Wednesday, July 24, 2013

"Royal Baby" & Other CNN spam leads to malware

As many sources reported earlier today, an email claiming to be from CNN's "Scribbler" provided a link to "Watch Live Hospital Updates" of the Royal Baby:

But what do Harrison Ford, President Obama, and Snowden have in common with The Royal Baby?

They were all subjects of fake "CNN Breaking News" stories delivered by spam email today that contained links to a dangerous collection of malware! In the Malcovery Spam Data Mine we had hundreds of copies of emails with subjects including:

"Snowden able to leave Moscow airport" - BreakingNews CNN
"Harrison Ford on 'Ender's Game' controversy: 'Not an issue for me'"
"Obama speech to urge refocus "
"Perfect gift for royal baby ... a tree?" - BreakingNews CNN


(click each image for full-size email)

To demonstrate the relatedness of the spam, a list of the URLs that were used by each of the four campaigns is listed at the end of this article, labeled either "snowden", "ender", "obama", or "tree" for which campaign advertised that URL. We threw all of the advertised URLs into a fetcher and found that there were two files found in the destinations. The first (from earlier in the day) pointed to two Javascript files that were used to redirect the visitor to an Exploit Kit that would cause malware dropped to their computer. The second (later in the day, and still live as of this writing) pointed to three Javascript files that redirected to a different Exploit Kit site.

I've added spaces to the URLs for your protection, but DO NOT VISIT ANY OF THESE URLS!!!

(early morning version <== redirects to nphscards.com / topic / accidentally-results-stay.php ) 

index.html with MD5 = 958a887fcfcad89b3fdeea4b58e55905
  - which loads two Javascript files:
               ftp.thermovite.de   / kurile  / teeniest.js     
               traditionalagoonresort.com  / prodded  / televised.js
(afternoon version <== redirects to deltaboatraces.net / topic / accidentally-results-stay.php ) 
index.html with MD5 = bc73afe28fc6b536e675cea4ac468b7d 
   - which loads three Javascript files:
                  thealphatechnologies.com   / advantageously   / autopilots.js 
                  atlas247.com   / mussiest   /syndicating.js  
                  www.mshc.in   /drubbing   / mouthful.js
Since it was late in the day by the time I was able to review these myself, I infected myself with the afternoon version.

deltaboatraces.net == 173.246.104.136 and is still an active infector as of this timestamp.

I got a randomly named 297,472 byte file, detected by 11 of 46 Anti-Virus vendors at VirusTotal.com, which was Zeus.

See VirusTotal Report

Adobe Flash Player Update?

After infecting, the website tries to trick the user into "upgrading his Adobe Flash Player", but please notice in the graphic below, I'm not on the Adobe website!

After "installing" my Adobe update, my sandbox went crazy and also fetched malware from each of these locations:

After infection with the second my sandbox went to "deltarivehouse.net / forum / viewtopic.php" (173.246.104.136) which caused a string of additional infections to occur. While the initial infection was Zeus, the well-known Financial Crime malware that steals banking information, but also provides criminals full remote-control capabilities to your computer, the purpose of the additional malware was for another form of money making.

"sainitravels.in" (204.11.58.185) to fetch "f7Qsfao.exe"
(VirusTotal: 8 of 46)) - "Tepfor" or "Medfos" malware

"server1.extra-web.cz" (212.80.69.55) to fetch "dbm.exe"
(VirusTotal: 8 of 46)

"www.MATTEPLANET.com" (208.86.184.10) to fetch "q7ojEH7.exe"
(VirusTotal: 4 of 46)

"ictsolutions.net.au" (27.124.120.1) to fetch "SAQjaWu.exe"
(VirusTotal: 8 of 46)

Medfos, one of the malware names given to several of the above, is an "Advertisement redirection" malware campaign. Microsoft did a great job explaining how Medfos works in their blog post, Medfos - Hijacking Your Daily Search on the Microsoft Malware Protection Center blog back in September. Some of the sites that seem to be related to this Medfos install include "bidpenniesforgold.net" (IP: 50.63.25.37) and "webpayppcclick.com" (IP: 85.17.147.34).

