POTENTIALLY DAMAGING IP: 198.50.178.90 COMMENT SPAMMER & MORE Montréal, CANADA

POTENTIALLY DAMAGING IP:

http://198.50.178.90/

• https://www.virustotal.com/de/url/49af94681d256ad8f31faa479b1a97d576e162c723c0f894e11a7fac21042a4d/analysis/1401210067/

XML

• https://www.virustotal.com/de/file/0a43cb9ab42a7a08ac796fc0f90cb28bdf063a8f1a84096754950f46db83cdbe/analysis/1401210229/

COMMENT SPAMMER:

• https://www.projecthoneypot.org/ip_198.50.178.90

LISTED AT TORNEVALL:

• http://dnsbl.tornevall.org/

Heartbleed OpenSSL Result: Vulnerable

• http://zulu.zscaler.com/submission/show/974aa036407238e24522b1aa10d27646-1401210072

BESIDES THAT: OUTDATED APACHE SERVER SOFTWARE: VULNERABLE

• http://httpd.apache.org/security/vulnerabilities_24.html

-------->

DOMAIN:

http://exe.moneyrobot.com/

• https://www.virustotal.com/de/url/13158ea50cdf2e66bce90bd6845f2a496012338f90047900bf21e11cf29de56e/analysis/1401210907/

PUA MoneyRobot.exe (The digital signature of the object did not verify)

• https://www.virustotal.com/de/file/c974e9923097b2bec307212a12b0165c263f03b3156bd7f735d5c628edb57611/analysis/

• https://www.virustotal.com/de/file/4a5e038bc0bbd3e1e0ba7d4489eda42df6a6b4237aff1c489b4d6d2c760c5367/analysis/

• https://www.virustotal.com/de/file/75976b46e7a286d49e9ac74a1f6090c95226495c655ac83d601b2f79a6cfe52e/analysis/

http://exe.moneyrobot.com/Data/bcdc096817213b207777e843e90e7767

• https://www.virustotal.com/de/url/8e8a714041ac640b848c6157bfff80edc9b8f5366d34982efe15104ca2f63aba/analysis/1401210501/

BESIDES THAT: OUTDATED APACHE SERVER SOFTWARE: VULNERABLE

• http://httpd.apache.org/security/vulnerabilities_24.html

IP:

http://67.205.81.45/

• https://www.virustotal.com/de/url/ec13ba31f3a882856e43d75c7a15dc972e227201d8947815b532c5aa54c0ab5f/analysis/1401211771/

• https://www.virustotal.com/de/file/752c03b6b7c5b46c8b2e2a0715b9847a3d9be43b1b1d5ba1484ef88d729d0464/analysis/1401211825/

• https://www.virustotal.com/de/ip-address/67.205.81.45/information/

• http://zulu.zscaler.com/submission/show/e729c788a7cca9552811c1ea8b13c430-1401212249

BESIDES THAT: OUTDATED APACHE SERVER SOFTWARE: VULNERABLE

• http://httpd.apache.org/security/vulnerabilities_24.html

SPAM SERVER, BAD WEB HOST (18):

• https://www.projecthoneypot.org/ip_67.205.81.45

Potentially Malicious Host IP: 216.40.47.17 Combined attack from Part of Botnet Toronto, Canada

Potentially Malicious IP:

• See Comments Below: https://www.projecthoneypot.org/ip_216.40.47.17

ATTEMPTED ADMIN EXPLOIT HACK

(Attempt to access non existing admin area using known exploit)
Combined attack from Part of Botnet:

216.40.47.17 - Canada - Tucows International - Domain: theblackberrydiaries.com
216.154.213.199 - United States - Strategic Systems Consulting - Hostname: babygo.zeebu.com - Domain: zeebu.com - Resolve Host: brennix.com ,northernartglass.com, ryersontennisclub.com, megamenus.com, kathybuckworth.com, centos5.brennix.com, epixus.com,

COMMON USER-AGENT:
"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"

