As many sources reported earlier today, an email claiming to be from CNN's "Scribbler" provided a link to "Watch Live Hospital Updates" of the Royal Baby:
But what do Harrison Ford, President Obama, and Snowden have in common with The Royal Baby?
They were all subjects of fake "CNN Breaking News" stories delivered by spam email today that contained links to a dangerous collection of malware! In the Malcovery Spam Data Mine we had hundreds of copies of emails with subjects including:
"Snowden able to leave Moscow airport" - BreakingNews CNN
"Harrison Ford on 'Ender's Game' controversy: 'Not an issue for me'"
"Obama speech to urge refocus "
"Perfect gift for royal baby ... a tree?" - BreakingNews CNN
(click each image for full-size email)
To demonstrate the relatedness of the spam, a list of the URLs that were used by each of the four campaigns is listed at the end of this article, labeled either "snowden", "ender", "obama", or "tree" for which campaign advertised that URL. We threw all of the advertised URLs into a fetcher and found that there were two files found in the destinations. The first (from earlier in the day) pointed to two Javascript files that were used to redirect the visitor to an Exploit Kit that would cause malware dropped to their computer. The second (later in the day, and still live as of this writing) pointed to three Javascript files that redirected to a different Exploit Kit site.
I've added spaces to the URLs for your protection, but DO NOT VISIT ANY OF THESE URLS!!!
(early morning version <== redirects to nphscards.com / topic / accidentally-results-stay.php )
index.html with MD5 = 958a887fcfcad89b3fdeea4b58e55905
- which loads two Javascript files:
ftp.thermovite.de / kurile / teeniest.js
traditionalagoonresort.com / prodded / televised.js
(afternoon version <== redirects to deltaboatraces.net / topic / accidentally-results-stay.php )
index.html with MD5 = bc73afe28fc6b536e675cea4ac468b7d
- which loads three Javascript files:
thealphatechnologies.com / advantageously / autopilots.js
atlas247.com / mussiest /syndicating.js
www.mshc.in /drubbing / mouthful.js
Since it was late in the day by the time I was able to review these myself, I infected myself with the afternoon version.
deltaboatraces.net == 173.246.104.136 and is still an active infector as of this timestamp.
I got a randomly named 297,472 byte file, detected by 11 of 46 Anti-Virus vendors at VirusTotal.com, which was Zeus.
See VirusTotal Report
Adobe Flash Player Update?
After infecting, the website tries to trick the user into "upgrading his Adobe Flash Player", but please notice in the graphic below, I'm not on the Adobe website!
After "installing" my Adobe update, my sandbox went crazy and also fetched malware from each of these locations:
After infection with the second my sandbox went to "deltarivehouse.net / forum / viewtopic.php" (173.246.104.136) which caused a string of additional infections to occur. While the initial infection was Zeus, the well-known Financial Crime malware that steals banking information, but also provides criminals full remote-control capabilities to your computer, the purpose of the additional malware was for another form of money making.
"sainitravels.in" (204.11.58.185) to fetch "f7Qsfao.exe"
(VirusTotal: 8 of 46)) - "Tepfor" or "Medfos" malware
"server1.extra-web.cz" (212.80.69.55) to fetch "dbm.exe"
(VirusTotal: 8 of 46)
"www.MATTEPLANET.com" (208.86.184.10) to fetch "q7ojEH7.exe"
(VirusTotal: 4 of 46)
"ictsolutions.net.au" (27.124.120.1) to fetch "SAQjaWu.exe"
(VirusTotal: 8 of 46)
Medfos, one of the malware names given to several of the above, is an "Advertisement redirection" malware campaign. Microsoft did a great job explaining how Medfos works in their blog post, Medfos - Hijacking Your Daily Search on the Microsoft Malware Protection Center blog back in September. Some of the sites that seem to be related to this Medfos install include "bidpenniesforgold.net" (IP: 50.63.25.37) and "webpayppcclick.com" (IP: 85.17.147.34).
