SPAM: Jennifer Woodard (woodardjennifer27@yahoo.com) DOMAIN: darwinistneleridusunmez.com IP: 180.180.146.4 Bankok, THAILAND

DOMAIN:

http://darwinistneleridusunmez.com/

• https://www.virustotal.com/de/url/51ee5532251a6a564ea561ab27211e864beec50df216a0827b1bb1052c369a5a/analysis/1399629448/

http://darwinistneleridusunmez.com/lsy/view.php

• https://www.virustotal.com/de/url/9d8251b452e80791bae691d8eebe0681a092719cf553c5e80c6b1784793c0928/analysis/1399629579/

DOMAIN IP:

http://54.247.100.110/

• https://www.virustotal.com/de/url/e1792fc59ff57735b91d13358c35cf0028ecf8516e36fbe23060b1eb8db96e10/analysis/1399631113/

• https://www.virustotal.com/de/ip-address/54.247.100.110/information/

IP LISTED AT SPAMHAUS (CBL)

• http://www.spamhaus.org/query/bl?ip=54.247.100.110

• http://cbl.abuseat.org/lookup.cgi?ip=54.247.100.110

• http://www.senderbase.org/lookup/?search_string=54.247.100.110

MAIL IPs:
1)

http://180.180.146.4/ (THAILAND)

• https://www.virustotal.com/de/url/dff9af04709b5bc1aec3f2705bafe872a9a57b8a23d9b29f75c117c0a5aba04a/analysis/1399629695/

SPAMMAILSERVER & DICTIONARY ATTACKER:

• https://www.projecthoneypot.org/ip_180.180.146.4

LISTED AT SPAMHAUS (PBL):

• http://www.spamhaus.org/query/bl?ip=180.180.146.4

E-MAIL-REP: POOR

• http://www.senderbase.org/lookup/?search_string=180.180.146.4

2)

http://66.147.244.82/ (UNITED STATES)

• https://www.virustotal.com/de/url/d60b98e987232df8a76c2aadaa8982b3d03a2b4a1a2cc91d829c296f513b13f1/analysis/1399630027/

• https://www.virustotal.com/de/ip-address/66.147.244.82/information/

BHA: 19

• https://www.projecthoneypot.org/ip_66.147.244.82

3)

http://14.4.4.6/ (SOUTH KOREA)

• https://www.virustotal.com/de/url/ea36277fb5e01f8d0713c1937c952433fa0d3e3d11956f161dd989b3a6a07219/analysis/1399630197/

LISTED AT SPAMHAUS (SBL & DROP)

• http://www.spamhaus.org/query/bl?ip=14.4.4.6
• http://www.spamhaus.org/sbl/query/SBL187947
• http://www.senderbase.org/lookup/?search_string=14.4.4.6

4)

http://69.89.23.228/

• https://www.virustotal.com/de/url/f15acfaf6680089b7af8ce6db92c64f2420b0f92e1bcb14af18e2420b2d5de79/analysis/1399631488/

"Blacksher Hall, Learn the secrets of top businesses in your industry" SPAM AGAIN from: ci33.actonsoftware.com IP: 207.189.124.33 Englewood, COLORADO, UNITED STATES (merchantcentric.com IP: 184.168.221.18)

Learn the secrets of top businesses in your industry as well as local competitors
Hi Blacksher Hall,

We have identified Atlanta Botanical Garden as the business in your industry with a high total marketing score of 1253. Create your free account to learn more about what they are doing and what makes up Blacksher Hall's score of 39, as of February 26, 2014.

We scan these top sites and more ...

Atlanta Botanical Garden may not be a direct competitor, however, seeing what they are doing to market themselves online can give you ideas for how to attract more customers. Merchant Centric will help you increase Blacksher Hall's marketing score from its current score of 39 by giving you unique insights into the competition.

Try it for free. No credit card required. Cancel at anytime.

    See what makes up Blacksher Hall's marketing score
    See what Atlanta Botanical Garden is doing to attract customers
    Pick other local competitors to see how you compare and learn what they are doing

Sign up for a free trial. No risk. No commitment.

Want to learn more? View Merchant Centric features.