SMALL SAMPLE:
theblackberrydiaries.com - - [16/Jan/2012:10:16:44 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 435 "-"
theblackberrydiaries.com - - [16/Jan/2012:10:16:44 +0000] "GET /ixxx/admin/xxx HTTP/1.1" 403 437 "-"
northernartglass.com - - [16/Jan/2012:10:16:44 +0000] "GET /admin/xxx HTTP/1.1" 403 411 "-"
ryersontennisclub.com - - [16/Jan/2012:10:16:44 +0000] "GET /admin/xxx HTTP/1.1" 403 413 "-"
megamenus.com - - [16/Jan/2012:10:16:45 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 429 "-"
kathybuckworth.com - - [16/Jan/2012:10:16:45 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 427 "-"
centos5.brennix.com - - [16/Jan/2012:10:17:03 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 437 "-"
brennix.com - - [16/Jan/2012:10:17:04 +0000] "GET /admin/xxx HTTP/1.1" 403 411 "-"
epixus.com - - [16/Jan/2012:10:17:04 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 439 "-"
demo.northernartglass.com - - [16/Jan/2012:10:17:04 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 435 "-"
demo.brennix.com - - [16/Jan/2012:10:17:05 +0000] "GET /admin/xxx HTTP/1.1" 403 413 "-"
old.northernartglass.com - - [16/Jan/2012:10:17:06 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 437 "-"
new.northernartglass.com - - [16/Jan/2012:10:25:20 +0000] "GET /xxx/admin/xxx HTTP/1.1" 403 439 "-"
m.brennix.com - - [16/Jan/2012:10:25:21 +0000] "GET /admin/xxx HTTP/1.1" 403 413 "-"

-----------------------------------------------------------------------------------------------------

The domain lvchildcareconnection.com is spamming really heavy pleas flag this IP as a dangerous IP.

-----------------------------------------------------------------------------------------------------

http://216.40.47.17/ 

• https://www.virustotal.com/de/url/bc9a5dc68621a1bbff0dcd909b5519b839459e17816845554c105c06aa0e7e8f/analysis/1400862995/

• https://www.virustotal.com/de/ip-address/216.40.47.17/information/

• http://www.senderbase.org/lookup/?search_string=216.40.47.17

Snowshoe Spam & PHISHING from hintcontrol.com "Recevez vos 2222Eur de B0nus" ("Receive a 2222 Euro Bonus) Hamilton, CANADA IP: 68.66.63.47 (Listed at SPAMHAUS)

Recevez vos 2222€ de

bienvenue maintenant!

En plus de cela, nous offrons des bonus gratuits speciaux.

 Voici comment recevoir vos 2222€:

• Ouvrez un compte

• Allez sur le chat en direct en cliquant ici et ecrivez le code suivant: 2222

• Selectionnez un jeu auquel vous aimeriez jouer depuis les options disponibles

• Vous avez 48 heures pour prendre le bonus

Contactez-nous pour reclamer vos 2222€.

L'equipe chaleureuse du support est disponible 24/7.

Soyez rapide - Cette offre est valable pour une periode limitee!

Cordialement,
John F.

MAIL SCREENSHOT

 --------------------------------------------------------------------------------------------------------------------------------------------

PHISHING, SPAM & SCAM DOMAIN:

http://hintcontrol.com/

• https://www.virustotal.com/de/url/d08035f592b89fcc08f095f6223461b8398777c25df0021def4233588d6d0577/analysis/1400676550/

OTHER LINKS IN THE MAIL:

http://hintcontrol.com/link.php

• https://www.virustotal.com/de/url/a4e0ade9db3e028e094bf4969ce3b7cb80783d9d3f6ecf1478f780aae2dc235c/analysis/1400676704/

• https://www.virustotal.com/de/file/22fc373d3b3ab36009613adfd7bb60f7135a4f510aa31808856e721dd5799d0c/analysis/1391621840/

http://hintcontrol.com/open.php

• https://www.virustotal.com/de/url/7da87cb951f0d660fc77ec4729444510a0306b278147b9baeef07553f0b39f58/analysis/1400676746/

• https://www.virustotal.com/de/file/dd5bdccb831d1b19c505bd3e67553f6049cea2e20dba7eb231a02ed0103e521f/analysis/1400396318/

http://hintcontrol.com/unsubscribe.php

• https://www.virustotal.com/de/url/4b68e4d1860ce9b98bbf19294b988dede6aa7c34ef59a64241698795940def92/analysis/1400676787/

• https://www.virustotal.com/de/file/fb18ec2dc45858efd8a69d17873eb1a92801a4af8e6b6a44b03e9e7a69d11ffd/analysis/1391621799/

BLACKLISTS:

• http://www.spamhaus.org/query/domain/hintcontrol.com
• https://www.mywot.com/en/scorecard/hintcontrol.com
• http://www.surbl.org/lists
• http://zulu.zscaler.com/submission/show/4e639b2311aa3e474bcb1eba327a1e3a-1400676384

DOMAIN-IP (ANALYSIS MOMENT):

http://68.66.63.47/

• https://www.virustotal.com/de/url/fc053947e300bbe62a101a18295c553058b0ff9912a9c414cb539a19f512d509/analysis/1400677067/
• https://www.virustotal.com/de/ip-address/68.66.63.47/information/