According to our friends at Domain Tools, that last IP address is associated with a whole world of "Pay Per Click" fraud domains, including:
advertisingclickfeed.com
allfeedppcadvertising.com
clickppcadvertisingone.com
clickwebppcpay.com
csuperclick.com
feedppcadvertisingdirect.com
feedppcadvertisinginfo.com
feedyourppcdirect.com
firstfeedppcadvertising.com
newpaywebclick.com
onlineppcclick.com
paymittelsclick.com
payonlineppc.com
payppcclickonline.com
paywebclick.com
paywebclicksite.com
perclickguide.com
perclicksite.com
perclickworld.com
ppcadvertisingfeed.com
ppcadvertisingworld.com
ppcclickonlineppc.com
ppcnewfeed.com
ppcperclickadvertising.com
ppcperpayadvertising.com
ppcwebclickpay.com
streamppcadvertising.com
webpayppcclick.com
Hopefully tying these malware samples to that activity can help someone clean up that mess! (Attention: Leaseweb!)
Spammed URLs for the Snowden, Ender, Obama, and Tree Campaigns
| obama | 198.251.67.11 | /incumbency/index.html |
| obama | 198.251.67.11 | /philippine/index.html |
| obama | 198.251.67.11 | /stifles/index.html |
| snowden | 198.251.67.11 | /campaigners/index.html |
| snowden | 198.251.67.11 | /foxhole/index.html |
| snowden | 198.251.67.11 | /fracturing/index.html |
| snowden | 198.251.67.11 | /incumbency/index.html |
| tree | 198.251.67.11 | /nomadic/index.html |
| tree | 198.251.67.11 | /philippine/index.html |
| tree | 198.251.67.11 | /reprehended/index.html |
| tree | 198.251.67.11 | /sauciness/index.html |
| tree | 198.251.67.11 | /sonya/index.html |
| snowden | 198.251.67.11 | /voodooing/index.html |
| ender | 198.61.134.93 | /decompressed/index.html |
| ender | 198.61.134.93 | /dinosaur/index.html |
| ender | 198.61.134.93 | /microeconomics/index.html |
| ender | 198.61.134.93 | /packard/index.html |
| ender | 198.61.134.93 | /reprimanding/index.html |
| ender | 198.61.134.93 | /sash/index.html |
| ender | 51956147.de.strato-hosting.eu | /radicalism/index.html |
| ender | 51956147.de.strato-hosting.eu | /remote/index.html |
| ender | 51956147.de.strato-hosting.eu | /soyinka/index.html |
| obama | 96.9.7.80 | /draftier/index.html |
| tree | 96.9.7.80 | /coif/index.html |
| tree | 96.9.7.80 | /contentious/index.html |
| snowden | 96.9.7.80 | /imperiling/index.html |
| snowden | 96.9.7.80 | /implausibilities/index.html |
| tree | 96.9.7.80 | /slaloming/index.html |
| snowden | 96.9.780 | /imperiling/index.html |
| ender | adeseye.me.pn | /clunkier/index.html |
| ender | adeseye.me.pn | /incest/index.html |
| ender | adeseye.me.pn | /mischancing/index.html |
| ender | adeseye.me.pn | /rarest/index.html |
| ender | adeseye.me.pn | /uglies/index.html |
| ender | andywinnie.com | /albert/index.html |
| ender | andywinnie.com | /anywheres/index.html |
| ender | andywinnie.com | /chairing/index.html |
| ender | andywinnie.com | /fits/index.html |
| ender | andywinnie.com | /network/index.html |
| ender | andywinnie.com | /preservation/index.html |
| ender | aptword.com.my | /dromedaries/index.html |
| ender | aptword.com.my | /incurred/index.html |
| ender | aptword.com.my | /interpol/index.html |
| ender | aptword.com.my | /translations/index.html |
| ender | aptword.com.my | /vietminh/index.html |
