Web Security And Awareness towards Cybercriminals

1/27/2014

Malicious Website:
freeexgfvideos.com (United States)

Diese Zusammenfassung ist nicht verfügbar. Klicke hier, um den Post aufzurufen.

INFECTED:
tarabiscot.free.fr
HEUR:Trojan.Script.Generic (FRANCE)

MALICIOUS DOMAIN: RBN 73

tarabiscot.free.fr

https://www.virustotal.com/de/url/eee02c8b0bc0f5a7a61b5433db103b962dcfa4e6cb06e9b1512909abcb36a014/analysis/1390833650/

INFECTED WITH: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/8051a2477f0a79811fce048efa0c41e224aab909cc87df43d47a615560c8c85c/analysis/1390834277/

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=tarabiscot.free.fr

http://zulu.zscaler.com/submission/show/2b5d08d924c965ff3c023d2c4f994e87-1390833696

http://jsunpack.jeek.org/?report=2bb5070ae0c68c628d7fe1b2b80ea59f9f0af254

http://www.urlvoid.com/scan/tarabiscot.free.fr/

http://urlquery.net/report.php?id=9019600

---> REMOTE

www.managementhouse.it/X1eqVXuP.php?id=52441323

https://www.virustotal.com/de/url/7b9280a92f0ac026b068e86f2a9ece67c955e3ca43601a593389c5f3f760505a/analysis/1390834619/

https://www.virustotal.com/de/file/680c91b576621427e4795f80d603cfb3c536f57b98c45a70a12f80f65bb3c9e6/analysis/1390833815/

--->

sexshopsexy.es/waser.html

https://www.virustotal.com/de/url/9d71724af54a74209f495b747c83b5610f41eaaaecb879007e4f6d7b6f2607d2/analysis/1390834924/

https://www.virustotal.com/de/file/80218063480d86ddcf2a5bdb3c0e8b67ca5e192a18fa38b74f71b8e7a6949f3c/analysis/1390834708/

--->

dnn506yrbagrg.cloudfront.net/pages/scripts/0018/9762.js?386342

https://www.virustotal.com/de/url/1e2666229a04b567448ad4480f2b7b981526aaa8d0a243ca75c40de3c8b47511/analysis/1390835245/

1/26/2014

MALICIOUS SITE: rukiyehayran.com
(PHISHING, MALWARE, SCAM, SEO SPAM)
TURKEY (Rogue Medications - Zymbiotix)

MALICIOUS SITE: PHISHING, MALWARE, SCAM, SEO SPAM (Zymbiotix Cleanse)

"Are you sure you don\'t want to take advantage of the Garcinia Cambogia offer?\n\nDon\'t forget - it will only be available for a LIMITED TIME.

Since this offer is so cheap, there is no risk to you. You can also give them away if you\'d like. Or give it a shot, and get Garcinia Cambogia.\n\nIf you are wondering why this offer is so cheap, the simple answer is because the manufacturer is confident that their products will help you, and that you will continue to use their products, and refer friends and family.

Celebrities like Kim Kardashian and Britney Spears have lost a
signifcant amount of body fat with just these 2 diet cleanses. The duo
cleanse is clinically proven to flush out all the junk in your body and
melt away body fat without harming your immune system. Keep reading and
you'll find out why we created this report."

DOMAIN:

rukiyehayran.com

https://www.virustotal.com/de/url/2f6ab6c39c5b436e410ec66f2f62be5d8f1156c38b48b63c8d5062128605e9f2/analysis/1390758337/

HTML

https://www.virustotal.com/de/file/1f1218e4661f525ee1fcd70a043b7c0a3709ab33b39af313ffec819f59e24ffa/analysis/1390751239/

LINK 2

rukiyehayran.com/likeit.php

https://www.virustotal.com/de/url/6ebf42c21c420e1b2d377bbd335ed3b3317373a895c8e29566deb40650e4bfe3/analysis/

HTML

https://www.virustotal.com/de/file/70c6546a370ccedbdbf101bfd0124adc537fc4cccb7c022a0300071c3f09afcd/analysis/

http://jsunpack.jeek.org/dec/getfile?hash=3585/7a7fe26eb28c4a47ccd31474b3944cefef41

