CyberCrime & Doing Time

Wednesday, August 17, 2011

New York City "Uniform Traffic Ticket" tops spammed malware

Email attachments that contain malicious code are still being used to infect computers and steal the data found on those computers. While it is easy to find people who discount this threat, believing no one would be foolish enough to open one of these email attachments, the criminals are working hard to make their approaches more convincing.

Today we've seen more than 11,000 copies of their newest attempt come in to the UAB Spam Data Mine. The email received looks like this:

The email contains several falsified header indicators, including at the most basic level that it claims to come from "@nyc.gov". In addition to this, however, there has been a "Received:" tag added to make it appear to have originated from a legitimate New York City IP address:

Received: from nyc.gov ([167.153.240.51]) by xx.xx.xx.xx; Wed, 03 Aug 2011 12:20:46 +0530

The City of New York is the registrant for every IP address beginning with "167.153.*.*" - in fact 167.153.240.51 is the IP address of the website "nyc.gov" where Mayor Bloomberg's homepage can be found.

The other false information is the date. Both the date in the Received: tag and the date in the "Date:" tag have been falsified to make it seem this email has been in your in box for several days by the time you see it.

Just from the falsified header, we would predict that this email is going to be in the same family of malware as the "IRS Notification" and "UPS Notification" emails seen earlier this week, which also contained falsified Received: tags.

The zip file contains an executable file disguised as a PDF file:

When the malware is launched, it connects to "sfkdhjnsfjg.ru" on 195.189.226.117.

from there it fetches "/ftp/g.php" and "pusk3.exe" -- exactly the same as the IRS Notification spam and the UPS Notification spam.

VirusTotal Report

Another group of spam messages this morning pretends to be a notice that you have received money via Western Union.

The attachment is of course a virus:

VirusTotal Report.

Money Transfer Information
MONEY TRANSFER INFORMATION
Money Transfer Information 00375
Money Transfer Notice
MONEY TRANSFER NOTICE
MONEY TRANSFER NOTICE 06457
Western Union: Money Transfer For You
WESTERN UNION: MONEY TRANSFER FOR YOU
Western Union: Remittance Advice
WESTERN UNION: REMITTANCE ADVICE
Western Union: Transfer Of Money
WESTERN UNION: TRANSFER OF MONEY
Western Union: You Have Money Transfer
WESTERN UNION: YOU HAVE MONEY TRANSFER
Western Union: You have received a money transfer
WESTERN UNION: YOU HAVE RECEIVED A MONEY TRANSFER

Another top spammed malware attachment today delivers emails with these subjects:

Re: End of July Statement Required
Re: FW: End of July Stat.
Re: FW: End of July Statement
Re: FW: End of July Statement required
Re: FW: End of July Statement Required
Re: FW: End of July Statement REquired
Re: FW: End of July Statement REquired!
Re: FW: End of July Stat. required
Re: FW: End of July Stat. Required

The email body says simply:

Hallo,
As requested i give you open Invoices issued to you as per 5th Aug. 2011
Regards
DEENA BUCKLEY

Here's the VirusTotal report for this one.

Wednesday, August 10, 2011

Inter-company Invoice spam leads to Malware

This morning we are seeing a new spam campaign in the UAB Spam Data Mine. Volumes are still low, but the count is rising steadily, and the detection so far is horrible. When I started writing this post we had seen 710 copies. It's now up to 1389 copies and counting!

count | mbox
-------+---------------------
1 | 2011-08-10 05:45:00
6 | 2011-08-10 06:00:00
3 | 2011-08-10 06:15:00
85 | 2011-08-10 06:30:00
1 | 2011-08-10 06:45:00
3 | 2011-08-10 07:00:00
1 | 2011-08-10 07:15:00
301 | 2011-08-10 07:30:00
252 | 2011-08-10 07:45:00
260 | 2011-08-10 08:00:00
247 | 2011-08-10 08:15:00
229 | 2011-08-10 08:30:00
(12 rows)

The spam pretends to be an invoice from a random company. So far this morning we've seen spam claiming to be an invoice from:

Aleris International Corp.
AMR Corporation Corp.
Anic Corp.
Arch Coal Corp.
ATFT Corp
Beazer Homes USA Corp.
Boyd Gaming Corp.
Brookdale Senior Living Corp.
Hyland Software Corp.
KPMG Corp.
Kraft Foods Corp.
Miltek Corp.
Novellus Systems Corp.
OSN Corp.
PDC Corp.
Safeco Corporation Corp.
WLC Corp.

Subject can be:

Re: Fw: Inter-company inv. from (company)
Re: Fw: Inter-company inv. from (company)
Re: Fw: Inter-company invoice from (company)
Re: Fw: Intercompany invoice from (company)
Re: Fw: Corp. invoice from (company)

A couple example emails follow:

Hi
Attached the inter-company inv. for the period January 2010 til December 2010.

Thanks a lot for support setting up this process.

CHERYL Flowers
Kraft Foods Corp.

Hi

Attached the inter-company inv. for the period January 2010 til December 2010.
Thanks a lot

Asher GIFFORD
Anic Corp.

Good day

Attached the intercompany invoice for the period January 2010 til December 2010.

Thanks a lot for supporting this process
MAYOLA LEARY
Aleris International Corp.

The attachment may be named "Intinvoice" or "Invoice" followed by an underscore, a date, and an "invoice number" ".zip" such as:

Intinvoice_08.6.2011_2222341965.zip
or
Intinvoice_08.4.2011_Q167829.zip
or
Invoice_08.6.2011_T40099.zip

We've seen 1300+ copies so far in the UAB Spam Data Mine, and I have 15 in my personal email.

So far, all have had the same attachment MD5, which yields a 6 of 43 detection rate on this VirusTotal Report.

So far everyone is just saying it is "Suspicious" or "Generic" ... which is our invitation to infect ourselves and figure out what it does!

When we launched the malware, we made a connection to "armaturan.ru" on 94.199.48.152.

We also talked to "ss-partners.ru" on 77.120.114.100
and to "ledinit.ru" on 78.111.51.121

The connection to armaturan.ru did:

GET /forum/dl/ots.php?seller=4&hash={8FA33B0C-3F04-405B-83BD-1CD82D298FF2}

which seems to be uniquely registering our machine, and giving seller #4 credit for my infection?

From ss-partners.ru we fetched a file:

GET /dump/light.exe

which dropped an approximately 70k file onto our local machine.

Then we went back to armaturan.ru and sent another get:

GET /forum/dl/getruns.php?seller=4&hash={8FA33B0C-3F04-405B-83BD-1CD82D298FF2}&ahash=5895b2509324d6a17b2b6ea09859a485

Any bets on whether that ahash is the MD5 of the file I just downloaded?

Looks like I just reported back to the C&C that I successfully downloaded and installed malware with that MD5.

At this point I checked my registry and found that I had a new Run command for next time I restart. I'm supposed to run:

C:\Documents and Settings\Administrator\Application Data\3B1F8DC4\3B1F8DC4.EXE

Odd, I don't recall having a file named that?

Actually, we confirmed that this is the file that was downloaded as "light.exe" above. The VirusTotal report shows only 4 of 43 infection reports for this file as well. See VirusTotal Report.

Unfortunately, it disproves my MD5 theory. This is NOT the "ahash" value. This file's MD5 is f58d5cbb564069eca8806d4e48d7a714.

Launching the second file caused the machine to open an SSL tunnel to 78.111.51.121 and then sit idle.

You may recognize that as the IP address for "ledinit.ru" earlier, but it didn't make a connection by name. It went straight for the IP address. If that IP sounds familiar, it's probably because there have been many other malware campaigns tied to the network "Azerbaijan Baku Sol Ltd", but I'm sure that's just because it's a very large network.

78.111.51.100 is currently hosting three live Zeus C&C servers. Surely a coincidence.

fileuplarc.com
hunterdriveez.com
asdfasdgqghgsw.cx.cc

I'll email the owner and get those taken down right away! (smirk)

-----------

person: Vugar Kouliyev
address: 44, J.Jabbarli str., Baku, Azerbaijan
mnt-by: MNT-SOL
e-mail: vugar@kouliyev.com
phone: +994124971234
nic-hdl: VK1161-RIPE
source: RIPE # Filtered

route: 78.111.48.0/20
descr: SOL ISP
origin: AS43637
mnt-by: MNT-SOL
source: RIPE # Filtered

route: 78.111.51.0/24
descr: SOL ISP
origin: AS43637
mnt-by: MNT-SOL
source: RIPE # Filtered

----------------

Armaturan.ru on 94.199.48.152 also has a sordid history.

That IP address, in Hungary, has been associated with at least two active SpyEye domains: hdkajhslalskjd.ru and hhasdalkjjfasd.ru

I suppose we'll have to ask Mr. Zsolt nicely if he would remove those domains.

person: Zemancsik Zsolt
address: Victor Hugo u. 18-22.
address: 1132 Budapest
address: Hungary
phone: +36 203609059
e-mail: darwick@cyberground.hu
nic-hdl: DARW-RIPE
mnt-by: DARW-MNT
source: RIPE # Filtered

route: 94.199.48.0/21
descr: Originated from 23VNet Network
origin: AS30836
mnt-by: NET23-MNT
source: RIPE # Filtered

========
ss-partners.ru is on servers from Bellhost.ru, a customer of Volia DC

person: Volia DC Admin contact
address: Ukraine, Kiev, Kikvidze st. 1/2
phone: +38 044 2852716
abuse-mailbox: abuse@dc.volia.com
nic-hdl: VDCA-RIPE
mnt-by: VOLIA-DC-MNT
source: RIPE # Filtered

route: 77.120.96.0/19
descr: Volia more specific route
origin: AS25229
mnt-by: VOLIA-MNT
mnt-lower: VOLIA-MNT
source: RIPE # Filtered

Friday, August 05, 2011

Fake IRS emails continue to spread Gov-related Zeus

We've already seen nearly 500 copies of the new Government-related Zeus spam campaign so far this morning in the UAB Spam Data Mine. As has been typical in this campaign that we first started tracking on July 13th, the detection has been fairly horrible each morning for the new malware version. We lasted updated on this malware on July 29th in our story Government-related Zeus Spam Continues.

Today's version advertises the domain "tax-irs-report.com" and asks users to download the file 0000770950077US.pdf.exe from that site.

190 different computers have sent us the spam for this campaign so far today. 118 of them from the USA, 40 from India.

When we asked the UAB Spam Data Mine what other virus links we had been sent by this same group of 190 computers on other days, we got this list:

receiving_date | machine | path
----------------+------------------------------+-------------------------------
2011-07-13 | usbanking-security.com | /tax_report.pdf.exe
2011-07-15 | federalsecusrity.com | /pending-taxes.pdf.exe
2011-07-19 | irs-report-link.com | /tax-report.pdf.exe
2011-07-19 | irs-taxes-report.com | /tax-report.pdf.exe
2011-07-19 | taxreport-irs.com | /tax-report.pdf.exe
2011-07-20 | alerts-federalresrve.com | /rejected_wire.pdf.exe
2011-07-20 | nacha-alert.com | /rejected_transaction.pdf.exe
2011-07-20 | nacha-alert.org | /rejected_transfer.pdf.exe
2011-07-20 | reports-federalreserve.com | /rejected_wire.pdf.exe
2011-07-21 | national-security-agency.com | /blocked_list.exe
2011-07-21 | national-security-agency.com | /token_security_update.exe
2011-07-21 | nsa-security.net | /blocked-list.exe
2011-07-21 | nsa-security.net | /token_security_update.exe
2011-07-22 | irs-downloads.com | /00000700955160US.exe
2011-07-22 | irs-files.com | /00000700955170US.exe
2011-07-26 | irs-alert.com | /00000700955770US.exe
2011-07-27 | nacha-transactions.org | /304694305894903.pdf.exe
2011-07-27 | taxes-refund.com | /00000700975770US.exe
2011-07-27 | www.nacha-rejected.com | /304694305894903.pdf.exe
2011-07-28 | fdic-updates.com | /system_update_07_28.exe
2011-07-29 | federalreserve-alert.com | /transaction_report.pdf.exe
2011-07-29 | taxes-security.com | /00000700955060US.pdf.exe
2011-08-03 | irs-report.com | /00000770950077US.exe
2011-08-05 | tax-irs-report.com | /0000770950077US.pdf.exe
(24 rows)

So, at least some of today's spamming computers have been with this campaign since the beginning (July 13th).

When today's malware is executed it sets a registry key in "HKEY_USERS\S-1-5(my user)-500\Software\Microsoft\Windows\CurrentVersion\Run" to relaunch itself from my current user account where it had copied itself as "C:\Documents and Settings\Administrator\Application Data\Afena\iror.exe"

It makes connection to domains generated with a DGA (Domain Generation Algorithm). Today's live domain was:

olojkpcltulirqr.info on 50.57.71.39

from there it did a GET for /news/?s=158404

It tried many other domains, but none of the others were live. Some of them include:

jruioljslsitjpfv.biz
wlnzkqmohuhzqyra.info
tjjhmtjlziebo.net
jpkpbxkoxwijzijr.info

As we have seen before, the malware ALSO fetches a copy of "heap_v206_mails.exe" after it successfully installs itself.

The spam started at 4:45 AM (Central time), peaked at 5:15, and then began to trickle off. (We group in 15 minute windows.)

count | 15 minute spam block
-------+---------------------
3 | 2011-08-05 04:45:00
3 | 2011-08-05 05:00:00
406 | 2011-08-05 05:15:00
86 | 2011-08-05 05:30:00
(4 rows)

This morning's malware is largely undetected:

A VirusTotal Report shows 6 of 43 AV products know that this is a virus.

I have to praise Microsoft for being the only one of the six to correctly call this Zeus (Zbot).

Email subjects we've seen on this morning's campaign:

count | subject
-------+-------------------------------------------------------------------
38 | Change Confirmation
4 | Does your company is registered outstanding tax debt
5 | Does your company is registered tax debt
1 | Does your enterprise including unpaid tax debts
1 | Does your enterprise listed outstanding tax debts
1 | Does your enterprise listed unpaid tax debts
30 | Federal Tax payment rejected
1 | For your company including unpaid tax debts
1 | For your company is registered outstanding tax debts
1 | For your company is registered tax debts
1 | For your company is registered unpaid tax debt
1 | For your company listed tax debts
2 | For your enterprise listed tax debt
70 | Internal Revenue Service
24 | Internal Revenue Service (IRS)
19 | Internal Revenue Service United States Department of the Treasury
32 | IRS.gov
31 | IRS.gov US
19 | Notice of Underreported Income
35 | Payment IRS.gov
50 | Support IRS.gov
40 | Treasury Inspector General for Tax Administration
42 | U.S. Department of the Treasury
1 | Your company including outstanding tax debts
1 | Your company including tax debts
1 | Your company listed outstanding tax debt
2 | Your company listed tax debts
1 | Your enterprise including outstanding tax debts
2 | Your enterprise is registered unpaid tax debts
1 | Your enterprise listed outstanding tax debt
1 | Your enterprise listed unpaid tax debt
39 | Your IRS payment rejected
(32 rows)

A mix and match of sender name, sender-username, and sender-domain creates the from addresses:

count | sender_name
-------+---------------------------------------------------------------------
19 | "Internal Revenue Service"
18 | "Internal Revenue Service (IRS)"
27 | "Internal Revenue Service (IRS.gov)"
29 | "Internal Revenue Service United States Department of the Treasury"
23 | "Internal Revenue Service US Department of the Treasury"
29 | "IRS.gov"
18 | "IRS.gov United States Department of the Treasury"
30 | "IRS.gov US"
22 | "IRS.gov US Department of the Treasury"
21 | "IRS United States Department of the Treasury"
41 | "Payment IRS.gov"
37 | "Support IRS.gov"
23 | "The Consumer Financial Protection"
37 | "Treasury Inspector General for Tax Administration"
30 | "United States Department of the Treasury"
19 | "U.S. Department of the Treasury"
23 | "US_IRS"
17 | "USIRS"
35 | "US IRS.gov"

count | sender_username
-------+--------------------------
12 | admin
8 | adminnistration
9 | alerts
16 | cunsumer
29 | delivery
15 | e-file
10 | finance
33 | frboard-webannouncements
36 | govdelivery
26 | info
17 | information
14 | inspector
8 | internal_revenue_service
30 | Internal_Revenue_Service
18 | irs
6 | news
14 | news-alerts
8 | no-reply
28 | privacy_policy
22 | protection
5 | public
5 | report
9 | service
17 | stats
22 | subscriber
12 | subscriptions
13 | support
13 | usirc
14 | USIRS
13 | usttb
16 | webannouncements
(31 rows)

count | sender_domain
-------+-------------------
93 | antifraud.irs.gov
73 | info.irs.gov
78 | irs.gov
91 | irs.security.gov
73 | irs.taxes.gov
90 | service.irs.gov
(6 rows)

Wednesday, August 03, 2011

Love Map Spam spreads Fake AV

The top malware spam of the morning is another Fake Antivirus product, but as you'll see in today's story, its a very familiar Fake AV product.

