Translate

5/09/2014

SPAM: Jennifer Woodard (woodardjennifer27@yahoo.com)
DOMAIN: darwinistneleridusunmez.com
IP: 180.180.146.4 Bankok, THAILAND




DOMAIN:
http://darwinistneleridusunmez.com/
  • https://www.virustotal.com/de/url/51ee5532251a6a564ea561ab27211e864beec50df216a0827b1bb1052c369a5a/analysis/1399629448/
http://darwinistneleridusunmez.com/lsy/view.php
  • https://www.virustotal.com/de/url/9d8251b452e80791bae691d8eebe0681a092719cf553c5e80c6b1784793c0928/analysis/1399629579/
DOMAIN IP:
http://54.247.100.110/
  • https://www.virustotal.com/de/url/e1792fc59ff57735b91d13358c35cf0028ecf8516e36fbe23060b1eb8db96e10/analysis/1399631113/
  • https://www.virustotal.com/de/ip-address/54.247.100.110/information/
IP LISTED AT SPAMHAUS (CBL)
  • http://www.spamhaus.org/query/bl?ip=54.247.100.110
  • http://cbl.abuseat.org/lookup.cgi?ip=54.247.100.110
  • http://www.senderbase.org/lookup/?search_string=54.247.100.110

MAIL IPs:
1)
http://180.180.146.4/ (THAILAND)
  • https://www.virustotal.com/de/url/dff9af04709b5bc1aec3f2705bafe872a9a57b8a23d9b29f75c117c0a5aba04a/analysis/1399629695/
SPAMMAILSERVER & DICTIONARY ATTACKER:
  • https://www.projecthoneypot.org/ip_180.180.146.4
LISTED AT SPAMHAUS (PBL):
  • http://www.spamhaus.org/query/bl?ip=180.180.146.4
E-MAIL-REP: POOR
  • http://www.senderbase.org/lookup/?search_string=180.180.146.4
2)
http://66.147.244.82/ (UNITED STATES)
  • https://www.virustotal.com/de/url/d60b98e987232df8a76c2aadaa8982b3d03a2b4a1a2cc91d829c296f513b13f1/analysis/1399630027/
  • https://www.virustotal.com/de/ip-address/66.147.244.82/information/
BHA: 19
  • https://www.projecthoneypot.org/ip_66.147.244.82
3)
http://14.4.4.6/ (SOUTH KOREA)
  • https://www.virustotal.com/de/url/ea36277fb5e01f8d0713c1937c952433fa0d3e3d11956f161dd989b3a6a07219/analysis/1399630197/
LISTED AT SPAMHAUS (SBL & DROP)
  • http://www.spamhaus.org/query/bl?ip=14.4.4.6
  • http://www.spamhaus.org/sbl/query/SBL187947
  • http://www.senderbase.org/lookup/?search_string=14.4.4.6
4)
http://69.89.23.228/
  • https://www.virustotal.com/de/url/f15acfaf6680089b7af8ce6db92c64f2420b0f92e1bcb14af18e2420b2d5de79/analysis/1399631488/

5/08/2014

ANGLER EXPLOIT KIT (& HEUR:Trojan.Script.Generic)
Newly Detected Malicious DOMAINS from FRANCE:
black-salope.photos-films-x.com
www.photosx-videosx.com
belles-noires.photosx-videosx.com

IPs: 23.239.17.30 & 194.150.236.81



FRENCH MALWARE DOMAIN(s): 
LINKS TO INFECTED DOMAINS (HEUR:Trojan.Script.Generic / ANGLER EXPLOIT KIT)

SITE:
http://black-salope.photos-films-x.com/
  • https://www.virustotal.com/de/url/afd7b2909fd81c0403dcd2d7751966ce255d6011b4217b857f102f0bd02b1d7d/analysis/1399550506/
SPECIFIC MALICIOUS URL:
http://black-salope.photos-films-x.com/black-salopes.html
  • https://www.virustotal.com/de/url/dd6f70d37f067050a8e9e7c9a902ed98e18697b125206252d2f9ab8ee4e44e80/analysis/1399550918/
  • http://quttera.com/detailed_report/www.photosx-videosx.com
INFECTED LINKS FOUND HERE:

1)
http://www.photosx-videosx.com/
  • https://www.virustotal.com/de/url/304eacef10ded96e02de6a8c7377facaf6fe00fa0f7abfb4916e509406caa0b0/analysis/1399551145/
HEUR:Trojan.Script.Generic
  • https://www.virustotal.com/de/file/8eb3907b32e45e38453b56a05aed6b0132f31e7db511e14da383c2e0821b55ea/analysis/1399551334/
  • Malicious iframe injection
  • Angler exploit kit URL pattern
  • https://urlquery.net/report.php?id=1399551228285
--->
http://promo.vador.com/js/tc_loader.js
  • https://www.virustotal.com/de/url/8cc9be1632fafa63070ba909501c2c1253363913f508c68ca851e53d3e997082/analysis/1399553305/
  • https://www.virustotal.com/de/file/017051c711d3cd4e1dfdfba7976237e86bcbf1841b8c4e96627c929403ea9a20/analysis/1397006857/
---->

DOMAIN:
http://consciousnesszone.com/
  • https://www.virustotal.com/de/url/ac7d259785dcda43ec1ec46b60d5be4f6850e7f516a35007fff1a3c34df8daee/analysis/1399553019/
  • http://sitecheck.sucuri.net/results/consciousnesszone.com
MALICIOUS URL (DOCWRITE)
http://consciousnesszone.com/wp-content/plugins/InstaBuilder/zE1ZWXxV.php?id=1707269
  • https://www.virustotal.com/de/url/e389ae2a547adde57bd8665fd45aa84307e994f550e08c11e2b3b125cdef3ee4/analysis/1399552408/
DOMAIN:
http://socialmediahelpforbusinesses.com/

