The primary malware was hosted on eleven different patterns of websites.
Here are the sites we saw in spam today pointing to malware sites:
e-card.exe malware
These spam messages all had the subject: You've received a greeting ecard
As of this writing, this is the least detectable of today's malware messages, with only 9 of 36 anti-virus products detecting the malware at VirusTotal.com.
http://emilimport.com/e-card.exe
http://leschevaliersdemines.be/e-card.exe
http://www.mylady.st/e-card.exe
/1.html video sites - downloads install.exe
Twenty-eight different web sites:
http://83.98.189.245/1.html
http://barbara.ines.ro/1.html
http://butterflycreekcreations.com/1.html
http://czpha.unas.cz/1.html
http://dps-varna.com/1.html
http://finger.czweb.org/1.html
http://gibsoncreek.ca/1.html
http://ikarosdesign.com/1.html
http://kokom.sk/1.html
http://longislandcriminallawyers.com/1.html
http://medicine.bg/1.html
http://metalground.net/1.html
http://moldovanova.com/1.html
http://rexmunyonphotography.com/1.html
http://sebai.edu.sa/1.html
http://siliconebody.com/1.html
http://spiral.sk/1.html
http://sunriseautos.ca/1.html
http://svest.org/1.html
http://themeburn.com/1.html
http://villavbolgarii.ru/1.html
http://vodaksport.unas.cz/1.html
http://willsoncar.com/1.html
http://wow-vegetarian.com/1.html
http://www.4x4.co.rs/1.html
http://www.mahe.com.co/1.html
http://www.mobilzeit-daten.de/1.html
http://www.vo-software.de/1.html
157 subjects advertised those emails. These accounted for 7% of all spam.
"brainstorming" To Be Banned Under Equality And Diversity Rules
[audio] Catholic Church Condemns Metrosexuality
[audio] Church Group Offers Homosexual New Life In Closet
[audio] Mccain Vows To Withdraw All Troops From The U.S.
[video] Bush Tours America To Survey Damage Caused By His Disastrous Presidency
[video] Cindy Mccain Talks About Her Boobs
[video] Hulk Smashed
[video] Mccain Vows To Replace Secret Service With His Own Bare Fists
[video] The Real Iron Man
2008 Presidential Election Results Leaked
Al Qaeda Reports Declining Revenues in Fiscal '08
Aliens Abducted By Michael Jackson
All Baseball Players May Be Indicted For Steroid Abuse
Al-Qaeda Gets Nuke, Blows Themselves Up
And Now We Return To The Subject Of Jennifer Anistons Breasts
Angelina Jolie Pregnancy. 'it Was All A Hoax!'
Angelina Jolie Pregnancy.it Was All A Hoax!
Army Of Two, Dick Cheney And John Mccain Invade Iran
Army Relent On Shooting Live Pigs In Training Exercise - Will Shoot Illegal Immigrants Instead
Arnold Says im Gay Too!
Attack Of The Zombie Negroes: Dick Cheney
Barack Obama Caught In A Time Warp
Bearded Lady Gives Birth
Blair: Im Not Gay, Thats Just My Accent
Bodyguards Positioned Outside Jolies Vagina
Brave Suicide Bomber Survives Blast!
BREAKING news
British Penny Actually Worth More Than One Dollar. Watch the proof.
Britney Spears And Michael Jackson To Write Parenting Book
Britney Spears hot video (NEW!)
Britney Spears Revealed
Bulimia Not The Same As Being A Greedy Bastard, Say Doctors
Bush And Mccain Dance Ballet
Bush Claims He Has Supernatural Abilities
Bush Down to 8 Friends on Myspace
Bush Says He Still Believes Iraq War Was The Fun Thing To Do
Bush Sells Louisiana Back to the French
Bush To Rename The Patriot Act
Bush 'Troubled' by Gay Marriages. Declares San Francisco Part of 'Axis of Evil'
Cannibalism!........In The Usa
Children Admit To Being Little Shits. Video
China's General Secretary Replaced by More Photogenic Stand-In
Chinese Olympic Officials Finally Figure Out How to Stop Michael Phelps
Cristiano Ronaldo Disses Paris Hilton "um Louro Mudo Feio!"
Downloadable porno DVD's for free
Elvis is alive! Watch the proof.