LINK 3 (SPECIFIC)

rukiyehayran.com/likeit.php?nwqmqztem1151qapb

https://www.virustotal.com/de/url/9f589ceabb55b17f43769500f860b201ff60715e36bff0cc6422728b93b92232/analysis/1390758346/

HTML

https://www.virustotal.com/de/file/70c6546a370ccedbdbf101bfd0124adc537fc4cccb7c022a0300071c3f09afcd/analysis/

POSSIBLE ORIGINATING IP ADRESS: 108.166.43.117

Screenshot of E-Mail Scam from rukiyehayran.com

www.onsitepctech.com.au
CVE-NO-MATCH Shellcode Engine Binary Threshold
(Potentially Malicious Domain from AUSTRALIA)

POTENTIALLY MALICIOUS DOMAIN:

www.onsitepctech.com.au

https://www.virustotal.com/de/url/0e29adcc5201def1c348c16d0be739c7b71392e612d9a9eb2f7055d5edadba5a/analysis/

suspicious: Warning detected /warning CVE-NO-MATCH Shellcode Engine Binary Threshold
suspicious: shellcode of length 4517/2725
suspicious: shellcode of length 388/227
suspicious: shellcode of length 140/102
suspicious: shellcode of length 2244/1348
suspicious: shellcode of length 138/100
suspicious: shellcode of length 363/287
suspicious: shellcode of length 2215/1319
suspicious: shellcode of length 73/45
suspicious: shellcode of length 167/129
suspicious: shellcode of length 1351/802
suspicious: shellcode of length 58/41
suspicious: shellcode of length 1352/803
suspicious: shellcode of length 2217/1321
suspicious: shellcode of length 526/412
suspicious: shellcode of length 2213/1317
suspicious: shellcode of length 856/509
suspicious: shellcode of length 844/502
suspicious: shellcode of length 6757/4069
suspicious: shellcode of length 75/54

http://jsunpack.jeek.org/?report=45d570fdee9ba93122369874ac25a35eccfa39a7

1/25/2014

www.eldiamantis.com
"Rogue Affiliate Reveals $100m Loophole"
(PHISHING, SCAM & SPAM)

You need to see this...

It's the most important website you'll visit
this year.

Here's why...

On that site you'll discover about a new
automated system that exploits a $100m
loophole.

Now this system was put to the test and
here's the results...

From scratch it produced $4,264 in the first
7 days.

And on to generate $27,353 in it's first
month.

Now next is where this gets very interesting.

The momentum of this system grows and grows
and last month it earned a massive $221,555!

Yes... Almost a quarter of a million dollars
in a single month just a few months after
starting.

Just click below to watch a free video all
about this amazing new system...

http://imoffers.systemx.clicksurecpa.com

With $221,555 a month in profits I think
you understand why this website will be
the most important you visit all year... If
not the most important of your entire life.

You now have a VERY REAL chance to start
making some serious money online.

With this underground loophole you DON'T
need to worry about:

- Having an exiting website or blog

- Having lots of capital for investing
in advertising... Just a few dollars
needed

- Having any technical knowledge... It's
all explained in a simple step-by-step
process anyone can follow

And it doesn't even matter if you've
earned a single cent online before.

You can start from scratch today knowing
nothing and follow along to be making
money tomorrow.

In the test... $4,264 was generated in
the first 7 days.

Just visit the site now to get started
and watch the free video...

http://imoffers.systemx.clicksurecpa.com

Now the creators and guys who have been
testing this system are super confident
anyone can make this work.

THIS MEANS YOU!

So if YOU download the system and follow
it they're going to GUARANTEE your success

No joke!

If you don't make at least $1,000 in the
first 7 days then their going to hand
you a $500 for giving it a shot.

YOU CAN'T LOSE

Think about it, you can try it out and
the very worst case is you'll pocket
a $100 in a week.

BUT... Just think if you do just half
as good as what the test showed...

... You'd be pocketing over $2,000
this very week.

And around $14,000 in 30 days time.

