SPAM frauds, fakes, and other MALWARE deliveries...

FYI…

Multiple Facebook SCAMS …
- http://www.hoax-slayer.com/fb-profile-viewer-scam.shtml
April 30, 2013 - "Outline: Message being spammed across Facebook claims that users can follow a link to install an app that allows them to check who has been viewing their profile.
Brief Analysis: The message is an attempt to trick Facebook users into relinquishing control of their Facebook accounts to Internet scammers by submitting their Facebook authentication token. The scammers will use the compromised accounts to launch further spam and scam campaigns in the names of their victims. Any message that claims that you can install an app to see who has viewed your profile is likely to be a scam. Do not click on any links in these messages…
Detailed Analysis: This message, which is currently appearing on Facebook, claims that users can check out who has been viewing their Facebook profiles by clicking a link and installing a new app.
However, the message is a scam designed to trick users into temporarily handing control of their Facebook accounts to online scammers. Those who click the link will first be taken to a Facebook page with further "instructions" for procuring the app:
> http://www.hoax-slayer.com/images/fb-profi…ewer-scam-1.jpg
If victims follow the link on the page, they will next be taken to a second page that falsely claims that Facebook is now required to show users who has been viewing their profile:
> http://www.hoax-slayer.com/images/fb-profi…ewer-scam-2.jpg
Next, victims are taken to a "security check" and told that they must generate an "age verification code" before proceeding:
> http://www.hoax-slayer.com/images/fb-profi…ewer-scam-3.jpg
Users will then receive the following instructions:
> http://www.hoax-slayer.com/images/fb-profi…ewer-scam-4.jpg
Folllowed by this:
> http://www.hoax-slayer.com/images/fb-profi…ewer-scam-5.jpg
… by pasting the "age verification" code as instructed, users are in fact giving the scammers access to their Facebook accounts, including their Friends list. The code is the victim's Facebook authentication token, which can then be used by the criminals to temporarily hijack the Facebook account. The compromised accounts are then used to distribute more of the same scam messages on Facebook… victims will be taken onward to various bogus survey pages and enticed to participate, supposedly as a further prerequisite to getting the promised profile viewer app… In reality, the profile viewer app does not exist… Some versions use the promise of a profile viewer to lead victims directly to a scam survey page. Other versions try to trick users into first installing a rogue Facebook application that will send spam and scam messages to all of their friends.
Do not trust any message that claims that you can click a link and install an app to see who has viewed your profile. If you receive such a message, delete it."
___

UK banks targeted with Trojans and social engineering
- https://www.net-security.org/malware_news.php?id=2477
April 30, 2013 - "… Trusteer’s security team recently analyzed a Ramnit variant that is targeting a UK bank with a clever one-time password (OTP) scam. The malware stays idle until the user successfully logs into their account, at which time it presents them with one of the following messages:
> https://www.net-security.org/images/article…er-042013-1.jpg
- or:
> https://www.net-security.org/images/article…er-042013-2.jpg
While the user is reading the message, Ramnit connects to its command and control server and obtains the details of a designated mule account. This is followed by the initiation of a wire transfer to the money mule. But, there is still one more obstacle in the way of the malware – to complete the transaction a One Time Password (OTP) must be entered by the user. To overcome this requirement Ramnit displays the following message:
> https://www.net-security.org/images/article…er-042013-3.jpg
The temporary receiver number in the message is in fact the mule’s account number. The user then receives the SMS and thinking that he must complete the “OTP service generation”, enters their OTP. By entering the OTP, the user unknowingly enables the malware to complete the fraudulent transaction and finalize the payment to the mule account. This is yet another example of how well designed social engineering techniques help streamline the fraud process… the authors most likely used ‘find and replace’ to switch the two words that resulted in the grammatical mistake “a option.” Nevertheless, by changing multiple entries in the FAQ section Ramnit* demonstrates that its authors did not leave anything to chance – even if the victim decides to go the extra step, Ramnit is already there…"

* http://www.trusteer.com/blog/ramnit-evolut…nancial-malware
___

Malicious PDFs on the rise
- http://blog.trendmicro.com/trendlabs-secur…fs-on-the-rise/
Apr 29, 2013 - "… we continue to see CVE-2012-0158 in heavy use, we have noticed increasing use of an exploit for Adobe Reader (CVE-2013-0640)… files used dnsport.chatnook .com, inter.so-webmail .com, and 223.25.242.45 as their command-and-control servers… Our research indicates that attackers engaged in APT campaigns may have adapted the exploit made infamous by the MiniDuke campaign and have incorporated it into their arsenal. At the same time, we have found that other APT campaigns seem to have developed their own methods to exploit the same vulnerability. The increase in malicious PDF’s exploiting CVE-2013-0640 may indicate the start of shift in APT attacker behavior away from using malicious Word documents that exploit the now quite old CVE-2012-0158."
(More detail at the trendmicro URL above.)

- https://blogs.technet.com/b/mmpc/archive/20…Redirected=true
29 Apr 2013
Graph: https://www.microsoft.com/security/portal/b…_exploits/2.png
___

Phish target Apple IDs
- http://blog.trendmicro.com/trendlabs-secur…-phishing-bait/
Apr 30, 2013 - "Phishers appear to have concentrated their fire on a relatively new target: Apple IDs. In recent days, we’ve seen a spike in phishing sites that try to steal Apple IDs… Technically, the sites were only compromised, but not hacked (as the original content was not modified). It’s possible, however, that the sites may be hacked or defaced if the site stays compromised… the directory contains pages that spoof the Apple ID login page fairly closely:
> http://blog.trendmicro.com/trendlabs-secur…/fake_apple.jpg
We’ve identified a total of 110 compromised sites, all of hosted at the IP address [removed], which is registered to an ISP in the Houston area. Almost all of these sites have not been cleaned:
> http://blog.trendmicro.com/trendlabs-secur…13/04/chart.png
The graph above shows the increase in phishing sites targeting Apple IDs. We’ve seen attacks targeting not only American users, but also British and French users. Some versions of this attack ask not only for the user’s Apple ID login credentials, but also their billing address and other personal and credit card information. It will eventually result in a page that states that access has been restored, but of course the information has been stolen. One can see in the sample page below how it asks for credit card information:
> http://blog.trendmicro.com/trendlabs-secur…credit_card.jpg
Users may be redirected to these phishing sites via spam messages that state that the user’s account will expire unless their information is subject to an “audit”, which not only gets users to click on the link, it puts them in a mindset willing to give up information.
> http://blog.trendmicro.com/trendlabs-secur…/apple_mail.jpg
One way to identify these phishing sites, is that the fake sites do not display any indications that you are at a secure site (like the padlock and “Apple Inc. [US]” part of the toolbar), which you can see in this screenshot of the legitimate site:
> http://blog.trendmicro.com/trendlabs-secur…4/legitsite.jpg
The screenshot above is from Chrome, but Internet Explorer and Firefox both have similar ways to indicate secure sites. For the phishing messages themselves, legitimate messages should generally have matching domains all around – where they were sent from, where any links go to, etcetera. Mere appearance of the email isn’t enough to judge, as very legitimate-looking emails have been used maliciously. We also encourage users to enable the two-factor authentication that Apple ID recently introduced, for added protection…"
___

