March 2013 ~ tech support 9

Friday, 29 March 2013

"Please respond - overdue payment" spam / INVOICE_28781731.zip

Posted on 12:51 by Unknown

This spam comes with a malware-laden attachment called INVOICE_28781731.zip:

Date:     Fri, 29 Mar 2013 10:33:53 -0600 [12:33:53 EDT]
From:     Victor_Lindsey@key.com
Subject:     Please respond - overdue payment

Please find attached your invoices for the past months. Remit the payment by 02/04/2013
as outlines under our "Payment Terms" agreement.

Thank you for your business,

Sincerely,

Posted in Canada, EXE-in-ZIP, Malware, Spam, Viruses | No comments

Thursday, 28 March 2013

ADP Spam / ipiniadto.ru

Posted on 12:51 by Unknown

This fake ADP spam leads to malware on ipiniadto.ru:

Date: Thu, 28 Mar 2013 04:22:48 +0600 [03/27/13 18:22:48 EDT]From: Bebo Service [service@noreply.bebo.com]Subject: ADP Immediate NotificationADP Immediate NotificationReference #: 120327398Thu, 28 Mar 2013 04:22:48 +0600Dear ADP ClientYour Transfer Record(s) have been created at the web site:https://www.flexdirect.adp.com/

Posted in ADP, Malware, RU:8080, Spam, Viruses | No comments

Facebook spam / ipiniadto.ru

Posted on 12:29 by Unknown

The email address says Filestube. The message says Facebook. This can't be good.. and in fact this message just leads to malware on ipiniadto.ru:

Date: Thu, 28 Mar 2013 04:58:33 +0600 [03/27/13 18:58:33 EDT]From: FilesTube [filestube@filestube.com]Subject: You have notifications pendingfacebookHi,Here's some activity you may have missed on Facebook.BERTIE Goldstein has posted

Posted in Endurance International Group, Facebook, Malware, RU:8080, Spam, Viruses | No comments

Changelog spam / Changelog_Urgent_N992.doc.exe

Posted on 02:30 by Unknown

This fake "changelog" spam has a malicious attachment Changelog.zip which in turn contains a malware file named Changelog_Urgent_N992.doc.exe

From: Logistics Express [admin@ups.com]
Subject: Re: Changelog 2011 update

Hi,
as promised changelog,

Michaud Abran

VirusTotal detects the payload as Cridex. The malware is resistant to automated analysis tools, but Comodo CAMAS reports

Posted in EXE-in-ZIP, Malware, Spam, Viruses | No comments

"Scan from a Xerox W. Pro" spam / ilianorkin.ru

Posted on 02:13 by Unknown

This fake printer spam leads to malware on ilianorkin.ru:

From: officejet@[victimdomain]
Sent: 27 March 2013 08:35
Subject: Fwd: Fwd: Scan from a Xerox W. Pro #589307

A Document was sent to you using a XEROX WorkJet PRO 481864299.

SENT BY : Omar
IMAGES : 9
FORMAT (.JPEG) DOWNLOAD
The malicious payload is at [donotclick]ilianorkin.ru:8080/forum/links/column.php (report here) hosted on:

Posted in Malware, Printer Spam, RU:8080, Spam, Viruses | No comments

Wednesday, 27 March 2013

NACHA spam / mgithessia.biz

Posted on 08:53 by Unknown

This fake NACHA spam leads to malware on mgithessia.biz:

From: "Олег.Тихонов@direct.nacha.org" [mailto:universe87@mmsrealestate.com]Sent: 27 March 2013 03:25Subject: Disallowed Direct Deposit paymentImportance: HighTo whom it may concern:We would like to inform you, that your latest Direct Deposit via ACH transaction (Int. No.989391803448) was cancelled,because your business software package

Posted in Amerika, Hetzner, Malware, NACHA, Spam, Viruses | No comments

"British Airways E-ticket receipts" spam / illuminataf.ru

Posted on 06:13 by Unknown

This fake airline ticket spam leads to malware on illuminataf.ru:

Date:     Wed, 27 Mar 2013 03:23:05 +0100
From:     "Xanga" [noreply@xanga.com]
Subject:     British Airways E-ticket receipts
Attachments:     E-Ticket-Receipt.htm

e-ticket receipt
Booking reference: JQ15191488
Dear,

Thank you for booking with British Airways.

Ticket Type: e-ticket
This is your e-ticket receipt. Your

Posted in China, Endurance International Group, Malware, RU:8080, Spam, Viruses | No comments

Tuesday, 26 March 2013

"NY TRAFFIC TICKET" spam / hondatravel.ru

Posted on 15:20 by Unknown

I haven't seen this type of spam for a while, but here it is.. leading to malware on hondatravel.ru:

Date: Wed, 27 Mar 2013 04:24:14 +0330From: "LiveJournal.com" [do-not-reply@livejournal.com]Subject: Fwd: Re: NY TRAFFIC TICKETNew-York Department of Motor VehiclesTRAFFIC TICKETNEW-YORK POLICE DEPARTMENTTHE PERSON CHARGED AS FOLLOWSTime: 2:15 AMDate of Offense: 28/07/2012SPEED

Posted in Malware, RU:8080, Spam, Viruses | No comments

Wire Transfer spam / hondatravel.ru

Posted on 09:11 by Unknown

This fake Wire Transfer spam leads to malware on hondatravel.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedInSent: 26 March 2013 11:52Subject: Re: Wire Transfer Confirmation (FED_4402D79813)Dear Bank Account Operator,WIRE TRANSFER: FED68081773954793456CURRENT STATUS: PENDING Please REVIEW YOUR TRANSACTION as soon as possible.