Don't miss important alerts for Blacksher Hall

For more information, please visit merchantcentric.com

"Real" Links marked on MAIL-Screenshot

SPAM DOMAIN FROM GERMANY:

http://merchantcentric.com/

• https://www.virustotal.com/de/url/2655175568ddab160a5f3a07cb4f6bb08eb47b5970460bd619de5d3dc1ad195e/analysis/1397212380/

THROUGH:

http://b2b-mail.net/

• https://www.virustotal.com/de/url/a0bf735206b0ae297b5fc69b8bbc14d42c1449cf671e3f04db456c138c372871/analysis/1397212963/

• https://www.mywot.com/en/scorecard/b2b-mail.net

"Real" LINKS (DOMAIN):

 http://ci33.actonsoftware.com/

• https://www.virustotal.com/de/url/d79508e04f1cebce60a2a5688ffe2e7bd9b2947a88bd165aab3f8d95eb7a203f/analysis/1397395024/

Redirects to: --->

http://www.actonsoftware.com/

https://www.virustotal.com/de/url/c5a38ba5fa2fa2610f32289824f259f551f7cfe17deace24f5b0bed532861069/analysis/1397397880/

Redirects to: --->

http://www.act-on.com/

• https://www.virustotal.com/de/url/3825d42cb168ac6c02c2658039f6c9fe8c85dd38d9a73f75104fa0011a318655/analysis/1397398511/

HTML

• https://www.virustotal.com/de/file/3d0425fd14e9054f8aad1949bcfef92f734ff1260370a865434af77ee2253f6d/analysis/1397394944/

Goes to:

http://code.jquery.com/jquery-latest.min.js

• https://www.virustotal.com/de/url/726054b5aa9f603f7350b016e0d0e9656d0b36d24bc19cedf14efce395e4eeb9/analysis/1397397801/

AS WELL, HIDDEN IFRAME FOUND:

http://www.act-on.com/contact

• https://www.virustotal.com/de/url/030e98abfbd9c463bdc1146846b6007db4fe30962d7c0fb6bb494fb828e53a18/analysis/1397399608/

W32.HfsIframe

• https://www.virustotal.com/de/file/74f5fc3c7f530b15e849fad2696317a3c6bacb3aa3872918a04efe8f8cd8c768/analysis/1397399505/

Iframe:

http://flex.atdmt.com/mstag/tag/4a37b15a-3ef1-4a8b-a371-479fb864947c/conversion.html?cp=5050&dedup=1

• https://www.virustotal.com/de/url/e3ea0036dd7351f6ae4bc2a4c58b3faa857651b8067f01386ea7cf8c68bb4ca0/analysis/1397399819/

--->

http://r.msn.com/?cp=5050&dedup=1

• https://www.virustotal.com/de/url/c07e4f9ce3ba7d0590a15ec7b77abc9648d8488da09350ccdb9c5a1b6ef0ac38/analysis/

<--- iframe src="//flex.atdmt.com/mstag/tag/4a37b15a-3ef1-4a8b-a371-479fb864947c/conversion.html?cp=5050&dedup=1" frameborder="0" scrolling="no" width="1" height="1" style="visibility:hidden;display:none" --->
----------------------------------------------------------------------------------------------------------------------------------------------
IP:

http://207.189.124.33/

• https://www.virustotal.com/de/url/6a7a91121e48253bb0b7919c01301015ae52960e711c7ee43b3df740e5d5059a/analysis/1397401056/

• https://www.virustotal.com/de/ip-address/207.189.124.33/information/

---> REDIRECTS TO (NON EXISTING DOMAIN - NX)

http://www.124.33?ao=1

• https://www.virustotal.com/de/url/a6aeb1ae8617a7888e4c75593c9568c5ad47aba2219b6c726b0ae0edadc49229/analysis/1397401221/

• http://wepawet.iseclab.org/view.php?hash=3c2a82642a3515ac82103829f31fbd2a&t=1397401105&type=js

See also:
http://wepawet.iseclab.org/view.php?hash=eb0c9b909fa7a3ceca628aa14d38975b&t=1397395059&type=js

RELATED POST:

• http://stayaway2.blogspot.com/2014/04/ip-8416822118-merchantcentriccom-german.html

IP: 184.168.221.18 merchantcentric.com German SPAM & PHISHING Domain "Blacksher Hall: See what your competitors are doing right now" (Through b2b-mail.net)

SPAM DOMAIN FROM GERMANY:

http://merchantcentric.com/

• https://www.virustotal.com/de/url/2655175568ddab160a5f3a07cb4f6bb08eb47b5970460bd619de5d3dc1ad195e/analysis/1397212380/

THROUGH:

http://b2b-mail.net/

• https://www.virustotal.com/de/url/a0bf735206b0ae297b5fc69b8bbc14d42c1449cf671e3f04db456c138c372871/analysis/1397212963/

• https://www.mywot.com/en/scorecard/b2b-mail.net

Related Post:
http://stayaway2.blogspot.com/2014/04/blacksher-hall-learn-secrets-of-top.html

"La Crise m'a frappe de plein fouet" FRENCH SPAM of the Moment (March 2nd 2014): globalmrkt.net (IPs: 14.3.2.2 & 66.111.202.245) JAPAN & USA SPAM, SCAM, PHISHING

La Crise m'a frappe de plein fouet, et pourtant cela
m'a rendu Riche tres rapidement.

