1-1-0-1-1-0-1-0-1-1-0-0-0-0-1-0-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-45-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-0-0-0-0-0-0-0-0-1-1-1-0-1-0-0-0-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-46-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-0-0-1-0-0-1-1-1-0-0-0-0-1-1-0-1-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-47-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-0-1-0-0-1-1-0-1-0-0-1-1-0-0-1-1-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-48-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-0-1-1-1-0-0-1-1-0-1-0-1-1-0-0-1-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-49-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-1-0-0-1-1-0-0-1-0-1-1-1-1-1-1-0-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-50-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-1-0-1-1-1-1-1-1-1-0-1-0-0-1-0-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-51-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-0-1-1-1-1-1-1-0-0-1-0-1-1-1-0-0-1-0-1-0-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-52-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-0-0-0-0-1-0-1-1-1-1-1-0-1-1-1-1-1-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-53-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-0-0-1-1-0-0-1-0-0-0-0-1-0-1-0-1-0-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-54-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-0-1-0-1-1-0-0-0-0-0-1-1-1-0-1-0-1-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-55-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-0-1-1-1-1-1-1-0-0-1-1-0-0-0-0-0-1-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-56-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-1-0-1-0-0-1-0-0-1-0-0-0-0-1-1-0-0-0-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-57-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-1-1-0-0-1-0-1-0-1-0-1-0-1-0-1-1-1-1-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-58-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-0-1-1-1-1-0-0-0-0-1-1-0-1-0-0-0-1-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-59-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-1-0-0-1-0-0-0-1-0-1-1-0-1-1-1-1-0-1-1-1-0-0-0-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-60-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-2-4-3-x-c-l-3-a-m-1-v-6-s-u-4-h-9-1-y-0-l-8-l-3-5-1-k-g-8-c-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-4-5-8-o-3-q-6-t-k-m-r-b-a-m-8-v-w-0-v-6-p-1-4-0-i-v-1-s-d-u-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-9-y-5-e-r-x-2-t-1-s-z-2-7-2-9-k-s-g-2-e-h-r-8-j-r-1-9-e-e-v-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
0-y-4-2-4-f-x-2-5-y-6-8-i-9-b-d-9-v-z-e-y-g-0-n-1-6-c-q-6-7-a-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
1-6-1-5-6-3-0-2-3-8-3-3-6-6-5-4-1-4-4-4-4-8-2-6-0-1-3-5-0-8-4-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
1-7-1-3-7-0-4-6-7-0-8-0-2-4-3-5-6-8-7-1-2-8-2-8-3-5-8-1-3-1-5-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
1-8-2-7-5-1-7-1-2-0-4-2-5-3-8-6-0-3-3-5-2-8-3-2-8-6-8-4-2-7-0-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
