Cyber Security Awareness Month: Day Two

Fake IRS Email Continues

I know this is becoming the Spam Campaign that Just Won't Die, but today we are still seeing extreme volumes of spam claiming to be from the Internal Revenue Service, with the subject line "Notice of Underreported Income". Here are the host names being used in the spam for October 1st and so far on October 2nd:

October 2, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ccviilli.com
www.irs.gov.ccviilli.net
www.irs.gov.ccviilll.com
www.irs.gov.ccviilll.net
www.irs.gov.ccvillli.com
www.irs.gov.gerradsz1.be
www.irs.gov.gerradsz1.co.ee
www.irs.gov.gerradsz1.com
www.irs.gov.gerradsz1.eu
www.irs.gov.haqwaz1.co.im
www.irs.gov.haqwaz1.com.im
www.irs.gov.haqwaz1.im
www.irs.gov.haqwaz1.net.im
www.irs.gov.hyyyyf1.cn
www.irs.gov.hyyyyf1.eu
www.irs.gov.hyyyyf2.eu
www.irs.gov.hyyyyf3.cn
www.irs.gov.hyyyyf4.cn
www.irs.gov.hyyyyf5.cn
www.irs.gov.hyyyyf6.cn
www.irs.gov.hyyyyf6.eu
www.irs.gov.hyyyyf7.cn
www.irs.gov.hyyyyf7.eu
www.irs.gov.hyyyyf8.cn
www.irs.gov.hyyyyf8.eu
www.irs.gov.nyuz1a.com
www.irs.gov.nyuz1a.net
www.irs.gov.nyuz2a.com
www.irs.gov.nyuz2a.net
www.irs.gov.nyuz3a.com
www.irs.gov.nyuz3a.net
www.irs.gov.nyuz4a.com
www.irs.gov.nyuz4a.net
www.irs.gov.nyuz5a.com
www.irs.gov.nyuz5a.net
www.irs.gov.vsdftpp.net

October 1, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ercc1zw.com
www.irs.gov.hyu111a.com
www.irs.gov.msrvtpp101.be
www.irs.gov.msrvtpp101.com
www.irs.gov.msrvtpp101.eu
www.irs.gov.msrvtpp102.be
www.irs.gov.msrvtpp102.com
www.irs.gov.msrvtpp102.eu
www.irs.gov.msrvtpp103.be
www.irs.gov.msrvtpp103.com
www.irs.gov.msrvtpp103.eu
www.irs.gov.vsdftpp.biz
www.irs.gov.vsdftpp.com
www.irs.gov.vsdftpp.in
www.irs.gov.vsdftpp.info
www.irs.gov.vsdftpp.mobi
www.irs.gov.vsdftpp.net
www.irs.gov.vsdftpp.org

Attempting to retrieve the malware from these sites, we were successful only with those on the ".im" country code. Like many cybercriminals, the criminals behind Zeus rely on inexperienced or uncooperative domain name registrars in order to keep their malicious websites live longer. In this case the domains:

haqwaz1.co.im
haqwaz1.com.im
haqwaz1.im
haqwaz1.net.im

as you're no doubt aware (ok, I had to look it up too!) .IM = Isle of Man. These domains would have been registered from "nic.im", who holds the keys to taking those domains off-line. I'm using the "nic.im" "contact us" page to report these fraud domains now.

The current version of the malware, which is still a Zeus Bot or "Zbot" infector, has these characteristics:

File size: 95232 bytes
MD5...: 869dba8c4bd9bb5a9030a24096883c6b

and is currently detected by only 9 of 41 anti-virus products at VirusTotal as you can see in this VirusTotal Report.

Other Malware in the Mail

Another long-running spam campaign claims that there has been a "delivery problem" with either DHL or Western Union.

The spam message says something like:

Hello!

We were not able to deliver the package you have sent on the (date here) in time
because the recipient's address is inexact.
Please print out the invoice copy attached and collect the package at our department.

DHL Customer Service

In this case the "attached package" is a piece of malware:

File size: 62464 bytes
MD5 : a4c926feeb6f906344f583091a02598f

which is well-detected as "BredoLab" as you can see in this VirusTotal Report by 16 of 41 anti-virus products.

Another version of the same spam says the same thing, only uses "UPS Delivery Problem" as the subject line and claims to be sent from "United Parcel Service".

A third version of the spam claims to be from Western Union, using the subject line "Wester Union transfer is available for withdrawl".

Dear customer.

The amount of money transfer: 8566 USD.
Money is available to withdrawl.

You may find the Money Transfer Control Number and receiver's details in document attached to this email.

Western Union.
Customer Service Center.

Whichever of these BredoLab malwares you run, you end up with Fake AV products being installed on your computer.


In the last prominent malware campaign we'll look at today a spam message is sent with the subject line "Thank you for setting the order No.475456". The text of the email reads:

Dear Customer!

Thank you for ordering at our online store.
Your order: Sony VAIO A1133651A, was sent at your address.
The tracking number of your postal parcel is indicated in the document attached to this letter.
Please, print out the postal label for receiving this parcel.

Internet Store.

Several slight variations of the attachment, sometimes called "install" and other times called "open" detect as different malware, with the two main versions being:

File size: 13312 bytes
MD5 : 595dc19dab1fa441304d77971c507d65

which detects as "Bravix" or "FakeAlert" or many other names, as you can see in this VirusTotal Report, which shows that 20 of 41 Anti-virus products detect this as malware.

and

File size: 13824 bytes
MD5 : 19daf4ef68dd4d830d4159e3d0dc7eb0

which also has many different detection names, including "Bravix", as you can see in this VirusTotal Report, which shows 23 of 41 anti-virus products detect this as malware.

Cyber Security Awareness Month: Day One

The Department of Homeland Security has designated the month of October to be Cyber Security Awareness Month, and we are off with a bang!

ASProx Compromised Webpages

Last night we received word that the ASProx SQL injection attack was back in full swing. After several months of no activity, this botnet is back to its old tricks of attacking vulnerable the ASP pages on IIS Servers trying to add a malicious javascript link to legitimate webpages by manipulating the underlying Microsoft SQL servers.

The main site which is hosting the malicious code right now is "ads-t.ru". Sites which have been hacked by this attack tool will contain a tag which leads to the page "ads-t.ru/ads.js". A quick Google search for this string will currently reveal more thousands of webpages which have had this code injected.

The Javascript causes an IFRAME to be loaded which causes the following file to be loaded:
adtcp.ru/ad/index.php

That domain was registered on September 29th with the email address omit@blogbuddy.ru

I wasn't sure if I should try my malware analysis VM 30,000 feet over Wichita Kansas, but I gave it a shot. The index.php file downloads a hostile Flash Player file:

/ad/spl/files/8628468724.swf

That file is only 797 bytes. VirusTotal has 1 of 41 detects for it, with Symantec calling it "Bloodhound.Exploit.266". The MD5 is 148a8c05fb0b63f036f024e2104a6e4c

The index.php files also causes a malicious PDF file to be downloaded. When the PDF file is opened by an older version of Adobe Reader, the computer becomes infected with one of the "scareware" fake Anti-virus products.

Unfortunately, I don't have a vulnerable copy of Adobe Flash Player handy, so I can't tell you yet what is downloaded by this flash file.


Let's take a search engine agnostic approach for a moment though:

Google.com shows pages injected with:
www.ads-t.ru/ads.js
www.bannert.ru/ads.js
www.bannerdriven.ru/ads.js
www.adtcp.ru/ads.js


Bing.com lists these as the top sites injected with "ads-t.ru":

justcorvettes.com
positiveresults.com
denver.mixliving.com
wirtzrealty.com
leonedirect.com
sandiegomix.com
thepartypeople.com.au
texasmoving.com
pcain.org
s-ecto.com
mpgourmet.com.au
equinehealthcentre.com
specialeducatorsamerica.com

Yahoo! lists only 823 results on ads-t.ru/ads.js with top hits being:
portalhomes.com
pocketlearn.com
justcorvettes.com
positiveresults.com
leonedirect.com
isleofman.com
tccs.org
visittheheart.com
scottsdirectories.com
tccs.org
healthgene.com
artsednj.org
bestpetsupply.com
chargrilled.com.au
healthyhomerecipes.com
lopeor.com
acrosser.com

AOL's search gives a number of results for "ads-t.ru/ads.js". One thing that cracks me up is the "sponsored links"! Can someone possible have bought adwords for that? When I search the path for this hostile Russian hosted javascript attack tool, I am told that:

"Apartments in El Paso, TX" LiveATIndependence.com/FortBliss
and
"TRUE.com The Safest Site in Online Dating" www.TRUE.com
and
"Tv Ads, Create & Run Video Ads Online" www.SpotMixer.com/video

are sponsored links for that search.

The domain names involved in this scam are all Fast Flux hosted, meaning that machines belonging to a botnet are used to resolve the website addresses. The traffic is then proxied from those IP addresses to the "real" criminal server. Here are some recently used IP addresses. If anyone recognizes that botnet, please shoot me an email:

24.17.154.91
24.65.94.114
24.113.68.58
24.151.19.155
24.210.184.44
24.220.226.110
65.189.239.122
66.223.140.55
67.180.252.95
67.185.125.93
67.233.93.235
68.38.133.22
68.40.167.165
69.151.150.145
69.181.182.250
69.245.96.203
70.44.247.207
71.108.37.140
71.121.172.27
71.202.204.125
72.39.29.137
74.130.69.226
74.132.42.47
75.15.183.0
75.34.216.140
75.37.106.134
75.62.36.251
76.87.82.83
76.99.70.115
76.179.209.62
77.86.61.126
81.182.27.22
81.183.112.36
82.126.78.225
82.131.156.180
82.131.217.88
82.131.222.164
83.173.149.63
84.0.96.52
85.67.62.86
86.101.168.70
88.153.34.164
89.200.152.188
91.82.134.228
92.141.150.234
92.249.203.67
94.21.19.98
94.220.214.111
96.245.233.90
96.245.238.218
98.134.46.213
98.150.54.94
128.192.33.6
141.154.188.249
147.134.182.51
147.134.222.113
165.123.143.179
207.168.223.80
207.168.223.92
209.19.94.197
209.55.68.243
216.119.45.147
216.229.86.21

IRS Version of Zeus

I'm actually blogging this using my free trial of Delta's "GoGo" WIFI service as I fly back from San Jose, where I was speaking at the Merchant Risk Council meeting. What is the primary email that I'm downloading this morning? Its still the fake IRS emails which are being used to distribute the IRS version of the Zeus Bot trojan.

So far this flight I've received 330 copies of the current IRS Zeus email. The domain names used in these emails are:

www.irs.gov.hyu111a.com
www.irs.gov.vsdftpp.org
www.irs.gov.vsdftpp.in
www.irs.gov.vsdftpp.mobi
www.irs.gov.vsdftpp.biz
www.irs.gov.msrvtpp103.eu
www.irs.gov.msrvtpp102.eu
www.irs.gov.msrvtpp101.be
www.irs.gov.msrvtpp102.com

The binary its dropping is brand new - I was the first one to have it scanned at VirusTotal. As usual with the new binaries, detection is not very good, 9 of 41 antivirus products are currently detecting it, but at least we do have some of the Big AV Guns on board.

See the VirusTotal Report Here.

Detects from F-Secure, Kaspersky, McAfee, Microsoft, Sophos, Sunbelt, and VBA32 right now.

File size: 96256 bytes
MD5...: 36ac39070d175b21cb2f46e2bdfe668c

Don't Be a Phishing Victim

Today's BBC News quotes Rohyt Belani, the founder and chief executive of Intrepidus Group, a security consultancy:

"Our studies have shown that within the first hour of someone receiving a phishing e-mail, 60% of people click on them. That is not enough time for the security folks to act."

I agree with Rohyt totally, and would urge the consumer message of the day to be "BE CAREFUL with links in your email". If your bank really has an important message for you, go to your bank's website in the way you would normally log in, and do so. If there are important messages from your bank, you should be able to find them there easily.

FBI Director Mueller, and remember Special Agent Sang Jun

Director Mueller gave a briefing to Congress yesterday that you can read here.

Director Mueller briefs Congress


Mueller outlined the work and challenges of the FBI in the areas of:

CounterTerrorism,

Counter Intelligence,

Cyber Attacks (including the National Investigative Joint Task Force)

White Collar (including Public Corruption, Mortgage Fraud, Health Care Fraud, Corporate Fraud)

Violent Crime (including Criminal Gangs, Border Violence, and Crimes Against Children)

If you aren't familiar with the National Cyber Investigative Joint Task Force, there's a pretty decent article describing it from Internet Business Law Services. As they point out, the NCIJTF was in a line item in the DOJ 2009 budget that read like this, although we can't tell how much of it was for the NCIJTF alone:

15. Comprehensive National Cybersecurity Initiative
The FBI requests 211 positions (35 Agents and 113 Intelligence Analysts) and $38,648,000 in personnel and non-personnel funding in support of investigative, intelligence, and technical requirements of the Comprehensive National Cybersecurity Initiative. Included in this request are resources for counterintelligence/computer intrusions investigatory requirements, National Cyber Investigative Joint Task Force (NCIJTF) infrastructure requirements, cyber training, intelligence/information sharing and analysis resource requirements, equipment funding for the continued operations and maintenance costs of its Consolidated Collection CALEA Cell Site Server and Carrier Records Digital Interfacing efforts. FY 2009 Current Services for this program are 89 positions (33 agents), 89 FTE, and $36,000,000.

