Tuesday, December 08, 2009

Ongoing Badness: AmEx, Facebook, and .CN

Here are several forms of "ongoing badness" that we are still seeing in the UAB Spam Data Mine:

American Express Phish



This campaign, which we told you about December 5th (see: American Express Phishing Campaign) continues to be heavily spammed. Today we've seen the following websites:

www212.americanexpress.com.idddet.co.uk
www212.americanexpress.com.idddet.me.uk
www212.americanexpress.com.idddet.org.uk
www212.americanexpress.com.idddot.co.uk
www212.americanexpress.com.idddot.me.uk
www212.americanexpress.com.idddot.org.uk
www212.americanexpress.com.ilddkt.co.uk
www212.americanexpress.com.ilddkt.org.uk
www212.americanexpress.com.ilddot.co.uk
www212.americanexpress.com.ilddot.me.uk
www212.americanexpress.com.ilddot.org.uk
www212.americanexpress.com.opadke.eu
www212.americanexpress.com.opadse.eu
www212.americanexpress.com.opidke.eu
www212.americanexpress.com.opldke.eu
www212.americanexpress.com.oplnke.eu
www212.americanexpress.com.oplvke.eu
www212.americanexpress.com.oplvle.eu
www212.americanexpress.com.tyhoql.eu
www212.americanexpress.com.tywobb.eu
www212.americanexpress.com.yhwed.co.uk
www212.americanexpress.com.yujekss.co.uk
www212.americanexpress.com.yujekss.eu
www212.americanexpress.com.yujekss.me.uk
www212.americanexpress.com.yujekss.org.uk
www212.americanexpress.com.yujerss.co.uk
www212.americanexpress.com.yujerss.eu
www212.americanexpress.com.yujerss.me.uk
www212.americanexpress.com.yujerss.org.uk
www212.americanexpress.com.yujikks.co.uk
www212.americanexpress.com.yujikks.eu
www212.americanexpress.com.yujikks.org.uk
www212.americanexpress.com.yujikss.co.uk
www212.americanexpress.com.yujikss.eu
www212.americanexpress.com.yujikss.me.uk
www212.americanexpress.com.yujikss.org.uk

With at least these live as of this writing:

www212.americanexpress.com.yujekss.co.uk
www212.americanexpress.com.yujekss.me.uk
www212.americanexpress.com.yujekss.org.uk
www212.americanexpress.com.yujerss.co.uk
www212.americanexpress.com.yujerss.me.uk
www212.americanexpress.com.yujerss.org.uk
www212.americanexpress.com.yujikks.co.uk
www212.americanexpress.com.yujikks.org.uk
www212.americanexpress.com.yujikss.co.uk
www212.americanexpress.com.yujikss.me.uk
www212.americanexpress.com.yujikss.org.uk

The emails for this one read like this:




Dear American Express customer,

A newly revised American Express Online Form has been issued by the American Express Customer Care Team. Please complete this form as soon as possible. You can access the form at:

American Express Online Form.

Thank you for choosing American Express.

Sincerely,
American Express



Facebook Password Reset Malware



A Facebook spam campaign claims four of our top ten email subjects for the morning, with more than 5,000 copies seen already:

Count Subject
-------+---------------------------------------------------------
1123 | Facebook Password Reset Confirmation. Important Message
1108 | Facebook Password Reset Confirmation. Customer Support.
1089 | Facebook Password Reset Confirmation. Your Support.
1080 | Facebook Password Reset Confirmation. Customer Message.
1034 | Facebook Password Reset Confirmation. Support Message.

This campaign has an attached ZIP file, with the most popular attachment name this morning being:

Facebook_Password_58688.zip

That file is recognized by 18 of 41 AV products according to this VirusTotal Report which finds the most popular definition names to be of the Bredolab family of malware.

We've been seeing Bredolab, primarily as fake package delivery notices, for some time this fall. We mentioned it back on October 2 as the second story in Cyber Security Awareness Day Two, but its been a near constant presence since that time.