SNOWSHOE SPAM BLACKLISTED AT:

• http://www.spamhaus.org/query/bl?ip=68.66.63.47
• http://www.spamhaus.org/sbl/query/SBL218662
• http://www.spamhaus.org/sbl/listings/networxhosting.com
• http://networxhosting.com/
• https://www.virustotal.com/de/url/7d49824dde2a6c1f3bf7794240fb4638a87c1c1e420a2a65720a791662f96543/analysis/1400677424/
• http://www.senderbase.org/lookup/?search_string=68.66.63.47
• http://zulu.zscaler.com/submission/show/ec6dd530622db7ec31301159b81b7e9c-1400676906

MAIL ORIGINATING IP(s):

http://14.4.22.14/ (SOUTH KOREA)

• https://www.virustotal.com/de/url/b4587224cb226aefacab1ed4e70d2e0695db607469fdb4c0f5c2084182957e5b/analysis/1400677788/

LISTED AT SPAMHAUS (SBL & DROP)

• http://www.spamhaus.org/query/ip/14.4.22.14
• http://www.spamhaus.org/sbl/query/SBL187947
• http://www.senderbase.org/lookup/?search_string=14.4.22.14

http://68.66.63.122/

• https://www.virustotal.com/de/url/379fe4b9d56b57279031e9cf4f00f5452269914c30abdc837c567845c0dd49cb/analysis/1400678183/

LISTED AT SPAMHAUS (SBL):

• http://www.spamhaus.org/query/bl?ip=68.66.63.122
• http://www.spamhaus.org/sbl/query/SBL218662
• http://www.senderbase.org/lookup/?search_string=68.66.63.122

IP RANGE INCLUDES THE FOLLOWING BLACKLISTED DOMAINS (IPs):

