The criminals believe (and from what we've seen, correctly) that when presented with the news that you just sent $100 to someone from your Paypal account, you will have a panic reaction and click on the link in the email. This is what they are counting on!
As you can see we got quite a few of these this morning:
The destination is NOT going to be Paypal. Don't click on the link, and tell your friends not to click on the link either! If they do, a bad set of malicious actions are set into motion.
This particular version of the campaign just started about 2.5 hours ago. Here are the number of messages we have seen so far:
count | mbox
-------+---------------------
22 | 2012-05-01 04:00:00
22 | 2012-05-01 04:15:00
312 | 2012-05-01 04:30:00
41 | 2012-05-01 04:45:00
15 | 2012-05-01 05:00:00
78 | 2012-05-01 05:15:00
241 | 2012-05-01 05:30:00
1 | 2012-05-01 05:45:00
210 | 2012-05-01 06:00:00
91 | 2012-05-01 06:15:00
(10 rows)
There are many hundreds of links that may have been advertised in your copy of this email, but don't click on ANY of them! In the example case that we checked, we followed a link to "globalsecurityservices.com" (yes, we like irony).
When the web page was visited, it immediately executed two remote javascript files (I've added spaces to "break" them):
script type="text/javascript" src="http:// laxana .org /1VxMC4Dy /js .js"
script type="text/javascript" src="http:// womaametw3 .com /CWTKosSw /js .js"
which redirected to an Exploit server that displayed this "Please Wait" sign while something more malicious was happening in the background.
The exploit kit dropped a Java "JAR" file that was launched in Java, taking advantage of a security hole, which then caused another executable file to download and install on the computer.
What was that executable? We're not sure yet, but your anti-virus product probably doesn't know either. At the time we submitted the malware to VirusTotal there were only 5 of 43 anti-virus products could label the malware as malicious. Although McAfee called it "Zbot" (PWS-Zbot.gen.ya, the anti-virus name for the Zeus Bot) Avast and one other vendor called it "Karagany" (Win32:Karagany-FS [Trj]).
The malware's MD5 was 4f58895af2b8f89bd90092f08fcbd54f and it was 33280 bytes in size.
Here's a link to the original VirusTotal report.
Previous Threats
This link is very closely linked to a "LinkedIn" spam campaign from yesterday. That campaign functioned in exactly the same manner, with the difference only in the spam campaign.
All of the domains listed below have been compromised by an attacker. Most likely the criminals have stolen the FTP userid and password of the criminal, allowing them to change the webmaster's content without the webmaster's knowledge. If you control or know the owner of one of these websites, let them know they have been hacked. They need to remove the content, scan any computers they use to access their website for malware, and change their password AFTER they get the malware cleaned up.
