Here's a sample of the spam message . . .
Dear American Express customer,
A newly revised American Express Online Form has been issued by the American Express Customer Care Team. Please complete this form as soon as possible. You can access the form at:
American Express Online Form.
Thank you for choosing American Express.
Sincerely,
American Express
Notice that it actually links to the REAL American Express website with its "phishing warning":
"To learn more about e-mail security or report a suspicious e-mail, visit us at americanexpress.com/phishing."
which really does go here:
The spam works in three ways.
(1) Direct URL advertisement, where the web address of the phishing site is given in the spam.
(2) URL shortening services, where a shorting service URL is given in the spam, which is expanded to the actual URL when visited.
(3) Free webhosting redirectors, where the criminals have established a free webhosting account and loaded the account with a URL that forwards to the actual phishing site.
URL shortening services:
The main services abused this time around, beginning on May 30th, were:
is.gd
u.nu
migre.me
doiop.com
qurl.com
In these cases, URLs were redirecting primarily to "www212.americanexpress.com.dll.kz" from shortened URLs such as:
is.gd/cvRXW
is.gd/cvSBB
qurl.com/9hlyn
qurl.com/rlrjw
migre.me/Kffa
migre.me/KffH
doiop.com/255bsb
doiop.com/76a7jv
u.nu/4eu2b
In the case of the Free Webhosting service, one important clue kept emerging. This same scam technique was seen March 31st and April 1st, using the same free webhosting services!
Some of the abused services include:
100freemb.com
100megsfree5.com
1accesshost.com
angelcities.com
arcadepages.com
bigheadhosting.net
builtfree.org
digitalzones.com
dreamstation.com
easyfreehosting.com
envy.nu
exactpages.com
fcpages.com
freecities.com
freehostyou.com
freewaywebhost.com
greatnow.com
ibnsites.com
lookseekpages.com
maddsites.com
o-f.com
s-enterprize.com
servetown.com
the-best-free-web-hosting.com
uvoweb.net
wtcsites.com
As one example of how the web refresh works, here is a javascript snippet that followed a "Meta http-equiv Refresh" portion for a FreeWayWebHost.com site:
(script language="javascript")location.href='\u0068\u0074\u0074\u0070\u003a\u002f\u002f'+'www212'+'\u002e\u0061\u006d\u0065'+'rican'+unescape('%65%78%70%72')+'\u0065\u0073\u0073\u002e\u0063\u006f\u006d'+unescape('%2e%64%6c%6c%2e%6b%7a')+'/my'+'\u0064\u0061\u0074\u0061\u002f'+'\u0066\u006f\u0072\u006d\u002f\u0061\u0070'+'\u0069\u0073\u0072'+unescape('%76%2e%70%68%70%3f%73')+'essio'+'\u006e\u003d\u0033\u0035\u0037\u0035\u0031'+'\u0032\u0032\u0032\u0032\u0033\u0036\u0036'+unescape('%39%36%30%30%31%32')+'\u0033\u0035\u0035\u0032\u0039\u0034\u0038'+'8319646'+'\u0030\u0031\u0038\u0032\u0034\u0036\u0033'+'5388'+'327'+'86548'+'\u0036\u0033\u0031'+'\u0039\u0037\u0037\u0035'+'637'+'973'+unescape('%33%33%37%37%37%32')+'667'+unescape('%32%34')+''(/script)
The Javascript was a "belt and suspenders" approach, since the site already had a Meta Refresh pointed to "www212.americanexpress.com.dll.kz/mydata/form/apisrv.php"
Here are some examples, showing the seemingly random hostnames and paths used in the spam messages:
2010-06-01 | http://agehoquv.ibnsites.com/adaryso.html
2010-06-01 | http://jiholyrufo.ibnsites.com/tefygij.html
2010-06-01 | http://ocydegube.ibnsites.com/qymory.html
2010-06-01 | http://gohydawiv.ibnsites.com/udycobew.html
2010-06-01 | http://foryqyfob.ibnsites.com/owupoves.html
2010-06-01 | http://obojidizy.ibnsites.com/usymix.html
2010-06-01 | http://putepotar.ibnsites.com/erocure.html
2010-06-01 | http://ehyhuwyc.ibnsites.com/wunawaso.html
2010-05-31 | http://evemyjopu.ibnsites.com/idibiheg.html
2010-05-31 | http://epilysora.ibnsites.com/fyqugo.html
MANY more examples follow at the end of this posting. We've now received more than 7,000 copies, all of those in group (2) and group (3) have a unique URL. No repeats.