68.66.63.2    sightsetup.com    listed
68.66.63.3    setuplevel.com    listed
68.66.63.4    setupidea.com    listed
68.66.63.5    setupgrade.com    listed
68.66.63.6    directsetup.com    listed
68.66.63.7    setuphint.com    listed
68.66.63.8    ranklevel.com    listed
68.66.63.9    hintrank.com    listed
68.66.63.10    sightbusiness.com listed
68.66.63.11    officelevel.com    listed
68.66.63.12    sortideas.com    listed
68.66.63.13    steadysort.com    listed
68.66.63.14    guidehint.com    listed
68.66.63.15    sightlead.com    listed
68.66.63.16    steadylead.com    listed
68.66.63.17    leadsetup.com    listed
68.66.63.18    setuplead.com    listed
68.66.63.19    managesight.com    listed
68.66.63.20    managestatus.com listed
68.66.63.21    managesetup.com    listed
68.66.63.22    hintcontrol.com    listed
68.66.63.23    controlimage.com listed
68.66.63.24    pointsteady.com    listed
68.66.63.25    setupoint.com    listed
68.66.63.26    channelidea.com    listed
68.66.63.27    sightsetup.com    listed
68.66.63.28    setuplevel.com    listed
68.66.63.29    setupidea.com    listed
68.66.63.30    setupgrade.com    listed
68.66.63.31    directsetup.com    listed
68.66.63.32    setuphint.com    listed
68.66.63.33    ranklevel.com    listed
68.66.63.34    hintrank.com    listed
68.66.63.35    sightbusiness.com listed
68.66.63.36    officelevel.com    listed
68.66.63.37    sortideas.com    listed
68.66.63.38    steadysort.com    listed
68.66.63.39    guidehint.com    listed
68.66.63.40    sightlead.com    listed
68.66.63.41    steadylead.com    listed
68.66.63.42    leadsetup.com    listed
68.66.63.43    setuplead.com    listed
68.66.63.44    managesight.com    listed
68.66.63.45    managestatus.com listed
68.66.63.46    managesetup.com    listed
68.66.63.47    hintcontrol.com    listed
68.66.63.48    controlimage.com listed
68.66.63.49    pointsteady.com    listed
68.66.63.50    setupoint.com    listed
68.66.63.51    channelidea.com    listed
68.66.63.52    sightsetup.com    listed
68.66.63.53    setuplevel.com    listed
68.66.63.54    setupidea.com    listed
68.66.63.55    setupgrade.com    listed
68.66.63.56    directsetup.com    listed
68.66.63.57    setuphint.com    listed
68.66.63.58    ranklevel.com    listed
68.66.63.59    hintrank.com    listed
68.66.63.60    sightbusiness.com listed
68.66.63.61    officelevel.com    listed
68.66.63.62    sortideas.com    listed
68.66.63.63    steadysort.com    listed
68.66.63.64    guidehint.com    listed
68.66.63.65    sightlead.com    listed
68.66.63.66    steadylead.com    listed
68.66.63.67    leadsetup.com    listed
68.66.63.68    setuplead.com    listed
68.66.63.69    managesight.com    listed
68.66.63.70    managestatus.com listed
68.66.63.71    managesetup.com    listed
68.66.63.72    hintcontrol.com    listed
68.66.63.73    controlimage.com listed
68.66.63.74    pointsteady.com    listed
68.66.63.75    setupoint.com    listed
68.66.63.76    channelidea.com    listed
68.66.63.77    sightsetup.com    listed
68.66.63.78    setuplevel.com    listed
68.66.63.79    setupidea.com    listed
68.66.63.80    setupgrade.com    listed
68.66.63.81    directsetup.com    listed
68.66.63.82    setuphint.com    listed
68.66.63.83    ranklevel.com    listed
68.66.63.84    hintrank.com    listed
68.66.63.85    sightbusiness.com listed
68.66.63.86    officelevel.com    listed
68.66.63.87    sortideas.com    listed
68.66.63.88    steadysort.com    listed
68.66.63.89    guidehint.com    listed
68.66.63.90    sightlead.com    listed
68.66.63.91    steadylead.com    listed
68.66.63.92    leadsetup.com    listed
68.66.63.93    setuplead.com    listed
68.66.63.94    managesight.com    listed
68.66.63.95    managestatus.com listed
68.66.63.96    managesetup.com    listed
68.66.63.97    hintcontrol.com    listed
68.66.63.98    controlimage.com listed
68.66.63.99    pointsteady.com    listed
68.66.63.100    setupoint.com    listed
68.66.63.101    channelidea.com    listed
68.66.63.102    sightsetup.com    listed
68.66.63.103    setuplevel.com    listed
68.66.63.104    setupidea.com    listed
68.66.63.105    setupgrade.com    listed
68.66.63.106    directsetup.com    listed
68.66.63.107    setuphint.com    listed
68.66.63.108    ranklevel.com    listed
68.66.63.109    hintrank.com    listed
68.66.63.110    sightbusiness.com listed
68.66.63.111    officelevel.com    listed
68.66.63.112    sortideas.com    listed
68.66.63.113    steadysort.com    listed
68.66.63.114    guidehint.com    listed
68.66.63.115    sightlead.com    listed
68.66.63.116    steadylead.com    listed
68.66.63.117    leadsetup.com    listed
68.66.63.118    setuplead.com    listed
68.66.63.119    managesight.com    listed
68.66.63.120    managestatus.com listed
68.66.63.121    managesetup.com    listed
68.66.63.122    hintcontrol.com    listed
68.66.63.123    controlimage.com listed
68.66.63.124    pointsteady.com    listed
68.66.63.125    setupoint.com    listed
68.66.63.126    channelidea.com    listed

New Mexico ONLINE CHILD PREDATORS 2010: Adam Goodsell, 29, of Albuquerque sentenced to 10 Years Federal Prison

A U.S. child porn distributor collared by the efforts of Winnipeg police and a local civilian tipster has been handed a 10-year prison term.

Adam Pedophile

Adam Goodsell, 29, was sentenced to the lengthy term in a New Mexico federal court, according to the Associated Press. Goodsell was charged in the U.S. after a Winnipeg woman complained about being sent sick images depicting child abuse or exploitation after striking up an online relationship with Goodsell. She reported the incident to Cybertip.ca in August 2010.

That tip was passed off to the Winnipeg Police Service's Internet Child Exploitation unit and she assisted detectives in the investigation. A Winnipeg undercover Agent managed to access Goodsell's computer through a file-sharing program and found more than 80.000 child-porn files available for distribution to others.

Investigators with the Albuquerque Police Department obtained a warrant to search the man's house. They seized and searched computer equipment, finding a number of illegal images.

"Goodsell admitted that while the search warrant was being executed he participated in a recorded interview during which he admitted having more than 1,000 child pornography files 'from babies on up' on his computers," the U.S. Department of Justice said in a statement announcing his plea to a distribution charge last October.

FRENCH CASINO PHISHING: "Jeux sur Internet - Prenez Votre B0nus" positionstatus.com (IP: 68.66.55.34) Spamhaus Listed (Hamilton, CANADA)

Rien n’est comparable aux B0NUS offerts
par Euroking et en vous joignant a
ses membres vous en recevrez une
multitude.