machine | path
-------------------------------+----------------------
cpaindia.net | /rHFbxKTn/index.html
dealaddict.ch | /bp9ksV54/index.html
dealaddict.ch | /N2rhmW5i/index.html
dealaddict.ch | /r1kVYAfU/index.html
dealaddict.ch | /vpW8hoZ6/index.html
depilee.com | /BzJoVeo0/index.html
depilee.com | /Lskx0Bew/index.html
depilee.com | /NdHgm0gT/index.html
depilee.com | /oZFZ0qJK/index.html
depilee.com | /pD2zHbBB/index.html
depilee.com | /vpW8hoZ6/index.html
depilee.com | /wcE0aK0J/index.html
depilee.com | /wjivLtgo/index.html
dpsdurgapur.com | /4RcYf6gB/index.html
dpsdurgapur.com | /7QLZuMme/index.html
dpsdurgapur.com | /bp9ksV54/index.html
dpsdurgapur.com | /BzJoVeo0/index.html
dpsdurgapur.com | /ErmgUouT/index.html
dpsdurgapur.com | /gj1W42Ee/index.html
dpsdurgapur.com | /i8ztSS5H/index.html
dpsdurgapur.com | /iaJ7FSBi/index.html
dpsdurgapur.com | /mKvc8Mh7/index.html
dpsdurgapur.com | /N2rhmW5i/index.html
dpsdurgapur.com | /NdHgm0gT/index.html
dpsdurgapur.com | /oZFZ0qJK/index.html
dpsdurgapur.com | /pD2zHbBB/index.html
dpsdurgapur.com | /rHFbxKTn/index.html
dpsdurgapur.com | /rzDZAsw7/index.html
dpsdurgapur.com | /t7xYVUJE/index.html
dpsdurgapur.com | /tLnW6jJT/index.html
dpsdurgapur.com | /UAtkgmot/index.html
dpsdurgapur.com | /UcL29wrU/index.html
dpsdurgapur.com | /vpW8hoZ6/index.html
dpsdurgapur.com | /wtQ8G0Ku/index.html
dpsdurgapur.com | /YhwvXGhk/index.html
dpsdurgapur.com | /zvo8ioak/index.html
enfoquescreativos.com | /4RcYf6gB/index.html
enfoquescreativos.com | /7NEM56yQ/index.html
enfoquescreativos.com | /7QLZuMme/index.html
enfoquescreativos.com | /bp9ksV54/index.html
enfoquescreativos.com | /BzJoVeo0/index.html
enfoquescreativos.com | /ddLvpeMu/index.html
enfoquescreativos.com | /DkM4v1PP/index.html
enfoquescreativos.com | /gj1W42Ee/index.html
enfoquescreativos.com | /N2rhmW5i/index.html
enfoquescreativos.com | /oZFZ0qJK/index.html
enfoquescreativos.com | /r1kVYAfU/index.html
enfoquescreativos.com | /Re3BMGVG/index.html
enfoquescreativos.com | /rHFbxKTn/index.html
enfoquescreativos.com | /RoScD8aq/index.html
enfoquescreativos.com | /rzDZAsw7/index.html
enfoquescreativos.com | /UAtkgmot/index.html
enfoquescreativos.com | /vpW8hoZ6/index.html
enfoquescreativos.com | /wjivLtgo/index.html
enfoquescreativos.com | /wtQ8G0Ku/index.html
enfoquescreativos.com | /YhwvXGhk/index.html
enfoquescreativos.com | /zvo8ioak/index.html
ftp.neez.com.br | /4RcYf6gB/index.html
ftp.neez.com.br | /7NEM56yQ/index.html
ftp.neez.com.br | /7QLZuMme/index.html
ftp.neez.com.br | /ErmgUouT/index.html
ftp.neez.com.br | /gj1W42Ee/index.html
ftp.neez.com.br | /mKvc8Mh7/index.html
ftp.neez.com.br | /NdHgm0gT/index.html
ftp.neez.com.br | /oZFZ0qJK/index.html
ftp.neez.com.br | /pSG1s2xs/index.html
ftp.neez.com.br | /Re3BMGVG/index.html
ftp.neez.com.br | /rzDZAsw7/index.html
ftp.neez.com.br | /t7xYVUJE/index.html
ftp.neez.com.br | /tLnW6jJT/index.html
ftp.neez.com.br | /UAtkgmot/index.html
ftp.neez.com.br | /UcL29wrU/index.html
ftp.neez.com.br | /wcE0aK0J/index.html