Posted in Endurance International Group, Malware, RU:8080, Spam, Viruses | No comments

UPS spam / Label_8827712794.zip

Posted on 09:01 by Unknown

This fake UPS spam has a malicious EXE-in-ZIP attachment:

Date: Tue, 26 Mar 2013 20:54:54 +0600 [10:54:54 EDT]From: UPS Express Services [service-notification@ups.com]Subject: UPS - Your package is available for pickup ( Parcel 4HS287FD )The courier company was not able to deliver your parcel by your address.Cause: Error in shipping address.You may pickup the parcel at our post

Posted in EXE-in-ZIP, Linode, Malware, Spam, UPS, Viruses | No comments

eFax Corporate spam / hjuiopsdbgp.ru

Posted on 06:41 by Unknown

This fake eFax spam leads to malware on hjuiopsdbgp.ru:

Date:     Tue, 26 Mar 2013 06:23:36 +0800
From:     LinkedIn [welcome@linkedin.com]
Subject:     Efax Corporate
Attachments:     Efax_Pages.htm

Fax Message [Caller-ID: 378677295]

You have received a 59 pages fax at Tue, 26 Mar 2013 06:23:36 +0800, (954)-363-5285.

* The reference number for this fax is [eFAX-677484317].

View

Posted in eFax, Endurance International Group, Leaseweb, Malware, RU:8080, Spam, Viruses | No comments

DHL Spam / LABEL-ID-NY26032013-GFK73.zip

Posted on 04:28 by Unknown

This DHL-themed spam contains a malicious attachment.

Date:     Tue, 26 Mar 2013 17:27:46 +0700 [06:27:46 EDT]
From:     Bart Whitt - DHL regional manager [reports@dhl.com]
Subject:     DHL delivery report NY20032013-GFK73

Web Version | Update preferences | Unsubscribe


DHL notification

Our company’s courier couldn’t make the delivery of parcel.

REASON: Postal code

Posted in DHL, Malware, Spam, Viruses | No comments

NACHA spam / breathtakingundistinguished.biz

Posted on 02:22 by Unknown

This fake NACHA spam leads to malware on breathtakingundistinguished.biz:

From: "Гена.Симонов@direct.nacha.org" [mailto:corruptnessljx953@bsilogistik.com] Sent: 25 March 2013 22:26Subject: Re: Your Direct Deposit disallowanceImportance: HighAttn: Accounting DepartmentWe are sorry to notify you, that your latest Direct Deposit transaction (#963417979218) was disallowed,because your business

Posted in Amerika, Malware, NACHA, Spam, Viruses | No comments

Monday, 25 March 2013

"Copies of policies" spam / heepsteronst.ru

Posted on 08:49 by Unknown

This spam leads to malware on heepsteronst.ru:

Date:     Mon, 25 Mar 2013 06:20:54 -0500 [07:20:54 EDT]
From:     Ashley Madison [donotreply@ashleymadison.com]
Subject:     RE: DEBBRA - Copies of Policies.

Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
Here is the Package and Umbrella,

and a copy of the most recent schedule.

DEBBRA Barnard,

Posted in Malware, RU:8080, Spam | No comments

"Scan from a HP ScanJet" spam / humaniopa.ru

Posted on 07:53 by Unknown

This fake printer spam leads to malware on humaniopa.ru:

Date: Mon, 25 Mar 2013 03:57:54 -0500From: LinkedIn Connections [connections@linkedin.com]Subject: Scan from a HP ScanJet #928909620Attachments: Scanned_Document.htmAttached document was scanned and sentto you using a Hewlett-Packard HP Officejet 98278P.Sent by: CHANGImages : 5Attachment Type: .HTM [INTERNET EXPLORER]

Posted in Endurance International Group, GoDaddy, Leaseweb, Malware, Printer Spam, RU:8080, Spam, Viruses | No comments

"Bank of America" spam / PAYMENT RECEIPT 25-03-2013-GBK-74

Posted on 06:40 by Unknown

This spam comes with a malicious EXE file in the archive PAYMENT RECEIPT 25-03-2013-GBK-74.zip

Date:     Mon, 25 Mar 2013 05:50:18 +0300 [03/24/13 22:50:18 EDT]
From:     Bank of America [gaudilyl30@gmail.com]
Subject:     Your transaction is completed

Transaction is completed. $4924 has been successfully transferred.
If the transaction was made by mistake please contact our customer

Posted in EXE-in-ZIP, Malware, Spam, Viruses | No comments

contactemaillists.com / Contact Email Lists / Sally Gaskell spam

Posted on 03:50 by Unknown

Would you buy a mailing list from a company that just spammed you? In this case "Contact Email Lists" (contactemaillists.com) has been spamming random at one of my domains (website@, server@ and shopping@), and yet they boast that their data "has been strictly opted in at decision maker level."