Ces Primes vous permettront de vous
eclater dans un environnement
fantastique et sur des tables superbes
ainsi que d’en gagner les cagnottes qui
sont, de l’avis de tous, parmi les plus
genereuses du web.

Ne laissez pas passer cette
opportunite de gagner une fortune et
venez vite vous mettre au jeu.

Accédez au site en cliquant là >>>

A tout de suite...

SPAM & PHISHING DOMAIN:

http://positionstatus.com/

• https://www.virustotal.com/de/url/ebc6a370b83be39f4d86787a6d757c76985d3be66809969090d2649e5c49bd32/analysis/1398322886/

LISTED AT SPAMHAUS:

• http://www.spamhaus.org/query/domain/positionstatus.com

LISTED AT SURBL:

• http://www.surbl.org/lists

• https://www.mywot.com/en/scorecard/positionstatus.com

--------------------------

http://positionstatus.com/link.php

• https://www.virustotal.com/de/url/f7fe5bafd2152c3bc8ec03a8c332ba4217f6a95796ad0f7607967928f0e9c8fc/analysis/1398322918/

http://positionstatus.com/unsubscribe.php

• https://www.virustotal.com/de/url/9d19b31ca3fbcad91c6becab677c0ba46f6c94c8d70addba06875d96c4d3302d/analysis/1398322961/

ORIGINATING IP:

http://68.66.55.34/

• https://www.virustotal.com/de/url/e5e675654f7df2e537064f8f11def3aa257d8ffc9fc59f67eb193890731531a2/analysis/1398322996/

LISTED AT SPAMHAUS (SBL):

• http://www.spamhaus.org/query/bl?ip=68.66.55.34

EMAIL-REP: POOR
WEB-REP: POOR

• http://www.senderbase.org/lookup/?search_string=68.66.55.34

Category MALICIOUS IP: 5.135.188.193 (kimsufi.com) COMMENT SPAMMER from (Roubaix, FRANCE)

CATEGORY MALICIOUS IP: 
COMMENT SPAMMER
LISTED AT TORNEVALL

FOUND ON EXPLOIT KIT STATISTIC ROUNDUP:
Host - Pages - Hits - Bandwidth - Last visit date - [Start date of last visit] - [Last page of last visit] 5.135.188.193 - 16 - 16 - 5839847 20140115134221


HOST:

http://5.135.188.193/  (Roubaix, FRANCE)

• https://www.virustotal.com/de/url/ad6cf5b5cc0ac88abe48f641f12ebb0bad4d7bf1d40e15af5f0383471eede4de/analysis/1396905319/

HOSTNAME: (Registered February 15th 2001)

http://ks3294570.kimsufi.com/

• https://www.virustotal.com/de/url/9e0bfb2602bc25eb416989ffd0cb78bb0e35108f06b6dd5fe4acc5604718cf3e/analysis/1396907424/

WEPAWET: NON-EXISTING DOMAIN

• http://wepawet.iseclab.org/view.php?hash=fb0cdf5e77cfec395b4db8bf802df86d&t=1396905343&type=js

DOMAIN: (IP: CANADA)

http://kimsufi.com/

• https://www.virustotal.com/de/url/b2957ee6fe072c26c66415b45c22062fa9319dcd11a935ccc6808ddf8d88c4f1/analysis/

IP: 213.186.33.80  (FRANCE)

• https://www.virustotal.com/de/url/bf71c3ee663f088661ee99420e310491c614b03b26557c771d040669e9cfe8e8/analysis/

• https://www.virustotal.com/de/ip-address/213.186.33.80/information/

• http://toolbar.netcraft.com/site_report?url=213.186.33.80

REDIRECTS TO:

http://www.kimsufi.com/

• https://www.virustotal.com/de/url/70a198d280f8e42e13903be64df4dbebf292ed8f3ff5d58360ee0af9f1ea9ae3/analysis/1396908942/

IP (CHANGE): 198.27.92.3  (Montréal, CANADA)

• https://www.virustotal.com/de/url/9e2487ef003597430ea9b8bf016675f1fb4501d516ab468212099b57ad707c87/analysis/1396909634/

REDIRECTS TO:

http://www.kimsufi.com/fr/index.xml

• https://www.virustotal.com/de/url/69f5933404d7b76ef3e0d002add1516e622d015ddacf4cfeda5803f73673424d/analysis/1396909006/

REDIRECTS TO:

http://www.kimsufi.com/fr/

• https://www.virustotal.com/de/url/30f30cae7dc114a98734d84bf5eb806a0932e6767c17e05b5f767ef4a5e3cbb3/analysis/1396909110/