1-9-5-7-3-2-4-4-5-4-7-3-2-7-2-4-5-5-5-2-3-8-5-2-1-2-1-4-6-2-7-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
1-x-5-5-8-0-9-3-7-1-5-7-c-g-r-6-z-m-h-n-7-b-7-9-3-s-3-0-4-j-t-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
2-1-4-2-5-3-7-4-1-6-6-5-7-1-7-1-8-0-0-7-3-4-1-1-1-0-6-4-5-1-4-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
2-5-q-i-2-1-6-9-k-a-2-i-6-a-h-3-5-6-u-8-8-t-9-e-0-8-8-t-6-7-f-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
2-7-t-q-2-7-l-0-2-4-k-c-0-q-0-c-k-a-6-4-z-h-9-r-u-w-8-4-4-3-9-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
2-a-7-7-1-f-5-r-e-s-s-f-0-h-l-7-d-o-8-s-a-i-p-z-8-2-a-4-0-c-z-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
2-m-1-m-s-g-f-1-6-k-5-4-5-f-d-f-9-7-2-v-c-2-9-j-d-6-7-8-8-c-x-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
3-4-4-6-0-5-8-3-1-3-6-3-3-6-3-6-4-1-2-0-8-2-5-2-7-2-7-1-2-0-4-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
3-4-5-3-3-8-5-7-2-8-6-0-1-6-5-8-0-3-5-6-3-2-8-6-8-6-5-0-3-8-6-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
3-6-j-6-a-y-j-1-h-q-m-b-z-m-3-2-s-5-p-0-f-7-1-0-0-h-f-2-7-g-d-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
4-6-9-6-f-x-k-4-w-7-4-9-d-4-m-1-8-v-3-z-5-d-v-a-t-d-a-6-8-2-9-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
4-7-5-3-0-1-1-2-8-4-6-7-6-6-1-0-8-7-5-7-2-1-8-6-2-7-1-2-2-8-0-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
5-4-5-2-8-8-1-2-4-6-7-2-5-6-7-4-4-7-3-8-2-7-2-3-7-3-6-8-7-3-6-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
5-l-8-w-i-7-4-4-z-x-9-c-0-c-0-0-d-o-4-0-9-9-8-4-i-1-s-0-j-e-j-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
5-u-e-o-w-x-8-i-3-n-p-c-6-9-0-6-7-w-s-3-8-f-2-d-e-1-d-3-3-k-8-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
6-2-0-0-2-7-2-2-4-2-3-0-4-1-7-5-6-8-2-4-0-5-3-8-1-8-5-3-1-4-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
6-3-1-g-6-3-n-4-4-5-d-j-h-6-i-g-1-j-2-4-0-0-3-3-3-1-r-s-6-9-u-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
6-4-5-2-2-6-0-6-7-6-0-3-7-7-3-8-7-0-8-3-4-6-0-5-4-2-5-5-2-2-7-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
6-6-2-6-5-4-7-1-7-8-6-7-5-6-1-6-3-3-9-8-9-7-2-5-4-7-5-6-2-2-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
6-h-o-f-m-7-8-7-g-4-e-p-x-1-z-1-a-0-0-4-3-3-k-8-j-9-n-7-z-4-s-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
7-2-2-4-7-9-7-4-8-3-6-2-9-1-2-7-8-8-7-9-3-6-5-3-5-9-9-3-9-2-6-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
765b394e34.biz
8-0-5-4-7-4-7-7-0-5-4-7-3-8-1-6-6-6-4-8-7-1-5-2-7-6-3-0-5-0-6-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
8-6-5-7-7-9-6-5-2-9-9-2-2-2-5-7-9-4-5-9-5-7-5-4-3-2-6-3-3-5-7-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
8-8-6-2-6-4-2-6-9-9-5-5-4-6-4-5-2-9-6-4-8-6-2-9-8-5-2-6-3-2-7-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
8-9-3-6-8-0-8-0-4-j-6-0-v-w-y-o-h-8-u-0-y-q-1-1-g-t-4-1-3-6-f-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
9-6-m-8-2-v-i-6-4-0-9-l-v-v-e-e-d-4-r-j-u-9-z-0-9-2-r-t-3-8-a-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
9-8-1-4-c-i-s-n-7-2-3-0-e-z-h-7-3-4-r-u-w-6-n-0-2-f-a-a-m-7-a-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
9-8-g-3-q-g-2-h-d-x-b-u-o-o-v-7-o-f-7-4-x-5-3-e-9-6-v-6-y-9-8-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