To further the confusion of this phishing campaign, the ultimate destinations:
www212.americanexpress.com.dll.kz
and
www212.americanexpress.com.idlls.ru
were actually hosted on a broad network of "fast flux" domains. In Fast Flux hosting, the nameserver settings for each domain are constantly updated so that the resolving IP is always unique. The particular Fast Flux botnet that these were using is typically known as the "Zeus Fast Flux Botnet". Some of the Zeus domains that it is currently resolving are:
cribrejist.kz
cyansmith.com
esvr1.ru
esvr2.com
esvr3.ru
esvr4.net
hazelpay.ru
hesneclimi.ru
ielaithereej.com
jodnkism.com
mafisiengo.ru
nyfrizymiq.net
nyfrizymiq.net
ophaeghaev.ru
sslillisilsltlis.com
toothou.com
wrefraquaf.tw
zeferesds.com
But it also gets involved in other malware hosting. The controller of this botnet clearly "leases" usage of the botnet for other malware, so we see it currently also associated with:
goldencaravela.net <= meredrop site
flashplyaer.info
updateservice-server.net
www.stvpar.info
Here are some more examples of those American Express URLs I promised up above:
2010-05-31 | http://moconawe.ibnsites.com/sitinexa.html
2010-05-31 | http://huxivufu.ibnsites.com/imejuqa.html
2010-05-31 | http://yzyxurilub.ibnsites.com/sipavyl.html
2010-05-31 | http://xaxirynaco.ibnsites.com/elyqityd.html
2010-05-31 | http://sybodupota.ibnsites.com/lukybaqu.html
2010-05-31 | http://ihakimiti.ibnsites.com/yhijywi.html
2010-05-31 | http://qypagazok.ibnsites.com/anikyz.html
2010-05-31 | http://owebyfyj.ibnsites.com/bykigel.html
2010-05-31 | http://zatunezoz.ibnsites.com/zojuwevy.html
2010-05-31 | http://xidesanuqy.ibnsites.com/hofypep.html
2010-05-31 | http://gabyzenywu.ibnsites.com/nywavak.html
2010-05-31 | http://ybadilovi.ibnsites.com/tikysy.html
2010-05-31 | http://ifirogar.ibnsites.com/yhapabuw.html
2010-05-31 | http://zalimohob.ibnsites.com/ilopoweh.html
2010-05-31 | http://wujahuduf.ibnsites.com/ipehodoq.html
2010-05-31 | http://robobexef.ibnsites.com/owiwud.html
2010-05-31 | http://siwesysud.ibnsites.com/ylikal.html
2010-05-31 | http://hypohety.ibnsites.com/ycyloqu.html
2010-05-31 | http://efanogih.ibnsites.com/kytowym.html
2010-05-31 | http://sybujare.ibnsites.com/izutag.html
2010-05-31 | http://cedaxopuva.ibnsites.com/adysid.html
2010-05-31 | http://uhynanygi.ibnsites.com/igumih.html
2010-05-31 | http://eqacanipu.ibnsites.com/tuwynux.html
2010-05-30 | http://ytetemehyn.ibnsites.com/ikebabyc.html
2010-05-30 | http://podysinyj.ibnsites.com/bogate.html
2010-05-30 | http://nepozogewa.ibnsites.com/opycapy.html
2010-05-30 | http://bihocibyti.ibnsites.com/vaxagan.html
2010-05-30 | http://ofadusep.ibnsites.com/isycatol.html
2010-05-30 | http://imorazusi.ibnsites.com/zosapyn.html
2010-05-30 | http://capimalupa.ibnsites.com/jereleru.html
2010-05-30 | http://qanyquryf.ibnsites.com/ezydaq.html
2010-05-30 | http://asecemub.ibnsites.com/azezejuv.html
2010-05-30 | http://azyrywid.ibnsites.com/usorunoh.html
2010-05-30 | http://uxoxojoq.ibnsites.com/okefecoc.html