... And with the growth momentum this
system has you'll be cashing in over
a million dollars in less than a year.

AND THATS IF YOU ONLY DO HALF AS GOOD
AS THE TEST RESULTS PROVED THIS SYSTEM
IS CAPABLE OF!

You really need to check this out and
download a copy while you can.

Click below to do it now:

http://imoffers.systemx.clicksurecpa.com

Regards

El Diamantis

POTENTIALLY MALICIOUS DOMAIN:

www.eldiamantis.com

https://www.virustotal.com/de/url/d34a9a3946b4b6ea780f93fba6b72ccebf6d9206ca93219e082417d1ac695c4f/analysis/1390660102/
http://urlquery.net/report.php?id=8988794
https://www.mywot.com/en/scorecard/eldiamantis.com
http://www.urlvoid.com/scan/eldiamantis.com/

Link shown in the Mail (3x):

imoffers.systemx.clicksurecpa.com

https://www.virustotal.com/de/url/ab3a5964037476981e23759423d85b4a118ab7c8ebac53daddf62cf429a47472/analysis/1390661644/

IP of imoffers.systemx.clicksurecpa.com: 78.137.119.93

https://www.virustotal.com/de/url/86d48e7997dc929a776bdfe5f0ab721d7b74bee3ebae2535efe9b167cff9f3a7/analysis/1390662412/
https://www.mywot.com/en/scorecard/78.137.119.93

imoffers.systemx.clicksurecpa.com REDIRECTS TO:

www.autocommissionsystemx.com

The website was registered 28 days ago, surf with caution.

https://www.virustotal.com/de/url/a58a8b08388b1e554ccb4683ba479b660f479fc98c8e83078a55ae3f8af06ef2/analysis/1390661783/
http://www.urlvoid.com/scan/autocommissionsystemx.com/

IP of imoffers.systemx.clicksurecpa.com: 198.143.162.154

https://www.virustotal.com/de/url/e1c25855b8d97c544b059910e386735a892b8d5dc1203786df3dd373479e451e/analysis/1390663057/

IP is Listed at SPAMCOP:

http://www.spamcop.net/w3m?action=checkblock&ip=198.143.162.154

SCAM-Mail SCREENSHOT

INTERNATIONAL Online Child Predators: The Lost Boy Bulletin Board
(Part 5)

Jeffrey Greenwell

At the sheriff's office in Union, the Franklin County seat, Chuck Subke opens a red binder on a conference-room table. On the front it reads: "Sensitive information enclosed. Not for public release. Law-enforcement eyes only."

Inside is a 175-page document, entitled, "How to practice child love. Child love explained by professionals." Subke and the St. Louis FBI agent say the guidebook is much like the one on the Lost Boy forum, explaining everything from "risks involved" and "when to start/what age" up to "exploring the child's genitals" and "making love for the first time." This specific version incorporates a section called "Our Latest Project: How to kidnap children." It seems basically like a Wikipedia for predators.

One section points out a particular relevance to the Greenwell case. Its title: "Single parents and moms with kids.". The chapter begins with: "Unfortunately not all of us are blessed with children in our lives, as in having our own children, or children in the family," and "But do not worry, that is not a show stopper."

The handbook suggests advertising for dates on websites and in newspapers and limiting one's search to single mothers looking for long-term relationships. It states:

"The usual guy does not really like single moms with a lot of kids running around,". "So these moms are therefore suffering from the lack of men, love and self-confidence."

Readers are encouraged to emphasize a mom's "inner values" during the romance.

The writer warns:

"We want to apologize in advance for this statement," & "The uglier and fatter the moms, the easier it will be for you to get into that family."

Brian Mize notes, that pedophiles are connecting more and more with their young victims via interest-specific websites, such as a youth soccer team's home page. Mize also says, that predators fine-tune their Facebook profiles, to match the interests of the kid they're targeting. The omnipresent smartphones these days, facilitates communication out of range of parents' prying eyes and ensures that video capability is just a click away.