  • https://www.virustotal.com/de/url/bb5f27c3c682dcde39769b673429d69f6ba7bb293824ffa555807aaafa16ee25/analysis/1399552046/
EXPLOIT URL (in this case (random)):
http://socialmediahelpforbusinesses.com/o5a8oheam8
  • https://www.virustotal.com/de/url/98ba770ce401bfc84286efaed8dd08e614c1c8f74198fb2f429bb91ebf6fed55/analysis/1399552020/
EXPLOIT ANGLER
  • https://www.virustotal.com/de/file/59831c7074ce6fb3cad1c442da9d8f943340909375e156ce988d3b6a5cbf86ee/analysis/1399551862/
---------------------------------------------------

2) SAME FOR
http://belles-noires.photosx-videosx.com/
  • https://www.virustotal.com/de/url/356c31acbf7f736f50a26783583632d2754b8a0094339ed70d4c1703d941f164/analysis/1399553987/
HEUR:Trojan.Script.Generic
  • https://www.virustotal.com/de/file/37ccdabc9e5d4dc17f00af44f311417577ab1dfe884634e663ae15184e37de0e/analysis/1399554228/
  • http://urlquery.net/report.php?id=1399554055463
---------------------------------------------------
IPs:

1)
http://194.150.236.81/
  • https://www.virustotal.com/de/url/090783f03563157938a2c276a895517863727923085fe8723335e188fbe0efd3/analysis/1399554601/
  • https://www.virustotal.com/de/ip-address/194.150.236.81/information/
2)
http://23.239.17.30/
  • https://www.virustotal.com/de/url/698f78c8e171958c4fe2e9090202804a5ec63d5b1a03bb31abae5094a7bef84c/analysis/1399554712/

U.S. NAVY MILITARY HACK 2012:

Nicholas Paul Knight & Daniel Trenton Krueger

charged with Hacking US Navy Computer Systems & Sites


Daniel Trenton Krueger, 20, of Salem, Illinois and Nicholas Paul Knight, 27, of Chantilly, Virginia, were accused of conspiring "to hack computers and computer systems as part of a plan to steal identities, obstruct justice, and damage a protected computer" from April 2012 to June 2013, court documents and prosecutors said.

USS Harry S. Truman

Knight, a former systems administrator in the nuclear reactor department of the USS Harry S. Truman, was the self-proclaimed leader and publicist of "Team Digi7al," prosecutors said. He used the names Inertia, Iner7ia, Logic and Solo and has been a hacker since the age of 16, charging documents say. He was discharged from the Navy after he was caught trying to hack a Navy database while at sea.

In an interview with a reporter for the website Softpedia, parts of which are quoted in charging documents, "Iner7ia" said that he was originally a White hat hacker, who found and reported security vulnerabilities. But he became bored and said "the people I did work for were ungrateful and sometimes they wouldn't take me seriously."

He admitted being a member of the United States Navy, and said that he worked for the people of the U.S. hacking primarily government sites, not the government. "I believe that if we can't protect ourselves against a cyber attack, then how can we trust the government to protect against anything else?"


He said that he uses a separate computer to avoid being caught, and at one point said, "I just hope that I can retire knowing I was never caught and arrested. Haha"

Krueger, who was studying network administration at an undisclosed college, did the hacking "out of boredom," prosecutors said. He went by the names Thor, Orunu, Gambit and Chronus.

Charging documents say that in June of 2012, the Naval Criminal Investigative Service (NCIS) detected a breach of a Naval database located in Oklahoma that contains the Social Security numbers, names, and birth dates of roughly approximately 220.000 members of the military.


"The Navy quickly identified the breach and tracked down the alleged culprits through their online activity, revealing an extensive computer hacking scheme committed across the country and even abroad," said U.S. Attorney Danny C. Williams of the Northern District of Oklahoma.

U.S. Attorney Danny C. Williams
The NCIS and Defense Criminal Investigative Service identified Knight and Krueger as the hackers of the Navy database as well as systems belonging to the U.S. National Geospatial-Intelligence Agency, the Department of Homeland Security, AT&T U-verse, Universities, Police Departments in Toronto and Alabama and the entire email account of the Peruvian ambassador to Bolivia.

They posted links to the data via Team Digi7al's Twitter account, and one co-conspirator said they released the data because they were "somewhat politically inclined to" but also because it was "fun, and we can," prosecutors said.

The U-verse hack compromised the personal information of 3.500 customers. The June 2012 Navy hack left 700 overseas military members unable to access the system and get "logistical support" for their transfers for more than 10 weeks and cost the Navy more than 500.000 US-Dollars documents say.

The U.S. National Geospatial-Intelligence Agency

After the NCIS searched Knight's Virginia home in February of 2013, he admitted "many" of his Team Digi7al activities and agreed to cooperate, but told a juvenile co-conspirator to delete data, documents say.

That juvenile and two others who hacked for Team Digi7al were not charged.

Illinois ONLINE CHILD PREDATORS 2009/2012:
Eight Self-Identified ‘Boy Lovers’ Sentenced
to Federal Prison for Sexual Exploitation Crimes

Three years after several self-identified “boylovers,” who met in person and online to discuss their sexual interest in children and trade child pornography, were arrested in an FBI sting during or soon after a purported party at a hotel in suburban Skokie, a total of eight defendants have been convicted and sentenced to federal prison terms as a result of the investigation. The sentences ranged from nine years for a suburban Crest Hill man sentenced last week in Chicago to 120 years for a Missouri man sentenced last year in St. Louis.


Six of the eight defendants pleaded guilty and three of them cooperated against others, while the Crest Hill man and a Missouri defendant were convicted after separate trials. All were prosecuted as part of an investigation by the Chicago FBI’s Innocent Images Task Force, which culminated with the undercover sting in September 2009.

“The sentences in these cases reflect the stark reality that defendants who prey upon children by sexually exploiting or abusing them will be punished severely,” said Gary S. Shapiro, Acting United States Attorney for the Northern District of Illinois. He announced the sentences together with William C. Monroe, Acting Special Agent in Charge of the Chicago Office of the Federal Bureau of Investigation.