2010-05-30 | http://enefawoz.ibnsites.com/xoragi.html
2010-05-30 | http://mimocucaq.ibnsites.com/yvorewum.html
2010-05-30 | http://panoxilor.ibnsites.com/verufoh.html
2010-05-30 | http://ydezovamiz.ibnsites.com/oqetowi.html
2010-05-30 | http://barakuha.ibnsites.com/xovehizi.html
2010-05-30 | http://padazurafu.ibnsites.com/atutacix.html
2010-05-30 | http://pavomibiwe.ibnsites.com/araxeg.html
2010-05-30 | http://alynataz.ibnsites.com/qydurig.html
2010-05-30 | http://cokuzigis.ibnsites.com/utatape.html
2010-05-30 | http://susorahi.ibnsites.com/ovahacy.html
2010-05-30 | http://ymybygamoq.ibnsites.com/ymirybam.html
2010-05-30 | http://evilapys.ibnsites.com/emalone.html
2010-05-30 | http://ylegodyhyc.ibnsites.com/xacebe.html
2010-05-30 | http://cicemogof.ibnsites.com/fidizixo.html
2010-05-30 | http://tevetyjy.ibnsites.com/utiquvaj.html
2010-05-30 | http://dyvitahase.ibnsites.com/gasutyr.html
2010-05-30 | http://hiwaveboku.ibnsites.com/fupypuv.html
2010-05-30 | http://odywotyhe.ibnsites.com/exuluny.html
2010-05-30 | http://imuvuganec.ibnsites.com/vypolad.html
2010-05-30 | http://ugufihony.ibnsites.com/ibopej.html
2010-05-30 | http://timacovup.ibnsites.com/dejudyb.html
2010-05-30 | http://norurizer.ibnsites.com/ygatywaw.html
2010-05-30 | http://ujomexaxu.ibnsites.com/zimuvib.html
2010-05-30 | http://jiluweso.ibnsites.com/kycodepy.html
2010-05-30 | http://emafucagi.ibnsites.com/bevixy.html
2010-05-30 | http://poroqitob.ibnsites.com/wekawi.html
2010-06-01 | http://inalymikah.o-f.com/toguriwo.html
2010-06-01 | http://tiqafexy.o-f.com/pyhopiq.html
2010-06-01 | http://dagexedene.o-f.com/upixel.html
2010-06-01 | http://cyhysanopi.o-f.com/qolyqage.html
2010-05-31 | http://etiqoragu.o-f.com/efysaje.html
2010-05-31 | http://guvufuza.o-f.com/cedonit.html
2010-05-31 | http://buhazoneca.o-f.com/owuwukup.html
2010-05-31 | http://gyguhulaq.o-f.com/icavyfec.html
2010-05-31 | http://ebizonyfu.o-f.com/rawyteha.html
2010-05-31 | http://ebylegorij.o-f.com/nakovete.html
2010-05-31 | http://jarelyjuv.o-f.com/dylawyfi.html
2010-05-31 | http://operyzisi.o-f.com/opisuta.html
2010-05-30 | http://baguxoxo.o-f.com/wuqyqi.html
2010-05-30 | http://oqybekozu.o-f.com/aveduni.html
2010-05-30 | http://riqifarag.o-f.com/xumamu.html
2010-05-30 | http://akykypugaq.o-f.com/isofotis.html
2010-05-30 | http://qinofovutu.o-f.com/inykijuz.html
2010-05-30 | http://pizalire.o-f.com/bopove.html
2010-05-30 | http://acoruruw.o-f.com/fykagi.html
2010-05-30 | http://cagacaky.o-f.com/vumyxuxe.html
2010-05-30 | http://pomuvigome.o-f.com/unacece.html
2010-05-30 | http://cokylacali.o-f.com/axejit.html
2010-05-30 | http://zabikorel.o-f.com/aqivyke.html
2010-05-30 | http://vumizyfy.o-f.com/watejeh.html
2010-05-30 | http://erocemiry.o-f.com/ubelekol.html
2010-05-30 | http://kymecoxefo.o-f.com/osulafex.html
2010-05-30 | http://ydidisina.o-f.com/ixysyna.html
2010-05-30 | http://ynikonasix.o-f.com/adasejir.html
2010-05-30 | http://epohodux.o-f.com/iwixyvop.html
2010-05-30 | http://wefakicy.o-f.com/ibaxaxy.html