9-f-z-s-e-6-2-k-y-f-7-4-7-8-g-m-9-p-5-7-n-g-3-d-o-s-q-0-m-4-a-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
alfa.homeunix.com
alotibi.xylocomod.com
arta.romail3arnest.info
b-8-8-l-0-5-e-8-k-d-a-o-9-u-9-6-3-p-a-d-1-s-a-n-p-0-1-h-u-u-l-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
chk3.eu
cirimpapacirimpapa-fghbvsfdbfdbfd875t67rfv7dsgyvsu.com
clickbrief.org
clickfremont.org
config1007.iwillhavesexygirls.com
config1130.iwillhavesexygirls.com
dentbeen.eu
disafuwokis.eu
down1130.iwillhavesexygirls.com
expl0it.homeunix.org
fe28753777.com
file0129.iwillhavesexygirls.com
finansgroups.com
findcourageous.org
findcurly.org
findrasup.org
findwandering.org
fl.ue1tio.in
flashi.in
foqaqehacew.eu
fotyriwavix.eu
gaquviwyrup.eu
gduf.info
iwillhavesexygirls.com
jayno.swastikano.net
jbalbfhkewo7i487fksd.info
jewish.r4t.biz
juno.swastikano.net
kefuwidijyp.eu
kejitanokon.eu
kezapyjolek.eu
kinderplus.in
li365-132.members.linode.com
love.swastikano.net
lysovidacyx.eu
mashka.in
maxyjofytyt.eu
mx2.finansgroups.com
mx3.finansgroups.com
mx4.finansgroups.com
mx5.finansgroups.com
n98usfhcyughdcsbchjb.com
n-o-2-8-1-6-k-y-0-e-8-x-j-g-0-e-8-a-a-p-0-1-b-8-c-4-e-z-b-f-p-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
nomebemenid.eu
o-b-0-j-9-7-h-8-0-2-d-6-m-3-4-9-l-c-8-v-g-h-4-u-u-9-1-n-b-t-c-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
o-j-j-k-1-9-4-1-4-7-z-1-h-p-l-2-8-3-w-n-f-l-r-9-0-5-8-s-0-6-q-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
ourfreespaces.com
p.r4t.biz
pufiluqudic.eu
q-1-4-5-v-s-z-e-r-0-3-v-d-8-8-e-6-i-8-6-q-8-5-2-2-4-3-s-j-g-6-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
qjisnelmcjtg.com
r-2-8-l-3-d-a-0-c-0-r-4-6-u-l-p-6-7-a-4-1-k-9-2-c-8-8-9-z-3-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
r4t.biz
reslove-dns.com
r-k-7-4-w-r-5-4-8-g-x-3-s-4-4-q-k-v-1-i-5-3-u-g-u-1-4-r-0-3-v-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
romail3arnest.info
ryleryqacic.eu
searchalaska.org
searchalice.org
searchalike.org
searchalphabet.org
searchatmosphere.org
searchbowl.org
searchbreeze.org
searchbrick.org
searchdefeated.org
searcheager.org
servf.zyns.com
spotrate.info
srnubetbguwfet.com
svaravinoplaks.com
swastikano.net
tefy.net
tep.xylocomod.com
tufecagemyl.eu
u-3-o-7-u-2-5-9-h-d-b-j-1-x-w-k-2-2-y-c-y-0-0-z-3-4-b-3-3-z-q-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info
ue1tio.in
update.longmusic.com
vfdykmselcv.com
w-7-2-9-h-1-s-9-8-x-7-e-4-8-4-i-6-l-0-5-f-7-9-0-7-4-x-7-x-7-8-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
wesaf341.org
windows-update-server.com
wsef32asd1.org
wvvexfux.com
www.flashi.in
xylocomod.com
y-3-z-i-j-2-5-t-y-s-g-0-1-f-3-9-w-k-7-c-0-5-n-i-1-a-3-r-4-p-3-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
y-4-5-3-k-a-n-6-2-w-p-b-s-2-4-i-3-t-0-4-k-7-3-r-a-t-6-p-f-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-7-0-0-0-0-0-0-0-0-0-0-0-0-0.info
y-t-s-t-2-x-8-5-p-m-h-1-x-8-9-c-5-8-4-3-d-t-s-8-5-1-3-7-s-0-i-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.info
yummcxgbkyknsbvrui.com
z-6-b-1-5-2-c-2-l-e-m-4-1-6-6-9-z-n-a-2-8-3-z-p-s-7-9-5-r-0-2-.0-0-0-0-0-0-0-0-0-0-0-0-0-38-0-0-0-0-0-0-0-0-0-0-0-0-0.info
zeqsmmiwj3d.com