According to our friends at Domain Tools, that last IP address is associated with a whole world of "Pay Per Click" fraud domains, including: 

advertisingclickfeed.com
allfeedppcadvertising.com
clickppcadvertisingone.com
clickwebppcpay.com
csuperclick.com
feedppcadvertisingdirect.com
feedppcadvertisinginfo.com
feedyourppcdirect.com
firstfeedppcadvertising.com
newpaywebclick.com
onlineppcclick.com
paymittelsclick.com
payonlineppc.com
payppcclickonline.com
paywebclick.com
paywebclicksite.com
perclickguide.com
perclicksite.com
perclickworld.com
ppcadvertisingfeed.com
ppcadvertisingworld.com
ppcclickonlineppc.com
ppcnewfeed.com
ppcperclickadvertising.com
ppcperpayadvertising.com
ppcwebclickpay.com
streamppcadvertising.com
webpayppcclick.com
Hopefully tying these malware samples to that activity can help someone clean up that mess! (Attention: Leaseweb!)

Spammed URLs for the Snowden, Ender, Obama, and Tree Campaigns

obama198.251.67.11/incumbency/index.html
obama198.251.67.11 /philippine/index.html
obama198.251.67.11 /stifles/index.html
snowden198.251.67.11/campaigners/index.html
snowden198.251.67.11/foxhole/index.html
snowden198.251.67.11/fracturing/index.html
snowden198.251.67.11/incumbency/index.html
tree198.251.67.11/nomadic/index.html
tree198.251.67.11/philippine/index.html
tree198.251.67.11/reprehended/index.html
tree198.251.67.11/sauciness/index.html
tree198.251.67.11/sonya/index.html
snowden198.251.67.11  /voodooing/index.html
ender198.61.134.93 /decompressed/index.html
ender198.61.134.93 /dinosaur/index.html
ender198.61.134.93 /microeconomics/index.html
ender198.61.134.93 /packard/index.html
ender198.61.134.93 /reprimanding/index.html
ender198.61.134.93 /sash/index.html
ender51956147.de.strato-hosting.eu   /radicalism/index.html
ender51956147.de.strato-hosting.eu   /remote/index.html
ender51956147.de.strato-hosting.eu   /soyinka/index.html
obama96.9.7.80                /draftier/index.html
tree96.9.7.80      /coif/index.html
tree96.9.7.80      /contentious/index.html
snowden96.9.7.80      /imperiling/index.html
snowden96.9.7.80      /implausibilities/index.html
tree96.9.7.80      /slaloming/index.html
snowden96.9.780       /imperiling/index.html
enderadeseye.me.pn /clunkier/index.html
enderadeseye.me.pn /incest/index.html
enderadeseye.me.pn /mischancing/index.html
enderadeseye.me.pn /rarest/index.html
enderadeseye.me.pn /uglies/index.html
enderandywinnie.com/albert/index.html
enderandywinnie.com/anywheres/index.html
enderandywinnie.com/chairing/index.html
enderandywinnie.com/fits/index.html
enderandywinnie.com/network/index.html
enderandywinnie.com/preservation/index.html
enderaptword.com.my/dromedaries/index.html
enderaptword.com.my/incurred/index.html
enderaptword.com.my/interpol/index.html
enderaptword.com.my/translations/index.html
enderaptword.com.my/vietminh/index.html
obamaassuredpropertycare.net  /overlying/index.html
obamaassuredpropertycare.net  /sneezes/index.html
treeassuredpropertycare.net /arrhenius/index.html
snowdenassuredpropertycare.net  /changed/index.html
snowdenassuredpropertycare.net/debaucheries/index.html
snowdenassuredpropertycare.net  /dulls/index.html
treeassuredpropertycare.net  /dulls/index.html
snowdenassuredpropertycare.net /overlying/index.html
treeassuredpropertycare.net /premeditation/index.html
treeassuredpropertycare.net /shekels/index.html
snowdenassuredpropertycare.net  /sneezes/index.html
obamabbsmfg.biz  /belaying/index.html
obamabbsmfg.biz               /lather/index.html
treebbsmfg.biz     /activists/index.html
snowdenbbsmfg.biz     /intellectualize/index.html