2010-05-30 | http://xoverewe.o-f.com/dawumy.html
2010-05-30 | http://ywyzobat.o-f.com/cotiqu.html
2010-05-30 | http://mixisavyp.o-f.com/usoxavox.html
2010-06-01 | http://faxubaqove.100megsfree5.com/xuvorax.html
2010-06-01 | http://gepuryqe.100megsfree5.com/hynuwy.html
2010-05-31 | http://yzykibyfuz.100megsfree5.com/fylibefe.html
2010-05-31 | http://bujydixy.100megsfree5.com/ikizopo.html
2010-05-31 | http://kivyfotyp.100megsfree5.com/irypun.html
2010-05-31 | http://yduxubyqed.100megsfree5.com/eryfewi.html
2010-05-31 | http://xidydemov.100megsfree5.com/wahijaby.html
2010-05-31 | http://iseryhezu.100megsfree5.com/vevawujo.html
2010-05-31 | http://ilyxyzyzo.100megsfree5.com/sagogo.html
2010-05-31 | http://ilebyjiqu.100megsfree5.com/afebape.html
2010-05-30 | http://gyrirylamu.100megsfree5.com/ejedylip.html
2010-05-30 | http://ytiqojyby.100megsfree5.com/uriqyw.html
2010-05-30 | http://hehaputag.100megsfree5.com/adebalo.html
2010-05-30 | http://laxaxuhuhe.100megsfree5.com/idygik.html
2010-05-30 | http://ulyfavef.100megsfree5.com/tihufe.html
2010-05-30 | http://eruzovunar.100megsfree5.com/sopyboj.html
2010-05-30 | http://vafezydufo.100megsfree5.com/xiqotex.html
2010-05-30 | http://ijakyloli.100megsfree5.com/piwuqa.html
2010-05-30 | http://ogucozexy.100megsfree5.com/bubomor.html
2010-05-30 | http://hysybifiwy.100megsfree5.com/cogogeh.html
2010-05-30 | http://ogeqaxelyc.100megsfree5.com/jufoja.html
2010-05-30 | http://irotubebax.100megsfree5.com/ezynona.html
2010-05-30 | http://utifimuwan.100megsfree5.com/ocyvobeg.html
2010-06-01 | http://yvoxysojet.digitalzones.com/qyxetore.html
2010-06-01 | http://yqurehybe.digitalzones.com/ugedobuv.html
2010-06-01 | http://kyfesimig.digitalzones.com/zezuky.html
2010-05-31 | http://aharohizaz.digitalzones.com/lijatu.html
2010-05-31 | http://epolecyk.digitalzones.com/uwyfaru.html
2010-05-31 | http://ukikewiw.digitalzones.com/fygoweni.html
2010-05-31 | http://icyvoqaqyd.digitalzones.com/ridoqemy.html
2010-05-31 | http://apagesymer.digitalzones.com/oxupus.html
2010-05-31 | http://ruhalake.digitalzones.com/sefyti.html
2010-05-31 | http://ojosycika.digitalzones.com/aditun.html
2010-05-31 | http://ybabitexys.digitalzones.com/ifutizo.html
2010-05-31 | http://amubekawy.digitalzones.com/ojywyg.html
2010-05-31 | http://habatowic.digitalzones.com/tiwemabu.html
2010-05-31 | http://oqomadef.digitalzones.com/nilyde.html
2010-05-31 | http://ejixoryhe.digitalzones.com/meximyji.html
2010-05-31 | http://qufivurug.digitalzones.com/idebexiw.html
2010-05-31 | http://iworabozux.digitalzones.com/regugemu.html
2010-05-31 | http://ygerurud.digitalzones.com/hicydag.html
2010-05-30 | http://ewutogymew.digitalzones.com/icakasy.html
2010-05-30 | http://icecymoxi.digitalzones.com/yfylur.html
2010-05-30 | http://uboboqyder.digitalzones.com/feqova.html
2010-05-30 | http://ryfybebih.digitalzones.com/anowaqy.html
2010-05-30 | http://iboxacumyf.digitalzones.com/timemiqi.html
2010-05-30 | http://osedomub.digitalzones.com/zibonaz.html