ftp.neez.com.br | /xXr3khjG/index.html
ftp.pousadaesmeralda.com.br | /4RcYf6gB/index.html
ftp.pousadaesmeralda.com.br | /bp9ksV54/index.html
ftp.pousadaesmeralda.com.br | /ddLvpeMu/index.html
ftp.pousadaesmeralda.com.br | /DkM4v1PP/index.html
ftp.pousadaesmeralda.com.br | /gj1W42Ee/index.html
ftp.pousadaesmeralda.com.br | /i8ztSS5H/index.html
ftp.pousadaesmeralda.com.br | /iaJ7FSBi/index.html
ftp.pousadaesmeralda.com.br | /Lskx0Bew/index.html
ftp.pousadaesmeralda.com.br | /mKvc8Mh7/index.html
ftp.pousadaesmeralda.com.br | /N2rhmW5i/index.html
ftp.pousadaesmeralda.com.br | /NdHgm0gT/index.html
ftp.pousadaesmeralda.com.br | /oZFZ0qJK/index.html
ftp.pousadaesmeralda.com.br | /pD2zHbBB/index.html
ftp.pousadaesmeralda.com.br | /pSG1s2xs/index.html
ftp.pousadaesmeralda.com.br | /r1kVYAfU/index.html
ftp.pousadaesmeralda.com.br | /Re3BMGVG/index.html
ftp.pousadaesmeralda.com.br | /rHFbxKTn/index.html
ftp.pousadaesmeralda.com.br | /rzDZAsw7/index.html
ftp.pousadaesmeralda.com.br | /UcL29wrU/index.html
ftp.pousadaesmeralda.com.br | /wcE0aK0J/index.html
ftp.pousadaesmeralda.com.br | /wjivLtgo/index.html
ftp.pousadaesmeralda.com.br | /wtQ8G0Ku/index.html
ftppousadaesmeralda.com.br | /ddLvpeMu/index.html
ftppousadaesmeralda.com.br | /Lskx0Bew/index.html
ftppousadaesmeralda.com.br | /oZFZ0qJK/index.html
ftppousadaesmeralda.com.br | /pSG1s2xs/index.html
ftppousadaesmeralda.com.br | /wjivLtgo/index.html
globesecurityservices.com | /4RcYf6gB/index.html
globesecurityservices.com | /6BrzkppT/index.html
globesecurityservices.com | /7NEM56yQ/index.html
globesecurityservices.com | /7QLZuMme/index.html
globesecurityservices.com | /bp9ksV54/index.html
globesecurityservices.com | /BzJoVeo0/index.html
globesecurityservices.com | /ddLvpeMu/index.html
globesecurityservices.com | /DkM4v1PP/index.html
globesecurityservices.com | /ErmgUouT/index.html
globesecurityservices.com | /gj1W42Ee/index.html
globesecurityservices.com | /i8ztSS5H/index.html
globesecurityservices.com | /iaJ7FSBi/index.html
globesecurityservices.com | /Lskx0Bew/index.html
globesecurityservices.com | /mKvc8Mh7/index.html
globesecurityservices.com | /NdHgm0gT/index.html
globesecurityservices.com | /oZFZ0qJK/index.html
globesecurityservices.com | /pD2zHbBB/index.html
globesecurityservices.com | /pSG1s2xs/index.html
globesecurityservices.com | /rHFbxKTn/index.html
globesecurityservices.com | /RoScD8aq/index.html
globesecurityservices.com | /rzDZAsw7/index.html
globesecurityservices.com | /t7xYVUJE/index.html
globesecurityservices.com | /tLnW6jJT/index.html
globesecurityservices.com | /UAtkgmot/index.html
globesecurityservices.com | /UcL29wrU/index.html
globesecurityservices.com | /vpW8hoZ6/index.html
globesecurityservices.com | /wcE0aK0J/index.html
globesecurityservices.com | /wjivLtgo/index.html
globesecurityservices.com | /wtQ8G0Ku/index.html
gpureappliances.com | /4RcYf6gB/index.html
gpureappliances.com | /6BrzkppT/index.html
gpureappliances.com | /7NEM56yQ/index.html