Something evil on 96.126.108.132
- http://blog.dynamoo.com/2013/04/something-…6126108132.html
30 April 2013 - "These sites are on (or are likely to be created on) 96.126.108.132 (Linode, US) which is a known malware server [1] [2] [3]. Blocking this IP would be wise. Some of the domains are rather.. unusual …"
(Long list at the dynamoo URL above.)
1) https://www.virustotal.com/en/ip-address/96…32/information/

2) https://palevotracker.abuse.ch/?ipaddress=96.126.108.132

3) http://support.clean-mx.de/clean-mx/viruse…=96.126.108.132
___

Fake "Requested Reset of Yoyr PayPal Password" SPAM / frustrationpostcards .biz
- http://blog.dynamoo.com/2013/04/requested-…l-password.html
29 Apr 2013 - "This fake PayPal spam leads to malware on frustrationpostcards .biz:
Date: Mon, 29 Apr 2013 13:22:03 -0500
From: "service @paypalmail .com" [chichisaq0 @emlreq.paypalmail .com]
Subject: Requested Reset of Yoyr PayPal Password
Your account will stay on hold untill password reset.
How to reset your PayPal password
Hello [redacted],
To get back into your PayPal account, you'll have to create a new password.
It's easy:
Click the link below to open a secure browser window.
Confirm that you're the owner of the account, and then follow the instructions.
Reset your password now
If you didn't requested help with your password, let us know immediately. Reporting it is important because it helps us prevent fraudsters from stealing your information.
Help Center | Security Center
Please don't reply to this email. It'll just confuse the computer that sent it and you won't get a response.
Copyright © 2013 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95132.
PayPal Email ID 2A7X1

The link goes through a legitimate but hacked site to land on a malicious payload at [donotclick]frustrationpostcards .biz/news/institutions-trusted.php (report here*) hosted on the following IPs:
82.236.38.147 (PROXAD Free SAS, France)
83.212.110.172 (Greek Research and Technology Network, Greece)
[removed] (Umea University, Sweden)…
Blocklist:
82.236.38.147
83.212.110.172
130.239.163.24 …"
* http://urlquery.net/report.php?id=2230181

Screenshot: https://www.net-security.org/images/article…ke-30042013.jpg
___

Fake Microsoft Security Scam
- http://blog.webroot.com/2013/04/30/fake-mi…-security-scam/
April 30, 2013 - "… we have seen an increase in fake Microsoft scams, which function by tricking people into thinking that their PC is infected. With these types of scams there are a number of things to remember.
1. Microsoft will never call you telling you that your PC is infected
2. Never allow strangers to connect to your PC
3. Do not give any credit card info to somebody claiming to be from Microsoft…
The current scam will display a webpage that is very similar to the one in Figure 1. There are a number of ways to figure out that this is a false alert. The first is that it’s a website message and not a program; the second is that the location of the web site will be a random string of letters.
1) https://webrootblog.files.wordpress.com/201…owser_alert.jpg
More details: These websites will normally only stay active for 24-48hrs before they are pulled down. The websites’ primary function is to get you to run a “removal tool” called “security cleaner”. This file is the infection and, if ran, will infect the PC and start displaying pop-ups (like the one in Figure 2).
2) https://webrootblog.files.wordpress.com/2013/04/fakeav.jpg
… Infection detected:
c:\users\owner\appdata\local\microsoft\windows\temporary internet files\content.ie5\wckxi56g\security_cleaner[1].exe

MD5: 68D9F9C6741CCF4ED9F77EE0275ACDA9 * … Virus Total… a number of infections that would have been prevented if Windows was up to date. Microsoft is constantly updating Windows to patch various security updates…"
* https://www.virustotal.com/en/file/006c4a55…b0a29/analysis/
File name: qdg.exe
Detection ratio: 28/46
Analysis date: 2013-04-27

Link: http://www.microsoft.com/security/online-privacy/msname.aspx
___

Fake Wire Transfer SPAM / Payment reeceipt.exe / 78.139.187.6
- http://blog.dynamoo.com/2013/04/your-wire-…2-canceled.html
30 Apr 2013 - "This fake wire transfer spam comes with a malicious attachment:
Date: Tue, 30 Apr 2013 15:27:44 -0500 [16:27:44 EDT]
From: Federal Reserve [alerts @federalreserve .gov]
Subject: Your Wire Transfer 82932922 canceled
The Wire transfer , recently sent from your bank account , was not processed by the FedWire.
Transfer details attached to the letter.
This service is provided to you by the Federal Reserve Board. Visit us on the web at website
To report this message as spam, offensive, or if you feel you have received this in error, please send e-mail to email address including the entire contents and subject of the message. It will be reviewed by staff and acted upon appropriately

In this case there is an attachment PAYMENT RECEIPT 30-04-2013-GBK-75.zip which contains a malicious executable crafted to look like a Word document called Payment reeceipt.exe . This executable has a so-so VirusTotal detection rate of 29/46*.
The malware has the following checksums according to Comodo CAMAS**:
Size 371712
MD5 0a3723483e06dcf7e51073972b9d1ef3
SHA1 293735a9fdc7e786b12c2ef92f544ffc53a0a0e7
SHA256 0eb5dd62e32bc6480bae638967320957419ba70330f0b9ad5759c2d3f25753dd
Anubis has a pretty detailed report*** of what this malware does. In particular, you might want to monitor network traffic to and from 78.139.187.6 (Caucasus Online, Georgia) which seems to be a C&C; server. This IP has also been seen here****. There are several other IPs involved, but these look like DSL subscribers with dynamic address, so probably a part of a botnet. For the sake of completeness they are:
64.231.249.250
69.183.226.70
78.139.187.6
81.133.189.232
123.237.234.67 …."
* https://www.virustotal.com/en/file/0eb5dd62…sis/1367354089/
File name: Payment reeceipt.exe
Detection ratio: 29/46
Analysis date: 2013-04-30
** http://camas.comodo.com/cgi-bin/submit?fil…759c2d3f25753dd
*** http://anubis.iseclab.org/?action=result&a;…amp;format=html