snowdenbbsmfg.biz     /lather/index.html
treebbsmfg.biz     /servo/index.html
treebbsmfg.biz     /skiing/index.html
treebbsmfg.biz     /tourist/index.html
snowdenbbsmfgbiz      /intellectualize/index.html
snowdenbbsmfgbiz      /lather/index.html
enderbestpaintinginc.org             /candidacy/index.html
enderbestpaintinginc.org             /enmeshes/index.html
enderbestpaintinginc.org             /genitives/index.html
enderbestpaintinginc.org             /hardly/index.html
enderbestpaintinginc.org             /parser/index.html
obamabordihn.net              /rubik/index.html
snowdenbordihn.net    /gnarl/index.html
treebordihn.net    /gnarl/index.html
treebordihn.net    /gushing/index.html
treebordihn.net    /reformulates/index.html
snowdenbordihn.net    /squirreling/index.html
treebordihn.net    /squirreling/index.html
enderchad.westhostsite.com           /addle/index.html
enderchad.westhostsite.com           /augmenting/index.html
enderchad.westhostsite.com           /buttonholes/index.html
enderchad.westhostsite.com           /expend/index.html
enderchad.westhostsite.com           /shillings/index.html
enderchad.westhostsite.com           /unfailing/index.html
enderCHALONE.COM.SG/ebbed/index.html
enderCHALONE.COM.SG/homy/index.html
enderCHALONE.COM.SG/saddling/index.html
obamadeerstalkersbop.org.nz   /evelyn/index.html
snowdendeerstalkersbop.org.nz               /absconding/index.html
treedeerstalkersbop.org.nz               /actioning/index.html
treedeerstalkersbop.org.nz               /bathroom/index.html
snowdendeerstalkersbop.org.nz               /dissatisfied/index.html
treedeerstalkersbop.org.nz               /dissatisfied/index.html
snowdendeerstalkersbop.org.nz               /tran/index.html
obamadtgcommunity.com         /imprimatur/index.html
snowdendtgcommunity.com   /electroencephalographs/index.html
treedtgcommunity.com   /electroencephalographs/index.html
snowdendtgcommunity.com   /gentlefolk/index.html
treedtgcommunity.com   /gunpoint/index.html
treedtgcommunity.com   /ingresses/index.html
snowdendtgcommunity.com   /parachutists/index.html
treedtgcommunity.com   /seesawing/index.html
snowdendtgcommunity.com   /thwacked/index.html
snowdendtgcommunity.com   /tzar/index.html
treeedition.cnn.com/
obamaekaterini.mainsys.gr     /bloodier/index.html
obamaekaterini.mainsys.gr     /habitual/index.html
treeekaterini.mainsys.gr                 /habitual/index.html
snowdenekaterini.mainsys.gr                 /livelongs/index.html
treeekaterini.mainsys.gr                 /oxymora/index.html
snowdenekaterini.mainsys.gr                 /peddle/index.html
snowdenekaterini.mainsys.gr                 /prithee/index.html
treeekaterini.mainsys.gr                 /suggested/index.html
snowdenekaterini.mainsys.gr                 /voled/index.html
treeekaterini.mainsys.gr                 /voled/index.html
enderfermatabow.com/clinicians/index.html
enderfermatabow.com/depicting/index.html
enderfermatabow.com/fairyland/index.html
obamaftp.suavva.com           /initiators/index.html
obamaftp.suavva.com           /riverbed/index.html
obamaftp.suavva.com           /sousa/index.html
snowdenftp.suavva.com /overstatements/index.html
treeftp.suavva.com /sousa/index.html
treeftp.suavva.com /surges/index.html
obamafuhr-haustechnik.de      /resubmit/index.html
treefuhr-haustechnik.de/attempted/index.html
treefuhr-haustechnik.de/continua/index.html
treefuhr-haustechnik.de/impartially/index.html
snowdenfuhr-haustechnik.de/recollecting/index.html
treefuhr-haustechnik.de/recollecting/index.html
treefuhr-haustechnik.de/taboo/index.html