• https://www.virustotal.com/de/file/11114b722dd11cc71086f1d47fcb36ca7b2b5fce27413ecb8d3da00a70fc336d/analysis/1396909603/

• https://www.virustotal.com/de/url/9e2487ef003597430ea9b8bf016675f1fb4501d516ab468212099b57ad707c87/analysis/1396909634/

--------------------------------------------------------------------------------------------------------------------------------------------

LISTED AT TORNEVALL:

• http://dnsbl.tornevall.org/  (http://www.ipvoid.com/scan/5.135.188.193)

User-Agents: 30
Web post submissions: 52

• https://www.projecthoneypot.org/ip_5.135.188.193

Netcraft Risk Rating: 9/10

• http://toolbar.netcraft.com/site_report?url=5.135.188.193

ALSO:

• http://www.stopforumspam.com/ipcheck/5.135.188.193

SCAM OF THE DAY from: "WIR BIETEN DARLEHEN" ("We Offer Credits") With Greetings from Coquitlam (CANADA), Australia &...& ratgeberplatz.com

IHR SEID IN ALLE FINANZNÖTE ODER BENÖTIGEN SIE MITTEL ZU STARTEN IHR EIGENES GESCHÄFT? BRAUCHEN SIE DARLEHEN FÜR IHRE SCHULD ZU BEGLEICHEN ODER ZAHLEN SIE IHRE RECHNUNGEN?

Wir geben Kredite im Bereich von 7000 US-Dollar (sieben Tausend Dollar) bis zu 50.000.000 US-Dollar (50 Millionen Dollar) mit 3 % Zinssatz.

Füllen Sie das nachstehende Formular (ist kein Formular, nur Text im Mail) für die Anwendung von Darlehen durch:

Persönliche e-Mail-Adresse:

Name: Adresse:

Land:

Telefonnummer:

Menge, die benötigt werden:

Darlehen-Dauer:

Monatliches Einkommen:

Alter:

Geschlecht:

Sie sind Beratung senden Ihre Daten an diese e-Mail-Adresse ein: scoth_smitt@ymail.com

Alles Gute

Herr Rev Scoth Smitt (Blöder gehts wohl nicht!)

Screenshot of HOCHwürden.....

MALICIOUS: HIDDEN IfRAMES ALL OVER THE PLACE & INVOLVED IN PHISHING SCAM

http://sd43.bc.ca/

• https://www.virustotal.com/de/url/8290fd493074a03e4b9c2e28e27d880175519bba5ec36b12f16aae864214fe44/analysis/1396302819/

http://sd43.bc.ca/Pages/default.aspx

• https://www.virustotal.com/de/url/3430aa5e2fcb1a7be76346576a55c9179acb649e9ab39d83843e692dbf2eca0e/analysis/1396302945/

HTML: 

W32.HfsIframe.420f (WHATEVER IT MEANS REFERS TO A HIDDEN IFRAME)

• https://www.virustotal.com/de/file/701247cb9f12329ce5558b3ceff20ab16a4f4880606b86cfe7fe474480f7299b/analysis/1396302682/

ORIGINATING IP(s) (ratgeberplatz.com again involved): Coquitlam (CANADA)

http://142.35.6.131/

• https://www.virustotal.com/de/url/0878044af1696c27903ac4978f8113c96b1222f5461fbc8f2e9db3191934f1f1/analysis/1396304403/

http://14.2.27.4/   (Adelaide, Australia)

• https://www.virustotal.com/de/url/3bdc4ddd451c4313001e49b924ff7ff7022ee6cec34bf8ec7b614487b5de2bf8/analysis/1396304621/

MALICIOUS VISITOR (to this BLOG): HEUR:Trojan.Win32.Generic @ searchandhra.in IP: 198.27.74.17 CANADA vous souhaite un Bon Appétit de Montréal

MALWARE (SITE): Generic Trojan
DOMAIN:

http://searchandhra.in/

• https://www.virustotal.com/de/url/8c8c23a275a908973f8665feed72d975ecd3d23bfcfe94c87703ac981d8d99a7/analysis/1395440619/

MALICIOUS LINK:

http://searchandhra.in/images/logo.gif?108c5=610029

• https://www.virustotal.com/de/url/a84ec9afdbfdde65c939110db31fd2c53161f307fa1710e4b0fa13a32f437f76/analysis/1395440607/

HEUR:Trojan.Win32.Generic

• https://www.virustotal.com/de/file/2a04b7d2904945d47c1cdedf914fc07672b57fe7bfd373d5b4948c3e38bdf4fc/analysis/1395417946/