**** http://blog.dynamoo.com/2013/04/fiserv-sec…ation-spam.html

<_<

FYI…

Malicious ADP Delivery Notice Spam
- http://threattrack.tumblr.com/post/4952897…ery-notice-spam
3 May 2013 - "Subjects Seen:
ADP Chesapeake - Package Delivery Confirmation
Typical e-mail details:
This message is to notify you that your package has been processed and is on schedule for delivery from ADP.
Here are the details of your delivery:
Package Type: QTR/YE Reporting
Courier: UPS Ground
Estimated Time of Arrival: Monday, 1:00pm
Tracking Number (if one is available for this package): [removed]
Details: Click here to overview and/or modify order
We will notify you via email if the status of your delivery changes.
Access these and other valuable tools at support.ADP.com:
Payroll and Tax Calculators
Order Payroll Supplies, Blank Checks, and more
Submit requests online such as SUI Rate Changes, Schedule Changes, and more
Download Product Documentation, Manuals, and Forms
Download Software Patches and Updates
Access Knowledge Solutions / Frequently Asked Questions
Watch Animated Tours with Guided Input Instructions
Thank You,
ADP Client Services
support.ADP .com

Malicious URLs
technotkan .kz/templates/ja_purity_ii/adp_dpack.html
sub.mumbailocaltraintimetable .net/ensure/indeed-called_risk_omits.php
sub.mumbailocaltraintimetable .net/ensure/indeed-called_risk_omits.php?hyobrlhz=kniez&vvhxv=nle
sub.mumbailocaltraintimetable .net/ensure/indeed-called_risk_omits.php?df=1g:1i:2v:32:1f&ne=1g:2w:2w:1h:1g:1j:1l:1h:2v:30&h=1f&ug=q&tr=s&jopa=3366088

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…fPsL1qz4rgp.png
___

Something evil on 173.255.200.91
- http://blog.dynamoo.com/2013/05/something-…7325520091.html
3 May 2013 - "173.255.200.91 (Linode, US) is exhibiting the characteristics of the Neutrino Exploit kit* [see URLquery** and VirusTotal reports***). Attempts to analyse the malware seem to be generating 404 errors, but this could simply be a defensive mechanism by the malware on the server. I can see… domains on the server, ones flagged by Google for malware… I would recommend blocking all domains on this server… or simply block the IP address…"
* http://malware.dontneedcoffee.com/2013/03/…xploit-kit.html

** http://urlquery.net/search.php?q=173.255.2…5-03&max=50

*** https://www.virustotal.com/en/ip-address/17…91/information/
___

Malicious US Airways Spam
- http://threattrack.tumblr.com/post/4945779…us-airways-spam
2 May 2013 - "Subjects Seen:
US Airways online check-in.
Typical e-mail details:
You can check in from 24 hours and up to 60 minutes before your flight (2 hours if you’re flying internationally). After that, all you need to do is print your boarding pass and go to the gate.

Malicious URLs
concaribe .com/images/wp_pageid.html?id=516047FC45UOYFC8AVC60VIQ
yob.newwaysys .com/ensure/origin-want_require.php?jnlp=e3ca9e7968
yob.newwaysys .com/ensure/origin-want_require.php?bnddxr=nlbaicu&zvgibtad=tqu
yob.newwaysys .com/ensure/origin-want_require.php?qf=1i:1f:32:33:2v&ge=32:1i:30:2v:1o:32:1m:1o:1l:1n&i=1f&wl=j&rw=r&jopa=2959383

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…ilQn1qz4rgp.png
___

Malicious Citibank Paymentech Attachment Spam
- http://threattrack.tumblr.com/post/4944901…attachment-spam
2 May 2013 - "Subjects Seen:
Merchant Statement
Typical e-mail details:
" Attached is your Citibank Paymentech electronic Merchant Billing Statement. If you need help, please contact your Account Executive or call Merchant Services at the telephone number listed on your statement. PLEASE DO NOT RESPOND BY USING REPLY. This email is sent from an unmonitored email address, and your response will not be received by Citibank Paymentech. Citibank Paymentech will not be responsible for any liabilities that may result from or relate to any failure or delay caused by Citibank Paymentech’s or the Merchant’s email service or otherwise. Citibank Paymentech recommends that Merchants continue to monitor their statement information regularly. ————— Learn more about Citibank Paymentech Solutions, LLC payment processing services at citibank.com. ————— THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

Malicious URLs
Spam contains a malicious attachment.

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…SQsp1qz4rgp.png
___

Fake LinkedIn SPAM / guessworkcontentprotect .biz
- http://blog.dynamoo.com/2013/05/linkedin-s…protectbiz.html
2 May 2013 - "This fake LinkedIn email leads to malware on guessworkcontentprotect .biz:
From: LinkedIn Invitations [giuseppeah5 @mail.paypal .com]
Date: 2 May 2013 16:49
Subject: LinkedIn inviation notificaltion.
LinkedIn
This is a note that on May 2, Lewis Padilla sent you an invitation to join their professional network at LinkedIn.
Accept Lewis Padilla Invitation
On May 2, Lewis Padilla wrote:
> To: [redacted]
> I'd like to join you to my professional network on LinkedIn.
> Lewis Padilla
You are receiving Reminder emails for pending invitations. Unsubscribe.
© 2013 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

The malicious payload is at [donotclick]guessworkcontentprotect .biz/news/pattern-brother.php (report here*) hosted on:
82.236.38.147 (PROXAD Free SAS, France)
83.212.110.172 (Greek Research and Technology Network, Greece)
[removed] (Umea University, Sweden)
[removed] (Kementerian Pertanian, Indonesia)
Blocklist:
82.236.38.147
83.212.110.172
130.239.163.24
203.190.36.201 …"
* http://urlquery.net/report.php?id=2293535