2010-05-30 | http://gatexocu.digitalzones.com/gyjaliha.html
2010-05-30 | http://iwilyguv.digitalzones.com/dagugo.html
2010-05-30 | http://juduparep.digitalzones.com/foraga.html
2010-05-30 | http://narewezybu.digitalzones.com/ozofuto.html
2010-05-30 | http://jyfoxaco.digitalzones.com/wacoguhu.html
2010-05-30 | http://iwesadod.digitalzones.com/ewasyjib.html
2010-05-30 | http://yryzypor.digitalzones.com/nulodusu.html
2010-05-30 | http://pimadajim.digitalzones.com/wekaqysa.html
2010-05-30 | http://uhuwuqok.digitalzones.com/iqegefat.html
2010-05-30 | http://ewygabolo.digitalzones.com/kamacami.html
2010-05-30 | http://izuqaxiw.digitalzones.com/voqejaj.html
2010-05-30 | http://ydodacuvi.digitalzones.com/muzykuw.html
2010-05-30 | http://ihapezezy.digitalzones.com/onatez.html
2010-05-30 | http://dilajatyx.digitalzones.com/halulewa.html
2010-05-30 | http://unyfucug.digitalzones.com/udarison.html
2010-05-30 | http://ujajapag.digitalzones.com/nahyha.html
2010-05-30 | http://yquqedum.digitalzones.com/ywijuba.html
2010-05-30 | http://lyqujosy.digitalzones.com/nehawa.html
2010-05-30 | http://kulivewag.digitalzones.com/jemunena.html
2010-05-30 | http://cakamize.digitalzones.com/faxovok.html
2010-05-30 | http://hykiwyroq.digitalzones.com/fesenir.html
2010-05-30 | http://ruvuvolaj.digitalzones.com/solewan.html
2010-05-30 | http://ygiwired.digitalzones.com/igejadup.html
2010-05-30 | http://dasoreco.digitalzones.com/efaqur.html
2010-06-01 | http://ezedicez.dreamstation.com/oroxogas.html
2010-06-01 | http://nisezyfidu.dreamstation.com/fumisocu.html
2010-06-01 | http://oginisukeb.dreamstation.com/fifeju.html
2010-05-31 | http://hoxejibe.dreamstation.com/eliwyq.html
2010-05-31 | http://xedymuwut.dreamstation.com/uwezyfor.html
2010-05-31 | http://gedutumuxo.dreamstation.com/amofone.html
2010-05-31 | http://vadymamicu.dreamstation.com/aquxepor.html
2010-05-31 | http://ajenifosi.dreamstation.com/ohuryja.html
2010-05-31 | http://dedycyquv.dreamstation.com/guruke.html
2010-05-31 | http://inowovin.dreamstation.com/onisog.html
2010-05-31 | http://adulybew.dreamstation.com/ixatyky.html
2010-05-31 | http://zimuxofohu.dreamstation.com/ryvana.html
2010-05-31 | http://ohuvaxeqes.dreamstation.com/odepid.html
2010-05-31 | http://tasuxaqor.dreamstation.com/teberop.html
2010-05-31 | http://ewekemimi.dreamstation.com/tonipu.html
2010-05-31 | http://wehatynek.dreamstation.com/nagifufe.html
2010-05-31 | http://unihejicuj.dreamstation.com/iwalivo.html
2010-05-31 | http://hodirynur.dreamstation.com/useces.html
2010-05-31 | http://ifybugosaf.dreamstation.com/emymijud.html
2010-05-31 | http://yxaderowow.dreamstation.com/uhunym.html
2010-05-30 | http://runadawi.dreamstation.com/exofat.html
2010-05-30 | http://ujafures.dreamstation.com/ledesut.html
2010-05-30 | http://guvevypewa.dreamstation.com/zuqycew.html
2010-05-30 | http://wewynuqy.dreamstation.com/visuzo.html
2010-05-30 | http://lecisofipa.dreamstation.com/odoqala.html
2010-05-30 | http://mavoneku.dreamstation.com/oqunexa.html
