Whois Spammers!

Some of our Domain Users are getting spammed and  requesting that they purchase unwanted domain names. The email is being sent by the adddomainnames.com entity.

“This is a classic Whois Spammer. They monitor new domain name registrations using zone files. They do bulk whois checks to obtain email addresses listed in whois and send bulk emails to these people who just purchased domains. This is the very same process that is used for “domain appraisal scams”.

Warning! Do not click the Unsubscribe link in the email, because it will actually sign you up! Simply do not click any link in the email.

You can report spam to the FTC here but it is a long process to fill out the forms… you can also forward the spam email to spam@uce.gov.

• Spammer Domain:adddomainnames.com
• Spammer IP: 206.214.216.7

<—————-Beginning of Spam—————->
Domain Names – January 8, 2011
From:    DomainNames <domainnames@inline.me>
To:    wemaster1@abc1.com

T continue getting these domains
hxxp://adddomainnames.com/add.php?di=524633&hash=68ab65b5be98aa7915d45f6dadd2c930

If you see any domains you like please reply back “SOLD” along with the domain names you want. The domains will be awarded to the first person who replies SOLD.

We will not bend this rule for anyone so please get your replies in asap.  There are some very nice high quality domains today at very low prices!

Our low prices make it easy to profit from the domain industry.  You could resell some of these domains for thousands of dollars!  Or you can develop sites on them and make nice monthly residual income.

Reminder, the prices listed below are the prices you pay for the domain. This is not an auction.  I know it’s hard to believe but these are truly BUY IT NOW prices for these awesome domains.

TelevisionWithDvdPlayer.com $79.00 (exact product domain)
SymptomsOfHepatitisB.com $79.00 (You don’t want the hep)
PrinterStickerPaper.com $69.00 (It’s fun to print stickers)
HowToTreatDiaperRash.com $69.00 (Every baby gets these)
70sCds.com $99.00 (short and sweet)
HomeEquityLineBadCredit.com $79.00 (High CPC)
ComputerGamesForPc.com $99.00 (great domain)
ToddlerBedsForBoys.com $69.00 (Nice exact product domain)
1000PokerChipSet.com $89.00 (Great product domain, popular product)
AdjustableBallMount.com $59.00 (nice product domain)
100BlankCds.com $59.00 (specific domain)
MetalWorkTable.com $59.00 (there’s one in my garage)
PinkPocketKnife.com $79.00 (Every country girl needs one of these)
OakKitchenIsland.com $69.00 (Nice product domain)
HowToStraightenCurlyHair.com $59.00 (nice how to domain)
AdverseCreditSecuredLoan.com $69.00 (High CPC)

ProfessionalHairbrushes.com $69.00 (nice domain)
TummyTuckInformation.com $79.00 (Nothing wrong with a little nip and tuck)
26InchTvs.com $79.00 (I have one of these)
NursingSchoolsInPA.com $69.00 (High CPC)
HairStylingAccessories.com $69.00 (my wife has tons of these)

10765 Reading Road – Cincinnati, Ohio
To Unsubscribe:
hxxp://adddomainnames.com/adn_unsub.php?did=524633&hash=68ab65b5be98aa7915d45f6dadd2c930&msgid=7&l=2

<—————-end of Spam—————->

Host names sharing IP with A records: 206.214.216.7

• centos.nonsbsites.com
• nonsbsites.com
• ns1.nonsbsites.com
• shipmentoffail.com
• sorcier.pe

Reference: Robtex

Fishy News Lead to Malware

It appears that the Cyber Criminals are starting 2011 with a bang. The Cyber Criminals are using the latest Google Trends and News to distribute malware.

Our users are searching for the latest “Dead Fish and Bird” news. The users report some fishy links that lead to malware.

Google News Search:
Video: Apocalyptic Signs Abound in Two States with Dead Fish and Birds. *Yesterday we reported on the dead blackbirds in Arkansas and now that strange …

Authorities in Maryland are investigating the deaths of about 2 million fish!
Another Unusual incident occurred in Arkansas on New Year’s Eve. Thousands of red-winged blackbirds and starlings were found dead over a square-mile area in the town of Beebe.