<_<

FYI…

Fake Amazon.com SPAM / ehrap .net
- http://blog.dynamoo.com/2013/05/amazoncom-spam-ehrapnet.html
8 May 2013 - "This fake Amazon spam leads to malware on ehrap .net:
Date: Tue, 7 May 2013 22:54:26 +0100 [05/07/13 17:54:26 EDT]
From: "Amazon.com" [[removed]]
Subject: Your Amazon.com order confirmation.
Thanks for your order, [redacted]!
Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.
Order Information:
E-mail Address: [redacted]
Billing Address:
216 CROSSING CRK N
GAHANNA
United States
Phone: [removed]
Order Grand Total: $ 53.99
Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More
Order Summary:
Details:
Order #: I12-4392835-6098844
Subtotal of items: $ 53.99
Total before tax: $ 53.99
Tax Collected: $0.00
Grand Total: $ 50.00
Gift Certificates: $ 3.99
Total for this Order: $ 53.99
The following item is auto-delivered to your Kindle or other device. You can view more information about this order by clicking on the title on the Manage Your Kindle page at Amazon.com.
Mockingjay (The Final Book of The Hunger Games) [Kindle Edition] $ 53.99
Sold By: Random House Digital, Inc.
Give Kindle books to anyone with an e-mail address - no Kindle required!
You can review your orders in Your Account. If you've explored the links on that page but still have a question, please visit our online Help Department.
Please note: This e-mail was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.
Thanks again for shopping with us.
Amazon.com
Earth's Biggest Selection
Prefer not to receive HTML mail? Click here

The link in the email goes through a legitimate hacked site and ends up on [donotclick]ehrap .net/news/days_electric-sources.php (report here*) hosted on (or with nameservers on) the following IPs:
85.41.88.24 (Telecom Italia, Italy)
98.210.212.79 (Comcast, US)
140.121.140.92 (TANet, Taiwan)
[removed] (Trabia-Network, Moldova)
[removed] (The Noor Group, Egypt)
[removed] (Media Temple, US)
The domains involved indicate that this is the gang behind what I call the Amerika series of spam emails.
Blocklist:
85.41.88.24
98.210.212.79
140.121.140.92
178.175.140.185
197.246.3.196
216.70.110.21 …"
* http://urlquery.net/report.php?id=2377955
___

Fake AV and ransomware combo
- https://www.net-security.org/malware_news.php?id=2486
8 May 2013 - "Ransomware and fake antivirus solutions are well-known threats, but a deadly fraudulent combination of the two has been recently spotted… The software - dubbed "Secure Bit" - first tries to convince the victims that the "security level" of their computer is low and instructs them to call for support so that the “threats” it has "found" can be removed. The claim is accompanied with a pop-ups that lists a great number of them. But if the victims don't do as they are told after a period of time, the fake AV turns nasty (well, nastier), and locks the computer screen. The victims can't do anything on their machine, and they are again told to contact the given phone number in order to regain control of it. The phone call reveals that it will cost the victims $49.99 to do that, and Total Defense's Tsahi Carmona warns* that many users may not recognize it's a scam and may pay the ransom…"
* http://www.totaldefense.com/blogs/2013/05/…secure-bit.aspx
"… This anti-virus software pretender combines two methods of fraud – the fake anti-virus software and a malware that supposedly locks the screen in order to make the victim pay money to unlock. After the user installs this free “anti-virus” software it immediately notifies that the security level of the computer is low and which they need to call for support to address the found “threats”…"
___

Fake Amazon emails lead to malware…
- http://blog.webroot.com/2013/05/08/fake-am…ts-and-malware/
May 8, 2013 - "… Cybercriminals are currently mass mailing tens of thousands of fake Amazon “You Kindle E-Book Order” themed emails in an attempt to trick Kindle users into clicking on the malicious links found in these messages. Once they do so, they’ll be automatically exposed to the client-side exploits served by the Black Hole Exploit Kit, ultimately joining the botnet operated by the cybercriminal/cybercriminals that launched the campaign…
Sample screenshot of the spamvertised email:
> https://webrootblog.files.wordpress.com/201…w=650&h;=486
… MD5 for the Java exploit: MD5: c9bc87eef8db72f64bac0a72f82b04cf * … HEUR:Exploit.Java.CVE-2012-0507.gen
MD5 for the PDF exploit: MD5: 53c90140fde593713efe6298547ff205 ** …Exploit:Win32/CVE-2010-0188
Upon successful client-side exploitation, the campaign drops MD5: 330ad00466bd44a5fb2786f0f5e2d0da *** …Trojan.Win32.Reveton.a (v).
… phones back to:
[removed]
[removed]
[removed]
[removed]
91.121.30.185
89.110.148.213
81.17.22.14
88.119.156.20
161.53.184.3
94.23.6.95
88.191.130.98 /J9/vp/EGa+AAAAAA/2MB9vCAAAA …"
(More detail at the webroot URL above.)
* https://www.virustotal.com/en/file/68b33b48…sis/1367968246/
File name: days_electric-sources.php
Detection ratio: 5/46
Analysis date: 2013-05-07
** https://www.virustotal.com/en/file/ff129989…sis/1367968346/
File name: Kindle.pdf
Detection ratio: 26/46
Analysis date: 2013-05-07
*** https://www.virustotal.com/en/file/15087202…27274/analysis/
File name: sndrec32.exe
Detection ratio: 16/46
Analysis date: 2013-05-08
___

Malicious Better Business Bureau Spam
- http://threattrack.tumblr.com/post/4994720…ess-bureau-spam
8 May 2013 - "Subjects Seen:
Better Business Beareau Complaint ID [removed]
Typical e-mail details:
The Better Business Bureau has been entered the above mentioned complaint from one of your users in regard to their business contacts with you. The information about the consumer’s concern are available at the link below. Please give attention to this point and notify us about your belief as soon as possible.
We kindly ask you to open the RECLAMATION REPORT to answer on this claim.
We are looking forward to your prompt response.
WBR
Colton Reed
Dispute Advisor
Better Business Bureau

Malicious URLs
stopwulgaryzmom .pl/bbb_view_compl.html?complain=DFMI30GA2_80VJA8
pub.mumbailocaltraintimetable .net/ensure/misuse-restrict-systems_properties.php