Here's a sample email body:

Hey gar ,

Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Thanks,
Your Facebook.


The attachment had these characteristics:
File size: 17223 bytes
MD5 : 632c33ddd8ad8fe9ba317fa441ff4540

More BredoLab - DHL Services


There is also a DHL services version that continues to be heavily spammed this morning:

Subject: DHL Services. Please get your parcel NR.42246

Each email has a randomly generated parcel number, but we've seen more than 1,000 copies of this spam already this morning as well, with messages that look like this:

Dear customer!

The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.

You may pickup the parcel at our post office personaly.

Please attention!
The shipping label is attached to this e-mail.
Print this label to get this package at our post office.


Please do not reply to this e-mail, it is an unmonitored mailbox!


Thank you,
DHL Express Services.


The ZIP file attached to this email is also Bredolab according to this VirusTotal report, which showed a 20 of 41 detection rate.

File size: 17904 bytes
MD5 : f6fc6ffbd0be0c0b0d8b702b5b47d571

Climate Change?


We wondered if the Climate Change Summit would end up being used as a spam bait, but so far its only being used as yet another lame way to deliver Viagra messages.

The Subjects:

Act now on climate, summit urged
What are your hopes for climate summit?

Are only two of many pathetic news headline attempts to get people to visit chinese domain names to see their Canadian pharmacy ads. Other headlines for this particular spammer include:

Balancing act
BBC World News
Bottle of cognac from 1788 and more up for grabs at Paris auction
'Cancer donor' kidney transplant success
Chanting back
Day in pictures
Decade in words
Dubai stock market slumps again
Gayle ton keeps Australia at bay
In pictures
Into the spotlight
Kabul mayor guilty of corruption
Member (your email) get (##)% OFF on ALL Pfizer
Personal ##% off
Romanian opposition alleges fraud
Silverstone deal saves British GP
Soldiers killed in attack
TV channel says sorry for jungle rat killing
US man charged over Mumbai attack
User (your email) get (##) discount on ALL Brands

Of all the emails we have received so far this morning (242,800 emails already at 6:30 AM), the top 18 emailed subjects were all from this campaign!

1344 | Silverstone deal saves British GP
1294 | Soldiers killed in attack
1290 | Decade in words
1288 | What are your hopes for climate summit?
1281 | Dubai stock market slumps again
1279 | Kabul mayor guilty of corruption
1277 | Bottle of cognac from 1788 and more up for grabs at Paris auction
1273 | Balancing act
1260 | Into the spotlight
1251 | Act now on climate, summit urged
1235 | BBC World News
1224 | Romanian opposition alleges fraud
1218 | 'Cancer donor' kidney transplant success
1214 | US man charged over Mumbai attack
1207 | Gayle ton keeps Australia at bay
1206 | TV channel says sorry for jungle rat killing
1188 | Day in pictures
1168 | In pictures
1136 | Facebook Password Reset Confirmation. Important Message
1117 | Facebook Password Reset Confirmation. Customer Support.
1110 | Chanting back
1100 | Facebook Password Reset Confirmation. Your Support.
1094 | Facebook Password Reset Confirmation. Customer Message.
1039 | Facebook Password Reset Confirmation. Support Message.

23,607 of these emails were from this particular Canadian Pharmacy group, which gives us 10% of all our emails - before we put in the subjects which use email addresses and random character insertion.

