PHISHING MAIL FROM: safeukemailer.com & planosdesaudeagora.com IP: 174.140.167.243 - DICTIONARY ATTACKER & SPAMSERVER Heuristic.BehavesLike.JS.BufferOverflow.J

PHISHING MAIL FROM:

http://safeukemailer.com/

• https://www.virustotal.com/de/url/7e6568720e2f0e44bfcb9d974823fc0d6bed744157a9e9b655c4f0ac5be96841/analysis/1397215692/

• http://wepawet.iseclab.org/view.php?hash=99533e29222be52ac0aecd2104ced6ec&t=1397215185&type=js

REDIRECTS TO:

http://planosdesaudeagora.com/admin/index.php

• https://www.virustotal.com/de/url/85b7433bf813cd4884a22a8f5f66a8481935be109e6e12066fad3f3ade37fe2f/analysis/1397215746/

HTML

• https://www.virustotal.com/de/file/6ea7c43f2a8f0bc4b6d11931e3eaeb5fe8f085a5db9accf605424390a9e00e21/analysis/1394810790/

ALSO

http://planosdesaudeagora.com/admin/includes/js/javascript.js

• https://www.virustotal.com/de/url/f8369cd305da7c812550ca69ecf82f857f4a2506bbd119b5217c57699ce19eac/analysis/1397216635/

Heuristic.BehavesLike.JS.BufferOverflow.J

• https://www.virustotal.com/de/file/d8c5447067ec6b33acaa3701a50d1d75b985d4e933490b0d0ef81bfd4c7c606d/analysis/1378020397/

DOMAIN LISTED AT SURBL & JOEWEIN

• http://www.urlvoid.com/scan/planosdesaudeagora.com/

• https://www.mywot.com/en/scorecard/planosdesaudeagora.com

IP:

http://174.140.167.243/

• https://www.virustotal.com/de/url/206033db51f7886c907adb9afc607982fbfab8d362ea78ec6e323a5d45cf167d/analysis/1397215940/

• https://www.virustotal.com/de/ip-address/174.140.167.243/information/

DICTIONARY ATTACKER & SPAMSERVER:

• https://www.projecthoneypot.org/ip_174.140.167.243

• http://www.senderbase.org/lookup/?search_string=174.140.167.243