"Requested Reset of Yoyr PayPal Password" spam / frustrationpostcards.biz

This fake PayPal spam leads to malware on frustrationpostcards.biz:

 Date:      Mon, 29 Apr 2013 13:22:03 -0500
From:      "service@paypalmail.com" [chichisaq0@emlreq.paypalmail.com]
Subject:      Requested Reset of Yoyr PayPal Password
  
Your account will stay on hold untill password reset.
How to reset your PayPal password

Hello [redacted],

To get back into your PayPal account, you'll have to create a new password.

It's easy:

    Click the link below to open a secure browser window.
    Confirm that you're the owner of the account, and then follow the instructions.

  Reset your password now

If you didn't requested help with your password, let us know immediately. Reporting it is important because it helps us prevent fraudsters from stealing your information.

  
Help Center | Security Center

Please don't reply to this email. It'll just confuse the computer that sent it and you won't get a response.

Copyright © 2013 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95132.

PayPal Email ID 2A7X1

The link goes through a legitimate but hacked site to land on a malicious payload at [donotclick]frustrationpostcards.biz/news/institutions-trusted.php (report here) hosted on the following IPs:

82.236.38.147 (PROXAD Free SAS, France)
83.212.110.172 (Greek Research and Technology Network, Greece)
130.239.163.24 (Umea University, Sweden)


TheWHOIS details identify this domain as belonging to the Amerika gang:

Registrant ID:                          INTEGOY3JBV8IIHG
Registrant Name:                        Shouli Cowper
Registrant Address1:                    40 W 17th St
Registrant City:                        New York
Registrant Postal Code:                 10011
Registrant Country:                     United States
Registrant Country Code:                US
Registrant Phone Number:                +1.4682697453
Registrant Email:                       shouli_cowper563@bikeracer.com
 
Blocklist:
82.236.38.147
83.212.110.172
130.239.163.24
app-smart-system.com
contonskovkiys.ru
curilkofskie.ru
egetraktovony.ru
exrexycheck.ru
fenvid.com
frustrationpostcards.biz
gangrenablin.ru
gatareykahera.ru
janefgort.net
klosotro9.net
miniscule.pl
mortalsrichers.info
mortolkr4.com
peertag.com
pricesgettos.info
priorityclub.pl
smartsecurity-app.com
zonebar.net

Is CB3ROB a champion of free speech? Or a spammer?

The alleged arrest of Sven Olaf Kamphuis (aka CB3ROB) of CyberBunker and the eponymous CB3ROB Ltd has thrown Anonymous into a tizzy, with a #freecb3rob campaign running on Twitter.

The arrest was made because of a suspicion that Kamphius might be behind a massive DDoS attack on Spamhaus that also impacted Cloudflare. I don't have any evidence that CB3ROB or any of his business associates are behind the DDoS attack, but there's a well-known public spat between Spamhaus (who accuse Cyberbunker of being spammers) and Cyberbunker (who accuse Spamhaus of being vigilantes who want to stifle free speech).

It's hard to see why Anon is pro-CB3ROB and so anti-Spamhaus. Yes, it has been reported that CyberBunker has helped to host the Pirate Bay and Wikileaks in the past, both favourites of Anon and not necessarily bad things in themselves. And Spamhaus doesn't actually block anything - it provides a reputation scoring system that others can use to see if they want to accept or reject email, but Spamhaus's very assertive actions against CyberBunker seem to have been the trigger.

But perhaps the critical question is this - what does CyberBunker (and CB3ROB Ltd) actually host?

I identified 866 websites in the large 84.22.96.0/19 block (84.22.96.0 - 84.22.127.255) allocated to both CyberBunker and CB3ROB, although this list is probably not comprehensive. This is what I discovered:

• 74% of them are flagged as spam domains by multi.surbl.org
• 39% are flagged as spam on more than one blacklist
• 0.9% of them are flagged as malware domains by Google
• 78% of them have a poor WOT reputation

You can download the complete set of results from here [csv]. This data includes the domain name, IP, decimalised IP (good for sorting in Excel), WOT rankings, Google Safe Browsing diagnostic and SURBL prognosis.


Given the high level of domains flagged for spam, the obvious conclusion is that CyberBunker has a serious spam problem and a less serious malware problem mostly centered on 84.22.104.244 and also 84.22.104.246 (more info here) Perhaps there are some legitimate sites in this list who have been caught up in the crossfire, although nothing seems to stand out. I'd love to know who is using CyberBunker for anything other than spam and malware.

You can look at the evidence yourself and decide if CB3ROB is a champion of free speech or someone who supports spammers. I know what my conclusion is though.

Something evil on 199.71.212.122

199.71.212.122 is an IP address belonging to Psychz Networks in the US. It hosts a number of sites with malware one them according to VirusTotal and URLquery. Some of the malicious domains were recently hosted on this IP.

I suspect that there are lot more domains than the ones listed on this server, blocking access to it is probably the best approach. Sites flagged by Google as malicious are marked in  red , you should assume that all sites on this server are equally evil though.

