Monday, August 18, 2014

Counterfeit Legal Notices continue to spread malware

Counterfeit legal notices continue to spread malware

Today a friend mentioned that they had seen several ASProx messages being distributed by domains that looked like law firm names warning of court appearances. I was a bit surprised that this was news to him, as we've been seeing this for some time. I thought it might be interesting to try to identify when the campaign began.

First, I was fairly certain that the campaign my friend referred to was the "Notice to appear" spam that we've written about so many times at Malcovery, but this does seem to be a bit different than the "law firm of the day" notice to appear campaigns we've seen imitating groups like Green Winick and many others including Jones Day (jonesday.com), Latham Watkins (lw.com), Hogan Lovells (hoganlovells.com), McDermitt, Will & Emery (wme.com). Those campaigns were all examples of the ASProx malware. But how are those different than the "truck lawyer" campaigns? It seemed worth taking a look.

For the month of August 2014, so far the daily count on these spam messages has looked like this:

 count |    date    
-------+------------
  1528 | 2014-08-01
   204 | 2014-08-02
  1375 | 2014-08-04
  1670 | 2014-08-05
  1571 | 2014-08-06
  1967 | 2014-08-07
  1541 | 2014-08-08
   129 | 2014-08-09
     1 | 2014-08-10
  1182 | 2014-08-11
  1399 | 2014-08-12
   191 | 2014-08-13
    58 | 2014-08-14
    25 | 2014-08-15
     1 | 2014-08-16
    21 | 2014-08-18
(16 rows)
While many of the campaigns used subject lines that included randomization, quite a few subjects did not, including these:

11727  Urgent court notice
11693  Hearing of your case in Court
11182  Notice to appear
9935  Notice of appearance in court
8424  Notice to Appear
7433  Notice of appearance
7108  Notice to appear in court
6612  Notice to Appear in Court
 643  Court hearing notice
 568  Pretrial notice
 441  Mandatory court appearance
We've seen more than 200 different "law" names involved in this campaign, including many "truck" related law domain names. Here's the batch so far just in August:

  count |                            sender_domain                            
-------+---------------------------------------------------------------------
     7 | accidentlawyers505.com
     1 | addictionrecoverylawyers.com
   328 | alabamatruckaccidentlawyers.com
   375 | alaskatruckaccidentlawyers.com
   352 | albanycountyelderlawyers.com
    11 | americanaccidentlawyers.com
     8 | anewgenerationoflawyers.com
    17 | arizonaspecialedlawyers.com
   363 | arizonatruckaccidentlawyers.com
   358 | arkansastruckaccidentlawyers.com
    12 | auburnbankruptcylawyers.com
    11 | aviationlawyersnetwork.com
   387 | az-lawyersadvice.com
     6 | bellevuebankruptcylawyers.com
   379 | bensonlawyers.com
     1 | bestlawyersinphoenix.com
     8 | bestlosangeleslawyers.com
   355 | best-ontario-lawyers.com
   361 | biofuelawyers.com
   360 | bronx-injury-lawyers.com
   316 | bronx-personal-injury-lawyers.com
    15 | brooklynelderlawyers.com
   371 | brooklyn-lawyers.com
    12 | bvslawyers.com
   326 | calgarydependentadultlawyers.com
   356 | californiatruckaccidentlawyers.com
   299 | californiaviolentcrimeslawyers.com
     5 | canadianduilawyers.com
   362 | capeannlawyers.com
   311 | caraccidentlawyerskc.com
     8 | career-lawyers.com
   318 | childsupportlawyerslosangeles.com
    13 | colobklawyers.com
   409 | coloradotruckaccidentlawyers.com
   395 | columbus-dui-lawyers.com
     9 | commoninterestlawyers.com
   326 | compasslawyers.com
   390 | connecticuttruckaccidentlawyers.com
    14 | contracosta-caraccident-lawyers.com
    17 | criminalcourtlawyers.com
   334 | criminaldefenselawyers360.com
     4 | crownpointindianawilltrustsprobateestatelderlawattorneyslawyers.com
     9 | csduilawyers.com
     5 | deferredstatuslawyers.com
   401 | delawaretruckaccidentlawyers.com
     1 | divorcelawyersinjacksonvillefl.com
     8 | drugcrimedefenselawyers.com
     5 | dubairealestatelawyers.com
     4 | easternnclawyers.com
    11 | employmentlawyersfortlauderdale.com
    10 | ernestolawyers.com
    10 | escortdefenselawyers.com
     1 | estateprotectionlawyers.com
    12 | falveylawyers.com
   354 | familylawyersoforangecounty.com
    10 | fla-injury-lawyers-blog.com
     9 | fl-criminal-defense-lawyers.com
    10 | fl-criminal-lawyers-blog.com
     7 | fllawyersonline.com
    11 | florida-criminal-defense-lawyers.com
     9 | floridaseniorlawyersassoc.com
   370 | floridatruckaccidentlawyers.com
    15 | fortmyersrealestatelawyers.com
    12 | garzalawyers.com
     9 | gatewaylawyers.com
   388 | georgiatruckaccidentlawyers.com
    12 | gofindlawyers.com
    13 | greatnecklawyersassociation.com
    10 | hartfordctlawyers.com
   361 | hawaiitruckaccidentlawyers.com
     9 | hcvlawyers.com
   351 | highdesertlawyers.com
     7 | hounslowlawyers.com
   372 | houstonmesotheliomalawyers.com
     6 | hphlawyersonbloor.com
     9 | huntingtonaccidentlawyers.com
   385 | idahotruckaccidentlawyers.com
    13 | illinoisbicyclelawyers.com
   347 | illinoistruckaccidentlawyers.com
   308 | immlawyers.com
   330 | indianatruckaccidentlawyers.com
     7 | indy-lawyers.com
     5 | institutionalinvestorlawyers.com
   352 | iowatruckaccidentlawyers.com
   340 | kansastruckaccidentlawyers.com
   300 | kentuckytruckaccidentlawyers.com
     9 | kentuckyyounglawyers.com
   337 | lakelanddivorcelawyers.com
    12 | lancasterautoaccidentlawyers.com
     1 | lawusa.com
     6 | lawyeringforlawyers.com
   311 | lawyersadviceinarizona.com
   350 | lawyersadviceinphoenix.com
     8 | lawyersandloans.com
    14 | lawyersbankruptcysolutions.com
     9 | lawyersbocaraton.com
    11 | lawyerscaringforamerica.com
     7 | lawyerscaringforarizona.com
     8 | lawyerscfo.com
   393 | lawyers-connecting.com
     7 | lawyersforeclosuresolutions.com
     8 | lawyers-germany.com
     8 | lawyersinbalance.com
    15 | lawyersinthecloud.com
     3 | lawyerslawfirms.com
     7 | lawyerslongisland.com
    14 | lawyersonlineguide.com
    13 | lawyerstaxsolutions.com