About 1/2 of 1% of the spam we've seen this morning is a new campaign spreading a fake antivirus dropper. The malware has a fair detection rating, with 17 of 43 AV products detecting the malware according to VirusTotal in their report for MD5 = 635aceafb9ee4236e50e7d0f6c7a7895.

The email bodies use some random misspellings, but look something like this:

WELCOME S'EXOHOLIC!
Are YOU real Se'X-tourist?
Check ->>NEW PROJECT: WORLD MAP OF PUSSY
With Best Wishes ...
www. love-map .com

and then have an attachment, which is the malware.

(the website, love-map.com, doesn't actually exist...)

The attachment filename is "map_of_love###.zip" where ### is a random number of length between 4 and 8 characters.

Thanks to the UAB Spam Data Mine, it's fairly easy for us to link this new Fake AV spam campaign to previous ones. For example -- we've seen 520 distinct sending IP addresses so far this morning, so let's ask "What was the most common email subject that those same sending IP addresses sent us yesterday?"

43 of the IP addresses sent us an email yesterday with the subject "Your credit card is blocked"

33 sent us "Your credit card has been blocked"

That's the same campaign we've been seeing since we wrote about it on July 23rd (See: MasterCard Spam Leads to Fake AV.

The other big fake AV campaign from yesterday was one pretending to be the US Postal Service. We saw 814 copies of that spam yesterday, and 154 of them came from computers that also sent us today's "Love Map" malware.

The USPS subjects were like:

DELIVERY CONFIRMATION FROM USPS 0785164
From USPS 0735590
USPS Attention 03867076
USPS: DELIVER CONFIRMATION - FAILED 1399475
USPS Delivery Confirmation 1784864
USPS id. 167163
Your USPS id. 12286791

With random upper and lowercasing, and random numbers in each subject.

Here's a VirusTotal report on yesterday's USPS Fake AV, which had MD5 = a9a01f061d336774276fabb1827b91cc

How closely related are the "MasterCard" fake AV and the USPS fake AV? Well, they are actually IDENTICAL. Its the same Malware. Here's a report extract from yesterday showing the email subject and the MD5 of the attached malware:

Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card is blocked | a9a01f061d336774276fabb1827b91cc
Your credit card has been blocked | a9a01f061d336774276fabb1827b91cc
From USPS 38864359 | a9a01f061d336774276fabb1827b91cc
USPS DELIVERY CONFIRMATION 954859 | a9a01f061d336774276fabb1827b91cc
From USPS 8815572 | a9a01f061d336774276fabb1827b91cc
DELIVERY CONFIRMATION FROM USPS 6498394 | a9a01f061d336774276fabb1827b91cc
DELIVERY CONFIRMATION FROM USPS 73687208 | a9a01f061d336774276fabb1827b91cc
USPS DELIVERY CONFIRMATION 56547166 | a9a01f061d336774276fabb1827b91cc
USPS ATTENTION 578975 | a9a01f061d336774276fabb1827b91cc
USPS: DELIVER CONFIRMATION - FAILED 9211453 | a9a01f061d336774276fabb1827b91cc
From USPS 5174072 | a9a01f061d336774276fabb1827b91cc
USPS Attention 1201554 | a9a01f061d336774276fabb1827b91cc
Your USPS id. 92444941 | a9a01f061d336774276fabb1827b91cc
DELIVERY CONFIRMATION FROM USPS 575555 | a9a01f061d336774276fabb1827b91cc
Your USPS id. 82259351 | a9a01f061d336774276fabb1827b91cc
Your USPS id. 139017 | a9a01f061d336774276fabb1827b91cc
Your USPS id. 381458 | a9a01f061d336774276fabb1827b91cc
From USPS 3877947 | a9a01f061d336774276fabb1827b91cc
USPS id. 45254864 | a9a01f061d336774276fabb1827b91cc

OK, back to today . . .

Here are the "Love Map" spam subject lines we've seen it use so far:

BABECITIES IN WORLD 2011
BABEPLACES IN WORLD 2011
BABIESPLACES IN WORLD 2011
BABIESSPOTS IN WORLD 2011
BABYCITIES IN WORLD 2011
BABYSPOTS IN WORLD 2011
GIRLSCITIES IN WORLD 2011
GIRLSPLACES IN WORLD 2011
GIRLSSPOTS IN WORLD 2011
HOT BABE CITIES 2011
HOT BABE PLACES 2011
HOT BABE SPOTS 2011
HOT BABIES CITIES 2011
HOT BABIES SPOTS 2011
HOT BABY CITIES 2011
HOT BABY PLACES 2011
HOT BABY SPOTS 2011
HOT CITIES OF BABE 2011
HOTCITIES OF BABIES 2011
HOT CITIES OF BABY 2011
HOTCITIES OF BABY 2011
HOT CITIES OF GIRLS 2011
HOTCITIES OF GIRLS 2011
HOTCITIES OF PUSSY 2011
HOT GIRLS PLACES 2011
HOT GIRLS SPOTS 2011
HOT PLACES OF BABE 2011
HOT PLACES OF BABIES 2011
HOTPLACES OF BABIES 2011
HOT PLACES OF BABY 2011
HOTPLACES OF BABY 2011
HOT PLACES OF GIRLS 2011
HOTPLACES OF GIRLS 2011
HOT PLACES OF GIRLS IN WORLD
HOTPLACES OF GIRLS IN WORLD
HOT PLACES OF PUSSIES 2011
HOTPLACES OF PUSSIES 2011
HOT PLACES OF PUSSY 2011
HOTPLACES OF PUSSY 2011
HOT PUSSIES CITIES 2011
HOT PUSSIES SPOTS 2011
HOT PUSSY CITIES 2011
HOT PUSSY PLACES 2011
HOT PUSSY SPOTS 2011
HOT SPOTS OF BABE 2011
HOT SPOTS OF BABIES 2011
HOTSPOTS OF BABIES 2011
HOT SPOTS OF GIRLS 2011
HOTSPOTS OF GIRLS 2011
HOT SPOTS OF GIRLS IN WORLD
HOT SPOTS OF PUSSIES 2011
HOTSPOTS OF PUSSIES 2011
HOT SPOTS OF PUSSY 2011
HOTSPOTS OF PUSSY 2011
JULY-2011: BABECITIES IN WORLD
JULY-2011: BABEPLACES IN WORLD
JULY-2011: BABIESCITIES IN WORLD
JULY-2011: BABIESPLACES IN WORLD
JULY-2011: BABYCITIES IN WORLD
JULY-2011: BABYPLACES IN WORLD
JULY-2011: GIRLSPLACES IN WORLD
JULY-2011: GIRLSSPOTS IN WORLD
JULY-2011: HOT BABE CITIES
JULY-2011: HOT BABE PLACES
JULY-2011: HOT BABE SPOTS
JULY-2011: HOT BABIES CITIES
JULY-2011: HOT BABY CITIES
JULY-2011: HOT BABY PLACES
JULY-2011: HOT BABY SPOTS
JULY-2011: HOT CITIES OF BABE
JULY-2011: HOTCITIES OF BABE
JULY-2011: HOTCITIES OF BABIES
JULY-2011: HOT CITIES OF BABY
JULY-2011: HOTCITIES OF BABY
JULY-2011: HOT CITIES OF GIRLS
JULY-2011: HOTCITIES OF GIRLS
JULY-2011: HOT CITIES OF PUSSIES
JULY-2011: HOTCITIES OF PUSSIES
JULY-2011: HOT CITIES OF PUSSY
JULY-2011: HOTCITIES OF PUSSY
JULY-2011: HOT GIRLS PLACES
JULY-2011: HOT GIRLS SPOTS
JULY-2011: HOT PLACES OF BABE
JULY-2011: HOTPLACES OF BABE
JULY-2011: HOT PLACES OF BABIES
JULY-2011: HOTPLACES OF BABIES
JULY-2011: HOT PLACES OF BABY
JULY-2011: HOTPLACES OF BABY
JULY-2011: HOT PLACES OF GIRLS
JULY-2011: HOTPLACES OF GIRLS
JULY-2011: HOTPLACES OF PUSSIES
JULY-2011: HOT PLACES OF PUSSY
JULY-2011: HOTPLACES OF PUSSY
JULY-2011: HOT PUSSIES CITIES
JULY-2011: HOT PUSSIES PLACES
JULY-2011: HOT PUSSIES SPOTS
JULY-2011: HOT PUSSY CITIES
JULY-2011: HOT PUSSY PLACES
JULY-2011: HOT PUSSY SPOTS
JULY-2011: HOTSPOTS OF BABE
JULY-2011: HOT SPOTS OF BABIES
JULY-2011: HOTSPOTS OF BABIES
JULY-2011: HOT SPOTS OF BABY
JULY-2011: HOTSPOTS OF BABY
JULY-2011: HOT SPOTS OF GIRLS
JULY-2011: HOTSPOTS OF GIRLS
JULY-2011: HOT SPOTS OF PUSSIES
JULY-2011: HOTSPOTS OF PUSSIES
JULY-2011: HOT SPOTS OF PUSSY
JULY-2011: LOVE BABE CITIES
JULY-2011: LOVE BABE PLACES
JULY-2011: LOVE BABIES SPOTS
JULY-2011: LOVE BABY CITIES
JULY-2011: LOVE BABY PLACES
JULY-2011: LOVE BABY SPOTS
JULY-2011: LOVE CITIES IN WORLD
JULY-2011: LOVE CITIES OF BABE
JULY-2011: LOVECITIES OF BABE
JULY-2011: LOVECITIES OF BABIES
JULY-2011: LOVE CITIES OF BABY
JULY-2011: LOVECITIES OF BABY
JULY-2011: LOVECITIES OF GIRLS
JULY-2011: LOVE CITIES OF PUSSIES
JULY-2011: LOVECITIES OF PUSSIES
JULY-2011: LOVE CITIES OF PUSSY
JULY-2011: LOVECITIES OF PUSSY
JULY-2011: LOVE GIRLS CITIES
JULY-2011: LOVE GIRLS PLACES
JULY-2011: LOVE GIRLS SPOTS
JULY-2011: LOVE MAP OF BABE
JULY-2011: LOVE MAP OF BABIES
JULY-2011: LOVE-MAP OF BABIES
JULY-2011: LOVE-MAP OF BABY
JULY-2011: LOVE MAP OF GIRLS
JULY-2011: LOVE-MAP OF GIRLS
JULY-2011: LOVE MAP OF PUSSIES
JULY-2011: LOVE-MAP OF PUSSIES
JULY-2011: LOVE MAP OF PUSSY
JULY-2011: LOVE-MAP OF PUSSY
JULY-2011: LOVEPLACES IN WORLD
JULY-2011: LOVE PLACES OF BABE
JULY-2011: LOVEPLACES OF BABE
JULY-2011: LOVE PLACES OF BABIES
JULY-2011: LOVEPLACES OF BABIES
JULY-2011: LOVE PLACES OF BABY
JULY-2011: LOVEPLACES OF BABY
JULY-2011: LOVE PLACES OF GIRLS
JULY-2011: LOVEPLACES OF GIRLS
JULY-2011: LOVE PLACES OF PUSSIES
JULY-2011: LOVEPLACES OF PUSSIES
JULY-2011: LOVE PLACES OF PUSSY
JULY-2011: LOVE PUSSIES PLACES
JULY-2011: LOVE PUSSIES SPOTS
JULY-2011: LOVE PUSSY CITIES
JULY-2011: LOVE PUSSY PLACES
JULY-2011: LOVE SPOTS IN WORLD
JULY-2011: LOVESPOTS IN WORLD
JULY-2011: LOVE SPOTS OF BABE
JULY-2011: LOVESPOTS OF BABE
JULY-2011: LOVE SPOTS OF BABIES
JULY-2011: LOVE SPOTS OF BABY
JULY-2011: LOVE SPOTS OF GIRLS
JULY-2011: LOVESPOTS OF GIRLS
JULY-2011: LOVE SPOTS OF PUSSIES
JULY-2011: LOVESPOTS OF PUSSIES
JULY-2011: LOVE SPOTS OF PUSSY
JULY-2011: LOVESPOTS OF PUSSY
JULY-2011: PUSSYCITIES IN WORLD
JULY-2011: PUSSYPLACES IN WORLD
JULY-2011: SEXYCITIES IN WORLD
JULY-2011: SEXY LOVE MAP
JULY-2011: SEXY LOVE-MAP
JULY-2011: SEXY PLACES IN WORLD
JULY-2011: SEXYPLACES IN WORLD
JULY-2011: SEXYSPOTS IN WORLD
JULY-2011: SEXY WORLD MAP
JULY-2011: WORLD MAP OF BABE
JULY-2011: WORLD-MAP OF BABE
JULY-2011: WORLD MAP OF BABIES
JULY-2011: WORLD-MAP OF BABIES
JULY-2011: WORLD MAP OF BABY
JULY-2011: WORLD-MAP OF BABY
JULY-2011: WORLD MAP OF GIRLS
JULY-2011: WORLD-MAP OF GIRLS
JULY-2011: WORLD-MAP OF PUSSIES
JULY-2011: WORLD MAP OF PUSSY
JULY-2011: WORLD-MAP OF PUSSY
KNOW-HOW: BABECITIES IN WORLD
KNOW-HOW: BABEPLACES IN WORLD
KNOW-HOW: BABESPOTS IN WORLD
KNOW-HOW: BABIESCITIES IN WORLD
KNOW-HOW: BABIESSPOTS IN WORLD
KNOW-HOW: BABYCITIES IN WORLD
KNOW-HOW: BABYPLACES IN WORLD
KNOW-HOW: BABYSPOTS IN WORLD
KNOW-HOW: GIRLSPLACES IN WORLD
KNOW-HOW: HOT BABE PLACES
KNOW-HOW: HOT BABE SPOTS
KNOW-HOW: HOT BABIES CITIES
KNOW-HOW: HOT BABIES PLACES
KNOW-HOW: HOT BABIES SPOTS
KNOW-HOW: HOT BABY CITIES
KNOW-HOW: HOT BABY PLACES
KNOW-HOW: HOT BABY SPOTS
KNOW-HOW: HOT CITIES OF BABE
KNOW-HOW: HOTCITIES OF BABE
KNOW-HOW: HOT CITIES OF BABIES
KNOW-HOW: HOTCITIES OF BABIES
KNOW-HOW: HOT CITIES OF BABY
KNOW-HOW: HOTCITIES OF BABY
KNOW-HOW: HOT CITIES OF PUSSIES
KNOW-HOW: HOTCITIES OF PUSSY
KNOW-HOW: HOT GIRLS CITIES
KNOW-HOW: HOT GIRLS SPOTS
KNOW-HOW: HOT PLACES OF BABE
KNOW-HOW: HOTPLACES OF BABE
KNOW-HOW: HOT PLACES OF BABIES
KNOW-HOW: HOTPLACES OF BABIES
KNOW-HOW: HOTPLACES OF BABY
KNOW-HOW: HOT PLACES OF GIRLS
KNOW-HOW: HOTPLACES OF GIRLS
KNOW-HOW: HOT PLACES OF PUSSIES
KNOW-HOW: HOT PLACES OF PUSSY
KNOW-HOW: HOTPLACES OF PUSSY
KNOW-HOW: HOT PUSSIES CITIES
KNOW-HOW: HOT PUSSIES PLACES
KNOW-HOW: HOT PUSSY PLACES
KNOW-HOW: HOT SPOTS OF BABE
KNOW-HOW: HOTSPOTS OF BABE
KNOW-HOW: HOT SPOTS OF BABY
KNOW-HOW: HOTSPOTS OF BABY
KNOW-HOW: HOTSPOTS OF GIRLS
KNOW-HOW: HOTSPOTS OF PUSSY
KNOW-HOW: LOVE BABE CITIES
KNOW-HOW: LOVE BABE SPOTS
KNOW-HOW: LOVE BABIES CITIES
KNOW-HOW: LOVE BABIES PLACES
KNOW-HOW: LOVE BABY CITIES
KNOW-HOW: LOVE CITIES IN WORLD
KNOW-HOW: LOVECITIES IN WORLD
KNOW-HOW: LOVECITIES OF BABE
KNOW-HOW: LOVECITIES OF BABIES
KNOW-HOW: LOVE CITIES OF BABY
KNOW-HOW: LOVECITIES OF BABY
KNOW-HOW: LOVE CITIES OF GIRLS
KNOW-HOW: LOVECITIES OF PUSSIES
KNOW-HOW: LOVE CITIES OF PUSSY
KNOW-HOW: LOVECITIES OF PUSSY
KNOW-HOW: LOVE GIRLS CITIES
KNOW-HOW: LOVE GIRLS SPOTS
KNOW-HOW: LOVE MAP OF BABE
KNOW-HOW: LOVE MAP OF BABIES
KNOW-HOW: LOVE MAP OF BABY
KNOW-HOW: LOVE-MAP OF BABY
KNOW-HOW: LOVE MAP OF GIRLS
KNOW-HOW: LOVE-MAP OF GIRLS
KNOW-HOW: LOVE MAP OF PUSSIES
KNOW-HOW: LOVE-MAP OF PUSSIES
KNOW-HOW: LOVE MAP OF PUSSY
KNOW-HOW: LOVE-MAP OF PUSSY
KNOW-HOW: LOVE PLACES IN WORLD
KNOW-HOW: LOVEPLACES IN WORLD
KNOW-HOW: LOVE PLACES OF BABE
KNOW-HOW: LOVEPLACES OF BABE
KNOW-HOW: LOVEPLACES OF BABIES
KNOW-HOW: LOVE PLACES OF BABY
KNOW-HOW: LOVEPLACES OF BABY
KNOW-HOW: LOVE PLACES OF GIRLS
KNOW-HOW: LOVEPLACES OF GIRLS
KNOW-HOW: LOVE PLACES OF PUSSIES
KNOW-HOW: LOVEPLACES OF PUSSIES
KNOW-HOW: LOVE PLACES OF PUSSY
KNOW-HOW: LOVEPLACES OF PUSSY
KNOW-HOW: LOVE PUSSIES CITIES
KNOW-HOW: LOVE PUSSIES PLACES
KNOW-HOW: LOVE PUSSIES SPOTS
KNOW-HOW: LOVE PUSSY CITIES
KNOW-HOW: LOVE PUSSY PLACES
KNOW-HOW: LOVE PUSSY SPOTS
KNOW-HOW: LOVE SPOTS IN WORLD
KNOW-HOW: LOVE SPOTS OF BABE
KNOW-HOW: LOVESPOTS OF BABE
KNOW-HOW: LOVESPOTS OF BABIES
KNOW-HOW: LOVESPOTS OF BABY
KNOW-HOW: LOVE SPOTS OF GIRLS
KNOW-HOW: LOVESPOTS OF GIRLS
KNOW-HOW: LOVE SPOTS OF PUSSIES
KNOW-HOW: LOVESPOTS OF PUSSIES
KNOW-HOW: LOVESPOTS OF PUSSY
KNOW-HOW: PUSSYPLACES IN WORLD
KNOW-HOW: PUSSYSPOTS IN WORLD
KNOW-HOW: SEXY CITIES IN WORLD
KNOW-HOW: SEXYCITIES IN WORLD
KNOW-HOW: SEXY LOVE MAP
KNOW-HOW: SEXY LOVE-MAP
KNOW-HOW: SEXY PLACES IN WORLD
KNOW-HOW: SEXYPLACES IN WORLD
KNOW-HOW: SEXY SPOTS IN WORLD
KNOW-HOW: SEXYSPOTS IN WORLD
KNOW-HOW: SEXY WORLD MAP
KNOW-HOW: SEXY WORLD-MAP
KNOW-HOW: WORLD MAP OF BABE
KNOW-HOW: WORLD-MAP OF BABE
KNOW-HOW: WORLD MAP OF BABIES
KNOW-HOW: WORLD-MAP OF BABIES
KNOW-HOW: WORLD MAP OF BABY
KNOW-HOW: WORLD-MAP OF BABY
KNOW-HOW: WORLD MAP OF GIRLS
KNOW-HOW: WORLD-MAP OF GIRLS
KNOW-HOW: WORLD-MAP OF PUSSIES
KNOW-HOW: WORLD MAP OF PUSSY
LOVE BABE CITIES 2011
LOVE BABE PLACES 2011
LOVE BABE SPOTS 2011
LOVE BABIES CITIES 2011
LOVE BABIES PLACES 2011
LOVE BABIES SPOTS 2011
LOVE BABY CITIES 2011
LOVE BABY PLACES 2011
LOVE BABY SPOTS 2011
LOVE CITIES IN WORLD 2011
LOVE CITIES OF BABE 2011
LOVECITIES OF BABE 2011
LOVE CITIES OF BABIES 2011
LOVECITIES OF BABIES 2011
LOVE CITIES OF BABY 2011
LOVECITIES OF BABY 2011
LOVE CITIES OF GIRLS 2011
LOVECITIES OF GIRLS 2011
LOVE CITIES OF PUSSIES 2011
LOVECITIES OF PUSSIES 2011
LOVE CITIES OF PUSSY 2011
LOVECITIES OF PUSSY 2011
LOVE GIRLS CITIES 2011
LOVE GIRLS PLACES 2011
LOVE GIRLS SPOTS 2011
LOVE MAP OF BABE 2011
LOVE-MAP OF BABE 2011
LOVE MAP OF BABIES 2011
LOVE-MAP OF BABIES 2011
LOVE MAP OF BABY 2011
LOVE-MAP OF BABY 2011
LOVE-MAP OF GIRLS 2011
LOVE MAP OF PUSSIES 2011
LOVE-MAP OF PUSSY 2011
LOVE PLACES IN WORLD 2011
LOVEPLACES IN WORLD 2011
LOVE PLACES OF BABE 2011
LOVEPLACES OF BABE 2011
LOVE PLACES OF BABIES 2011
LOVEPLACES OF BABIES 2011
LOVEPLACES OF BABY 2011
LOVE PLACES OF GIRLS 2011
LOVEPLACES OF GIRLS 2011
LOVE PLACES OF GIRLS IN WORLD
LOVEPLACES OF GIRLS IN WORLD
LOVE PLACES OF PUSSIES 2011
LOVEPLACES OF PUSSIES 2011
LOVE PLACES OF PUSSY 2011
LOVEPLACES OF PUSSY 2011
LOVE PUSSIES PLACES 2011
LOVE PUSSIES SPOTS 2011
LOVE PUSSY CITIES 2011
LOVE PUSSY PLACES 2011
LOVE PUSSY SPOTS 2011
LOVE SPOTS IN WORLD 2011
LOVESPOTS IN WORLD 2011
LOVESPOTS OF BABE 2011
LOVE SPOTS OF BABIES 2011
LOVESPOTS OF BABIES 2011
LOVE SPOTS OF BABY 2011
LOVESPOTS OF BABY 2011
LOVE SPOTS OF GIRLS 2011
LOVESPOTS OF GIRLS 2011
LOVE SPOTS OF GIRLS IN WORLD
LOVE SPOTS OF PUSSIES 2011
LOVESPOTS OF PUSSIES 2011
LOVE SPOTS OF PUSSY 2011
LOVESPOTS OF PUSSY 2011
PUSSIESCITIES IN WORLD 2011
PUSSIESPLACES IN WORLD
PUSSIESSPOTS IN WORLD 2011
PUSSYCITIES IN WORLD 2011
PUSSYPLACES IN WORLD 2011
PUSSYSPOTS IN WORLD 2011
SEXY CITIES IN WORLD 2011
SEXY LOVE MAP 2011
SEXY LOVE-MAP 2011
SEXY PLACES IN WORLD 2011
SEXYPLACES IN WORLD 2011
SEXY SPOTS IN WORLD
SEXYSPOTS IN WORLD
SEXY WORLD MAP 2011
SUMMER-2011: BABECITIES IN WORLD
SUMMER-2011: BABEPLACES IN WORLD
SUMMER-2011: BABIESCITIES IN WORLD
SUMMER-2011: BABIESPLACES IN WORLD
SUMMER-2011: BABYCITIES IN WORLD
SUMMER-2011: BABYPLACES IN WORLD
SUMMER-2011: GIRLSCITIES IN WORLD
SUMMER-2011: GIRLSPLACES IN WORLD
SUMMER-2011: GIRLSSPOTS IN WORLD
SUMMER-2011: HOT BABE SPOTS
SUMMER-2011: HOT BABIES CITIES
SUMMER-2011: HOT BABIES PLACES
SUMMER-2011: HOT BABY PLACES
SUMMER-2011: HOT CITIES OF BABE
SUMMER-2011: HOTCITIES OF BABE
SUMMER-2011: HOT CITIES OF BABIES
SUMMER-2011: HOT CITIES OF BABY
SUMMER-2011: HOTCITIES OF BABY
SUMMER-2011: HOT CITIES OF GIRLS
SUMMER-2011: HOT CITIES OF PUSSIES
SUMMER-2011: HOT CITIES OF PUSSY
SUMMER-2011: HOTCITIES OF PUSSY
SUMMER-2011: HOT GIRLS CITIES
SUMMER-2011: HOTPLACES OF BABE
SUMMER-2011: HOT PLACES OF BABIES
SUMMER-2011: HOTPLACES OF BABIES
SUMMER-2011: HOT PLACES OF BABY
SUMMER-2011: HOTPLACES OF BABY
SUMMER-2011: HOT PLACES OF GIRLS
SUMMER-2011: HOTPLACES OF GIRLS
SUMMER-2011: HOT PLACES OF PUSSIES
SUMMER-2011: HOTPLACES OF PUSSIES
SUMMER-2011: HOT PLACES OF PUSSY
SUMMER-2011: HOTPLACES OF PUSSY
SUMMER-2011: HOT PUSSIES CITIES
SUMMER-2011: HOT PUSSIES PLACES
SUMMER-2011: HOT PUSSY CITIES
SUMMER-2011: HOT PUSSY SPOTS
SUMMER-2011: HOT SPOTS OF BABE
SUMMER-2011: HOTSPOTS OF BABE
SUMMER-2011: HOT SPOTS OF BABIES
SUMMER-2011: HOTSPOTS OF BABIES
SUMMER-2011: HOT SPOTS OF BABY
SUMMER-2011: HOTSPOTS OF BABY
SUMMER-2011: HOT SPOTS OF GIRLS
SUMMER-2011: HOTSPOTS OF GIRLS
SUMMER-2011: HOT SPOTS OF PUSSIES
SUMMER-2011: HOTSPOTS OF PUSSIES
SUMMER-2011: HOT SPOTS OF PUSSY
SUMMER-2011: HOTSPOTS OF PUSSY
SUMMER-2011: LOVE BABE CITIES
SUMMER-2011: LOVE BABE PLACES
SUMMER-2011: LOVE BABE SPOTS
SUMMER-2011: LOVE BABIES CITIES
SUMMER-2011: LOVE BABIES SPOTS
SUMMER-2011: LOVE BABY CITIES
SUMMER-2011: LOVE BABY PLACES
SUMMER-2011: LOVE CITIES IN WORLD
SUMMER-2011: LOVE CITIES OF BABE
SUMMER-2011: LOVECITIES OF BABE
SUMMER-2011: LOVECITIES OF BABIES
SUMMER-2011: LOVE CITIES OF BABY
SUMMER-2011: LOVECITIES OF BABY
SUMMER-2011: LOVE CITIES OF PUSSIES
SUMMER-2011: LOVECITIES OF PUSSIES
SUMMER-2011: LOVE CITIES OF PUSSY
SUMMER-2011: LOVECITIES OF PUSSY
SUMMER-2011: LOVE GIRLS CITIES
SUMMER-2011: LOVE GIRLS PLACES
SUMMER-2011: LOVE GIRLS SPOTS
SUMMER-2011: LOVE MAP OF BABE
SUMMER-2011: LOVE-MAP OF BABE
SUMMER-2011: LOVE MAP OF BABIES
SUMMER-2011: LOVE-MAP OF BABIES
SUMMER-2011: LOVE MAP OF BABY
SUMMER-2011: LOVE-MAP OF BABY
SUMMER-2011: LOVE-MAP OF GIRLS
SUMMER-2011: LOVE MAP OF PUSSIES
SUMMER-2011: LOVE-MAP OF PUSSIES
SUMMER-2011: LOVE MAP OF PUSSY
SUMMER-2011: LOVE-MAP OF PUSSY
SUMMER-2011: LOVE PLACES OF BABE
SUMMER-2011: LOVEPLACES OF BABE
SUMMER-2011: LOVE PLACES OF BABIES
SUMMER-2011: LOVEPLACES OF BABIES
SUMMER-2011: LOVE PLACES OF BABY
SUMMER-2011: LOVEPLACES OF BABY
SUMMER-2011: LOVE PLACES OF GIRLS
SUMMER-2011: LOVEPLACES OF GIRLS
SUMMER-2011: LOVE PLACES OF PUSSIES
SUMMER-2011: LOVEPLACES OF PUSSIES
SUMMER-2011: LOVEPLACES OF PUSSY
SUMMER-2011: LOVE PUSSIES CITIES
SUMMER-2011: LOVE PUSSIES PLACES
SUMMER-2011: LOVE PUSSIES SPOTS
SUMMER-2011: LOVE PUSSY CITIES
SUMMER-2011: LOVE PUSSY SPOTS
SUMMER-2011: LOVE SPOTS IN WORLD
SUMMER-2011: LOVESPOTS IN WORLD
SUMMER-2011: LOVE SPOTS OF BABE
SUMMER-2011: LOVESPOTS OF BABE
SUMMER-2011: LOVE SPOTS OF BABIES
SUMMER-2011: LOVESPOTS OF BABIES
SUMMER-2011: LOVE SPOTS OF BABY
SUMMER-2011: LOVESPOTS OF BABY
SUMMER-2011: LOVE SPOTS OF GIRLS
SUMMER-2011: LOVE SPOTS OF PUSSIES
SUMMER-2011: LOVESPOTS OF PUSSIES
SUMMER-2011: LOVE SPOTS OF PUSSY
SUMMER-2011: LOVESPOTS OF PUSSY
SUMMER-2011: PUSSYCITIES IN WORLD
SUMMER-2011: PUSSYPLACES IN WORLD
SUMMER-2011: SEXYCITIES IN WORLD
SUMMER-2011: SEXY LOVE MAP
SUMMER-2011: SEXY LOVE-MAP
SUMMER-2011: SEXY PLACES IN WORLD
SUMMER-2011: SEXYPLACES IN WORLD
SUMMER-2011: SEXY SPOTS IN WORLD
SUMMER-2011: SEXYSPOTS IN WORLD
SUMMER-2011: SEXY WORLD MAP
SUMMER-2011: SEXY WORLD-MAP
SUMMER-2011: WORLD MAP OF BABE
SUMMER-2011: WORLD-MAP OF BABE
SUMMER-2011: WORLD MAP OF BABIES
SUMMER-2011: WORLD MAP OF BABY
SUMMER-2011: WORLD-MAP OF BABY
SUMMER-2011: WORLD MAP OF GIRLS
SUMMER-2011: WORLD-MAP OF GIRLS
SUMMER-2011: WORLD MAP OF PUSSIES
SUMMER-2011: WORLD-MAP OF PUSSIES
SUMMER-2011: WORLD-MAP OF PUSSY
WORLD MAP OF BABE 2011
WORLD MAP OF BABIES 2011
WORLD-MAP OF BABIES 2011
WORLD-MAP OF BABY 2011
WORLD MAP OF GIRLS 2011
WORLD-MAP OF GIRLS 2011
WORLD MAP OF PUSSY 2011
WORLD-MAP OF PUSSY 2011
(532 rows)