Assuming that they are using their own mailing lists for marketing, then their claim is a lie. In

Posted in Sally Gaskell, Spam | No comments

Sunday, 24 March 2013

"Champions Club Community" / championsclubcommunity.com spam

Posted on 16:17 by Unknown

Why these people bother sending me unsolicited email is a mystery... but in fact the so-called "Champions Club Community" is a bit of a mystery too..

From: Simon Phillips - Champions Club [news@championsclubcommunity.com]Reply-To: contactus2@championsclubcommunity.comDate: 24 March 2013 15:56Subject: March 2013 NewsletterEmail not displaying properly? View it onlineCCC

Posted in Spam | No comments

Friday, 22 March 2013

Changelog spam / hohohomaza.ru

Posted on 12:36 by Unknown

Evil changelog spam episode 274, leading to malware on hohohomaza.ru. Hohoho indeed.

Date: Fri, 22 Mar 2013 11:06:48 -0430From: Hank Sears via LinkedIn [member@linkedin.com]Subject: Fwd: Changelog as promised (upd.)Hello,as promised changelog - ViewL. HENDRICKS

The malware landing page is at [donotclick]hohohomaza.ru:8080/forum/links/column.php (report here) hosted on:

Posted in Endurance International Group, Germany, Malware, RU:8080, Spam, Viruses | No comments

Wire Transfer spam / dataprocessingservice-alerts.com

Posted on 10:03 by Unknown

This fake Wire Transfer spam leads to malware on dataprocessingservice-alerts.com:

Date:     Fri, 22 Mar 2013 10:42:22 -0600
From:     support@digitalinsight.com
Subject:     Terminated Wire Transfer Notification - Ref: 54133

Immediate Transfers Processing Service

STATUS Notification
The following wire transfer has been submitted for approval. Please visit this link to review the

Posted in Amerika, Malware, South Africa, Spam, Viruses | No comments

Zendesk "An important notice about security" spam / vagh.ru / pillshighest.com

Posted on 07:42 by Unknown

This unusual spam leads to a fake pharma site on pillshighest.com via vagh.ru and an intermediate hacked site.

Date:     Fri, 22 Mar 2013 13:52:08 -0700
From:     Support Team [pinbot@schwegler.com]
To:     [redacted]
Subject:     An important notice about security

We recently learned that the vendor we use to answer support requests and other emails (Zendesk) experienced a security

Posted in Fake Pharma, Spam | No comments

Thursday, 21 March 2013

Changelog spam / hillairusbomges.ru

Posted on 17:20 by Unknown

This fake changelog spam leads to malware on hillairusbomges.ru:

Date: Thu, 21 Mar 2013 03:01:59 -0500 [04:01:59 EDT]From: LinkedIn Email Confirmation [emailconfirm@linkedin.com]Subject: Re: Changelog Oct.Good morning,as prmised updated changelog - ViewL. LOYD
The malicious payload is at [donotclick]hillairusbomges.ru:8080/forum/links/column.php (report here) hosted on:

Posted in Endurance International Group, Malware, OVH, RU:8080, Spam, Viruses | No comments

Facebook spam / scriptuserreported.org

Posted on 13:32 by Unknown

This Facebook spam has undergone some sort of failure during construction, revealing some of the secrets of how these messages are constructed. It leads to malware on scriptuserreported.org:

Date:     Thu, 21 Mar 2013 10:56:28 -0500
From:     Facebook [update+oi=MKW63Z@facebookmail.com]
Subject:     John Jenkins commented photo of you.

facebook

John Jenkins commented on {l5}.
reply

Posted in Amerika, Facebook, Malware, OVH, Scam, Scams, Spam, Viruses | No comments

"Data Processing Service" spam / airtrantran.com

Posted on 09:19 by Unknown

This spam leads to malware on

Date: Thu, 21 Mar 2013 15:55:22 +0000 [11:55:22 EDT]From: Data Processing Service [customerservice@dataprocessingservice.com]Subject: ACH file ID "973.995" has been processed successfullyFiles Processing ServiceSUCCESS NotificationWe have successfully complete ACH file 'ACH2013-03-20-8.txt' (id '973.995') submitted by user '[redacted]' on '

Posted in Hungary, Malware, South Africa, Spam, Viruses | No comments

NACHA spam / encodeshole.org

Posted on 08:50 by Unknown

This fake NACHA spam leads to malware on encodeshole.org:

From: "Тимур.Родионов@direct.nacha.org" [mailto:biker@wmuttkecompany.com]
Sent: 20 March 2013 18:51
Subject: Payment ID 454806207096 rejected
Importance: High

Dear Sirs,

Herewith we are informing you, that your latest Direct Deposit payment (ID431989197078) was cancelled,due to your current Direct Deposit software being out of date.

