Federal Reserve Spam

Last week the big malware-spreading spam claimed to be from NACHA and warned about problems with an ACH money transfer. The same bad guys are at it again, this week pretending to be the Federal Reserve bank.

The UAB Spam Data Mine has received more than 3500 copies of the spam email messages, primarily using the subject lines:

Wire Transfer #12976271232523 (a random number on each email)
Wire transfer 0430972006146 was canceled (a random number on each email)
Wire transfer was canceled
Wire transfer was rejected
Your Wire fund transfer
Your Wire Transfer
Your Wire Transfer #2491786220489 (a random number on each email)
Your Wire Transfer, ID544349843700 (a random number on each email)

The senders of the email message varied between one of five choices:

alert@federalreserve.gov
alerts@federalreserve.gov
fedwire@federalreserve.gov
info@federalreserve.gov
information@federalreserve.gov

As before, someone with a Yahoo email address had their account used on GoDaddy to register ".info" domains to be used in this campaign. This time, we have spam samples for 487 of them.

Both GoDaddy and Afilias have excellent abuse staffs, and the domains in question were quickly terminated.

count | machine
-------+----------------------------------
8 | A-WIREBLOG.INFO
8 | AWIRE.INFO
5 | A-WIRENOW.INFO
6 | A-WIREONLINE.INFO
11 | A-WIRESHOP.INFO
4 | A-WIRESITE.INFO
7 | A-WIRESTORE.INFO
8 | A-WIRETODAY.INFO
4 | BESTA-WIRE.INFO
10 | BESTD-WIRE.INFO
9 | BESTFEDERALWIRE.INFO
6 | BESTFEDWIRE-B.INFO
2 | BESTFEDWIRE-E.INFO
8 | BESTFEDWIRE-M.INFO
8 | BESTFEDWIRE-N.INFO
9 | BESTFEDWIRE-O.INFO
5 | BESTFEDWIRE-Q.INFO
10 | BESTFEDWIRE-R.INFO
4 | BESTFEDWIRE-T.INFO
14 | BESTFEDWIRE-U.INFO
7 | BESTFEDWIRE-Y.INFO
9 | BESTI-WIRE.INFO
5 | BESTP-WIRE.INFO
6 | BESTU-WIRE.INFO
8 | BESTWIREORGANISATION.INFO
4 | BESTWIREREPORTTRANSFER.INFO
5 | BESTWIRETRANSFERMONEY.INFO
6 | BESTX-WIRE.INFO
4 | BESTZ-ACH.INFO
7 | BESTZ-WIRE.INFO
11 | COPPER-WIRE-ORGANISATION.INFO
6 | COPPERWIREORGANISATION.INFO
8 | COPPER-WIRE-REPORT-TRANSFER.INFO
8 | COPPERWIREREPORTTRANSFER.INFO
5 | COPPERWIRETRANSFERMONEY.INFO