snowdenfuhr-haustechnik.de/unswerving/index.html
endergbihongkong.org                 /boer/index.html
endergbihongkong.org                 /economist/index.html
endergbihongkong.org                 /inconsiderately/index.html
endergbihongkong.org                 /unenlightened/index.html
endergrape.wurster.ws                /filtration/index.html
endergrape.wurster.ws                /geisha/index.html
endergrape.wurster.ws                /pagans/index.html
endergrape.wurster.ws                /rationalized/index.html
endergrape.wurster.ws                /spica/index.html
endergrape.wurster.ws                /suntans/index.html
snowdenhackspitz.com  /adidas/index.html
snowdenhackspitz.com  /candied/index.html
snowdenhackspitz.com  /impropriety/index.html
treehackspitz.com  /kook/index.html
treehackspitz.com  /penetrable/index.html
obamahotelnewyorkbd.com       /twill/index.html
treehotelnewyorkbd.com /bayou/index.html
snowdenhotelnewyorkbd.com /doyens/index.html
treehotelnewyorkbd.com /doyens/index.html
snowdenhotelnewyorkbd.com /fiftieths/index.html
snowdenhotelnewyorkbd.com /hill/index.html
snowdenhotelnewyorkbd.com /preyer/index.html
treehotelnewyorkbdcom  /bayou/index.html
enderic44.com  /bulgarian/index.html
enderic44.com  /byword/index.html
enderic44.com  /flourishes/index.html
enderic44.com  /ganglier/index.html
enderic44.com  /sundry/index.html
enderisgett.org/ambling/index.html
enderisgett.org/besmirched/index.html
enderisgett.org/daybed/index.html
enderisgett.org/discriminatory/index.html
enderisgett.org/flux/index.html
enderisgett.org/tanzania/index.html
obamajobarium.com             /sham/index.html
snowdenjobarium.com   /benefactresses/index.html
snowdenjobarium.com   /hobos/index.html
treejobarium.com   /melissa/index.html
obamajoerg.gmxhome.de         /ease/index.html
obamajoerg.gmxhome.de         /freezes/index.html
snowdenjoerg.gmxhome.de   /ease/index.html
snowdenjoerg.gmxhome.de   /enumerated/index.html
treejoerg.gmxhome.de   /enumerated/index.html
snowdenjoerg.gmxhome.de   /harvester/index.html
treejoerg.gmxhome.de   /skeptically/index.html
treekassos.gr      /bode/index.html
treekassos.gr      /chosen/index.html
snowdenkassos.gr      /dragooning/index.html
snowdenkassos.gr      /futility/index.html
snowdenkassos.gr      /golf/index.html
snowdenkassos.gr      /walkways/index.html
treekassos.gr      /walkways/index.html
snowdenkassosgr       /futility/index.html
snowdenkassosgr       /golf/index.html
obamakryokontur.fr            /biopsy/index.html
obamakryokontur.fr            /brows/index.html
obamakryokontur.fr            /kern/index.html
obamakryokontur.fr            /nosh/index.html
treekryokontur.fr  /alternator/index.html
snowdenkryokontur.fr  /brows/index.html
treekryokontur.fr  /brows/index.html
treekryokontur.fr  /curs/index.html
treekryokontur.fr  /heating/index.html
snowdenkryokontur.fr  /housebreaking/index.html
snowdenkryokontur.fr  /preheats/index.html
snowdenkryokontur.fr  /tint/index.html
snowdenkryokontur.fr  /windmills/index.html
enderlees-landscaping.com            /angiosperm/index.html
enderlees-landscaping.com            /barrettes/index.html
enderlees-landscaping.com            /illegitimacy/index.html
snowdenlimelight.arinet.com                 /cloy/index.html
snowdenlimelight.arinet.com                 /hamlet/index.html
treelimelight.arinet.com                 /hamlet/index.html
snowdenlimelight.arinet.com                 /universities/index.html
obamalostfounddevices.com     /mama/index.html
obamalostfounddevices.com     /mullet/index.html
obamalostfounddevices.com     /unavoidable/index.html