Malware Link:
hxxp://64.78.41.150/headlines/redirect.cfm?ID=19005
Malware Found:

• Trojan-Downloader.Win32.Agent.brk
• Fake Anti-Virus

Malware Names:

• blackwebportal.com
• kemnet.com
• thebwp.com
• www.blackwebportal.com

Blacklisted by Mcafee Site Advisor

Malware Files Created:

• C:\Documents and Settings\Administrator\Cookies\administrator@www.eurweb[1].txt
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\ga[1].js
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\eurweb[1].htm

DNS Traffic:

• www.eurweb.com
• 69.64.68.201
• script.opentracker.net
• 50.16.222.69
• www.google-analytics.com
• 74.125.224.0
• 74.125.224.1
• 74.125.224.15

HTTP Traffic:

• Request: [ GET /headlines/redirect.cfm?ID=19005 ]
• Request: GET /wp-content/plugins/sociable/sociable.css?ver=3.0.4
• Response: 200 “OK”
• Request: GET /wp-content/plugins/snazzy-archives/snazzy-archives.css
• Response: 200 “OK”

Infected Ecard Spam

Some joker sent us a Saggy Dancing Granny Ecard with a nice infection. Nice Try. The Spam includes a link to downloads the Fake Anti-Virus and Fake Alert Infections.

Spam Sample:

—————————–<>——————————

You have been sent an ecard – Saggy Dancing Granny
…
From:
HumorEcard <humorecard@inline.me>

To:    joesix@yahoo.com
You have been sent an Ecard

To receive the card you were sent and receive future cards
Saggy Dancing Granny
hxxp://2taf.com/r.php?id=2586516&n=0&url=http://humorecard.com/56/humor/61/saggy-granny.html&hash=5ffa70fb3325aa2556e0ec1c396aee11

To just receive the card you were sent
Saggy Dancing Granny
hxxp://2taf.com/dr.php?id=2586516&n=0&url=http://humorecard.com/56/humor/61/saggy-granny.html&hash=5ffa70fb3325aa2556e0ec1c396aee11

Thank You
Your friends at Humorecard.com

If you do not wish to receive anymore emails from us:
hxxtp://2taf.com/d_unsubscribe.php?id=2586516&n=0&hash=5ffa70fb3325aa2556e0ec1c396aee11

—————————–<>——————————
Malware link:

hxxtp://humorecard.com/56/humor/61/saggy-granny.html http://humorecard.com/56/humor/61/saggy-granny.html Opening page
Malware Files:

• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4X23OP2B\jquery.media[1].js
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\jquery.flash[1].js
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\jquery.min[1].js
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\saggy-granny[1].htm

Funky DNS Queries:

• 2taf.com
• 64.64.14.231
• humorecard.com
• 174.120.149.157
• ajax.googleapis.com
• 209.85.229.95

Hosting at least 99 other hosts point to 174.120.149.157. and at least ten other hosts use this as a mail server.

• Yallanekhtar.com
• findhats.info
• social-market.net
• discountcorporatehousing.com
• going4wealth.net

• Bestclassictoys.info
• bigthing.net
• bestcbradios.info
• charlestonoldtown.com
• dance-off.net

Resources: Robtex

Spam straight out of Russia with Love and Malware!

Today our team got a nice little Spam Invite to Chat with some Russian Girls.

Very Interesting, the spam is straight out of Russia With Love and Malware!

Malware Found:

• Trojan+FakeVimes
• Trojan.JS
• FakeUpdates
• Fake Antivirus /”free-spy-software.net”
• Trojan-Downloader.Win32.Genome
• TDSS/Rootkit
• Trojan Zeus/ZBOT

Spam Sample:

Inna (status-online) invites you for chat.Administrator [foneya3969@ajato.com.br]
To:   JoeSix@1123.com

From: Administrator <tizuhid3775@abpl.pl>
To: JoePC@NBC1.com

Subject: Inna (status-online) invites you for chat.