Sunday, July 31, 2011

"Wrong Transaction" Hotel spam malware continues to evolve

One of the distinct advantages of having the UAB Spam Data Mine is that we are able to provide near-real-time intelligence about the evolution of malware campaigns being delivered by spam. On July 27, 2011 we provided a warning about Wrong Transaction Hotel Spam that was covered by Robert McMillan in PC World and ComputerWorld, and was also mentioned by Matt Liebowitz for MSNBC.

Unfortunately, from an anti-virus perspective, consumers are no safer than they were when we first put out the warning four days ago.

We're still seeing more than 1,000 copies per day of this malware (with the exception of the 29th) each day:

 count | receiving_date
-------+----------------
  1516 | 2011-07-27
  1828 | 2011-07-28
   813 | 2011-07-29
  1470 | 2011-07-30
  1258 | 2011-07-31
(5 rows)

but the malware is constantly evolving.

Count	Malware MD5	TimeRange
593	c15eb3c47800fec025b6a86a6409f144	2011-07-27 03:00 AM to 2011-07-27 08:30 AM
1001	01e3bbd4b6f8c22a3516771f9b6792bc	2011-07-27 12:45 PM to 2011-07-28 04:45 AM
318	57d931256fd6d7184528ae983e34677b	2011-07-27 08:00 AM to 2011-07-27 13:30 PM
865	6e2eae488317280dd813e3e2fc9e0275	2011-07-28 04:15 AM to 2011-07-28 13:00 PM
554	ad760ac5806a84a272e1eb76b315ac31	2011-07-28 12:30 PM to 2011-07-28 20:15 PM
1116	4140ee10115174fe36a738d4d943f2af	2011-07-29 13:45 PM to 2011-07-30 04:00 AM
614	e2d3d4ccf02ea924e6d11cb452235f4c	2011-07-30 03:30 AM to 2011-07-30 16:15 PM
931	5bbe80ad216c89bcbb6891178dc4b5fa	2011-07-30 14:45 PM to 2011-07-31 07:30 AM
409	ca84d1a0c49eff5ca829b5fa531800e8	2011-07-31 07:30 AM to 2011-07-31 13:15 PM
484	aa412182a164321a159f9b2e95be53bc	2011-07-31 13:15 PM to 2011-07-31 CURRENT TIME

Each of the links in the table above will take you to the VirusTotal report showing how many of 43 different anti-virus products detected this particular malware at the time it was submitted to VirusTotal.

I'll let you explore the links for yourself, but may I call attention to the fact the last one is detected by FOUR of forty-three AV products, and the one immediately prior to that by ONE of forty-three.

Just to make sure there was not a problem, I decided to look at those last two and confirm that they actually were malware.

We started with the sample starting with "aa412". It unpacks successfully as an .exe named "Refund_Form" that uses an icon from Microsoft Office Excel to try to trick people into thinking it's a Spreadsheet.

When we launched it, it made connections to:

runescapegpge2011.ru - 84.247.61.25
www.radio-80.com - 210.172.192.38
heftyhips.com - 66.197.251.53

That last would be exactly the same domain that the first sample we looked at on the 27th connected to. It fetched "soft.exe" from www.radio-80.com.

I'm going to go out on a limb and say this is malware. "soft.exe" got renamed "defender.exe" and placed in our "C:\Documents and Settings\All Users\Application Data\" directory, which was scheduled to launch when the machine reboots.

Defender.exe was declared to be malware by 6 of 43 anti-virus packages at VirusTotal. Here's the report. It's Fake anti-virus.

Next, just to be thorough, we also checked out the version that started with "ca84d1". Just like the first, it unpacked to a "Refund_Form.exe" file, although this one had a different MD5. When we launched Refund_Form it made network connections to:

runescapegpge2011.ru - 84.247.61.25
ewingparkbmx2011.ru - failed to resolve

It looks like this version is not functioning due to a dead domain, which may be the reason the "aa412" version was released.

That "84.247.61.25" box is in Romania, currently using a domain name with "RuneScape" in the domain name. The same IP has recently been called bedownloader2011.ru, diamondexchange2011.ru, watchfamilyguynow2011.ru and is also currently resolving as yomwarayom2001.ru.

Update 01AUG2011

At 3:15 this morning, the malware being distributed swapped to:

2e749d608d29aef739f5b08e7f63225a (click for VirusTotal Report)

The MD5 for the exe inside of the zip file with MD5 2e749d608d29aef739f5b08e7f63225a is:

a446ced5db1de877cf78f77741e2a804 Filename: Refund-Form (dot) exe (1 of 43 detects at VirusTotal).

At 4:30 this morning, and continuing to the present moment (07:45 AM Central Time), the malware being distributed swapped to:

4b126c49c261ca0f65fce9e5d08811d6 (click for VirusTotal Report)

The MD5 for the exe inside of the zip file with MD5 4b126c49c261ca0f65fce9e5d08811d6 is:

2f0155c39ddcf490f3a310ba0546c627 Filename: Refund_Form (dot) exe (5 of 43 detects at VirusTotal).

Thursday, July 28, 2011

"Government-related" Zeus spam continues

As we discussed in yesterday's article, "Wrong transaction" hotel spam, the UAB Spam Data Mine now has an ability to provide early alerting when a new spam campaign is directly linking to executable files.

Update: New Zeus distribution site, July 29th AM:

We are receiving spam emails this morning from "nacha.org" From: addresses that direct us to this Zeus distribution site.

hxxp://federalreserve-alert.com/transaction_report.pdf.exe

Here's the VirusTotal report: As of this timestamp (5:30 AM Central time) we see (5 of 43) detections. Only 2 of those are calling this Zeus.

This morning we have a new example of this capability in the form of the two most recent installments of a long-running "government-related" Zeus campaign.

One of the two spammed destinations is:

alert-irs.com /00000700973770US.exe MD5 = 0691a4856713edc97664e60db735747c

This malware is currently showing a (12 of 43) detection rate at VirusTotal, as seen in this VirusTotal Report.

The other spammed destination is:

fdic-updates.com /system_update_07_28.exe MD5 = 7a0303fdb809ac0c1a84123b106992c2

This malware is currently showing a (8 of 43) detection rate at VirusTotal, as seen in this VirusTotal Report.

Both files are 172,032 bytes in size, but currently the FDIC one is showing a dramatically wider distribution via email than the IRS one, which may be an indication of "targeting" by the latter.

The FDIC version has been seen almost 500 times, despite the fact that the campaign is less than 45 minutes old as of this writing. Here is the count per 15 minute block seen in the UAB Spam Data Mine:

     5 | ACH and Wire transfers disabled.      | 2011-07-28 06:00:00
     3 | Banking security update.              | 2011-07-28 06:00:00
     1 | Update for your banking account.      | 2011-07-28 06:00:00
   107 | ACH and Wire transfers disabled.      | 2011-07-28 05:45:00
   138 | Banking security update.              | 2011-07-28 05:45:00
   108 | Security update for banking accounts. | 2011-07-28 05:45:00
   122 | Update for your banking account.      | 2011-07-28 05:45:00
     1 | Banking security update.              | 2011-07-28 05:30:00
     1 | Security update for banking accounts. | 2011-07-28 05:30:00
     1 | ACH and Wire transfers disabled.      | 2011-07-28 05:15:00
     1 | Banking security update.              | 2011-07-28 05:15:00
     1 | Security update for banking accounts. | 2011-07-28 05:15:00

(Timestamps are US-Central Time, GMT -6)

The FDIC spam comes from email addresses that randomly associate these "usernames" with these "hostnames". Everything in the first column was seen combined with everything in the second column.

admin            @   admin.fdic.gov
adminnistration  @   administration.fdic.gov
cunsumer         @   fdic.gov
FDIC             @   security.fdic.gov
finance          @
govdelivery      @
information      @
inspector        @
news             @
no-reply         @
privacy_policy   @
protection       @
public           @
report           @
service          @
stats            @
support          @
webannouncements @

Here's what the email actually says:

Dear clients,
Your account ACH and Wire transactions have been
temporarily suspended for your settings, due to the
expiration of your security version. To download and install the
newest Updates, click here.

As soon as it is Applied, your transaction abilities will be fully restored.

Best regards,
Online security department
Federal Deposit Insurance Corporation

The IRS related spam came first:

     2 | Internal Revenue Service     | 2011-07-28 04:15:00
     2 | Federal Tax payment rejected | 2011-07-28 04:00:00
     2 | Your IRS payment rejected    | 2011-07-28 04:00:00
     2 | Internal Revenue Service     | 2011-07-28 03:45:00

This is fairly typical spamming for this group. They like to make a new Zeus variant, populate it on a website, and then spam it very hard at the beginning of the East Coast business day. For example, here is the spam for:

"nacha-rejected.com"

     2 | Rejected transaction | 2011-07-27 05:30:00
     1 | Canceled  payment    | 2011-07-27 05:15:00
     2 | Canceled transaction | 2011-07-27 05:15:00
     3 | Payment rejected     | 2011-07-27 05:15:00
     5 | Rejected transaction | 2011-07-27 05:15:00
     2 | Canceled transaction | 2011-07-27 05:00:00
     8 | Canceled transfer    | 2011-07-27 05:00:00
     5 | Payment canceled     | 2011-07-27 05:00:00
     3 | Payment rejected     | 2011-07-27 05:00:00
     4 | Rejected transaction | 2011-07-27 05:00:00
    92 | Canceled  payment    | 2011-07-27 04:45:00
    74 | Canceled transaction | 2011-07-27 04:45:00
    84 | Canceled transfer    | 2011-07-27 04:45:00
    60 | Payment canceled     | 2011-07-27 04:45:00
    75 | Payment rejected     | 2011-07-27 04:45:00
    57 | Rejected transaction | 2011-07-27 04:45:00
     2 | Payment canceled     | 2011-07-27 04:30:00
     1 | Payment rejected     | 2011-07-27 04:30:00
     1 | Canceled transaction | 2011-07-27 04:15:00
     2 | Payment canceled     | 2011-07-27 04:15:00

nacha-transactions.com

     1 | Payment rejected     | 2011-07-27 07:00:00
     1 | Rejected transaction | 2011-07-27 06:45:00
     4 | Canceled  payment    | 2011-07-27 06:30:00
     2 | Canceled transfer    | 2011-07-27 06:30:00
     1 | Payment canceled     | 2011-07-27 06:30:00
     1 | Payment rejected     | 2011-07-27 06:30:00
     1 | Canceled transaction | 2011-07-27 06:15:00
     1 | Canceled transfer    | 2011-07-27 06:15:00
     1 | Payment canceled     | 2011-07-27 06:15:00
     1 | Payment rejected     | 2011-07-27 06:15:00

taxes-refund.com

     1 | Internal Revenue Service        | 2011-07-27 08:00:00
     1 | U.S. Department of the Treasury | 2011-07-27 08:00:00
     1 | Internal Revenue Service        | 2011-07-27 07:45:00
     2 | Internal Revenue Service (IRS)  | 2011-07-27 07:45:00
     2 | Payment IRS.gov                 | 2011-07-27 07:45:00
     1 | Internal Revenue Service        | 2011-07-27 07:30:00
     1 | IRS.gov                         | 2011-07-27 07:30:00
     1 | U.S. Department of the Treasury | 2011-07-27 07:30:00

Three consecutive campaigns, one following the other, with the whole thing wrapping up before 8 AM Central time. (which would be 9 AM Eastern time).

The NACHA spam leading to Zeus has been an issue for a very long time. We've seen spam like this since all the way back to November 2009, but it's been fairly constant since February of this year when we shared the article ACH Transaction Rejected Payment Spam.