Mark McGill, 27, of Crest Hill, was sentenced to nine years in prison, followed by 20 years’ supervised release, by U.S. District Judge Joan Gottschall on October 9th, 2012. McGill was convicted of possessing and distributing child pornography after a trial in March 2012. Evidence at McGill’s trial showed that he had attended at least one party with other “boylovers.”

In August 2009, McGill gave a cooperating defendant a thumb drive containing approximately 3.500 images and nearly 60 videos containing child pornography.

Jose Garcia, 25, of Schererville, Indiana, was sentenced to 33 years in prison, followed by lifetime supervised release, by U.S. District Judge Amy St. Eve on July 23. Garcia, who cooperated, pleaded guilty to producing, possessing, and distributing child pornography.

Jacob Elliott, 32, of Matteson, was sentenced to 20 years in prison, followed by 10 years’ supervised release, by U.S. District Judge John Grady on July 18. Elliott, who cooperated, pleaded guilty to producing and possessing child pornography.

Corey Stinefast, 30, of Kenosha, Wisconsin, sentenced to 18 years in prison, followed by lifetime supervised release, by Judge St. Eve on June 13. Stinefast pleaded guilty to possessing and distributing child pornography, and he was found to have amassed a collection of more than 191.000 images of child pornography.

Neal Maschke, 42, of West Chicago, was sentenced to nine years in prison, followed by five years’ supervised release, by U.S. District Judge Samuel Der-Yeghiayan in October 2010. Maschke pleaded guilty to possessing child pornography.

McGill, Maschke, Garcia, Stinefast
Donald Peppers, 38, of Hoffman Estates, sentenced to 27 years in prison, followed by lifetime supervised release, by the late U.S. District Judge William Hibbler in December 2010. Peppers, who cooperated, pleaded guilty to producing, transporting, and possessing child pornography, including an admission that he had produced a video of himself sexually molesting a 1-year-old child. Peppers’ arrest and subsequent cooperation touched off the investigation that resulted in the other prosecutions.

Garcia and Maschke were arrested when they showed up for what they believed was going to be a “boylovers” party at the Skokie hotel in September 2009. McGill and Stinefast were arrested a short time later. Two other defendants, Michael Martin and Matthew Klopfenstine, were convicted in federal courts in St. Louis and Kansas City, respectively, based on evidence gathered during this investigation. Martin was sentenced last year to 120 years in prison for producing child pornography, and Klopfenstine was sentenced recently to 15 years and eight months for producing child pornography.

5/05/2014

Spyware ALIASES for:
PAK:PE Patch / PAK:ASProtect




PUA.Win32.Packer.Asprotect-2 (Clamav)
  • http://www.clamav.net/lang/en/
Win32.SuspectCrc (Ikarus)
  • http://www.ikarussecurity.com/
PAK:PE Patch (PAK:ASProtect) (Kaspersky)
  • http://www.securelist.com/en/descriptions/29810394/ASProtect
Packed.Win32.Black.d
"It is packed using PE Patch and ASprotect."
  • http://www.securelist.com/en/descriptions/6134039/Packed.Win32.Black.d
Trojan-Dropper.Win32.Delf.grq
"It is packed using ASprotect. The unpacked file is approximately 915 KB in size. It is written in Delphi."
  • http://www.securelist.com/en/descriptions/16268043/Trojan-Dropper.Win32.Delf.grq
PWS:Win32/Zbot.AFW (Microsoft)
"This password-stealing trojan can monitor your keystrokes and send the recorded information to a hacker. This can include your online activity such as visits to banking websites."
  • http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32/Zbot
Trojan.Win32.Generic!BT (Sunbelt)
  • http://www.lavasoft.com/mylavasoft/malware-descriptions/blog/backdoorwin32poisontrojanwin32genericbt
TSPY_ZBOT.TE (TrendMicro)
"This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It modifies the Internet Explorer Zone Settings. It deletes itself after execution."
  • http://about-threats.trendmicro.com/malware.aspx?language=au&name=TSPY_ZBOT.TE
Variant of Win32/Kryptik.AIJU trojan (NOD32)
  • https://www.virustotal.com/de/file/0a5bf022f878ee811a038a1fd9c8cedfd5d13e7bb028542e4bc7469fdc3272e1/analysis/

ANALYZING HASHES
MD5: 589eb00c8d071f8b81a782772dde514a
PUA.Win32.Packer.Asprotect-2 (Heur.Win32.Veebee.3!O)

FROM:

http://athan.islamicfinder.org/screensavers/Ramadan1.exe
  • https://www.virustotal.com/de/url/2ffeb9ca413dc2756602d3650c0d178698b0b19c573bfeeedbb46584842934f4/analysis/1399297572/
PUA.Win32.Packer.Asprotect-2
  • https://www.virustotal.com/de/file/7e6b28c0b34dd2bf037e80016e38636e64e5d9e0f7ad939c69c4895e32e74200/analysis/1399297418/
  • https://urlquery.net/report.php?id=1399297906951


MD5: 589eb00c8d071f8b81a782772dde514a INCLUDES:

1) ConfigureScr.exe
  • https://www.virustotal.com/de/file/dd4d2dd4690f895ee3e4a6dc319e8ed4e7282f21bc818dfed49068873fc01353/analysis/1399298315/
2) Ramadan1.SCR
Heur.Win32.Veebee.3!O
PUA.Win32.Packer.Asprotect-2
  • https://www.virustotal.com/de/file/cdc9ed6d336b530f70adce5e836eccd5da7ec06447594a3830ed10af20f18dcd/analysis/
3) RemoveScr.exe
  • https://www.virustotal.com/de/file/52a7f3cb893fdaf4aa2a7f20b585047b2b128b07a10d7f0606222d990d40cd49/analysis/1399298943/

Grizzly Adam:
Maybe .......................................!............?