Posted in Amerika, Malware, NACHA, Spam, Viruses | No comments

"Scan from a Hewlett-Packard ScanJet" spam / hillaryklinton.ru

Posted on 05:09 by Unknown

This fake printer spam leads to malware on the amusingly-named hillaryklinton.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn PasswordSent: 21 March 2013 06:56Subject: Scan from a Hewlett-Packard ScanJet #269644Attached document was scanned and sentto you using a Hewlett-Packard HP Officejet 6209P.Sent by: SANDIEImages :

Posted in Germany, Malware, Printer Spam, RU:8080, Spam, Viruses | No comments

Wednesday, 20 March 2013

"End of Aug. Statement" spam / hifnsiiip.ru

Posted on 08:17 by Unknown

This fake invoice spam leads to malware on hifnsiiip.ru:

Date: Wed, 20 Mar 2013 05:41:44 +0100From: LinkedIn Connections [connections@linkedin.com]Subject: Re: FW: End of Aug. StatementAttachments: Invoices-AS9927.htmGood morning,as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)Regards
The attached Invoices-AS9927.htm file attempts to

Posted in Germany, Malware, OVH, RU:8080, Spam, Viruses | No comments

USPS Spam / himalayaori.ru

Posted on 03:46 by Unknown

This fake UPS (or is it USPS?) spam leads to malware on himalayaori.ru. The malicious link is in an attachment called ATT17235668.htm.

For some reason the only sample of the spam that I have is horribly mangled:

From: HamzaRowson@hotmail.com [mailto:HamzaRowson@hotmail.com] Sent: 19 March 2013 23:40Subject: United Postal Service Tracking Number H1338091657

Posted in Malware, OVH, RU:8080, Spam, UPS, USPS, Viruses | No comments

Tuesday, 19 March 2013

Malware spam: "Opinion: Cyprus banks shut extended to Monday - CNN.com" / salespeoplerelaunch.org

Posted on 09:57 by Unknown

This topically themed (but fake) CNN spam leads to malware on salespeoplerelaunch.org:

Date:     Tue, 19 Mar 2013 10:40:22 -0600
From:     "CNN Breaking News" [BreakingNews@mail.cnn.com]
Subject:     Opinion: Cyprus banks shut extended to Monday - CNN.com


Powered by
* Please note, the sender's email address has not been verified.


You have received the following link

Posted in Amerika, CNN, Hetzner, Malware, Spam, Viruses | No comments

Facebook spam / heelicotper.ru

Posted on 08:51 by Unknown

This fake Facebook spam leads to malware on heelicotper.ru:

Date: Tue, 19 Mar 2013 08:37:37 +0200From: Facebook [updateSIXQG03I44AX@facebookmail.com]Subject: You have notifications pendingfacebookHi,Here's some activity you may have missed on Facebook.TAMISHA Gore has posted statuses, photos and more on Facebook.Go To Facebook See All NotificationsThis message was sent to [

Posted in Facebook, Malware, RU:8080, Spam, Viruses | No comments

Squeak Data / squeakdata.com spam

Posted on 08:07 by Unknown

This spam is really just a laughable tissue of bullshit. The email address they are sending to has been harvested, so you can be pretty sure that the mailing lists they sell are of very low quality. But there's a bit more to this spam than meets the eye..

From:    Squeak Data [enquiries@squeakdata.com] via smtpguru.net
Date:    19 March 2013 13:35
Subject:    Squeak Data
Signed by:

Posted in Sally Gaskell, Spam, Stupidity | No comments

"End of Aug. Statement Reqiured" spam / hiskintako.ru

Posted on 06:35 by Unknown

This spam leads to malware on hiskintako.ru:

Date: Tue, 19 Mar 2013 08:04:18 +0300From: "package update Ups" [upsdelivercompanyb@ups.com]Subject: Re: FW: End of Aug. Statement ReqiuredAttachments: Invoices-CAS9927.htmHi,as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)Regards-----------------------Date: Tue, 19 Mar 2013 02:18:

Posted in Germany, Malware, OVH, RU:8080, Spam, Viruses | No comments

Monday, 18 March 2013

Malware spam "New Pope Sued For Not Wearing Seat Belt In Popemobile" / webpageparking.net

Posted on 13:11 by Unknown

This pope themed spam leads to malware on webpageparking.net:

Date:     Mon, 18 Mar 2013 20:20:54 +0200
From:     "CNN Breaking News" [BreakingNews@mail.cnn.com]
Subject:     Opinion: New Pope Sued For Not Wearing Seat Belt In Popemobile ... - CNN.com

Powered by
* Please note, the sender's email address has not been verified.