obamalostfounddevices.com     /unavoidable/indexhtml
snowdenlostfounddevices.com                 /blaspheme/index.html
snowdenlostfounddevices.com                 /espinoza/index.html
treelostfounddevices.com                 /espinoza/index.html
snowdenlostfounddevices.com                 /friskily/index.html
snowdenlostfounddevices.com                 /hunchbacked/index.html
snowdenlostfounddevices.com                 /mama/index.html
treelostfounddevices.com                 /mama/index.html
snowdenlostfounddevices.com                 /manageable/index.html
snowdenlostfounddevices.com                 /undresses/index.html
treelostfounddevices.com                 /undresses/index.html
snowdenmydataplus.com /parenthesized/index.html
snowdenmydataplus.com /powhatan/index.html
treemydataplus.com /spotlessness/index.html
obamanendt.com                /degree/index.html
treenendt.com      /famous/index.html
snowdennendt.com      /horded/index.html
snowdennendt.com      /phoneyed/index.html
snowdennendt.com      /psalmists/index.html
treenendt.com      /shown/index.html
snowdennendt.com      /spreaders/index.html
enderphotos4earth.com                /strobe/index.html
enders273524369.onlinehome.us        /disarray/index.html
enders273524369.onlinehome.us        /opposite/index.html
enders273524369.onlinehome.us        /sheepishly/index.html
enders273524369.onlinehome.us        /wakes/index.html
enders273524369.onlinehome.us        /yeasty/index.html
trees3.hostingkartinok.com               /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg
trees3.hostingkartinok.com               /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebdjpg
trees3hostingkartinok.com                /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg
obamas5.hostingkartinok.com   /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg
obamas5.hostingkartinok.com   /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9ajpg
obamas5hostingkartinok.com    /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg
enderstolichband.com                 /betook/index.html
enderstolichband.com                 /daddy/index.html
enderstolichband.com                 /laudatory/index.html
enderstolichband.com                 /mediated/index.html
enderstolichband.com                 /modulation/index.html
enderstolichband.com                 /slander/index.html
enderstolichband.com                 /slovakian/index.html
obamat.co   /068wfdEwvI
obamat.co   /0B3uJXHZHq
obamat.co   /2RKkCjMhDY
obamat.co   /3Bi5WUDuzQ
obamat.co   /6oxioBYqIN
obamat.co   /7qev03NGnJ
obamat.co   /a4ERRbQQl4
obamat.co   /acBBL0xTCV
obamat.co   /bkkUHH67hJ
obamat.co   /bXH47NZNqO
obamat.co   /C6DXVWqaBc
obamat.co   /c6pMmdDPpO
obamat.co   /dcLDDl0aty
obamat.co   /DKgUzhWMr9
obamat.co   /dpM6GQ5NZ5
obamat.co   /dW8S1lHWkf
obamat.co   /e9AsQbSPBW
obamat.co   /eGRRrXsqQP
obamat.co   /EUKNmKfV7q
obamat.co   /f3bUOwEME8
obamat.co   /fOPdMNQOsM
obamat.co   /g29I6C8vZy
obamat.co   /GfduFeg1yd
obamat.co   /gGGSrs26ZU
obamat.co   /gKwkpduJ5v
obamat.co   /Gs7xupxY4e
obamat.co   /hP66qiEvov
obamat.co   /htgnJQgBls
obamat.co   /ims3mUbQAJ
obamat.co   /j7WCQHF8ZR
obamat.co   /JNaITTgZF4
obamat.co   /JyXdiTk9zz
obamat.co   /k99DjSMgDX
obamat.co   /KroVjGhTzS
obamat.co   /lwcWsTSwc9
obamat.co   /m69otwSQB6
obamat.co   /M8wADK71ii
obamat.co   /MMJJZm6BgK
obamat.co   /MrjneT1p2F
obamat.co   /nD7PWsTS2Z
obamat.co   /nGGBXHTZiR
obamat.co   /NT9VneQG7G
obamat.co   /o5dSTNSEWg
obamat.co   /OR7w6EeD2s
obamat.co   /PMuNvHMrPz
obamat.co   /Q4diDo0JMR
obamat.co   /QEdUNFwVSe
obamat.co   /qEQMOBXrQu