En 2011, une catastrophe arrive au garage pour lequel
je travaillais. Le patron est tomber malade et nous
n'avons trouve personne pour reprendre cette petite
affaire sans grand interet...

Du coup nous les 5 employes, nous nous sommes retrouves
au chomage sans grand avenir devant nous surtout dans
notre région.

Cela a ete un coup terrible ...

Je n'avais nulle part ou aller, aucune idee de quoi
faire, avec un simple diplome de mecanicien obtenu
en travaillant dans ce meme garage...

Et pourtant, un amis tres aise a decide de me
prendre par la main et de m'expliquer comment
faire fortune avec un PC et une connexion internet.

Rendez-vous est pris chez lui, je n'en reviens pas
du luxe qui l'entoure, voiture, piscine, hifi,
le reve pour toute personne...

On s'installe devant son PC et il me fait voir
comment en quelques minutes il gagne 100€, c'est
tout simplement incroyable je n'en revenais pas.

Presser de rentrer a la maison pour me mettre
au travail j'en oublie presque de le remercier.

Bref fini les blablas...en quelques semaines j'ai
gagne plus d'argent quand 5 annee de travail au
garage c'est stupefiant et dur a croire.

Du coup comme je sais que beaucoup galere avec
cette crise mondiale, j'ai cree une page web
pour vous expliquer en details comment vous
aussi commencer a mettre en place ce systeme.

Pour vous y rendre cliquez simplement ici >>

Je suis content de pouvoir vous aider alors
n'hesitez pas a venir me parler sur MSN
si vous avez besoin de moi...

E-MAIL SCAM SCREENSHOT

MALICIOUS DOMAIN: SPAM, SCAM, PHISHING

http://globalmrkt.net/

• https://www.virustotal.com/de/url/fc9354101dde316cc480db2faaa4a9cb4d67c1c83b442b437b271d798c3af9c3/analysis/1396623727/

http://globalmrkt.net/link.php

• https://www.virustotal.com/de/url/f6ba43bb07d8bd0b29bd10e4c38a2ab65f5954d51bf4f297088d918ba2a76872/analysis/1396623762/

http://globalmrkt.net/open.php

• https://www.virustotal.com/de/url/a0d3800e98aa335b3bd3e39ed0b0bc32fc3f46febeced00ebef054ceab3a4645/analysis/1396623856/

ORIGINATING IPs:

http://14.3.2.2/ (Asahi, JAPAN)

• https://www.virustotal.com/de/url/452305e81bc2b995dadee0ad7a30c2a4071b6c5ad9d20d0aa7f3b049fa130c9f/analysis/1396623426/

• http://www.senderbase.org/lookup/?search_string=14.3.2.2

MALICIOUS IP:

http://66.111.202.245/ (Santa Monica, USA)

• https://www.virustotal.com/de/url/b4b642acac605882a2012b00bd46454690e5bcd475930800b2a21e95d517960e/analysis/1396624250/

LISTED AT SPAMHAUS (SBL):

• http://www.spamhaus.org/query/bl?ip=66.111.202.245

• http://www.spamhaus.org/sbl/listings/ARIN

Fwd/Rev DNS Match: NO
EMAIL-REP: POOR
WEB-REP: POOR

• http://www.senderbase.org/lookup/?search_string=66.111.202.245

SEE AS WELL:

• https://www.mywot.com/en/scorecard/globalmrkt.net

LISTED AT SURBL:

• http://www.surbl.org/surbl-analysis

Introducing COMMENT SPAMMERS (so the NET will not FORGET) Helping those sorrow ones out in Publicity, otherwise no one would notice them....

www.home-staging-montreal.com

IP: 66.43.56.89

(Montréal)

Anonymous wrote on February 8th, 2014:

Pretty great post. I just stumbled upon your blog and wished to mention that I have truly loved surfing around your weblog posts. After all I will be subscribing in your feed and I am hoping you write once more very soon! 
My weblog: www.home-staging-montreal.com...