Examiners Caught Downloading Grades From The Internet
Existence of Poor People A Surprise, Says Bush
Flush out excess pounds with Acai Berry Boom
For The Man Who Has Everything: Three Tits
Free porno DVD's to download
Fuck you.
Gay Bishop Was A Wrestling Pro
Gay Marriage Could Be Profitable
Gay Men Perceive Each Other As Homophobic
Gays Banned From Owning Pets In New York
George W Bush Slams Tony Blair
God Accepts Responsability for Hurricane Katrina
Gus Hiddink Heads For Gulag
Heather Mills Mccartney Arrested
Heather To Have Other Leg Removed
Hi [username]
Hillary Clinton Gets Night Job
Home Office To Deport Anyone With Iq Below 100
Ican To Shut Down Email Services World Wide
Illegal Immigrants Seize Control Of The U.S.
Iran Kicks America In The Nuts
Jessica Simpson Starts Doing It With Some Other Guy. Video.
Jesus Christ To Star In Next Series Of Batman
John Mccain "I Promise To Invade Your Vaginas."
John Mccain Denies Allegations That He Is A Politician
John Mccain Eats A Bug
John Mccain Kicks Lilly Ledbetter In The Crotch
John Mccain Selects Laura Bush As His Vice President
John McCain Takes the Olympic Gold in 'Gymnastics'
John Mccain Taps Osama Bin Laden As Running Mate
Jolie new naked video
Laika The Russian Space Dog, Returns To Earth
Madonnas Former Home Destroyed By Jesus
Martian Soil Fantastic For Growing Weed Says Nasa
Mccain - Iran Has Weapons Of Mass Destruction
Mccain And Bush To Dance In Puppet Show
McCain Endorses Bush For 3rd Term
Mccain Says Unsure If Obama A Secret Hippopotamus
Mccain Sex Tape Surfaces
Mccain Will Promote The Takeover Of America
McDonald's Happy Meals In San Francisco To Include Gay Marriage License
Michael Jackson Auctions Himself On Ebay!
Michael Jackson Feels A Little Prick
Michael Jackson is hermaphrodite. Watch the video.
Michael Jackson strikes again
Microsoft's AntiSpyware Tool Removes Internet Explorer
Mike Tyson To Fight Michael Jackson
Monsanto to genetically modify British Royal family
Naked Janet Jackson Video Goes Online
NASA to use Space Shuttles to Kill Birds
Nation Morns The Tragic Loss Of Britney Spears
nazi Toddlers Ruined My Birthday
new DVD movie they are original new
New Evidence Suggests That The President May Be Drinking Again
Obama Captures Osama
Obama Is Anorexic Over-Exerciser;
Obama is gay. Watch the Proof.
Old Man Dies Inside Paris Hilton
One Hot White Chick Injured in Tsunami Disaster
Oprah Winfrey Enters Race For The White House As Barack Obamas Running Mate.
Pamela Anderson Cheating On Tommy Lee And Seeing Barack Obama
Pamela Anderson Shouts, "i'm Gonna Remarry My One And Only True Love Tommy!"
Pamela Anderson Tommy Lee In New Sex Film Sensation On Abramovich Yacht
Paris Hilton Charges For Pussy
Paris Hilton Considered For Mother Teresa Role
Paris Hilton Infested With Cockroaches
Paris Hilton Initially Denies Having Inverted Nipples
Paris Hilton Is Going To Jail
Paris Hilton Lectures On Dickens And Dostoevsky
Paris Hilton To Operate New Atom Smasher
Paris Hilton Tosses Dwarf On The Street
Paris Hilton Wins Pulitzer Prize
Paris Hilton: I Will Give My Body To The Winner Of The French Open
Paul Mccartney Gets Back With Heather Shock
Pedicurist's Piranhas Chew Off Clients' Feet
Pitt and Jolie xxx home video
Polar Bear Finds Yoga Great For Flexibility, But Murder On The Balls
Poll: Is That Really Britney In The Sex Video
PopeWatch: Fox News Personally Confirms the Pope's Death
President Bush's iPod: The Complete Playlist
Rapper 50 Cent To Be John Mccains Choice For Vp
Release Of The Nancy Pelosi Sex Dvd Causes Mass Erectile Dysfunction In Us
Right To Own Guns Upheld
Ronald Reagan Prime Suspect In Bank Robbery
Rupaul: Ron Paul Is My Brother!