Deep inside the forest
Is a door into another land
Here is our life and home
We are staying, here forever
In the beauty of this place all alone
We keep on hoping

Maybe
There's a world where we don't have to run
And maybe
There's a time we'll call our own
Livin' free in harmony and majesty
Take me ho-ome
Take me home


Walkin' through the land
Where every living thing is beautiful
Why does it have to end
We are calling, oh so sadly
On the whispers of the wind
As we send a dying message

Maybe
There's a world where we don't have to run
Maybe
There's a time we'll call our own
Livin' free in harmony and majesty
Take me home
Take me home

Maybe
There's a world where we don't have to run
Maybe
There's a time we'll call our own
Livin' free in harmony and majesty
Take me home
Take me home

(Maybe)
Maybe there's a world where we don't have to run
Maybe
There's a time we'll call our own
Livin' free in harmony and majesty
Take me home
Take me home (....fade)

5/04/2014

PHISHING SCAM !
Subject: The hottest sex positions in the world from:
wonder-save.de (IP: 46.137.116.197)



SPAM - SCAM - PHISHING DOMAIN
(MAIL THROUGH sexpositions@load-next.com)

http://www.wonder-save.de/
  • https://www.virustotal.com/de/url/4cbee3944f626152a7b0e565989dfcdfa97128d9e1661e8b2f881544bdcf38a7/analysis/1399057180/
HTML=LOOOOOOOLLL (Rattenscharfe Amateute am laufenden Band)
  • https://www.virustotal.com/de/file/d079714ab2586e4eb1d64bdea7ea0904160f2c848b0cb84b1c4040e82f79e501/analysis/1399057765/


BitDefender DOMAIN information: "This URL domain/host was seen to host badware at some point in time"


DOMAIN BLACKLISTED AT:
1) WOT
  • https://www.mywot.com/en/scorecard/wonder-save.de
2) SURBL
  • http://www.surbl.org/lists
3) JoeWein
  • http://www.joewein.net/
ADDITIONAL LINK:
http://www.wonder-save.de/o/e181067801c9b41237c8ca23126a2754c00befbb41d019e0470c71483874f92d
  • https://www.virustotal.com/de/url/2a9d116e843f5d5ca49d2b1e8fecb2be80998c6d79b9fccfeacd62a13a0f4ee3/analysis/1399063964/
HTMLSRC
  • https://www.virustotal.com/de/file/b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b/analysis/1398895856/
REDIRECTION TO --->
http://www.medusa.mx/open/e181067801c9b41237c8ca23126a2754c00befbb41d019e0470c71483874f92d
  • https://www.virustotal.com/de/url/d8053385191d602cccc3bde8afc22a3f99814f27d239f74787787b55b110a46f/analysis/
HTMLSRC
  • https://www.virustotal.com/de/file/b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b/analysis/1398895856/
DOMAIN:
http://www.medusa.mx/
  • https://www.virustotal.com/de/url/a451ede892082c712db5d49ed9152ed9bb0dd59aad190acb4be3d4d1320b8bfc/analysis/1399064361/
IP:
http://176.34.253.56/
  • https://www.virustotal.com/de/url/d4999bea2206837dff08b433a4c099eb794b7f1e3c5aafb7cad21895a2382f86/analysis/1399065373/
  • https://www.virustotal.com/de/ip-address/176.34.253.56/information/
REDIRECTS TO --->
http://newsletterabo.com/
  • https://www.virustotal.com/de/url/53fb33f8aea6cfadcd5fcaea7cf34509d2e95721acefa4058490a024d37eb9bd/analysis/1399064949/
IP:
http://62.129.143.124/
  • https://www.virustotal.com/de/url/753211dc1d21447d75875e36d3dd36c195078e99d32c3039c3dbee0232c96cd6/analysis/1399066574/
  • https://www.virustotal.com/de/ip-address/62.129.143.124/information/
LISTED AT SPAMHAUS (SBL):
  • http://www.spamhaus.org/query/bl?ip=62.129.143.124
Some 5000 SPAMVERTIZED DOMAINS ARE hosted HERE:
  • http://www.spamhaus.org/sbl/query/SBL112409
WEB-REP: POOR
EMAIL-REP: POOR
  • http://www.senderbase.org/lookup/?search_string=62.129.143.124
HTMLSRC
  • https://www.virustotal.com/de/file/ed3d4bf96a6e2c0c0f9ac7b27701b8dbab3fbfeb8078a3b4a847c1a797d8cd6d/analysis/1399064611/
SEE AS WELL:
  • http://sitecheck.sucuri.net/results/www.medusa.mx
  • http://sitecheck.sucuri.net/results/newsletterabo.com
-----------------------

MAIL SENT THROUGH:
http://load-next.com/
  • https://www.virustotal.com/de/url/7ac028fb0869d91755fb1a260da32b7189872856761e98b271bbf7c54283b670/analysis/1399061768/
  • https://www.virustotal.com/de/file/989e7a7c0680624b684c78468a1a1909c98a96dbce68c3a6d9a7d9122314aceb/analysis/1399061565/
  • https://www.virustotal.com/de/file/4ee70fe07827224c29f73047c71569c8fe740b370506cdd8b13e203a0ea5244d/analysis/1399061582/
IP:
http://95.130.125.232/ (AUSTRIA)
  • https://www.virustotal.com/de/url/e75688860b8f4224a5c62a7bfdb9c424a7a1e97e237eb40730d991c7d7e2ea42/analysis/1399063376/
  • https://www.virustotal.com/de/ip-address/95.130.125.232/information/
Fwd/Rev DNS Match: NO
  • http://www.senderbase.org/lookup/?search_string=95.130.125.232
-----------------------

IP:
http://46.137.116.197/
  • https://www.virustotal.com/de/url/1475cbe1f128f13cfbc44a6ef054af0e4edbfe87b1a881fcf912045eb62ab857/analysis/1399059664/
  • https://www.virustotal.com/de/ip-address/46.137.116.197/information/

5/02/2014

www.my-lifespan.com
----------------------------------
Spying DOMAIN
(Maxmind geoip check)