| obama | assuredpropertycare.net | /overlying/index.html |
| obama | assuredpropertycare.net | /sneezes/index.html |
| tree | assuredpropertycare.net | /arrhenius/index.html |
| snowden | assuredpropertycare.net | /changed/index.html |
| snowden | assuredpropertycare.net | /debaucheries/index.html |
| snowden | assuredpropertycare.net | /dulls/index.html |
| tree | assuredpropertycare.net | /dulls/index.html |
| snowden | assuredpropertycare.net | /overlying/index.html |
| tree | assuredpropertycare.net | /premeditation/index.html |
| tree | assuredpropertycare.net | /shekels/index.html |
| snowden | assuredpropertycare.net | /sneezes/index.html |
| obama | bbsmfg.biz | /belaying/index.html |
| obama | bbsmfg.biz | /lather/index.html |
| tree | bbsmfg.biz | /activists/index.html |
| snowden | bbsmfg.biz | /intellectualize/index.html |
| snowden | bbsmfg.biz | /lather/index.html |
| tree | bbsmfg.biz | /servo/index.html |
| tree | bbsmfg.biz | /skiing/index.html |
| tree | bbsmfg.biz | /tourist/index.html |
| snowden | bbsmfgbiz | /intellectualize/index.html |
| snowden | bbsmfgbiz | /lather/index.html |
| ender | bestpaintinginc.org | /candidacy/index.html |
| ender | bestpaintinginc.org | /enmeshes/index.html |
| ender | bestpaintinginc.org | /genitives/index.html |
| ender | bestpaintinginc.org | /hardly/index.html |
| ender | bestpaintinginc.org | /parser/index.html |
| obama | bordihn.net | /rubik/index.html |
| snowden | bordihn.net | /gnarl/index.html |
| tree | bordihn.net | /gnarl/index.html |
| tree | bordihn.net | /gushing/index.html |
| tree | bordihn.net | /reformulates/index.html |
| snowden | bordihn.net | /squirreling/index.html |
| tree | bordihn.net | /squirreling/index.html |
| ender | chad.westhostsite.com | /addle/index.html |
| ender | chad.westhostsite.com | /augmenting/index.html |
| ender | chad.westhostsite.com | /buttonholes/index.html |
| ender | chad.westhostsite.com | /expend/index.html |
| ender | chad.westhostsite.com | /shillings/index.html |
| ender | chad.westhostsite.com | /unfailing/index.html |
| ender | CHALONE.COM.SG | /ebbed/index.html |
| ender | CHALONE.COM.SG | /homy/index.html |
| ender | CHALONE.COM.SG | /saddling/index.html |
| obama | deerstalkersbop.org.nz | /evelyn/index.html |
| snowden | deerstalkersbop.org.nz | /absconding/index.html |
| tree | deerstalkersbop.org.nz | /actioning/index.html |
| tree | deerstalkersbop.org.nz | /bathroom/index.html |
| snowden | deerstalkersbop.org.nz | /dissatisfied/index.html |
| tree | deerstalkersbop.org.nz | /dissatisfied/index.html |
| snowden | deerstalkersbop.org.nz | /tran/index.html |
| obama | dtgcommunity.com | /imprimatur/index.html |
| snowden | dtgcommunity.com | /electroencephalographs/index.html |
| tree | dtgcommunity.com | /electroencephalographs/index.html |
| snowden | dtgcommunity.com | /gentlefolk/index.html |
| tree | dtgcommunity.com | /gunpoint/index.html |
| tree | dtgcommunity.com | /ingresses/index.html |
| snowden | dtgcommunity.com | /parachutists/index.html |
| tree | dtgcommunity.com | /seesawing/index.html |
| snowden | dtgcommunity.com | /thwacked/index.html |
| snowden | dtgcommunity.com | /tzar/index.html |
| tree | edition.cnn.com | / |