     1 | lawyersthatrock.com
     5 | lawyersvirtualbookkeeper.com
    10 | lawyerswithdepression.com
    11 | loan-modification-lawyers.com
   364 | long-island-lawyers.com
   356 | louisianatruckaccidentlawyers.com
    11 | mailfrauddefenselawyers.com
   376 | mainetruckaccidentlawyers.com
    10 | malpracticelawyersnewyorkcity.com
   329 | manhattan-injury-lawyers.com
   362 | manhattan-personal-injury-lawyers.com
   318 | marylandtruckaccidentlawyers.com
   807 | massachusettstruckaccidentlawyers.com
    10 | medicalmalpraticelawyers.com
   388 | mesotheliomalawyersonline.com
   402 | michigantruckaccidentlawyers.com
     8 | millbrooklawyers.com
   398 | minnesotatruckaccidentlawyers.com
   374 | mississippitruckaccidentlawyers.com
   361 | missouritruckaccidentlawyers.com
     8 | mitpatentlawyers.com
    11 | mittrademarklawyers.com
     7 | mmspersonalinjurylawyers.com
   374 | montanatruckaccidentlawyers.com
    12 | mylawyersolicitors.com
    14 | myreallawyers.com
     7 | naplesbusinesslawyers.com
   373 | nassau-county-lawyers.com
   329 | nebraskaboatinjurylawyers.com
   315 | nebraskatruckaccidentlawyers.com
     1 | nebraskatruckaccidentlawyers.com.com
   351 | nevadatruckaccidentlawyers.com
   384 | newhampshiretruckaccidentlawyers.com
   398 | newjerseytruckaccidentlawyers.com
   370 | newmexicotruckaccidentlawyers.com
   365 | new-york-city-lawyers.com
     9 | newyorkscaffoldlawyers.com
   393 | newyorktruckaccidentlawyers.com
   339 | njlandlordtenantlawyers.com
   351 | northcarolinatruckaccidentlawyers.com
   377 | northdakotatruckaccidentlawyers.com
   284 | nyautoaccidentlawyers.com
   312 | nycaraccidentlawyers.com
    14 | ohadoptionlawyers.com
   383 | ohiotruckaccidentlawyers.com
   344 | oklahomatruckaccidentlawyers.com
   404 | oregon-lawyers.com
   373 | oregontruckaccidentlawyers.com
    11 | palmbayinjurylawyers.com
     8 | panamacitysocialsecuritydisabilityclaimlawyers.com
   321 | phoenixlawyersadvice.com
     8 | pittsburgaccidentlawyers.com
    12 | poptodorova-lawyers.com
     1 | portstlucie-duilawyers.com
    11 | prescriptiondiversiondefenselawyers.com
    17 | probateadministrationlawyers.com
   314 | productsliabilitylawyers360.com
     9 | refineryfirelawyers.com
   356 | rhodeislandtruckaccidentlawyers.com
    13 | robberydefenselawyers.com
   361 | rockland-county-lawyers.com
   343 | saintpaulinjurylawyers.com
    11 | seattlesbestduilawyers.com
     9 | seattle-trial-lawyers.com
    11 | sfmesolawyers.com
   401 | southcarolinatruckaccidentlawyers.com
   396 | southdakotatruckaccidentlawyers.com
     6 | southfloridaworkerscompensationlawyers.com
   316 | southhamptoninjurylawyers.com
   368 | staten-island-lawyers.com
   358 | stentinjurylawyers.com
    14 | success4lawyers.com
   324 | suffolk-county-lawyers.com
     7 | tacomabankruptcylawyers.com
   386 | tennesseetruckaccidentlawyers.com
    13 | thebusinessgrowthlawyers.com
   362 | thechicago-deportationlawyers.com
   307 | the-consumer-lawyers.com
    12 | thelawyerscfo.com
    12 | themauilawyers.com
   333 | thenationstoplawyers.com
     8 | topmultimilliondollartriallawyers.com
   294 | trivalleylawyers.com
   325 | tuscaloosa-lawyers.com
   359 | utahtruckaccidentlawyers.com
   326 | vermonttruckaccidentlawyers.com
   338 | villanuevalawyers.com
     6 | virginia-non-compete-lawyers.com
     7 | virginianoncompetelawyers.com
   395 | virginiatruckaccidentlawyers.com
   361 | washingtontruckaccidentlawyers.com
   338 | westchester-county-lawyers.com
   379 | westvirginiatruckaccidentlawyers.com
     1 | westvirginiatruckaccidentlawyers.com.com
     1 | whsbf-law.com
   386 | wisconsintruckaccidentlawyers.com
    12 | wolfegrouplawyers.com
     8 | wrongfulldeathlawyers.com
   377 | wyomingtruckaccidentlawyers.com
   283 | yourvegaslawyers.com
(208 rows)
This group tends to have email addresses that were a single word followed by three digits, so we use those to search in the Spam Data Mine:

([account|answer|confirmation|customer|customercare|customersupport|
customerservice|custservice|custsupport|details|dontreply|help|
identdep|infonum|login|mail|no-reply|noreply|onlinesupport|operate|
operator|reference|reply|security|support|supprefnum|time|update|
verification|][0-9]{3})

From June 1, 2014 to August 18, 2014 more than 25,000 different combinations of the above were used in emails that sent email to the Malcovery Spam Data Mine.

The attached .zip files during that period of time, when unpacked, revealed 39,571 distinct executables, all of which are variants of the "Kuluoz" or "DoFoil" malware.

Because of the apparent polymorphic nature of many of the samples, where each binary is unique, I've only shared the hashes of the non-polymorphic versions - where the same binary was used many times. If the final column is clickable, the link shows the VirusTotal detection rate at the time of our original reporting.

A recent trend in these file names is that the first character, which looks like the letter "C" is actually the Russian "S", a cyrillic look alike for our "C", expressed with the characters: С (ampersand, pound sign, 1057, semicolon). When the word "Court" is spelled with the Cyrillic S instead, a search for the word "Court" will not find it! Here is the word Court twice, first with a "C" and then with the cyrillic equivalent: Court Сourt

CountDateFilenameFilesizeMD5 (VT Link)
50 2014-03-07 Copy_Court_Notice.exe178688 55a60b91143c5c91849237f8e6bc3235
31 2014-03-07 Copy_Court_Notice.exe78447 6f8a65b02fea37530af50e65483300db
48 2014-03-10 Copy_Court_Notice.exe81400 13b519634c4a03001122def3f471616a
31 2014-03-10 Copy_Court_Notice.exe78446 1f9570e4b628f81578ae0fb03cddd137
33 2014-03-11 Court_Notice_Copy.exe140800 202a8720eddc389b91fb4d398df95da0
29 2014-03-11 Court_Notice_Copy.exe181248 49723312b73067e66b0f4db453231825
41 2014-03-11 Court_Notice_Copy.exe144384 8cd13060037ddd790c41a4ea4b209a06
34 2014-03-12 Court_Notice_Copy.exe78447 bc08d0c5f5a5e4e6a199fce5e243e8aa
43 2014-03-20 Court_Notice_Copy_doc.exe82856 0a2be62df1320b4f20d4777f7b69f1a4
34 2014-03-20 Court_Notice_Copy_doc.exe81395 1c549f6bc1afcfd7f0af9b2e3ada1e9f
29 2014-03-20 Court_Notice_Copy_doc.exe178688 786cb67c6f8409ce1933bb838e80d2a8
29 2014-03-20 Court_Notice_Copy_doc.exe78198 861530485284fc46c37b41400810477a
49 2014-03-20 Court_Notice_Copy_doc.exe78447 93b678cbcc583079cf7e0082910fc51f
50 2014-03-20 Court_Notice_Copy_doc.exe183808 99fc4dbc2082ee2d111086affd2c623e
29 2014-03-21 Court_Notice_Copy_doc.exe178688 040196c76bc37ede48262dddbb871df6
50 2014-03-21 Court_Notice_Copy_doc.exe78967 305bcd56a92c0ecfbe0a498bb920ea89
49 2014-03-21 Court_Notice_Copy_doc.exe181248 546608757bde754251975a5deefff67f
30 2014-03-21 Court_Notice_Copy_doc.exe181248 6e3021203febb924372c87af1d239b26
27 2014-03-21 Court_Notice_Copy_doc.exe78199 d4f214e94467070e09fac5f762769f39
39 2014-03-22 Court_Notice_Copy_doc.exe82265 e7175f3ac0f29146967da11375528d4f
159 2014-03-26 Court_Notice.exe181248 68c8cd0bde8b38780a2d2d7862f4e02d
27 2014-03-27 Court_Notice.exe114176 8b1fa6be2aa31212fe15cee8c4e0cedb
3634 2014-03-28 Court_Notice_Copy.exe177152 096402c1e21da0df9465511b600a135e
2244 2014-03-28 Court_Notice_Copy.exe110080 27c7f219798ad65b158dd9c4b4658743
1685 2014-03-31 Court_Notice_Copy.exe211968 36b3d44816b933c2a3c2000ed50d4685
3378 2014-03-31 Court_Notice_Copy.exe103936 d185a21bf355ad67b8e75e0ecb28acb8
6037 2014-04-01 Court_Notice_Copy.exe148480 4adee84193b467d0ea2a2a64e4767586
446 2014-04-02 Court_Notice_Copy.exe209920 3368e248a76a7b7d090d0ce7cb7335be