If we look at the top domains that we saw so far this morning (6:30 AM) after the huge amounts of spam for x10 cameras (www.x10.com) and some other Chinese hosted but not Chinese named spam domains, (medztochoosefrom.net, drugsquentin25.net) most of the top ten spammed domains are Chinese pill seller domains:

xikokmb.cn
retovdw.cn
selejsk.cn
hogocxq.cn
hizoxnn.cn
wewodbr.cn
yucujxz.cn
gixudrv.cn
hevugjf.cn
foqonhq.cn
zkksokwj.cn

---------------
Here's the rest of the 661 ".cn" domains in our spam this morning:

abravisorees.cn
acordetionses.cn
acrawoneses.cn
adristakorees.cn
advousteres.cn
afrehotresoes.cn
agernobeeltes.cn
akreoplastoes.cn
allusionertes.cn
alohamortes.cn
amderbaltes.cn
amerosofates.cn
apostilertes.cn
aprodesofts.cn
arastoromees.cn
assortimanoes.cn
avardokrounees.cn
avietoresas.cn
avrasuportees.cn
axiometricoes.cn
azopregonees.cn
azorekrasses.cn
balorecomtes.cn
bargadurittes.cn
bartopomas.cn
bartopomees.cn
belikqq.cn
bengaminotes.cn
beqawwz.cn
bergamotestes.cn
berkuteras.cn
bertoluchiotes.cn
bertonsodas.cn
bihupqk.cn
biidrtyu.cn
bikofvs.cn
boprenagas.cn
boriglasees.cn
bosumgx.cn
bowalzf.cn
brasseromertes.cn
bravisomees.cn
bravoredotes.cn
brendomessates.cn
brendomesstes.cn
brenevases.cn
breonevases.cn
budutjq.cn
buletrq.cn
bupiplt.cn
buwajfz.cn
caliostrattes.cn
camerosofates.cn
caxiptk.cn
cerogasortes.cn
cidahdy.cn
ciestopotes.cn
cijiknq.cn
cilevfl.cn
cilicch.cn
cimimzp.cn
cimofwf.cn
cisugbj.cn
citonnv.cn
citunxv.cn
ciwanag.cn
ciyazlr.cn
cizekbh.cn
ckranovites.cn
clapedonuses.cn
cofdetionses.cn
coloratostes.cn
colupxf.cn
com.cn
combaridoes.cn
cominternotes.cn
comiternotes.cn
commaderkates.cn
conterasotes.cn
copdetionses.cn
coperfieltes.cn
copitationstes.cn
coplesationes.cn
coradetionses.cn
coredetionses.cn
coridetionses.cn
corodetionses.cn
corudetionses.cn
cosdetionses.cn
cotydetionses.cn
couteronettes.cn
coverapinotes.cn
cowdetionses.cn
cravistecoes.cn
creativosas.cn
creativosees.cn
creditoregates.cn
cretivoleses.cn
cronenburtes.cn
croperodes.cn
cuwifzz.cn
cuyaqch.cn
cuyijzy.cn
dakorestotes.cn
dapimlg.cn
daquwzd.cn
darazvr.cn
dasocjw.cn
dayudzm.cn
dehegcd.cn
demedovas.cn
demiuserottes.cn
demonisimotes.cn
denomertolas.cn
deqecwn.cn
diamegerattes.cn
digorkc.cn
dimografichestes.cn
dimresitotes.cn
diogarevoes.cn
dipiqzw.cn
dnevapronees.cn
docibqv.cn
dogamns.cn
dogaqzq.cn
dokrasteras.cn
donaterrostes.cn