Content-Type: text/html; charset=”UTF-8″
Content-Transfer-Encoding: ISO-8859-1

<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=utf-8″ />
<title>Update</title>
</head>
<body>
NEW MAILS FROM <b>Inna</b><br />
<a href=”hxxp://Joepc.datingwithlove.ru” target=”_blank”>CHAT HERE</a><br /><br /><—–
999 LADIES ONLINE RIGHT NOW!<br />

Administrator Julia

</body>
</html>

Malware Site: hxxp://datingwithlove.ru

• IP:194.85.105.17
• IP:91.216.141.173
• IP:178.208.76.153

HTTP Conversations:

From Port:1053 to 178.208.76.153: 80 – < pc.datingwithlove.ru >
Request: [ GET /i/girl_shuba.png ], Response: [ 200 "OK" ]

Malware Files Created:

• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4X23OP2B\jquery.pack[1].js ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4X23OP2B\logo[1].png ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\footer_girls[1].jpg ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\girls_photos[1].jpg ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\style[1].css ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\girl_shuba[1].jpg ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\pc.datingwithlove[1].htm ]

Malware DNS Queries:

• datingwithlove.ru
• IP: 178.208.76.153
• imgs.blyadgirl.ru
• IP: 72.9.107.43
• img.blyadgirl.ru
• IP: 178.208.76.153

More Malware Sites:

• *.cross-the-best.com
• *.gogetsuperr.com
• *.privenowtoo.com
• americangirls.ru
• afur.ru
• dateyourdream.ru
• datingextazy.ru
• datingsasha.ru
• f*-ckmyrussianwife.ru
• lovedatig.ru
• ns1.privenowtoo.com
• ns2.privenowtoo.com
• ns3.gogetsuperr.com
• ns4.gogetsuperr.com
• ns4.iknarr.ru
• ns4.nsxine.ru
• ns4.tiniee.ru
• sexbeerdating.ru
• www.cross-the-best.com
• pevo.ru
• sexyputana.ru
• pornorate.ru
• wantedunitedsex.ru

If you do a little Googling you see the following enticing entries:

Reference: Threatexpert and Mywot

Stop-Malware.com Malware Invitational

A few days ago, the Cyber Criminals sent our team an email invitation for a chat. It seems that the Cyber Criminals wanted us to visit his malware site – www. stop- malware.com.

The site is associated to a group of criminals that are pumping various malware attacks.

“All of these sites should be avoided as many can automatically infect your computer with a ‘backdoor’ or ‘driveby’ downloads!”

Malware Found:

• Trojan FakeSmoke / QuickHealCleaner loader
• Fake Anti-virus/RansomWare
• Trojan DNS-Changer
• Fake scanner page / Directs to Trojan
• Trojan /TDSS Root-kit
• SpyBots

Copy of Malware Email Invite:

—————————————-

admin@stop-malware.com

show details 2:51 PM (15 minutes ago)

I would first like to commend you and your team on a fine job with your MS Blog.

I also noticed we recommend similar tools. To cut to the chase I would like to interview you via email for an article on my website www. stop- malware.com -I was thinking between 5 and 10 questions would satisfy my viewers.

It is my desire to link up with subject matter experts and voice their views and opinions about the malware threats we face now and possibly in the future. I would love to hear from you, please let
-Matt

————————————————–

Malware Payload: hxxp://stop-malware.com/index.php

• IP: 203.169.164.18
• IP: 66.43.51.53
• IP: 208.73.210.29

Malware Sites:

• aphealthinsurancealternative.com
  awesomehomebusiness4u.com
  forex-guide.net
  fun-picnics.com
  medical-alert-info.com
  stop-malware.biz
  stop-malware.com
  stop-malware.info
  stop-malwarea3.cn
  stop-malwarea9.cn
• epeeche.com

Malware Files Created:

• Files\Content.IE5\4X23OP2B\hijacked-browser[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4X23OP2B\malware-removal-blog[1].gif File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4X23OP2B\show_ads[1].js ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\logo[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\malware-hijacked[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\rootkit[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\BACK[1].jpg ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\malware-protection[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\malwareeducation[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\googleplus[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\malware-rescue-cd[1].gif ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\stop-malware[1].htm ]

DNS Queries:

• stop-malware.com
• IP: 66.43.51.53
• pagead2.googlesyndication.com
• IP: 74.125.87.164
• IP: 74.125.87.165

Graph:

Registrant:
Name: Andrew Byrne
Address: 369 Columbia Ave, Apt 203
City: Los Angeles
Province/state: CA
Country: US
Postal Code: 519000

Reference:

MalwareURL
Free-PC Security
Clean-MX

Pharma Spam Spoofing Facebook

We have received a copy of the Pharma Spam that is spoofing Facebook. The Spam points to malware site hxxp://www.drjstern.com/silky.html. The Pharma Spam gang is associated with other attacks that include Fake AV, Zeus/Zbot and Trojan Down-loaders.