IP: 74.220.215.216 from Provo, UTAH


POTENTIALLY MALICIOUS WEBDOMAIN
SPYWARE (Maxmind geoip check)
SUSPICIOUS MEDICATIONS ONLINE ORDER


DOMAIN: http://www.my-lifespan.com/
  • https://www.virustotal.com/de/url/6ca77e2af62f1dda5906d724ab55f617e380a7298a531e54a57b7fac999ca18d/analysis/1399044590/
HTML
  • https://www.virustotal.com/de/file/5784dd2f9da24a1c7dea8a90a7f953d0befced6fe23f684fcadd49abdfd680c5/analysis/1399045056/
---> LINKS TO FOLLOWING Mal. DOMAINS:
http://b.scorecardresearch.com/
  • https://www.virustotal.com/de/url/bc910cfb21a188032f8b808b5f73318ecfc8e9a67fb579a3aea8699a5fe57232/analysis/1399045283/
http://extremetracking.com/
  • https://www.virustotal.com/de/url/0783c2061f219702786615d551d76c21afe676a2c287e7c94ecc54044eb8cc08/analysis/1399045356/
---------------------------
ET POLICY Maxmind geoip check to /app/geoip.js
  • https://urlquery.net/report.php?id=1399044577915
  • https://urlquery.net/report.php?id=1399044573117
  • https://urlquery.net/report.php?id=1399044572505
  • https://urlquery.net/report.php?id=1399044582830
  • https://urlquery.net/report.php?id=1399045795165
---------------------------
IP:
http://74.220.215.216/
  • https://www.virustotal.com/de/url/d60fd473a3e21ced99fef2606307e654d73ab75c71c98e031ac40340afc9e8af/analysis/1399046474/
  • https://www.virustotal.com/de/ip-address/74.220.215.216/information/
BHA: 2
  • https://www.projecthoneypot.org/ip_74.220.215.216
---------------------------

SEE ALSO:
  • http://www.UnmaskParasites.com/security-report/?page=www.my-lifespan.com
 