FBI investigators say Jeffrey Greenwell relied on a consistent method to seduce boys: In nearly every instance, he sought out single mothers on online dating websites. He would romance a woman and spoil her son, frittering the boy with attention and gifts. After a while he would push the relationship to a more intimate level, taking the boy on trips to Six Flags or babysitting him and, finally, sexually molesting him.

Six Flags New England

"You're talking about "the best" predators ever," the federal agent from St. Louis stated.

"Greenwell was very smooth-talking. He dressed normally. He wooed the heck out of the mothers. This wasn't 'the guy in the ice cream truck.'"

The agent points to a flow chart the investigators created to diagram Greenwell's various connections to molestation victims and their parents, as well as two suspected fellow pedophiles. He gestures to photos of four mothers and ticks off Greenwell's tie to each: "boyfriend, boyfriend, babysitter, coworker."

Subke and his partner from the FBI questioned their objective at the sheriff's office on the evening of Greenwells arrest.

Subke began, by offering Greenwell, age 37 at the time, a soda. After reading him his rights, the investigators explained that there had been some allegations made against him. At first the conversation was heading toward small talk.

Investigator: "Mr. Greenwell, what kinds of hobbies are you into?"

Greenwell: "Scooby Doo, SpongeBob and playing Xbox."

Investigator: "What's your type, Mr. Greenwell? Guys or girls?"

Greenwell: "Guys. Young males, specifically - around eight to twelve years old. But I don't like hardcore sex images, as Society doesn't look too kindly upon adult males who like young boys."

Investigator: "Let's talk about child porn,".

Greenwell: "They're boring,"

His computer skills, Greenwell added in response to another question, were "beginner to low-intermediate." He said he had encrypted the contents of his hard drive "because of personal information."

The Federal agent asked about a framed picture of a boy he had seen on a wall in Greenwell's home: It appeared to be a formal school portrait. Greenwell explained that it was an old photo of a boy he'd been a father figure to.

After a while the investigators brought up the fourth grader who had described how Greenwell had sexually molested him. Eventually Greenwell admitted that he had fondled the boy's penis and photographed the experience.

But Greenwell didn't stop there.

Aware of Greenwell's affinity for Scooby-Doo, the investigators brought up the topic in the hope that he might be familiar with the "Scooby-Doo Productions" material that LA investigators had uncovered on Lost Boy. But instead of referencing those videos, Greenwell described a pornographic video a friend had sent to him - and also a non-pornographic video he had made, which featured the son of a coworker playing in a park.

"We didn't know what the hell he was talking about," said the Federal Agent. "So we played off of it."

"Yeah, tell us about those other videos," the agent prompted. At that point Greenwell abruptly opened up.

He admitted incorporating Scooby-Doo imagery into the home movie he'd shot in the park, featuring a boy he knew. He began spouting "computer lingo," as the agent puts it - saying he had used the Sony Vegas software to tag three other videos with his "Scooby-Doo Productions" .

He hadn't shot those videos, he said; they'd been sent to him by acquaintances. He said he'd obscured background details so as not to reveal where the videos had been made.

"Everyone knew him as 'the computer guy,'" the federal agent noted in afterthoughts. "If there was something in the background that identified someone, he would take care of it."

The detectives asked Greenwell who'd sent him the videos. One man was from New Hampshire, he said; another, who went by the screen name "SpongeBob," was from Utah. The investigators could hardly believe what they were hearing.

"LA was hot after 'SpongeBob,'" the FBI agent explains. When Greenwell offered up the man's name, Antonio Cardenas, "We immediately called LA, and Salt Lake started their investigation full-bore."

And Greenwell kept talking and admitting.

He also admitted that the framed photo on his wall was of a boy he had molested, and he told Subke and the agent where the boy's mother lived. He admitted that he was "Muddyfeet." He admitted to operating a child-porn message board of his own, called "aLL bois." He identified by name all of the boys in photos that had been sent from Los Angeles. He came up with the screen names of ten additional fellow porn traders.

After three and a half hours of questioning, minus a few breaks for cigarettes, Greenwell finally broke down.

