Wednesday, April 10, 2013

New Spam Attack accounts for 62% of our spam!

A new spamming botnet seems to be on the scenes, distinguishing itself with an extremely high spam volume, a great diversity of email subjects, and an amazingly diverse collection of URLs, mostly hosted on compromised websites.

Four of the top six spam subjects in the past 36 hours came from this new botnet:
• Obama’s policies affecting unemployed
• Change your life in 60 seconds.
• Recently got a job offer?
• Have you ever considered working on the internet?

When we used the Malcovery Spam Data Mine to review the sending IP addresses, we found that these messages had come from more than 23,000 different IP addresses. Just for the “Obama’s policies” subject, we saw 296 unique URLs advertised just this morning before 8:00 AM! Here are some of the Top URLs for that spam message.

count                 machine                     path                      
38  www.ghostsquad.altervista.org          /cellchickengrahamwilliams/
36  rundeecke.bplaced.net                  /connectiondevicejamesbailey/
35  sungoldcoast.com                       /assistantelegantjasonedwards/
35  www.coloniasunidas.com                 /conflictarticlephilipwood/
35  www.cocheenminiatura.altervista.org    /arrestautumndanielhill/
34  protetyk.ovh.org                       /engineercorealanspencer/
33  www.ghostsquad.altervista.org          /cellchickencraigdavies/
32  guildrampage.com                       /besickendwaynemiller/
32  cuorebravo.com                         /armyeastkevinspencer/
31  www.curiosando.altervista.org          /clockconflictjohnking/
31  www.divorcecamp.com                   /equalatmospheregeoffreycooper/
31  6sejc.com                              /associatealliedadrianthomas/

When we check for other websites advertised in spam, JUST FOR SPAMMING IP ADDRESSES THAT SENT THE FOUR SUBJECTS ABOVE, and ONLY FOR THE PAST 36 hours, we find that 3,849 distinct URLs were spamvertised a total of 1,217,196 times – only counting the spam in our Spam Data Mine!

A great variety of subject lines were used in addition to the four top ones above. By “theme” there were:

Oprah and Celebrity subjects:

  • Oprah Winfrey Reveals That She Has A Sister Named Patricia
  • Kourtney & Kim Take NY
  • Oprah’s big secret: she has a sister
  • Oscar 2011: What To Expect
  • Ivanka Trump Has A Baby Bump
  • Ellen DeGeneres secret
  • Rapid-Fire Fitness: Katy Perry
  • Release Your Soul with Pamela Anderson
  • Your morning fashion and beauty report: Reese Witherspoon
  • Anne Hathaway find out how
Fitness subjects:
  • Fitness: Love the 30s!
  • Body and Soul women’s weight loss
  • Healthy Hollywood
  • Miracle Diet or Scam
  • Sorry, guys, these fitness classes aren’t for you
  • No workout, lose weight
  • Miracle or science?
  • Get fit
  • Women try to balance fitness, safety
  • No diet just weight loss
  • Workouts for Women
Silly “fwd” and “re” subjects:
  • Fwd: private
  • Fwd: hey
  • Fwd: question
  • Fwd: hello
  • Re: important
  • Re: hey
  • Fwd: deal
  • Fwd: ?
  • Fwd: information
  • Fwd: …
  • Fwd: business
  • Fwd: answer
  • Fwd: help
News Subjects:
  • Fox investigates claim
  • Fox News investigates: “Change your life in 60 seconds!”
  • Need some money? Fox News wants to help
  • BBC: Online giant Google, worth over 100 billion dollars..
  • Unemployed? Fox! Investigates.
  • TBS breaking news
Random number weight loss subjects:
  • She lost 54 lb in 3 weeks.
  • She lost 46 pounds in 3 weeks.
  • She lost 53 lbs in 3 weeks.
  • (etc.)
And there are still “Work at Home” scam versions, even though the URLs now take you to weight loss websites instead:

Home Maker Dad claims investigated by Fox
 Work from home Dad claims investigated by TBS
 Work from home Mom claims investigated by CNN USA
 Home-Maker Mom claims investigated by Fox!
 Work from home Mom claims investigated by Fox News
 Work from home Mother claims investigated by BBC
 Work at home Mom claims investigated by TBS
 Work-from-home Dad claims investigated by CNN
 Stay-at-home Mom claims investigated by Yahoo!
 Stay home Mother claims investigated by TBS
 Home-Maker Dad claims investigated by CNN USA
 Homemaker Mom claims investigated by BBC
 Stay home Father claims investigated by Fox
 Stay home Mom claims investigated by CNN
 Stay at home Mother claims investigated by Fox!
 Stay home Dad claims investigated by CNN!
 Work-at-home Dad claims investigated by CNN
 Stay home Mom claims investigated by BBC
 Work-at-home Mom claims investigated by Fox!
 Work-at-home Mom claims investigated by CNN!
 Work-from-home Mom claims investigated by BBC
 Work at home Mother claims investigated by BBC USA
 Work-at-home Mom claims investigated by BBC USA
 Stay at home Mom claims investigated by Fox!
 Homemaker Mother claims investigated by CNN
 Work at home Mother claims investigated by ITV
 Homemaker Father claims investigated by CNN!
 Stay at home Mother claims investigated by TBS
 Work-at-home Dad claims investigated by Fox
 Home Maker Mom claims investigated by ITV
 Home Maker Father claims investigated by Fox
 Work-at-home Dad claims investigated by BBC USA
 Homemaker Mother claims investigated by CNN USA
 Work at home Dad claims investigated by Fox News
 Work from home Dad claims investigated by BBC USA
 Home-Maker Father claims investigated by Fox News
 Home-Maker Mother claims investigated by Fox News
What do those pages do when you visit them?

On Monday morning, they sent you to a website with information about a new “Work at Home” program that you could learn about for the low low low price of $100.

But today, they are sending you to a page that proclaims:

Breakthrough Diet Exposed: Celebrity Doctor Uncovers The “Holy Grail of Weight Loss”

This is an on-going campaign that has recently advertised various miracle weight loss products including Raspberry Drops, Green Coffee Bean Extract, and now, “Garcinia Cambogia Featured on TV”

The method for doing this is the use a tiny javascript to set the “parent location href” equal to com-independentvoice.net (or one of many other redirector pages) and passing an “indexer.php?a=225783&c=job” parameter along with the new address. This causes the browser to go to that page and look up the job offer, which displays the weight loss miracle of the day by forwarding the visitor to the path “/diet/GarciniaCambogiaDiet/”

Trying to leave the website generates pop-up messages like these:

Several great clues that these guys are not legitimate including:

The domain is registered by UKRNames.com (Ukrainian Domain Name Registrar of Ill Repute)

The IP address, 201.182.92.166, is hosted at AS52284, Panamaserver.com, claiming to be in Panama.

That IP is also “naturaldietforyou1.com” as well as:

Burnfatandgetflatstomach1.com
Rapidfatlossnatural1.com
Getbestdietsecret1.com
Howtoloseweightquicklyexercises.com
Howtoloseweightfastwithexerciseanddiet.com
Easistnaturalwaytoloseweight.com
Com-work24.net
Finance-reports.com-work24.net
Com-newslocal6.net
Finance-reports.com-newslocal6.net
Com-cbc.net
Finance-reports.com-cbc.net
Finance-reports.com-thestar.net
Com-world-jobnews.net
Com-globejobnews.net
Com-dailylocalnews.net
Finance-reports.com-cnnnewsnet
Com-independentnews.net
Alternativenewsdaily.net

Just picking one of those addresses, com-cnnnews.net was also hosted at:
31.184.192.35
31.184.192.36
81.17.23.40
142.0.72.101
142.0.72.103
176.9.208.121
176.9.208.122
176.9.218.182
185.12.45.102
185.12.45.107
199.91.174.71
199.91.174.72
199.182.168.139
201.182.92.166

More subjects:

 Need some money? CNN! wants to help
 Fox investigates claim
 Fox News investigates: "Change your life in 60 seconds!"
 Need some money? Fox News wants to help
 BBC: Online giant Google, worth over 100 billion dollars..
 Unemployed? Fox! investigates.
 TBS breaking news
 Lost your job? Fox News wants to help.
 CNN! investigates "impossible" claims.
 Lost your job? BBC USA wants to help.
 CNN! investigates: "Change your life in 60 seconds!"
 CNN investigates: "Change your life in 60 seconds!"
 Fox!: Online giant Google, worth over 100 billion dollars..
 BBC investigates latest claim.
 BBC investigates claim
 Fox! breaking news
 CNN investigates latest claim.
 ITV investigates claim
 ITV investigates: "Change your life in 60 seconds!"
 CNN!: Breaking news!
 CNN USA investigates: "Change your life in 60 seconds!"
 Unemployed? CNN USA investigates.
 Lost your job? BBC wants to know.
 Need some money? TBS wants to help
 Unemployed? Yahoo! investigates.
 Lost your job? CNN USA wants to know.
 ITV investigates latest claim.
 Yahoo! investigates: "Change your life in 60 seconds!"
 TBS: Online giant Google, worth over 100 billion dollars..
 Lost your job? CNN wants to know.
 Lost your job? TBS wants to help.
 CNN!: Online giant Google, worth over 100 billion dollars..
 Lost your job? TBS wants to know.
 Lost your job? CNN! wants to help.
 Lost your job? CNN! wants to know.
 Fox!: Breaking news!
 Unemployed? Fox News investigates.
 Lost your job? ITV wants to know.
 Unemployed? TBS investigates.
 Need some money? CNN USA wants to help
 Lost your job? CNN USA wants to help.
 Lost your job? Fox! wants to help.
 CNN USA investigates claim
 Yahoo! investigates latest claim.
 Fox! investigates claim
 CNN: Breaking news!
 Lost your job? Yahoo! wants to know.
 BBC USA investigates "impossible" claims.
 Yahoo!: Online giant Google, worth over 100 billion dollars..
 Lost your job? Fox! wants to know.
 Fox investigates: "Change your life in 60 seconds!"
 TBS: Breaking news!
 Unemployed? CNN investigates.
 Yahoo! breaking news
 Need some money? CNN wants to help
 Fox! investigates "impossible" claims.
 ITV breaking news
 Lost your job? Fox News wants to know.
 Unemployed? ITV investigates.
 BBC USA investigates claim
 CNN USA investigates latest claim.
 CNN investigates "impossible" claims.
 Fox breaking news
 Fox: Online giant Google, worth over 100 billion dollars..
 Lost your job? Fox wants to know.
 ITV: Online giant Google, worth over 100 billion dollars..
 Yahoo!: Breaking news!
 Need some money? Yahoo! wants to help
 BBC USA: Online giant Google, worth over 100 billion dollars..
 Lost your job? ITV wants to help.
 Need some money? Fox! wants to help
 Fox News: Breaking news!
 Fox News breaking news
 Fox News investigates latest claim.
 Yahoo! investigates claim
 Fox News: Online giant Google, worth over 100 billion dollars..
 Yahoo! investigates "impossible" claims.
 CNN USA: Breaking news!
 ITV: Breaking news!
 ITV investigates "impossible" claims.
 BBC USA investigates latest claim.
 CNN USA investigates "impossible" claims.
 CNN USA breaking news
 TBS investigates: "Change your life in 60 seconds!"
 BBC USA investigates: "Change your life in 60 seconds!"
 Fox investigates latest claim.
 BBC USA: Breaking news!
 BBC breaking news
 Unemployed? BBC investigates.
 TBS investigates claim
 TBS investigates latest claim.
 Need some money? BBC wants to help
 BBC: Breaking news!
 Need some money? ITV wants to help
 BBC USA breaking news
 Unemployed? CNN! investigates.
 CNN: Online giant Google, worth over 100 billion dollars..
 CNN breaking news
 Lost your job? CNN wants to help.
 Lost your job? BBC USA wants to know.
 Lost your job? Fox wants to help.
 Need some money? BBC USA wants to help
 CNN investigates claim
 Fox News investigates claim
 Lost your job? BBC wants to help.
 Fox! investigates: "Change your life in 60 seconds!"
 BBC investigates: "Change your life in 60 seconds!"
 Fox: Breaking news!
 TBS investigates "impossible" claims.
 CNN USA: Online giant Google, worth over 100 billion dollars..
 BBC investigates "impossible" claims.
 Fox! investigates latest claim.
 CNN! investigates latest claim.
 Unemployed? Fox investigates.
 Fox investigates "impossible" claims.
 Lost your job? Yahoo! wants to help.
 Need some money? Fox wants to help
 CNN! breaking news
 Unemployed? BBC USA investigates.
 Fox News investigates "impossible" claims.
 CNN! investigates claim


Work at home Dad claims investigated
 Rapid fire weight loss Salma Hayek
 Work-at-home Mom claims investigated
 Breaking news for Home Maker Father.
 Breaking news for Stay at home Dad.
 Breaking news for Home-Maker Father.
 Oprah Whinfrey Heads To Paris In Search Of The Perfect Wedding Gown!
 Breaking news for Home-Maker Mother.
 Breaking news for Work-at-home Mom.
 Ellen DeGeneres diet or scam?
 Salma Hayek diet or scam?
 weight loss Katy Perry
 Breaking news for Stay home Dad.
 Stay at home Mother claims investigated
 Breaking news for Stay home Father.
 Stay at home Father claims investigated
 Release Your Soul with Anne Hathaway
 weight loss Madonna
 Breaking news for Work-at-home Dad.
 Ellen DeGeneres secret
 Rapid-Fire Fitness: Katy Perry
 Release Your Soul with Pamela Anderson
 Your morning fashion and beauty report: Reese Witherspoon
 Anne Hathaway find out how
 Work from home Mom claims investigated
 Breaking news for Work at home Mom.
 Rachel Ray says
 Britney Spears Going Harder, More Urgent
 Pamela Anderson try to balance fitness, safety
 Check out how Natalie Portman did it
 Oprah Whinfrey try to balance fitness, safety
 Breaking news for Work from home Father.
 Ellen DeGeneres weight loss
 Breaking news for Homemaker Father.
 Homemaker Dad claims investigated