5realgame.deaftone.com
atomzmarquee.org
byfiletypepreparing.org
newssearch048.ru
ohlikeminded.org
printboyexplore.biz
yearlyvoiceover.org
2record-fact.3d-game.com
3coopertu.4irc.com
3perioda.3d-game.com
4poitesla.3d-game.com
4terpanf.3d-game.com
4terropet.flnet.org
5perebor.3d-game.com
5teasure.3d-game.com
a3debora.3d-game.com
a4bebeshka.3d-game.com
a5sonfar.3d-game.com
boxbelow.scieron.com
documentingglanced.org
entirelynumerical.scieron.com
fashionbrands2013.com
formkindmasculine.biz
headsskypeme.org
iolan5da.3d-game.com
newssearch040.ru
newssearch041.ru
newssearch042.ru
newssearch043.ru
newssearch044.ru
newssearch045.ru
newssearch046.ru
newssearch047.ru
newssearch049.ru
noireresponsible.org
perry4out.3d-game.com
strugglestabs.biz
truespaceia.biz
usecanatt.biz
visualagenostalgic.org
worldsgiver.biz
youcandoitshop.info

Something evil on 193.107.16.213 / Ideal Solution Ltd

193.107.16.213 is a web server run by Ideal Solution Ltd in the Seychelles. It contains many malware sites that should be blocked, and you might well want to consider blocking the entire 193.107.16.0/22 (193.107.16.0 - 193.107.19.255) range.

VirusTotal detects a number of malicious sites on this server (see report) but blocking access to this IP address is probably the easiest approach. However there seems to be very little of value in the whole /22 and I have personally had it blocked for some months with no ill effects.

The sites that I can identify, their MyWOT ratings and Google prognosis can be download from here [csv]. Use this data as you see fit.

The following sites are on 193.107.16.213. Ones marked in  red  are flagged by Google as being malicious, although you should assume that they all are and block them accordingly.

allbestauto097.ru
forumsupport015.ru
forumsupport016.ru
forumsupport017.ru
forumsupport018.ru
forumsupport019.ru
forumsupport020.ru
forumsupport023.ru
forumsupport024.ru
forumsupport025.ru
forumsupport026.ru
forumsupport027.ru
forumsupport028.ru
forumsupport029.ru
forumsupport030.ru
forumsupport034.ru
forumsupport037.ru
forumsupport038.ru
forumsupport039.ru
forumsupport040.ru
forumsupport041.ru
forumsupport043.ru
forumsupport044.ru
forumsupport045.ru
forumsupport046.ru
forumsupport047.ru
forumsupport048.ru
forumsupport049.ru
forumsupport050.ru
newssearch001.ru
newssearch002.ru
newssearch003.ru
newssearch010.ru
newssearch017.ru
newssearch024.ru
newssearch039.ru
overviewdrive023.ru
overviewdrive026.ru
overviewdrive027.ru
overviewdrive028.ru
overviewdrive030.ru
overviewdrive032.ru
overviewdrive034.ru
overviewdrive035.ru
overviewdrive036.ru
overviewdrive039.ru
overviewdrive040.ru
overviewdrive041.ru
overviewdrive042.ru
overviewdrive043.ru
overviewdrive044.ru
overviewdrive045.ru
overviewdrive046.ru
overviewdrive047.ru
overviewdrive051.ru
overviewdrive054.ru
overviewdrive056.ru
overviewdrive059.ru
overviewdrive061.ru
overviewdrive063.ru
overviewdrive065.ru
overviewdrive066.ru
overviewdrive070.ru
overviewdrive072.ru
overviewdrive075.ru
overviewdrive087.ru
overviewdrive092.ru
overviewdrive093.ru
overviewdrive094.ru
overviewdrive100.ru
promoution242.ru
rotatorjps001.ru
rotatorjps030.ru
rotatorjps044.ru
rotatorjps046.ru
rotatorjps050.ru
newssearch004.ru
newssearch005.ru
newssearch006.ru
newssearch007.ru
newssearch008.ru
newssearch009.ru
newssearch011.ru
newssearch012.ru
newssearch013.ru
newssearch014.ru
newssearch015.ru
newssearch016.ru
newssearch018.ru
newssearch019.ru
newssearch020.ru
newssearch021.ru
newssearch022.ru
newssearch023.ru
newssearch025.ru
newssearch026.ru
newssearch027.ru
newssearch028.ru
newssearch029.ru
newssearch030.ru
newssearch031.ru
newssearch033.ru
newssearch034.ru
newssearch035.ru
newssearch036.ru
newssearch037.ru
newssearch038.ru
newssearch050.ru
overviewdrive091.ru
overviewdrive095.ru
overviewdrive097.ru
overviewdrive098.ru
permanentbiz.com
promoution115.ru
promoution181.ru
promoution218.ru
promoution221.ru
promoution222.ru
promoution223.ru
promoution224.ru
promoution225.ru
promoution226.ru
promoution227.ru
promoution228.ru
promoution229.ru
promoution231.ru
promoution246.ru
promoution247.ru
promoution248.ru
promoution250.ru
roger001.ru
roger002.ru
roger003.ru
roger004.ru
roger005.ru
roger006.ru
roger007.ru
roger008.ru
roger009.ru
roger010.ru