| obama | ekaterini.mainsys.gr | /bloodier/index.html |
| obama | ekaterini.mainsys.gr | /habitual/index.html |
| tree | ekaterini.mainsys.gr | /habitual/index.html |
| snowden | ekaterini.mainsys.gr | /livelongs/index.html |
| tree | ekaterini.mainsys.gr | /oxymora/index.html |
| snowden | ekaterini.mainsys.gr | /peddle/index.html |
| snowden | ekaterini.mainsys.gr | /prithee/index.html |
| tree | ekaterini.mainsys.gr | /suggested/index.html |
| snowden | ekaterini.mainsys.gr | /voled/index.html |
| tree | ekaterini.mainsys.gr | /voled/index.html |
| ender | fermatabow.com | /clinicians/index.html |
| ender | fermatabow.com | /depicting/index.html |
| ender | fermatabow.com | /fairyland/index.html |
| obama | ftp.suavva.com | /initiators/index.html |
| obama | ftp.suavva.com | /riverbed/index.html |
| obama | ftp.suavva.com | /sousa/index.html |
| snowden | ftp.suavva.com | /overstatements/index.html |
| tree | ftp.suavva.com | /sousa/index.html |
| tree | ftp.suavva.com | /surges/index.html |
| obama | fuhr-haustechnik.de | /resubmit/index.html |
| tree | fuhr-haustechnik.de | /attempted/index.html |
| tree | fuhr-haustechnik.de | /continua/index.html |
| tree | fuhr-haustechnik.de | /impartially/index.html |
| snowden | fuhr-haustechnik.de | /recollecting/index.html |
| tree | fuhr-haustechnik.de | /recollecting/index.html |
| tree | fuhr-haustechnik.de | /taboo/index.html |
| snowden | fuhr-haustechnik.de | /unswerving/index.html |
| ender | gbihongkong.org | /boer/index.html |
| ender | gbihongkong.org | /economist/index.html |
| ender | gbihongkong.org | /inconsiderately/index.html |
| ender | gbihongkong.org | /unenlightened/index.html |
| ender | grape.wurster.ws | /filtration/index.html |
| ender | grape.wurster.ws | /geisha/index.html |
| ender | grape.wurster.ws | /pagans/index.html |
| ender | grape.wurster.ws | /rationalized/index.html |
| ender | grape.wurster.ws | /spica/index.html |
| ender | grape.wurster.ws | /suntans/index.html |
| snowden | hackspitz.com | /adidas/index.html |
| snowden | hackspitz.com | /candied/index.html |
| snowden | hackspitz.com | /impropriety/index.html |
| tree | hackspitz.com | /kook/index.html |
| tree | hackspitz.com | /penetrable/index.html |
| obama | hotelnewyorkbd.com | /twill/index.html |
| tree | hotelnewyorkbd.com | /bayou/index.html |
| snowden | hotelnewyorkbd.com | /doyens/index.html |
| tree | hotelnewyorkbd.com | /doyens/index.html |
| snowden | hotelnewyorkbd.com | /fiftieths/index.html |
| snowden | hotelnewyorkbd.com | /hill/index.html |
| snowden | hotelnewyorkbd.com | /preyer/index.html |
| tree | hotelnewyorkbdcom | /bayou/index.html |
| ender | ic44.com | /bulgarian/index.html |
| ender | ic44.com | /byword/index.html |
| ender | ic44.com | /flourishes/index.html |
| ender | ic44.com | /ganglier/index.html |
| ender | ic44.com | /sundry/index.html |
| ender | isgett.org | /ambling/index.html |
| ender | isgett.org | /besmirched/index.html |
| ender | isgett.org | /daybed/index.html |
| ender | isgett.org | /discriminatory/index.html |
| ender | isgett.org | /flux/index.html |
| ender | isgett.org | /tanzania/index.html |
| obama | jobarium.com | /sham/index.html |