The Cyber Criminals are using facebook to entice users to click on and download malware.

The embedded site hxxp://www.drjstern.com/silky.html site is crawling with malware.

Malware found:

• Illegal 3rd party exploits
• including proxies
• Trojan exploits
• Trojan Banload
• Trojan Agent
• Worms
• ZeuS/Zbot

See our MS Post – Pharma Spam Spoofing Twitter.

Spam Sample:

Sites Analyzed:

• Links hxxp://www.drjstern.com/silky.html
• hxxp://www.drjstern.com/silky.html
• hxxp://sleepingpillsfitnesspills.com/…

• mail.pharmacyprescriptiontablets.com
  rxdrugsplus.net
  pillpharmacymedicationsworld.com

Malware Files:

• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GPURSX23\jquery-1.3.2.min[1].js
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\sleepingpillsfitnesspills[1]
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\sleepingpillsfitnesspills[1].htm
  C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\silky[1].htm

DNS Queries:

• www.drjstern.com
• IP:74.52.105.226
• sleepingpillsfitnesspills.com
• IP:201.7.103.58
• ajax.microsoft.com
• IP:94.245.70.80
• IP:94.245.70.22
• 201-7-103-58.rjorb302.ipd.brasiltelecom.net.br

HTTP Traffic:

• From  :1039 to 74.52.105.226:80 – [www.drjstern.com]
• Request: GET /silky.html
• From  :1040 to 201.7.103.58:80 – [sleepingpillsfitnesspills.com]
• From  :1041 to 201.7.103.58:80 – [sleepingpillsfitnesspills.com]
• Request: GET /js/jquery.js
• Response: 302 “Found”
• From  :1042 to 94.245.70.80:80 – [ajax.microsoft.com]
• Request: GET /ajax/jquery/jquery-1.3.2.min.js
• Response: 200 “OK”

Malware Domains Pointing to IP: 74.52.105.226

• *.15.161.193.aumix.net
  12weeklifetransformation.com
  1heavenlysleep.com
  activateyourpotential.com
  aerialphotographythailand.com
  ashleyhunt.com
  atribecalledquest.com
  audioplace.com
  av-engineered.com
  babycarriages.net
  babyonthefly.com
  barbzwire.com
  bicyclehelmet.net
  blogonline24.com
  bob.org
  californiadiscussion.com
  candlechart.net
  cashflowinnercircle.com
  chatcross.com
  chelseaclubshop.com
  chezjones.net
  comaparty.com
  computerdiscuss.com
  createdforexcellence.com
  creditrepairfix.net
  cridoc.net
  croupiers.ro
  danceinphoenix.com
  digitalimageagency.com
  digitalmode.com
  discussboard.com
  discussplanet.com
  dog-training-talk.com
  foreclosurediscuss.com
  freefootballshirts.com
  friendcommunity.com
  gator150.hostgator.com
  gaycornwall.com
  gaydorset.com
  harshwintersvw.com
  healthdiscuss.com
  highfrequencytest.com
  hispanic-success.com
  jewelrycommunity.com
  kalaria.com
  koreacommunity.com
  latinomotivationalspeaker.com
  leilajane.com
  ligarconexito.com
  longlakesoftware.com
  loverforum.com
  lynnie.com
  militarypoliceassn.com
  mindpick.com
  newlifechurch-lou.org
  newwaylogistics.com
  photographicmemoryart.com
  pittsburghpixels.com
  planet-zeppelin.com
  planetjay.net
  pluto.net
  pranichealingsc.net
  predatorsw.com
  predatorsw.net
  ratecommunity.com
  ratemylatina.com
  remyrocks.com
  remyrocksandrhinestones.com
  ringlock.com
  rockpolls.com
  rockproperties
  sociallylocal.com
  softwarediscuss.com
  suncoastbeaches.com
  superringfit.com
  suzi-hunt.com
  suzihunt.com
  taralynne.com
  thailandchats.com
  thailandcommunity.com
  urban-city.net
  www.inferno2005.com

Site Graph:

Good Luck!

Reference: RobTex

Investment Spam with ZBOT Links

We are getting copies of a new spam that is making the rounds. The Spam email is written in Spanish and it informs our users to invest money in some bonds. It appears that the Spam is targetting users with BankCard and Expedia offers.