"USPS delivery failure report" spam / LABEL-ID-56723547-GFK72.zip

This fake USPS message has a malicious attachment:

Date:      Fri, 26 Apr 2013 12:46:25 +0400 [04:46:25 EDT]
From:      USPS client manager Lelia Holden [reports@usps.com]
Subject:      USPS delivery failure report
Priority:      High Priority 1

Notification

Our company’s courier couldn’t make the delivery of package.

REASON: Postal code contains an error.
LOCATION OF YOUR PARCEL: New York
DELIVERY STATUS: sort order
SERVICE: One-day Shipping
NUMBER OF YOUR PARCEL: UGL38SHK4T
FEATURES: No

Label is enclosed to the letter.
Print a label and show it at your post office.

An additional information:

If the parcel isn’t received within 30 working days our company will have the right to claim compensation from you for it’s keeping in the amount of $8.26 for each day of keeping of it.

You can find the information about the procedure and conditions of parcels keeping in the nearest office.

Thank you for using our services.
USPS Global.

There is an attachment LABEL-ID-56723547-GFK72.zip which in turn contains an executable file LABEL-ID-56723547-GFK72.exe which is designed to look like a PDF file. VirusTotal results are a pretty poor 7/46.

The malicious binary has the following checksums:

MD5	df81b21e9526c571d03bc1fb189f233c
SHA1	dd2fe390e3f16a7f12786799af927f62df6754c4
SHA256	db001675033574e5291b1717b7b704d43d9bd676604b623f781d2f4cde60590a

Comodo CAMAS reports some very unusual behaviour around LDAP registry keys, not present in the Anubis report or ThreatExpert report.

Update: a rather more comprehensive ThreatTrack report can be found here [pdf].

RU:8080 timeline

A quick bit of research for anyone following the RU:8080 gang.. where has the spam gone? Recently we've seen RU:8080 spam every weekday for some time, and there hasn't been anything since 19th April (nearly a week ago).

The current RU:8080 runs started in February 2012 (although there had been similar malware spam URLs before that). A timeline of the dates of the runs I spotted can be found here.

The spam runs always happen on a weekday, not a weekend. Mondays are slightly less common than the other weekdays. Usually there are no more than 4 or 5 days between runs.. but the RU:8080 gang has shut down for longer.

For example, in April 2012 they shut down for up to 46 days, in July 2012 it was 21 days, August 2012 was 31 days, December 2012 for 13 days and February 2013 for 10 days.

Of note the April 2012 shutdown coincided roughly with start of Orthodox Easter, the December 2012 shutdown was from the period between the Western and Orthodox Christmas. The summer shutdowns could simply be because the RU:8080 gang were on holiday (they don't work weekends, after all).

Show a brief shutdown doesn't mean a permanent shutdown. But if it lasts for longer than a month then it's a different matter..

Updated 22/5/13: and now it has been over a month without a peep..

The "Signature Strengths" (behaviourlibrary.com) fiasco

A post over at the Sqwawkbox Blog highlights the absurdity of an online behavioural survey site called "Signature Strengths" that jobseekers are "encouraged" to use. It makes the claim that no matter what you enter, it always comes up with some positive reason why you should be working. OK.. perhaps that isn't a bad thing, but it is clearly pretty absurd.

Try it for yourself by taking the test. I answered all the questions with the mindset of an feckless, depressive sociopath and this is what I was told:

Your results!
Think about how you can use these strengths in your job search and in your life in general
Try to find a new way to use them then everyday

Strength 1. Curiosity
You are curious about everything. You are always asking questions, and you find all subjects and topics fascinating. You like exploration and discovery.

Strength 2. Love of learning
You love learning new things, whether in a class or on your own. You have always loved school, reading, and museums-anywhere and everywhere there is an opportunity to learn.