COMMENT SCREENSHOT

On this Post:

• ILLINOIS Online Child Predators 2011: “funson999” aka Michael Wayne Bailey sentenced to 97 Months in Prison

Screenshot of the Webpage:

One important Question remains: Would you buy something at a place where the Spammer is trying to Advertise through an Article thats subject to Cild Predators & Pedophiles harming Children ??? I BET NOT !!!

----------------------------------------------------------------------------------------------------------------------------------------------

Real Comment Number 3 on COMMENT SPAM (with Malicious Link) ! ANONYMOUS WROTE:"Whɑt's up, after reading this awesome paragraph..." KEY COMMENT: "Stop by my website..." scp.uma.pt/images/....... Portugal, Poland, Germany

This Post is (and will be & stay) to demonstrate what SPAM IN BLOGS (Comment SPAM) IS about and how you should difference it ! From this part it is surveilled, and followed. IP-Data and Domains who are involved are being recorded, to monitor the frequency and analyzing the connections given to it. In case suspicious Connections (related to Phishing, Spambots (what they already are), and other fraudulent activities and/or behaviour) will (not only) be recorded and transfered to the appropriate agencies (i.e. IC3) what however is done anyway. Special observations from outside can be adressed to me through IC3. 

Reminder: However, every SPAM-Post is delivered to the appropriate Adress. Keep following.
-------------------------------------------------------------------------------------------------------------------------------------------

NUMBER 3:

Whɑt's up, after reading this awesome paragraph i am as well happy to share my experience here with mates. Stop by my website http://scp.uma.pt/images/1.php/what-is-biaxin-used-to-treat-ogqd.php

SPAM COMMENT MADE ON FOLLOWING POST:

http://stayaway2.blogspot.com/2014/01/category-malicious-domain_13.html

SCREENSHOT OF ANONYMUS COMMENT SPAMMER

MW URL: PHISHING - ROGUE MEDS - TDS SUTRA

http://scp.uma.pt/images/1.php/what-is-biaxin-used-to-treat-ogqd.php

• https://www.virustotal.com/de/url/b4ddfb4f5d1d6de3d7ac09bc3f9b86cf1e1152c431989be9ba128ebadcc902ed/analysis/1396334546/

TDS Sutra - redirect received

TDS Sutra - request in.cgi

• https://urlquery.net/report.php?id=1396334666046

--->

http://getmarketschoice.com/in.cgi?12&parameter=what+is+biaxin+used+to+treat

• https://www.virustotal.com/de/url/15b9552bdaaef5306203130d8ec521adc2ec02836e244a6c288660a77af1de9f/analysis/1396334968/

TDS Sutra - redirect received

• https://urlquery.net/report.php?id=1396335061174

---->

http://okpillsbest.com/catalog/Antibiotics/Biaxin.htm

• https://www.virustotal.com/de/url/817a3dad94af46f7e84cf077bf34f54888b21bf8df5e2b7aa8c58a00dc3437e4/analysis/

• https://urlquery.net/report.php?id=1396335569086

IPs:

http://193.136.232.84/

• https://www.virustotal.com/de/url/6e4f5bd49883788be5d2d08199a76341d1b5a44a5e1054a20bbb2999170950aa/analysis/1396335823/

http://91.230.205.65/

• https://www.virustotal.com/de/url/cd4912b45256be4f214fd289ed20c225c7d68e236e44c78895ffe3fb862f847d/analysis/1396335909/

• https://www.virustotal.com/de/ip-address/91.230.205.65/information/

http://176.9.192.16/

• https://www.virustotal.com/de/url/4c8e99a657d39784c9bd79d726db6b96677fbb9e575d28bc2eb704caa08c7257/analysis/1396336061/

• https://www.virustotal.com/de/ip-address/176.9.192.16/information/

• http://95.169.190.160/

• https://www.virustotal.com/de/url/00dfaf1d27128c8f8f00b91a82a1f3a259e51042b504b784c7fa970efaaa2424/analysis/1396336268/

• https://www.virustotal.com/de/ip-address/95.169.190.160/information/

Spider Sightings: 14

• https://www.projecthoneypot.org/ip_95.169.190.160

Real Comment Number 2 on COMMENT SPAM ! ANONYMOUS WROTE:"It's really a great and useful piece of information." KEY COMMENT: "Here is my blog post: pirater un compte Facebook"My Site: www.facebook-recherche.com

This Post is (and will be & stay) to demonstrate what SPAM IN BLOGS (Comment SPAM) IS about and how you should difference it ! From this part it is surveilled, and followed. IP-Data and Domains who are involved are being recorded, to monitor the frequency and analyzing the connections given to it. In case suspicious Connections (related to Phishing, Spambots (what they already are), and other fraudulent activities and/or behaviour) will (not only) be recorded and transfered to the appropriate agencies (i.e. IC3) what however is done anyway. Special observations from outside can be adressed to me through IC3. 

