AplusWebMaster
FYI…
Fake pharmacy SPAM / accooma .org / classic-pharmacy .com
- http://blog.dynamoo.com/2013/04/updated-in…accoomaorg.html
6 April 2013 - "This scary looking spam is nothing more than an attempt to get you to click through to a fake pharmacy site:
Date: Mon, 9 Feb 2004 13:00:35 +0000 (GMT)
From: "Account Info Change" [info @virtualregistrar .com]
Subject: Updated information
Updated information
Hello,
The following information for your ID [redacted] was updated on 02/09/2012: Date of birth, Security question and answer.
If these changes were made in error, or if you believe an unauthorized person accessed your account, please reset your account password immediately.
This is an automated message. Please do not reply to this email. If you need additional help, visit our Support Center.
Thanks,
Customer Support
The link in the email goes to a landing page on accooma .org (184.82.155.18 - HostNOC, US) which clicks through to classic-pharmacy .com (184.82.155.20 - also HostNOC). These two IPs are very close together which indicates a bad block. There does not appear to be any malware involved (see here* and here**) and of course nobody has changed any details on your account. You can safely ignore these emails. A closer examination shows that HostNOC have suballocated 184.82.155.16/29 (184.82.155.16 - 184.82.155.23) to an unknown party… fake pharma sites are active in this range…"
(Long list at the dynamoo URL above.)
* http://urlquery.net/report.php?id=1850413
** http://urlquery.net/report.php?id=1850445
- https://www.google.com/safebrowsing/diagnostic?site=AS:21788
"… over the past 90 days, 1069 site(s)… served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2013-04-06, and the last time suspicious content was found was on 2013-04-06… we found 227 site(s) on this network… that appeared to function as intermediaries for the infection of 981 other site(s)… We found 384 site(s)… that infected 1772 other site(s)…"
___
Fake Facebook pwd reset SPAM / accooma .org
- http://blog.dynamoo.com/2013/04/facebook-r…r-password.html
6 April 2013 - "Another very aggressive spam run promoting accooma .org which is a fake pharma site..
Date: Sat, 6 Apr 2013 13:16:59 -0700 [16:16:59 EDT]
From: Facebook
Subject: Reminder: Reset your password
facebook
You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to reset your password 2 ago.
This is a reminder that you need to complete this action by clicking this link and Confirm or Cancel your request.
If you have any other questions, please visit our Help Center.
Thanks,
The Facebook Team
The emails vary somewhat in content. I've received 60+ of these today to one email account alone, so this site is being pushed very hard indeed. Although the email is annoying, it does not seem to be harmful. For more details, see this earlier post* about another spam run for the same domain."
* http://blog.dynamoo.com/2013/04/updated-in…accoomaorg.html
<_<
Fake pharmacy SPAM / accooma .org / classic-pharmacy .com
- http://blog.dynamoo.com/2013/04/updated-in…accoomaorg.html
6 April 2013 - "This scary looking spam is nothing more than an attempt to get you to click through to a fake pharmacy site:
Date: Mon, 9 Feb 2004 13:00:35 +0000 (GMT)
From: "Account Info Change" [info @virtualregistrar .com]
Subject: Updated information
Updated information
Hello,
The following information for your ID [redacted] was updated on 02/09/2012: Date of birth, Security question and answer.
If these changes were made in error, or if you believe an unauthorized person accessed your account, please reset your account password immediately.
This is an automated message. Please do not reply to this email. If you need additional help, visit our Support Center.
Thanks,
Customer Support
The link in the email goes to a landing page on accooma .org (184.82.155.18 - HostNOC, US) which clicks through to classic-pharmacy .com (184.82.155.20 - also HostNOC). These two IPs are very close together which indicates a bad block. There does not appear to be any malware involved (see here* and here**) and of course nobody has changed any details on your account. You can safely ignore these emails. A closer examination shows that HostNOC have suballocated 184.82.155.16/29 (184.82.155.16 - 184.82.155.23) to an unknown party… fake pharma sites are active in this range…"
(Long list at the dynamoo URL above.)
* http://urlquery.net/report.php?id=1850413
** http://urlquery.net/report.php?id=1850445
- https://www.google.com/safebrowsing/diagnostic?site=AS:21788
"… over the past 90 days, 1069 site(s)… served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2013-04-06, and the last time suspicious content was found was on 2013-04-06… we found 227 site(s) on this network… that appeared to function as intermediaries for the infection of 981 other site(s)… We found 384 site(s)… that infected 1772 other site(s)…"
___
Fake Facebook pwd reset SPAM / accooma .org
- http://blog.dynamoo.com/2013/04/facebook-r…r-password.html
6 April 2013 - "Another very aggressive spam run promoting accooma .org which is a fake pharma site..
Date: Sat, 6 Apr 2013 13:16:59 -0700 [16:16:59 EDT]
From: Facebook
Subject: Reminder: Reset your password
You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to reset your password 2 ago.
This is a reminder that you need to complete this action by clicking this link and Confirm or Cancel your request.
If you have any other questions, please visit our Help Center.
Thanks,
The Facebook Team
The emails vary somewhat in content. I've received 60+ of these today to one email account alone, so this site is being pushed very hard indeed. Although the email is annoying, it does not seem to be harmful. For more details, see this earlier post* about another spam run for the same domain."
* http://blog.dynamoo.com/2013/04/updated-in…accoomaorg.html
<_<