2183 2014-04-03 Court_Notice_Copy_03-04-14_AP.exe143360 790cba7836b71b666592891f7bf75b32
2698 2014-04-03 Court_Notice_Copy_03-04-14_AP.exe201216 7f268ff0850a623de27dbb835d13cd60
2248 2014-04-04 Court_Notice_Copy_04-04-14_AP.exe133120 0ef2108030990e2f8914639b3c1d2098
2049 2014-04-04 Court_Notice_Copy_04-04-14_AP.exe141312 24826d752ee438e78d689b5416170cd9
3657 2014-04-07 Court_Notice_Copy_07-04-14_AP.exe110592 52e5589b6fe5be00a3959e0da2d08413
1841 2014-04-07 Court_Notice_Copy_07-04-14_AP.exe146944 a1e0804d0bbc17b895194d88a61c85e4
1338 2014-04-08 Court_Notice_Copy_08-04-14_AP.exe110080 66b286f769753a9e51695205ae07ffb8
2165 2014-04-09 Court_Notice_Copy_09-04-14_AP.exe139264 7e28325f5bc307646097a1481512f726
228 2014-04-09 Court_Notice_Copy_09-04-14.exe216064 bccc5c02d4341de68dc5195497e5a909
38 2014-05-07 Court_Notice_Date_May-7_2014CV-D.exe181248 e3cbfdd4dfa6561e22e19177a4f60e7a
75 2014-05-08 Court_Notice_May-8_Date_2014FHK.exe181248 648401ae4f3b5f2f7f9198a2fc3fe072
106 2014-05-09 Court_Notice_May-9_Date_2014FHK.exe150016 413d43f0e5431b58de0d37d4fc5dd333
79 2014-05-09 Court_Notice_May-9_Date_2014FHK.exe78447 b6029ee57a3f6b8ca73fb1699106d9cf
255 2014-05-12 Court_Notice_May-12_Date_2014_FEN.exe178176 512c867583c1ba6cdf8857bdd8d84ff9
263 2014-05-12 Court_Notice_May-12_Date_2014_FES.exe108544 5752260d7e2ac9e57083792a5f87e4ce
197 2014-05-13 Court_Notice_May-13_Date_2014_A-DC.exe141312 530eed9bc14c386b10d38c77bef44a4d
167 2014-05-13 Court_Notice_May-13_Date_2014_D-SER-N.exe144384 b15932cb2a15f06de49773400c6e1f07
41 2014-05-14 Court_Notice_May-14_Date_2014_EXL-DC.exe150016 41d7b395ca4dd5b3150b35be4fad3737
51 2014-05-14 Court_Notice_May-14_Date_2014_.exe78200 71ab11b81995e8dd94b9c04813b95c04
54 2014-05-15 Court_Notice_May-15_Date_2014_EN_DOC_.exe139264 723770d9cff199c400ea0d472736428e
182 2014-05-15 Court_Notice_May-15_Date_2014_TN_DOC_.exe82857 f5a4690f12f64bbf4944980060dc56ec
120 2014-05-16 Court_Notice_May-16_Date_2014_ID-SER_DOC.exe78447 1bb1d62749258f4813c4cd1d1b62d92d
188 2014-05-16 Court_Notice_May-15_Date_2014_SE-ANDC_.exe108032 5e9b56bc10e7c1a5fcb26615de7f5923
94 2014-05-19 Court_Notice_May-19_Date_DOC-SER_2014.exe108032 fbcb2407e676c095b53196c630f16d9e
69 2014-05-19 Court_Notice_May-19_Date_DF-SER_2014.exe81396 fc89720c573184b6b0c740025bd8f0be
192 2014-05-20 Court_Notice_May-20_Date_IN-FN_2014.exe220672 110a0bc676dc2094ebaf8faad0423461
133 2014-05-20 Court_Notice_May-20_Date_EN-RM_2014.exe177152 76bd89ff3141fef1345053881797392a
147 2014-05-21 Court_Notice_May-21_Date_EN-RT_2014.exe78200 243d37f8fc6efac0a2e99d198af01d54
149 2014-05-21 Court_Notice_May-21_Date_EN-RT_2014.exe78445 8a70b33c64c5b48c9691f0ddc7826bbe
119 2014-05-22 Court_Notice_May-22_Date_DCSER-LS_2014.exe181248 08f2f21aae0c2917c19dbbe70842bf8e
111 2014-05-22 Court_Notice_May-22_2014_EN-OP.exe181248 46a6f5a0a8c2f31477cb5812f094640d
107 2014-05-22 Court_Notice_May-22_Date_DCSER-LS_2014.exe78447 d2d84503d4f43e8abeab158a351df290
286 2014-05-23 Court_Notice_May-23_Date_2014_SER-ERN-DC.exe209408 51e12bec75e8d5a0b2e434a45b7e1c67
599 2014-05-28 Plaint_Note_May-28_Date_FN-SE-DC_2014.exe209920 797f8d6da6c1ca6a6f3f60c257d9f6c5
1090 2014-06-09 DC_Court_Notice_June-09_Date_2014-SER.exe109568 7fb418b6c4ec42ca1ccc4c372293169e
1091 2014-06-10 Court_Notice_June-10_Date_2014-ID.exe229888 01535c6f5594790e458e011dc4cd7a3d
746 2014-06-10 DOC_Court_Notice_June-10_Date_2014-SER.exe109568 169e683b948ae1bce6a45350201b427d
727 2014-06-11 SR_Court_Notice_June-11_Date_2014-ID_DC.exe109568 f1542e83f0577f9d54370d9778074371