gpureappliances.com | /7QLZuMme/index.html
gpureappliances.com | /bp9ksV54/index.html
gpureappliances.com | /ddLvpeMu/index.html
gpureappliances.com | /DkM4v1PP/index.html
gpureappliances.com | /ErmgUouT/index.html
gpureappliances.com | /gj1W42Ee/index.html
gpureappliances.com | /Lskx0Bew/index.html
gpureappliances.com | /N2rhmW5i/index.html
gpureappliances.com | /NdHgm0gT/index.html
gpureappliances.com | /oZFZ0qJK/index.html
gpureappliances.com | /pD2zHbBB/index.html
gpureappliances.com | /r1kVYAfU/index.html
gpureappliances.com | /rHFbxKTn/index.html
gpureappliances.com | /RoScD8aq/index.html
gpureappliances.com | /rzDZAsw7/index.html
gpureappliances.com | /t7xYVUJE/index.html
gpureappliances.com | /UAtkgmot/index.html
gpureappliances.com | /vpW8hoZ6/index.html
gpureappliances.com | /wcE0aK0J/index.html
gpureappliances.com | /wtQ8G0Ku/index.html
gpureappliances.com | /xXr3khjG/index.html
gpureappliances.com | /YhwvXGhk/index.html
gpureappliances.com | /zvo8ioak/index.html
hitechsystems.org.in | /4RcYf6gB/index.html
hitechsystems.org.in | /7NEM56yQ/index.html
hitechsystems.org.in | /7QLZuMme/index.html
hitechsystems.org.in | /ddLvpeMu/index.html
hitechsystems.org.in | /DkM4v1PP/index.html
hitechsystems.org.in | /gj1W42Ee/index.html
hitechsystems.org.in | /Lskx0Bew/index.html
hitechsystems.org.in | /mKvc8Mh7/index.html
hitechsystems.org.in | /N2rhmW5i/index.html
hitechsystems.org.in | /NdHgm0gT/index.html
hitechsystems.org.in | /oZFZ0qJK/index.html
hitechsystems.org.in | /pD2zHbBB/index.html
hitechsystems.org.in | /pSG1s2xs/index.html
hitechsystems.org.in | /r1kVYAfU/index.html
hitechsystems.org.in | /Re3BMGVG/index.html
hitechsystems.org.in | /rHFbxKTn/index.html
hitechsystems.org.in | /RoScD8aq/index.html
hitechsystems.org.in | /rzDZAsw7/index.html
hitechsystems.org.in | /t7xYVUJE/index.html
hitechsystems.org.in | /UAtkgmot/index.html
hitechsystems.org.in | /UcL29wrU/index.html
hitechsystems.org.in | /vpW8hoZ6/index.html
hitechsystems.org.in | /wcE0aK0J/index.html
hitechsystems.org.in | /wjivLtgo/index.html
hitechsystems.org.in | /wtQ8G0Ku/index.html
hitechsystems.org.in | /xXr3khjG/index.html
hypernovamedia.com | /4RcYf6gB/index.html
hypernovamedia.com | /6BrzkppT/index.html
hypernovamedia.com | /7NEM56yQ/index.html
hypernovamedia.com | /7QLZuMme/index.html
hypernovamedia.com | /bp9ksV54/index.html
hypernovamedia.com | /BzJoVeo0/index.html
hypernovamedia.com | /DkM4v1PP/index.html
hypernovamedia.com | /ErmgUouT/index.html
hypernovamedia.com | /gj1W42Ee/index.html
hypernovamedia.com | /i8ztSS5H/index.html
hypernovamedia.com | /iaJ7FSBi/index.html
hypernovamedia.com | /Lskx0Bew/index.html
hypernovamedia.com | /mKvc8Mh7/index.html
hypernovamedia.com | /N2rhmW5i/index.html
hypernovamedia.com | /pD2zHbBB/index.html
hypernovamedia.com | /pSG1s2xs/index.html
hypernovamedia.com | /r1kVYAfU/index.html
hypernovamedia.com | /Re3BMGVG/index.html
hypernovamedia.com | /RoScD8aq/index.html
hypernovamedia.com | /t7xYVUJE/index.html
hypernovamedia.com | /tLnW6jJT/index.html