IP:

http://198.27.74.17/

• https://www.virustotal.com/de/url/9c74a26e9e31f6c581b4c829389eb26fc93d824979e514e2feef4a4859b8d0be/analysis/1395442580/

• https://www.virustotal.com/de/ip-address/198.27.74.17/information/

SPYWARE DOMAIN: terra.mastertop100.net TROJAN REDIRECTOR (Pagesinxt Malicious Redirect) USA-RUSSIA-CANADA-Virgin-IslandsNORWAY-NETHERLANDS-FRANCE-ITALY

MALICIOUS DOMAIN:
SPYWARE - TROJAN REDIRECTOR 

USA-RUSSIA-CANADA-Virgin-Islands-NORWAY-NETHERLANDS-FRANCE-ITALY

http://terra.mastertop100.net/

• https://www.virustotal.com/de/url/b99bc9716fa430c1e0417a758ddf03d3eaf1ca33f8619da37756c61e8469e559/analysis/1395328043/

Pagesinxt Malicious Redirect

• https://urlquery.net/report.php?id=1395328112708

FOR FULL REPORT .txt ICON:

HEUR:Trojan.Script.Generic sitting on www.arcoserv.com.br from BRAZIL and emedemargara.com from CANADA

MALICIOUS SITES: HEUR:Trojan.Script.Generic

http://www.arcoserv.com.br/

• https://www.virustotal.com/de/url/969971f91ee04be15dadc65ef5be7840ada025564a9814675abe4893693c5c6b/analysis/1392809735/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/cc90607dd56550c117c0222b8e6750a3b259c11fa8b712ab7f83245013a71ba7/analysis/1392810262/

FULL REPORT:

Full Report

www.visonic.com & www.visonictech.com & www.dhtml-menu-builder.com & elpas.com MALICIOUS DOMAINS INFECTED (Directly or Indirectly) BV:StartPage-FY [Trojan]

visionic.com

MALICIOUS DOMAIN: HIDDEN LINK & BV:StartPage-FY [Trojan]

www.visonic.com

• https://www.virustotal.com/de/url/f78e05cce3d42b2e2af2d9b77e333ddf02f255b3bcdf3633a2b4301fe7cfaf73/analysis/1391264633/

HTML

• https://www.virustotal.com/de/file/e351123b15e39ce42e458fe0ce173a3dae67e6d2e332583eee0b4542a8a0ebc4/analysis/1391264778/

• http://www.UnmaskParasites.com/security-report/?page=www.visonic.com

www.visonictech.com ---> redirects to elpas.com

HIDDEN LINK TO:

www.visonictech.com

• https://www.virustotal.com/de/url/bb123e45066579186a9eee70d00a7314d58bb6dd707e8a810b26c94676152ae4/analysis/1391265169/

SPAM LINK (VIAGRA):

• http://www.UnmaskParasites.com/security-report/?page=www.visonictech.com

dhtml-menu-builder.com

TO:

www.dhtml-menu-builder.com

• https://www.virustotal.com/de/url/8067736540845fba3def863c89bc850f5ffb0a9d718793973034a7d79021121e/analysis/1391265583/

SPECIFIC MALICIOUS LINK:

www.dhtml-menu-builder.com/include/js/ie6-png.js

• https://www.virustotal.com/de/url/8e1fbb8ba1b128744dbb94db5a9494af8e357ef88b047044cb261bae892d4128/analysis/1391266171/

INFECTED WITH: BV:StartPage-FY [Trj]

• https://www.virustotal.com/de/file/66da12165f89ac7a2a330ed8d75288f3c3aeb98b3ce019c890ee1b06a3a48c6f/analysis/1391265996/

• https://www.virustotal.com/de/file/c3504e6c4b8bf4c1f8bbb265bbdba23270ce5a593f124e38fe65214e4a4b88e2/analysis/1391266028/

REFERENCE & FILE(s):

• http://jsunpack.jeek.org/?report=eb47e3a23a0f713fe37fb08bdc85ba42651ff26c

buysoftviagra.com

VIAGRA LINK:

buysoftviagra.com

• https://www.virustotal.com/de/url/a71b8be18ba11c82b6dc425316a7b2c5d2e8766d2c198db755be4494e18d934d/analysis/1391265844/

AS WELL INVOLVED:

elpas.com

• https://www.virustotal.com/de/url/eef5935a084f5ae84fa9ed3cc936df3531d37802cdef07a8fdc5b7f55e9d0dc4/analysis/1391266776/

• SEE: http://jsunpack.jeek.org/?report=a8c2e01dc1da2d7ecd26be013ef04799379b3970

SEE ALSO:

• http://sitecheck.sucuri.net/results/www.dhtml-menu-builder.com

• http://sitecheck.sucuri.net/results/buysoftviagra.com

• http://quttera.com/detailed_report/www.visonictech.com

www.eldiamantis.com "Rogue Affiliate Reveals $100m Loophole" (PHISHING, SCAM & SPAM)

You need to see this...