donterrostes.cn
dorgusofts.cn
dormegovees.cn
dourtangotes.cn
doyovpg.cn
dragohunas.cn
dragounas.cn
dramboveres.cn
dreafiepees.cn
dreamdrosertes.cn
dreamgovertes.cn
dreamosfertes.cn
drebokapotes.cn
dresdekoliertes.cn
dresdomerges.cn
drestocoleres.cn
dromvertoes.cn
drutopiektes.cn
dubohky.cn
dugercs.cn
ecordetionses.cn
ergonombiles.cn
erogasores.cn
fafujhk.cn
famantd.cn
faqurcj.cn
fasermanostes.cn
favefqh.cn
fecufjj.cn
fejogqd.cn
fekujpv.cn
feloqvb.cn
fezufck.cn
fidaksj.cn
fidekns.cn
fierosetotes.cn
fierrosetotes.cn
fiesordertes.cn
fiomenatas.cn
fixumsn.cn
flarestinoes.cn
flopertoveres.cn
fobebyd.cn
fodovks.cn
foqonhq.cn
foqutqc.cn
forijdc.cn
fotagkg.cn
fradeakinotes.cn
fragolinestes.cn
fregostens.cn
fregosters.cn
frepigolesses.cn
friesetertes.cn
frosendomas.cn
fucatwv.cn
fuvobqk.cn
fuwifyb.cn
fuzonbk.cn
galustantes.cn
gamerosofaes.cn
gaqagcv.cn
garehdg.cn
gayebhp.cn
gecernr.cn
geleporesoftes.cn
germanissoes.cn
gewiyln.cn
gewrgre.cn
gilorrz.cn
gimezdg.cn
giorgentoes.cn
gitoffr.cn
gixudrv.cn
gojuslh.cn
gorpelloses.cn
goxeskq.cn
goyehlg.cn
goziywb.cn
grackoveres.cn
gregoriantotes.cn
grivodanoves.cn
guminrh.cn
gutunws.cn
gvardetiontes.cn
halekds.cn
hasaspr.cn
hehapvm.cn
heloperosettes.cn
hevasqr.cn
hevugjf.cn
hexishf.cn
hikexmk.cn
hivuttk.cn
hizigyd.cn
hizoxnn.cn
hlopowsytes.cn
hogocxq.cn
hogundz.cn
hoporesovas.cn
hopresovas.cn
horrowesees.cn
howoglp.cn
hranoprestes.cn
hrapikonees.cn
hrenostartes.cn
hromberodas.cn
huhulyb.cn
humohvw.cn
huweynf.cn
icordetionses.cn
icordetionstes.cn
ijksjiw.cn
intewreadas.cn
ipacivbf.cn
ipacusrt.cn
irgalometrices.cn
jabadmd.cn
janezyp.cn
japupsc.cn
jawatcd.cn
jcordetionses.cn
jepodcc.cn
jibimwy.cn
jifonft.cn
jigugmb.cn
jikizcn.cn
jiwicnh.cn
jiwukvz.cn
jockedaonas.cn
jogibyp.cn
jokasomtes.cn
jolitzr.cn
jonuwhd.cn
joremysoftes.cn
jotizbn.cn
joviykg.cn
jujipqr.cn
juxinrg.cn
kalverminoes.cn
kapobravtes.cn
kapriciontes.cn
kaprioskeres.cn
kasmoterstes.cn
kassiopenastes.cn
kavientoes.cn
kecetlx.cn
keyoryj.cn
kezovgc.cn
kieloplastictes.cn
kilalfk.cn
kilometragtes.cn
kipomonestes.cn
kipromonestes.cn
kisarzg.cn
kiwicrx.cn
kiyupqx.cn
klapidorees.cn
kloperesoftes.cn
klxkksoe.cn
kodudjb.cn
koperdinoses.cn
koperovestes.cn
kordamenstes.cn
kordosofts.cn
koretopases.cn
koreykounes.cn
kosoqcm.cn
kovafcb.cn
krapobraves.cn
kraskopurtes.cn
kravientotes.cn
krepostiches.cn
krestendostes.cn
kropedovates.cn
kuduzsh.cn