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…fiSm1qz4rgp.png

<_<

FYI…

Fake ‘Free Media Player’ via rogue ‘Adobe Flash Player HD’ ad …
- http://blog.webroot.com/2013/05/15/fake-fr…-advertisement/
May 15, 2013 - "Our sensors just picked up a rogue advertisement served through the Yieldmanager ad network, which exposes users to fake Adobe Flash Player HD ads, ultimately dropping a copy of the potentially unwanted application (PUA)/adware, known as Somoto Better Installer…
Sample screenshot of the actual advertisement:
> https://webrootblog.files.wordpress.com/201…omoto.png?w=869
… once users click, they’re presented with a rogue Free Media Player page, instead of of a Adobe Flash Player HD themed page. Users who fall victim to the social engineering scam will end up installing multiple potentially unwanted applications… Landing domain:
hxxp ://www.softigloo .com – 78.138.105.151. Responding to the same IP is also the following typosquatted domain – hxxp ://down1oads .com…
Detection rate for the sampled malware:
MD5: 3ee49800cc3c2ce74fa63e6174c81dff * … Somoto BetterInstaller; Adware.Somoto
MD5: b57cc4b5aecd69eb57063f4de914d4dd ** … Somoto BetterInstaller; TROJ_GEN.F47V0429 …
And initiates the following TCP connections:
78.138.97.8 :80
54.239.158.55 :80
78.138.127.129 :80
54.239.158.183 :80
54.239.158.247 :80
78.138.127.7 :80
The affiliate network participant that’s abusing the Yieldmanager ad network is currently earning revenue through the Somoto’s BetterInstaller PPI (Pay-Per-Install) revenue sharing network…"
(More detail at the websense URL above.)
* https://www.virustotal.com/en/file/826b5b15…sis/1368314633/
File name: VLCMediaPlayerSetup-9Kf76Wv.exe
Detection ratio: 8/46
Analysis date: 2013-05-11
** https://www.virustotal.com/en/file/2e0d7b54…sis/1368314918/
File name: 7ZipSetup-aVEkw5Y.exe
Detection ratio: 8/46
Analysis date: 2013-05-11

Removal Guide for Somoto.BetterInstaller
> http://forums.spybot.info/showthread.php?6…BetterInstaller
2013-05-08
___

Malicious FedEx SPAM delivers trojan …
- http://www.hotforsecurity.com/blog/spam-po…kages-6173.html
May 15, 2013 - "A new wave of malicious FedEx spam delivers Trojans instead of packages, infecting users with malware when opening the attachments. In the last couple months, the Gamarue Trojan has spread intensely in the US, Australia, Croatia, Romania, Iran, the UK, Germany and Spain…
Screenshot1: http://www.hotforsecurity.com/wp-content/u…-packages-1.jpg
… To give credibility to the malicious payload, scammers added links to the authentic shipping company. Trojan.Gamarue silently installs itself on the system, sending sensitive information to the command and control center. The stolen data can then be used for identity theft and other cyber-criminal activities. Gamarue can also download and execute arbitrary files, performing updates without users noticing. The malicious software can also spread to removable drives, so users should be careful when managing important documents through USB devices…
Screenshot2: http://www.hotforsecurity.com/wp-content/u…-packages-2.png
FedEx is a common target for cyber-criminals, who only change the bait from time to time. Other excuses to ship malware include parcel delivery notifications. Scammers also request money in return for delivery of a package by posing as representatives of the shipping service. They also go so far as to create spoofed web sites to collect usernames, passwords, Social Security Numbers, credit card details and more…"
___

Fake Facebook SPAM / otophone .net
- http://blog.dynamoo.com/2013/05/facebook-s…tophonenet.html
15 May 2013 - "This fake Facebook spam leads to malware on otophone .net:
Date: Tue, 14 May 2013 15:29:24 -0500 [05/14/13 16:29:24 EDT]
From: Facebook [notification+LTFS15RDTR @facebookmail .com]
Subject: Jonathan Rogers wants to be friends on Facebook
facebook
Jonathan Rogers wants to be friends with you on Facebook Facebook…
1083 friends · 497 photos · 2 notes · 1535 Wall posts
Confirm Friend Request
See All Requests
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 417 P.O Box 10005 Palo Alto CA 96303

The link in the email goes through a legitimate hacked site and then ends up on a malware landing page at [donotclick]otophone .net/news/appreciate_trick_hanging.php (report here*) hosted on the following IPs:
36.224.16.74 (Chunghwa Telecom, Taiwan)
108.5.125.134 (Verizon, US)
198.61.147.58 (Matt Martin Real Estate Management / Rackspace, US)…
Blocklist:
36.224.16.74
108.5.125.134
198.61.147.58 …"
* http://urlquery.net/report.php?id=2474662
___

Something evil on 184.95.51.123
- http://blog.dynamoo.com/2013/05/something-…1849551123.html
15 May 2013 - "184.95.51.123 (Secured Servers LLC, US) appears to be trying to serve the Blackhole Exploit kit through an injection attack (for example). The payload appears to be 404ing when viewed in the automated tools I am using, but indications are that the malware on this site is still very much live. The domains on this server belong to a legitimate company, Lifestyle exterior Products, Inc. of Florida who are probably completely unaware of the issue.
These following domains are all flagged by Google as being malicious, and are all based on 184.95.51.123. I would recommend blocking the IP if you can…"
___

Malicious DocuSign Payroll Spam
- http://threattrack.tumblr.com/post/5049875…gn-payroll-spam
15 May 2013 - "Subjects Seen:
Completed: Please DocuSign this document : Payroll May 2013..pdf
Typical e-mail details:
Your document has been completed
Sent on behalf of [removed].
All parties have completed the envelope ‘Please DocuSign this document: Payroll April 2013..pdf’.
To view or print the document download the attachment .
(self-extracting archive, Adobe PDF)
This document contains information confidential and proprietary to [removed]

Malicious URLs
mail.yaklasim .com:8080/forum/viewtopic.php
116.122.158.195 :8080/forum/viewtopic.php
lifestylehomeowners .com/ponyb/gate.php
lifestylehurricaneguide .com/ponyb/gate.php
parpaiol a.com/0nWhFjZ.exe

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…rAIV1qz4rgp.png
___

Fake ADP SPAM / outlookexpres .net
- http://blog.dynamoo.com/2013/05/adp-spam-o…kexpresnet.html
15 May 2013 - "This fake ADP spam leads to malware on outlookexpres .net:
Date: Wed, 15 May 2013 22:39:26 +0400
From: "donotreply @adp .com" [phrasingr6 @news.adpmail .org]
Subject: adp_subj
ADP Instant Warning
Report #: 55233
Respected ADP Client May, 15 2013
Your Processed Transaction Report(s) have been uploaded to the website:
Sign In here
Please see the following information:
• Please note that your bank account will be charged within 1 business banking day for the sum shown on the Statement(s).
• Please don't try to reply to this message. automative notification system not configured to accept incoming email. Please Contact your ADP Benefits Expert.
This email was sent to existing users in your company that access ADP Netsecure.
As every time, thank you for using ADP as your business affiliate!
Rep: 55233 [redacted]