It's the most important website you'll visit
this year.

Here's why...

On that site you'll discover about a new
automated system that exploits a $100m
loophole.

Now this system was put to the test and
here's the results...

From scratch it produced $4,264 in the first
7 days.

And on to generate $27,353 in it's first
month.

Now next is where this gets very interesting.

The momentum of this system grows and grows
and last month it earned a massive $221,555!

Yes... Almost a quarter of a million dollars
in a single month just a few months after
starting.

Just click below to watch a free video all
about this amazing new system...

http://imoffers.systemx.clicksurecpa.com


With $221,555 a month in profits I think
you understand why this website will be
the most important you visit all year... If
not the most important of your entire life.

You now have a VERY REAL chance to start
making some serious money online.

With this underground loophole you DON'T
need to worry about:

- Having an exiting website or blog

- Having lots of capital for investing
in advertising... Just a few dollars
needed

- Having any technical knowledge... It's
all explained in a simple step-by-step
process anyone can follow

And it doesn't even matter if you've
earned a single cent online before.

You can start from scratch today knowing
nothing and follow along to be making
money tomorrow.

In the test... $4,264 was generated in
the first 7 days.

Just visit the site now to get started
and watch the free video...

http://imoffers.systemx.clicksurecpa.com


Now the creators and guys who have been
testing this system are super confident
anyone can make this work.

THIS MEANS YOU!

So if YOU download the system and follow
it they're going to GUARANTEE your success

No joke!

If you don't make at least $1,000 in the
first 7 days then their going to hand
you a $500 for giving it a shot.

YOU CAN'T LOSE

Think about it, you can try it out and
the very worst case is you'll pocket
a $100 in a week.

BUT... Just think if you do just half
as good as what the test showed...

... You'd be pocketing over $2,000
this very week.

And around $14,000 in 30 days time.

... And with the growth momentum this
system has you'll be cashing in over
a million dollars in less than a year.

AND THATS IF YOU ONLY DO HALF AS GOOD
AS THE TEST RESULTS PROVED THIS SYSTEM
IS CAPABLE OF!

You really need to check this out and
download a copy while you can.

Click below to do it now:

http://imoffers.systemx.clicksurecpa.com


Regards

El Diamantis

POTENTIALLY MALICIOUS DOMAIN:

www.eldiamantis.com

• https://www.virustotal.com/de/url/d34a9a3946b4b6ea780f93fba6b72ccebf6d9206ca93219e082417d1ac695c4f/analysis/1390660102/
• http://urlquery.net/report.php?id=8988794
• https://www.mywot.com/en/scorecard/eldiamantis.com
• http://www.urlvoid.com/scan/eldiamantis.com/

Link shown in the Mail (3x):

imoffers.systemx.clicksurecpa.com

• https://www.virustotal.com/de/url/ab3a5964037476981e23759423d85b4a118ab7c8ebac53daddf62cf429a47472/analysis/1390661644/

IP of imoffers.systemx.clicksurecpa.com: 78.137.119.93

• https://www.virustotal.com/de/url/86d48e7997dc929a776bdfe5f0ab721d7b74bee3ebae2535efe9b167cff9f3a7/analysis/1390662412/
• https://www.mywot.com/en/scorecard/78.137.119.93

imoffers.systemx.clicksurecpa.com REDIRECTS TO:

www.autocommissionsystemx.com

  The website was registered 28 days ago, surf with caution.

• https://www.virustotal.com/de/url/a58a8b08388b1e554ccb4683ba479b660f479fc98c8e83078a55ae3f8af06ef2/analysis/1390661783/
• http://www.urlvoid.com/scan/autocommissionsystemx.com/

IP of imoffers.systemx.clicksurecpa.com: 198.143.162.154

• https://www.virustotal.com/de/url/e1c25855b8d97c544b059910e386735a892b8d5dc1203786df3dd373479e451e/analysis/1390663057/

IP is Listed at SPAMCOP:

• http://www.spamcop.net/w3m?action=checkblock&ip=198.143.162.154

SCAM-Mail SCREENSHOT