| snowden | jobarium.com | /benefactresses/index.html |
| snowden | jobarium.com | /hobos/index.html |
| tree | jobarium.com | /melissa/index.html |
| obama | joerg.gmxhome.de | /ease/index.html |
| obama | joerg.gmxhome.de | /freezes/index.html |
| snowden | joerg.gmxhome.de | /ease/index.html |
| snowden | joerg.gmxhome.de | /enumerated/index.html |
| tree | joerg.gmxhome.de | /enumerated/index.html |
| snowden | joerg.gmxhome.de | /harvester/index.html |
| tree | joerg.gmxhome.de | /skeptically/index.html |
| tree | kassos.gr | /bode/index.html |
| tree | kassos.gr | /chosen/index.html |
| snowden | kassos.gr | /dragooning/index.html |
| snowden | kassos.gr | /futility/index.html |
| snowden | kassos.gr | /golf/index.html |
| snowden | kassos.gr | /walkways/index.html |
| tree | kassos.gr | /walkways/index.html |
| snowden | kassosgr | /futility/index.html |
| snowden | kassosgr | /golf/index.html |
| obama | kryokontur.fr | /biopsy/index.html |
| obama | kryokontur.fr | /brows/index.html |
| obama | kryokontur.fr | /kern/index.html |
| obama | kryokontur.fr | /nosh/index.html |
| tree | kryokontur.fr | /alternator/index.html |
| snowden | kryokontur.fr | /brows/index.html |
| tree | kryokontur.fr | /brows/index.html |
| tree | kryokontur.fr | /curs/index.html |
| tree | kryokontur.fr | /heating/index.html |
| snowden | kryokontur.fr | /housebreaking/index.html |
| snowden | kryokontur.fr | /preheats/index.html |
| snowden | kryokontur.fr | /tint/index.html |
| snowden | kryokontur.fr | /windmills/index.html |
| ender | lees-landscaping.com | /angiosperm/index.html |
| ender | lees-landscaping.com | /barrettes/index.html |
| ender | lees-landscaping.com | /illegitimacy/index.html |
| snowden | limelight.arinet.com | /cloy/index.html |
| snowden | limelight.arinet.com | /hamlet/index.html |
| tree | limelight.arinet.com | /hamlet/index.html |
| snowden | limelight.arinet.com | /universities/index.html |
| obama | lostfounddevices.com | /mama/index.html |
| obama | lostfounddevices.com | /mullet/index.html |
| obama | lostfounddevices.com | /unavoidable/index.html |
| obama | lostfounddevices.com | /unavoidable/indexhtml |
| snowden | lostfounddevices.com | /blaspheme/index.html |
| snowden | lostfounddevices.com | /espinoza/index.html |
| tree | lostfounddevices.com | /espinoza/index.html |
| snowden | lostfounddevices.com | /friskily/index.html |
| snowden | lostfounddevices.com | /hunchbacked/index.html |
| snowden | lostfounddevices.com | /mama/index.html |
| tree | lostfounddevices.com | /mama/index.html |
| snowden | lostfounddevices.com | /manageable/index.html |
| snowden | lostfounddevices.com | /undresses/index.html |
| tree | lostfounddevices.com | /undresses/index.html |
| snowden | mydataplus.com | /parenthesized/index.html |
| snowden | mydataplus.com | /powhatan/index.html |
| tree | mydataplus.com | /spotlessness/index.html |
| obama | nendt.com | /degree/index.html |
| tree | nendt.com | /famous/index.html |
| snowden | nendt.com | /horded/index.html |
| snowden | nendt.com | /phoneyed/index.html |
| snowden | nendt.com | /psalmists/index.html |
| tree | nendt.com | /shown/index.html |
| snowden | nendt.com | /spreaders/index.html |