Part 1:

http://stayaway2.blogspot.com/2014/01/international-online-child-predators.html

Part 2:

http://stayaway2.blogspot.com/2014/01/international-online-child-predators_10.html

Part 3:

http://stayaway2.blogspot.com/2014/01/international-online-child-predators_11.html

Part 4:

http://stayaway2.blogspot.com/2014/01/international-online-child-predators_16.html

Malicious Site: fajnstudio.sk
Trojan-Downloader.JS.Iframe.dfe (SLOVAKIA)

MALICIOUS SLOVAKIAN SITE:

fajnstudio.sk

https://www.virustotal.com/de/url/6080a9720496d74ed2f7cf7ca39c1f0174fb48a7b027f353df05490a328e26c1/analysis/

Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/c987bb6d76e73b69b2af05113351d0b6698b27bdece2d19da4a4fc2024ab70e0/analysis/1390646416/

fajnstudio.sk/files/e107.js

https://www.virustotal.com/de/url/fab21363cd2ec138bf54f8de642bfdbc6b4679f7dd2aa440da7148dbd5ae5551/analysis/1390646559/

HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/2ba2ad81fea9972360841eb5c0b7af72dc746322c5d4e537a78850c76abd4b7e/analysis/1385071499/

fajnstudio.sk/plugins/lightbox/src/js/prototype.js

https://www.virustotal.com/de/url/1f5bb1db016f58c0d2a9429aa7d34f000bc141e275af39ff067aa36c7729ac24/analysis/1390646738/

Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/47199a74828ba83bb655f752009d97fd9aa171745f141c2cf676fcdca4772aac/analysis/

fajnstudio.sk/plugins/lightbox/src/js/plugins/lightbox/src/js/scriptaculous.js?load=effects,window

https://www.virustotal.com/de/url/24dda26f5c831da3016214d7e5a89fbe7ecad0b26e6978097fdb59c7f7ee6b83/analysis/1390647757/

Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/253fbfd313e53a10ab360f49dbe13fb6397c2f12d39d4459ac38349453ac1c03/analysis/1390647184/

fajnstudio.sk/plugins/lightbox/src/js/plugins/lightbox/src/js/lightbox.js

https://www.virustotal.com/de/url/43e5fedde352285d3eca1b64d2de40ae11d5c19bc7e19cf5dbfbaeeb46beb846/analysis/1390648131/

Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/2e01c9c9bbeb0099094565ecf2034de875f29a8604bd696154f98086c31f6c76/analysis/1390648230/

fajnstudio.sk/swfobject.js

https://www.virustotal.com/de/url/29fc821af1f7daeb1eb99c776e92dd77bfcc0ce02fb1e1e88fab8ba756f0c3af/analysis/1390648329/

Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/a2a19169ac59192e2bc88f5a9e91cac644d176b207a18ecbdd6d038668da0fc1/analysis/1390648416/

Apple Releases iTunes 11.1.4

Apple has released a security update for Apple iTunes 11.1.4 to address multiple vulnerabilities. These vulnerabilities could allow an attacker to execute arbitrary code or cause a denial-of-service condition.

For Details See: http://support.apple.com/kb/HT6001

Todays Useless Website:
A Teacup full of Sugar

A Useless Cup of Sugar (Please): http://teacup.gopagoda.com/

1/24/2014

NEW MALWARE CODE:
Trojan-Clicker.HTML.IFrame.api & Trojan.JS.Agent.cfe & Trojan.JS.Agent.cff & Trojan.JS.Agent.cfg
found on
iprostate.org (FRANCE) & 89.161.179.50 (POLAND) & aixuaxoh.corpellis.com (FRANCE)

MALICIOUS DOMAIN INFECTED:

iprostate.org

https://www.virustotal.com/de/url/60a26b91beaa3f637236fd90c0337dbbbbca80eeef890fe65ccf4e08d1e47dcf/analysis/1390565063/

NEW MALICIOUS CODE: Trojan-Clicker.HTML.IFrame.api

https://www.virustotal.com/de/file/e985726550f1e3d0e509d7b137b0fb8e638e0206be3dac95aa3374b68b75f9c4/analysis/1390565399/

http://wepawet.iseclab.org/view.php?hash=95b6d14c905bb68bb00acc216aeee6ea&t=1390565037&type=js

http://jsunpack.jeek.org/?report=544ce445dec7f573fde5dbae940cf8e1a877d501

http://www.urlvoid.com/scan/iprostate.org/

--->

DOMAIN: (POLAND)