You have received the following link from BreakingNews@

Posted in Amerika, CNN, Hungary, Malware, South Africa, Spam, Viruses | No comments

LinkedIn spam / applockrapidfire.biz

Posted on 09:27 by Unknown

This fake LinkedIn spam leads to malware on applockrapidfire.biz:

From: David O'Connor - LinkedIn [mailto:kissp@gartenplandesign.de]
Sent: 18 March 2013 15:34
Subject: Join my network on LinkedIn
Importance: High

LinkedIn
REMINDERS
Invitation reminders:
From David O\'Connor (animator at ea)

PENDING MESSAGES
There are a total of 9 messages awaiting your response. Go to InBox now.
This

Posted in Amerika, Hetzner, LinkedIn, Malware, Spam, Viruses | No comments

FOG RANT: turn your lights on!

Posted on 01:54 by Unknown

Much of the part of the UK I live in is currently either a) foggy or b) very foggy. Freezing rain has turned the roads to ice and visibility is bugger all. At the moment the roads look like they do in the picture, and there are multiple accidents all over the place.

What amazes me is the sheer amount of complete f--king idiots driving with NO LIGHTS ON WHATSOEVER. Do they not notice that

Posted in Stupidity, Weather | No comments

Friday, 15 March 2013

ADP Package Delivery Confirmation spam / picturesofdeath.net

Posted on 08:10 by Unknown

This fake ADP spam leads to malware on the jollily-named picturesofdeath.net:

From: ADP Chesapeake Package Delivery Confirmation [mailto:do_not_reply@adp.com] Sent: 15 March 2013 14:45Subject: =?iso-8859-1?Q?ADP Chesapeake - Package Delivery NotificationImportance: HighThis message is to notify you that your package has been processed and is on schedule for delivery from ADP. Here are the

Posted in ADP, Amerika, Malware, Spam, Viruses | No comments

RU:8080 Malware sites to block 15/3/13

Posted on 03:20 by Unknown

These seem to be the currently active IPs and domains being used by the RU:8080 gang. Of these the domain gilaogbaos.ru seems to be very active this morning. Block 'em if you can:

5.9.40.136
41.72.150.100
50.116.23.204
66.249.23.64
94.102.14.239
212.180.176.4
213.215.240.24
forumilllionois.ru
foruminanki.ru
forumla.ru
forum-la.ru
forumny.ru
forum-ny.ru
giimiiifo.ru
gilaogbaos.ru
giliaonso.ru

Posted in Endurance International Group, Hetzner, Linode, Malware, RU:8080, Spam, Viruses | No comments

Thursday, 14 March 2013

Samsung Galaxy S4

Posted on 17:22 by Unknown

Seriously.. when does it stop being a phone? This Galaxy S4 thing has a 5" HD display, a processor with up to eight cores, and it even watches you watching it. Just remember that last point while you are perusing your favourite rubber midget lesbian vore collection.

What I hadn't heard of before is the Samsung HomeSync server which is basically a 1TB appliance you put in your home and store

Posted in Phones | No comments

Brian Krebs gets SWATted

Posted on 15:49 by Unknown

It looks like Brian Krebs got a visit from a SWAT team today, after having his site DDOSed and served with a fake takedown notice, possibly in retaliation for this article. Nasty.

It reminds me a little of the "suicide note" incident with the operator of abuse.ch a few years back. You know when you have pissed off the bad guys when they arrange for armed police to come calling..

Posted in | No comments

LinkedIn spam / teenlocal.net

Posted on 09:44 by Unknown

This fake LinkedIn spam leads to malware on teenlocal.net:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedInSent: 14 March 2013 16:32Subject: Frank and Len have endorsed you!Congratulations! Your connections Frank Garcia and Len Rosenthal have endorsed you for the following skills and expertise: Program Management

Posted in Amerika, LinkedIn, Malware, Spam, Viruses | No comments

"Efax Corporate" spam / gimiinfinfal.ru

Posted on 05:53 by Unknown

This eFax-themed spam leads to malware on gimiinfinfal.ru:

Date: Thu, 14 Mar 2013 07:39:23 +0300From: SarahPoncio@mail.comSubject: Efax CorporateAttachments: Efax_Corporate.htmFax Message [Caller-ID: 449555234]You have received a 44 pages fax at Thu, 14 Mar 2013 07:39:23 +0300, (751)-674-3105.* The reference number for this fax is [eFAX-263482326].View attached fax using

Posted in Linode, Malware, RU:8080, Spam, Viruses | No comments

Wednesday, 13 March 2013

"Copies of policies" spam / giimiiifo.ru

Posted on 13:01 by Unknown

This spam leads to malware on giimiiifo.ru:

Date: Wed, 13 Mar 2013 06:49:25 +0100From: LinkedIn Email Confirmation [emailconfirm@linkedin.com]Subject: RE: Alonso - Copies of Policies.Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.Here is the Package and Umbrella,and a copy of the most recent schedule.Alonso SAMS,

The malicious payload

Posted in Italy, Malware, RU:8080, Spam, Turkey, Viruses | No comments

"Wapiti Lease Corporation" spam / giminaaaao.ru

Posted on 08:15 by Unknown

A fairly bizarre spam leading to malware on giminaaaao.ru:

From: IESHA WILLEY [mailto:AtticusRambo@tui-infotec.com] Sent: 13 March 2013 11:22To: Sara SmithSubject: Fwd: Wapiti Land Corporation Guiding Principles attachedHello,Attached is a draft of the Guiding Principles that the Wapiti Lease Corporation (“W.L.C”) would like to publish. Prior to doing that, WLC would like you to have an

Posted in Malware, RU:8080, Spam, Turkey, Viruses | No comments

Zbot sites to block 13/3/13

Posted on 07:17 by Unknown

These domains and IPs seem to be active as Zbot C&C servers. The obsolete .su (Soviet Union) domain is usually a tell-tale sign of.. something.

76.185.101.239
77.74.197.190
89.202.183.27
89.253.234.247
201.236.78.182
218.249.154.140
aesssbacktrack.pl
beveragerefine.su
dinitrolkalor.com
dugsextremesda.su
establishingwi.su
eurasianpolicy.net
euroscientists.at
ewebbcst.info
fireinthesgae.pl

Posted in .SU, Malware, Zbot | No comments

Tuesday, 12 March 2013

"End of Aug. Stat. Required" spam / giminkfjol.ru

Posted on 07:23 by Unknown

This spam leads to malware on giminkfjol.ru:

From: user@victimdomain.comSent: 12 March 2013 04:19Subject: Re: End of Aug. Stat. RequiredGood morning, as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)Regards
The attachment Invoices-ATX993823.htm attempts to redirect the victim to [donotclick]giminkfjol.ru:8080/forum/links/column.php (report here) hosted on:

Posted in Germany, Hetzner, Italy, Malware, RU:8080, Spam, Turkey, Viruses | No comments

Monday, 11 March 2013

Wire Transfer spam / giminanvok.ru

Posted on 15:25 by Unknown

Another wire transfer spam, this time leading to malware on giminanvok.ru:

Date:     Mon, 11 Mar 2013 02:46:19 -0300 [01:46:19 EDT]
From:     LinkedIn Connections [connections@linkedin.com]
Subject:     Fwd: Wire Transfer (5600LJ65)

Dear Bank Account Operator,

WIRE TRANSFER: FED694760330367340
CURRENT STATUS: PENDING

Please REVIEW YOUR TRANSACTION as soon as possible.
The malicious

Posted in Endurance International Group, Germany, Hetzner, Malware, RU:8080, Spam, Turkey, Viruses | No comments

Wire Transfer spam / gimikalno.ru

Posted on 09:04 by Unknown

This fake wire transfer spam leads to malware on gimikalno.ru:

Date:     Mon, 11 Mar 2013 04:00:22 +0000 [00:00:22 EDT]
From:     Xanga [noreply@xanga.com]
Subject:     Re: Fwd: Wire Transfer Confirmation (FED REFERENCE 16442CU385)

Dear Bank Account Operator,
WIRE TRANSFER: FED62403611378975648
CURRENT STATUS: PENDING

Please REVIEW YOUR TRANSACTION as soon as possible.

The malicious

Posted in Endurance International Group, Germany, Hetzner, Malware, RU:8080, Spam, Turkey, Viruses | No comments

Sidharth Shah / OVH / itechline.com

Posted on 08:22 by Unknown

I have now come across several incidents of malware hosted in an OVH IP address range suballocated to Sidharth Shah. The blocks that I can identify so far are:

5.135.20.0/27
5.135.27.128/27
5.135.204.0/27
5.135.218.32/27
5.135.223.96/27
37.59.93.128/27
37.59.214.0/28
46.105.183.48/28
91.121.228.176/28
94.23.106.224/28
176.31.106.96/27
176.31.140.64/28
178.32.186.0/27
178.32.199.24/29

Posted in Evil Network, Malware, OVH, Sidharth Shah, Viruses | No comments

Something evil on 176.31.140.64/28

Posted on 07:01 by Unknown

176.31.140.64/28 is an OVH block suballocated to Sidharth Shah (mentioned in this earlier post). It contains a a small number of malicious domains flagged by Google (in red), most of the rest of the sites have a very poor WOT rating (in yellow). I'll post more details later. You can safely assume that everything in this block is malicious, and I note that some of the domains are refugees from

Posted in Evil Network, Malware, OVH, Sidharth Shah, Spam, Viruses | No comments

Something evil on 37.59.214.0/28

Posted on 06:48 by Unknown

37.59.214.0/28 is an OVH IP range suballocated to a person called Sidharth Shah in Maryland (more of whom later). At the moment it is hosting a number of malware sites with a hard-to-determine payload such as [donotclick]55voolith.info:89/forum/had.php which is evading automated analysis.