---------------------------

OTHER SUSPICIOUS LINKS TAGGES WITH MAXMIND FROM THIS DOMAIN:
http://www.my-lifespan.com/acarbose.html
http://www.my-lifespan.com/accupril.html
http://www.my-lifespan.com/aciphex.html
http://www.my-lifespan.com/actos.html
http://www.my-lifespan.com/acyclovir.html
http://www.my-lifespan.com/adalat.html
http://www.my-lifespan.com/adamantan.html
http://www.my-lifespan.com/aerius.html
http://www.my-lifespan.com/alendronate.html
http://www.my-lifespan.com/allegra.html
http://www.my-lifespan.com/allopurinol.html
http://www.my-lifespan.com/amantadine.html
http://www.my-lifespan.com/amaryl.html
http://www.my-lifespan.com/aminoguanidine.html
http://www.my-lifespan.com/amitriptyline.html
http://www.my-lifespan.com/arava.html
http://www.my-lifespan.com/aredia.html
http://www.my-lifespan.com/aricept.html
http://www.my-lifespan.com/arimidex.html
http://www.my-lifespan.com/article-148.html
http://www.my-lifespan.com/article-162.html
http://www.my-lifespan.com/articles.php
http://www.my-lifespan.com/astragalosideiv.html
http://www.my-lifespan.com/atorvastatin.html
http://www.my-lifespan.com/augmentin.html
http://www.my-lifespan.com/avapro.html
http://www.my-lifespan.com/avastin.html
http://www.my-lifespan.com/avemarimmunebooster.html
http://www.my-lifespan.com/azarga.html
http://www.my-lifespan.com/azopt.html
http://www.my-lifespan.com/b_vitamincomplex.html
http://www.my-lifespan.com/b_vitamincomplexforte.html
http://www.my-lifespan.com/b6vitamin.html
http://www.my-lifespan.com/benicar.html
http://www.my-lifespan.com/boniva.html
http://www.my-lifespan.com/bromocriptine.html
http://www.my-lifespan.com/burdockrootoil.html
http://www.my-lifespan.com/caffeinecomplex.html
http://www.my-lifespan.com/calcitrio.html
http://www.my-lifespan.com/campto.html
http://www.my-lifespan.com/casodex.html
http://www.my-lifespan.com/cavinton.html
http://www.my-lifespan.com/centrophenoxine.html
http://www.my-lifespan.com/cialis.html
http://www.my-lifespan.com/ciprobay.html
http://www.my-lifespan.com/climagest.html
http://www.my-lifespan.com/clomid.html
http://www.my-lifespan.com/clotrimazolebifonazole.html
http://www.my-lifespan.com/coaxil.html
http://www.my-lifespan.com/coenzymeq10.html
http://www.my-lifespan.com/combivir.html
http://www.my-lifespan.com/competact.html
http://www.my-lifespan.com/comtan.html
http://www.my-lifespan.com/contact.php
http://www.my-lifespan.com/coverex.html
http://www.my-lifespan.com/coversyl.html
http://www.my-lifespan.com/cozaar.html
http://www.my-lifespan.com/crestor.html
http://www.my-lifespan.com/cycloastragenolta_65activesubstance.html
http://www.my-lifespan.com/d3vitamin.html
http://www.my-lifespan.com/depakote.html
http://www.my-lifespan.com/depo_medrol.html
http://www.my-lifespan.com/deprenyl.html
http://www.my-lifespan.com/diabenol.html
http://www.my-lifespan.com/diflucan.html
http://www.my-lifespan.com/disease-1.html
http://www.my-lifespan.com/disease-10.html
http://www.my-lifespan.com/disease-11.html
http://www.my-lifespan.com/disease-12.html
http://www.my-lifespan.com/disease-14.html
http://www.my-lifespan.com/disease-15.html
http://www.my-lifespan.com/disease-16.html
http://www.my-lifespan.com/disease-17.html
http://www.my-lifespan.com/disease-18.html
http://www.my-lifespan.com/disease-19.html
http://www.my-lifespan.com/disease-2.html
http://www.my-lifespan.com/disease-20.html
http://www.my-lifespan.com/disease-22.html
http://www.my-lifespan.com/disease-23.html
http://www.my-lifespan.com/disease-25.html
http://www.my-lifespan.com/disease-26.html
http://www.my-lifespan.com/disease-27.html
http://www.my-lifespan.com/disease-28.html
http://www.my-lifespan.com/disease-29.html
http://www.my-lifespan.com/disease-3.html
http://www.my-lifespan.com/disease-31.html
http://www.my-lifespan.com/disease-32.html
http://www.my-lifespan.com/disease-35.html
http://www.my-lifespan.com/disease-36.html
http://www.my-lifespan.com/disease-39.html
http://www.my-lifespan.com/disease-4.html
http://www.my-lifespan.com/disease-46.html
http://www.my-lifespan.com/disease-47.html
http://www.my-lifespan.com/disease-48.html
http://www.my-lifespan.com/disease-49.html
http://www.my-lifespan.com/disease-5.html
http://www.my-lifespan.com/disease-51.html
http://www.my-lifespan.com/disease-56.html
http://www.my-lifespan.com/disease-57.html
http://www.my-lifespan.com/disease-58.html
http://www.my-lifespan.com/disease-59.html
http://www.my-lifespan.com/disease-6.html
http://www.my-lifespan.com/disease-8.html
http://www.my-lifespan.com/disease-9.html
http://www.my-lifespan.com/doxycycline.html
http://www.my-lifespan.com/echinaceavitc1000zinc.html
http://www.my-lifespan.com/effexor.html
http://www.my-lifespan.com/eldepryl.html
http://www.my-lifespan.com/eulexin.html
http://www.my-lifespan.com/evista.html
http://www.my-lifespan.com/evitamin.html
http://www.my-lifespan.com/exelon.html
http://www.my-lifespan.com/fareston.html
http://www.my-lifespan.com/fatburner.html
http://www.my-lifespan.com/femara.html
http://www.my-lifespan.com/fishoil.html
http://www.my-lifespan.com/flomax.html
http://www.my-lifespan.com/fluconazole.html
http://www.my-lifespan.com/folicacid.html
http://www.my-lifespan.com/fosamax.html
http://www.my-lifespan.com/galvus.html
http://www.my-lifespan.com/gleevecglivec.html
http://www.my-lifespan.com/glucobay.html
http://www.my-lifespan.com/glucobene.html
http://www.my-lifespan.com/gluconorm.html
http://www.my-lifespan.com/glucophageglucophagexr.html
http://www.my-lifespan.com/ibuprofen.html
http://www.my-lifespan.com/imatinib.html
http://www.my-lifespan.com/img/banner-acd.jpg
http://www.my-lifespan.com/img/clouds.gif
http://www.my-lifespan.com/img/dot.gif
http://www.my-lifespan.com/img/icon-blog.png
http://www.my-lifespan.com/img/icon-facebook.png
http://www.my-lifespan.com/img/logo.gif
http://www.my-lifespan.com/img/news/news-148.jpg
http://www.my-lifespan.com/img/news/news-162.jpg
http://www.my-lifespan.com/img/news/news-168.jpg
http://www.my-lifespan.com/img/news/news-169.jpg
http://www.my-lifespan.com/img/news/news-170.jpg
http://www.my-lifespan.com/img/news/news-171.jpg
http://www.my-lifespan.com/img/phone-title.gif
http://www.my-lifespan.com/img/products/prod-108.jpg
http://www.my-lifespan.com/img/products/prod-26.jpg
http://www.my-lifespan.com/img/products/prod-272.jpg
http://www.my-lifespan.com/img/products/prod-33.jpg
http://www.my-lifespan.com/img/products/prod-35.jpg
http://www.my-lifespan.com/img/products/prod-72.jpg
http://www.my-lifespan.com/img/visa.gif
http://www.my-lifespan.com/imigran.html
http://www.my-lifespan.com/imunovir.html
http://www.my-lifespan.com/inulin.html
http://www.my-lifespan.com/iodideki.html
http://www.my-lifespan.com/iodinewater.html
http://www.my-lifespan.com/iressa.html
http://www.my-lifespan.com/isoprinosine.html
http://www.my-lifespan.com/janumet.html
http://www.my-lifespan.com/jumex.html
http://www.my-lifespan.com/kaletra.html
http://www.my-lifespan.com/lamisil.html
http://www.my-lifespan.com/led.css
http://www.my-lifespan.com/lescol.html
http://www.my-lifespan.com/leuzearoot.html
http://www.my-lifespan.com/levaquinlevofloxacin.html
http://www.my-lifespan.com/lifeexendingkit.html
http://www.my-lifespan.com/lipitor.html
http://www.my-lifespan.com/lipoicacid.html
http://www.my-lifespan.com/lotensin.html
http://www.my-lifespan.com/macavibe.html
http://www.my-lifespan.com/madopar.html
http://www.my-lifespan.com/megace.html
http://www.my-lifespan.com/melatonin.html
http://www.my-lifespan.com/memantine.html
http://www.my-lifespan.com/metformin.html
http://www.my-lifespan.com/metoprolol.html
http://www.my-lifespan.com/milgamma.html
http://www.my-lifespan.com/mirapexin.html
http://www.my-lifespan.com/mobic.html
http://www.my-lifespan.com/movalis.html
http://www.my-lifespan.com/mumijomumio.html
http://www.my-lifespan.com/nadh.html
http://www.my-lifespan.com/neupro.html
http://www.my-lifespan.com/news.php
http://www.my-lifespan.com/news-168.html
http://www.my-lifespan.com/news-169.html
http://www.my-lifespan.com/news-170.html
http://www.my-lifespan.com/news-171.html
http://www.my-lifespan.com/nexium.html
http://www.my-lifespan.com/nizoral.html
http://www.my-lifespan.com/nolvadex.html
http://www.my-lifespan.com/nootropil.html
http://www.my-lifespan.com/nootropyl.html
http://www.my-lifespan.com/norvasc.html
http://www.my-lifespan.com/orungal.html
http://www.my-lifespan.com/oseltamivir.html
http://www.my-lifespan.com/pantocrin.html
http://www.my-lifespan.com/pikamilonpicamilon.html
http://www.my-lifespan.com/piracetam.html
http://www.my-lifespan.com/plavix.html
http://www.my-lifespan.com/precose.html
http://www.my-lifespan.com/products.php
http://www.my-lifespan.com/proscar.html
http://www.my-lifespan.com/pumpkinseedoil.html
http://www.my-lifespan.com/raloxifene.html
http://www.my-lifespan.com/redwinehighinresveratrol.html
http://www.my-lifespan.com/resveratrol.html
http://www.my-lifespan.com/revalidcapsules.html
http://www.my-lifespan.com/revalidcream.html
http://www.my-lifespan.com/revalidhairtonic.html
http://www.my-lifespan.com/revalidshampooandconditioner.html
http://www.my-lifespan.com/reyataz.html
http://www.my-lifespan.com/rhodiolaroot.html
http://www.my-lifespan.com/rhodiolatablets.html
http://www.my-lifespan.com/rosuvastatin.html
http://www.my-lifespan.com/rutin.html
http://www.my-lifespan.com/schisandra.html
http://www.my-lifespan.com/sea_buckthorn.html
http://www.my-lifespan.com/selegilin.html
http://www.my-lifespan.com/selenium.html
http://www.my-lifespan.com/seroquel.html
http://www.my-lifespan.com/sinemet.html
http://www.my-lifespan.com/singulair.html
http://www.my-lifespan.com/sporanox.html
http://www.my-lifespan.com/src
http://www.my-lifespan.com/stablon.html
http://www.my-lifespan.com/sustiva.html
http://www.my-lifespan.com/tamiflu.html
http://www.my-lifespan.com/tamoxifen.html
http://www.my-lifespan.com/tasmar.html
http://www.my-lifespan.com/telfast.html
http://www.my-lifespan.com/terms.php
http://www.my-lifespan.com/thiogammalipoicacid.html
http://www.my-lifespan.com/tolcapone.html
http://www.my-lifespan.com/topamax.html
http://www.my-lifespan.com/tritico.html
http://www.my-lifespan.com/truvada.html
http://www.my-lifespan.com/valdoxan.html
http://www.my-lifespan.com/vepesid.html
http://www.my-lifespan.com/vfendvoriconazole.html
http://www.my-lifespan.com/viagra.html
http://www.my-lifespan.com/vinpocetine.html
http://www.my-lifespan.com/vinpotropile.html
http://www.my-lifespan.com/viread.html
http://www.my-lifespan.com/xalatan.html
http://www.my-lifespan.com/xanthinolnicotinate.html
http://www.my-lifespan.com/xeloda.html
http://www.my-lifespan.com/xenical.html
http://www.my-lifespan.com/xylometazolineotrivin.html
http://www.my-lifespan.com/zetia.html
http://www.my-lifespan.com/ziagen.html
http://www.my-lifespan.com/zinczn.html
http://www.my-lifespan.com/zithromax.html
http://www.my-lifespan.com/zocor.html
http://www.my-lifespan.com/zofran.html
http://www.my-lifespan.com/zovirax.html
http://www.my-lifespan.com/zyprexa.html
http://www.my-lifespan.com/zyrtec.html