obamat.co   /rfiCBnJbng
obamat.co   /RGFxIi96oy
obamat.co   /Rlu9pAZfbd
obamat.co   /SbzAPP8Vdh
obamat.co   /TtGPbv2jkt
obamat.co   /twZBBrhZF6
obamat.co   /utoI54aE3a
obamat.co   /vj38vKkeNZ
obamat.co   /vp6XZXxaev
obamat.co   /VPxdX8abZV
obamat.co   /xDlelOjWBn
obamat.co   /XFiGKFtVKp
obamat.co   /XOWz23aYDY
obamat.co   /y5jSjRvpnk
obamat.co   /yCZT3kJ259
obamat.co   /yfpfhlOVyB
obamat.co   /yJqGYQPmwe
obamat.co   /ytpUhryXaB
obamat.co   /YVTow2XnJ8
endertpafbicaaorg.web.siteprotect.net/expansionist/index.html
endertpafbicaaorg.web.siteprotect.net/tocqueville/index.html
endertransstorlogistics.eu           /cowered/index.html
endertransstorlogistics.eu           /dapples/index.html
endertransstorlogistics.eu           /dentist/index.html
endertransstorlogistics.eu           /footpaths/index.html
endertransstorlogistics.eu           /have/index.html
endertransstorlogistics.eu           /miraculous/index.html
obamavillaflorida.biz         /backslappers/index.html
obamavillaflorida.biz         /chin/index.html
obamavillaflorida.biz         /encapsulates/index.html
treevillaflorida.biz   /caste/index.html
treevillaflorida.biz   /chin/index.html
snowdenvillaflorida.biz   /cliquish/index.html
treevillaflorida.biz   /cliquish/index.html
snowdenvillaflorida.biz   /huitzilopitchli/index.html
snowdenvillaflorida.biz   /rotogravure/index.html
treevillaflorida.biz   /unloosing/index.html
obamawhittakerwatertech.com   /beveling/index.html
obamawhittakerwatertech.com   /butlers/index.html
snowdenwhittakerwatertech.com               /careering/index.html
snowdenwhittakerwatertech.com               /guardroom/index.html
treewhittakerwatertech.com               /guardroom/index.html
snowdenwhittakerwatertech.com               /hundredweights/index.html
treewhittakerwatertech.com               /plover/index.html
snowdenwhittakerwatertech.com               /snorts/index.html
enderwww.arrow2000.ca                /gradient/index.html
enderwww.arrow2000.ca                /homemaker/index.html
enderwww.arrow2000.ca                /mulling/index.html
enderwww.arrow2000.ca                /nettie/index.html
enderwww.arrow2000.ca                /offed/index.html
obamawww.bernderl.de          /paradigmatic/index.html
snowdenwww.bernderl.de/coward/index.html
snowdenwww.bernderl.de/munoz/index.html
treewww.bernderl.de/oleaginous/index.html
snowdenwww.bernderl.de/polygon/index.html
snowdenwww.bernderl.de/selvedge/index.html
treewww.bernderl.de/undue/index.html
enderwww.bst-kanzlei.de              /attenuation/index.html
enderwww.bst-kanzlei.de              /cutback/index.html
enderwww.bst-kanzlei.de              /divorce/index.html
treewww.compare-treadmills.co.uk         /bassinet/index.html
snowdenwww.compare-treadmills.co.uk         /deciding/index.html
treewww.compare-treadmills.co.uk         /faster/index.html
snowdenwww.compare-treadmills.co.uk         /implosion/index.html
treewww.compare-treadmills.co.uk         /implosion/index.html
snowdenwww.compare-treadmills.co.uk         /leon/index.html
snowdenwww.compare-treadmills.co.uk         /leonor/index.html
treewww.compare-treadmills.co.uk         /march/index.html
treewww.compare-treadmills.co.uk         /tamarinds/index.html
enderwww.ishootyou.gr                /auguring/index.html
enderwww.ishootyou.gr                /insinuating/index.html
enderwww.ishootyou.gr                /sultanates/index.html
enderwww.ishootyou.gr                /towelling/index.html
obamawww.kauai2u.com          /connect/index.html
treewww.kauai2u.com/connect/index.html
snowdenwww.kauai2u.com/cynically/index.html