1009 2014-06-12 Court_Notice_June-12_Date_2014-DC.exe105472 9395698fbfcaa1f5b297c01e4aa52e1c
445 2014-06-13 SR_Court_Notice_June-13_Date_2014-DOC-NR.exe105472 0bc400ab22ab5fd82a3408477d7f20dd
809 2014-06-16 Detailed_Document_FAX_June-16_Date_2014_DOID.exe111104 3c5a4968f70f0883971d312f7f97d4a4
1059 2014-06-17 Detailed_Document_ID7723H_June-17_Date_2014_SRID.exe77824 55226242da24299345b45fb46751764a
700 2014-06-18 Doc_Court_Agent_Date_June-18-2014Y.exe77312 b0cae006c23ca33c36daecd32f50d9fc
1076 2014-06-19 Copy_of_document_Date_June-19-2014.exe74752 d6b9982d1b3abcb4530a7abd6a063944
27 2014-06-20 Copy_of_document_Date_June-20-2014.exe74752 73f03523e4c14ca55a92dce91b958ba1
262 2014-06-23 Copy_of_document_Date_June-23-2014.exe76800 c5b6a4c546be34642141660e7a0dbb1e
169 2014-06-24 Copy_of_document_Date_June-24-2014.exe76800 0829817d83d583f5a55075dc0017ef52
209 2014-06-25 Copy_of_document_Date_June-25-2014.exe76800 8c920901eca575593f580531e44ea62f
311 2014-07-04 Copy_of_document_Date_July-04-2014.exe80384 50daa5c135d5ad2da3b2c8a8dd4c3f50
496 2014-07-14 Copy_of_document_July-14-2014.exe135168 559fd034d76e45aec67be49c2f93cfae
552 2014-07-15 Copy_of_document_July-15-2014.exe135168 80aff3257ec4f6f7bd5e5259ea08815e
584 2014-07-16 Copy_of_document_July-16-2014.exe135168 cc19a778b730d310a1bea1518bdc7a6f
704 2014-07-17 Copy_of_document_July-17-2014.exe135168 b43e9210da3e06dc2b88ae028a13d8c5
526 2014-07-18 Copy_of_document_July-18-2014.exe139264 1531f529f73d79f1cf4dd1d6a7426429
614 2014-07-22 Copy_of_document_July-22-2014.exe135168 3c3944f52d194fd86d12ebccb2c7cf85
623 2014-07-23 Copy_of_document_July-23-2014.exe135168 046f9dbedcf03749d0e7ae5cc120897d
600 2014-07-24 Copy_of_document_July-24-2014.exe135168 a1eb4a25be83c770f38203fcc64f9419
717 2014-07-25 Copy_of_document_July-10-2014.exe135168 35850cfececd274ee5f182bd64c221ab
370 2014-07-28 Copy_of_document_July-28-2014.exe135168 6edec50da5540820682387c71434d209
613 2014-07-29 Copy_of_document_July-29-2014.exe106496 2f8a429f6e005cecc25f9bb86f4211dc
555 2014-07-30 Copy_of_document_July-30-2014.exe110592 529e7348bca26b22d0b42a7fe6c63e8d
604 2014-07-31 Copy_of_document_July-31-2014.exe106496 b2c8662858ed7a8c052a080b03ca26b2
806 2014-08-01 Copy_of_document_August-01-2014.exe102400 2ca1e3d6312c3f844de919caec77fc1f
711 2014-08-04 Copy_of_document_August-04-2014.exe110592 6c83a7e471421899141e7e13a635abbd
973 2014-08-05 Copy_of_document_August-05-2014.exe143360 1463aaa9b393a1591df049534e9f9ddd
734 2014-08-06 Copy_of_document_August-06-2014.exe106496 49985d6ae2805c2301bd941c783991e4
447 2014-08-07 Copy_of_document_August-07-2014.exe127488 659f348503f30952f19816e2afb1e595
447 2014-08-07 Сopy_of_Document_ID4923.zip75375 802529cf5a1c85eb0389f9e0e0f309da
826 2014-08-08 Copy_of_document_August-08-2014.exe106496 804f0d437f3c500c9d5a340d4f783b6b
4 2014-08-11 Copy_of_document_August-11-2014.exe118272 2fc5cc07700d3eacd0d063f93aebfa14
768 2014-08-11 Copy_of_document_August-11-2014.exe104448 ebb9e152618e4b0a871aceb1966b8f85
4 2014-08-11 Copy_of_document_August-11-2014.exe118272 ffa9f70e72fb7eea06fea313ef979502
739 2014-08-12 Copy_of_document_August-12-2014.exe103424 c6a53a80b7425215d2f32332e2721a49
22 2014-08-13 Copy_of_document_August-13-2014.exe113152 6bb5e1502b8cdfaa5ae78238cee7ab85
36 2014-08-14 Copy_of_document_August-14-2014.exe94720 956f9551579314bbe74e55fbdbe4b869
14 2014-08-15 Copy_of_document_August-15-2014.exe90624 d38c3aa977745be341ae26e439d8e111
15 2014-08-18 Copy_of_document_August-18-2014.exe92672 49aef017ad8880a7b4d24c8190acc068