hypernovamedia.com | /UAtkgmot/index.html
hypernovamedia.com | /UcL29wrU/index.htm
hypernovamedia.com | /UcL29wrU/index.html
hypernovamedia.com | /vpW8hoZ6/index.html
hypernovamedia.com | /wcE0aK0J/index.html
hypernovamedia.com | /wjivLtgo/index.html
hypernovamedia.com | /xXr3khjG/index.html
hypernovamedia.com | /YhwvXGhk/index.html
hypernovamedia.com | /zvo8ioak/index.html
ilabph.com | /6BrzkppT/index.html
ilabph.com | /7NEM56yQ/index.html
ilabph.com | /BzJoVeo0/index.html
ilabph.com | /ddLvpeMu/index.html
ilabph.com | /ErmgUouT/index.html
ilabph.com | /gj1W42Ee/index.html
ilabph.com | /i8ztSS5H/index.html
ilabph.com | /iaJ7FSBi/index.html
ilabph.com | /Lskx0Bew/index.html
ilabph.com | /mKvc8Mh7/index.html
ilabph.com | /N2rhmW5i/index.html
ilabph.com | /NdHgm0gT/index.html
ilabph.com | /oZFZ0qJK/index.html
ilabph.com | /pD2zHbBB/index.html
ilabph.com | /pSG1s2xs/index.html
ilabph.com | /r1kVYAfU/index.html
ilabph.com | /Re3BMGVG/index.html
ilabph.com | /rHFbxKTn/index.html
ilabph.com | /RoScD8aq/index.html
ilabph.com | /rzDZAsw7/index.html
ilabph.com | /t7xYVUJE/index.html
ilabph.com | /tLnW6jJT/index.html
ilabph.com | /UAtkgmot/index.html
ilabph.com | /UcL29wrU/index.html
ilabph.com | /vpW8hoZ6/index.html
ilabph.com | /wcE0aK0J/index.html
ilabph.com | /wjivLtgo/index.html
ilabph.com | /wtQ8G0Ku/index.html
ilabph.com | /xXr3khjG/index.html
ilabph.com | /YhwvXGhk/index.html
jmexy.com | /4RcYf6gB/index.html
jmexy.com | /7QLZuMme/index.html
jmexy.com | /BzJoVeo0/index.html
jmexy.com | /ddLvpeMu/index.html
jmexy.com | /DkM4v1PP/index.html
jmexy.com | /ErmgUouT/index.html
jmexy.com | /gj1W42Ee/index.html
jmexy.com | /Lskx0Bew/index.html
jmexy.com | /mKvc8Mh7/index.html
jmexy.com | /N2rhmW5i/index.html
jmexy.com | /NdHgm0gT/index.html
jmexy.com | /r1kVYAfU/index.html
jmexy.com | /Re3BMGVG/index.html
jmexy.com | /rHFbxKTn/index.html
jmexy.com | /RoScD8aq/index.html
jmexy.com | /rzDZAsw7/index.html
jmexy.com | /tLnW6jJT/index.html
jmexy.com | /UAtkgmot/index.html
jmexy.com | /UcL29wrU/index.html
jmexy.com | /vpW8hoZ6/index.html
jmexy.com | /wcE0aK0J/index.html
jmexy.com | /wjivLtgo/index.html
jmexy.com | /wtQ8G0Ku/index.html
jmexy.com | /xXr3khjG/index.html
jmexy.com | /YhwvXGhk/index.html
jmexy.com | /zvo8ioak/index.html
justinbieber-fans.nixiweb.com | /6BrzkppT/index.html
justinbieber-fans.nixiweb.com | /7NEM56yQ/index.html
justinbieber-fans.nixiweb.com | /ddLvpeMu/index.html
justinbieber-fans.nixiweb.com | /DkM4v1PP/index.html
justinbieber-fans.nixiweb.com | /ErmgUouT/index.html
justinbieber-fans.nixiweb.com | /gj1W42Ee/index.html
justinbieber-fans.nixiweb.com | /iaJ7FSBi/index.html
justinbieber-fans.nixiweb.com | /Lskx0Bew/index.html
justinbieber-fans.nixiweb.com | /mKvc8Mh7/index.html
justinbieber-fans.nixiweb.com | /oZFZ0qJK/index.html
justinbieber-fans.nixiweb.com | /pD2zHbBB/index.html
justinbieber-fans.nixiweb.com | /pSG1s2xs/index.html
justinbieber-fans.nixiweb.com | /Re3BMGVG/index.html
justinbieber-fans.nixiweb.com | /rHFbxKTn/index.html