The link in the spam email goes through a legitimate but hacked site and ends up on a malware landing page at [donotclick]outlookexpres .net/news/estimate_promising.php (report here*) hosted on the same IPs found in this attack:
36.224.16.74 (Chunghwa Telecom, Taiwan)
108.5.125.134 (Verizon, US)
198.61.147.58 (Matt Martin Real Estate Management / Rackspace, US)
Blocklist:
36.224.16.74
108.5.125.134
198.61.147.58 …"
* http://urlquery.net/report.php?id=2479638
___

- http://tools.cisco.com/security/center/threatOutbreak.x?i=77
Fake Scanned Document Attachment E-mail Messages - 2013 May 15
Fake Product Order E-mail Messages - 2013 May 15
Fake Document Sharing Notification E-mail Messages - 2013 May 15
Fake Invoice Statement Attachment E-mail Messages - 2013 May 15
Malicious Attachment E-mail Messages - 2013 May 15
Fake Delta E-Ticket Attachment E-mail Messages - 2013 May 15
Fake Third Party Consumer Complaint Notification E-mail Messages - 2013 May 15
Fake Portuguese Invoice Notification E-mail Messages - 2013 May 15
Fake Photo Sharing E-mail Messages - 2013 May 15
Fake Product Order Request E-mail Messages - 2013 May 15
Fake Xerox Scan Attachment E-mail Messages - 2013 May 15
Malicious Attachment E-mail Messages - 2013 May 15
(More info and links at the cisco URL above.)

<_<

FYI…

Fake "Invoice Copy" SPAM / invoice copy.zip
- http://blog.dynamoo.com/2013/05/invoice-co…ce-copyzip.html
16 May 2013 - This fake invoice email contains a malicious attachment:
Date: Thu, 16 May 2013 00:27:41 -0500 [01:27:41 EDT]
From: Karen Parker [Kk.parker @tiffany .com]
Subject: invoice copy
Kindly open to see export License and payment invoice attached,meanwhile we sent the balance payment yesterday.Please confirm if it has settled in your account or you can call ifthere is any problem.ThanksKaren parker

The attachment is invoice copy.zip which in turn contains an executable invoice copy.exe which has an icon to make it look like a spreadsheet. VirusTotal results are a pretty poor 7/45* and indicate that this is a Zbot variant. The Comodo CAMAS report** indicates that the malware seems to be rummaging though address books and gives the following characteristics:
Size 331776
MD5 ebdcd7b8468f28932f235dc7e0cd8bcd
SHA1 a3d251b8f488ef1602e7016cb1f51ffe116d7917
SHA256 4b15971cf928a42d44afdf87a517d229e4aabbb5967cb9230a19592d2b939fe6
… The ThreatTrack report*** is nicely detailed and gives some details about network connections… As ever, blocking EXE-in-ZIP files at the perimeter is the best way to guard against this type of threat."
* https://www.virustotal.com/en/file/4b15971c…sis/1368687945/
File name: invoice copy.exe
Detection ratio: 7/45
Analysis date: 2013-05-16

** http://camas.comodo.com/cgi-bin/submit?fil…a19592d2b939fe6

*** http://www.dynamoo.com/files/analysis_3063…dc7e0cd8bcd.pdf
___

Fake HMRC SPAM / VAT Returns Repot 517794350.doc
- http://blog.dynamoo.com/2013/05/hmrc-spam-…7794350doc.html
16 May 2013 - "This fake HMRC (UK tax authority) spam contains a malicious attachment:
From: noreply @hmrc .gov.uk [mailto:noreply @hmrc .gov.uk]
Sent: 16 May 2013 10:48
Subject: Successful Receipt of Online Submission for Reference 517794350
Thank you for sending your VAT Return online. The submission for reference 517794350 was successfully received on 2013-05-16 T10:45:27 and is being processed. Make VAT Returns is just one of the many online services we offer that can save you time and paperwork.
For the latest information on your VAT Return please open attached report.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless; Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

The attachment is VAT Returns Repot 517794350.doc which contains an exploit which is currently being analysed. It is likely to use the same vulnerability as this attack*. VirusTotal results are just 1/46**, so either this is something completely new or it is a corrupt sample. UPDATE: ThreatTrack reports*** that the malware sample appears to make contact with the following IPs which are all dynamic IP addresses, indicating perhaps a P2P version of Zeus:
[removed]
[removed]
[removed]
92.241.139.165
122.179.128.38
189.223.139.172
190.42.161.35 …"
* http://blog.dynamoo.com/2013/05/bank-of-america-spam.html

** https://www.virustotal.com/en/file/c6bdbe23…sis/1368697862/
File name: VAT Returns Repot 517794350.doc
Detection ratio: 1/46
Analysis date: 2013-05-16

*** http://www.dynamoo.com/files/analysis_3063…b5b3a8c2a34.pdf
___

Fake Walmart SPAM / bestunallowable .com
- http://blog.dynamoo.com/2013/05/walmartcom…lowablecom.html
16 May 2013 - "This fake Walmart spam leads to malware on bestunallowable .com:
From: Wallmart.com [deviledm978 @news.wallmart .com]
Date: 16 May 2013 14:02
Subject: Thanks for your Walmart.com Order 3795695-976140
Walmart
Visit Walmartcom | Help | My Account | Track My Orders
[redacted]
Thanks for ordering from Walmart.com. We're currently processing your order.
Items in your order selected for shipping
• You'll receive another email, with tracking information, when your order ships.
• If you're paying by credit card or Bill Me Later®, your account will not be charged until your order ships. If you see a pending charge on your account prior to your items shipping, this is an authorization hold to ensure the funds are available. All other forms of payment are charged at the time the order is placed.
Shipping Information
Ship to Home
Hannah Johnson
1961 12 Rd
Orange, NC 68025-3157
USA
—
Walmart.com Order Number: 3795695-976140
Ship to Home - Standard
Items Qty Arrival Date Price
Philips UN65EH9060 50" 1080p 60Hz Class LED (Internet Connected) 3D HDTV 1 Arrives by Tue., May 21
Eligible for Free Standard Shipping to Home. $898.00
Subtotal: $898.00
Shipping: Free
Tax: $62.86
See our Returns Policy or
contact Customer Service Walmart.com Total: $960.86
Order Summary
Order Date: 05/15/2013
Subtotal: $898.00
Shipping: Free
Tax: $62.86
Order Total: $960.86
Credit card: $960.86
Billing Information
Payment Method:
Credit card
If you have any questions, please refer to help.walmart.com or reply to this email and let us know how we can help.
Thanks,
Your Walmart.com Customer Service Team…
Rollbacks Sign Up for Email Savings and Updates
Have the latest Rollbacks, hot new releases, great gift ideas and more sent right to your inbox!
©Walmart.com USA, LLC, All Rights Reserved.