89.161.179.50

https://www.virustotal.com/de/url/3eb048bbc38acf47bc1fc56d6ba0bca27af49befb9501ba7e6217f1fd1f855a8/analysis/1390566648/

INFECTED WITH: JS:Includer-APY [Trj] & Trojan.JS.Blacole.Gen

https://www.virustotal.com/de/file/e7b478aeb97b77d2b7603ec9b3c01a67c9283b5773dc220fa181aec6b106502c/analysis/1390566981/

http://urlquery.net/report.php?id=8956027

http://wepawet.iseclab.org/view.php?hash=71f5f7a455f222fa3632d2fa5513d733&t=1390567166&type=js

http://jsunpack.jeek.org/?report=d0d24f41d2763479e8bdd80e573321b1495b3ee5

89.161.179.50/AC_RunActiveContent.js

https://www.virustotal.com/de/url/46559ae6b42b98f6a5636e639f20cf218a21dbe4e74bde08627368d5e4004efa/analysis/1390567518/

NEW MALICIOUS CODE: Trojan.JS.Agent.cfg

https://www.virustotal.com/de/file/8dd5ca26ad29dbb78104867199d67d6cf93115b3af206c434470d8f896c6df6b/analysis/1390567519/

SPECIFIC REMOTE LINK:

89.161.179.50/pub/MQZ11znP.php?id=27367098

https://www.virustotal.com/de/url/db69ece38e9a7d922b2fc7f4363d7c763e1f7393e7f60aeb049334e56b25324d/analysis/1390565939/

NEW MALICIOUS CODE: Trojan.JS.Agent.cfe

https://www.virustotal.com/de/file/da207e5f0c04455f4a759e81fa7930be4e92bff35786ac69fa647c31588bd0dd/analysis/1390565729/

--->

DOMAIN:

aahaimie.corpellis.com

https://www.virustotal.com/de/url/74b62220ddfd4194ec8353076c5a47dc6d75169cee68a0b1b04183042ea90971/analysis/1390566439/

SPECIFIC REMOTE LINK:

aahaimie.corpellis.com:8000/kbgvqiqyg?bwiossxvihjt=6621548

https://www.virustotal.com/de/url/716660bdafda01452ff3383dc54d57578b33620ce3f2b60c5a04b085262aa26b/analysis/

NEW MALICIOUS CODE: Trojan.JS.Agent.cff

https://www.virustotal.com/de/file/e7b478aeb97b77d2b7603ec9b3c01a67c9283b5773dc220fa181aec6b106502c/analysis/

--->

DOMAIN: (UKRAINE)

91.217.91.104

https://www.virustotal.com/de/url/600b14a0354cde620db64861fd6865d7395f8e3cbb744240c842ab09f01fb577/analysis/1390568047/

91.217.91.104//?id=1&se_referer=&charset=utf-8

https://www.virustotal.com/de/url/b1edaeb1d47b89d2747466822d49aba12752e79a004de1643bca1f70d03f7584/analysis/1390568170/


-----------------------------------------------------------------------------------

OTHER DOMAINS INVOLVED

1) DOMAIN: (U.S.)

akmc-engg.com

https://www.virustotal.com/de/url/704c9b0de1bad345c1af1094c1f130a9e3af891aeb5e01aca4634e189ad2cb7f/analysis/1390568688/


SPECIFIC LINK:

akmc-engg.com/cO5hpbRz.php?id=27367098

https://www.virustotal.com/de/url/15901dee78bb8e1a89187df6e9482f84379cea7ba8f78d2fbb79755058286f19/analysis/1390568698/

https://www.virustotal.com/de/file/afee46604646db0e32c46dd0f423e1da7c2f9d2a2be31990ab287585f825ba83/analysis/1390566117/

-----------------------------------------------------------------------------------

2) DOMAIN: (U.S.)