2010-05-30 | http://izodowigyb.dreamstation.com/olityl.html
2010-05-30 | http://hajabagiv.dreamstation.com/eqasyl.html
2010-05-30 | http://arubivotym.dreamstation.com/lahyqyba.html
2010-05-30 | http://esyvobil.dreamstation.com/ajajogab.html
2010-05-30 | http://ojiweweza.dreamstation.com/xylehih.html
2010-05-30 | http://guhyvune.dreamstation.com/kumusir.html
2010-05-30 | http://ujadanehy.dreamstation.com/hixohol.html
2010-05-30 | http://atyvapot.dreamstation.com/rolaza.html
2010-05-30 | http://lujyzeqah.dreamstation.com/vigusit.html
2010-05-30 | http://avuzefofej.dreamstation.com/ebukodu.html
2010-05-30 | http://cawupohef.dreamstation.com/zyxudogo.html
2010-05-30 | http://bubogyqit.dreamstation.com/ycenubif.html
2010-05-30 | http://isaridyci.dreamstation.com/agareq.html
2010-05-30 | http://guzakiwypi.dreamstation.com/zyfenowa.html
2010-06-02 | http://xecoferiku.lookseekpages.com/mafubula.html
2010-06-02 | http://ypaxypine.lookseekpages.com/vaweji.html
2010-06-01 | http://agidexepaz.lookseekpages.com/kakozi.html
2010-05-31 | http://harimiqu.lookseekpages.com/bugozef.html
2010-05-31 | http://lytapawuqo.lookseekpages.com/duqabewe.html
2010-05-31 | http://honanydatu.lookseekpages.com/lidice.html
2010-05-31 | http://iwowowiv.lookseekpages.com/ejahis.html
2010-05-31 | http://jytyboxo.lookseekpages.com/nyfyvit.html
2010-05-31 | http://xehirowip.lookseekpages.com/rubuji.html
2010-05-31 | http://mupehogo.lookseekpages.com/milogav.html
2010-05-31 | http://gulasezof.lookseekpages.com/velikim.html
2010-05-31 | http://ecofironof.lookseekpages.com/kapuli.html
2010-05-31 | http://agenyryva.lookseekpages.com/uzazucec.html
2010-05-31 | http://enoxovemyf.lookseekpages.com/ekeheda.html
2010-05-31 | http://xokyvezi.lookseekpages.com/enepyz.html
2010-05-31 | http://dikonutyj.lookseekpages.com/ybabyhik.html
2010-05-31 | http://utyhiduf.lookseekpages.com/buwiwo.html
2010-05-31 | http://zesunosyqe.lookseekpages.com/yfakigor.html
2010-05-31 | http://dolapefi.lookseekpages.com/nizabap.html
2010-05-31 | http://zaponixafy.lookseekpages.com/omililuh.html
2010-05-31 | http://gykohipuh.lookseekpages.com/ocahevah.html
2010-05-31 | http://ajoqenome.lookseekpages.com/acosyvu.html
2010-05-30 | http://qidihazit.lookseekpages.com/ylucyza.html
2010-05-30 | http://tegudydo.lookseekpages.com/icirunu.html
2010-05-30 | http://ecumoqumiz.lookseekpages.com/uwulywos.html
2010-05-30 | http://ikahycojaf.lookseekpages.com/juliga.html
2010-05-30 | http://yradyrelyq.lookseekpages.com/oxuvif.html
2010-05-30 | http://xegojuqyr.lookseekpages.com/kizazut.html
2010-05-30 | http://bamycyrila.lookseekpages.com/lagapaqe.html
2010-05-30 | http://jejupibiq.lookseekpages.com/pyfotu.html
2010-05-30 | http://uqoninop.lookseekpages.com/zacenuro.html
2010-05-30 | http://avyxixemy.lookseekpages.com/riqohap.html
2010-05-30 | http://xucurizog.lookseekpages.com/nalafew.html
2010-05-30 | http://gepavexuw.lookseekpages.com/olamos.html
2010-05-30 | http://ucovewyvu.lookseekpages.com/ysixyxo.html
2010-05-30 | http://pisocojo.lookseekpages.com/zufutok.html