The link goes through a legitimate hacked site and ends up on a malware page at [donotclick]bestunallowable .com/news/ask-index.php (report here*) hosted on:
108.5.125.134 (Verizon, US)
198.61.147.58 (Matt Martin Real Estate Management / Rackspace, US)
The WHOIS details are characterstic of the Amerika gang…
Blocklist (including nameservers):
71.107.107.11
108.5.125.134
198.50.169.2
198.61.147.58
bestunallowable.com …"
* http://urlquery.net/report.php?id=2494957
___

More Walmart SPAM / virgin-altantic .net
- http://blog.dynamoo.com/2013/05/walmartcom…ltanticnet.html
16 May 2013 - "Another -variant- of this spam* is doing the rounds, this time leading to a landing page on virgin-altantic .net:
From: Wallmart.com [mailto:sculptsu @complains .wallmartmail .com]
Sent: 16 May 2013 15:35
Subject: Thanks for your Walmart.com Order 3450995-348882 …
—
Subtotal: $898.00
Shipping: Free
Tax: $62.86
See our Returns Policy or
contact Customer Service
Walmart.com Total: $960.86
Order Summary
Order Date: 05/15/2013
Subtotal: $898.00
Shipping: Free
Tax: $62.86
Order Total: $960.86
Credit card: $960.86
Billing Information
Payment Method:
Credit card
If you have any questions, please refer to help.walmart.com or reply to this email and let us know how we can help.
Thanks,
Your Walmart.com Customer Service Team…

The malicious payload is at [donotclick]virgin-altantic .net/news/ask-index.php (report here**). IP addresses are the same as in the other attack, although obviously if you are blocking by domain you should add virgin-altantic .net too."
* http://blog.dynamoo.com/2013/05/walmartcom…lowablecom.html

** http://urlquery.net/report.php?id=2496275
___

Fake Wells Fargo and Citi SPAM / SecureMessage.zip and Securedoc.zip
- http://blog.dynamoo.com/2013/05/wells-farg…-citi-spam.html
16 May 2013 - "This fake Wells Fargo message contains a malicious attachment:
Date: Thu, 16 May 2013 23:24:38 +0800 [11:24:38 EDT]
From: "Grover_Covington @wellsfargo .com" [Grover_Covington @wellsfargo .com]
Subject: New Secure Message
Wells Fargo
Help
To Read This Message:
Look for and open SecureMessage.zip (typically at the top or bottom; location varies by email service).
Secure Message
This message was sent to : [redacted]
Email Security Powered by Voltage IBE
Copyright 2013 Wells Fargo. All rights reserved

The attachment SecureMessage.zip contains a file SecureMessage.exe which has a SHA256 of 289bd82b66ed0c66f0e6a947cb61c928275c1053fa5d2b1119828217f61365ba and is only detected by 2/45 scanning engines at VirusTotal**.
The second version is a fake Citi spam with an attachment Securedoc.zip which contains Securedoc.exe. This is the same executable with the same SHA256, just a different name.
Date: Thu, 16 May 2013 10:16:27 -0500 [11:16:27 EDT]
From: "secure.email @citi .com" [secure.email @citi .com]
Subject: You have received a secure message
You have received a secure message
Read your secure message by opening the attachment, securedoc.html You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it with Internet Explorer.
If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the Citi Secure Email Help Desk at [removed].
First time users - will need to register after opening the attachment.
About Email Encryption - http ://www.citi .com/citi/citizen/privacy/email.htm

… the best analysis is this ThreatTrack report*… some IPs and domains worth blocking:
69.89.21.99
116.122.158.195
212.58.4.13
mail.yaklasim .com
ryulawgroup .com "
* http://www.dynamoo.com/files/analysis_3064…0cddcbdc604.pdf

** https://www.virustotal.com/en/file/289bd82b…sis/1368718128/
File name: SecureMessage.exe
Detection ratio: 2/45
Analysis date: 2013-05-16
___

Get Free Followers! on Instagram? Get Free Malware, Survey Scams Instead
- http://blog.trendmicro.com/trendlabs-secur…-scams-instead/
May 16, 2013 - "The popular photosharing app Instagram is the latest social networking site targeted by the ubiquitous survey scams seen on Facebook and Twitter. This time, we found that these survey scams may also lead users to download an Android malware… these Instagram followers have repetitive account names like “Tawna Tawna” and “Concetta Concetta”… Given these suspicious signs, I then checked this “Get Free Followers” picture (which is actually clickable) and was led to this page that supposedly offers the “Get Followers” app. This app is detected by Trend Micro as ANDROIDOS_GCMBOT.A, which can be used to launch malicious webpages or send SMS from the device.
> http://blog.trendmicro.com/trendlabs-secur…rvey-scam-4.jpg
Whether users download the said app or not (in my case, I tried to), in the end they are redirected to your run-of-the-mill survey scams. Since Instagram can also be accessed via a PC, we tried to access the malicious website and survey scam using a desktop. Fortunately, this ruse didn’t work. Cybercriminals profit from these survey scams via ad-tracking sites, which users are redirected to before the actual survey page. Plus, these bad guys can also use the data gathered from these scams by either peddling them to other cybercriminal groups or using them in their future schemes. Facebook, Pinterest, Tumblr, and now Instagram. The people behind these scams are jumping on every popular networking sites and potential engineering hooks like the Google Glass contest. To protect yourself against this scam, you must always double-check posts on your social media accounts, even if they come from friends, family members, or known acquaintance. Caution is your best defense…"