karocchio.eu

https://www.virustotal.com/de/url/fff4fdeb39bb94d2696dc08f21a116135f90045b60a1c634c48d6f75a9efc81d/analysis/1390569353/

-----------------------------------------------------------------------------------

3) DOMAIN: (ICELAND)

bobomo.mynumber.org

https://www.virustotal.com/de/url/315bdb1eaf95fcaeb3bf417a5185a4b1b7a69c888a133707df227201cd8c7921/analysis/1390569679/

Dynamic DNS URL

http://urlquery.net/report.php?id=8956217

http://www.urlvoid.com/scan/bobomo.mynumber.org/

-----------------------------------------------------------------------------------

4) DOMAIN: (INDONESIA)

inez.co.id

https://www.virustotal.com/de/url/a3a8f91034a79665ee1a2c92c8a7d4dcb8536440f4acf9472c2a6650046c4445/analysis/1390570093/

https://www.virustotal.com/de/file/7212d36a24d79b733ee726e38c0db6734e4a55b290a2680504de57683ed49a07/analysis/1390570210/

http://www.urlvoid.com/scan/inez.co.id/

SPECIFIC LINK (INFECTED):

inez.co.id/edocus/tSB0NuE7.php?id=19034511

https://www.virustotal.com/de/url/17b184b7e0f250eda98b7314b3e2316a6540701029647b3814705fddbbde9c57/analysis/1390570447/

INFECTED WITH: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/521de2e5d3c5140f17a06400840f7002bd2ec33f6e085171fc3df768efb4413f/analysis/1390570748/

https://www.virustotal.com/de/file/b671d0390dcde53d9b0fd1e0bd3a8b145409e57f58b00bc47d11c449037a7468/analysis/1390570733/

http://jsunpack.jeek.org/?report=d9152fba62fa51859e1955854a0a447e785e73c0

-----------------------------------------------------------------------------------

5) DOMAIN: (FRANCE) Dynamic DNS URL

www.urofrance.org

https://www.virustotal.com/de/url/ad735bc21d8858b255a8688cd78c3d04ee7ccf483dfea7e0147a5b92915774f5/analysis/1390571126/

www.urofrance.org/congres-et-formations/calendrier.html

https://www.virustotal.com/de/url/de91fb23ff3add27e1b0b61c9e6a57043ffe33c927a4bd40201ed79e2ac0f03b/analysis/1390571128/

Dynamic DNS URL

http://urlquery.net/report.php?id=8956326

-----------------------------------------------------------------------------------

6) DOMAIN: (SWITZERLAND)

www.healthonnet.org

https://www.virustotal.com/de/url/ffe8ada5a6b6a7eca744223b20087bebb2fe5339ef3b9f983f2e38b62056dada/analysis/1390572210/

http://quttera.com/detailed_report/www.healthonnet.org

-----------------------------------------------------------------------------------

7) DOMAIN: (FRANCE) - LINK TO iprostate.org found

www.spdesigner1.com

https://www.virustotal.com/de/url/aabf7f0ce3e2507fe39cf3a2d7c1488ec96e81bbec5899771bad3944845639e9/analysis/1390573845/

www.spdesigner1.com/js/carouFredSel.js

https://www.virustotal.com/de/url/87ff75c131dd793787cc905b4c86b65fa62cea025f29ce837efc9863bf003919/analysis/1390574236/

PUA

https://www.virustotal.com/de/file/babe4ebb46ac2dbe59de631e65409bd31133a3c48b0e3069d8543aed9af13f98/analysis/1386751724/

LINK FOUND TO: iprostate.org

http://www.UnmaskParasites.com/security-report/?page=www.spdesigner1.com

1/23/2014

Beware of such FAKE FACEBOOK PROFILE(s):
www.facebook.com/Gertruda
(PHISHING & MALICIOUS ACTIVITIES (BLOGSPYING AND -PROVOKING))

SUSPICIOUS TO MALICIOUS - FAKE FACEBOOK PROFILE: (PHISHING & MALICIOUS ACTIVITIES (BLOGSPYING AND PROVOKING))

www.facebook.com/Gertruda

https://www.virustotal.com/de/url/a1a5dc8ee81ab63a5e78376d7649cfa38290e74649389b01d0c1bffb85457f4e/analysis/1390505891/
https://www.virustotal.com/de/file/63179ad2dff2e4a1745f05650007bb54630c83c49127101bd474fa054144a64c/analysis/1390509908/

Gert ? Gertruda ?