There's also an interesting chart from the White House showing How the NCIJTF links to other Federal Cyber Centers. Despite that chart, the NCIJTF is a real item and moving forward. The FY10 Intelligence Appropriations bill authorizes a greater involvement in the JTF from the Intelligence community, and I believe this year we will see even greater accomplishments, although its possible we'll never learn about their best work, as is true in so much of the activities of the FBI and others as they defend our nation from attack.

Fallen Agents

At the end of Mueller's remarks, he shared the fact that since his last annual address to Congress, the FBI lost three agents, and he asked that they be remembered:

Special Agent Sam Hicks, "a decorated Baltimore police officer who was part of the Pittsburgh Joint Terrorism Task Force";

Special Agent Sang Jun, "a top-notch cyber agent who served in the El Paso Division";

Special Agent Paul Sorce, "a lifelong street agent who worked on the Detroit Violent Crimes Task Force"

---

I wanted to mention Sang Jun, because he actually re-arrested my very first cyber-criminal, Robert Lyttle, when he got out the first time and hacked NASA, which gave me a tiny connection to him.

-----------
Here's a picture of Sang Jun (right) with Sung-ki Lim, who also went "from geek to g-man":



Sang Jun was a cybercrimes agent who was interviewed by the San Francisco Chronicle in 2005, along with his co-worker Sung-ki Lim, about his new job working in cyberterrorism investigations. At the time, Jun said he took a 25% cut in pay to walk away from a great computer job to join the FBI.

In that interview, it describes his decision making process like this (which I've added and re-ordered slightly):

Jun took a somewhat different route. A high school teacher persuaded him to join the computer club, and he took an advanced Pascal class "and fell in love with it."

In 1994, he graduated from Jacksonville University in his native Florida with a degree in computer science. He worked for three years as a systems analyst with Blue Cross/Blue Shield, then for a year in a similar job at Merrill Lynch. He then joined consulting giant Capgemini, traveling to many Fortune 500 firms.

During that time, he applied to the FBI, but ultimately rejected a job because the salary couldn't compete. He jumped from Capgemini to Andersen Consulting and kept up his glamorous high-flying career.

Until Sept. 11. "That hit me," he said. "I did a lot of traveling on the airlines. I said, 'That could have been me. I want to do something. I want to contribute.' "

He called the FBI again and was hired in 2003.

Both men loved the training. Jun dropped 35 pounds just getting in shape for the training.

Now that they're full-fledged special agents, they can't talk much about their jobs. In Jun's time on the computer intrusions squad, he helped bring down the "Deceptive Duo," a case in which Robert Lyttle, 21, of Pleasant Hill pleaded guilty in March to hacking into computer systems at NASA Ames Research Center and other government sites.

Now Jun works on cyberterrorism, which is the FBI computer unit's top priority. Although cyberterrorism can be defined in many ways, the FBI is particularly concerned with terrorists who might use computer systems to compromise real world infrastructure, such as dams or the power grid.

Much of Jun's work in that arena is pro-active, meaning it involves securing those systems before an attack, rather than waiting until they've been hit.

Now, as a special agent assigned to combating cyberterrorism, Jun said, "You can't beat this. There, I was making a difference on a small scale. Here, I'm protecting the country. ... At the end of the day, all in all, I feel like I accomplished something."

Citizens like Sang Jun deserve our highest respect, and should challenge us to ask ourselves what we are doing to protect the country we love. When Jun thought about September 11th, he walked away from his ten years in a comfortable job at Accenture/Anderson to serve our country in a greater mission. How will you help your country?

Sang died in El Paso on October 22, 2008. His friends and family made a memorial page for him. His best friend, Mel, remembers teasing him about driving to Quantico in his convertible BMW. His sister remembers playing together at their home in Korea and the long plane ride to the US when they were children, and his other sister says because of his inspiration she finished college.

In Brief: The New York Times fake anti-virus redirect

Several people have emailed asking if the fake anti-virus products I mentioned in today's blog article, US Open and VMAs top rogue anti-virus efforts, was the same fake anti-virus that was reported as being launched from advertisements at the New York Times website over the weekend. The truth is, I didn't know! So I looked into it.

The New York Times fessed up that they were having problems in This note on September 13th:

Some NYTimes.com readers have seen a pop-up box warning them about a virus and directing them to a site that claims to offer antivirus software. We believe this was generated by an unauthorized advertisement and are working to prevent the problem from recurring. If you see such a warning, we suggest that you not click on it. Instead, quit and restart your Web browser. Questions and comments can be sent to webeditor@nytimes.com.

A second NYT story today tells only SLIGHTLY more information:
http://bits.blogs.nytimes.com/2009/09/14/times-site-was-victim-of-a-malicious-ad-swap/?hpw, see also: http://gadgetwise.blogs.nytimes.com/2009/09/14/what-to-do-if-you-saw-an-antivirus-pop-up-ad/


A new advertising network that fed ads to the NYT ran "normal" ads for about a week, then suddenly started advertising malware sites over the weekend. An ad, that at least part of the time redirected to russell-brand.cn, contained hostile javascript, which redirected to the actual fake AV site.

Some of the domains involved included:

protection-check07.com which resolved to IP address 88.198.107.25. That IP was also used by:

antivirusonlinescan03.com
antispywarescanner07.com
antispywarescanner08.com
best-antivirus03.com
best-spyware-scan01.com
best-spyware-scan03.com
intellectual-vir-scan08.com
intellectual-vir-scan09.com
malwareinternetscanner03.com
online-antivir-scan09.com
protection-check07.com
quick-virus-scanner01.com
quick-virus-scanner02.com
quick-virus-scanner08.com
reliable-scanner02.com
reliable-scanner05.com


These actually were shared across several IPs, including:

78.46.251.43 - Berlin, Germany, "your-server.de"
88.198.107.25 - Sweden, - "your-server.de"
88.198.120.177 - your-server.de
91.212.107.5 - Cyprus - Ricomm
91.212.127.200 - UK - Telos Solutions
94.102.51.26 - Netherlands - Ecatel

As I was not a first-hand witness, I'm going to wrap this up short as promised by pointing to a few other blogs:

http://ddanchev.blogspot.com/2009/09/ukrainian-fan-club-features.html


http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com

US Open and Video Music Awards top rogue anti-virus efforts

This summary is not available. Please click here to view the post.

IRS Version of Zeus Bot continues

Update - 16SEP09 - the Zeus Bot trojan, or Zbot, continues to be spread

The extremely heavy spam campaign described below continues. A list of 130 more domains being used to spread this malware is appended to the bottom of this article. Current detection rate of this malware at VirusTotal? ONE of forty-one Anti-virus products detect this malware. MD5 = 34cee60590817be6f8dd1115c6a1883f

Researchers at the University of Alabama at Birmingham continue to study the Zeus Bot trojan this week as a new spam campaign seeks to extend this already prolific bank robbery malware. This is the fourth major Zeus-spreading spam campaign that we've seen hit the UAB Spam Data Mine in the past few months.

On July 24th, we reported on the "1001 Postcards" spam campaign in our story From Russia, With Love...new Postcard spam spies on your PC.

On June 30th, we reported on the "Michael Jackson" spam campaign in our story Michael Jackson headline used in Password Stealing.

On June 24th, we reported on the "Microsoft Outlook Update" spam campaign in our story Malware in the Mail (Email that is!).

The current spam campaign has been proven by malware analysts on the UAB Computer Forensics research team to be in the same family as each of these additional versions. On September 9th and 10th, we received 1281 copies of the current Zeus spreading email, this time pretending to be an email from the Internal Revenue Service. On September 11th we received 764 more copies of the email, some of which point to websites which are still live on the morning of September 12th as I write this.



The email, which uses a subject line "Notice of Underreported Income" and claims to be sent from "Internal Revenue Service" claims that you need to visit a website to review an issue of "Unreported/Underreported Income" which seems to have been detected by the "Fraud Application" at the IRS.

The website you are sent to contains your email address, and claims that you need to download and execute a program to review the problem with your tax statement.



The image above was taken from one of the several sites which are still live as of this writing on the morning of September 12, 2009. Many websites have been created by the criminal, and many of them have already been shutdown.

During the first 24 hours of the spam campaign, we saw these websites used in the spam email:

www.irs.gov.hyg12zi.eu
www.irs.gov.hyg12zk.eu
www.irs.gov.hyg12zo.eu
www.irs.gov.hyg12zq.eu
www.irs.gov.hyg12zr.eu
www.irs.gov.hyg12zu.eu
www.irs.gov.hyg12zw.eu
www.irs.gov.hyu11hea.eu
www.irs.gov.hyu11heb.eu
www.irs.gov.hyu11hec.eu
www.irs.gov.hyu11heg.eu
www.irs.gov.hyu11heh.eu
www.irs.gov.hyu11hej.eu
www.irs.gov.hyu11hem.eu
www.irs.gov.hyu11hep.eu
www.irs.gov.hyu11her.eu
www.irs.gov.hyu11hes.eu
www.irs.gov.hyu11heu.eu
www.irs.gov.hyu11hew.eu
www.irs.gov.hyu11hez.eu
www.irs.gov.hyu11hic.eu
www.irs.gov.nyusa2a.eu
www.irs.gov.nyusa2b.eu
www.irs.gov.nyusa2e.eu
www.irs.gov.nyusa2i.eu
www.irs.gov.nyusa2l.eu
www.irs.gov.nyusa2s.eu
www.irs.gov.nyusa2y.eu
www.irs.gov.ringrins.co.uk

After all of these were successfully terminated, the spammer took almost 26 hours to regroup and relaunch, using these additional websites during the September 11th version of his spam campaign:

www.irs.gov.ger11zd.com
www.irs.gov.ger11zd.net
www.irs.gov.ger11zf.com
www.irs.gov.ger11zf.net
www.irs.gov.ger11zh.com
www.irs.gov.ger11zh.net
www.irs.gov.ger11zr.com
www.irs.gov.ger11zr.net
www.irs.gov.ger11zx.com
www.irs.gov.ger11zx.eu
www.irs.gov.ger11zx.net
www.irs.gov.losawza.cn
www.irs.gov.losawza.eu
www.irs.gov.losawzd.cn
www.irs.gov.losawzd.eu
www.irs.gov.losawze.cn
www.irs.gov.losawze.eu
www.irs.gov.losawzf.cn
www.irs.gov.losawzf.eu
www.irs.gov.losawzg.cn
www.irs.gov.losawzg.eu
www.irs.gov.losawzs.cn
www.irs.gov.losawzs.eu
www.irs.gov.losawzx.cn
www.irs.gov.losawzx.eu
www.irs.gov.merfaslo.biz
www.irs.gov.merfaslo.com
www.irs.gov.merfaslo.info
www.irs.gov.merfaslo.net
www.irs.gov.tersab1.cn
www.irs.gov.tersab1.eu
www.irs.gov.tersac1.cn
www.irs.gov.tersad1.cn
www.irs.gov.tersad1.eu
www.irs.gov.tersan1.cn
www.irs.gov.tersan1.eu
www.irs.gov.tersav1.eu
www.irs.gov.tersaw1.eu
www.irs.gov.tersax1.eu
www.irs.gov.tersaz1.cn
www.irs.gov.tersaz1.eu
www.irs.gov.yh1ferz.com
www.irs.gov.yh1ferz.info
www.irs.gov.yh1ferz.net
www.irs.gov.yh1ferz.org

The malware itself has also been modified to be MUCH more difficult to detect. When we first scanned the copy of the Zeus bot on September 9th, it was already detected as Zeus by 21 of the 41 anti-virus products at VirusTotal, and the detection continued to rise through the day.

When we scanned the current malware during the evening of September 11th, we found that only 6 of the 41 anti-virus products at VirusTotal were able to detect the malware as being the Zeus bot. See this VirusTotal Report for the current malware with MD5: 04eb70edf674d7bf376994aec68785ee (file size = 96,256 bytes). Rescanning this morning - more than 12 hours after our initial submission - still only shows 6 of 41 products detecting the malware:

BitDefender and GData call it "Trojan.Spy.Zbot.BFK"
Kaspersky calls it: "Trojan-Spy.Win32.Zbot.gen"
McAfee+Artemis calls it: "Suspect-29"
NOD32 calls it: "a variant of Win32/Kryptik.AET"
Sunbelt calls it: "Trojan-Downloader.Tibs.gen"

That detection was so poor, we really wondered if it was corrupt or broken malware.

So, what do you do if you want to know if your malware is real? Fire it up!

I'm not in the lab today, but I have the Malware Analysis VM that UAB Malware Analyst Brian Tanner put together for my team, so I fired it up. I self-infected the VM by visiting the website above, confirming that my MD5 was the same as I did so. Within a couple seconds, I was making HTTP Post messages to:

nerinsk.com on the path /livs/gate.php

The traffic was flowing to 91.213.72.51, an IP address that was used by the "gorodu.com" domain name in the malware earlier this week. "gate.php" is a file name we've seen repeatedly associated with Zeus Malware.