Sarah Jessica Parker Arrested For Gross Negligee
Sarkozy Carla Bruni Sex Film Shocker At Windsor Castle
Scarlett Johanssen nude video.
School Board Adopts Gay-Ass Uniform Policy
Senator John Mccain Wishes To Have Sex With Model Heidi Klum; Others
Sex With Robots. video.
Shocking Video Shows Spongebob And Gay Sex!
Spongebob Denies Reports That Hes Gay
Spongebob Squarepants Not Shrek's Father!
Steve Jobs Names God as Successor
Stock Markets Close As Global Earth World Planet International Buys All Shares
Switzerland To Be Devoured By Black Hole
Teenage Girl obviously Having Affair With Bat
The Antichrist Revealed! video.
The Beatles - Back Together Again
The Meat Wars: Jessica Simpson's Shirt Tees-Off Pam Anderson
Theodore Roosevelt Was A Gay Man
Tiger Woods Will Call Next Son Monkey
Ufos Sighted Over Uk
Unemployed To Be Used For Soup
Weekly top news
What the fuck???
Where Do Homosexuals Get All Their Energy
White Male Workers Banned In Britain
World Leaders Gather To Roast Mahmoud Ahmadinejad
Your girlfriend having sex. Watch the video ^)
/fullstory.html video sites - also downloads install.exe
These emails all used the subject line: CNN.com Daily Top 10, but there were only 125 copies - far less than 1% of our spam for the day, but still with many live distribution points.
While writing this entry, fifty-three live distribution sites
http://83.98.189.245/fullstory.html
http://anshi.com.ar/fullstory.html
http://artbazar.ro/fullstory.html
http://aventurasaladero.com.ar/fullstory.html
http://deome.net/fullstory.html
http://dps-varna.com/fullstory.html
http://efmpentathlon.org/fullstory.html
http://finger.czweb.org/fullstory.html
http://fotoberza.com/fullstory.html
http://frmkaynak.com/fullstory.html
http://gibsoncreek.ca/fullstory.html
http://hotelnoorla.com.au/fullstory.html
http://ikarosdesign.com/fullstory.html
http://imaginenaxos.com/fullstory.html
http://imw.wz.cz/fullstory.html
http://infofeed.ro/fullstory.html
http://ingyenkonyv.com/fullstory.html
http://kokom.sk/fullstory.html
http://movetothecloud.com/fullstory.html
http://nagyker.ingyenkonyv.com/fullstory.html
http://ncccmaor.ipower.com/fullstory.html
http://sanjustino.com.ar/fullstory.html
http://sexysanjusto.com.ar/fullstory.html
http://spudgraphics.com/fullstory.html
http://sunflowergraphics.net/fullstory.html
http://tirtaji.com/fullstory.html
http://web-grower.ru/fullstory.html
/base/mov.php ==> downloads name.avi.exe from 79.135.167.49
The messages in this group used the subject lines:
NEWS.
Weekly NEWS.
Daily news.
Your subscription.
http://garbolino.pl/base/mov.php
http://healthybalanceyoga.com/base/mov.php
http://lucagazzaniga.com/base/mov.php
http://metrodenverrealestateonline.net/base/mov.php
http://olinickl3zz.ol.funpic.de/base/mov.php
http://quatuorbeat.fr/base/mov.php
http://somaplanet.net/base/mov.php
http://spborkowo.pomorskie.pl/base/mov.php
http://televisioncookery.com/base/mov.php
/mod1/mod1.php ==> downloads name.avi.exe from 79.135.167.49
http://dayer.es/mod1/mod1.php
http://emulespain.es/mod1/mod1.php
http://introdekor.com/mod1/mod1.php
http://jayminhomoreira.com.br/mod1/mod1.php
http://ktkol.webd.pl/mod1/mod1.php
http://makkarna.com/mod1/mod1.php
http://mugcafe.com.sa/mod1/mod1.php
http://parrilladasanisidro.com/mod1/mod1.php
http://pclabs.it/mod1/mod1.php
http://skylinkmexico.com/mod1/mod1.php
http://supperdomain.com/mod1/mod1.php
http://tl1-normandie.com/mod1/mod1.php
http://www.goaapartments.net/mod1/mod1.php
http://www.kraken.sk/mod1/mod1.php
http://www.restaurantemmen.nl/mod1/mod1.php
http://www.support-infos.de/mod1/mod1.php
/index1.html ==> downloads install.exe
All of the emails in this group used the subject Weekly top news.