Is this Gert...


...or is HE GERTRUDA ???

NEW MALWARE: Trojan-Downloader.JS.Iframe.dfe
found on
icecube.it (ITALY)

MALICIOUS SITE:

icecube.it

https://www.virustotal.com/de/url/b1e562e23de2c29cf5cb51b757d82edbdbd06edb3fc1da976db3cba00a046998/analysis/1390497005/

INFECTED WITH NEW MALWARE VARIANT: Trojan-Downloader.JS.Iframe.dfe

https://www.virustotal.com/de/file/35f74daecafa6897e66b8e8fa5dfb8940f65b50b9a6fc4aae32f6665583b3f40/analysis/1390496903/

http://urlquery.net/report.php?id=8948169

http://www.google.com/safebrowsing/diagnostic?site=icecube.it

---> REMOTE

DOMAIN POSSIBLY INFECTED:

tanersarf.com

https://www.virustotal.com/de/url/2db7836898435db551a3fbcd47db96c42551c4748788ea5facc6522e78bbb149/analysis/1390498334/

WITH: Script.Packed.IFrame.K@gen

https://www.virustotal.com/de/file/2478011b919e778e0eb30ac74fbc69f81f7a70ec4c7d15bdff3ac8e5dd32d470/analysis/1390497912/

http://jsunpack.jeek.org/dec/getfile?hash=84af/dca9f4cc27824fcb9650dbfd21dcdc2396c1

SPECIFIC GO:

tanersarf.com/counter.php

https://www.virustotal.com/de/url/feaf2c7858276ef6f6db59c8eef5219f448c135f9081e85f83a8e637d14dc604/analysis/1390498323/

https://www.virustotal.com/de/file/97865611a349e3922f252aa61369e2d82fa32598e8a416694c66986c758cf188/analysis/1390498052/

MALICIOUS DOMAIN: top100blogs.4you.cloudns.us
(PHISHING & Paid Links - Netherlands)

POTENTIALLY MALICIOUS DOMAIN:

top100blogs.4you.cloudns.us

https://www.virustotal.com/de/url/113d96e224923eceebeb484e92aacd0f6d929d81b79f014503a3c8276fb852e8/analysis/

http://www.browserdefender.com/site/top100blogs.4you.cloudns.us/

http://quttera.com/detailed_report/top100blogs.4you.cloudns.us

http://sitecheck.sucuri.net/results/top100blogs.4you.cloudns.us

http://www.urlvoid.com/scan/top100blogs.4you.cloudns.us/

1/21/2014

www.scalesexpress.com (United Kingdom)
POTENTIALLY SUSPICIOUS DOMAIN
Microsoft Internet Explorer remote code execution via option element

POTENTIALLY SUSPICIOUS DOMAIN:

Microsoft Internet Explorer remote code execution via option element

www.scalesexpress.com

https://www.virustotal.com/de/url/48d23059451f6289a371b36f14ae5a7dd254d945ba32294d67ef8f2dd8ab44ac/analysis/1390310938/

https://urlquery.net/report.php?id=8877127

https://urlquery.net/report.php?id=7605847

https://urlquery.net/report.php?id=7870025

https://urlquery.net/report.php?id=8182437

---------------------------------------------------------------------------------------------------------------------------------------------

MORE ABOUT THIS SPECIFIC THREAT:
http://www.iss.net/security_center/reference/vuln/HTML_IE_Option_Uaf.htm

Facebook User of the Day: Kanizze Fatema Khuzeima (Who is SHE ?)

Is this Kanizze...?

Say Hello to Kanizze @:

https://www.facebook.com/kanizze111

Or THIS ? Same Haircut it seems.

Translate

1/27/2014

1/26/2014

1/25/2014

1/24/2014

1/23/2014

1/21/2014