3 | CUSTOMWIREORGANISATION.INFO
13 | D-WIREBLOG.INFO
7 | DWIRECABLE.INFO
10 | DWIRECLOTH.INFO
10 | DWIREDIAMETER.INFO
8 | D-WIRE-FENCE.INFO
5 | DWIREFENCE.INFO
8 | DWIREFORMING.INFO
5 | D-WIRE.INFO
7 | DWIREMANUFACTURER.INFO
12 | D-WIRENOW.INFO
7 | D-WIREONLINE.INFO
3 | DWIRESHELF.INFO
9 | D-WIRESHOP.INFO
11 | D-WIRES.INFO
9 | D-WIRESITE.INFO
10 | D-WIRESTORE.INFO
9 | DWIRESUPPLIERS.INFO
6 | DWIRETECH.INFO
8 | D-WIRETODAY.INFO
7 | ELECTRICALWIRETRANSFERMONEY.INFO
9 | FEDERALWIREBLOG.INFO
8 | FEDERALWIRECABLE.INFO
7 | FEDERALWIRECLOTH.INFO
8 | FEDERALWIREDIAMETER.INFO
8 | FEDERAL-WIRE-FENCE.INFO
6 | FEDERALWIREFENCE.INFO
9 | FEDERALWIREFORMING.INFO
9 | FEDERAL-WIRE.INFO
6 | FEDERALWIRE.INFO
7 | FEDERALWIRENOW.INFO
5 | FEDERALWIREONLINE.INFO
6 | FEDERALWIRESHELF.INFO
6 | FEDERALWIRESHOP.INFO
6 | FEDERALWIRES.INFO
5 | FEDERALWIRESITE.INFO
8 | FEDERALWIRESIZES.INFO
8 | FEDERALWIRESTORE.INFO
9 | FEDERALWIRETECH.INFO
9 | FEDERALWIRETODAY.INFO
8 | FEDWIREANDBLUE.INFO
8 | FEDWIREANDSAVE.INFO
8 | FEDWIREANDSILVER.INFO
4 | FEDWIREANDSONS.INFO
12 | FEDWIREANDSOUL.INFO
2 | FEDWIREANDSTYLE.INFO
7 | FEDWIREANDTRAVEL.INFO
10 | FEDWIRE-BBLOG.INFO
8 | FEDWIRE-BE-CONNECTED.INFO
6 | FEDWIREBECONNECTED.INFO
10 | FEDWIRE-BE-COOL.INFO
7 | FEDWIREBECOOL.INFO
11 | FEDWIRE-BE.INFO
10 | FEDWIREBE.INFO
7 | FEDWIRE-B.INFO
8 | FEDWIREB.INFO
6 | FEDWIRE-BNOW.INFO
7 | FEDWIRE-BONLINE.INFO
8 | FEDWIRE-B-RICH.INFO
7 | FEDWIREBRICH.INFO
7 | FEDWIRE-BSHOP.INFO
3 | FEDWIRE-BS.INFO
7 | FEDWIRE-BSITE.INFO
6 | FEDWIRE-BSTORE.INFO
8 | FEDWIRE-BTODAY.INFO
5 | FEDWIRE-EBLOG.INFO
6 | FEDWIRE-E.INFO
8 | FEDWIREE.INFO
5 | FEDWIRE-E-MINOR.INFO
7 | FEDWIREEMINOR.INFO
6 | FEDWIRE-ENOW.INFO
9 | FEDWIRE-EONLINE.INFO
4 | FEDWIRE-ESHOP.INFO
9 | FEDWIRE-ES.INFO
10 | FEDWIRE-ESITE.INFO
5 | FEDWIRE-ESTORE.INFO
4 | FEDWIRE-ETODAY.INFO
11 | FEDWIRE-M-BASKETBALL.INFO
6 | FEDWIREMBASKETBALL.INFO
10 | FEDWIRE-MBLOG.INFO
4 | FEDWIRE-M.INFO
12 | FEDWIREM.INFO
13 | FEDWIRE-MNOW.INFO
4 | FEDWIRE-MONLINE.INFO
7 | FEDWIRE-MSHOP.INFO
3 | FEDWIRE-MS.INFO
3 | FEDWIRE-MSITE.INFO
3 | FEDWIRE-MSTORE.INFO
12 | FEDWIRE-MTODAY.INFO
6 | FEDWIRE-M-WARD.INFO