treewww.kauai2u.com/department/index.html
snowdenwww.kauai2u.com/descent/index.html
snowdenwww.kauai2u.com/finked/index.html
snowdenwww.kauai2u.com/strapping/index.html
treewww.kauai2u.com/strapping/index.html
treewww.masago-bkt.co.jp                 /axes/index.html
snowdenwww.masago-bkt.co.jp                 /beirut/index.html
obamawww.Miami-Beach-Reisen.de/eminently/index.html
obamawww.Miami-Beach-Reisen.de/tangoing/index.html
snowdenwww.Miami-Beach-Reisen.de            /eduardo/index.html
treewww.Miami-Beach-Reisen.de            /exceeding/index.html
snowdenwww.Miami-Beach-Reisen.de            /frail/index.html
snowdenwww.Miami-Beach-Reisen.de            /incrusts/index.html
treewww.Miami-Beach-Reisen.de            /invalided/index.html
treewww.Miami-Beach-Reisen.de            /requirements/index.html
snowdenwww.Miami-Beach-Reisen.de            /tangoing/index.html
obamawww.readingfluency.net   /juvenile/index.html
snowdenwww.readingfluency.net               /imperishables/index.html
treewww.readingfluency.net               /imperishables/index.html
snowdenwww.readingfluency.net               /poachers/index.html
snowdenwww.readingfluency.net               /tarantula/index.html
treewww.saito-office.biz                 /hooker/index.html
snowdenwww.saito-office.biz                 /rechargeable/index.html
snowdenwww.saito-office.biz                 /suggestively/index.html
treewww.saito-office.biz                 /suggestively/index.html
snowdenwww.saito-office.biz                 /vandyke/index.html
snowdenwww.schmaeing-reken.de               /banjos/index.html
treewww.schmaeing-reken.de               /baxter/index.html
snowdenwww.schmaeing-reken.de               /blocking/index.html
treewww.schmaeing-reken.de               /blocking/index.html
treewww.schmaeing-reken.de               /droller/index.html
treewww.schmaeing-reken.de               /iambs/index.html
treewww.schmaeing-reken.de               /metamorphosing/index.html
snowdenwww.schmaeing-reken.de               /mucks/index.html
treewww.schmaeing-reken.de               /regurgitating/index.html
obamawww.socivi.com           /estonians/index.html
treewww.socivi.com /flippancy/index.html
snowdenwww.socivi.com /incapable/index.html
snowdenwww.socivi.com /infuses/index.html
treewww.socivi.com /lepke/index.html
snowdenwww.socivi.com /moonlights/index.html
treewww.socivi.com /tugs/index.html
treewww.spurtwinslotshelvingsystems.co.uk/chirruping/index.html
treewww.spurtwinslotshelvingsystems.co.uk/dumped/index.html
snowdenwww.spurtwinslotshelvingsystems.co.uk/helot/index.html
treewww.spurtwinslotshelvingsystems.co.uk/reprinted/index.html
snowdenwww.spurtwinslotshelvingsystems.co.uk/terminological/index.html
treewww.spurtwinslotshelvingsystems.co.uk/terminological/index.html
treewww.spurtwinslotshelvingsystems.co.uk/tushes/index.html
treewww.tennisclub-iburg.de              /barking/index.html
snowdenwww.tennisclub-iburg.de              /bruckner/index.html
snowdenwww.tennisclub-iburg.de              /distemper/index.html
treewww.tennisclub-iburg.de              /excreta/index.html
snowdenwww.tennisclub-iburg.de              /geneses/index.html
snowdenwww.tennisclub-iburg.de              /hepper/index.html
treewww.tennisclub-iburg.de              /retributions/index.html
obamawww.wurster.ws           /dope/index.html
treewww.wurster.ws /cheaply/index.html
snowdenwww.wurster.ws /dearness/index.html
snowdenwww.wurster.ws /fixity/index.html
treewww.wurster.ws /loathing/index.html
treewww.wurster.ws /rump/index.html
Posted by Gary Warner at 11:06 PM
Labels: ,