<_<

FYI…

e-netprotections.su ?
- https://isc.sans.edu/diary.html?storyid=15818
Last Updated: 2013-05-17 - "Like with .biz, I sometimes have the impression that .su and .cc could be sinkholed in their entirety, because the bad domains seem to vastly outnumber whatever (if any) good is running under these TLDs as well. Earlier today, ISC reader Michael contacted us with information that several PCs on his network had started to communicate with iestats .cc, emstats .su, ehistats .su, e-protections .su and a couple other domains. I was pretty sure that I had seen the latter domain on an earlier occasion in a malware outbreak, but I couldn't find it in our records .. until I only searched for "e-protections", and found e-protections .cc. This domain had been implicated back in October 2012 in a malware spree that was linked to the nasty W32.Caphaw, a backdoor/information stealer… each infected box was apparently running a slightly different version of the EXE. Anti-Virus coverage is still thin (Virustotal*) , but the Heuristics of some products seem to be catching on. This sample looks more like a ransomware trojan than Caphaw, but we'll know more once we analyze all the information gathered so far…"
Partial list of IPs involved:
64.85.161.67
85.25.132.55
173.224.210.244
178.63.172.88
188.95.48.152
199.68.199.178
91.227.220.104
* https://www.virustotal.com/en/file/b19818bb…b9041/analysis/
File name: dwdsrtrt
Detection ratio: 4/46
Analysis date: 2013-05-16

- https://www.abuse.ch/?p=3581
___

Malicious Wells Fargo Secure Message Spam
- http://threattrack.tumblr.com/post/5059766…re-message-spam
16 May 2013 - "Subjects Seen:
New Secure Message
Typical e-mail details:
View attachment for details
To Read This Message:
Look for and open SecureMessage.zip (typically at the top or bottom; location varies by email service).

Malicious URLs
mail.yaklasim .com:8080/forum/viewtopic.php
116.122.158.195 :8080/forum/viewtopic.php
mylifestylestormproducts .com/forum/viewtopic.php
mysafefloridahomelife .com/forum/viewtopic.php
ryulawgroup .com/Gsdw1.exe

Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…4bl91qz4rgp.png
___

Malicious "Referral link" SPAM / rockingworldds .net and parishiltonnaked2013 .net
- http://blog.dynamoo.com/2013/05/referral-l…worlddsnet.html
17 May 2013 - "This spam comes from a hacked AOL email account and leads to malware on 62.76.190.11:
From: [AOL sender]
Sent: 17 May 2013 14:12
To: [redacted]
Subject: [AOL screen name]
Subject :RE ( 8 )
Sent: 5/17/2013 2:11:53 PM
referral link
http ://printcopy.co .za/elemqi.php?whvbcfm

The link goes through a legitimate -hacked- site and in this case ends up at [donotclick]rockingworldds .net/sword/in.cgi?6 (report here*) which either -redirects- to a weight loss spam site or alternatively a malware landing page at [donotclick]parishiltonnaked2013 .net/ngen/controlling/coupon_voucher.php (report here**) which appears to load the BlackHole Exploit Kit. Both these sites are hosted on 62.76.190.11 (Clodo-Cloud / IT House, Russia)… I have several IPs blocked in the 62.76.184.0/21 range, you may want to consider blocking the entire lot if you don't have any reason to send web traffic to Russia."
* http://urlquery.net/report.php?id=2512341

** http://urlquery.net/report.php?id=2512431
___

Fake Newegg .com SPAM / balckanweb .com
- http://blog.dynamoo.com/2013/05/neweggcom-…ckanwebcom.html
17 May 2013 - "This fake Newegg.com spam leads to malware:
Date: Fri, 17 May 2013 10:29:20 -0600 [12:29:20 EDT]
From: Newegg [info @newegg .com]
Subject: Newegg.com - Payment Charged
Priority: High Priority 1
Newegg logo
My Account My Account | Customer Services Customer Services
Twitter Twitter You Tube You Tube Facebook Facebook Myspace Myspace
click to browse e-Blast click to browse Shell Shocker click to browse Daily Deals
Computer Hardware PCs & Laptops Electronics Home Theater Cameras Software Gaming Cell Phones Home & Office MarketPlace Outlet More
Customer ID: [redacted]
Account Number: 23711731
Dear Customer,
Thank you for shopping at Newegg.com.
We are happy to inform you that your order (Sales Order Number: 97850177) has been successfully charged to your AMEX and order verification is now complete.
If you have any questions, please use our LiveChat function or visit our Contact Us Page.
Once You Know, You Newegg.
Your Newegg.com Customer Service Team
ONCE YOU KNOW, YOU NEWEGG. Ž
Policy and Agreement | Privacy Policy | Confidentiality Notice
Newegg.com, 9997 Rose Hills Road, Whittier, CA. 90601-1701 | Š 2000-2013 Newegg Inc. All rights reserved.

Screenshot: https://lh3.ggpht.com/-Si0jHOHqviw/UZZqyHxG…1600/newegg.png

In the version I have the link doesn't work, but I believe that it goes to [donotclick]balckanweb .com/news/unpleasant-near_finally-events.php (report here*) hosted or having nameservers on the following IPs:
5.231.24.162 (GHOSTnet, Germany)
71.107.107.11 (Verizon, US)
108.5.125.134 (Verizon, US)
198.50.169.2 (OVH, Canada)
198.61.147.58 (Matt Martin Real Estate Management / Rackspace, US)
209.59.223.119 (Endurance International Group, US)
The domains and IPs indicate that this is part of the "Amerika" spam run.
Blocklist (including nameservers):
5.231.24.162
71.107.107.11
108.5.125.134
198.50.169.2
198.61.147.58
209.59.223.119 …"
* http://urlquery.net/report.php?id=2504632

Also at: http://threattrack.tumblr.com/post/5067140…wegg-order-spam
May 17, 2013
Screenshot: https://gs1.wac.edgecastcdn.net/8019B6/data…Awpg1qz4rgp.png
___

- http://tools.cisco.com/security/center/threatOutbreak.x?i=77
Fake Product Order Quotation Attachment E-mail Messages - 2013 May 17
Fake Product Order E-mail Messages - 2013 May 17
Fake Purchase Order E-mail Messages - 2013 May 17
Fake Account Compromise Notification E-mail Messages - 2013 May 17
Fake Scanned Document Attachment E-mail Messages - 2013 May 17
Fake Social Media User Notification E-mail Messages - 2013 May 17
Fake Facebook Security Software E-mail Messages - 2013 May 17
Fake Incoming Fax Message E-mail Messages - 2013 May 17
Fake Document Sharing E-mail Messages - 2013 May 17
Fake Italian Shared Document E-mail Messages - 2013 May 17
Fake Invoice Statement Attachment E-mail Messages - 2013 May 17
Fake Money Transfer Notification E-mail Messages - 2013 May 17
Fake Xerox Scan Attachment E-mail Messages - 2013 May 17
(More detail and links at the cisco URL above.)