I'm going to call this "Confirmed Badness", and say that despite the HORRIBLE AV detection on this one, we have a confirmed, live, Zeus Bot trojan / ZBot trojan that people need to worry about.

UPDATED September 28th . . . here are the domain names we've seen, and the number of spam samples we've received for each of these domains, and the dates on which those domains were used in spam.

receiving_date | count | machine
----------------+-------+-----------------------------
2009-09-09 | 18 | www.irs.gov.hyg12zi.eu
2009-09-09 | 16 | www.irs.gov.hyg12zk.eu
2009-09-09 | 21 | www.irs.gov.hyg12zo.eu
2009-09-09 | 19 | www.irs.gov.hyg12zq.eu
2009-09-09 | 11 | www.irs.gov.hyg12zr.eu
2009-09-09 | 15 | www.irs.gov.hyg12zu.eu
2009-09-09 | 24 | www.irs.gov.hyg12zw.eu
2009-09-09 | 10 | www.irs.gov.hyu11hea.eu
2009-09-09 | 17 | www.irs.gov.hyu11heb.eu
2009-09-09 | 37 | www.irs.gov.hyu11hec.eu
2009-09-09 | 9 | www.irs.gov.hyu11heg.eu
2009-09-09 | 27 | www.irs.gov.hyu11heh.eu
2009-09-09 | 44 | www.irs.gov.hyu11hej.eu
2009-09-09 | 9 | www.irs.gov.hyu11hem.eu
2009-09-09 | 431 | www.irs.gov.hyu11hep.eu
2009-09-09 | 11 | www.irs.gov.hyu11her.eu
2009-09-09 | 9 | www.irs.gov.hyu11hes.eu
2009-09-09 | 38 | www.irs.gov.hyu11heu.eu
2009-09-09 | 17 | www.irs.gov.hyu11hew.eu
2009-09-09 | 6 | www.irs.gov.hyu11hez.eu
2009-09-09 | 8 | www.irs.gov.hyu11hic.eu
2009-09-09 | 15 | www.irs.gov.nyusa2a.eu
2009-09-09 | 13 | www.irs.gov.nyusa2b.eu
2009-09-09 | 16 | www.irs.gov.nyusa2e.eu
2009-09-09 | 13 | www.irs.gov.nyusa2i.eu
2009-09-09 | 9 | www.irs.gov.nyusa2l.eu
2009-09-09 | 17 | www.irs.gov.nyusa2s.eu
2009-09-09 | 16 | www.irs.gov.nyusa2y.eu
2009-09-09 | 47 | www.irs.gov.ringrins.co.uk
2009-09-10 | 152 | www.irs.gov.hyu11hep.eu
2009-09-10 | 523 | www.irs.gov.ringrins.co.uk
2009-09-11 | 35 | www.irs.gov.ger11zd.com
2009-09-11 | 36 | www.irs.gov.ger11zd.net
2009-09-11 | 45 | www.irs.gov.ger11zf.com
2009-09-11 | 45 | www.irs.gov.ger11zf.net
2009-09-11 | 57 | www.irs.gov.ger11zh.com
2009-09-11 | 54 | www.irs.gov.ger11zh.net
2009-09-11 | 50 | www.irs.gov.ger11zr.com
2009-09-11 | 40 | www.irs.gov.ger11zr.net
2009-09-11 | 38 | www.irs.gov.ger11zx.com
2009-09-11 | 48 | www.irs.gov.ger11zx.eu
2009-09-11 | 40 | www.irs.gov.ger11zx.net
2009-09-11 | 5 | www.irs.gov.losawza.cn
2009-09-11 | 4 | www.irs.gov.losawza.eu
2009-09-11 | 11 | www.irs.gov.losawzd.cn
2009-09-11 | 6 | www.irs.gov.losawzd.eu
2009-09-11 | 10 | www.irs.gov.losawze.cn
2009-09-11 | 8 | www.irs.gov.losawze.eu
2009-09-11 | 7 | www.irs.gov.losawzf.cn
2009-09-11 | 3 | www.irs.gov.losawzf.eu
2009-09-11 | 4 | www.irs.gov.losawzg.cn
2009-09-11 | 8 | www.irs.gov.losawzg.eu
2009-09-11 | 6 | www.irs.gov.losawzs.cn
2009-09-11 | 4 | www.irs.gov.losawzs.eu
2009-09-11 | 7 | www.irs.gov.losawzx.cn
2009-09-11 | 8 | www.irs.gov.losawzx.eu
2009-09-11 | 14 | www.irs.gov.merfaslo.biz
2009-09-11 | 13 | www.irs.gov.merfaslo.com
2009-09-11 | 10 | www.irs.gov.merfaslo.info
2009-09-11 | 11 | www.irs.gov.merfaslo.net
2009-09-11 | 7 | www.irs.gov.tersab1.cn
2009-09-11 | 6 | www.irs.gov.tersab1.eu
2009-09-11 | 4 | www.irs.gov.tersac1.cn
2009-09-11 | 10 | www.irs.gov.tersad1.cn
2009-09-11 | 7 | www.irs.gov.tersad1.eu
2009-09-11 | 8 | www.irs.gov.tersan1.cn
2009-09-11 | 10 | www.irs.gov.tersan1.eu
2009-09-11 | 5 | www.irs.gov.tersav1.eu
2009-09-11 | 5 | www.irs.gov.tersaw1.eu
2009-09-11 | 6 | www.irs.gov.tersax1.eu
2009-09-11 | 10 | www.irs.gov.tersaz1.cn
2009-09-11 | 8 | www.irs.gov.tersaz1.eu
2009-09-11 | 19 | www.irs.gov.yh1ferz.com
2009-09-11 | 10 | www.irs.gov.yh1ferz.info
2009-09-11 | 15 | www.irs.gov.yh1ferz.net
2009-09-11 | 10 | www.irs.gov.yh1ferz.org
2009-09-12 | 1 | www.irs.gov.ger11zx.eu
2009-09-14 | 13 | www.irs.gov.1kikyd.cn
2009-09-14 | 27 | www.irs.gov.1kikyf.cn
2009-09-14 | 15 | www.irs.gov.1kikys.cn
2009-09-14 | 19 | www.irs.gov.1kikyt.cn
2009-09-14 | 26 | www.irs.gov.1kikyt.eu
2009-09-14 | 21 | www.irs.gov.ersawe1.net
2009-09-14 | 3 | www.irs.gov.ersawec.com
2009-09-14 | 5 | www.irs.gov.ersawec.net
2009-09-14 | 1 | www.irs.gov.ersaweq.com
2009-09-14 | 3 | www.irs.gov.ersaweq.net
2009-09-14 | 3 | www.irs.gov.ersawet.net
2009-09-14 | 4 | www.irs.gov.ersaweu.com
2009-09-14 | 1 | www.irs.gov.ersaweu.net
2009-09-14 | 1 | www.irs.gov.ersawew.com
2009-09-14 | 8 | www.irs.gov.ersawew.net
2009-09-14 | 3 | www.irs.gov.ersawey.com
2009-09-14 | 17 | www.irs.gov.ersawey.net
2009-09-14 | 2 | www.irs.gov.ersawez.net
2009-09-14 | 16 | www.irs.gov.ikhrtyg1.com
2009-09-14 | 9 | www.irs.gov.ikhrtyg1.net
2009-09-14 | 17 | www.irs.gov.ikhrtygf.com
2009-09-14 | 16 | www.irs.gov.ikhrtygf.net
2009-09-14 | 21 | www.irs.gov.ikhrtyrf.com
2009-09-14 | 22 | www.irs.gov.ikhrtyrf.net
2009-09-14 | 18 | www.irs.gov.ikhrtysa.com
2009-09-14 | 23 | www.irs.gov.ikhrtysa.net
2009-09-14 | 16 | www.irs.gov.ikhrtyth.com
2009-09-14 | 13 | www.irs.gov.ikhrtyth.eu
2009-09-14 | 18 | www.irs.gov.ikhrtyth.net
2009-09-14 | 10 | www.irs.gov.muk11de.cn
2009-09-14 | 24 | www.irs.gov.muk11de.eu
2009-09-14 | 6 | www.irs.gov.muk11do.cn
2009-09-14 | 12 | www.irs.gov.muk11dp.cn
2009-09-14 | 51 | www.irs.gov.muk11dp.eu
2009-09-14 | 14 | www.irs.gov.muk11dq.cn
2009-09-14 | 9 | www.irs.gov.muk11dr.cn
2009-09-14 | 9 | www.irs.gov.muk11du.cn
2009-09-14 | 20 | www.irs.gov.muk11du.eu
2009-09-14 | 5 | www.irs.gov.muk11dy.cn
2009-09-14 | 29 | www.irs.gov.muk11dy.eu
2009-09-14 | 22 | www.irs.gov.olrfder.com
2009-09-14 | 8 | www.irs.gov.oolqj.cn
2009-09-14 | 6 | www.irs.gov.oolqp.cn
2009-09-14 | 18 | www.irs.gov.oolqp.eu
2009-09-14 | 27 | www.irs.gov.oolqq.eu
2009-09-14 | 6 | www.irs.gov.oolqw.cn
2009-09-14 | 11 | www.irs.gov.oolqx.cn
2009-09-14 | 7 | www.irs.gov.oolqy.cn
2009-09-14 | 11 | www.irs.gov.oolqz.cn
2009-09-14 | 38 | www.irs.gov.oolqz.eu
2009-09-14 | 28 | www.irs.gov.strmodesa.com
2009-09-14 | 25 | www.irs.gov.strmodesa.co.uk
2009-09-14 | 49 | www.irs.gov.strmodesa.eu
2009-09-15 | 27 | www.irs.gov.dirvsdl.co.kr
2009-09-15 | 38 | www.irs.gov.dirvsdl.kr
2009-09-15 | 26 | www.irs.gov.dirvsdl.ne.kr
2009-09-15 | 35 | www.irs.gov.dirvsdl.or.kr
2009-09-15 | 7 | www.irs.gov.ersawe1.net
2009-09-15 | 8 | www.irs.gov.ersawey.net
2009-09-15 | 23 | www.irs.gov.fhqw1sae.eu
2009-09-15 | 8 | www.irs.gov.fhqw1say.eu
2009-09-15 | 16 | www.irs.gov.fhw1sa1.eu
2009-09-15 | 11 | www.irs.gov.fhw1sae.eu
2009-09-15 | 29 | www.irs.gov.hrtfe11l.eu
2009-09-15 | 32 | www.irs.gov.hrtfe11l.mn
2009-09-15 | 28 | www.irs.gov.hrtfe11q.mn
2009-09-15 | 9 | www.irs.gov.hrtfe11s.eu
2009-09-15 | 22 | www.irs.gov.hrtfe11s.mn
2009-09-15 | 8 | www.irs.gov.hrtfe11u.eu
2009-09-15 | 10 | www.irs.gov.hrtfe11u.mn
2009-09-15 | 26 | www.irs.gov.hrtfe11y.mn
2009-09-15 | 3 | www.irs.gov.ikhrtyg1.com
2009-09-15 | 2 | www.irs.gov.ikhrtyg1.net
2009-09-15 | 7 | www.irs.gov.ikhrtygf.com
2009-09-15 | 8 | www.irs.gov.ikhrtygf.net
2009-09-15 | 8 | www.irs.gov.ikhrtyrf.com
2009-09-15 | 4 | www.irs.gov.ikhrtyrf.net
2009-09-15 | 4 | www.irs.gov.ikhrtysa.com
2009-09-15 | 6 | www.irs.gov.ikhrtysa.net
2009-09-15 | 7 | www.irs.gov.ikhrtyth.com
2009-09-15 | 10 | www.irs.gov.ikhrtyth.eu
2009-09-15 | 10 | www.irs.gov.ikhrtyth.net
2009-09-15 | 15 | www.irs.gov.mtkstrip.co.kr
2009-09-15 | 26 | www.irs.gov.mtkstrip.com
2009-09-15 | 24 | www.irs.gov.mtkstrip.kr
2009-09-15 | 9 | www.irs.gov.nyh11de.me
2009-09-15 | 10 | www.irs.gov.nyh11di.me
2009-09-15 | 7 | www.irs.gov.nyh11do.me
2009-09-15 | 9 | www.irs.gov.nyh11dq.me
2009-09-15 | 15 | www.irs.gov.nyh11dr.me
2009-09-15 | 7 | www.irs.gov.nyh11dt.me
2009-09-15 | 6 | www.irs.gov.nyh11du.me
2009-09-15 | 8 | www.irs.gov.nyh11dw.me
2009-09-15 | 6 | www.irs.gov.nyh11dx.me
2009-09-15 | 9 | www.irs.gov.nyh11dy.me
2009-09-15 | 22 | www.irs.gov.vstdrrr.com.cn
2009-09-15 | 15 | www.irs.gov.vstdrrr.mn
2009-09-15 | 20 | www.irs.gov.vstdrrr.us
2009-09-15 | 13 | www.irs.gov.yh11asd.eu