7 | FEDWIREMWARD.INFO
12 | FEDWIRE-NBLOG.INFO
9 | FEDWIRE-N.INFO
3 | FEDWIREN.INFO
5 | FEDWIRE-NNOW.INFO
4 | FEDWIRE-NONLINE.INFO
4 | FEDWIRE-N-SCALE.INFO
16 | FEDWIRENSCALE.INFO
6 | FEDWIRE-NSHOP.INFO
3 | FEDWIRE-NS.INFO
5 | FEDWIRE-NSITE.INFO
4 | FEDWIRE-NSTORE.INFO
11 | FEDWIRE-NTODAY.INFO
6 | FEDWIRE-OBLOG.INFO
5 | FEDWIRE-O-HENRY.INFO
7 | FEDWIREOHENRY.INFO
8 | FEDWIRE-O.INFO
5 | FEDWIREO.INFO
6 | FEDWIRE-ONOW.INFO
13 | FEDWIRE-OONLINE.INFO
11 | FEDWIRE-OSHOP.INFO
9 | FEDWIRE-OS.INFO
11 | FEDWIRE-OSITE.INFO
4 | FEDWIRE-OSTORE.INFO
8 | FEDWIRE-O-TICKET.INFO
5 | FEDWIREOTICKET.INFO
7 | FEDWIRE-OTODAY.INFO
9 | FEDWIRE-Q-AUDIO.INFO
5 | FEDWIREQAUDIO.INFO
9 | FEDWIRE-Q-AWARDS.INFO
10 | FEDWIREQAWARDS.INFO
7 | FEDWIRE-QBLOG.INFO
9 | FEDWIRE-Q-CELL.INFO
5 | FEDWIREQCELL.INFO
9 | FEDWIRE-Q-FEVER.INFO
9 | FEDWIREQFEVER.INFO
6 | FEDWIRE-Q.INFO
5 | FEDWIRE-Q-MAGAZINE.INFO
6 | FEDWIREQMAGAZINE.INFO
8 | FEDWIRE-QNOW.INFO
5 | FEDWIRE-QONLINE.INFO
8 | FEDWIRE-QSHOP.INFO
9 | FEDWIRE-QS.INFO
5 | FEDWIRE-QSITE.INFO
6 | FEDWIRE-QSTORE.INFO
12 | FEDWIRE-QTODAY.INFO
5 | FEDWIRE-RBLOG.INFO
5 | FEDWIRE-R.INFO
5 | FEDWIRER.INFO
8 | FEDWIRE-R-KELLY.INFO
3 | FEDWIRERKELLY.INFO
13 | FEDWIRE-RNOW.INFO
7 | FEDWIRE-RONLINE.INFO
3 | FEDWIRE-RSHOP.INFO
11 | FEDWIRE-RS.INFO
7 | FEDWIRE-RSITE.INFO
8 | FEDWIRE-RSTORE.INFO
5 | FEDWIRE-RTODAY.INFO
7 | FEDWIRE-TBLOG.INFO
6 | FEDWIRE-T-CELLS.INFO
12 | FEDWIRETCELLS.INFO
7 | FEDWIRE-T.INFO
9 | FEDWIRET.INFO
8 | FEDWIRE-T-MAGAZINE.INFO
6 | FEDWIRETMAGAZINE.INFO
4 | FEDWIRE-TNOW.INFO
9 | FEDWIRE-TONLINE.INFO
6 | FEDWIRE-T-PAIN.INFO
8 | FEDWIRETPAIN.INFO
8 | FEDWIRE-TSHOP.INFO
6 | FEDWIRE-TS.INFO
5 | FEDWIRE-TSITE.INFO
5 | FEDWIRE-TSTORE.INFO
14 | FEDWIRE-TTODAY.INFO
4 | FEDWIRE-UBLOG.INFO
11 | FEDWIRE-U.INFO
9 | FEDWIREU.INFO
12 | FEDWIRE-UNOW.INFO
12 | FEDWIRE-UONLINE.INFO
10 | FEDWIRE-USHOP.INFO
10 | FEDWIRE-US.INFO
5 | FEDWIRE-USITE.INFO
10 | FEDWIRE-USTORE.INFO
3 | FEDWIRE-UTODAY.INFO
7 | FEDWIRE-YBLOG.INFO
6 | FEDWIRE-Y-CAMP.INFO
7 | FEDWIREYCAMP.INFO
10 | FEDWIRE-Y.INFO
9 | FEDWIREY.INFO
6 | FEDWIRE-YNOW.INFO
7 | FEDWIRE-YONLINE.INFO
7 | FEDWIRE-YOU-CANT.INFO