kuqiypt.cn
kusinakoptes.cn
kuyisrk.cn
lafawhv.cn
lakerdc.cn
laxohfw.cn
layikcj.cn
legovfj.cn
lejagdw.cn
lenuyrk.cn
leteyyj.cn
lijucnb.cn
linahwr.cn
linktech.cn
litowlm.cn
loguzgm.cn
lohospd.cn
loqignq.cn
loxurdw.cn
lskzokel.cn
lsoikww.cn
lugidmj.cn
magneticosas.cn
magomedastas.cn
makiksx.cn
manylopertes.cn
mapupkr.cn
marasofertes.cn
margoulistes.cn
mashurakotes.cn
maticxw.cn
matiryy.cn
matuqvd.cn
mebiwyf.cn
mecunzw.cn
medogden33.cn
memitqn.cn
menavsm.cn
meyaydd.cn
mg-bz.cn
mifipdh.cn
mitesvn.cn
miwoytb.cn
mizuxjr.cn
mlff3we.cn
modotvw.cn
mogeroseltes.cn
mohevwn.cn
mohuqdv.cn
monderossoes.cn
monicolesstes.cn
monigxb.cn
mordesofts.cn
mosabmp.cn
mukabhx.cn
muyojdf.cn
najajqj.cn
neaderesttes.cn
neapolitases.cn
nearomasses.cn
nearosofttes.cn
neatopisdtes.cn
nedocbq.cn
negutqr.cn
nelufmb.cn
nernonerates.cn
neronerates.cn
netaytl.cn
netendortes.cn
nevadiotiones.cn
newfaundledes.cn
newicgb.cn
nigareastotes.cn
nihivlz.cn
nikumdw.cn
nimorxc.cn
nitezsl.cn
notermodas.cn
nuqismj.cn
oconterasoes.cn
ocordetionses.cn
ocronenbures.cn
okcnjdhe.cn
onlinemarshal56.cn
onlinetallie48.cn
operasiotees.cn
ordenanosttes.cn
overtorneses.cn
pacozzy.cn
padabcm.cn
padumjt.cn
pavelevones.cn
pecovjk.cn
pedogsx.cn
pefejqm.cn
pharmjohn19.cn
phoniudo.cn
piesomanottes.cn
pikegkb.cn
pizijpn.cn
pizuzmm.cn
plemountotes.cn
plsdkww.cn
pofislr.cn
pofresotees.cn
pomiralesttes.cn
poratpl.cn
poregrassoes.cn
premoverottes.cn
prevalidotas.cn
privatonas.cn
profeklorees.cn
puguqvy.cn
punuskv.cn
qamakdz.cn
qaxajkw.cn
qazovbt.cn
qerattc.cn
qibegjq.cn
qigistx.cn
qiwamxc.cn
qoliqpg.cn
qotixfc.cn
qoviqzj.cn
qoxagyr.cn
qoxuhxr.cn
qp-hh.cn
quboqcq.cn
questergotes.cn
questinoportes.cn
qujeytf.cn
quwimdy.cn
ramilyr.cn
randstad.cn
ranopreses.cn
rarofcz.cn
rastimores.cn
ravigxx.cn
rcordetionses.cn
reluxlb.cn
resovrn.cn
retovdw.cn
rigannv.cn
riqonkt.cn
rogubgy.cn
ronuplq.cn
rosakrf.cn
rosteromas.cn
rosteromass.cn
rudobhc.cn
sacurnz.cn
sahuwwn.cn
salutoserotes.cn
samburatinoes.cn
samnetiones.cn
saporsofttes.cn
sapporovees.cn
sapresodas.cn
sattermenes.cn
saunetodtes.cn
savolinosas.cn
sejeshm.cn
selejsk.cn
semefwd.cn
sepremestotes.cn
sevehmz.cn
silubrk.cn
sipomenoras.cn
siratdh.cn
sivejyg.cn
sixopwx.cn
snowviretes.cn
soberdg.cn
sociaheroes.cn
soferdinoes.cn
softerobas.cn
sogradapees.cn
solusatertes.cn
soluterestes.cn
somerosotas.cn
sondercomaes.cn
sondercommates.cn