2009-09-15 | 13 | www.irs.gov.yh11asf.eu
2009-09-15 | 7 | www.irs.gov.yh11asg.eu
2009-09-15 | 3 | www.irs.gov.yh11ash.eu
2009-09-15 | 3 | www.irs.gov.yh11asq.eu
2009-09-15 | 10 | www.irs.gov.yh11asr.eu
2009-09-15 | 10 | www.irs.gov.yh11asu.eu
2009-09-15 | 3 | www.irs.gov.yh11asw.eu
2009-09-15 | 10 | www.irs.gov.yh11asy.eu
2009-09-15 | 5 | www.irs.gov.yhqw1sa1.eu
2009-09-15 | 8 | www.irs.gov.yhqw1saw.eu
2009-09-16 | 1 | www.irs.gov.dirvsdl.kr
2009-09-16 | 1 | www.irs.gov.dirvsdl.ne.kr
2009-09-16 | 1 | www.irs.gov.dirvsdl.or.kr
2009-09-16 | 1 | www.irs.gov.hrtfe11u.eu
2009-09-16 | 36 | www.irs.gov.hyuae1d.me
2009-09-16 | 43 | www.irs.gov.hyuae1e.me
2009-09-16 | 3 | www.irs.gov.hyuae1r.me
2009-09-16 | 42 | www.irs.gov.hyuae1u.me
2009-09-16 | 6 | www.irs.gov.hyuae1y.eu
2009-09-16 | 100 | www.irs.gov.jezz1f.eu
2009-09-16 | 24 | www.irs.gov.mdtsrv.bz
2009-09-16 | 6 | www.irs.gov.mdtsrv.com
2009-09-16 | 6 | www.irs.gov.mdtsrv.me
2009-09-16 | 14 | www.irs.gov.mdtsrv.mn
2009-09-16 | 15 | www.irs.gov.modesrv.bz
2009-09-16 | 62 | www.irs.gov.modesrv.com
2009-09-16 | 53 | www.irs.gov.modesrv.me
2009-09-16 | 11 | www.irs.gov.modesrv.mn
2009-09-16 | 1 | www.irs.gov.mtkstrip.co.kr
2009-09-16 | 3 | www.irs.gov.mtkstrip.com
2009-09-16 | 1 | www.irs.gov.mtkstrip.kr
2009-09-16 | 3 | www.irs.gov.nyh11de.me
2009-09-16 | 3 | www.irs.gov.nyh11di.me
2009-09-16 | 2 | www.irs.gov.nyh11do.me
2009-09-16 | 1 | www.irs.gov.nyh11dq.me
2009-09-16 | 4 | www.irs.gov.nyh11dr.me
2009-09-16 | 3 | www.irs.gov.nyh11dt.me
2009-09-16 | 1 | www.irs.gov.nyh11du.me
2009-09-16 | 4 | www.irs.gov.nyh11dw.me
2009-09-16 | 3 | www.irs.gov.nyh11dx.me
2009-09-16 | 3 | www.irs.gov.nyh11dy.me
2009-09-16 | 43 | www.irs.gov.rawq12qe.eu
2009-09-16 | 3 | www.irs.gov.rawq12qe.me
2009-09-16 | 43 | www.irs.gov.rawq12qi.me
2009-09-16 | 46 | www.irs.gov.rawq12qr.me
2009-09-16 | 42 | www.irs.gov.rawq12qt.me
2009-09-16 | 48 | www.irs.gov.rawq12qy.me
2009-09-16 | 14 | www.irs.gov.srvmode.bz
2009-09-16 | 13 | www.irs.gov.srvmode.com
2009-09-16 | 13 | www.irs.gov.srvmode.me
2009-09-16 | 20 | www.irs.gov.srvmode.mn
2009-09-16 | 6 | www.irs.gov.vsdsrv.bz
2009-09-16 | 7 | www.irs.gov.vsdsrv.com
2009-09-16 | 17 | www.irs.gov.vsdsrv.eu
2009-09-16 | 15 | www.irs.gov.vsdsrv.me
2009-09-16 | 17 | www.irs.gov.vsdsrv.mn
2009-09-16 | 13 | www.irs.gov.yh11asd.eu
2009-09-16 | 16 | www.irs.gov.yh11asf.eu
2009-09-16 | 13 | www.irs.gov.yh11asg.eu
2009-09-16 | 2 | www.irs.gov.yh11ash.eu
2009-09-16 | 21 | www.irs.gov.yh11asr.eu
2009-09-16 | 11 | www.irs.gov.yh11ast.eu
2009-09-16 | 15 | www.irs.gov.yh11asu.eu
2009-09-16 | 2 | www.irs.gov.yh11asw.eu
2009-09-16 | 4 | www.irs.gov.yh11asy.eu
2009-09-16 | 11 | www.irs.gov.yhferdh.eu
2009-09-16 | 19 | www.irs.gov.yhferdj.eu
2009-09-16 | 12 | www.irs.gov.yhferdk.eu
2009-09-16 | 15 | www.irs.gov.yhferdo.eu
2009-09-16 | 8 | www.irs.gov.yhferdp.eu
2009-09-16 | 5 | www.irs.gov.yhferdw.eu
2009-09-17 | 17 | www.irs.gov.akmas1.eu
2009-09-17 | 31 | www.irs.gov.hyu11db.eu
2009-09-17 | 24 | www.irs.gov.hyu11db.me
2009-09-17 | 33 | www.irs.gov.hyu11dc.me
2009-09-17 | 16 | www.irs.gov.hyu11de.eu
2009-09-17 | 35 | www.irs.gov.hyu11df.eu
2009-09-17 | 23 | www.irs.gov.hyu11df.me
2009-09-17 | 25 | www.irs.gov.hyu11dg.eu
2009-09-17 | 39 | www.irs.gov.hyu11dg.me
2009-09-17 | 41 | www.irs.gov.hyu11dn.eu
2009-09-17 | 24 | www.irs.gov.hyu11dn.me
2009-09-17 | 51 | www.irs.gov.hyu11dv.eu
2009-09-17 | 24 | www.irs.gov.hyu11dv.me
2009-09-17 | 24 | www.irs.gov.hyu11dx.eu
2009-09-17 | 28 | www.irs.gov.hyu11dx.me
2009-09-17 | 13 | www.irs.gov.ihmas1.eu
2009-09-17 | 16 | www.irs.gov.ikbas1.eu
2009-09-17 | 11 | www.irs.gov.ikmas1.eu
2009-09-17 | 9 | www.irs.gov.ikmls1.eu
2009-09-17 | 20 | www.irs.gov.ikmps1.eu
2009-09-17 | 16 | www.irs.gov.iktas1.eu
2009-09-17 | 17 | www.irs.gov.illas1.eu
2009-09-17 | 7 | www.irs.gov.iwmas1.eu
2009-09-17 | 57 | www.irs.gov.jezz1f.eu
2009-09-17 | 40 | www.irs.gov.lamsa1.com
2009-09-17 | 1 | www.irs.gov.uh1ahq.eu
2009-09-17 | 9 | www.irs.gov.uh1ahx.eu
2009-09-17 | 2 | www.irs.gov.uh1ahy.eu
2009-09-17 | 11 | www.irs.gov.uh1as1.eu
2009-09-17 | 10 | www.irs.gov.uh1asd.eu
2009-09-17 | 9 | www.irs.gov.uh1ase.eu
2009-09-17 | 12 | www.irs.gov.uh1ask.eu
2009-09-17 | 4 | www.irs.gov.uh1asm.eu
2009-09-17 | 4 | www.irs.gov.uh1aso.eu
2009-09-17 | 5 | www.irs.gov.uh1asp.eu
2009-09-17 | 7 | www.irs.gov.uh1asq.eu
2009-09-17 | 4 | www.irs.gov.uh1asr.eu
2009-09-17 | 13 | www.irs.gov.uh1ast.eu
2009-09-17 | 7 | www.irs.gov.uh1asu.eu
2009-09-17 | 8 | www.irs.gov.uh1asv.eu
2009-09-17 | 7 | www.irs.gov.uh1asx.eu
2009-09-17 | 6 | www.irs.gov.uh1asy.eu
2009-09-17 | 8 | www.irs.gov.uh1asz.eu
2009-09-17 | 21 | www.irs.gov.yh1wed.eu
2009-09-17 | 14 | www.irs.gov.yh1wee.eu
2009-09-17 | 19 | www.irs.gov.yh1wee.me
2009-09-17 | 21 | www.irs.gov.yh1wef.eu
2009-09-17 | 16 | www.irs.gov.yh1wej.eu
2009-09-17 | 18 | www.irs.gov.yh1wek.eu
2009-09-17 | 18 | www.irs.gov.yh1wel.eu
2009-09-17 | 25 | www.irs.gov.yh1weq.eu
2009-09-17 | 23 | www.irs.gov.yh1weq.me
2009-09-17 | 26 | www.irs.gov.yh1wes.eu
2009-09-17 | 18 | www.irs.gov.yh1wet.eu
2009-09-17 | 17 | www.irs.gov.yh1wet.me
2009-09-17 | 24 | www.irs.gov.yh1wew.eu
2009-09-17 | 25 | www.irs.gov.yh1wew.me
2009-09-17 | 9 | www.irs.gov.zkmas1.eu
2009-09-18 | 78 | www.irs.gov.kid1ax.eu
2009-09-18 | 66 | www.irs.gov.kid1bx.eu
2009-09-18 | 60 | www.irs.gov.kid1cx.eu
2009-09-18 | 39 | www.irs.gov.kid1ex.eu
2009-09-18 | 66 | www.irs.gov.kid1hx.eu
2009-09-18 | 58 | www.irs.gov.kid1ix.eu
2009-09-18 | 57 | www.irs.gov.kid1nx.eu
2009-09-18 | 13 | www.irs.gov.kid1ox.eu
2009-09-18 | 68 | www.irs.gov.kid1qx.eu
2009-09-18 | 64 | www.irs.gov.kid1sx.eu
2009-09-18 | 24 | www.irs.gov.kid1vx.eu
2009-09-18 | 63 | www.irs.gov.kid1xx.eu
2009-09-18 | 47 | www.irs.gov.kid1zx.eu
2009-09-18 | 77 | www.irs.gov.uh1ahq.eu
2009-09-18 | 46 | www.irs.gov.uh1ahx.eu
2009-09-18 | 31 | www.irs.gov.uh1ahy.eu
2009-09-18 | 30 | www.irs.gov.uh1as1.eu
2009-09-18 | 112 | www.irs.gov.uh1asd.eu
2009-09-18 | 94 | www.irs.gov.uh1ase.eu
2009-09-18 | 30 | www.irs.gov.uh1ask.eu
2009-09-18 | 27 | www.irs.gov.uh1asm.eu
2009-09-18 | 40 | www.irs.gov.uh1aso.eu
2009-09-18 | 111 | www.irs.gov.uh1asp.eu
2009-09-18 | 69 | www.irs.gov.uh1asq.eu
2009-09-18 | 119 | www.irs.gov.uh1asr.eu
2009-09-18 | 60 | www.irs.gov.uh1ast.eu
2009-09-18 | 76 | www.irs.gov.uh1asu.eu
2009-09-18 | 107 | www.irs.gov.uh1asv.eu
2009-09-18 | 26 | www.irs.gov.uh1asx.eu
2009-09-18 | 21 | www.irs.gov.uh1asy.eu
2009-09-18 | 68 | www.irs.gov.uh1asz.eu
2009-09-18 | 67 | www.irs.gov.yh1wed.eu
2009-09-18 | 67 | www.irs.gov.yh1wee.eu
2009-09-18 | 34 | www.irs.gov.yh1wee.me
2009-09-18 | 73 | www.irs.gov.yh1wef.eu
2009-09-18 | 38 | www.irs.gov.yh1wej.eu
2009-09-18 | 32 | www.irs.gov.yh1wek.eu
2009-09-18 | 33 | www.irs.gov.yh1wel.eu
2009-09-18 | 77 | www.irs.gov.yh1weq.eu
2009-09-18 | 22 | www.irs.gov.yh1weq.me
2009-09-18 | 105 | www.irs.gov.yh1wes.eu
2009-09-18 | 65 | www.irs.gov.yh1wet.eu
2009-09-18 | 23 | www.irs.gov.yh1wet.me
2009-09-18 | 69 | www.irs.gov.yh1wew.eu
2009-09-18 | 37 | www.irs.gov.yh1wew.me
2009-09-19 | 105 | www.irs.gov.kid1ax.eu
2009-09-19 | 97 | www.irs.gov.kid1bx.eu
2009-09-19 | 43 | www.irs.gov.kid1cx.eu
2009-09-19 | 27 | www.irs.gov.kid1ex.eu
2009-09-19 | 102 | www.irs.gov.kid1hx.eu
2009-09-19 | 22 | www.irs.gov.kid1ix.eu
2009-09-19 | 103 | www.irs.gov.kid1nx.eu
2009-09-19 | 15 | www.irs.gov.kid1ox.eu
2009-09-19 | 62 | www.irs.gov.kid1qx.eu
2009-09-19 | 59 | www.irs.gov.kid1sx.eu
2009-09-19 | 48 | www.irs.gov.kid1vx.eu
2009-09-19 | 61 | www.irs.gov.kid1xx.eu
2009-09-19 | 78 | www.irs.gov.kid1zx.eu
2009-09-19 | 43 | www.irs.gov.uh1asq.eu
2009-09-20 | 1 | www.irs.gov.her1da.eu
2009-09-20 | 3 | www.irs.gov.her1de.eu
2009-09-20 | 4 | www.irs.gov.her1df.eu
2009-09-20 | 1 | www.irs.gov.her1di.eu