16 comments:

  1. I received one today from custservice367@caraccidentlawyerskc.com.
    Trolling bot through my website e-mail.

    ReplyDelete
  2. From: Court Agent (customerssupport721@stentinjurylawyers.com) Microsoft SmartScreen

    ReplyDelete
  3. I received one today from online_support397@prescriptiondiversiondefenselawyers.com, the email has an attachment of "Note_6654_copy.zip". I tried to open but it won't let me open.

    ReplyDelete
  4. Received this today.

    Notice to Appear (customer147@mylawyersolicitors.com)

    10:27 AM

    1 attachment (72.6 KB)
    Download Note_8534_copy.zip (72.6 KB)
    Note_8534_copy.zip

    Notice to Appear,

    The copy of the court notice is attached to this letter.
    Please, read it thoroughly.

    Truly yours,
    Clerk to the Court,
    Amelia Smith

    ReplyDelete
  5. I received this in my junk mail yesterday

    Notice to Appear (online-support613@garzalawyers.com)
    Add to contacts
    Attachment
    13/10/2014

    ReplyDelete
  6. I received one a few days ago from account272@employmentlawyersfortlauderdale.com. I looked into the website and it's registered to an immigration lawyer in Florida named Yuri Tsyganov.

    ReplyDelete
  7. I keep getting ones from this - panamacitysocialsecuritydisabilityclaimlawyers.com

    Panama City is the first part of the address, so I would suppose it is a scam from Panama?

    ReplyDelete
  8. reference601@mesotheliomalawyersonline.com Notice to Appear,

    ReplyDelete
  9. I got this today from : saintpaulinjurylawyers.com notice to appear with a zip drive

    ReplyDelete
  10. I got this today : Notice to appear from : saintpaulinjurylawyers.com

    ReplyDelete
  11. Notice to appear - verification123@familylawyersoforangecounty.com

    ReplyDelete
  12. Got this today: Notice to Appear (reference741@nebraskatruckaccidentlawyers.com)

    ReplyDelete
  13. Got this on 11/14 in my Junk Mail - Notice to Appear (time706@pittsburgaccidentlawyers.com)

    Notice to Appear,

    The copy of the court notice is attached to this letter.
    Please, read it thoroughly.

    Truly yours,
    Clerk to the Court,
    Amelia Mason

    ReplyDelete
  14. In my experience, lawyers don't usually communicate with people via email, and they don't ask for private information that way either. Usually they'll ask you to come in if any paperwork is required. As always, whenever someone solicits you for information over the internet, you should be cautious. When in doubt, just give the other party a phone call to help verify the email's authenticity. http://www.bbo.on.ca

    ReplyDelete
  15. I received this in my junk mail yesterday.




    Law Hounslow

    ReplyDelete
  16. I have one titled "Notice of appearance in Court #00000828407" with the email address of: walter.duke@judcred.org.br.

    It contains a file titled "Court_Notification_00000828407.zip"

    My AVG antivirus wouldn't let me open it, searching online discovered this blog. Just thought I would give you a heads up.

    ReplyDelete

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.