4/30/2014

Officer Down Memorial Post (10-00):
Christopher A. Upton (37)
killed on March 5th 2010
@ the Oconee National Forest, Georgia, United States

A USDA Forest Service Law Enforcement officer was fatally killed on, March 5th 2010 at the Ocmulgee Bluff Equestrian Recreation Area on the Oconee Ranger District of the Chattahoochee-Oconee National Forest in Jasper County, Georgia.

Christopher Upton
Christopher Arby Upton, 37, of Monroe, Georgia, was on a routine patrol in the area about 11 p.m., where 2 hunters were hunting coyotes with a high-powered rifle equipped with night vision and apparently mistook the officer for game. After the shooting, the hunters dialed 911 and reported a hunting incident.


“This is a tragic incident where the loss of a federal officer’s life could have been avoided,” said Steven Ruppert, Special Agent-in-Charge for the Southern Region of the Forest Service.

“The standard procedure for a hunter is to identify your target and then shoot,” said Homer Bryson, Law Enforcement Colonel for Georgia Department of Natural Resources (DNR) Wildlife Resources Division (WRD). “The hunter failed to do this, and mistook the officer for game. He then shot and instantly killed the officer.”

The shooter, Norman Clinton Hale, 40, McDonough, Ga., and an observer, Clifford Allen McGouirk, 41, of Jackson, Georgia, were hunting coyotes.

While hunting illegally, Hale discharged his rifle, striking Upton in the face. At the sentencing hearing, the government offered expert evidence that had Mr. Hale taken appropriate action, such as calling for emergency services and applying pressure to Officer Upton’s wound, Officer Upton could have survived.

Oconee National Forest
Instead, Mr. Hale waited one hour and 32 minutes before calling 911 and offered no aid to Officer Upton. Mr. Hale asked the other persons present to just leave and not report the incident. When they refused to do so, Mr. Hale then suggested they get four wheelers and drive them to where Officer Upton was and tell the police that they found Officer Upton’s body in this condition. Hale was sentenced on March 22nd 2012 before the Judge Marc T. Treadwell to to 60 months’ imprisonment.

Upton, a four-year veteran of the Forest Service, had previously worked as a game warden for the Department of Defense, U.S. Marine Corps, at Beaufort, South Carolina, and as a conservation officer, game warden and pilot with the Florida Fish and Wildlife Commission. He is survived by his wife, Jessica, and a 4-year-old daughter, Annabelle.