2009-09-20 | 3 | www.irs.gov.her1dj.eu
2009-09-20 | 1 | www.irs.gov.her1dk.eu
2009-09-20 | 5 | www.irs.gov.her1do.eu
2009-09-20 | 4 | www.irs.gov.her1dp.eu
2009-09-20 | 3 | www.irs.gov.her1dq.eu
2009-09-20 | 1 | www.irs.gov.her1dr.eu
2009-09-20 | 2 | www.irs.gov.her1dt.eu
2009-09-20 | 1 | www.irs.gov.her1du.eu
2009-09-20 | 1 | www.irs.gov.her1dw.eu
2009-09-20 | 3 | www.irs.gov.her1dy.eu
2009-09-20 | 4 | www.irs.gov.her1dz.eu
2009-09-20 | 2 | www.irs.gov.jaha1ws.eu
2009-09-20 | 2 | www.irs.gov.jbha1ws.eu
2009-09-20 | 3 | www.irs.gov.jgha1ws.eu
2009-09-20 | 2 | www.irs.gov.jjha1ws.eu
2009-09-20 | 3 | www.irs.gov.jkha1ws.eu
2009-09-20 | 4 | www.irs.gov.jmha1ws.eu
2009-09-20 | 3 | www.irs.gov.jpha1ws.eu
2009-09-20 | 1 | www.irs.gov.jqha1ws.eu
2009-09-20 | 1 | www.irs.gov.jrha1ws.eu
2009-09-20 | 4 | www.irs.gov.jtha1ws.eu
2009-09-20 | 3 | www.irs.gov.juha1ws.eu
2009-09-20 | 3 | www.irs.gov.jvha1ws.eu
2009-09-20 | 3 | www.irs.gov.jwha1ws.eu
2009-09-20 | 1 | www.irs.gov.poi1qwa.eu
2009-09-20 | 3 | www.irs.gov.poi1qwb.eu
2009-09-20 | 1 | www.irs.gov.poi1qwd.eu
2009-09-20 | 6 | www.irs.gov.poi1qwf.eu
2009-09-20 | 4 | www.irs.gov.poi1qwg.eu
2009-09-20 | 1 | www.irs.gov.poi1qwm.eu
2009-09-20 | 1 | www.irs.gov.poi1qwq.eu
2009-09-20 | 3 | www.irs.gov.poi1qwr.eu
2009-09-20 | 3 | www.irs.gov.poi1qwt.eu
2009-09-20 | 5 | www.irs.gov.poi1qwv.eu
2009-09-20 | 3 | www.irs.gov.poi1qww.eu
2009-09-20 | 1 | www.irs.gov.poi1qwy.eu
2009-09-20 | 417 | www.irs.gov.uh1asq.eu
2009-09-21 | 4 | www.irs.gov.akuja1.eu
2009-09-21 | 10 | www.irs.gov.gkuja1.eu
2009-09-21 | 10 | www.irs.gov.her1da.eu
2009-09-21 | 12 | www.irs.gov.her1de.eu
2009-09-21 | 36 | www.irs.gov.her1di.eu
2009-09-21 | 2 | www.irs.gov.her1dj.eu
2009-09-21 | 1 | www.irs.gov.her1dk.eu
2009-09-21 | 21 | www.irs.gov.her1do.eu
2009-09-21 | 3 | www.irs.gov.her1dp.eu
2009-09-21 | 15 | www.irs.gov.her1dq.eu
2009-09-21 | 16 | www.irs.gov.her1dr.eu
2009-09-21 | 19 | www.irs.gov.her1dt.eu
2009-09-21 | 22 | www.irs.gov.her1du.eu
2009-09-21 | 18 | www.irs.gov.her1dw.eu
2009-09-21 | 13 | www.irs.gov.her1dy.eu
2009-09-21 | 4 | www.irs.gov.her1dz.eu
2009-09-21 | 15 | www.irs.gov.hkuja1.eu
2009-09-21 | 9 | www.irs.gov.hou1ma.eu
2009-09-21 | 17 | www.irs.gov.hou1me.eu
2009-09-21 | 4 | www.irs.gov.hou1mg.eu
2009-09-21 | 9 | www.irs.gov.hou1mi.eu
2009-09-21 | 2 | www.irs.gov.hou1mj.eu
2009-09-21 | 4 | www.irs.gov.hou1mk.eu
2009-09-21 | 1 | www.irs.gov.hou1ml.eu
2009-09-21 | 4 | www.irs.gov.hou1mo.eu
2009-09-21 | 3 | www.irs.gov.hou1mp.eu
2009-09-21 | 13 | www.irs.gov.hou1mq.eu
2009-09-21 | 11 | www.irs.gov.hou1mr.eu
2009-09-21 | 20 | www.irs.gov.hou1mt.eu
2009-09-21 | 4 | www.irs.gov.hou1mu.eu
2009-09-21 | 14 | www.irs.gov.hou1mw.eu
2009-09-21 | 3 | www.irs.gov.hou1my.eu
2009-09-21 | 4 | www.irs.gov.jaha1ws.eu
2009-09-21 | 40 | www.irs.gov.jdha1ws.eu
2009-09-21 | 22 | www.irs.gov.jgha1ws.eu
2009-09-21 | 23 | www.irs.gov.jjha1ws.eu
2009-09-21 | 17 | www.irs.gov.jkha1ws.eu
2009-09-21 | 10 | www.irs.gov.jkuja1.eu
2009-09-21 | 14 | www.irs.gov.jmha1ws.eu
2009-09-21 | 7 | www.irs.gov.jnha1ws.eu
2009-09-21 | 9 | www.irs.gov.jpha1ws.eu
2009-09-21 | 18 | www.irs.gov.jqha1ws.eu
2009-09-21 | 7 | www.irs.gov.jrha1ws.eu
2009-09-21 | 4 | www.irs.gov.jtha1ws.eu
2009-09-21 | 8 | www.irs.gov.juha1ws.eu
2009-09-21 | 6 | www.irs.gov.jvha1ws.eu
2009-09-21 | 19 | www.irs.gov.jwha1ws.eu
2009-09-21 | 14 | www.irs.gov.kkuja1.eu
2009-09-21 | 4 | www.irs.gov.lkuja1.eu
2009-09-21 | 17 | www.irs.gov.naj1za.eu
2009-09-21 | 5 | www.irs.gov.ncj1za.eu
2009-09-21 | 8 | www.irs.gov.nej1za.eu
2009-09-21 | 6 | www.irs.gov.nij1za.eu
2009-09-21 | 18 | www.irs.gov.nkuja1.eu
2009-09-21 | 13 | www.irs.gov.noj1za.eu
2009-09-21 | 13 | www.irs.gov.nuj1za.eu
2009-09-21 | 2 | www.irs.gov.nxj1za.eu
2009-09-21 | 2 | www.irs.gov.nye1za.eu
2009-09-21 | 10 | www.irs.gov.nyj1za.eu
2009-09-21 | 1 | www.irs.gov.nym1za.eu
2009-09-21 | 1 | www.irs.gov.nyo1za.eu
2009-09-21 | 2 | www.irs.gov.nyq1za.eu
2009-09-21 | 15 | www.irs.gov.pkuja1.eu
2009-09-21 | 32 | www.irs.gov.poi1qwa.eu
2009-09-21 | 13 | www.irs.gov.poi1qwb.eu
2009-09-21 | 25 | www.irs.gov.poi1qwd.eu
2009-09-21 | 10 | www.irs.gov.poi1qwf.eu
2009-09-21 | 20 | www.irs.gov.poi1qwg.eu
2009-09-21 | 22 | www.irs.gov.poi1qwm.eu
2009-09-21 | 16 | www.irs.gov.poi1qwn.eu
2009-09-21 | 1 | www.irs.gov.poi1qwq.eu
2009-09-21 | 1 | www.irs.gov.poi1qwr.eu
2009-09-21 | 12 | www.irs.gov.poi1qwt.eu
2009-09-21 | 13 | www.irs.gov.poi1qwv.eu
2009-09-21 | 1 | www.irs.gov.poi1qww.eu
2009-09-21 | 21 | www.irs.gov.poi1qwy.eu
2009-09-21 | 32 | www.irs.gov.poi1qwz.eu
2009-09-21 | 3 | www.irs.gov.qkuja1.eu
2009-09-21 | 10 | www.irs.gov.tkuja1.eu
2009-09-21 | 20 | www.irs.gov.ykuja1.eu
2009-09-21 | 1 | www.irs.gov.zkuja1.eu
2009-09-22 | 5 | www.irs.gov.akuja1.eu
2009-09-22 | 3 | www.irs.gov.gkuja1.eu
2009-09-22 | 1 | www.irs.gov.her1do.eu
2009-09-22 | 5 | www.irs.gov.herd1a.eu
2009-09-22 | 1 | www.irs.gov.here1a.eu
2009-09-22 | 4 | www.irs.gov.herf1a.eu
2009-09-22 | 4 | www.irs.gov.herq1a.eu
2009-09-22 | 3 | www.irs.gov.herr1a.eu
2009-09-22 | 6 | www.irs.gov.hert1a.eu
2009-09-22 | 2 | www.irs.gov.herw1a.eu
2009-09-22 | 1 | www.irs.gov.hery1a.eu
2009-09-22 | 5 | www.irs.gov.hkuja1.eu
2009-09-22 | 3 | www.irs.gov.hou1ma.eu
2009-09-22 | 7 | www.irs.gov.hou1me.eu
2009-09-22 | 8 | www.irs.gov.hou1mg.eu
2009-09-22 | 4 | www.irs.gov.hou1mi.eu
2009-09-22 | 7 | www.irs.gov.hou1mj.eu
2009-09-22 | 3 | www.irs.gov.hou1mk.eu
2009-09-22 | 5 | www.irs.gov.hou1ml.eu
2009-09-22 | 6 | www.irs.gov.hou1mo.eu
2009-09-22 | 7 | www.irs.gov.hou1mp.eu
2009-09-22 | 4 | www.irs.gov.hou1mr.eu
2009-09-22 | 4 | www.irs.gov.hou1mt.eu
2009-09-22 | 3 | www.irs.gov.hou1mu.eu
2009-09-22 | 8 | www.irs.gov.hou1mw.eu
2009-09-22 | 9 | www.irs.gov.hou1my.eu
2009-09-22 | 167 | www.irs.gov.ipdotfl.com
2009-09-22 | 4 | www.irs.gov.jkuja1.eu
2009-09-22 | 4 | www.irs.gov.kkuja1.eu
2009-09-22 | 19 | www.irs.gov.likka1.eu
2009-09-22 | 14 | www.irs.gov.likkb1.eu
2009-09-22 | 14 | www.irs.gov.likkc1.eu
2009-09-22 | 13 | www.irs.gov.likkd1.eu
2009-09-22 | 20 | www.irs.gov.likke1.eu
2009-09-22 | 19 | www.irs.gov.likkh1.eu
2009-09-22 | 15 | www.irs.gov.likkm1.eu
2009-09-22 | 9 | www.irs.gov.likkn1.eu
2009-09-22 | 11 | www.irs.gov.likko1.eu
2009-09-22 | 16 | www.irs.gov.likkt1.eu
2009-09-22 | 21 | www.irs.gov.likkv1.eu
2009-09-22 | 14 | www.irs.gov.likkx1.eu
2009-09-22 | 11 | www.irs.gov.likky1.eu
2009-09-22 | 15 | www.irs.gov.likkz1.eu
2009-09-22 | 15 | www.irs.gov.likzn1.eu
2009-09-22 | 4 | www.irs.gov.lkuja1.eu
2009-09-22 | 2 | www.irs.gov.naj1za.eu
2009-09-22 | 5 | www.irs.gov.ncj1za.eu
2009-09-22 | 3 | www.irs.gov.nej1za.eu
2009-09-22 | 5 | www.irs.gov.nij1za.eu
2009-09-22 | 7 | www.irs.gov.nkuja1.eu
2009-09-22 | 3 | www.irs.gov.noj1za.eu
2009-09-22 | 19 | www.irs.gov.nuhh1b.eu
2009-09-22 | 15 | www.irs.gov.nuhh1c.eu
2009-09-22 | 5 | www.irs.gov.nuhh1d.eu
2009-09-22 | 17 | www.irs.gov.nuhh1f.eu
2009-09-22 | 14 | www.irs.gov.nuhh1g.eu
2009-09-22 | 17 | www.irs.gov.nuhh1h.eu
2009-09-22 | 14 | www.irs.gov.nuhh1k.eu
2009-09-22 | 18 | www.irs.gov.nuhh1l.eu
2009-09-22 | 22 | www.irs.gov.nuhh1m.eu
2009-09-22 | 24 | www.irs.gov.nuhh1n.eu
2009-09-22 | 3 | www.irs.gov.nuhh1s.eu
2009-09-22 | 20 | www.irs.gov.nuhh1v.eu
2009-09-22 | 10 | www.irs.gov.nuhh1x.eu
2009-09-22 | 14 | www.irs.gov.nuhh1z.eu
2009-09-22 | 3 | www.irs.gov.nuj1za.eu
2009-09-22 | 4 | www.irs.gov.nxj1za.eu
2009-09-22 | 2 | www.irs.gov.nye1za.eu
2009-09-22 | 6 | www.irs.gov.nyj1za.eu
2009-09-22 | 3 | www.irs.gov.nyjnza.eu
2009-09-22 | 2 | www.irs.gov.nym1za.eu
2009-09-22 | 5 | www.irs.gov.nyo1za.eu
2009-09-22 | 6 | www.irs.gov.nyq1za.eu
2009-09-22 | 3 | www.irs.gov.nzj1za.eu
2009-09-22 | 6 | www.irs.gov.pkuja1.eu
2009-09-22 | 1 | www.irs.gov.poi1qwz.eu
2009-09-22 | 6 | www.irs.gov.qkuja1.eu
2009-09-22 | 128 | www.irs.gov.strmodefs.bz