The owner of this block is as follows:
organisation: ORG-SS252-RIPEorg-name: Shah Sidharthorg-type

Posted in Evil Network, Malware, OVH, Sidharth Shah, Spam, Viruses | No comments

Friday, 8 March 2013

RU:8080 and Amerika spam runs

Posted on 12:30 by Unknown

For about the past year I have seen two very persistent spam runs leading to malware, typically themed along the lines of fake emails from the BBB, LinkedIn, NACHA, USPS and ADP.

The most obvious characteristic of one of the spam runs in the use of a malware landing page containing .ru:8080, registered through NAUNET to the infamous "private person". In order to aid researchers, I have

Posted in Amerika, Malware, RU:8080, Spam, Viruses | No comments

AT&T spam (again)

Posted on 08:27 by Unknown

This fake AT&T spam leads to malware on.. well, in this case nothing at all.

Date: Fri, 8 Mar 2013 10:37:24 -0500 [10:37:24 EST]From: AT&T Customer Care [icare7@amcustomercare.att-mail.com]Subject: Your AT&T wireless bill is ready to viewatt.com | Support | My AT&T Account Rethink PossibleYour wireless bill is ready to viewDear Customer,Your monthly wireless bill for your

Posted in Malware, Spam, Viruses | No comments

LinkedIn spam / giminalso.ru

Posted on 07:02 by Unknown

This fake LinkedIn spam leads to malware on giminalso.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn Password
Sent: 08 March 2013 10:24
Subject: Aylin is now part of your network. Keep connecting...

     [redacted], Congratulations!
You and Aylin are now connected.

    Aylin Welsh

--
Tajikistan

2012, LinkedIn

Posted in Germany, Hetzner, LinkedIn, Malware, RU:8080, Spam, Viruses | No comments

"Your tax return appeal is declined" / gimilako.ru

Posted on 06:44 by Unknown

This following fake IRS spam leads to malware on gimilako.ru:

From: Myspace [mailto:noreply@message.myspace.com]
Sent: 07 March 2013 20:55
Subject: Your tax return appeal is declined.

Dear Chief Account Officer,
Hereby you are notified that your Income Tax Refund Appeal id#9518045 has been REJECTED. If you believe the IRS did not properly estimate your case due to a misunderstanding of the

Posted in Hetzner, IRS, Malware, RU:8080, Spam, Viruses | No comments

Adobe CS4 spam / guuderia.ru

Posted on 01:55 by Unknown

This fake Adobe spam leads to malware on guuderia.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of Donnie Cherry via LinkedIn
Sent: 07 March 2013 12:39
Subject: Order N40898

Good afternoon,

You can download your Adobe CS4 License here -

We encourage you to explore its new and enhanced capabilities with these helpful tips, tutorials,

Posted in Hetzner, Malware, RU:8080, Spam, Viruses | No comments

Thursday, 7 March 2013

Malware sites to block 7/3/13

Posted on 08:12 by Unknown

Some Cridex-based nastiness here. These are the malicious domains that I can find on the IPs mentioned, alternatively you can just block:

173.246.102.2 (Gandi, US)
173.255.215.242 (Linode, US)
64.13.172.42 (Silicon Valley Colocation, US)

Blocklist:
173.246.102.2
173.255.215.242
64.13.172.42
17.247nycr.com
17.optimax-fuel-saver.us
17.grantmassie.org
17.seniorgazette.org
17.scottbarr.org
17.

Posted in Gandi, Linode, Malware, Viruses | No comments

BBB Spam / alteshotel.net and bbb-accredited.net

Posted on 05:40 by Unknown

This fake BBB spam leads to malware onalteshotel.net and bbb-accredited.net:

Date:     Thu, 7 Mar 2013 06:23:12 -0700
From:     "Better Business Bureau Warnings" [hurriese3@bbb.com]
Subject:     BBB details regarding your claim No.

Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
Better Business Bureau ©
Start With Trust ©

Thu, 6 March 2013

Posted in Amerika, BBB, Malware, Spam, TheFirst-RU, Viruses | No comments

Wednesday, 6 March 2013

Pizza spam / gimalayad.ru

Posted on 11:33 by Unknown

Cheese Lover's Pizza with no cheese?! Chicken pizza with three lots of extra ham?? This spam actually leads to malware on gimalayad.ru:

Date:     Wed, 6 Mar 2013 12:22:04 +0330
From:     Tagged [Tagged@taggedmail.com]
Subject:     Fwd: Order confirmation

You??™ve just ordered pizza from our site

Pizza Ultimate Cheese Lover's with extras:
- Bacon Pieces
- Ham
- Bacon Pieces
- Jalapenos
-

Posted in Hetzner, Malware, Pizza, RU:8080, Spam, Viruses | No comments

BT Business Direct Order Spam / ginagion.ru

Posted on 07:59 by Unknown

This fake BT spam leads to malware on ginagion.ru:

From: Bebo Service [mailto:service=noreply.bebo.com@bebo.com] On Behalf Of Bebo Service
Sent: 05 March 2013 21:22
Subject: BT Business Direct Order

Notice of delivery

Hi,

We're pleased to confirm that we have now accepted and despatched your order on Wed, 6 Mar 2013 03:21:30 +0600.