Following the Botnet Back in Time

Because of the way we archive our email, it's possible for us to ask the UAB Spam Data Mine to reveal a deeper history for this particular spamming botnet by asking a question like:

"Show me all the spam subjects that have been sent by IP addresses that sent me this morning's fdic-updates.com spam message"

     5 | 2011-07-28 06:00:00 | ACH and Wire transfers disabled.
     3 | 2011-07-28 06:00:00 | Banking security update.
     1 | 2011-07-28 06:00:00 | Update for your banking account.
   107 | 2011-07-28 05:45:00 | ACH and Wire transfers disabled.
   138 | 2011-07-28 05:45:00 | Banking security update.
   108 | 2011-07-28 05:45:00 | Security update for banking accounts.
   122 | 2011-07-28 05:45:00 | Update for your banking account.
     1 | 2011-07-28 05:30:00 | Banking security update.
     1 | 2011-07-28 05:30:00 | Security update for banking accounts.
     1 | 2011-07-28 05:15:00 | ACH and Wire transfers disabled.
     1 | 2011-07-28 05:15:00 | Banking security update.
     1 | 2011-07-28 05:15:00 | Security update for banking accounts.
     1 | 2011-07-27 23:30:00 | ho
     1 | 2011-07-27 21:15:00 | RE:.. How do you do,
     4 | 2011-07-27 20:00:00 | ho
     1 | 2011-07-27 14:45:00 | VIDEO: Lockerbie bomber at pro-Gaddafi rally
     1 | 2011-07-27 12:00:00 | Yo
     1 | 2011-07-27 08:00:00 | Internal Revenue Service
     1 | 2011-07-27 06:45:00 | Rejected transaction
     2 | 2011-07-27 05:15:00 | Rejected transaction
     2 | 2011-07-27 05:00:00 | Canceled transaction
     2 | 2011-07-27 05:00:00 | Canceled transfer
     3 | 2011-07-27 05:00:00 | Payment rejected
    33 | 2011-07-27 04:45:00 | Canceled  payment
    22 | 2011-07-27 04:45:00 | Canceled transaction
    26 | 2011-07-27 04:45:00 | Canceled transfer
    24 | 2011-07-27 04:45:00 | Payment canceled
    30 | 2011-07-27 04:45:00 | Payment rejected
    17 | 2011-07-27 04:45:00 | Rejected transaction
     1 | 2011-07-27 04:30:00 | Payment canceled
     1 | 2011-07-27 04:15:00 | Canceled transaction
     1 | 2011-07-27 04:15:00 | Payment canceled
     1 | 2011-07-26 17:15:00 | Attack on Guinea leader repelled
     1 | 2011-07-26 06:00:00 | IRC.gov
     1 | 2011-07-26 05:45:00 | VIDEO: Phoenix hit by second dust storm
     1 | 2011-07-25 14:00:00 | Hi!
     1 | 2011-07-23 19:45:00 | Giant space telescope reaches orbit
     1 | 2011-07-23 19:45:00 | High Court challenge on care cuts
     1 | 2011-07-23 19:45:00 | HMRC in cost-cutting 'challenge'
     1 | 2011-07-23 19:45:00 | Mortgage lending remains subdued
     1 | 2011-07-23 19:45:00 | Mum's stress reaches baby in womb
     1 | 2011-07-23 19:45:00 | Nato hands over key Afghan city
     1 | 2011-07-23 19:45:00 | Personal pension advice still bad
     1 | 2011-07-23 19:45:00 | Scots economy escapes recession
     1 | 2011-07-23 19:45:00 | Serbia arrests last war crimes fugitive
     1 | 2011-07-23 19:45:00 | Strauss-Kahn daughter questioned
     1 | 2011-07-23 19:45:00 | VIDEO: Key moments as MPs grill Murdochs
     1 | 2011-07-23 18:30:00 | Heya
     2 | 2011-07-22 19:45:00 | Hi
     1 | 2011-07-22 19:00:00 | Hey
     1 | 2011-07-22 19:00:00 | Hi
     1 | 2011-07-22 13:45:00 | Heya
     1 | 2011-07-22 07:15:00 | Read: A Must for High-Rise Emergencies
     1 | 2011-07-22 05:00:00 | IRC.gov
     1 | 2011-07-22 04:45:00 | Support IRS.gov
     2 | 2011-07-22 03:45:00 | Change Confirmation
     1 | 2011-07-22 03:45:00 | Does your enterprise including outstanding tax debts
     1 | 2011-07-22 03:45:00 | Internal Revenue Service
     1 | 2011-07-22 03:45:00 | Internal Revenue Service United States Department of the Treasury
     1 | 2011-07-22 03:45:00 | IRC.gov
     1 | 2011-07-22 03:45:00 | IRS.gov US
     1 | 2011-07-22 03:45:00 | Notice of Underreported Income
     3 | 2011-07-22 03:45:00 | Support IRS.gov
     2 | 2011-07-22 03:45:00 | Treasury Inspector General for Tax Administration
     2 | 2011-07-22 03:45:00 | U.S. Department of the Treasury
     2 | 2011-07-22 03:45:00 | Your company including unpaid tax debts
     1 | 2011-07-21 13:00:00 | Manhood raisers with price-offs!
     1 | 2011-07-21 13:00:00 | Super lasting and good stiff!
     1 | 2011-07-21 05:45:00 | New security update
     2 | 2011-07-21 04:45:00 | Go id token update
     6 | 2011-07-21 04:45:00 | Security token update
     1 | 2011-07-21 04:45:00 | Token code update
     2 | 2011-07-21 04:45:00 | Token software update
     1 | 2011-07-20 07:30:00 | Canceled  payment
     1 | 2011-07-20 07:30:00 | Rejected transaction
     1 | 2011-07-20 07:00:00 | Payment rejected
     1 | 2011-07-20 06:45:00 | Canceled  payment
     1 | 2011-07-20 06:45:00 | Payment canceled
    16 | 2011-07-20 06:30:00 | Canceled  payment
     8 | 2011-07-20 06:30:00 | Canceled transaction
    10 | 2011-07-20 06:30:00 | Canceled transfer
     7 | 2011-07-20 06:30:00 | Payment canceled
     8 | 2011-07-20 06:30:00 | Payment rejected
     6 | 2011-07-20 06:30:00 | Rejected transaction
    19 | 2011-07-20 06:15:00 | Canceled  payment
    13 | 2011-07-20 06:15:00 | Canceled transaction
    15 | 2011-07-20 06:15:00 | Canceled transfer
    16 | 2011-07-20 06:15:00 | Payment canceled
    17 | 2011-07-20 06:15:00 | Payment rejected
    24 | 2011-07-20 06:15:00 | Rejected transaction
     2 | 2011-07-20 05:00:00 | Wire transfer # 3240569823405844930
     4 | 2011-07-20 05:00:00 | Wire transfer # 3463453123432454667
     1 | 2011-07-20 05:00:00 | Wire transfer # 3858994783568734677
     1 | 2011-07-20 05:00:00 | Wire transfer # 4577867895676542367
     2 | 2011-07-20 05:00:00 | Wire transfer # 5645746324515345353
     2 | 2011-07-20 05:00:00 | Wire transfer # 6754846773457536756
     2 | 2011-07-20 05:00:00 | Wire transfer # 6785675623451222333
     1 | 2011-07-20 05:00:00 | Wire transfer # 8565696735865742365
     2 | 2011-07-20 05:00:00 | Wire transfer ID 2345578568567567544
     1 | 2011-07-20 05:00:00 | Wire transfer ID 3265474356547356756
     1 | 2011-07-20 05:00:00 | Wire transfer ID 3425215345565475468
     1 | 2011-07-20 05:00:00 | Wire transfer id 3425233214234534634
     5 | 2011-07-20 05:00:00 | Wire transfer ID 3425233214234534634
     1 | 2011-07-20 05:00:00 | Wire transfer id 3452364365475463425
     1 | 2011-07-20 05:00:00 | Wire transfer ID 4135146854351231151
     1 | 2011-07-20 05:00:00 | Wire transfer ID 4353267658545629087
     3 | 2011-07-20 05:00:00 | Wire transfer ID 5468513264769656536
     1 | 2011-07-20 05:00:00 | Wire transfer id 5473785489567245623
     1 | 2011-07-20 05:00:00 | Wire transfer ID 5687895416264572398
     1 | 2011-07-20 05:00:00 | Wire transfer ID 5876978567345176586
     1 | 2011-07-20 05:00:00 | Wire transfer ID 6768576565423453415
     1 | 2011-07-20 05:00:00 | Wire transfer id 6857234568657433677
     3 | 2011-07-20 05:00:00 | Wire transfer id 8479764976835672345
     1 | 2011-07-20 05:00:00 | Wire transfer id 8658375686537546544
    41 | 2011-07-20 05:00:00 | Your Wire fund transfer
     1 | 2011-07-20 04:30:00 | Wire transfer ID 6431531354846843122
     1 | 2011-07-19 04:45:00 | Change Confirmation
     1 | 2011-07-19 04:45:00 | Does your company is registered outstanding tax debts
     2 | 2011-07-19 04:45:00 | U.S. Department of the Treasury
     1 | 2011-07-19 04:45:00 | Your IRS payment rejected
     1 | 2011-07-19 04:30:00 | Change Confirmation
     1 | 2011-07-19 04:30:00 | Does your company including  tax debts
     1 | 2011-07-19 04:30:00 | Does your enterprise listed unpaid tax debts
     2 | 2011-07-19 04:30:00 | Federal Tax payment rejected
     1 | 2011-07-19 04:30:00 | For your company including unpaid tax debt
     1 | 2011-07-19 04:30:00 | For your enterprise including  tax debt
    13 | 2011-07-19 04:30:00 | Internal Revenue Service
     4 | 2011-07-19 04:30:00 | Internal Revenue Service (IRS)
     2 | 2011-07-19 04:30:00 | Internal Revenue Service United States Department of the Treasury
     4 | 2011-07-19 04:30:00 | IRC.gov
     5 | 2011-07-19 04:30:00 | IRS.gov US
     8 | 2011-07-19 04:30:00 | Notice of Underreported Income
     6 | 2011-07-19 04:30:00 | Payment IRS.gov
     4 | 2011-07-19 04:30:00 | Support IRS.gov
     5 | 2011-07-19 04:30:00 | Treasury Inspector General for Tax Administration
     1 | 2011-07-19 04:30:00 | U.S. Department of the Treasury
     2 | 2011-07-19 04:30:00 | Your enterprise has remained outstanding tax debts
     3 | 2011-07-19 04:30:00 | Your IRS payment rejected
     1 | 2011-07-19 04:15:00 | Internal Revenue Service
     1 | 2011-07-18 10:30:00 | Love BlackJack? Check out the games at Winner Palace
     1 | 2011-07-16 02:00:00 | Out of Office AutoReply: Please Review
     1 | 2011-07-15 09:00:00 | For your company is registered unpaid tax debt
     1 | 2011-07-15 09:00:00 | Internal Revenue Service
     2 | 2011-07-15 08:45:00 | Change Confirmation
     2 | 2011-07-15 08:45:00 | Federal Tax payment rejected
     2 | 2011-07-15 08:45:00 | Internal Revenue Service
     2 | 2011-07-15 08:45:00 | Internal Revenue Service (IRS)
     4 | 2011-07-15 08:45:00 | Internal Revenue Service United States Department of the Treasury
     3 | 2011-07-15 08:45:00 | IRC.gov
     1 | 2011-07-15 08:45:00 | IRS.gov US
     3 | 2011-07-15 08:45:00 | Payment IRS.gov
     2 | 2011-07-15 08:45:00 | Support IRS.gov
     1 | 2011-07-15 08:45:00 | Treasury Inspector General for Tax Administration
     1 | 2011-07-15 08:45:00 | U.S. Department of the Treasury
     2 | 2011-07-15 08:45:00 | Your IRS payment rejected
     1 | 2011-07-15 07:30:00 | TV murder appeal prompts 40 calls
     1 | 2011-07-14 21:30:00 | US senator requests hacking probe
     1 | 2011-07-14 20:15:00 | Parties unite over BSkyB bid call
     1 | 2011-07-14 19:45:00 | PM Kan urges 'nuclear-free Japan'
     1 | 2011-07-14 18:00:00 | Man tells jury 'I killed Lynette'
     1 | 2011-07-14 15:15:00 | VIDEO: Live: Debate on youth unemployment
     1 | 2011-07-14 07:15:00 | Security update for banking accounts.
    10 | 2011-07-14 07:00:00 | ACH and Wire transfers disabled.
     5 | 2011-07-14 07:00:00 | Banking security update.
     7 | 2011-07-14 07:00:00 | Security update for banking accounts.
     5 | 2011-07-14 07:00:00 | Update for your banking account.
     1 | 2011-07-13 11:30:00 | Hospitals warned over clot deaths
     1 | 2011-07-13 07:45:00 | Does your enterprise listed unpaid tax debt
     3 | 2011-07-13 07:45:00 | Federal Tax payment rejected
     5 | 2011-07-13 07:45:00 | Internal Revenue Service United States Department of the Treasury
     2 | 2011-07-13 07:45:00 | IRC.gov
     7 | 2011-07-13 07:45:00 | Notice of Underreported Income
     1 | 2011-07-13 07:45:00 | Treasury Inspector General for Tax Administration
     2 | 2011-07-13 07:45:00 | U.S. Department of the Treasury
     1 | 2011-07-13 07:45:00 | Your company listed outstanding tax debt
     1 | 2011-07-13 07:45:00 | Your enterprise listed unpaid tax debt
     1 | 2011-07-13 07:30:00 | Internal Revenue Service
     2 | 2011-07-13 07:30:00 | Internal Revenue Service (IRS)
     2 | 2011-07-13 07:30:00 | Internal Revenue Service United States Department of the Treasury
     1 | 2011-07-13 07:30:00 | Notice of Underreported Income
     3 | 2011-07-13 07:30:00 | Payment IRS.gov
     1 | 2011-07-13 07:30:00 | Support IRS.gov
     2 | 2011-07-13 07:30:00 | U.S. Department of the Treasury
     2 | 2011-07-13 07:30:00 | Your IRS payment rejected
     3 | 2011-07-13 05:45:00 | Business accounts updates
     1 | 2011-07-13 05:45:00 | Dear corporate clients
     1 | 2011-07-13 05:45:00 | New settings for wire transfers
     1 | 2011-07-13 05:30:00 | Business accounts updates
     5 | 2011-07-13 05:30:00 | Corporate banking security
     3 | 2011-07-13 05:30:00 | Dear corporate clients
    10 | 2011-07-13 05:30:00 | Federalreserve security update
     4 | 2011-07-13 05:30:00 | New security settings
     4 | 2011-07-13 05:30:00 | New security update
     5 | 2011-07-13 05:30:00 | New settings for wire transfers
     2 | 2011-07-13 05:30:00 | Wire transfers update

We can also ask it to tell us what spammed destinations were being described by those messages and learn that what we see is:

July 13th = usbanking-security.com
July 15th = federalsecusrity.com
July 19th = taxreport-irs.com
July 19th = irs-taxes-report.com
July 19th = irs-report-link.com
July 20th = www.federalreserve.gov
July 20th = reports-federalreserve.com
July 20th = nacha-alert.org
July 20th = nacha-alert.com
July 20th = alerts-federalresrve.com
July 21st = national-security-agency.com
July 21st = federal-secueity-government.com
July 22nd = irs-downloads.com
July 22nd = irs-files.com
July 26th = taxes-irs.net
July 27th = www.nacha-rejected.com
July 27th = taxes-refund.com
July 28th = fdic-updates.com

Again, the query run says "look at my spam history FOR THE IP ADDRESSES USED BY THE GOV-RELATED ZEUS DOMAIN THIS MORNING and see what else they've sent me previously."

I've temporarily included only those links that were DIRECTLY linking to an executable, but we also have all of the "domain-shortener" spam that was sent on July 13th pretending to be a LinkedIn message. In that case, the spam used 25 different shortener services, most of which seem to have been created specifically for that purpose:

1tja.com
4h.biz
4nu.net
coge.la
d3c.co
flyfrm.com
gli.im
gsfn.info
hi2.com
ion.so
ks.gs
lawurl.com
lllll.im
niy.me
nznet.info
sendtourl.com
shoor.tk
smlurl.info
sra.li
tiny.tw
vs0.net
widg.me
wurl.ca
yi.pe
zolp.net

And yes, we can also tie today's spamming botnet to all of those fake LinkedIn spam messages that distributed Zeus on July 13th.

Wednesday, July 27, 2011

"Wrong Transaction" Hotel Spam

(Updated information available here: Wrong Transaction Hotel Spam Continues to Evolve.)

One of the features in the new version of the UAB Spam Data Mine is the ability to quickly run "malware links" and "malware attachments" reports for the current day, the previous day, or a date range.

The objective of this functionality is to provide as close to "real time" intelligence on potential new email-based threats as possible. You'll see what I mean below.