2009-09-22 | 123 | www.irs.gov.strmodefs.com
2009-09-22 | 6 | www.irs.gov.tkuja1.eu
2009-09-22 | 19 | www.irs.gov.xyg1qe.eu
2009-09-22 | 9 | www.irs.gov.xyg1qq.eu
2009-09-22 | 8 | www.irs.gov.xyg1qr.eu
2009-09-22 | 4 | www.irs.gov.xyg1qt.eu
2009-09-22 | 18 | www.irs.gov.xyg1qu.eu
2009-09-22 | 15 | www.irs.gov.xyg1qw.eu
2009-09-22 | 22 | www.irs.gov.xyg1qy.eu
2009-09-22 | 5 | www.irs.gov.ykuja1.eu
2009-09-22 | 6 | www.irs.gov.zkuja1.eu
2009-09-23 | 5 | www.irs.gov.ea1asb.eu
2009-09-23 | 8 | www.irs.gov.ea1asc.eu
2009-09-23 | 4 | www.irs.gov.ea1asd.eu
2009-09-23 | 2 | www.irs.gov.ea1ase.eu
2009-09-23 | 6 | www.irs.gov.ea1asf.eu
2009-09-23 | 6 | www.irs.gov.ea1asg.eu
2009-09-23 | 1 | www.irs.gov.ea1ash.eu
2009-09-23 | 6 | www.irs.gov.ea1ask.eu
2009-09-23 | 3 | www.irs.gov.ea1asm.eu
2009-09-23 | 3 | www.irs.gov.ea1asn.eu
2009-09-23 | 4 | www.irs.gov.ea1aso.eu
2009-09-23 | 7 | www.irs.gov.ea1asu.eu
2009-09-23 | 1 | www.irs.gov.ea1asv.eu
2009-09-23 | 5 | www.irs.gov.ea1asx.eu
2009-09-23 | 4 | www.irs.gov.ea1asz.eu
2009-09-23 | 7 | www.irs.gov.herd1a.eu
2009-09-23 | 6 | www.irs.gov.here1a.eu
2009-09-23 | 9 | www.irs.gov.herf1a.eu
2009-09-23 | 11 | www.irs.gov.herq1a.eu
2009-09-23 | 9 | www.irs.gov.herr1a.eu
2009-09-23 | 10 | www.irs.gov.hert1a.eu
2009-09-23 | 6 | www.irs.gov.herw1a.eu
2009-09-23 | 9 | www.irs.gov.hery1a.eu
2009-09-23 | 5 | www.irs.gov.ipdotfl.com
2009-09-23 | 11 | www.irs.gov.likka1.eu
2009-09-23 | 11 | www.irs.gov.likkb1.eu
2009-09-23 | 9 | www.irs.gov.likkc1.eu
2009-09-23 | 9 | www.irs.gov.likkd1.eu
2009-09-23 | 7 | www.irs.gov.likke1.eu
2009-09-23 | 16 | www.irs.gov.likkh1.eu
2009-09-23 | 10 | www.irs.gov.likkm1.eu
2009-09-23 | 7 | www.irs.gov.likkn1.eu
2009-09-23 | 2 | www.irs.gov.likko1.eu
2009-09-23 | 8 | www.irs.gov.likkt1.eu
2009-09-23 | 8 | www.irs.gov.likkv1.eu
2009-09-23 | 3 | www.irs.gov.likkx1.eu
2009-09-23 | 3 | www.irs.gov.likky1.eu
2009-09-23 | 5 | www.irs.gov.likkz1.eu
2009-09-23 | 7 | www.irs.gov.likzn1.eu
2009-09-23 | 7 | www.irs.gov.nuhh1b.eu
2009-09-23 | 4 | www.irs.gov.nuhh1c.eu
2009-09-23 | 7 | www.irs.gov.nuhh1d.eu
2009-09-23 | 7 | www.irs.gov.nuhh1f.eu
2009-09-23 | 4 | www.irs.gov.nuhh1g.eu
2009-09-23 | 2 | www.irs.gov.nuhh1h.eu
2009-09-23 | 10 | www.irs.gov.nuhh1k.eu
2009-09-23 | 2 | www.irs.gov.nuhh1l.eu
2009-09-23 | 6 | www.irs.gov.nuhh1m.eu
2009-09-23 | 10 | www.irs.gov.nuhh1n.eu
2009-09-23 | 7 | www.irs.gov.nuhh1s.eu
2009-09-23 | 10 | www.irs.gov.nuhh1v.eu
2009-09-23 | 10 | www.irs.gov.nuhh1x.eu
2009-09-23 | 6 | www.irs.gov.nuhh1z.eu
2009-09-23 | 11 | www.irs.gov.xyg1qe.eu
2009-09-23 | 7 | www.irs.gov.xyg1qq.eu
2009-09-23 | 6 | www.irs.gov.xyg1qr.eu
2009-09-23 | 11 | www.irs.gov.xyg1qt.eu
2009-09-23 | 9 | www.irs.gov.xyg1qu.eu
2009-09-23 | 7 | www.irs.gov.xyg1qw.eu
2009-09-23 | 11 | www.irs.gov.xyg1qy.eu
2009-09-24 | 10 | www.irs.gov.awh7kio.eu
2009-09-24 | 6 | www.irs.gov.do11juy.eu
2009-09-24 | 2 | www.irs.gov.fo11juy.eu
2009-09-24 | 8 | www.irs.gov.ger11sa.com
2009-09-24 | 3 | www.irs.gov.ger11se.com
2009-09-24 | 2 | www.irs.gov.ger11si.com
2009-09-24 | 3 | www.irs.gov.ger11so.com
2009-09-24 | 4 | www.irs.gov.ger11sy.com
2009-09-24 | 7 | www.irs.gov.ger11za.com
2009-09-24 | 1 | www.irs.gov.ger11ze.com
2009-09-24 | 6 | www.irs.gov.ger11zi.com
2009-09-24 | 11 | www.irs.gov.ger11zo.com
2009-09-24 | 4 | www.irs.gov.ger11zy.com
2009-09-24 | 7 | www.irs.gov.go11juy.eu
2009-09-24 | 14 | www.irs.gov.hu1wev.eu
2009-09-24 | 7 | www.irs.gov.i11ate.eu
2009-09-24 | 3 | www.irs.gov.i11bte.eu
2009-09-24 | 4 | www.irs.gov.i11ete.eu
2009-09-24 | 1 | www.irs.gov.i11hte.eu
2009-09-24 | 7 | www.irs.gov.i11ite.eu
2009-09-24 | 8 | www.irs.gov.i11mte.eu
2009-09-24 | 4 | www.irs.gov.i11nte.eu
2009-09-24 | 4 | www.irs.gov.i11ote.eu
2009-09-24 | 4 | www.irs.gov.i11pte.eu
2009-09-24 | 7 | www.irs.gov.i11rte.eu
2009-09-24 | 7 | www.irs.gov.i11tte.eu
2009-09-24 | 7 | www.irs.gov.i11ute.eu
2009-09-24 | 7 | www.irs.gov.i11wte.eu
2009-09-24 | 3 | www.irs.gov.i11xte.eu
2009-09-24 | 6 | www.irs.gov.i11zte.eu
2009-09-24 | 18 | www.irs.gov.ijh7kio.eu
2009-09-24 | 4 | www.irs.gov.ikh7kio.eu
2009-09-24 | 6 | www.irs.gov.io11juy.eu
2009-09-24 | 12 | www.irs.gov.iz1fd2.eu
2009-09-24 | 10 | www.irs.gov.iz1ff2.eu
2009-09-24 | 9 | www.irs.gov.iz1gf2.eu
2009-09-24 | 10 | www.irs.gov.iz1hf2.eu
2009-09-24 | 14 | www.irs.gov.iz1if2.eu
2009-09-24 | 15 | www.irs.gov.iz1jf2.eu
2009-09-24 | 4 | www.irs.gov.iz1kf2.eu
2009-09-24 | 8 | www.irs.gov.iz1lf2.eu
2009-09-24 | 5 | www.irs.gov.iz1pf2.eu
2009-09-24 | 12 | www.irs.gov.iz1qf2.eu
2009-09-24 | 7 | www.irs.gov.iz1rf2.eu
2009-09-24 | 10 | www.irs.gov.iz1tf2.eu
2009-09-24 | 8 | www.irs.gov.iz1uf2.eu
2009-09-24 | 7 | www.irs.gov.iz1wf2.eu
2009-09-24 | 9 | www.irs.gov.iz1yf2.eu
2009-09-24 | 3 | www.irs.gov.jo11juy.eu
2009-09-24 | 11 | www.irs.gov.mah7kio.eu
2009-09-24 | 4 | www.irs.gov.mi11f1.eu
2009-09-24 | 6 | www.irs.gov.mi11fa.eu
2009-09-24 | 6 | www.irs.gov.mi11fd.eu
2009-09-24 | 5 | www.irs.gov.mi11fe.eu
2009-09-24 | 8 | www.irs.gov.mi11ff.eu
2009-09-24 | 3 | www.irs.gov.mi11fi.eu
2009-09-24 | 5 | www.irs.gov.mi11fo.eu
2009-09-24 | 7 | www.irs.gov.mi11fp.eu
2009-09-24 | 2 | www.irs.gov.mi11fq.eu
2009-09-24 | 6 | www.irs.gov.mi11fr.eu
2009-09-24 | 3 | www.irs.gov.mi11fs.eu
2009-09-24 | 2 | www.irs.gov.mi11ft.eu
2009-09-24 | 6 | www.irs.gov.mi11fu.eu
2009-09-24 | 2 | www.irs.gov.mi11fw.eu
2009-09-24 | 4 | www.irs.gov.mi11fy.eu
2009-09-24 | 5 | www.irs.gov.nuh7kio.eu
2009-09-24 | 4 | www.irs.gov.nuko7u1.eu
2009-09-24 | 8 | www.irs.gov.nuko7ue.eu
2009-09-24 | 3 | www.irs.gov.nuko7ug.eu
2009-09-24 | 3 | www.irs.gov.nuko7uh.eu
2009-09-24 | 4 | www.irs.gov.nuko7ui.eu
2009-09-24 | 11 | www.irs.gov.nuko7uj.eu
2009-09-24 | 6 | www.irs.gov.nuko7uk.eu
2009-09-24 | 6 | www.irs.gov.nuko7uo.eu
2009-09-24 | 7 | www.irs.gov.nuko7up.eu
2009-09-24 | 7 | www.irs.gov.nuko7uq.eu
2009-09-24 | 14 | www.irs.gov.nuko7ur.eu
2009-09-24 | 3 | www.irs.gov.nuko7ut.eu
2009-09-24 | 7 | www.irs.gov.nuko7uu.eu
2009-09-24 | 7 | www.irs.gov.nuko7uw.eu
2009-09-24 | 7 | www.irs.gov.nuko7uy.eu
2009-09-24 | 2 | www.irs.gov.oo11juy.eu
2009-09-24 | 1 | www.irs.gov.po11juy.eu
2009-09-24 | 17 | www.irs.gov.poh7kio.eu
2009-09-24 | 16 | www.irs.gov.qyh7kio.eu
2009-09-24 | 5 | www.irs.gov.ro11juy.eu
2009-09-24 | 4 | www.irs.gov.so11juy.eu
2009-09-24 | 3 | www.irs.gov.to11juy.eu
2009-09-24 | 2 | www.irs.gov.uij7yj.eu
2009-09-24 | 2 | www.irs.gov.uij7yl.eu
2009-09-24 | 1 | www.irs.gov.uij7ym.eu
2009-09-24 | 2 | www.irs.gov.uij7yq.eu
2009-09-24 | 3 | www.irs.gov.uij7yt.eu
2009-09-24 | 2 | www.irs.gov.uij7yy.eu
2009-09-24 | 2 | www.irs.gov.uij7yz.eu
2009-09-24 | 4 | www.irs.gov.uo11juy.eu
2009-09-24 | 14 | www.irs.gov.veh7kio.eu
2009-09-24 | 4 | www.irs.gov.xo11juy.eu
2009-09-24 | 7 | www.irs.gov.yoky1a.eu
2009-09-24 | 2 | www.irs.gov.yoky1c.eu
2009-09-24 | 3 | www.irs.gov.yoky1d.eu
2009-09-24 | 4 | www.irs.gov.yoky1e.eu
2009-09-24 | 2 | www.irs.gov.yoky1f.eu
2009-09-24 | 7 | www.irs.gov.yoky1g.eu
2009-09-24 | 4 | www.irs.gov.yoky1n.eu
2009-09-24 | 3 | www.irs.gov.yoky1r.eu
2009-09-24 | 6 | www.irs.gov.yoky1s.eu
2009-09-24 | 4 | www.irs.gov.yoky1t.eu
2009-09-24 | 3 | www.irs.gov.yoky1w.eu
2009-09-24 | 5 | www.irs.gov.yoky1x.eu
2009-09-24 | 2 | www.irs.gov.yoky1y.eu
2009-09-24 | 5 | www.irs.gov.yoky1z.eu
2009-09-24 | 4 | www.irs.gov.zah7kio.eu
2009-09-24 | 18 | www.irs.gov.zuh7kio.eu
2009-09-25 | 2 | www.irs.gov.bbasza.com
2009-09-25 | 2 | www.irs.gov.bbaszb.com
2009-09-25 | 3 | www.irs.gov.bbaszc.com
2009-09-25 | 3 | www.irs.gov.bbaszd.com
2009-09-25 | 3 | www.irs.gov.bbasze.com
2009-09-25 | 5 | www.irs.gov.bbaszf.com
2009-09-25 | 2 | www.irs.gov.bbaszg.com
2009-09-25 | 3 | www.irs.gov.bbaszl.com
2009-09-25 | 2 | www.irs.gov.bbaszq.com
2009-09-25 | 3 | www.irs.gov.bbaszs.com
2009-09-25 | 4 | www.irs.gov.bbaszt.com