justinbieber-fans.nixiweb.com | /RoScD8aq/index.html
justinbieber-fans.nixiweb.com | /rzDZAsw7/index.html
justinbieber-fans.nixiweb.com | /t7xYVUJE/index.html
justinbieber-fans.nixiweb.com | /UcL29wrU/index.html
justinbieber-fans.nixiweb.com | /xXr3khjG/index.html
justinbieber-fans.nixiweb.com | /YhwvXGhk/index.html
justinbieber-fans.nixiweb.com | /zvo8ioak/index.html
mangalamcorporation.in | /4RcYf6gB/index.html
mangalamcorporation.in | /6BrzkppT/index.html
mangalamcorporation.in | /bp9ksV54/index.html
mangalamcorporation.in | /BzJoVeo0/index.html
mangalamcorporation.in | /ddLvpeMu/index.html
mangalamcorporation.in | /DkM4v1PP/index.html
mangalamcorporation.in | /gj1W42Ee/index.html
mangalamcorporation.in | /i8ztSS5H/index.html
mangalamcorporation.in | /iaJ7FSBi/index.html
mangalamcorporation.in | /mKvc8Mh7/index.html
mangalamcorporation.in | /N2rhmW5i/index.html
mangalamcorporation.in | /NdHgm0gT/index.html
mangalamcorporation.in | /oZFZ0qJK/indexhtml
mangalamcorporation.in | /oZFZ0qJK/index.html
mangalamcorporation.in | /pD2zHbBB/index.html
mangalamcorporation.in | /pSG1s2xs/index.html
mangalamcorporation.in | /r1kVYAfU/index.html
mangalamcorporation.in | /rHFbxKTn/index.html
mangalamcorporation.in | /RoScD8aq/index.html
mangalamcorporation.in | /rzDZAsw7/index.html
mangalamcorporation.in | /UAtkgmot/index.html
mangalamcorporation.in | /UcL29wrU/index.html
mangalamcorporation.in | /vpW8hoZ6/index.html
mangalamcorporation.in | /wcE0aK0J/index.html
mangalamcorporation.in | /xXr3khjG/index.html
mangalamcorporation.in | /YhwvXGhk/index.html
mksteslaenergy.com | /4RcYf6gB/index.html
mksteslaenergy.com | /6BrzkppT/index.html
mksteslaenergy.com | /7NEM56yQ/index.html
mksteslaenergy.com | /BzJoVeo0/index.html
mksteslaenergy.com | /ddLvpeMu/index.html
mksteslaenergy.com | /DkM4v1PP/index.html
mksteslaenergy.com | /ErmgUouT/index.html
mksteslaenergy.com | /gj1W42Ee/index.html
mksteslaenergy.com | /i8ztSS5H/index.html
mksteslaenergy.com | /iaJ7FSBi/index.html
mksteslaenergy.com | /mKvc8Mh7/index.html
mksteslaenergy.com | /N2rhmW5i/index.html
mksteslaenergy.com | /NdHgm0gT/index.html
mksteslaenergy.com | /oZFZ0qJK/index.html
mksteslaenergy.com | /pD2zHbBB/index.html
mksteslaenergy.com | /pSG1s2xs/index.html
mksteslaenergy.com | /r1kVYAfU/index.html
mksteslaenergy.com | /rzDZAsw7/indexhtml
mksteslaenergy.com | /rzDZAsw7/index.html
mksteslaenergy.com | /tLnW6jJT/index.html
mksteslaenergy.com | /UAtkgmot/index.html
mksteslaenergy.com | /UcL29wrU/index.html
mksteslaenergy.com | /wcE0aK0J/index.html
mksteslaenergy.com | /wjivLtgo/index.html
mksteslaenergy.com | /xXr3khjG/index.html
mksteslaenergy.com | /YhwvXGhk/index.html
mpralos.gr | /6BrzkppT/index.html
mpralos.gr | /7NEM56yQ/index.html
mpralos.gr | /7QLZuMme/index.html
mpralos.gr | /bp9ksV54/index.html
mpralos.gr | /BzJoVeo0/index.html
mpralos.gr | /ErmgUouT/index.html
mpralos.gr | /gj1W42Ee/index.html
mpralos.gr | /i8ztSS5H/index.html
mpralos.gr | /iaJ7FSBi/index.html