Reminder: However, every SPAM-Post is delivered to the appropriate Adress. Keep following.
-------------------------------------------------------------------------------------------------------------------------------------------

NUMBER 2:

It's really a great and useful piece of information. I'm glad that you simply shared this helpful information with us. Please keep us up to date like this. Thank you for sharing. Here is my blog post pirater un compte Facebook www.facebook-recherche.com

SPAM COMMENT MADE ON FOLLOWING POST:

http://stayaway2.blogspot.com/2014/01/international-online-child-predators.html

SCREENSHOT OF ANONYMUS COMMENT SPAMMER

PHISHING & MALICIOUS DOMAIN: FACEBOOK ACCOUNT HIJACK (HACK) & PHISHING FOR FB CREDENTIALS AS WELL A BLOG COMMENT SPAMMER (LISTED AT SPAMHAUS)

http://www.facebook-recherche.com/

• https://www.virustotal.com/de/url/86eba7512f57e84d6864a943230e74e9767a568755dd2240690ddba9572a1910/analysis/1396193684/

HTML

• https://www.virustotal.com/de/file/4d92a05b9a4c097d28c09784947fd4af204e1238b13df695bc477f5f74666e67/analysis/

LISTED AT SPAMHAUS (DBL):

• http://www.spamhaus.org/query/domain/facebook-recherche.com

-------------------------
IP: NETHERLANDS

http://37.46.125.166/

• https://www.virustotal.com/de/url/a9a0fd6a7a201e4675d3179bd408efbf0f602f492c649f450d92fb56c1d140cf/analysis/1396195483/

• https://www.virustotal.com/de/ip-address/37.46.125.166/information/

PHISHING SPAM from: www.ereatvipgame.la In Connection with ratgeberplatz.com AUSTRALIA: 14.2.24.1 IRAN: 217.219.253.210 "Beste deutsche Casinos in 2014" (sercoinfo.com: FRANCE)

Wir haben eine Liste der besten online casinos für Sie zusammengestellt und möchten Ihnen die Möglichkeit geben, ein exklusives Bonusangebot wahrzunehmen, wenn Sie sich in einem dieser Casinos anmelden.
Unzählige Angebote mit Freispielen und Einzahl-Bonussen stehen zur Auswahl.
Melden Sie sich über einen der Links auf unseren Webseiten in einem casino Ihrer Wahl an und sichern Sie sich einen exklusiven Bonus.
Besuchen Sie unsere Webseite hier. http://www.ereatvipgame.la/
Mit freundlichen Grüßen
Carl Barmasser
******************************

***********
Bitte klicken Sie hier, wenn Sie von uns keine E-Mails mehr erhalten wollen:
http://unsubscribe.ereatvipgame.la/

PHISHING MAIL SCREENSHOT

DOMAIN:

http://www.ereatvipgame.la/

• https://www.virustotal.com/de/url/7b3bf62ec24c544a9e4b7b53b67d056583bf372543626015ec36fcdcfc4c02ac/analysis/1396002960/

UNSUBSCRIBE LINK:

http://unsubscribe.ereatvipgame.la/

• https://www.virustotal.com/de/url/bb6c5411fdff163d11176dde943c5d8ea743983fe2ffbab867e6ee046dc6a5a5/analysis/1396003189/

ORIGINATING IPs:

14.2.24.1

• https://www.virustotal.com/de/url/6671096f3f434b58d889520e044498210faf3944dae80d8a5a084fd47ee0e3a6/analysis/1396003406/

• http://www.senderbase.org/senderbase_queries/detailip?search_string=14.02.24.01

217.219.253.210

• https://www.virustotal.com/de/url/af19ac8d166ab0e796dbcb19ce8e9aaded5ddbf78bca8ef42c42a19b0caff8cb/analysis/1396003561/

 SPAMHAUS PBL LISTED:

• http://www.spamhaus.org/query/bl?ip=217.219.253.210

• http://www.senderbase.org/lookup/?search_string=217.219.253.210

THROUGH MAILSERVER:

sercoinfo.com

• https://www.virustotal.com/de/url/0e5a930aab7957867dc351f4678e6d0b854a0a9292d5fdbcb43c14eb0fe33e29/analysis/1396004036/

The reason why ratgeberplatz.com is involved in this one (PHISHING) can be found (seen) at the following Blogpost: They both use the same SPAMSEVER-IP:

http://stayaway2.blogspot.com/2014/03/just-another-spam-from_29.html 

Category MALICIOUS IP: 187.155.38.145 (Tizimín, MEXICO) SPAMHAUS LISTED (PBL)

Tizimín, MEXICO
OS on IP:  Mac OS X 1083

IP:

187.155.38.145

• https://www.virustotal.com/de/url/a54d751bc93b7e8e1aeb672da88b1b1deaaa81f44344d240b5c24ce6ec85fe12/analysis/1396001404/

SPAMHAUS LISTED (PBL):

• http://www.spamhaus.org/query/bl?ip=187.155.38.145

 

DAILY PHISH, SPAM & SCAM: news.online-surftipps.com & gratisinfoservice.de (IP 2.1.8.110) "Revolutionäre Geschäftsidee: Steigen Sie ein, und verlieren Sie dabei ihr ganzes Vermögen" FRANCE & GERMANY

Sehr geehrte Damen und Herren,

Jetzt gibt es ein neues revolutionäres Geschäftsmodell, mit dem Sie in einen der größten Märkte weltweit einsteigen können.

Welcher das ist, erfahren Sie hier.

http://gratisinfoservice.de/ilead.php?prodid=_&agent=_

SCAM-Screenshot

http://gratisinfoservice.de/

• https://www.virustotal.com/de/url/e1b612f6268292103b7df2845a421146f141143c714ef342b3a66f20b20eea8b/analysis/1394563241/

http://gratisinfoservice.de/ilead.php

• https://www.virustotal.com/de/url/5a7fbc141a4903d49a1ef4f967d29681d710596b9497007d9319d6f4f6f29ddf/analysis/

Originating IP

2.1.8.110

• https://www.virustotal.com/de/url/f511e3823cedc584bdcd55ec4b788197390a851dcf630c4398caba3cbc929d36/analysis/1394563757/

LISTED AT SPAMHAUS (PBL):

• http://www.spamhaus.org/query/bl?ip=2.1.8.110

Email Reputation: Poor

• http://www.senderbase.org/lookup/?search_string=2.1.8.110

------------------------------------------------------------------------------------------------------------------------

http://news.online-surftipps.com/

• https://www.virustotal.com/de/url/9b289c2e28e2790291f4b6fad96c31623ea5894c4867379652d4adbda52f3b38/analysis/1394563975/

SPAM, SCAM, PHISH DOMAIN: news.online-surftipps.com & allesunverbindlich.com & tradebutler.de (Nebenjob zu vergeben) FRANCE & GERMANY (IP: 2.1.8.110)

Sehr geehrte Damen und Herren,

ein internationaler Konzern sucht für die Expansion in Deutschland engagierte Online-Bürokräfte.
Sehr gute Einkommensmöglichkeiten (bis 25 € pro Stunde) erwarten Sie in einer Teil- oder Vollzeittätigkeit, die Sie von Zuhause ausführen.

Hier geht es zum Bewerbungsformular.


Mit freundlichen Grüßen
Ihr JobKarriere Team

Ihre Petra Vogt

SCREENSHOT SPAM-MAIL

DOMAIN(s) INVOLVED:

 http://www.allesunverbindlich.com/

• https://www.virustotal.com/de/url/a50a28210fc094a6861f49520a028ebc17ab10217b16e82773672250830131c9/analysis/1393670585/

http://news.online-surftipps.com/

• https://www.virustotal.com/de/url/9b289c2e28e2790291f4b6fad96c31623ea5894c4867379652d4adbda52f3b38/analysis/1393671148/

http://www.tradebutler.de/

• https://www.virustotal.com/de/url/add54dd3214308f79440b4172d96992a26540b194a048ef92fa2b71d70fc3ac5/analysis/1393671238/

ORIGINATING IP:

2.1.8.110

• https://www.virustotal.com/de/url/f511e3823cedc584bdcd55ec4b788197390a851dcf630c4398caba3cbc929d36/analysis/1393671338/

LISTED AT SPAMHAUS (PBL):