2009-09-25 | 3 | www.irs.gov.bbaszv.com
2009-09-25 | 2 | www.irs.gov.bbaszw.com
2009-09-25 | 3 | www.irs.gov.bbaszx.com
2009-09-25 | 4 | www.irs.gov.bbaszz.com
2009-09-25 | 1 | www.irs.gov.fedas1ah.com
2009-09-25 | 15 | www.irs.gov.ger11sa.com
2009-09-25 | 12 | www.irs.gov.ger11se.com
2009-09-25 | 4 | www.irs.gov.ger11si.com
2009-09-25 | 14 | www.irs.gov.ger11so.com
2009-09-25 | 16 | www.irs.gov.ger11sy.com
2009-09-25 | 8 | www.irs.gov.ger11za.com
2009-09-25 | 4 | www.irs.gov.ger11ze.com
2009-09-25 | 21 | www.irs.gov.ger11zi.com
2009-09-25 | 19 | www.irs.gov.ger11zo.com
2009-09-25 | 11 | www.irs.gov.ger11zy.com
2009-09-25 | 14 | www.irs.gov.nuko7u1.eu
2009-09-25 | 17 | www.irs.gov.nuko7ue.eu
2009-09-25 | 13 | www.irs.gov.nuko7ug.eu
2009-09-25 | 27 | www.irs.gov.nuko7uh.eu
2009-09-25 | 29 | www.irs.gov.nuko7ui.eu
2009-09-25 | 15 | www.irs.gov.nuko7uj.eu
2009-09-25 | 14 | www.irs.gov.nuko7uk.eu
2009-09-25 | 28 | www.irs.gov.nuko7uo.eu
2009-09-25 | 12 | www.irs.gov.nuko7up.eu
2009-09-25 | 16 | www.irs.gov.nuko7uq.eu
2009-09-25 | 19 | www.irs.gov.nuko7ur.eu
2009-09-25 | 11 | www.irs.gov.nuko7ut.eu
2009-09-25 | 24 | www.irs.gov.nuko7uu.eu
2009-09-25 | 14 | www.irs.gov.nuko7uw.eu
2009-09-25 | 15 | www.irs.gov.nuko7uy.eu
2009-09-25 | 1 | www.irs.gov.nuya1ze.eu
2009-09-25 | 14 | www.irs.gov.nuya1zg.eu
2009-09-25 | 6 | www.irs.gov.nuya1zh.eu
2009-09-25 | 3 | www.irs.gov.nuya1zi.eu
2009-09-25 | 3 | www.irs.gov.nuya1zl.eu
2009-09-25 | 9 | www.irs.gov.nuya1zo.eu
2009-09-25 | 7 | www.irs.gov.nuya1zp.eu
2009-09-25 | 9 | www.irs.gov.nuya1zq.eu
2009-09-25 | 9 | www.irs.gov.nuya1zt.eu
2009-09-25 | 6 | www.irs.gov.nuya1zw.eu
2009-09-25 | 2 | www.irs.gov.nuya1zy.eu
2009-09-25 | 26 | www.irs.gov.y11dera.com
2009-09-25 | 28 | www.irs.gov.y11derc.com
2009-09-25 | 24 | www.irs.gov.y11derd.com
2009-09-25 | 15 | www.irs.gov.y11dere.com
2009-09-25 | 34 | www.irs.gov.y11derf.com
2009-09-25 | 12 | www.irs.gov.y11derq.com
2009-09-25 | 7 | www.irs.gov.y11derr.com
2009-09-25 | 4 | www.irs.gov.y11ders.com
2009-09-25 | 20 | www.irs.gov.y11derv.com
2009-09-25 | 19 | www.irs.gov.y11derw.com
2009-09-25 | 8 | www.irs.gov.y11derx.com
2009-09-25 | 14 | www.irs.gov.y11derz.com
2009-09-26 | 1 | www.irs.gov.berfa1b.com
2009-09-26 | 1 | www.irs.gov.berfa1j.com
2009-09-26 | 2 | www.irs.gov.berfa1k.com
2009-09-26 | 7 | www.irs.gov.berfa1m.com
2009-09-26 | 3 | www.irs.gov.berfa1p.com
2009-09-26 | 1 | www.irs.gov.berfa1q.com
2009-09-26 | 8 | www.irs.gov.berfa1r.com
2009-09-26 | 2 | www.irs.gov.berfa1s.com
2009-09-26 | 3 | www.irs.gov.berfa1w.com
2009-09-26 | 1 | www.irs.gov.berfa1z.com
2009-09-26 | 7 | www.irs.gov.fedas1aa.com
2009-09-26 | 3 | www.irs.gov.fedas1ab.com
2009-09-26 | 5 | www.irs.gov.fedas1ad.com
2009-09-26 | 8 | www.irs.gov.fedas1af.com
2009-09-26 | 5 | www.irs.gov.fedas1ag.com
2009-09-26 | 7 | www.irs.gov.fedas1ah.com
2009-09-26 | 6 | www.irs.gov.fedas1ak.com
2009-09-26 | 7 | www.irs.gov.fedas1am.com
2009-09-26 | 8 | www.irs.gov.fedas1an.com
2009-09-26 | 3 | www.irs.gov.fedas1ao.com
2009-09-26 | 6 | www.irs.gov.fedas1aq.com
2009-09-26 | 2 | www.irs.gov.fedas1ar.com
2009-09-26 | 6 | www.irs.gov.fedas1as.com
2009-09-26 | 2 | www.irs.gov.fedas1av.com
2009-09-26 | 5 | www.irs.gov.fedas1az.com
2009-09-26 | 5 | www.irs.gov.juhh1we.com
2009-09-26 | 6 | www.irs.gov.juhh1wf.com
2009-09-26 | 3 | www.irs.gov.juhh1wg.com
2009-09-26 | 4 | www.irs.gov.juhh1wh.com
2009-09-26 | 4 | www.irs.gov.juhh1wi.com
2009-09-26 | 5 | www.irs.gov.juhh1wj.com
2009-09-26 | 3 | www.irs.gov.juhh1wn.com
2009-09-26 | 5 | www.irs.gov.juhh1wo.com
2009-09-26 | 5 | www.irs.gov.juhh1wp.com
2009-09-26 | 3 | www.irs.gov.juhh1wq.com
2009-09-26 | 2 | www.irs.gov.juhh1wr.com
2009-09-26 | 3 | www.irs.gov.juhh1wt.com
2009-09-26 | 5 | www.irs.gov.juhh1wu.com
2009-09-26 | 2 | www.irs.gov.juhh1wy.com
2009-09-26 | 47 | www.irs.gov.y11dera.com
2009-09-26 | 46 | www.irs.gov.y11derc.com
2009-09-26 | 38 | www.irs.gov.y11derd.com
2009-09-26 | 36 | www.irs.gov.y11dere.com
2009-09-26 | 35 | www.irs.gov.y11derf.com
2009-09-26 | 49 | www.irs.gov.y11derq.com
2009-09-26 | 39 | www.irs.gov.y11derr.com
2009-09-26 | 34 | www.irs.gov.y11ders.com
2009-09-26 | 47 | www.irs.gov.y11derv.com
2009-09-26 | 50 | www.irs.gov.y11derw.com
2009-09-26 | 40 | www.irs.gov.y11derx.com
2009-09-26 | 44 | www.irs.gov.y11derz.com
2009-09-27 | 17 | www.irs.gov.fedas1aa.com
2009-09-27 | 22 | www.irs.gov.fedas1ab.com
2009-09-27 | 10 | www.irs.gov.fedas1ad.com
2009-09-27 | 17 | www.irs.gov.fedas1af.com
2009-09-27 | 16 | www.irs.gov.fedas1ag.com
2009-09-27 | 16 | www.irs.gov.fedas1ah.com
2009-09-27 | 15 | www.irs.gov.fedas1ak.com
2009-09-27 | 20 | www.irs.gov.fedas1am.com
2009-09-27 | 23 | www.irs.gov.fedas1an.com
2009-09-27 | 17 | www.irs.gov.fedas1ao.com
2009-09-27 | 13 | www.irs.gov.fedas1aq.com
2009-09-27 | 17 | www.irs.gov.fedas1ar.com
2009-09-27 | 16 | www.irs.gov.fedas1as.com
2009-09-27 | 18 | www.irs.gov.fedas1av.com
2009-09-27 | 17 | www.irs.gov.fedas1az.com
2009-09-27 | 29 | www.irs.gov.juhh1we.com
2009-09-27 | 15 | www.irs.gov.juhh1wf.com
2009-09-27 | 12 | www.irs.gov.juhh1wg.com
2009-09-27 | 18 | www.irs.gov.juhh1wh.com
2009-09-27 | 23 | www.irs.gov.juhh1wi.com
2009-09-27 | 17 | www.irs.gov.juhh1wj.com
2009-09-27 | 22 | www.irs.gov.juhh1wn.com
2009-09-27 | 28 | www.irs.gov.juhh1wo.com
2009-09-27 | 19 | www.irs.gov.juhh1wp.com
2009-09-27 | 24 | www.irs.gov.juhh1wq.com
2009-09-27 | 17 | www.irs.gov.juhh1wr.com
2009-09-27 | 26 | www.irs.gov.juhh1wt.com
2009-09-27 | 15 | www.irs.gov.juhh1wu.com
2009-09-27 | 24 | www.irs.gov.juhh1wy.com
2009-09-27 | 19 | www.irs.gov.y11dera.com
2009-09-27 | 23 | www.irs.gov.y11derc.com
2009-09-27 | 15 | www.irs.gov.y11derd.com
2009-09-27 | 18 | www.irs.gov.y11dere.com
2009-09-27 | 24 | www.irs.gov.y11derf.com
2009-09-27 | 17 | www.irs.gov.y11derq.com
2009-09-27 | 16 | www.irs.gov.y11derr.com
2009-09-27 | 17 | www.irs.gov.y11ders.com
2009-09-27 | 13 | www.irs.gov.y11derv.com
2009-09-27 | 25 | www.irs.gov.y11derw.com
2009-09-27 | 22 | www.irs.gov.y11derx.com
2009-09-27 | 24 | www.irs.gov.y11derz.com
2009-09-28 | 5 | www.irs.gov.fedas1aa.com
2009-09-28 | 5 | www.irs.gov.fedas1ab.com
2009-09-28 | 4 | www.irs.gov.fedas1ad.com
2009-09-28 | 5 | www.irs.gov.fedas1af.com
2009-09-28 | 5 | www.irs.gov.fedas1ag.com
2009-09-28 | 4 | www.irs.gov.fedas1ah.com
2009-09-28 | 12 | www.irs.gov.fedas1ak.com
2009-09-28 | 8 | www.irs.gov.fedas1am.com
2009-09-28 | 7 | www.irs.gov.fedas1an.com
2009-09-28 | 9 | www.irs.gov.fedas1ao.com
2009-09-28 | 3 | www.irs.gov.fedas1aq.com
2009-09-28 | 4 | www.irs.gov.fedas1ar.com
2009-09-28 | 2 | www.irs.gov.fedas1as.com
2009-09-28 | 5 | www.irs.gov.fedas1av.com
2009-09-28 | 6 | www.irs.gov.fedas1az.com
2009-09-28 | 7 | www.irs.gov.juhh1we.com
2009-09-28 | 4 | www.irs.gov.juhh1wf.com
2009-09-28 | 8 | www.irs.gov.juhh1wg.com
2009-09-28 | 4 | www.irs.gov.juhh1wh.com
2009-09-28 | 7 | www.irs.gov.juhh1wi.com
2009-09-28 | 6 | www.irs.gov.juhh1wj.com
2009-09-28 | 7 | www.irs.gov.juhh1wn.com
2009-09-28 | 12 | www.irs.gov.juhh1wo.com
2009-09-28 | 9 | www.irs.gov.juhh1wp.com
2009-09-28 | 6 | www.irs.gov.juhh1wq.com
2009-09-28 | 4 | www.irs.gov.juhh1wr.com
2009-09-28 | 8 | www.irs.gov.juhh1wt.com
2009-09-28 | 9 | www.irs.gov.juhh1wu.com
2009-09-28 | 5 | www.irs.gov.juhh1wy.com
2009-09-28 | 6 | www.irs.gov.y11dera.com
2009-09-28 | 3 | www.irs.gov.y11derc.com
2009-09-28 | 7 | www.irs.gov.y11derd.com
2009-09-28 | 8 | www.irs.gov.y11dere.com
2009-09-28 | 9 | www.irs.gov.y11derf.com
2009-09-28 | 3 | www.irs.gov.y11derq.com
2009-09-28 | 9 | www.irs.gov.y11derr.com
2009-09-28 | 9 | www.irs.gov.y11ders.com
2009-09-28 | 7 | www.irs.gov.y11derv.com
2009-09-28 | 2 | www.irs.gov.y11derw.com
2009-09-28 | 5 | www.irs.gov.y11derx.com
2009-09-28 | 5 | www.irs.gov.y11derz.com
(946 rows)