soprementostes.cn
sovierosttes.cn
soyinps.cn
sruisorehoes.cn
stounkoprees.cn
submiternotes.cn
suisorehotes.cn
sumovxt.cn
sunmail.cn
suqevxz.cn
swalowrestes.cn
swokreatees.cn
tabigbp.cn
tafucrx.cn
tagorkl.cn
tahadrd.cn
talilfv.cn
tasaxst.cn
tehubcs.cn
tejizdc.cn
tergonovas.cn
terrabosertes.cn
tesarurissotes.cn
tesaurimotes.cn
tesaurissotes.cn
tibagxz.cn
timomjp.cn
tiniwny.cn
tiolanoses.cn
tiomenadotes.cn
tiomenatas.cn
titelvd.cn
tocibhk.cn
togadqt.cn
topezzf.cn
topitbk.cn
toxaqky.cn
trastoregotes.cn
tudipkc.cn
tupaycy.cn
tuxurvj.cn
ucordetionses.cn
ueijfik.cn
unicolorestes.cn
utondaremotes.cn
vercovesttes.cn
vertikalesotes.cn
veyopqc.cn
vienmorettes.cn
vientoresotes.cn
vietongertes.cn
vietoresas.cn
vifunyc.cn
viokermanes.cn
violerassoes.cn
violettosas.cn
vioperdosas.cn
vioreganoes.cn
vodaforentoes.cn
vofusln.cn
vombasteres.cn
vonmertotes.cn
vonumertotes.cn
vopientorates.cn
voredqp.cn
vorkuteras.cn
voutersartes.cn
vrogessoes.cn
vupevkd.cn
wabomns.cn
wamaryr.cn
wassermanostes.cn
wcordetionses.cn
weapedirotes.cn
weavertopas.cn
weilosertes.cn
wekimqx.cn
wensdaysoftes.cn
wergolertoes.cn
werikopektes.cn
wermondoes.cn
wevapsz.cn
wewodbr.cn
wharemandes.cn
whatisorees.cn
wietoperastes.cn
wifulpt.cn
wihehmj.cn
wikadpv.cn
winipkc.cn
winouretoes.cn
wiquvpc.cn
wizatfb.cn
wogecmf.cn
wohebqw.cn
wojocpp.cn
wonderfoustes.cn
wordesofts.cn
wrdokirotes.cn
wucadcy.cn
wufonmn.cn
xasikjj.cn
xavieresttes.cn
xavierossoes.cn
xcordetionses.cn
xekasbt.cn
xenubfm.cn
xeqirxs.cn
xerovittoes.cn
xicajvx.cn
xifilpg.cn
xikokmb.cn
ximaretoktes.cn
ximuvqd.cn
xiosofteres.cn
xiraspv.cn
xirobenasoes.cn
xjikdijee.cn
xjiodjire.cn
xobayhb.cn
xodagkh.cn
xogerks.cn
xoguvkg.cn
xomitjv.cn
xudasqp.cn
xusegjw.cn
xzjksjww.cn
yaciwkr.cn
yajazcx.cn
yaqogyd.cn
yararcy.cn
yarodzk.cn
yepojdf.cn
yifafzr.cn
yiruxgl.cn
yobeqjh.cn
yohisvy.cn
yojussc.cn
youaskedthedomain.cn
yucujxz.cn
yusokjv.cn
yuwicpd.cn
zacirzs.cn
zafuvbv.cn
zamenikanotes.cn
zaratustrotes.cn
zaretosetes.cn
zaropustestes.cn
zasiznt.cn
zcordetionses.cn
zeremdr.cn
zetariontes.cn
zevultc.cn
zewirff.cn
zeyurqv.cn
zhishw.cn
zhisxihw.cn
zhjsihwq.cn
zicajsv.cn
zikipjw.cn
ziopraventoes.cn
zisidsk.cn
zkksokwj.cn
zlkxmskw.cn
zoksjhiuw.cn
zokxfde.cn
zokxisjw.cn
zomedsr.cn
zopregonas.cn
zoqejwg.cn
zordesofts.cn
zoreharoptes.cn
zosuhjr.cn
zupaxzm.cn
zusazwk.cn
zxjkkejh.cn

No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.