mpralos.gr | /Lskx0Bew/index.html
mpralos.gr | /mKvc8Mh7/index.html
mpralos.gr | /N2rhmW5i/index.html
mpralos.gr | /NdHgm0gT/index.html
mpralos.gr | /oZFZ0qJK/index.html
mpralos.gr | /pD2zHbBB/index.html
mpralos.gr | /pSG1s2xs/index.html
mpralos.gr | /r1kVYAfU/index.html
mpralos.gr | /rHFbxKTn/index.html
mpralos.gr | /rzDZAsw7/index.html
mpralos.gr | /t7xYVUJE/index.html
mpralos.gr | /tLnW6jJT/index.html
mpralos.gr | /UAtkgmot/index.html
mpralos.gr | /UcL29wrU/index.html
mpralos.gr | /wcE0aK0J/index.html
mpralos.gr | /wjivLtgo/index.html
mpralos.gr | /wtQ8G0Ku/index.html
mpralos.gr | /zvo8ioak/index.html
njsksansthan.com | /6BrzkppT/index.html
njsksansthan.com | /7NEM56yQ/index.html
njsksansthan.com | /7QLZuMme/index.html
njsksansthan.com | /bp9ksV54/index.html
njsksansthan.com | /ddLvpeMu/index.html
njsksansthan.com | /DkM4v1PP/index.html
njsksansthan.com | /ErmgUouT/index.html
njsksansthan.com | /iaJ7FSBi/index.html
njsksansthan.com | /Lskx0Bew/index.html
njsksansthan.com | /N2rhmW5i/index.html
njsksansthan.com | /pD2zHbBB/index.html
njsksansthan.com | /Re3BMGVG/index.html
njsksansthan.com | /RoScD8aq/index.html
njsksansthan.com | /rzDZAsw7/index.html
njsksansthan.com | /UcL29wrU/index.html
njsksansthan.com | /wtQ8G0Ku/index.html
njsksansthan.com | /xXr3khjG/index.html
njsksansthan.com | /YhwvXGhk/index.html
njsksansthan.com | /zvo8ioak/index.html
pakwestind.com | /6BrzkppT/index.html
pakwestind.com | /ErmgUouT/index.html
pakwestind.com | /i8ztSS5H/index.html
pakwestind.com | /NdHgm0gT/index.html
pakwestind.com | /oZFZ0qJK/index.html
pakwestind.com | /pD2zHbBB/index.html
pakwestind.com | /rHFbxKTn/index.html
pakwestind.com | /t7xYVUJE/index.html
pakwestind.com | /tLnW6jJT/index.html
pakwestind.com | /UAtkgmot/index.html
pakwestind.com | /UcL29wrU/index.html
pakwestind.com | /wcE0aK0J/index.html
pakwestind.com | /wtQ8G0Ku/index.html
punial.com | /4RcYf6gB/index.html
punial.com | /7NEM56yQ/index.html
punial.com | /7QLZuMme/index.html
punial.com | /bp9ksV54/index.html
punial.com | /BzJoVeo0/index.html
punial.com | /ErmgUouT/index.html
punial.com | /i8ztSS5H/index.html
punial.com | /NdHgm0gT/index.html
punial.com | /r1kVYAfU/index.html
punial.com | /rHFbxKTn/index.html
punial.com | /RoScD8aq/index.html
punial.com | /t7xYVUJE/index.html
punial.com | /UcL29wrU/index.html
punial.com | /vpW8hoZ6/index.html
punial.com | /xXr3khjG/index.html
punial.com | /zvo8ioak/index.html
rsons.in | /6BrzkppT/index.html
rsons.in | /bp9ksV54/index.html
rsons.in | /DkM4v1PP/index.html
rsons.in | /gj1W42Ee/index.html
rsons.in | /i8ztSS5H/index.html
rsons.in | /mKvc8Mh7/index.html
rsons.in | /r1kVYAfU/index.html
rsons.in | /Re3BMGVG/index.html
rsons.in | /tLnW6jJT/index.html
rsons.in | /UAtkgmot/index.html
rsons.in | /vpW8hoZ6/index.html
rsons.in | /wcE0aK0J/index.html
rsons.in | /wtQ8G0Ku/index.html
rsons.in | /xXr3khjG/index.html
siniflar.net | /4RcYf6gB/index.html
siniflar.net | /ddLvpeMu/index.html
siniflar.net | /ErmgUouT/index.html
siniflar.net | /wjivLtgo/index.html
Posts