http://alternativemicro.com/index1.html
http://bamtec.hu/index1.html
http://bearofpa.com/index1.html
http://criminallegalhelp.com/index1.html
http://dmisystems.ro/index1.html
http://dominostalknews.com/index1.html
http://fecami.org.ar/index1.html
http://heliozid.com/index1.html
http://hietbrink.net/index1.html
http://hiflitravel.com/index1.html
http://hiptrendy.ipower.com/index1.html
http://i24onsit.ipower.com/index1.html
http://iispc.net/index1.html
http://islamicstore.biz/index1.html
http://lagoadoperi.com.br/index1.html
http://lenaantabi.com/index1.html
http://mic.edu.lb/index1.html
http://operasofia.com/index1.html
http://oxfordchristianschool.com/index1.html
http://rcengineer.com/index1.html
http://roderick-deaguero.com/index1.html
http://suruu.com/index1.html
http://www.berachahbaptist.org/index1.html
http://www.cristianosecuador.com/index1.html
http://www.designologia.com/index1.html
http://www.donovanpinscherclub.com/index1.html
http://www.lebcanbank.com/index1.html
/index1.php - fake YouTube porn movies - forwards to index#.html -
downloads malware names like videosecrt927.exe or my_hot_video.exe
(sorry, freaks, no porn images here...)
I'm afraid I'm also not comfortable listing all the subject lines. Many of them used "the f word" and very explicit sexual subjects. This group also includes all the "porno dvd", "stunning video", and "gallery porno" subject lines, including those which list celebrity names, including Jessica Alba, Clara Morgane, Claudia Schiffer, Carmen Electra, Keira Knightley, Jennifer Lopez, Christina Aguilera, Penelope Cruz, Meg Ryan, Pamela Anderson, Monica Bellucci, Veronika Zemanova, Nicole Kidman, Demi Moore, Salma Hayek, Cameron Diaz, and others.
http://andreas-cronauer.de/index1.php
http://deniarelax.es/index1.php
http://fikcja.nazwa.pl/index1.php
http://gayboyhb.de/index1.php
http://illustar.ca/index1.php
http://irakliodaynight.gr/index1.php
http://luckyclimbing.com/index1.php
http://markaje.com/index1.php
http://maxiboutix.com/index1.php
http://maxpiran.com/index1.php
http://metacienciafisica.com/index1.php
http://moizes.cerqueira.nom.br/index1.php
http://namhee.fr/index1.php
http://oficinadeacordeon.com.br/index1.php
http://olle-andersson.se/index1.php
http://opcionsp.com/index1.php
http://p28516.typo3server.info/index1.php
http://pcwebcenter.com/index1.php
http://playazul.info/index1.php
http://pomes-energie.fr/index1.php
http://previarch.com/index1.php
http://regv.net/index1.php
http://rockschool-barbey.com/index1.php
http://samorzad.pollub.pl/index1.php
http://servirisc.com/index1.php
http://sgweb.fr/index1.php
http://softwaregestionefrantoio.com/index1.php
http://under4mix.com/index1.php
http://weseremsmamas.we.ohost.de/index1.php
http://www.christian-moreau-86.com/index1.php
http://www.heck-spedition.de/index1.php
http://www.jim-fu.com/index1.php
http://www.king-pak.com.ar/index1.php
http://www.nikko-air.eu/index1.php
http://www.nikkor2d2.com/index1.php
http://www.performance-check.de/index1.php
http://www.prezesm.kylos.pl/index1.php
http://www.saomarcoslaboratorio.com.br/index1.php
/index2.html = downloads install.exe
This group also used the subject lines "Weekly top news" for each message.