Unless you chose a next day or other premium delivery

Posted in Hetzner, Malware, RU:8080, Spam, Viruses | No comments

Tuesday, 5 March 2013

Sendspace spam / forumkianko.ru

Posted on 07:59 by Unknown

This fake Sendspace spam leads to malware on forumkianko.ru:

Date:     Tue, 5 Mar 2013 06:52:10 +0100
From:     AyanaLinney@[redacted]
Subject:     You have been sent a file (Filename: [redacted]-51153.pdf)

Sendspace File Delivery Notification:

You've got a file called [redacted]-01271.pdf, (797.4 KB) waiting to be downloaded at sendspace.(It was sent by DEON VANG).

You can use the

Posted in Hetzner, Malware, RU:8080, Spam, Viruses | No comments

"Scan from a Hewlett-Packard ScanJet" spam / giliaonso.ru

Posted on 06:38 by Unknown

This fake HP printer spam leads to malware on giliaonso.ru:

Date:     Tue, 5 Mar 2013 12:53:40 +0500
From:     "Classmates . com" [classmatesemail@accounts.classmates.com]
Subject:     Fwd: Re: Scan from a Hewlett-Packard ScanJet #161051
Attachments:     HP_Scan.htm

Attached document was scanned and sent

to you using a HP A-16292P.

SENT BY : Landon
PAGES : 6
FILETYPE: .HTML [INTERNET

Posted in Hetzner, Malware, RU:8080, Spam, Viruses | No comments

Something evil on 5.9.196.3 and 5.9.196.6

Posted on 06:21 by Unknown

Two IPs in the 5.9.196.0/28 block that you probably want to avoid are 5.9.196.3 and 5.9.196.6. The first of these IPs is being used in an injection attack (in this case via [donotclick]frasselt-kalorama.nl/relay.php) leading to two identified malware landing pages:

[donotclick]kisielius.surfwing.me/world/explode_conscious-scandal.jar (report here)
[donotclick]

Posted in Hetzner, Injection Attacks, Malware, Viruses | No comments

Monday, 4 March 2013

"British Airways E-ticket receipts" spam / forum-la.ru

Posted on 14:19 by Unknown

This fake British Airways spam leads to malware on forum-la.ru:

From:    LiveJournal.com [do-not-reply@livejournal.com]
Date:    4 March 2013 12:17
Subject:    British Airways E-ticket receipts

e-ticket receipt
Booking reference: 9AZ3049885
Dear,

Thank you for booking with British Airways.

Ticket Type: e-ticket
This is your e-ticket receipt. Your ticket is held in our systems, you will

Posted in Malware, RU:8080, Spam, Viruses | No comments

dealerbid.co.uk spam

Posted on 07:59 by Unknown

This spam uses an email address ONLY used to sign up for dealerbid.co.uk

From:    HM Revenue & Customs [enroll@hmrc.gov.uk]
Date:    4 March 2013 13:37
Subject:    HMRC Tax Refund ID: 3976244

Dear Taxpayer,

After the last annual calculations of your fiscal activity we have discovered that you are eligible to receive a tax refund of 377.50 GBP. Kindly complete the tax refund request and

Posted in Spam | No comments

eFax spam / forumla.ru

Posted on 07:32 by Unknown

This fake eFax spam leads to malware on forumla.ru:

Date:     Mon, 4 Mar 2013 08:53:20 +0300
From:     LinkedIn [welcome@linkedin.com]
Subject:     Efax Corporate
Attachments:     Efax_Corporate.htm

Fax Message [Caller-ID: 646370000]

You have received a 57 pages fax at Mon, 4 Mar 2013 08:53:20 +0300, (213)-406-0113.

* The reference number for this fax is [eFAX-336705661].

View

Posted in eFax, Malware, RU:8080, Spam, Viruses | No comments

Delta Airlines spam / inanimateweaknesses.net and complainpaywall.net

Posted on 07:26 by Unknown

This fake Delta Airlines spam leads to malware on inanimateweaknesses.net and complainpaywall.net:

From: DELTA CONFIRMATION [mailto:cggQozvOc@sutaffu.co.jp]
Sent: 04 March 2013 14:27
Subject: Your Receipt and Itinerary

Thank you for choosing Delta. We encourage you to review this information before your trip.
If you need to contact Delta or check on your flight information, go to delta.com/

Posted in Amerika, logol.ru, Malware, Russia, Spam, Viruses | No comments

Friday, 1 March 2013

Casino-themed Blackhole sites

Posted on 06:26 by Unknown

Here's a a couple of URLs that looks suspicious like a BlackHole Exploit kit, hosted on 130.185.105.74:

[donotclick]888casino-luckystar.net/discussing/sizes_agreed.php
[donotclick]555slotsportal.org/discussing/alternative_distance.php
[donotclick]555slotsportal.net/shrift.php
[donotclick]555slotsportal.net/discussing/alternative_distance.php
[donotclick]555slotsportal.me/discussing/

Posted in Malware, Viruses | No comments