8 | FEDWIREYOUCANT.INFO
6 | FEDWIRE-YOU.INFO
9 | FEDWIREYOU.INFO
9 | FEDWIRE-YOU-ROCK.INFO
10 | FEDWIREYOUROCK.INFO
2 | FEDWIRE-YOU-SAVE.INFO
4 | FEDWIREYOUSAVE.INFO
12 | FEDWIREYOUTUBE.INFO
5 | FEDWIRE-YSHOP.INFO
5 | FEDWIRE-YS.INFO
7 | FEDWIRE-YSITE.INFO
7 | FEDWIRE-YSTORE.INFO
8 | FEDWIRE-YTODAY.INFO
4 | FREEA-WIRE.INFO
7 | FREED-WIRE.INFO
9 | FREEFEDERALWIRE.INFO
8 | FREEFEDWIRE-B.INFO
7 | FREEFEDWIRE-E.INFO
9 | FREEFEDWIRE-M.INFO
5 | FREEFEDWIRE-N.INFO
7 | FREEFEDWIRE-O.INFO
2 | FREEFEDWIRE-Q.INFO
5 | FREEFEDWIRE-R.INFO
8 | FREEFEDWIRE-T.INFO
13 | FREEFEDWIRE-U.INFO
14 | FREEFEDWIRE-Y.INFO
7 | FREEI-WIRE.INFO
5 | FREEP-WIRE.INFO
8 | FREEU-WIRE.INFO
5 | FREEWIREORGANISATION.INFO
9 | FREEWIREREPORTTRANSFER.INFO
4 | FREEWIRETRANSFERMONEY.INFO
8 | FREEX-WIRE.INFO
7 | FREEZ-ACH.INFO
6 | FREEZ-WIRE.INFO
5 | GAUGEWIREORGANISATION.INFO
5 | GAUGEWIRETRANSFERMONEY.INFO
7 | I-MOBILE-WIRE.INFO
8 | IMOBILEWIRE.INFO
5 | IRONWIREORGANISATION.INFO
5 | IRONWIREREPORTTRANSFER.INFO
7 | IRONWIRETRANSFERMONEY.INFO
6 | I-WIREBLOG.INFO
10 | IWIREHOMES.INFO
8 | I-WIRE.INFO
7 | I-WIRE-INTERACTIVE.INFO
5 | IWIREINTERACTIVE.INFO
10 | IWIRENETWORKS.INFO
10 | I-WIRENOW.INFO
11 | I-WIREONLINE.INFO
7 | I-WIRESHOP.INFO
2 | I-WIRES.INFO
7 | I-WIRESITE.INFO
8 | I-WIRESTORE.INFO
14 | I-WIRE-TECH.INFO
5 | IWIRETECH.INFO
11 | I-WIRETODAY.INFO
7 | METALWIREORGANISATION.INFO
6 | METALWIREREPORTTRANSFER.INFO
6 | METALWIRETRANSFERMONEY.INFO
6 | MYA-WIRE.INFO
3 | MYD-WIRE.INFO
8 | MYFEDERALWIRE.INFO
12 | MYFEDWIRE-B.INFO
5 | MYFEDWIRE-E.INFO
13 | MYFEDWIRE-M.INFO
8 | MYFEDWIRE-N.INFO
10 | MYFEDWIRE-O.INFO
4 | MYFEDWIRE-Q.INFO
11 | MYFEDWIRE-R.INFO
11 | MYFEDWIRE-T.INFO
10 | MYFEDWIRE-U.INFO
11 | MYFEDWIRE-Y.INFO
7 | MYI-WIRE.INFO
6 | MYP-WIRE.INFO
5 | MYU-WIRE.INFO
12 | MYWIREORGANISATION.INFO
7 | MYWIREREPORTTRANSFER.INFO
9 | MYWIRETRANSFERMONEY.INFO
5 | MYX-WIRE.INFO
9 | MYZ-ACH.INFO
7 | MYZ-WIRE.INFO
4 | NEWA-WIRE.INFO
6 | NEWD-WIRE.INFO
5 | NEWFEDERALWIRE.INFO
12 | NEWFEDWIRE-B.INFO
5 | NEWFEDWIRE-E.INFO
12 | NEWFEDWIRE-M.INFO
7 | NEWFEDWIRE-N.INFO
7 | NEWFEDWIRE-O.INFO
8 | NEWFEDWIRE-Q.INFO
10 | NEWFEDWIRE-R.INFO