Strength 3. Critical Thinking
Thinking things through and examining them from all sides are important aspects of who you are. You do not jump to conclusions, and you rely only on solid evidence to make your decisions. You are able to change your mind.

Strength 4. Originality
Thinking of new ways to do things is a crucial part of who you are. You are never content with doing something the conventional way if a better way is possible.

Strength 5. Social Intelligence
You are aware of the motives and feelings of other people. You know what to do to fit in to different social situations, and you know what to do to put others at ease.

Fill in your email address address below to have your strengths emailed to you. You may want to discuss these with your advisor at your next meeting.

Sounds positive? But the answers that I gave to the questions completely contradict this:

1. I am always curious about the world
Very much unlike me [contradicts Strength 1]

2. I am easily bored
Very much like me

3. I am thrilled when I learn something new
Very much unlike me [contradicts Strength 2]

4. I never go out of my way to visit museums
Very much like me [contradicts Strength 2]

5. When the topic called for it, I can be a highly rational thinker
Very much unlike me [contradicts Strength 3]

6. I tend to make snap judgements
Very much like me [contradicts Strength 3]

7. I like to think of new ways to do things
Very much unlike me [contradicts Strength 4]

8. Most of my friends are more imaginative than I am
Very much like me

9. No matter what the social situation, I am able to fit in
Very much unlike me [contradicts Strength 5]

10. I am not very good at sensing what other people are feeling
Very much like me [contradicts Strength 5]

11. I am always able to look at things and see the big picture
Very much unlike me [contradicts Strength 3]

12. Others rarely come to me for advice
Very much like me

13. I have taken frequent stands in the face of strong opposition
Very much unlike me

14. Pain and disappointment often get the better of me
Very much like me

15. I always finish what I start
Very much unlike me

16. I get sidetracked when I work
Very much like me

17. I always keep my promises
Very much unlike me [partly contradicts Strength 5]

18. My friends never tell me I’m down to earth
Very much like me

19. I voluntarily helped a neighbour last month
Very much unlike me

20. I am rarely as excited about the good fortune of others as I am about my own
Very much like me [contradicts Strength 5]

21. There are people in my life who care as much about my feelings and well-being as they do about their own
Very much unlike me

22. I have trouble accepting love from others
Very much like me

23. I work best when I am part of a group
Very much unlike me [partly contradicts Strength 5]

24. I hesitate to sacrifice my self-interest for the benefit of groups I am in
Very much like me [partly contradicts Strength 5]

25. I treat all people equally, regardless of who they might be
Very much unlike me [partly contradicts Strength 5]

26. If I do not like someone, it is difficult for me to treat him or her fairly
Very much like me [partly contradicts Strength 5]

27. I can always get people to do things together without nagging them
Very much unlike me [partly contradicts Strength 5]

28. I am not very good at planning group activities
Very much like me

29. I can control my emotions
Very much unlike me

30. I can rarely stay on a diet
Very much like me

31. I avoid activities that are physically dangerous
Very much unlike me

32. I sometimes make poor choices in friendships and relationships
Very much like me [partly contradicts Strength 5]

33. I change the subject when people pay me compliments
Very much unlike me

34. I often brag about my accomplishments
Very much like me [partly contradicts Strength 5]

35. In the last month, I have been thrilled by excellence in music, art, drama, film, sport, science or mathematics
Very much unlike me [partly contradicts Strength 2]

36. I have not created anything of beauty in the last year
Very much like me [partly contradicts Strength 2]

37. I always say thank you, even for little things
Very much unlike me [partly contradicts Strength 5]

38. I rarely stop and count my blessings
Very much like me

39. I always look on bright side
Very much unlike me

40. I rarely have a well thought out plan for what I want to do
Very much like me [contradicts Strength 3]

41. My life has a strong purpose
Very much unlike me

42. I do not have a calling in life
Very much like me

43. I always let bygones be bygones
Very much unlike me [partly contradicts Strength 5]

44. I always try to get even
Very much like me [partly contradicts Strength 5]

45. I always mix work and play as much as possible
Very much unlike me

46. I rarely say funny things
Very much like me

47. I throw myself into everything I do
Very much unlike me

48. I mope a lot
Very much like me

So who owns this site? A look at the WHOIS records come up blank:

   Administrative Contact:
      Private, Registration  behaviourlibrary.com@domainsbyproxy.com
      Domains By Proxy, LLC
      DomainsByProxy.com
      14747 N Northsight Blvd Suite 111, PMB 309
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599      Fax -- (480) 624-2598

Not to worry, because a historical WHOIS gives us the real records:

   Administrative Contact:
      Nguyen, Samuel  samuel.nguyen@cabinet-office.gsi.gov.uk
      1123 Aquarius House
      19 St George Wharf
      London, England SW82FG
      United Kingdom
      0-782-183-6785

That's this chappie.