I've been playing with it for the past several days, but just so you can join in the fun, let me show you the top results that come back when I do:

\i malware.attachments.sql

Spam Count	Attached MD5	Extension	Subject
6	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Renaissance Chicago made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Hyatt Regency Houston made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Jefferson made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Renaissance Washington made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Sheraton Suites San Diego at Symphony Hall made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel The Westin Oaks made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Westin Diplomat Resort & Spa made wrong transaction
5	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Westin St. Francis made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Hilton Las Vegas made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Intercontinental Buckhead Atlanta made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Rancho Bernardo Inn made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Ritz Carlton Kapalua made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Ritz-Carlton Marina Del Rey made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel The Latham made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Hotel The Westin New York at Times Square made wrong transaction
4	c15eb3c47800fec025b6a86a6409f144	zip	Wrong transaction from your credit card in Ritz Carlton Naples Beach Resort
3	c15eb3c47800fec025b6a86a6409f144	zip	Hotel Four Seasons Resort Maui at Wailea made wrong transaction
3	c15eb3c47800fec025b6a86a6409f144	zip	Hotel The Whitehall made wrong transaction
3	c15eb3c47800fec025b6a86a6409f144	zip	Wrong transaction from your credit card in Loews Miami Beach
3	c15eb3c47800fec025b6a86a6409f144	zip	Wrong transaction from your credit card in Woodrun V Townhomes

Since we've never seen spam like this before, it's "new" and potentially interesting!

One quick check of whether this is "interesting" is what happens when we ask forty-three different Anti-virus vendors whether the attached file is a virus or not.

We do this by using the services of VirusTotal.com who gave us back this report: VirusTotal Report for c15eb3c47800fec025b6a86a6409f144. At the time of this writing, having already received more than 800 copies of the spam, Sophos and Trend Micro call it "BredoLab", Rising AV of China calls it "suspicious", and NOD32 says it's a "Kryptik" variant. The other thirty-nine AV companies currently don't have published definitions for this malware.

UPDATE: As of 12:36 PM Central Time on July 27th, we are now up to 12 of 43 detects. See the Update VirusTotal Report Here. Curiously, just yesterday someone asked me, do you ever see AV vendors change their mind on what something should be called? You'll note that on the first report, Sophos called this Bredolab, but now they are calling it Zbot. It will be curious to see how that rolls out, since no one else among the 12 detectors believes this to be Zeus (aka Zbot).

The spam messages look like this:

We've already seen more than 400 different subjects that are part of this group!

7 | Hotel Courtyard by Marriott Houston Downtown made wrong transaction
6 | Hotel Ritz-Carlton Marina Del Rey made wrong transaction
6 | Hotel Hilton Las Vegas made wrong transaction
6 | Hotel Renaissance Chicago made wrong transaction
6 | Hotel Westin Diplomat Resort & Spa made wrong transaction
5 | Wrong transaction from your credit card in Icon
5 | Wrong transaction from your credit card in Ritz Carlton Naples Beach Resort
5 | Hotel The Westin Oaks made wrong transaction
5 | Hotel Sheraton Suites San Diego at Symphony Hall made wrong transaction
5 | Hotel Renaissance Washington made wrong transaction
5 | Hotel Jefferson made wrong transaction
5 | Hotel Westin St. Francis made wrong transaction
5 | Hotel Rancho Bernardo Inn made wrong transaction
5 | Hotel Intercontinental Buckhead Atlanta made wrong transaction
5 | Hotel Hyatt Regency Houston made wrong transaction

(The complete list concludes at the bottom of this post . . . )

One of the other great things we can do with the UAB Spam Data Mine though, is to ask "what other things are being sent by the computers that sent us this spam?"

Look what happens when I ask "show me the top subjects from YESTERDAY that were spammed by IP addresses that spammed the hotel spam TODAY?"

62 | 2011-07-26 | Credit Card is one week overdue
51 | 2011-07-26 | Credit Card overdue
43 | 2011-07-26 | Your Credit Card is one week overdue
39 | 2011-07-26 | Payment by credit card overdue
39 | 2011-07-26 | Credit card payment of overstayed
25 | 2011-07-26 | Your financial debt overdue
6 | 2011-07-26 | Re: Re: hi bud
5 | 2011-07-26 | Get your first bonus just for registering.
4 | 2011-07-26 | We offer only top grade Replica watches at only a fraction of the original price,
4 | 2011-07-26 | Chase bonuses no more; register at Winner Palacce.
4 | 2011-07-26 | Seeking gaming glory? Sign up and get free bonus.
3 | 2011-07-26 | A dream come true sign up bonus at Winner Palacce.
3 | 2011-07-26 | Gaming glory beckons, register and get free bonus.

The top group - the most prominent in response to this query - was the "MasterCard" version of the Fake AV malware that we blogged about previously on July 23rd -- MasterCard Spam Leads to Fake AV. SC Magazine's Angelina Moscaritolo wrote that up under the headline "Rogue AV Masquerading as SC Awards 2011 Finalist. The same spamming botnet has been sending out Casino spam and Rolex watch spam for more than a month.

We had 120 different subjects from this small IP sample group yesterday -- many of the subjects are "customized" such as "gar@place.com Rolex.com For You - 77%" or "gar@otherplace.com Rolex.com For You - 55%"

So, what do we predict the Hotel Spam will turn out to be? There is a good chance it will be related to the MasterCard Fake AV Spam. Well . . . one way to find out, right?

The .zip file contained this file:

When we launched the malware, it made connection to the webserver at "yomwarayom2001.ru" on IP address 84.247.61.25.

The first link we hit there was an exploit server -- probably the "BlackHole Exploit Kit" that has been very popular recently on similarly structured web pages. We almost immediately ALSO fetched a file called "forum3/load.php?module=grabbers".

This caused us to download a file "soft.exe" from yomwarayom2001.ru.

In a couple minutes, a pop-up announced "Software Installed" and had an "OK" button. Clicking OK caused a connection to "heftyhips.com" on IP 66.197.251.53.

where the file "images/img.php?id=106" was fetched.

Shortly thereafter we had a "Defender" icon on the desktop, which was this file:

Note that "Defender" claims to be written by AVG Software Development, a real antivirus company!

That was enough to convince me we were still in "Fake AV" territory.

