Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
Bogus ‘Intuit Software Order Confirmations’ lead to BlackHole Exploit Kit
- http://blog.webroot....le-exploit-kit/
Nov 30, 2012 - "Sticking to their well proven practice of systematically rotating impersonated brands, the cybercriminals behind a huge majority of the malicious campaigns that we’ve been profiling recently are once again impersonating Intuit in an attempt to trick its customers into clicking on links exposing them to the client-side exploits served by the BlackHole Exploit Kit...
Sample screenshot from the spamvertised email:
> https://webrootblog....its_malware.png
Sample spamvertised URL re-director: hxxp ://www.mysnap .com.tw/sites/default/files/upload.htm?RANDOM_CHARACTERS
Client-side exploits serving URL: hxxp ://moneymakergrow .ru:8080/forum/links/column.php
Malicious domain name reconnaissance:
moneymakergrow .ru – 202.180.221.186, AS24496; 203.80.16.81, AS24514; 207.126.57.208
Name server: ns1.moneymakergrow .ru – 62.76.178.233
Name server: ns2.moneymakergrow .ru – 132.248.49.112
Name server: ns3.moneymakergrow .ru – 84.22.100.108
Name server: ns4.moneymakergrow .ru – 65.99.223.24
... Although we couldn’t reproduce the client-side exploitation, we’ve already seen the majority of these malicious domains in previously profiled campaigns..."
___
Bogus ‘End of August Invoices’ emails serve malware and client-side exploits
- http://blog.webroot....-side-exploits/
Nov 30, 2012 - "Cybercriminals have recently launched yet another massive spam campaign attempting to trick users into clicking on malicious links or executing malicious attachments found in the spamvertised emails...
Sample screenshot of the spamvertised email:
> https://webrootblog....re_exploits.png
Sample detection rate for the malicious attachment: MD5: 8b194d05c7e7f96a37b1840388231791 * ... Trojan:Win32/Ransom
Sample client-side exploits serving URL: hxxp ://forumibiza .ru:8080/forum/links/column.php
Although we couldn’t obtain the actual payload, the gathered intelligence indicates that this is a campaign launched by the same group that we’ve been monitoring for a few weeks now, allowing us to more effectively expose their campaigns and protect Internet users...
Malicious domain name reconnaissance:
forumibiza.ru – 65.99.223.24, AS30496; 103.6.238.9, AS21125; 203.80.16.81, AS24514
Name server: ns1.forumibiza .ru – 62.76.186.190
Name server: ns2.forumibiza .ru – 84.22.100.108
Name server: ns3.forumibiza .ru – 50.22.102.132
Name server: ns4.forumibiza .ru – 213.251.171.30
... malicious domains also respond to the same IPs (65.99.223.24; 103.6.238.9; 203.80.16.81). We’ve already seen these in several previously profiled malicious campaigns..."
(More detail at the webroot URL above.)
* https://www.virustot...sis/1353823689/
File name: Invoices.exe
Detection ratio: 39/44
Analysis date: 2012-11-25
___
(Here they come...) Santa SCAMS...
- http://community.web...amta-claus.aspx
Nov 30, 2012 - "... detected a marked increase in spam emails seeking to exploit fans of the big man himself: Santa Claus... They claim to offer alternative services to ensure that your "little ones" receive personalized responses from Santa. As is often the case in today’s unsolicited email world, the links within these emails don’t take you to a reputable and Santa-approved communication facilitator. Rather than being prompted for personal details about your little ones (which in itself poses an interesting discussion of internet safety and the sharing of personal details with random websites) you’ll probably find that you’re either a winner, or a potential winner, of some new fruit-branded hardware. All you have to do is complete a survey or an affiliate offer...
> http://community.web...7360.santa1.png
... subject lines to catch your attention and elicit a response:
- Personal Letter From Santa For Your Child
- (A) Letter From Santa For Your Child
- Santa Claus Letters
- A personal letter from Santa for your little ones
- Custom Santa Letters
> http://community.web...7848.santa2.png
Clicking the "Click Here" links within many of these messages directs you to an official-looking web-browser opinion survey, tailored to the browser from which you are viewing the page: Simple browser detection and IP geolocation techniques are used to appear convincing.
Unfortunately, other than the opinion survey, the only personalized item you’re likely to receive from this point on is more spam, scams, or empty offers. No amount of form-filling, survey submissions, or offer completions are likely to result in the desired letter from Santa Claus. Therefore, if you are looking to assist Santa with his letter-sending duties, please stick to reputable organizations. Many charities, for example, provide this service legitimately..."
___
"Copies of Policies" SPAM / podarunoki .ru
- http://blog.dynamoo....darunokiru.html
30 Nov 2012 - "This spam leads to malware on podarunoki .ru:
Date: Fri, 30 Nov 2012 04:54:30 -0300
From: Jone Castaneda via LinkedIn [member@linkedin.com]
Subject: RE: Leonie - Copies of Policies.
Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
Here is the Package and Umbrella,
and a copy of the most recent schedule.
Leonie Doyle,
==========
Date: Fri, 30 Nov 2012 02:32:21 -0400
From: sales1@[victimdomain].com
Subject: RE: Samson - Copies of Policies.
Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
Here is the Package and Umbrella,
and a copy of the most recent schedule.
Samson Henry,
The malicious payload is at [donotclick]podarunoki .ru:8080/forum/links/column.php hosted on some familiar IP addresses which should be blocked if you can:
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)..."
___
iTunes SPAM / mokingbirdgives .org
- http://blog.dynamoo....rdgivesorg.html
30 Nov 2012 - "This fake iTunes spam leads to malware on mokingbirdgives .org:
From: iTunes itunes @new .itunes .com
To: purchasing [purchasing @victimdomain .com]
Date: 30 November 2012 17:02
Subject: Your receipt #16201509085048
Billed To:
%email%
Order Number: M1V008146011
Receipt Date: 30/11/2012
Order Total: $699.99
Billed To: Credit card
Item Number Description Unit Price
1 Postcard (View\Download )
Cancel order Not your order?Report a Problem $699.99
Subtotal: $699.99
Tax: $0.00
Order Total: $699.99
Please retain for your records.
Please See Below For Terms And Conditions Pertaining To This Order.
Apple Inc.
You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes application and clicking on Terms of Sale or Sales Policies
FBI ANTI-PIRACY WARNING
UNAUTHORIZED COPYING IS PUNISHABLE UNDER FEDERAL LAW.
Answers to frequently asked questions regarding the iTunes Store can be found at http ://www.apple .com/support/itunes/store/
Apple ID Summary • Detailed invoice
Apple respects your privacy.
Copyright © 2011 Apple Inc. All rights reserved
The malicious payload is at [donotclick]mokingbirdgives .org/less/demands-probably.php (report here) hosted on 184.82.100.201 (HostNOC, US) along with the following domains which also appear to be malicious: ..."
(Long list at the dynamoo URL above..)
Edited by AplusWebMaster, 30 November 2012 - 07:43 PM.