5 | NEWFEDWIRE-T.INFO
11 | NEWFEDWIRE-U.INFO
5 | NEWFEDWIRE-Y.INFO
6 | NEWI-WIRE.INFO
7 | NEWP-WIRE.INFO
18 | NEWU-WIRE.INFO
12 | NEWWIREORGANISATION.INFO
9 | NEWWIREREPORTTRANSFER.INFO
8 | NEWWIRETRANSFERMONEY.INFO
3 | NEWX-WIRE.INFO
6 | NEWZ-ACH.INFO
10 | NEWZ-WIRE.INFO
11 | PRECISIONWIREORGANISATION.INFO
3 | P-WIREBLOG.INFO
10 | PWIRECABLE.INFO
8 | PWIRECLOTH.INFO
4 | PWIREDIAMETER.INFO
8 | P-WIRE-FENCE.INFO
3 | PWIREFENCE.INFO
7 | PWIREFORMING.INFO
2 | P-WIRE.INFO
11 | PWIRE.INFO
9 | PWIREMANUFACTURER.INFO
8 | P-WIRENOW.INFO
9 | P-WIREONLINE.INFO
7 | PWIRESHELF.INFO
6 | P-WIRESHOP.INFO
7 | P-WIRES.INFO
12 | P-WIRESITE.INFO
7 | P-WIRESTORE.INFO
6 | PWIRESUPPLIERS.INFO
4 | P-WIRETODAY.INFO
6 | RESISTANCEWIRETRANSFERMONEY.INFO
7 | RIDINGTHEWIRE.INFO
12 | ROME-X-WIRE.INFO
9 | SILVERWIRETRANSFERMONEY.INFO
10 | SPOT-I-WIRE.INFO
11 | SPOTIWIRE.INFO
4 | STEEL-WIRE-ORGANISATION.INFO
9 | STEELWIREORGANISATION.INFO
3 | STEEL-WIRE-REPORT-TRANSFER.INFO
9 | STEELWIREREPORTTRANSFER.INFO
5 | STEELWIRETRANSFERMONEY.INFO
7 | THEA-WIRE.INFO
7 | THEDETROITWIRE.INFO
7 | THED-WIRE.INFO
3 | THEFEDERALWIRE.INFO
11 | THEFEDWIRE-B.INFO
5 | THEFEDWIRE-E.INFO
8 | THEFEDWIRE-M.INFO
7 | THEFEDWIRE-N.INFO
5 | THEFEDWIRE-O.INFO
7 | THEFEDWIRE-Q.INFO
6 | THEFEDWIRE-R.INFO
9 | THEFEDWIRE-T.INFO
3 | THEFEDWIRE-U.INFO
12 | THEFEDWIRE-Y.INFO
9 | THEI-WIRE.INFO
7 | THEP-WIRE.INFO
4 | THERIDEWIRE.INFO
2 | THEU-WIRE.INFO
11 | THEWIREDOGS.INFO
6 | THEWIREGUYS.INFO
6 | THE-WIRE.INFO
5 | THEWIREORGANISATION.INFO
14 | THEWIREREPORTTRANSFER.INFO
1 | THEWIRETRANSFERMONEY.INFO
10 | THEX-WIRE.INFO
10 | THEZ-ACH.INFO
6 | THEZ-WIRE.INFO
6 | TRAVEL-A-WIRE.INFO
10 | TRAVELAWIRE.INFO
12 | U-WIREBLOG.INFO
7 | UWIRECABLE.INFO
11 | UWIRECLOTH.INFO
9 | UWIREDIAMETER.INFO
7 | U-WIRE-FENCE.INFO
9 | UWIREFENCE.INFO
9 | UWIREFORMING.INFO
9 | U-WIRE.INFO
9 | UWIREMANUFACTURER.INFO
4 | U-WIRENOW.INFO
8 | U-WIREONLINE.INFO
9 | UWIRESHELF.INFO
7 | U-WIRESHOP.INFO
8 | U-WIRES.INFO
8 | U-WIRESITE.INFO
8 | U-WIRESTORE.INFO
5 | UWIRESUPPLIERS.INFO
6 | UWIRETECH.INFO
3 | U-WIRETODAY.INFO
6 | WALKINGTHEWIRE.INFO
12 | WIREORGANISATIONBLOG.INFO