The rest of the hotel spam subject list

Hotel Acqualina Resort & Spa made wrong transaction
Hotel Ahwahnee made wrong transaction
Hotel Amsterdam Hospitality made wrong transaction
Hotel Anglers made wrong transaction
Hotel Argonaut made wrong transaction
Hotel Aria made wrong transaction
Hotel Arizona Biltmore made wrong transaction
Hotel Arrabelle at Vail Square made wrong transaction
Hotel Avalon made wrong transaction
Hotel Bellagio and Casino made wrong transaction
Hotel Beverly Hills & Bungalows made wrong transaction
Hotel Beverly Wilshire, A Four Seasons made wrong transaction
Hotel Biltmore made wrong transaction
Hotel Boston Harbor made wrong transaction
Hotel Boston Marriott Copley Place made wrong transaction
Hotel Breakers Palm Beach made wrong transaction
Hotel Breakwater made wrong transaction
Hotel Camelback Inn, A JW Marriott Resort & Spa made wrong transaction
Hotel Campton Place made wrong transaction
Hotel Carlton on Madison Avenue made wrong transaction
Hotel Casa Del Mar made wrong transaction
Hotel Chamonix made wrong transaction
Hotel Charleston Marriott made wrong transaction
Hotel Charleston Place made wrong transaction
Hotel Conrad Chicago made wrong transaction
Hotel Conrad Miami made wrong transaction
Hotel Courtyard by Marriott Capitol Hill/Navy Yard made wrong transaction
Hotel Courtyard by Marriott Houston Downtown made wrong transaction
Hotel Courtyard Washington Convention Center made wrong transaction
Hotel Crowne Plaza The Hamilton made wrong transaction
Hotel Delano made wrong transaction
Hotel Del Coronado made wrong transaction
Hotel Disney's Grand Californian made wrong transaction
Hotel Disney's Grand Floridian made wrong transaction
Hotel Disney's Polynesian Resort made wrong transaction
Hotel Doubletree by Hilton Orlando at SeaWorld made wrong transaction
Hotel Dunton Hot Springs made wrong transaction
Hotel Embassy Suites Chevy Chase Pavilion made wrong transaction
Hotel Embassy Suites - Convention Center made wrong transaction
Hotel Embassy Suites made wrong transaction
Hotel Embassy Suites North Charleston made wrong transaction
Hotel Embassy Suites Washington made wrong transaction
Hotel Enchantment Resort made wrong transaction
Hotel Encore at Wynn made wrong transaction
Hotel Fairmont Chicago made wrong transaction
Hotel Fairmont Heritage Place Ghiradelli Square made wrong transaction
Hotel Fairmont Kea Lani made wrong transaction
Hotel Fairmont Miramar made wrong transaction
Hotel Fairmont Scottsdale made wrong transaction
Hotel Fairmont & Towers made wrong transaction
Hotel Florida Choice Executive Pool Homes made wrong transaction
Hotel Four Seasons Los Angeles at Beverly Hills made wrong transaction
Hotel Four Seasons made wrong transaction
Hotel Four Seasons Resort Lanai at Manele Bay made wrong transaction
Hotel Four Seasons Resort Maui at Wailea made wrong transaction
Hotel Four Seasons Resort Palm Beach made wrong transaction
Hotel Four Seasons Resort Scottsdale made wrong transaction
Hotel Four Seasons San Francisco made wrong transaction
Hotel Gansevoort South made wrong transaction
Hotel George made wrong transaction
Hotel Gramercy Park made wrong transaction
Hotel Grand Bohemian made wrong transaction
Hotel Grand Hyatt Atlanta in Buckhead made wrong transaction
Hotel Grand Hyatt Kauai Resort & Spa made wrong transaction
Hotel Grand Hyatt New York made wrong transaction
Hotel Grand Hyatt San Francisco made wrong transaction
Hotel Grand Hyatt Seattle made wrong transaction
Hotel Grand Hyatt Washington made wrong transaction
Hotel Granduca made wrong transaction
Hotel Grand Wailea Resort made wrong transaction
Hotel Halekulani made wrong transaction
Hotel Hampton Inn Washington - Convention Center made wrong transaction
Hotel Helix Boutique made wrong transaction
Hotel Hilton Americas Houston made wrong transaction
Hotel Hilton Atlanta Airport made wrong transaction
Hotel Hilton Atlanta made wrong transaction
Hotel Hilton Boston Logan Airport made wrong transaction
Hotel Hilton Chicago made wrong transaction
Hotel Hilton Garden Inn Washington DC Franklin Square made wrong transaction
Hotel Hilton Grand Vacations Club made wrong transaction
Hotel Hilton Hawaiian Village made wrong transaction
Hotel Hilton Houston Plaza made wrong transaction
Hotel Hilton Houston Westchase made wrong transaction
Hotel Hilton Las Vegas made wrong transaction
Hotel Hilton Orlando Bonnet Creek made wrong transaction
Hotel Hilton Washington Embassy Row made wrong transaction
Hotel Hilton Washington made wrong transaction
Hotel Holiday Inn Port of Miami Downtown made wrong transaction
Hotel Homewood Suites made wrong transaction
Hotel Hyatt Grand Aspen made wrong transaction
Hotel Hyatt Regency Atlanta made wrong transaction
Hotel Hyatt Regency Grand Cypress made wrong transaction
Hotel Hyatt Regency Houston made wrong transaction
Hotel Hyatt Regency Huntington Beach made wrong transaction
Hotel Hyatt Regency Maui Resort and Spa made wrong transaction
Hotel Hyatt Regency San Francisco made wrong transaction
Hotel Hyatt Regency Scottsdale Resort made wrong transaction
Hotel Hyatt Regency Waikiki made wrong transaction
Hotel Hyatt Regency Washington made wrong transaction
Hotel Icon made wrong transaction
Hotel Indian Creek made wrong transaction
Hotel Inn at Perry Cabin made wrong transaction
Hotel Inn at the Ballpark made wrong transaction
Hotel Intercontinental Buckhead Atlanta made wrong transaction
Hotel InterContinental Chicago made wrong transaction
Hotel InterContinental made wrong transaction
Hotel Intercontinental San Francisco made wrong transaction
Hotel InterContinental The Barclay New York made wrong transaction
Hotel Jefferson made wrong transaction
Hotel Jerome made wrong transaction
Hotel Jumeirah Essex House made wrong transaction
Hotel JW Marriott Buckhead Atlanta made wrong transaction
Hotel JW Marriott Desert Ridge Resort & Spa made wrong transaction
Hotel JW Marriott Las Vegas Resort, Spa & Golf made wrong transaction
Hotel JW Marriott Miami made wrong transaction
Hotel JW Marriott Orlando Grande Lakes made wrong transaction
Hotel JW Marriott Pennsylvania Avenue made wrong transaction
Hotel JW Marriott San Francisco made wrong transaction
Hotel Kahala Resort made wrong transaction
Hotel Keswick Hall made wrong transaction
Hotel La Costa Resort & Spa made wrong transaction
Hotel Lauberge Del Mar made wrong transaction
Hotel La Valencia made wrong transaction
Hotel Le Meridien San Francisco made wrong transaction
Hotel Le Parker Meridien made wrong transaction
Hotel Lodge At Koele made wrong transaction
Hotel Lodge At Torrey Pines made wrong transaction
Hotel Loews Coronado Bay Resort made wrong transaction
Hotel Loews Miami Beach made wrong transaction
Hotel Loews Regency made wrong transaction
Hotel Loews Santa Monica Beach made wrong transaction
Hotel London West Hollywood made wrong transaction
Hotel Lowell made wrong transaction
Hotel Madera made wrong transaction
Hotel Madison made wrong transaction
Hotel Main Street Station & Casino made wrong transaction
Hotel Mandalay Bay made wrong transaction
Hotel Mandarin Oriental made wrong transaction
Hotel Mandarin Oriental Miami made wrong transaction
Hotel Marriott at Metro Center made wrong transaction
Hotel Marriott Chicago Downtown Magnificent Mile made wrong transaction
Hotel Marriott Houston Airport at George Bush Intercontinental made wrong transaction
Hotel Marriott Marquis San Francisco made wrong transaction
Hotel Marriott Resort made wrong transaction
Hotel Marriott San Francisco Fisherman's Wharf made wrong transaction
Hotel Mauna Kea Beach made wrong transaction
Hotel Mauna Lani Bay & Bungalows made wrong transaction
Hotel McCoy Peak Lodge made wrong transaction
Hotel Melrose made wrong transaction
Hotel Meridian Luxury Suites made wrong transaction
Hotel Michelangelo made wrong transaction
Hotel Millennium UN Plaza made wrong transaction
Hotel Monaco Boutique made wrong transaction
Hotel Monaco Washington DC made wrong transaction
Hotel Mona Lisa Suite made wrong transaction
Hotel Mondrian made wrong transaction
Hotel Mondrian Scottsdale made wrong transaction
Hotel Mondrian South Beach made wrong transaction
Hotel Morenas Resort Morrison-Clark Historic Inn made wrong transaction
Hotel M Resort Spa & Casino made wrong transaction
Hotel New York Marriott Marquis made wrong transaction
Hotel Nolitan made wrong transaction
Hotel Oak Plantation Resort made wrong transaction
Hotel Ocean Key Resort & Spa made wrong transaction
Hotel Ocean Point Resort & Club made wrong transaction
Hotel Omni Berkshire Place made wrong transaction
Hotel Omni Chicago made wrong transaction
Hotel Omni Houston made wrong transaction
Hotel Omni made wrong transaction
Hotel One Bal Harbour Resort & Spa made wrong transaction
Hotel Owl Creek Homes made wrong transaction
Hotel Palms Place & Spa made wrong transaction
Hotel Palomar Boutique made wrong transaction
Hotel Palomar made wrong transaction
Hotel Park Hyatt Chicago made wrong transaction
Hotel Park Hyatt made wrong transaction
Hotel Park Hyatt Resort & Spa made wrong transaction
Hotel Peabody Orlando made wrong transaction
Hotel Peninsula New York made wrong transaction
Hotel Phoenician made wrong transaction
Hotel Pierre A Taj made wrong transaction
Hotel Plaza Athenee made wrong transaction
Hotel Pocono Palace made wrong transaction
Hotel Prescott made wrong transaction
Hotel Raffles L'Ermitage Beverly Hills made wrong transaction
Hotel Rancho Bernardo Inn made wrong transaction
Hotel Rancho Las Palmas Resort & Spa made wrong transaction
Hotel Red Rock Casino Resort & Spa made wrong transaction
Hotel Renaissance Charleston Historic District made wrong transaction
Hotel Renaissance Chicago made wrong transaction
Hotel Renaissance Houston Greenway Plaza made wrong transaction
Hotel Renaissance New York Times Square made wrong transaction
Hotel Renaissance Washington made wrong transaction
Hotel Renaissance Waverly made wrong transaction
Hotel Residence Inn by Marriott Capitol made wrong transaction
Hotel Rio Suite and Casino made wrong transaction
Hotel Ritz-Carlton Battery Park made wrong transaction
Hotel Ritz-Carlton Boston Common made wrong transaction
Hotel Ritz-Carlton Central Park made wrong transaction
Hotel Ritz-Carlton Golf Resort made wrong transaction
Hotel Ritz Carlton Kapalua made wrong transaction
Hotel Ritz Carlton Key Biscayne made wrong transaction
Hotel Ritz-Carlton Laguna Niguel made wrong transaction
Hotel Ritz-Carlton made wrong transaction
Hotel Ritz-Carlton Marina Del Rey made wrong transaction
Hotel Ritz Carlton Naples Beach Resort made wrong transaction
Hotel Ritz Carlton Naples Golf Resort made wrong transaction
Hotel Ritz-Carlton Orlando, Grande Lakes Resort made wrong transaction
Hotel Ritz-Carlton Palm Beach made wrong transaction
Hotel Ritz-Carlton San Francisco made wrong transaction
Hotel Ritz Carlton South Beach made wrong transaction
Hotel Rouge made wrong transaction
Hotel Royal Hawaiian made wrong transaction
Hotel Royal Pacific Resort made wrong transaction
Hotel Royal Palms Resort & Spa made wrong transaction
Hotel Sanctuary on Camelback Mountain made wrong transaction
Hotel Seattle Marriott Waterfront made wrong transaction
Hotel Se San Diego made wrong transaction
Hotel Shangri-La made wrong transaction
Hotel Sheraton Bal Harbour Beach Resort made wrong transaction
Hotel Sheraton Chicago and Towers made wrong transaction
Hotel Sheraton Keauhou Bay Resort & Spa made wrong transaction
Hotel Sheraton Maui Resort made wrong transaction
Hotel Sheraton Moana Surfrider made wrong transaction
Hotel Sheraton Suites Houston Near The Galleria made wrong transaction
Hotel Sheraton Suites San Diego at Symphony Hall made wrong transaction
Hotel Sheraton Waikiki made wrong transaction
Hotel Shore Club made wrong transaction
Hotel Shutters Beach made wrong transaction
Hotel Signature at MGM Grand made wrong transaction
Hotel Skylofts at MGM Grand made wrong transaction
Hotel SLS at Beverly Hills made wrong transaction
Hotel Sofitel Lafayette Square made wrong transaction
Hotel Sonesta Orlando Downtown made wrong transaction
Hotel Sorrento made wrong transaction
Hotel South Beach Marriott made wrong transaction
Hotel Star The Michelangelo made wrong transaction
Hotel St. Gregory Luxury & Suites made wrong transaction
Hotel St. Regis made wrong transaction
Hotel St. Regis Princeville Resort made wrong transaction
Hotel St. Regis Washington made wrong transaction
Hotel Sun Harbour Boutique made wrong transaction
Hotel Sutton Place made wrong transaction
Hotel Swissotel Chicago made wrong transaction
Hotel Taj Boston made wrong transaction
Hotel Taj Campton Place made wrong transaction
Hotel Tamarack by Destination Resorts Snowmass made wrong transaction
Hotel The Alexander made wrong transaction
Hotel The Alex made wrong transaction
Hotel The Carlyle, A Rosewood made wrong transaction
Hotel The Carlyle Suites made wrong transaction
Hotel The Chatwal made wrong transaction
Hotel The Cosmopolitan Las Vegas made wrong transaction
Hotel The Drake made wrong transaction
Hotel The Enclave made wrong transaction
Hotel The Equinox Resort & Spa made wrong transaction
Hotel The Fairmont Copley Plaza made wrong transaction
Hotel The Fairmont made wrong transaction
Hotel The Fairmont Olympic made wrong transaction
Hotel The Fairmont Orchid made wrong transaction
Hotel The Fairmont Washington made wrong transaction
Hotel The Hay-Adams made wrong transaction
Hotel The Helmsley Carlton House made wrong transaction
Hotel The Henley Park made wrong transaction
Hotel The Houstonian Club & Spa made wrong transaction
Hotel The Huntington and Nob Hill Spa made wrong transaction
Hotel The Iroquois made wrong transaction
Hotel The Langham Huntington & SPA made wrong transaction
Hotel The Latham made wrong transaction
Hotel The Lenox made wrong transaction
Hotel The Little Nell made wrong transaction
Hotel The Lucerne made wrong transaction
Hotel The New York Helmsley made wrong transaction
Hotel The Orchard made wrong transaction
Hotel The Palmer House Hilton made wrong transaction
Hotel The Peninsula Beverly Hills made wrong transaction
Hotel The Peninsula made wrong transaction
Hotel The Phoenician made wrong transaction
Hotel The Pierre made wrong transaction
Hotel The Plaza made wrong transaction
Hotel The Quincy made wrong transaction
Hotel The Ritz-Carlton Bachelor Gulch made wrong transaction
Hotel The Ritz-Carlton Buckhead made wrong transaction
Hotel The Ritz-Carlton Fort Lauderdale made wrong transaction
Hotel The Ritz-Carlton Georgetown made wrong transaction
Hotel The Ritz-Carlton Laguna Niguel made wrong transaction
Hotel The Ritz Carlton made wrong transaction
Hotel The Ritz-Carlton Orlando, Grande Lakes made wrong transaction
Hotel The Setai Fifth Avenue made wrong transaction
Hotel The Setai made wrong transaction
Hotel The St. Regis Aspen made wrong transaction
Hotel The St. Regis Monarch Beach made wrong transaction
Hotel The Venetian Resort and Casino made wrong transaction
Hotel The Villa By Barton G made wrong transaction
Hotel The Washington Court On Capital Hil made wrong transaction
Hotel The Westin Atlanta Airport made wrong transaction
Hotel The Westin Chicago River North made wrong transaction
Hotel The Westin Embassy Row made wrong transaction
Hotel The Westin Grand made wrong transaction
Hotel The Westin Michigan Avenue made wrong transaction
Hotel The Westin Mission Hills Resort & Spa made wrong transaction
Hotel The Westin New York at Times Square made wrong transaction
Hotel The Westin Oaks made wrong transaction
Hotel The Westin Peachtree Plaza made wrong transaction
Hotel The Westin Seattle made wrong transaction
Hotel The Whitehall made wrong transaction
Hotel The Wit-A Doubletree made wrong transaction
Hotel Tides South Beach made wrong transaction
Hotel Topaz made wrong transaction
Hotel Trump International Sonesta Beach resort made wrong transaction
Hotel Trump International & Tower made wrong transaction
Hotel Trump International Waikiki Beach Walk made wrong transaction
Hotel Trump Las Vegas made wrong transaction
Hotel Trump Soho made wrong transaction
Hotel Universal Portofino Bay a Loews made wrong transaction
Hotel Universal Royal Pacific Resort a Loews made wrong transaction
Hotel Vdara & Spa made wrong transaction
Hotel Viceroy Palm Springs made wrong transaction
Hotel Villas Of Grand Cypress made wrong transaction
Hotel Wailea Marriott an Outrigger Resort made wrong transaction
Hotel Waldorf Astoria Orlando made wrong transaction
Hotel Waldorf Astoria & Towers made wrong transaction
Hotel Waldorf Towers made wrong transaction
Hotel Walt Disney World Swan and Dolphin made wrong transaction
Hotel Wardman Park Marriott made wrong transaction
Hotel Washington Court on Capitol Hill made wrong transaction
Hotel Washington Suites Georgetown made wrong transaction
Hotel W Atlanta Midtown made wrong transaction
Hotel W Boston made wrong transaction
Hotel Westin Diplomat Resort & Spa made wrong transaction
Hotel Westin Maui Resort & Spa made wrong transaction
Hotel Westin Princeville Ocean Resort Villas made wrong transaction
Hotel Westin St. Francis made wrong transaction
Hotel W Hollywood made wrong transaction
Hotel Willard InterContinental made wrong transaction
Hotel Windsor Court made wrong transaction
Hotel W Los Angeles Westwood made wrong transaction
Hotel Woodrun Place Condo made wrong transaction
Hotel Woodrun V Townhomes made wrong transaction
Hotel W Seattle made wrong transaction
Hotel Wyndham Grand Desert made wrong transaction
Hotel Wynn Las Vegas made wrong transaction
Hotel XV Beacon made wrong transaction
Hotel ZaZa Houston made wrong transaction
Hotel Z Ocean made wrong transaction
Wrong transaction from your credit card in Acqualina Resort & Spa
Wrong transaction from your credit card in Ahwahnee
Wrong transaction from your credit card in Amsterdam Hospitality
Wrong transaction from your credit card in Anglers
Wrong transaction from your credit card in Argonaut
Wrong transaction from your credit card in Aria
Wrong transaction from your credit card in Arizona Biltmore
Wrong transaction from your credit card in Arrabelle at Vail Square
Wrong transaction from your credit card in Avalon
Wrong transaction from your credit card in Bellagio and Casino
Wrong transaction from your credit card in Beverly Hills & Bungalows
Wrong transaction from your credit card in Beverly Wilshire, A Four Seasons
Wrong transaction from your credit card in Biltmore
Wrong transaction from your credit card in Boston Harbor
Wrong transaction from your credit card in Boston Marriott Copley Place
Wrong transaction from your credit card in Breakers Palm Beach
Wrong transaction from your credit card in Breakwater
Wrong transaction from your credit card in Camelback Inn, A JW Marriott Resort & Spa
Wrong transaction from your credit card in Campton Place
Wrong transaction from your credit card in Carlton on Madison Avenue
Wrong transaction from your credit card in Casa Del Mar
Wrong transaction from your credit card in Chamonix
Wrong transaction from your credit card in Charleston Marriott
Wrong transaction from your credit card in Charleston Place
Wrong transaction from your credit card in Conrad Chicago
Wrong transaction from your credit card in Conrad Miami
Wrong transaction from your credit card in Courtyard by Marriott Capitol Hill/Navy Yard
Wrong transaction from your credit card in Courtyard by Marriott Houston Downtown
Wrong transaction from your credit card in Courtyard Washington Convention Center
Wrong transaction from your credit card in Crowne Plaza The Hamilton
Wrong transaction from your credit card in Delano
Wrong transaction from your credit card in Del Coronado
Wrong transaction from your credit card in Disney's Grand Californian
Wrong transaction from your credit card in Disney's Grand Floridian
Wrong transaction from your credit card in Disney's Polynesian Resort
Wrong transaction from your credit card in Doubletree by Hilton Orlando at SeaWorld
Wrong transaction from your credit card in Dunton Hot Springs
Wrong transaction from your credit card in Embassy Suites
Wrong transaction from your credit card in Embassy Suites Chevy Chase Pavilion
Wrong transaction from your credit card in Embassy Suites - Convention Center
Wrong transaction from your credit card in Embassy Suites North Charleston
Wrong transaction from your credit card in Embassy Suites Washington
Wrong transaction from your credit card in Enchantment Resort
Wrong transaction from your credit card in Encore at Wynn
Wrong transaction from your credit card in Fairmont Chicago