http://4everforum.org/index2.html
http://abtecno.com/index2.html
http://aeroprintcool.com.ar/index2.html
http://amicieamanti.it/index2.html
http://anshi.com.ar/index2.html
http://ariovaldoramos.com.br/index2.html
http://armaka.lh.pl/index2.html
http://armaka.nazwa.pl/index2.html
http://aventurasaladero.com.ar/index2.html
http://burzy.sk/index2.html
http://cloudrelease.com/index2.html
http://creativemarketing.com/index2.html
http://cybitech.com/index2.html
http://damaspost.com/index2.html
http://divacouple.com/index2.html
http://doscondos.net/index2.html
http://eastcoaststorageequipment.com/index2.html
http://e-ontel.com/index2.html
http://fireline.hu/index2.html
http://gillette.ipower.com/index2.html
http://girogirotondo.it/index2.html
http://hotelnoorla.com.au/index2.html
http://ikarosdesign.com/index2.html
http://imaginenaxos.com/index2.html
http://kokom.sk/index2.html
http://nineinvestmentsinc.com/index2.html
http://photowalkr.com/index2.html
http://ref-in.com.ar/index2.html
http://sanjustino.com.ar/index2.html
http://sexysanjusto.com.ar/index2.html
http://spudgraphics.com/index2.html
http://txtget.com/index2.html
http://vaukary.com/index2.html
http://www.basicnorge.no/index2.html
http://www.beagleadvice.org.uk/index2.html
http://www.kaminecke.de/index2.html
http://www.tma.cz/index2.html
http://www.wassoufgroup.com/index2.html
There were a few msnbc emails very early today
The subject lines seen today were:
msnbc.com - BREAKING NEWS: Aliens Abducted By Michael Jackson
msnbc.com - BREAKING NEWS: Senator John Mccain Wishes To Have Sex With Model Heidi Klum; Others
msnbc.com - BREAKING NEWS: White Male Workers Banned In Britain
msnbc.com - BREAKING NEWS: Spongebob Denies Reports That Hes Gay
msnbc.com - BREAKING NEWS: Stock Markets Close As Global Earth World Planet International Buys All Shares
msnbc.com - BREAKING NEWS: Jesus Christ To Star In Next Series Of Batman
msnbc.com - BREAKING NEWS: Mccain Says Unsure If Obama A Secret Hippopotamus
msnbc.com - BREAKING NEWS: Sarkozy Carla Bruni Sex Film Shocker At Windsor Castle
msnbc.com - BREAKING NEWS: John Mccain Selects Laura Bush As His Vice President
msnbc.com - BREAKING NEWS: Children Admit To Being Little Shits. Video
msnbc.com - BREAKING NEWS: Switzerland To Be Devoured By Black Hole
msnbc.com - BREAKING NEWS: McDonald's Happy Meals In San Francisco To Include Gay Marriage License
msnbc.com - BREAKING NEWS: McDonald's Happy Meals In San Francisco To Include Gay Marriage License
msnbc.com - BREAKING NEWS: John Mccain Selects Laura Bush As His Vice President
msnbc.com - BREAKING NEWS: New Evidence Suggests That The President May Be Drinking Again
http://65.36.182.147/msn_video.html
http://artbazar.ro/msn_video.html
http://caratiparis.com/msn_video.html
http://cheahahs.com/msn_video.html
http://piero.bg/msn_video.html
http://pphuvena.nazwa.pl/msn_video.html
http://redstonegroup.net/msn_video.html
http://rorvigvand.net/msn_video.html
http://srq.dk/msn_video.html
http://tamarabdulhadi.com/msn_video.html
http://thebablooworld.com/msn_video.html
http://themeburn.com/msn_video.html
http://women-environment.org/msn_video.html
/relink/relink.php = installs name.avi.exe from 79.135.167.49
http://associazionemama.it/relink/relink.php
http://eandre.net/relink/relink.php
http://f11-jl.my-aircraft-project.com/relink/relink.php
http://hotelsdirectory.it/relink/relink.php
http://leslogesduvallon.fr/relink/relink.php
http://pudliszek.kei.pl/relink/relink.php
http://sw71ru.40.com1.ru/relink/relink.php
http://www.christophwyneken.com/relink/relink.php
http://www.hape-angeln.de/relink/relink.php
http://www.mediobasento.it/relink/relink.php
http://www.ncantalejo.com/relink/relink.php
so does /upload1/upload.php
http://aguadodecea.com/upload1/upload.php
http://farmaciacardelus.com/upload1/upload.php
http://freeweb.8k.ro/upload1/upload.php
http://magicweb.es/upload1/upload.php
http://outragerecords.com/upload1/upload.php
http://pendulumsandmore.com/upload1/upload.php
http://thecar.fr/upload1/upload.php
http://transporter.tv/upload1/upload.php
http://www.oris-uk.com/upload1/upload.php
http://xrevolution.de/upload1/upload.php
No comments:
Post a Comment