We look under the hood and checked out the link. We check out the embedded link  hxp://datbeyriz.in/outlink/ and it is associated with the Infamous Zeus ZBOT and other type of malware.

Spam Sample:

• From: mroseeu@gmail.com
• To: Joe6Pack@yahoo.com

Malware Site:

• hxxxp://datbeyriz.in/es/
• 193.27.232.68

Associated with the following suspicious sites:
* post.com
* IP: 204.74.99.100
* forex1ad.com
* datbeyriz.in
* ns2.forex1ad.com
* ns1.forex1ad.com

Malware Found:

• Adware Spyware Trojan
• Trojan ZEUS /ZBOT
• Troj/Delf-LB Trojan (Trojan-Clicker.Win32)
• Worm.IrcBot
• SpamBot-Send email with info finance fraud to: 204.74.99.100

Files Created:

• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\POST[1].png ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODM3O1U3\yangtse[1].png ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\favicon[1].ico ]
• File Name: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\post[1].htm ]

Funky http Connections:

• From  :1045 to 216.246.74.34:80 – [save.post.com]
• Request: GET /new?DomainName=post.com&Keywords=POST&Referer=&SuggestedLinks=News,Education,News_Alerts,Schools,Stock_Market,Courses,Tech News,Science,Health,Students,Classifieds,Degree,Shop_Online,Family,Clothing,Counseling,Online_Stores,Insurance,Cosmetics,Contractors,Autos,Kids,Houses,Baby,Money,Travel,Loans,Vacations,Cash,Hotels,Payday,Flights,Stocks,Cruises,Small_Business,Adventure&CacheTime=600&LanderPage=NewXMLfirstpagezzTestC
• Response: 200 “OK”
• From  :1039 to 204.74.99.100:80 – [ post.com ]
• Request: [ GET / ], Response: [ 200 "OK" ]
• From  :1041 to 198.189.255.200:80 – [ www.huffingtonpost.com ]
• Request: [ GET /favicon.ico ], Response: [ 200 "OK" ]
• From  :1042 to 12.129.147.65:80 – [ www.washingtonpost.com ]
• From  :1043 to 198.189.255.209:80 – [ extras.mnginteractive.com ]
• Request: [ GET /live/media/favIcon/dpo/favicon.ico ], Response: [ 200 "OK" ]
• From  :1044 to 98.142.98.60:80 – [ static.jpost.com ]

Malware Host names sharing IP with A records:

• accreditedhome.com
• accreditedhomelenders.com
• bankcardusa.us
• bankcardusams.net
• bankcardusams.org
• bankcardusaonline.net
• bankcardusaonline.org
• bestexpediadeals.com
• bestfaresearch.biz
• bestfaresearch.org
• blogdevoyages.com
• bluebook.com
• calottery.com
• cambank.com
• chargers.com
• condosforsalelosangeles.com
• couponsforexpedia.com
• cruiseexpedia.info
• cruiseexpedia.org
• cruisesexpedia.biz
• cruisesexpedia.org
• custombuildershow.org
• doradoatdamonteranch.com
• dos-lagos.com
• e-xpedia.biz
• e-xpedia.net
• estatesattradition.com
• ex-pedia.net
• ex-spedia.com
• excedia.info
• exoedia.com
• expcruiseoutlet.biz
• expecn.com
• expecndx.com
• exped8a.com
• expeda.org
• expedai.info
• expedaia.com
• expedea.com
• expedeai.com
• expedeas.com
• expedetia.com
• expedia-cafe.com
• expedia-epackage.com
• expedia-hoteis.com
• expedia-location.com
• expedia-travel.com
• expedia-travels.net
• expedia-voyages.com
• expedia.biz
• expedia.us
• expedia4travelagents.org
• expediaagents.com
• expediaagents.net
• expediaagents.org
• expediaasia.org
• expediabargainfares.net
• expediabargainfares.org
• expediacafe.org
• expediacast.net
• expediacom.org
• expediacorp.com
• expediacs.org
• expediacustomer.net
• expediad.com
• expediadealhunter.us
• expediadenver.com
• expediafare.us
• expediafares.biz
• expediafares.info
• expediafares.org
• expediafares.us