SOURCE(s): http://www.woodsnwater.net/ & http://www.odmp.org/officer/20315-officer-christopher-a-upton

down.360safe.com with Win32/Trojan.Genome:
MALICIOUS DOMAIN FROM CHINA
IP: 180.153.229.17 Shanghai & IP: 220.181.150.209 Beijing




CHINESE (Shanghai & Beijing)
MALWARE DOMAIN: & SUSPICIOUS FILE
DOMAIN + SUBDOMAIN: BLACKLISTED @ MalwareDomainList

http://360safe.com/
  • https://www.virustotal.com/de/url/b3e16d689af0dd0c1c7f91b3bb7d3b1945f8a38b0f944713c0f87244ee2baee0/analysis/
SUBDOMAIN:
http://down.360safe.com/
  • https://www.virustotal.com/de/url/a0ded28ef8f22d505636819bb2b8bba88412c8157ca3ac4723a5a34fe994cb73/analysis/1398878350/
SUSPICIOUS FILE LINK:
http://down.360safe.com/setup.exe
  • https://www.virustotal.com/de/url/659adefa8017920149ed69bc009b0bc8be1ba53a02a589346392cec09cf144f6/analysis/1398878498/
SUSPICIOUS FILE:
  • https://www.virustotal.com/de/file/1f99e9e6e5bb5444a6010219b44837c89aab951c177da702d771e91dcbfc97d2/analysis/
IP(s):
http://180.153.229.17/
  • https://www.virustotal.com/de/url/67118050119382d41608cd53e67db70664b09dcd75fe9ad47994be1228b77e9b/analysis/1398878751/
  • https://www.virustotal.com/de/ip-address/180.153.229.17/information/
http://220.181.150.209/
  • https://www.virustotal.com/de/url/d4968e75e9802ef631320da4bb1c4c5c5766b28fedb5a90160a18ca79f70b2cf/analysis/1398878962/
  • https://www.virustotal.com/de/ip-address/220.181.150.209/information/
SEE ALSO:
  • http://urlquery.net/report.php?id=1398876496772
  • http://quttera.com/detailed_report/down.360safe.com

4/29/2014

aspiderm2m.net
POTENTIALLY MALICIOUS DOMAIN
PUA.PHISHING.BANK or Malware.HTML.Iframe (Paranoid Heuristics)
IP: 66.155.9.238

San Francisco, UNITED STATES



POTENTIALLY MALICIOUS DOMAIN:



PUA.PHISHING.BANK 
OR
Malware.HTML.Iframe (Paranoid Heuristics)
http://www.aspiderm2m.net/
  • https://www.virustotal.com/de/url/1cd0a5ab886c9f5c8c5f77487ab7b3d3de4195c916c27be624ca0d9d8988321b/analysis/1398796394/
---> REDIRECTS TO:
http://aspiderm2m.net/
  • https://www.virustotal.com/de/url/f8a2831d9c9f5f88e68f3f8ab67e88fbf8f8073e928d407561b9134f946652fd/analysis/1398796533/
PUA.PHISHING.BANK OR Malware.HTML.Iframe (Paranoid Heuristics)
  • https://www.virustotal.com/de/file/3f247ec48488c107deed757f8e4ea3c7bf5f7d2d0e48567a75745a69b2e3234e/analysis/1398796207/
  • http://virusscan.jotti.org/de/scanresult/7bd9d4594300b12e875d0bf9bffb8be09d384363

IP:
http://66.155.9.238/
  • https://www.virustotal.com/de/url/1a20d9bd80e3f59756f980204479ead147fa25471de76a18df69cea22ecd66d3/analysis/1398797120/
  • https://www.virustotal.com/de/ip-address/66.155.9.238/information/
BHA: 1
  • https://www.projecthoneypot.org/ip_66.155.9.238
Fwd/Rev DNS Match: NO
  • http://www.senderbase.org/lookup/?search_string=66.155.9.238

Florida ONLINE CHILD PREDATORS 2011:

Joshua Jay Williamson (24) from Jacksonville
sentenced to 5 ½ years in federal prison for
extorting dozens of women on Facebook
and possession child porn


24-year-old Joshua Jay Williamson received the sentence on the 29th of November, 2012, in Jacksonville. Court documents say Williamson "hacked" in to the email and social networking site on FB of dozens of women between February 2011 and June 2011. Using the personal information he gathered, along with suggestive photos he would find online, and would then further demand the women to send him full nude and sexually explicit photos. He told them that if they did not comply, he would send provocative pictures to their email and Facebook contacts.



On May 19th, 2011 alone Williamson sent extortionate emails to about 75 women.

He attempted to hide his ID by using several IP Adresses and an anonymizer tool (like i.ex. Ghostsurf) but the Smartass should have known that he can be tracked down by authorities anyway.

Files with photos of personal information for more than 150 women were found on Williamson’s computer; 23 images and 31 videos of child pornography were also uncovered.

Williamson will spend 66 months in federal prison and further will serve 10 years of supervised release. He also has been registered as a sex offender and his CPU-Hardware were forfeited as well.

Many agencies, including the FBI, the FDLE (Florida Department of Law Enforcement) and the JSO (Jacksonville Sheriff's Office) were involved in the investigation.

SOURCE: http://www.wokv.com/

4/28/2014

CVE-2014-1776:

Microsoft Internet Explorer Use-After-Free Vulnerability
Being Actively Exploited
Vulnerability Note VU#222929

US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and could lead to the complete compromise of an affected system.


US-CERT recommends that users and administrators enable Microsoft EMET where possible and consider employing an alternative web browser until an official update is available.

For more details, please see:

http://www.kb.cert.org/vuls/id/222929

https://www.us-cert.gov/ncas/current-activity/2014/04/28/Microsoft-Internet-Explorer-Use-After-Free-Vulnerability-Being

PUA.JS.Obfus-7 @ pro-hackerz.blogspot.com
recently detected as a Potentially Malicious Blogspot
with a likely damaging Heap Spray Attempt



MALICIOUS & MALWARE BLOG:
http://pro-hackerz.blogspot.com/

  • https://www.virustotal.com/de/url/df11cd4c7eb26602db65645887663070ac8f682a8206ff185e76347e3f82917d/analysis/1398709316/

PUA.JS.Obfus-7

  • https://www.virustotal.com/de/file/60956bff3cc0bdb608beb77417d96c1a46ec531e9537504de4d27cc30e98c707/analysis/1398709404/
Likely Malicious Heap Spray Attempt
  • https://urlquery.net/report.php?id=1398709408204
  • https://urlquery.net/report.php?id=1398709393557
  • https://urlquery.net/report.php?id=1398709407940

SEE ALSO:
  • http://quttera.com/detailed_report/pro-hackerz.blogspot.com
SOME CODE :