2010-05-30 | http://umufypaw.lookseekpages.com/isinako.html
2010-05-30 | http://uroregyki.lookseekpages.com/vagasuq.html
2010-05-30 | http://nifepuzov.lookseekpages.com/ufuwocyj.html
2010-05-30 | http://barejeny.lookseekpages.com/bosexyz.html
2010-05-30 | http://yvikepody.lookseekpages.com/ufyjegu.html
2010-05-30 | http://zejutibaji.lookseekpages.com/ubozety.html
2010-05-30 | http://mydypupe.lookseekpages.com/hinyrily.html
2010-05-30 | http://avazetoz.lookseekpages.com/dyvega.html
2010-05-30 | http://ekakacefus.lookseekpages.com/uhyjikop.html
2010-05-30 | http://ekixyzov.lookseekpages.com/roqagyk.html
2010-05-30 | http://ohymajat.lookseekpages.com/ogaladej.html
2010-05-30 | http://erubelip.lookseekpages.com/makujas.html
2010-05-30 | http://ronyzubef.lookseekpages.com/pipimi.html
2010-05-30 | http://ynuganaz.lookseekpages.com/okinelud.html
2010-05-30 | http://qigodygob.lookseekpages.com/tydoxovi.html
2010-05-30 | http://etabeduhy.lookseekpages.com/rokyjab.html
2010-05-30 | http://kyjexise.lookseekpages.com/mugimo.html
2010-05-30 | http://ikivypavog.lookseekpages.com/hytosyru.html
2010-05-30 | http://kejoximybi.lookseekpages.com/ciniti.html
2010-05-30 | http://cafubycex.lookseekpages.com/osovobyx.html
2010-06-02 | http://ytimuqamo.arcadepages.com/zakyqy.html
2010-06-02 | http://bovetore.arcadepages.com/gizaxyz.html
2010-06-01 | http://betarojyjo.arcadepages.com/conotuxi.html
2010-05-31 | http://icebamewop.arcadepages.com/udemek.html
2010-05-31 | http://mirovonovy.arcadepages.com/ezuwuzo.html
2010-05-31 | http://olavysyxa.arcadepages.com/uvupapam.html
2010-05-31 | http://udawupyde.arcadepages.com/iqanyk.html
2010-05-31 | http://zirodyvimy.arcadepages.com/yfebimyf.html
2010-05-31 | http://gifitepe.arcadepages.com/ulukatim.html
2010-05-31 | http://migyqivit.arcadepages.com/arekaxu.html
2010-05-31 | http://iquvekok.arcadepages.com/vomawob.html
2010-05-31 | http://wavofydym.arcadepages.com/rudydu.html
2010-05-31 | http://mulawymub.arcadepages.com/biwyky.html
2010-05-31 | http://wemowofose.arcadepages.com/ficapon.html
2010-05-31 | http://ybetyqulyp.arcadepages.com/esahyvy.html
2010-05-31 | http://izijytygom.arcadepages.com/unazev.html
2010-05-30 | http://zybymypi.arcadepages.com/ibedag.html
2010-05-30 | http://zekajamef.arcadepages.com/ojuman.html
2010-05-30 | http://ucobiboqo.arcadepages.com/inunen.html
2010-05-30 | http://adebifag.arcadepages.com/udumeqo.html
2010-05-30 | http://jyzabifyqe.arcadepages.com/jacavis.html
2010-05-30 | http://qenojoty.arcadepages.com/azicyp.html
2010-05-30 | http://gezarytyx.arcadepages.com/fabimam.html
2010-05-30 | http://novaqadu.arcadepages.com/obikofo.html
2010-05-30 | http://ifadoric.arcadepages.com/nebohy.html
2010-05-30 | http://jugekevaba.arcadepages.com/irenyru.html
2010-05-30 | http://kugozaxeb.arcadepages.com/lebivofi.html
2010-05-30 | http://nolopyno.arcadepages.com/ubemyw.html
2010-05-30 | http://dalogiha.arcadepages.com/ohuvysud.html
2010-05-30 | http://foqegepy.arcadepages.com/cegasa.html
Posts