10 | WIRE-ORGANISATION.INFO
5 | WIREORGANISATION.INFO
5 | WIREORGANISATIONNOW.INFO
9 | WIREORGANISATIONONLINE.INFO
6 | WIREORGANISATIONSHOP.INFO
5 | WIREORGANISATIONS.INFO
3 | WIREORGANISATIONSITE.INFO
9 | WIREORGANISATIONSTORE.INFO
6 | WIREORGANISATIONTODAY.INFO
7 | WIREREPORTCARDSTRANSFER.INFO
6 | WIRE-REPORT-CARD-TRANSFER.INFO
7 | WIREREPORTCARDTRANSFER.INFO
4 | WIREREPORTTRANSFERBLOG.INFO
11 | WIRE-REPORT-TRANSFER.INFO
6 | WIREREPORTTRANSFER.INFO
4 | WIREREPORTTRANSFERNOW.INFO
6 | WIREREPORTTRANSFERONLINE.INFO
4 | WIREREPORTTRANSFERSHOP.INFO
10 | WIREREPORTTRANSFERS.INFO
6 | WIREREPORTTRANSFERSITE.INFO
2 | WIREREPORTTRANSFERSTORE.INFO
7 | WIREREPORTTRANSFERTODAY.INFO
5 | WIRETRANSFERMONEYBLOG.INFO
13 | WIRE-TRANSFER-MONEY.INFO
7 | WIRETRANSFERMONEY.INFO
7 | WIRETRANSFERMONEYNOW.INFO
7 | WIRETRANSFERMONEYONLINE.INFO
7 | WIRETRANSFERMONEYSHOP.INFO
9 | WIRETRANSFERMONEYS.INFO
6 | WIRETRANSFERMONEYSITE.INFO
10 | WIRETRANSFERMONEYSTORE.INFO
1 | WIRETRANSFERMONEYTODAY.INFO
7 | WIRETRANSFERSTATIONMONEY.INFO
3 | X-CABLE.INFO
4 | XCIRCUITBOARDS.INFO
6 | X-CIRCUIT.INFO
7 | XCIRCUIT.INFO
5 | X-CONNECTION.INFO
6 | XELECTRICALCONDUCTOR.INFO
6 | X-FILAMENT.INFO
7 | XFILAMENT.INFO
8 | X-WIREBLOG.INFO
6 | XWIRE.INFO
10 | X-WIRENOW.INFO
11 | X-WIREONLINE.INFO
8 | X-WIRESHOP.INFO
3 | X-WIRES.INFO
2 | X-WIRESITE.INFO
6 | X-WIRESTORE.INFO
2 | X-WIRETODAY.INFO
13 | Z-ACH-ACCOUNTS.INFO
5 | ZACHACCOUNTS.INFO
10 | Z-ACHBLOG.INFO
8 | Z-ACH.INFO
9 | Z-ACHNOW.INFO
16 | Z-ACHONLINE.INFO
6 | Z-ACH-PAYMENT.INFO
10 | ZACHPAYMENT.INFO
5 | Z-ACH-PAYMENTS.INFO
6 | ZACHPAYMENTS.INFO
5 | Z-ACHSHOP.INFO
4 | Z-ACHS.INFO
8 | Z-ACHSITE.INFO
6 | Z-ACHSTORE.INFO
4 | Z-ACHTODAY.INFO
4 | Z-ACH-TRANSACTIONS.INFO
10 | ZACHTRANSACTIONS.INFO
5 | ZCABLE.INFO
9 | ZCIRCUITBOARDS.INFO
9 | ZCIRCUIT.INFO
6 | ZCONNECTION.INFO
5 | ZFILAMENT.INFO
10 | ZLINESEGMENT.INFO
3 | ZLINETRAINS.INFO
3 | ZLINK.INFO
4 | Z-WIREBLOG.INFO
7 | Z-WIRE-INTERACTIVE.INFO
9 | ZWIREINTERACTIVE.INFO
6 | Z-WIRENOW.INFO
8 | Z-WIREONLINE.INFO
11 | Z-WIRESHOP.INFO
7 | Z-WIRES.INFO
13 | Z-WIRESITE.INFO
15 | Z-WIRESTORE.INFO
7 | Z-WIRETODAY.INFO
(487 rows)