| ender | photos4earth.com | /strobe/index.html |
| ender | s273524369.onlinehome.us | /disarray/index.html |
| ender | s273524369.onlinehome.us | /opposite/index.html |
| ender | s273524369.onlinehome.us | /sheepishly/index.html |
| ender | s273524369.onlinehome.us | /wakes/index.html |
| ender | s273524369.onlinehome.us | /yeasty/index.html |
| tree | s3.hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg |
| tree | s3.hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebdjpg |
| tree | s3hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg |
| obama | s5.hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg |
| obama | s5.hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9ajpg |
| obama | s5hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg |
| ender | stolichband.com | /betook/index.html |
| ender | stolichband.com | /daddy/index.html |
| ender | stolichband.com | /laudatory/index.html |
| ender | stolichband.com | /mediated/index.html |
| ender | stolichband.com | /modulation/index.html |
| ender | stolichband.com | /slander/index.html |
| ender | stolichband.com | /slovakian/index.html |
| obama | t.co | /068wfdEwvI |
| obama | t.co | /0B3uJXHZHq |
| obama | t.co | /2RKkCjMhDY |
| obama | t.co | /3Bi5WUDuzQ |
| obama | t.co | /6oxioBYqIN |
| obama | t.co | /7qev03NGnJ |
| obama | t.co | /a4ERRbQQl4 |
| obama | t.co | /acBBL0xTCV |
| obama | t.co | /bkkUHH67hJ |
| obama | t.co | /bXH47NZNqO |
| obama | t.co | /C6DXVWqaBc |
| obama | t.co | /c6pMmdDPpO |
| obama | t.co | /dcLDDl0aty |
| obama | t.co | /DKgUzhWMr9 |
| obama | t.co | /dpM6GQ5NZ5 |
| obama | t.co | /dW8S1lHWkf |
| obama | t.co | /e9AsQbSPBW |
| obama | t.co | /eGRRrXsqQP |
| obama | t.co | /EUKNmKfV7q |
| obama | t.co | /f3bUOwEME8 |
| obama | t.co | /fOPdMNQOsM |
| obama | t.co | /g29I6C8vZy |
| obama | t.co | /GfduFeg1yd |
| obama | t.co | /gGGSrs26ZU |
| obama | t.co | /gKwkpduJ5v |
| obama | t.co | /Gs7xupxY4e |
| obama | t.co | /hP66qiEvov |
| obama | t.co | /htgnJQgBls |
| obama | t.co | /ims3mUbQAJ |
| obama | t.co | /j7WCQHF8ZR |
| obama | t.co | /JNaITTgZF4 |
| obama | t.co | /JyXdiTk9zz |
| obama | t.co | /k99DjSMgDX |
| obama | t.co | /KroVjGhTzS |
| obama | t.co | /lwcWsTSwc9 |
| obama | t.co | /m69otwSQB6 |
| obama | t.co | /M8wADK71ii |
| obama | t.co | /MMJJZm6BgK |
| obama | t.co | /MrjneT1p2F |
| obama | t.co | /nD7PWsTS2Z |
| obama | t.co | /nGGBXHTZiR |
| obama | t.co | /NT9VneQG7G |
| obama | t.co | /o5dSTNSEWg |
| obama | t.co | /OR7w6EeD2s |
| obama | t.co | /PMuNvHMrPz |
| obama | t.co | /Q4diDo0JMR |
| obama | t.co | /QEdUNFwVSe |
| obama | t.co | /qEQMOBXrQu |
| obama | t.co | /rfiCBnJbng |
| obama | t.co | /RGFxIi96oy |
| obama | t.co | /Rlu9pAZfbd |
| obama | t.co | /SbzAPP8Vdh |
| obama | t.co | /TtGPbv2jkt |
| obama | t.co | /twZBBrhZF6 |
| obama | t.co | /utoI54aE3a |
| obama | t.co | /vj38vKkeNZ |
| obama | t.co | /vp6XZXxaev |
| obama | t.co | /VPxdX8abZV |
| obama | t.co | /xDlelOjWBn |
| obama | t.co | /XFiGKFtVKp |
| obama | t.co | /XOWz23aYDY |
| obama | t.co | /y5jSjRvpnk |
| obama | t.co | /yCZT3kJ259 |
| obama | t.co | /yfpfhlOVyB |
| obama | t.co | /yJqGYQPmwe |
| obama | t.co | /ytpUhryXaB |
| obama | t.co | /YVTow2XnJ8 |