Wrong transaction from your credit card in Fairmont Heritage Place Ghiradelli Square
Wrong transaction from your credit card in Fairmont Kea Lani
Wrong transaction from your credit card in Fairmont Miramar
Wrong transaction from your credit card in Fairmont Scottsdale
Wrong transaction from your credit card in Fairmont & Towers
Wrong transaction from your credit card in Florida Choice Executive Pool Homes
Wrong transaction from your credit card in Four Seasons
Wrong transaction from your credit card in Four Seasons Los Angeles at Beverly Hills
Wrong transaction from your credit card in Four Seasons Resort Lanai at Manele Bay
Wrong transaction from your credit card in Four Seasons Resort Maui at Wailea
Wrong transaction from your credit card in Four Seasons Resort Palm Beach
Wrong transaction from your credit card in Four Seasons Resort Scottsdale
Wrong transaction from your credit card in Four Seasons San Francisco
Wrong transaction from your credit card in Gansevoort South
Wrong transaction from your credit card in George
Wrong transaction from your credit card in Gramercy Park
Wrong transaction from your credit card in Grand Bohemian
Wrong transaction from your credit card in Grand Hyatt Atlanta in Buckhead
Wrong transaction from your credit card in Grand Hyatt Kauai Resort & Spa
Wrong transaction from your credit card in Grand Hyatt New York
Wrong transaction from your credit card in Grand Hyatt San Francisco
Wrong transaction from your credit card in Grand Hyatt Seattle
Wrong transaction from your credit card in Grand Hyatt Washington
Wrong transaction from your credit card in Granduca
Wrong transaction from your credit card in Grand Wailea Resort
Wrong transaction from your credit card in Halekulani
Wrong transaction from your credit card in Hampton Inn Washington - Convention Center
Wrong transaction from your credit card in Helix Boutique
Wrong transaction from your credit card in Hilton Americas Houston
Wrong transaction from your credit card in Hilton Atlanta
Wrong transaction from your credit card in Hilton Atlanta Airport
Wrong transaction from your credit card in Hilton Boston Logan Airport
Wrong transaction from your credit card in Hilton Chicago
Wrong transaction from your credit card in Hilton Garden Inn Washington DC Franklin Square
Wrong transaction from your credit card in Hilton Grand Vacations Club
Wrong transaction from your credit card in Hilton Hawaiian Village
Wrong transaction from your credit card in Hilton Houston Plaza
Wrong transaction from your credit card in Hilton Houston Westchase
Wrong transaction from your credit card in Hilton Las Vegas
Wrong transaction from your credit card in Hilton Orlando Bonnet Creek
Wrong transaction from your credit card in Hilton Washington
Wrong transaction from your credit card in Hilton Washington Embassy Row
Wrong transaction from your credit card in Holiday Inn Port of Miami Downtown
Wrong transaction from your credit card in Homewood Suites
Wrong transaction from your credit card in Hyatt Grand Aspen
Wrong transaction from your credit card in Hyatt Regency Atlanta
Wrong transaction from your credit card in Hyatt Regency Grand Cypress
Wrong transaction from your credit card in Hyatt Regency Houston
Wrong transaction from your credit card in Hyatt Regency Huntington Beach
Wrong transaction from your credit card in Hyatt Regency Maui Resort and Spa
Wrong transaction from your credit card in Hyatt Regency San Francisco
Wrong transaction from your credit card in Hyatt Regency Scottsdale Resort
Wrong transaction from your credit card in Hyatt Regency Waikiki
Wrong transaction from your credit card in Hyatt Regency Washington
Wrong transaction from your credit card in Icon
Wrong transaction from your credit card in Indian Creek
Wrong transaction from your credit card in Inn at Perry Cabin
Wrong transaction from your credit card in Inn at the Ballpark
Wrong transaction from your credit card in InterContinental
Wrong transaction from your credit card in Intercontinental Buckhead Atlanta
Wrong transaction from your credit card in InterContinental Chicago
Wrong transaction from your credit card in Intercontinental San Francisco
Wrong transaction from your credit card in InterContinental The Barclay New York
Wrong transaction from your credit card in Jefferson
Wrong transaction from your credit card in Jerome
Wrong transaction from your credit card in Jumeirah Essex House
Wrong transaction from your credit card in JW Marriott Buckhead Atlanta
Wrong transaction from your credit card in JW Marriott Desert Ridge Resort & Spa
Wrong transaction from your credit card in JW Marriott Las Vegas Resort, Spa & Golf
Wrong transaction from your credit card in JW Marriott Miami
Wrong transaction from your credit card in JW Marriott Orlando Grande Lakes
Wrong transaction from your credit card in JW Marriott Pennsylvania Avenue
Wrong transaction from your credit card in JW Marriott San Francisco
Wrong transaction from your credit card in Kahala Resort
Wrong transaction from your credit card in Keswick Hall
Wrong transaction from your credit card in La Costa Resort & Spa
Wrong transaction from your credit card in Lauberge Del Mar
Wrong transaction from your credit card in La Valencia
Wrong transaction from your credit card in Le Meridien San Francisco
Wrong transaction from your credit card in Le Parker Meridien
Wrong transaction from your credit card in Lodge At Koele
Wrong transaction from your credit card in Lodge At Torrey Pines
Wrong transaction from your credit card in Loews Coronado Bay Resort
Wrong transaction from your credit card in Loews Miami Beach
Wrong transaction from your credit card in Loews Regency
Wrong transaction from your credit card in Loews Santa Monica Beach
Wrong transaction from your credit card in London West Hollywood
Wrong transaction from your credit card in Lowell
Wrong transaction from your credit card in Madera
Wrong transaction from your credit card in Madison
Wrong transaction from your credit card in Main Street Station & Casino
Wrong transaction from your credit card in Mandalay Bay
Wrong transaction from your credit card in Mandarin Oriental
Wrong transaction from your credit card in Mandarin Oriental Miami
Wrong transaction from your credit card in Marriott at Metro Center
Wrong transaction from your credit card in Marriott Chicago Downtown Magnificent Mile
Wrong transaction from your credit card in Marriott Houston Airport at George Bush Intercontinental
Wrong transaction from your credit card in Marriott Marquis San Francisco
Wrong transaction from your credit card in Marriott Resort
Wrong transaction from your credit card in Marriott San Francisco Fisherman's Wharf
Wrong transaction from your credit card in Mauna Kea Beach
Wrong transaction from your credit card in Mauna Lani Bay & Bungalows
Wrong transaction from your credit card in McCoy Peak Lodge
Wrong transaction from your credit card in Melrose
Wrong transaction from your credit card in Meridian Luxury Suites
Wrong transaction from your credit card in Michelangelo
Wrong transaction from your credit card in Millennium UN Plaza
Wrong transaction from your credit card in Monaco Boutique
Wrong transaction from your credit card in Monaco Washington DC
Wrong transaction from your credit card in Mona Lisa Suite
Wrong transaction from your credit card in Mondrian
Wrong transaction from your credit card in Mondrian Scottsdale
Wrong transaction from your credit card in Mondrian South Beach
Wrong transaction from your credit card in Morenas Resort Morrison-Clark Historic Inn
Wrong transaction from your credit card in M Resort Spa & Casino
Wrong transaction from your credit card in New York Marriott Marquis
Wrong transaction from your credit card in Nolitan
Wrong transaction from your credit card in Oak Plantation Resort
Wrong transaction from your credit card in Ocean Key Resort & Spa
Wrong transaction from your credit card in Ocean Point Resort & Club
Wrong transaction from your credit card in Omni
Wrong transaction from your credit card in Omni Berkshire Place
Wrong transaction from your credit card in Omni Chicago
Wrong transaction from your credit card in Omni Houston
Wrong transaction from your credit card in One Bal Harbour Resort & Spa
Wrong transaction from your credit card in Owl Creek Homes
Wrong transaction from your credit card in Palms Place & Spa
Wrong transaction from your credit card in Palomar
Wrong transaction from your credit card in Palomar Boutique
Wrong transaction from your credit card in Park Hyatt
Wrong transaction from your credit card in Park Hyatt Chicago
Wrong transaction from your credit card in Park Hyatt Resort & Spa
Wrong transaction from your credit card in Peabody Orlando
Wrong transaction from your credit card in Peninsula New York
Wrong transaction from your credit card in Phoenician
Wrong transaction from your credit card in Pierre A Taj
Wrong transaction from your credit card in Plaza Athenee
Wrong transaction from your credit card in Pocono Palace
Wrong transaction from your credit card in Prescott
Wrong transaction from your credit card in Raffles L'Ermitage Beverly Hills
Wrong transaction from your credit card in Rancho Bernardo Inn
Wrong transaction from your credit card in Rancho Las Palmas Resort & Spa
Wrong transaction from your credit card in Red Rock Casino Resort & Spa
Wrong transaction from your credit card in Renaissance Charleston Historic District
Wrong transaction from your credit card in Renaissance Chicago
Wrong transaction from your credit card in Renaissance Houston Greenway Plaza
Wrong transaction from your credit card in Renaissance New York Times Square
Wrong transaction from your credit card in Renaissance Washington
Wrong transaction from your credit card in Renaissance Waverly
Wrong transaction from your credit card in Residence Inn by Marriott Capitol
Wrong transaction from your credit card in Rio Suite and Casino
Wrong transaction from your credit card in Ritz-Carlton
Wrong transaction from your credit card in Ritz-Carlton Battery Park
Wrong transaction from your credit card in Ritz-Carlton Boston Common
Wrong transaction from your credit card in Ritz-Carlton Central Park
Wrong transaction from your credit card in Ritz-Carlton Golf Resort
Wrong transaction from your credit card in Ritz Carlton Kapalua
Wrong transaction from your credit card in Ritz Carlton Key Biscayne
Wrong transaction from your credit card in Ritz-Carlton Laguna Niguel
Wrong transaction from your credit card in Ritz-Carlton Marina Del Rey
Wrong transaction from your credit card in Ritz Carlton Naples Beach Resort
Wrong transaction from your credit card in Ritz Carlton Naples Golf Resort
Wrong transaction from your credit card in Ritz-Carlton Orlando, Grande Lakes Resort
Wrong transaction from your credit card in Ritz-Carlton Palm Beach
Wrong transaction from your credit card in Ritz-Carlton San Francisco
Wrong transaction from your credit card in Ritz Carlton South Beach
Wrong transaction from your credit card in Rouge
Wrong transaction from your credit card in Royal Hawaiian
Wrong transaction from your credit card in Royal Pacific Resort
Wrong transaction from your credit card in Royal Palms Resort & Spa
Wrong transaction from your credit card in Sanctuary on Camelback Mountain
Wrong transaction from your credit card in Seattle Marriott Waterfront
Wrong transaction from your credit card in Se San Diego
Wrong transaction from your credit card in Shangri-La
Wrong transaction from your credit card in Sheraton Chicago and Towers
Wrong transaction from your credit card in Sheraton Keauhou Bay Resort & Spa
Wrong transaction from your credit card in Sheraton Maui Resort
Wrong transaction from your credit card in Sheraton Moana Surfrider
Wrong transaction from your credit card in Sheraton Suites Houston Near The Galleria
Wrong transaction from your credit card in Sheraton Suites San Diego at Symphony Hall
Wrong transaction from your credit card in Sheraton Waikiki
Wrong transaction from your credit card in Shore Club
Wrong transaction from your credit card in Shutters Beach
Wrong transaction from your credit card in Signature at MGM Grand
Wrong transaction from your credit card in Skylofts at MGM Grand
Wrong transaction from your credit card in SLS at Beverly Hills
Wrong transaction from your credit card in Sofitel Lafayette Square
Wrong transaction from your credit card in Sonesta Orlando Downtown
Wrong transaction from your credit card in Sorrento
Wrong transaction from your credit card in South Beach Marriott
Wrong transaction from your credit card in Star The Michelangelo
Wrong transaction from your credit card in St. Gregory Luxury & Suites
Wrong transaction from your credit card in St. Regis
Wrong transaction from your credit card in St. Regis Princeville Resort
Wrong transaction from your credit card in St. Regis Washington
Wrong transaction from your credit card in Sun Harbour Boutique
Wrong transaction from your credit card in Sutton Place
Wrong transaction from your credit card in Swissotel Chicago
Wrong transaction from your credit card in Taj Boston
Wrong transaction from your credit card in Taj Campton Place
Wrong transaction from your credit card in Tamarack by Destination Resorts Snowmass
Wrong transaction from your credit card in The Alex
Wrong transaction from your credit card in The Alexander
Wrong transaction from your credit card in The Carlyle, A Rosewood
Wrong transaction from your credit card in The Carlyle Suites
Wrong transaction from your credit card in The Chatwal
Wrong transaction from your credit card in The Cosmopolitan Las Vegas
Wrong transaction from your credit card in The Drake
Wrong transaction from your credit card in The Enclave
Wrong transaction from your credit card in The Equinox Resort & Spa
Wrong transaction from your credit card in The Fairmont
Wrong transaction from your credit card in The Fairmont Copley Plaza
Wrong transaction from your credit card in The Fairmont Olympic
Wrong transaction from your credit card in The Fairmont Orchid
Wrong transaction from your credit card in The Fairmont Washington
Wrong transaction from your credit card in The Hay-Adams
Wrong transaction from your credit card in The Helmsley Carlton House
Wrong transaction from your credit card in The Henley Park
Wrong transaction from your credit card in The Houstonian Club & Spa
Wrong transaction from your credit card in The Huntington and Nob Hill Spa
Wrong transaction from your credit card in The Iroquois
Wrong transaction from your credit card in The Langham Huntington & SPA
Wrong transaction from your credit card in The Latham
Wrong transaction from your credit card in The Lenox
Wrong transaction from your credit card in The Little Nell
Wrong transaction from your credit card in The Lucerne
Wrong transaction from your credit card in The New York Helmsley
Wrong transaction from your credit card in The Orchard
Wrong transaction from your credit card in The Palmer House Hilton
Wrong transaction from your credit card in The Peninsula
Wrong transaction from your credit card in The Peninsula Beverly Hills
Wrong transaction from your credit card in The Phoenician
Wrong transaction from your credit card in The Pierre
Wrong transaction from your credit card in The Plaza
Wrong transaction from your credit card in The Quincy
Wrong transaction from your credit card in The Ritz Carlton
Wrong transaction from your credit card in The Ritz-Carlton Bachelor Gulch
Wrong transaction from your credit card in The Ritz-Carlton Buckhead
Wrong transaction from your credit card in The Ritz-Carlton Fort Lauderdale
Wrong transaction from your credit card in The Ritz-Carlton Georgetown
Wrong transaction from your credit card in The Ritz-Carlton Laguna Niguel
Wrong transaction from your credit card in The Ritz-Carlton Orlando, Grande Lakes
Wrong transaction from your credit card in The Setai
Wrong transaction from your credit card in The Setai Fifth Avenue
Wrong transaction from your credit card in The St. Regis Aspen
Wrong transaction from your credit card in The St. Regis Monarch Beach
Wrong transaction from your credit card in The Venetian Resort and Casino
Wrong transaction from your credit card in The Villa By Barton G
Wrong transaction from your credit card in The Washington Court On Capital Hil
Wrong transaction from your credit card in The Westin Atlanta Airport
Wrong transaction from your credit card in The Westin Chicago River North
Wrong transaction from your credit card in The Westin Embassy Row
Wrong transaction from your credit card in The Westin Grand
Wrong transaction from your credit card in The Westin Michigan Avenue
Wrong transaction from your credit card in The Westin Mission Hills Resort & Spa
Wrong transaction from your credit card in The Westin New York at Times Square
Wrong transaction from your credit card in The Westin Oaks
Wrong transaction from your credit card in The Westin Peachtree Plaza
Wrong transaction from your credit card in The Westin Seattle
Wrong transaction from your credit card in The Whitehall
Wrong transaction from your credit card in The Wit-A Doubletree
Wrong transaction from your credit card in Tides South Beach
Wrong transaction from your credit card in Topaz
Wrong transaction from your credit card in Trump International Sonesta Beach resort
Wrong transaction from your credit card in Trump International & Tower
Wrong transaction from your credit card in Trump International Waikiki Beach Walk
Wrong transaction from your credit card in Trump Las Vegas
Wrong transaction from your credit card in Trump Soho
Wrong transaction from your credit card in Universal Portofino Bay a Loews
Wrong transaction from your credit card in Universal Royal Pacific Resort a Loews
Wrong transaction from your credit card in Vdara & Spa
Wrong transaction from your credit card in Viceroy Palm Springs
Wrong transaction from your credit card in Villas Of Grand Cypress
Wrong transaction from your credit card in Wailea Marriott an Outrigger Resort
Wrong transaction from your credit card in Waldorf Astoria Orlando
Wrong transaction from your credit card in Waldorf Astoria & Towers
Wrong transaction from your credit card in Waldorf Towers
Wrong transaction from your credit card in Walt Disney World Swan and Dolphin
Wrong transaction from your credit card in Wardman Park Marriott
Wrong transaction from your credit card in Washington Court on Capitol Hill
Wrong transaction from your credit card in Washington Suites Georgetown
Wrong transaction from your credit card in W Atlanta Midtown
Wrong transaction from your credit card in W Boston
Wrong transaction from your credit card in Westin Diplomat Resort & Spa
Wrong transaction from your credit card in Westin Maui Resort & Spa
Wrong transaction from your credit card in Westin Princeville Ocean Resort Villas
Wrong transaction from your credit card in Westin St. Francis
Wrong transaction from your credit card in W Hollywood
Wrong transaction from your credit card in Willard InterContinental
Wrong transaction from your credit card in Windsor Court
Wrong transaction from your credit card in W Los Angeles Westwood
Wrong transaction from your credit card in Woodrun Place Condo
Wrong transaction from your credit card in Woodrun V Townhomes
Wrong transaction from your credit card in W Seattle
Wrong transaction from your credit card in Wyndham Grand Desert
Wrong transaction from your credit card in Wynn Las Vegas
Wrong transaction from your credit card in XV Beacon
Wrong transaction from your credit card in ZaZa Houston
Wrong transaction from your credit card in Z Ocean
(689 rows)

CyberCrime & Doing Time

Wednesday, August 17, 2011

New York City "Uniform Traffic Ticket" tops spammed malware

Wednesday, August 10, 2011

Inter-company Invoice spam leads to Malware

Friday, August 05, 2011

Fake IRS emails continue to spread Gov-related Zeus

Wednesday, August 03, 2011

Love Map Spam spreads Fake AV

Sunday, July 31, 2011

"Wrong Transaction" Hotel spam malware continues to evolve

Update 01AUG2011

Thursday, July 28, 2011

"Government-related" Zeus spam continues

Following the Botnet Back in Time

Wednesday, July 27, 2011

"Wrong Transaction" Hotel Spam

The rest of the hotel spam subject list

GarWarner

Blog Archive

Pageviews last month

Pageviews all time

Wednesday, August 17, 2011

Wednesday, August 10, 2011

Friday, August 05, 2011

Wednesday, August 03, 2011

Sunday, July 31, 2011

Update 01AUG2011

Thursday, July 28, 2011

Following the Botnet Back in Time

Wednesday, July 27, 2011

The rest of the hotel spam subject list

GarWarner

Subscribe To

Blog Archive

Pageviews last month

Pageviews all time