Tien Truong Nguyen pleads Guilty

In April of 2007, the Eastern District of California sent out a Press Release titled "SACRAMENTO MAN CHARGED WITH COMPUTER FRAUD AND AGGRAVATED IDENTITY THEFT" with the description, "Internet Phishing Scheme Used to Steal Thousands of Credit and Debit Card Numbers, Social Security Numbers."

At the University of Alabama at Birmingham, our UAB Computer Forensics program has a mix of Computer & Information Science and Criminal Justice students who are working together to research how phishing investigations are performed. When I saw this story back in the news today, I thought we might have another agent who could help us understand how the US Secret Service investigates phishing. While I'm very glad that Nguyen was picked up, and it looks like ECSAP-trained Senior Special Agent Brian Korbs did an excellent job on the Computer Forensics aspects of this case, unfortunately this wasn't a "phishing investigation."

Several of my students learned about the US Secret Service Electronic Crimes Special Agent Program (ECSAP) while visiting the National Computer Forensics Institute in Hoover, Alabama, about ten miles from our campus, earlier this month. Housed at the NCFI, the Electronic Crimes Task Force for the Birmingham field office of the Secret Service maintains a computer forensics lab where computer forensics examiners from the US Secret Service and the Alabama Bureau of Investigation work side-by-side with examiners from the Alabama District Attorneys Association and the Hoover Police Department to perform examinations and provide training and forensic services to all manner of law enforcement cases. The NCFI provides the equivalent of the Secret Service ECSAP training for state and local law enforcement officers across the country. ECSAP-based courses available in Hoover include "Basic Investigation of Computer and Electronic Crimes Program (BICEP)", "Network Intrusion Responder Program (NITRO)", "Basic Computer Evidence Recovery Training (BCERT)", and "Advanced Computer Evidence Recovery Training (ACERT)", which is ten full weeks of very hands-on training! The NCFI also offers two "Computer Forensics in Court" classes, CFC-J for Judges, and CFC-P for Prosecutors.

Back to the story . . . According to the Affidavit of SSA Brian Korbs, Nguyen was clearly involved in phishing. He was able to establish that from at least October 15, 2005 through January 26, 2007, Nguyen was involved in multiple identity theft, phishing, and credit card fraud activities.

The forensics examination covered:

A Dell Laptop Computer "Latitude" Serial Number 8P530B1
A Toshiba Laptop Computer "M-45" with black thumb drive Serial Number 26234221Q
A Hewlett Packard Laptop Computer "Pavilion D1000" with Serial Number CNF5382K5T
two black USB thumb drives and
A Dell Computer Model 470 Serial Number 37NQC61

These showed that Nguyen was regularly communicating with Eastern Europeans to acquire credit card and debit card numbers, social security numbers, and other personal identification information. Files on the computer were used to create phishing websites, including sites against eBay, Fairwinds Credit Union (Florida), Heritage Bank (Olympia, Washington), Honolulu City and County Employees Credit Union, and others. A program for encoding credit cards, lists of account information, a magnetic card writer, and a laminator were found. Thousands of email addresses, sorted by the state in which they were located, were found to be used for sending out phishing emails state-by-state. (For example, it would make sense to only send "Honolulu City and County Employees Credit Union" phishing emails to people who live in Hawaii.)

The fruit of the phishing was "thousands of pages of customer information" from companies "such as eBay, Western Union, and others." Korbs reported finding
"Hundreds of files of credit card numbers, many with PINs, as well as the true cardholders name, address, email address, password, bank account information, social security number, driver's license number, telephone number, etc." Korbs estimates that "tens of thousands" of identities were on the computer, which is certainly "more than 15" as described in the Federal statute (see below).

Yahoo! chat logs were also found on the computer, which, if printed, would be 16,000 pages of logs. Many of the chats related to buying and selling credit cards, and exchanging email addresses for phish targeting.

In Nguyen's case, the whole story seems to be that he worked with several Romanians to build phishing sites and steal personally identifiable information. Then he provided that information to local accomplices who cashed out in an interesting manner. Apparently GE Capital runs a system of kiosks in California Wal-Mart stores where you can enter your information and be approved for an instant line of credit, which is provided as Wal-Mart coupons that can be used to shop in the store. According to Special Agent Korbs, they did this for more than $200,000 worth of merchandise. In the full indictment, it lists many of the items purchased with these cards, including laptops, monitors, satellite radio systems, 8 ipods, infrared night light, a "Nightowl" night vision scope, CB radios, GPS units, watches, televisions, a radar detector, etc.

When Detective Jim Hudson, from the Placer County Sheriff, and Special Agent Korbs talked to Tien Nguyen after he was arrested on January 26, 2007, he waived his Miranda rights and told them pretty much everything. He admitted to using his computer to trade identities and credit card information, and he explained the GE Capital / Wal Mart scheme.

Enter the 9th Circuit

So, why after all this time is Nguyen just now pleading guilty? Apparently the defense's plan all along has been to say that all of the evidence that was obtained from Nguyen, INCLUDING HIS CONFESSION, was based on a warrantless search of the premises, which meant all of the evidence should be suppressed. After the recent 9th Circuit ruling, Nguyen's lawyer, Micheal K. Cernyar of Long Beach, California, thought he had fresh evidence, and on September 8, 2009 a hearing was held before the Honorable Morrison C. England, Jr, to hear this a plea to establish a new hearing for a new motion to suppress. Here are the basics outlined in the Motion to Suppress:

* Mr. Nguyen was arrested on or about January 26, 2007 on a Ramey Warrant at his residence located at 8225 & 8229 Gerber Road, Sacramento, California. "A warrantless search of the residence" uncovered all of the information, while Nguyen and his companion were detained in the living room of the home.

* On March 27, 2007, Special Agent Korbs applied for a federal search warrant seeking the items seized on January 26, 2007. After receiving this search warrant, Nguyen was indicted April 26, 2007.

* Nguyen moved "to suppress all evidence and any statements obtained" claiming his Fourth Amendment rights were violated, and his motion was denied October 15, 2008.

Here's the new part . . .

7. Last week, in United States v. Gonzalez -- F.3d --, (9th Cir. 2009) (D.C. No. 07-30098), the Ninth Circuit reversed a matter regarding suppression of evidence based upon a warrentless search when applying the recent ruling in Arizona v. Gant. The Ninth Circuit held that Mr. Gonzalez was entitled to benefit from the Supreme Court's ruling in Gant.

8. Counsel believes that the facts in Mr. Nguyen's warrentless search incident to arrest are at the very list similarly situated to those in the Gant and Gonzalez matter.

Rodney Joseph Gant v. Arizona was a case where a man was arrested, and after his arrest police went and searched his vehicle, which he was not in at the time of the arrest. In the car, they found cocaine, not related to the charges for which he had just been arrested, and expanded the charges to include drug possession. Because they did not have a warrant for the vehicular search, and because the perp was not in the vehicle, the Supreme Court ruled that they should not have searched the vehicle without a warrant. (This has been standard practice, called "The Bright Line rule" since 1981 . . .)

How does this relate to the 9th Circuit decision in US. v. Gonzales? It is well-established practice that police can perform a warrantless search "incident to arrest", meaning that after I've arrested you, it is "not unreasonable" to search for evidence related to the crime for which you have been arrested, both on your person, as well as in the immediate vicinity. The question of what is meant by the immediate vicinity is one that has had the legal scholars appealing searches on Fourth Amendment grounds over and over. In this case, it all starts with Chimel v. California. The Supreme Court held that when someone is arrested in their home, officers would be reasonable to search not only the room of the arrest, but other "sufficiently large spaces" where someone might be hiding that could be a risk to officer safety. So, the idea was, if I arrest you in your living room, but I feel that someone might be hiding in the closet, I can look in the closet, without a warrant, to see if your brother is hiding in their with a shotgun planning to jump out and shoot me. I couldn't search the drawer in the end-table, because it is unlikely a potential attacker is hiding in that drawer. Several arguments since then have argued whether you should only be able to do such a search if there was a suspicion that such a risk to officer safety was probable, and then, only in certain "reasonable areas", with three cases helping define those boundaries and expectations -- Maryland v. Buie, Belton v. New York, and Thornton v. United States. Arizona v. Gant reset those expectations by overruling some of those prior standards of when it was reasonable to do an "suspicionless search", which lead to the 9th Circuit Decision.

The judge rightly denied the motion to suppress, since this WAS a search "INCIDENT TO ARREST", and there was EVERY REASON to believe that the computers held relevant evidence of the crime for which Nguyen was being arrested, based on his own statements, and his own permission to search, meaning that NONE of those prior cases really had anything to do with this case.

With his last hope extinguished, Nguyen pleaded guilty, but even then went all the way to the wire. I really thought he was going to go to trial! His lawyer had submitted Questions for the Jury (Voire Dire) as recently as September 2, 2009! I had to chuckle as I read through them . . . he asks if they Bank Online, if they use their Debit Card online, if they have purchased online items in the past year . . . I thought the next question might be "Please state your debit card number slowly, and tell us your PIN." When it came down to the start of the Jury Trial, at 9:00 am on September 8th, the Courtroom minutes tell us that Nguyen asked for a five minute recess, and came back in and pleaded guilty to counts 1-4. He then asked for another recess, and came back and pleaded guilty to count 5.

The Penalty Slip with the indictment includes the charges. Especially sweet that the Aggravated Identity Theft adds an automatic +2 years. Nguyen was found to have a shotgun in his bedroom as well, a Remington 870 Express Magnum.

18 USC § 371 - Conspiracy to Commit Computer Fraud and Access Device Fraud:
- Not more than $250,000 or notmore than gross gain or loss;
- Not more than 5 years imprisonment, or both
- Not more than 3 years of supervised release

18 USC § 1029(a)(2) - Access Device Fraud
- Not more than $250,000 or not more than gross gain or gross loss;
- Not more than 5 years imprisonment, or both
- Not more than 3 years of supervised release

18 USC § 1029(a)(3) - Possession of More than 15 Unauthorized Access Devices
- Not more than $250,000 or not more than gross gain or gross loss;
- Not more than 10 years imprisonment, or both
- Not more than 3 years of supervised release

18 USC § 1028A(a)(1) - Aggravated Identity Theft
- Not more than $250,000 or not more than gross gain or gross loss;
- Not more than 2 years imprisonment, or both
- Not more than 3 years of supervised release

18 USC § 922(g)(1) - Felon in Possession of a Firearm or Ammunition
- Not more than $250,000 or not more than gross gain or gross loss;
- Not more than 10 years imprisonment, or both
- Not more than 3 years of supervised release

(Nguyen had already spent "more than a year" in jail back in 1999 for "Receipt of Stolen Property" and "Making and Passing Fictitious Checks", but these were state of California crimes rather than Federal crimes.)

The sentencing for Nguyen will be on November 19th, at 9:00 am.

The question for my student's research project is - "Was this a phishing investigation?" We haven't talked to Special Agent Korbs yet, but from a reading of the court documents, I believe the answer will be "No." This was a credit card fraud investigation, which uncovered a phishing case after the Computer Forensics evidence was evaluated.

The on-going and unsolved question for our research is, "Could this case have been worked the other way around?" If we had started with the Honolulu City and County Employees Credit Union phishing site, would we have still ended up at Tien Truong Nguyen's front door? If you are a law enforcement officer with first-hand experience in phishing investigations, we'd love to talk with you and get your opinion.

References: Stranger than Dictum: Why Arizona v. Gant Compels the Conclusion that Suspicionless Buie Searches Incident to Lawful Arrests are Unconstitutional by Colin Miller, Assistant Professor of the John Marshall Law School.