As The Register points out, this is a completely bogus test that appears to be designed to make people feel more positive about work (and to perhaps collect email addresses) rather than offering any constructive advice. Positive thinking is not a bad thing, but this is a wasted opportunity to achieve something constructive in terms of critical analysis. Surely it wouldn't be too difficult to create (or buy in) a test to do this properly?

"Organ donation" spam

This isn't the first time that I've seen this spam...

From: timur146@mail.ru
Date: 25 April 2013 02:26
Subject: Organ donation.

Hello.
My name is Alex and I'm from Ukraine. I found your address on medical website.
I want to be a living donor. I am ready to give one of my kidneys or part of my liver, but I want to receive a big compensation for that.
If you need kidney or liver transplant contact me. If you don't need it, but you know somebody who need it, please send my message or keep it.
I am 33 years old man. I don't smoke cigarettes and don't drink alcohol. My blood is O+ and I have a good health.
This is not a joke, I am ready to do it. I will listen the offer and conditions of recipient.

Don't reply to this letter, but write to me on one of these e-mail addresses:

organ.donation@yandex.ua
organ.donation_ua@yahoo.com

P.S. I am sorry if I was mistaken or you received my e-mail twice. I won't disturb you any more.

..presumably Alex hasn't manage to punt his internal organs yet as I saw the same Alex spamming two years ago. Given that he was 31 then and is 33 now, then I have the horrible feeling that this is a genuine offer for used body parts.

The originating IP appears to be 74.54.201.178 (ThePlanet, US) which looks like a rented server.

"New Secure Message" spam / pricesgettos.info

This spam leads to malware on pricesgettos.info:

Date:      Wed, 24 Apr 2013 16:41:50 +0100 [11:41:50 EDT]
From:      Cooper.Anderson@csiweb.com
Subject:      New Secure Message Received from Cooper.Anderson@csiweb.com

New Secure Message
Respective [redacted],

You have received a new secure message from Cooper.Anderson@csiweb.com.

If you are using the Secure Message Plugin in Lotus Notes this message will be in your SecureMessages Inbox.

If you are NOT using the Secure Message Plugin, you are able to view it by clicking https://www.csiweb.com/5890424-13QZUR797870/?inbox_idf3795430A7NO9 to retrieve your secure message or to begin using the convenient Lotus Notes Plugin.


Sincerely Yours,

CSIe

The link displayed in the email is fake and actually goes to a legitimate (but hacked) site and is then forwarded to the Blackhole payload site at [donotclick]pricesgettos.info/news/done-heavy_hall_meant.php (report here) hosted on the following IPs:

1.235.183.241 (SK Broadband, Korea)
130.239.163.24 (Umea University, Sweden)
155.239.247.247 (Centurion Telkom, South Africa)
202.31.139.173 (Kum oh National University of Technology, Korea)
203.64.101.145 (Taiwan Academic Network, Taiwan)

Blocklist:
1.235.183.241
130.239.163.24
155.239.247.247
202.31.139.173
203.64.101.145
airtrantran.com
antidoterskief.net
app-smartsystem.com
app-smart-system.com
basic-printers.com
bbb-complaint.org
buyersusaremote.net
condalinaradushko5.ru
conficinskiy.ru
contonskovkiys.ru
cormoviesutki.ru
curilkofskie.ru
dataprocessingservice-alerts.com
dataprocessingservice-reports.com
docudat.ru
dyntic.com
egetraktovony.ru
excuticoble.ru
exrexycheck.ru
fenvid.com
freedblacks.net
gangrenablin.ru
gatareykahera.ru
independinsy.net
janefgort.net
klosotro9.net
libertyusadist.info
mortalsrichers.info
mortolkr4.com
peertag.com
pricesgettos.info
ricepad.net
securitysmartsystem.com
tempandhost.com
thesecondincomee.com
zonebar.net