• http://www.spamhaus.org/query/bl?ip=2.1.8.110

Email Reputation: Poor

• http://www.senderbase.org/lookup/?search_string=2.1.8.110

Category MALICIOUS IP: 217.74.66.183 (komsta.biz) Infected with a spam or malware forwarding link - Botnet (POLAND) Also: mecsohesti.strefa.pl & berlokava.strefa.pl

The IP address 217.74.66.183 (listed in the CBL (Composite Blocking List)) corresponds to a web site that is infected with a spam or malware forwarding link. The website's host name is "komsta.biz", and this link is an example of the redirect: "http://komsta.biz/xmlrpc/r1.php". In other words the website "komsta.biz" has been hacked. Usually, the redirect takes the user's browser to a spam or malware site. It's usually fake russian pills or pornography.

Most probably, the infection is a Cpanel, Plesk, Joomla or Wordpress CMS install, that has become infected either through a vulnerability (meaning the CMS software is out of date and needs patching), or the owner of "komsta.biz" has had their account information (userids/passwords) compromised. Then malicious software/files are being uploaded by ftp or ssl.

In many cases, particularly with older compromises, the criminals that hacked this site will have uploaded a wide variety of spamming and other compromise tools. Therefore, the account corresponding to "komsta.biz" needs to be examined very carefully for signs of tampering. Further, the criminals will even modify existing web pages (particularly http://komsta.biz itself) to have hidden references to pill/drug/porn sites.

It is believed that the malicious redirects are done by altering web server access control mechanisms (example, ".htaccess" files on Apache web servers), and causing the redirect to occur on all "404 url not found" errors.


REFERENCES:

217.74.66.183

• https://www.virustotal.com/de/url/0a6cbec1348cf0d336786144d8ac8b3392a06044ea45210c1ff7164b935138d3/analysis/1391867416/

LISTED AT SPAMHAUS (CBL):

• http://www.spamhaus.org/query/bl?ip=217.74.66.183

LISTED AT CBL:

• http://cbl.abuseat.org/lookup.cgi?ip=217.74.66.183 

----------------------------------------------------------

komsta.biz

• https://www.virustotal.com/de/url/d075ee0a046bf5b9061d6516f74a2a8a896f6d645b500b82b8e5621cdd347af3/analysis/1391868630/

komsta.biz/xmlrpc/r1.php

• https://www.virustotal.com/de/url/13fe2e198d34cfb1180de459f3cdc711cd35315653a442f5ea4cfae49d771803/analysis/ 

---------------------------------------------------------

Other Malicious Domains connected to this IP:

mecsohesti.strefa.pl

• https://www.virustotal.com/de/url/7b8461c8134626cc15ae094d9ae3c6fa82c82a417cc6936693dbaac78829481e/analysis/1391866196/

mecsohesti.strefa.pl/908juare3rm.js

• https://www.virustotal.com/de/url/e953124d50e1310dd2812e263931848b00d462470c676a634e4cb399cfa6b92a/analysis/1391866188/

• https://www.virustotal.com/de/file/b16b4bdb5699e781801c38303ff0843681d622683b1edfaefe7d9255da7cdc36/analysis/1391865764/

• http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=mecsohesti.strefa.pl

---------------------------------------------------------

berlokava.strefa.pl

• https://www.virustotal.com/de/url/3ade4568cc4b8450928f22fdc2ef3961f253073f5854b1cecc26274ddce8afc6/analysis/1391865399/

INFECTED WITH: HTML:Script-inf

• https://www.virustotal.com/de/file/1b9c71d4ede9b1b74f6a228fd391b1532e2dbe90c78ef3bbb77effbebac9693c/analysis/1391865730/

• http://wepawet.iseclab.org/view.php?hash=f54d99392772ab74cc133e0920e5a658&t=1391865424&type=js

• http://zulu.zscaler.com/submission/show/4f05692eb30713ac8402cef9ce93cb06-1391865434

SPAM: "Pures Verwöhnprogramm" emv-info.hotelreservierung.de (FRANCE)

MALICIOUS DOMAIN: SPAM & PHISHING SCAM (FRANCE)

ORIGINATING IP ADRESS:

2.1.14.110

• https://www.virustotal.com/de/url/5daa82f054d1922a3ee933df19c8e85c6798db2f94bd03335d629588349fe817/analysis/1391807477/

LISTED AT SPAMHAUS:

• http://www.spamhaus.org/query/bl?ip=2.1.14.110

Email Reputation: Poor

• http://www.senderbase.org/lookup/?search_string=2.1.14.110

emv-info.hotelreservierung.de

• https://www.virustotal.com/de/url/68cf71f26c2b4e5ef62d3fc27600ed4dc7c1086101b89194092ae84a3fd93340/analysis/1391806480/

• http://www.UnmaskParasites.com/security-report/?page=www.hotelreservierung.de

CONNECTED SPAM DOMAINS:

ads.unister-gmbh.de

• https://www.virustotal.com/de/url/f046bd900cae54568f25063533aeddb8f685ce58b24066f37357fba10e1a2e23/analysis/1391806371/

• https://www.mywot.com/en/scorecard/ads.unister-gmbh.de

crm.hotelreservierung.de

• https://www.virustotal.com/de/url/e82ecd62ab91a3b4792554b117d55deaabc5820d89bdfc8aef7dcf3a4a87aeb7/analysis/1391806614/

www.ab-in-den-urlaub.de

• https://www.virustotal.com/de/url/a368e6a05fd18af9554b616f32e8fab1797d8baab9f67c2585b6f9d72f3ff254/analysis/1391806780/

SPAM: www.globalcitybusiness.com (LISTED AT DBL SPAMHAUS) & www.streamlife.de (GERMANY)

Dieser Newsletter ist kein SPAM. Sie erhalten ihn, weil Sie bei
ihrer Anmeldung bei uns bzw. auf unserer Partnerseite dem
Newsletterempfang zugestimmt haben.

Die Angebote sind Anzeigen der jeweiligen Werbekunden, die für den Inhalt verantwortlich sind. Bei Fragen zum Inhalt, wenden Sie sich bitte an den Anbieter und nicht an die Adress Butler Ltd. da diese ausschliesslich der technische Versender dieser Nachricht ist!

Bitte antworten Sie nicht direkt auf diese E-Mail, da diese nicht zugestellt werden kann.

Technischer Versender der E-Mail ist die AdressButler Ltd,
Karl-Heinz-Beckurts-Str. 13, 52428 Jülich
Selbstverständlich können Sie der Nutzung Ihrer Daten jederzeit wiedersprechen. Sie wünschen keine weiteren Informationen,
klicken Sie bitte hier um sich abzumelden.

http://www.globalcitybusiness.com/unsubscribe.php

POTENTIALLY MALICIOUS SPAM DOMAIN(s): 
SCAM, PHISHING ETC. (LISTED AT SPAMHAUS)

www.globalcitybusiness.com

• https://www.virustotal.com/de/url/111618ab5b6305880338fff2038a6dbdd5007efe2b7ae7886a91a25fb04cc1d9/analysis/1390927191/

www.globalcitybusiness.com/link.php

• https://www.virustotal.com/de/url/352dbbd057b010a71041a76563b676358c7b98297fba1fda87b24f0386bb7b24/analysis/1390927504/

• https://www.virustotal.com/de/file/23d32b79f3e71e41c2eb3d8811f58f72a2b6b5eb04c0981f16f61ab009945054/analysis/1386786113/

www.globalcitybusiness.com/open.php

• https://www.virustotal.com/de/url/7a7a15b5d7f022340d21f099685c49ea8ff4f291b190d7ecb5cdd6417c8fa46d/analysis/1390927570/

• https://www.virustotal.com/de/file/dd5bdccb831d1b19c505bd3e67553f6049cea2e20dba7eb231a02ed0103e521f/analysis/1390580473/

www.globalcitybusiness.com/unsubscribe.php

• https://www.virustotal.com/de/url/a52381179dbe95f686a83ef039f938f62d3ddd1ac90c0898d1ed898f4cbf3745/analysis/1390927632/

• https://www.virustotal.com/de/file/baefeec3f91b70b39b03c556d29dd1ad4eff87fe7bb0ba91fc3b774e70089281/analysis/1386768007/

• http://www.urlvoid.com/scan/globalcitybusiness.com/

LISTED AT SPAMHAUS (DBL): 

(and not without reason, as they state in the e-mail: THIS IS NO SPAM)

• http://www.spamhaus.org/query/domain/globalcitybusiness.com

 

E-Mail SS (ScreenShot)

www.streamlife.de

• https://www.virustotal.com/de/url/87771b9dd41a23e777709022835837a7f32da2b361c54e3f6805bc6a9c554312/analysis/1390934550/

• https://www.mywot.com/en/scorecard/streamlife.de

• http://www.urlvoid.com/scan/streamlife.de/