| ender | tpafbicaaorg.web.siteprotect.net | /expansionist/index.html |
| ender | tpafbicaaorg.web.siteprotect.net | /tocqueville/index.html |
| ender | transstorlogistics.eu | /cowered/index.html |
| ender | transstorlogistics.eu | /dapples/index.html |
| ender | transstorlogistics.eu | /dentist/index.html |
| ender | transstorlogistics.eu | /footpaths/index.html |
| ender | transstorlogistics.eu | /have/index.html |
| ender | transstorlogistics.eu | /miraculous/index.html |
| obama | villaflorida.biz | /backslappers/index.html |
| obama | villaflorida.biz | /chin/index.html |
| obama | villaflorida.biz | /encapsulates/index.html |
| tree | villaflorida.biz | /caste/index.html |
| tree | villaflorida.biz | /chin/index.html |
| snowden | villaflorida.biz | /cliquish/index.html |
| tree | villaflorida.biz | /cliquish/index.html |
| snowden | villaflorida.biz | /huitzilopitchli/index.html |
| snowden | villaflorida.biz | /rotogravure/index.html |
| tree | villaflorida.biz | /unloosing/index.html |
| obama | whittakerwatertech.com | /beveling/index.html |
| obama | whittakerwatertech.com | /butlers/index.html |
| snowden | whittakerwatertech.com | /careering/index.html |
| snowden | whittakerwatertech.com | /guardroom/index.html |
| tree | whittakerwatertech.com | /guardroom/index.html |
| snowden | whittakerwatertech.com | /hundredweights/index.html |
| tree | whittakerwatertech.com | /plover/index.html |
| snowden | whittakerwatertech.com | /snorts/index.html |
| ender | www.arrow2000.ca | /gradient/index.html |
| ender | www.arrow2000.ca | /homemaker/index.html |
| ender | www.arrow2000.ca | /mulling/index.html |
| ender | www.arrow2000.ca | /nettie/index.html |
| ender | www.arrow2000.ca | /offed/index.html |
| obama | www.bernderl.de | /paradigmatic/index.html |
| snowden | www.bernderl.de | /coward/index.html |
| snowden | www.bernderl.de | /munoz/index.html |
| tree | www.bernderl.de | /oleaginous/index.html |
| snowden | www.bernderl.de | /polygon/index.html |
| snowden | www.bernderl.de | /selvedge/index.html |
| tree | www.bernderl.de | /undue/index.html |
| ender | www.bst-kanzlei.de | /attenuation/index.html |
| ender | www.bst-kanzlei.de | /cutback/index.html |
| ender | www.bst-kanzlei.de | /divorce/index.html |
| tree | www.compare-treadmills.co.uk | /bassinet/index.html |
| snowden | www.compare-treadmills.co.uk | /deciding/index.html |
| tree | www.compare-treadmills.co.uk | /faster/index.html |
| snowden | www.compare-treadmills.co.uk | /implosion/index.html |
| tree | www.compare-treadmills.co.uk | /implosion/index.html |
| snowden | www.compare-treadmills.co.uk | /leon/index.html |
| snowden | www.compare-treadmills.co.uk | /leonor/index.html |
| tree | www.compare-treadmills.co.uk | /march/index.html |
| tree | www.compare-treadmills.co.uk | /tamarinds/index.html |
| ender | www.ishootyou.gr | /auguring/index.html |
| ender | www.ishootyou.gr | /insinuating/index.html |
| ender | www.ishootyou.gr | /sultanates/index.html |
| ender | www.ishootyou.gr | /towelling/index.html |
| obama | www.kauai2u.com | /connect/index.html |
| tree | www.kauai2u.com | /connect/index.html |
| snowden | www.kauai2u.com | /cynically/index.html |
| tree | www.kauai2u.com | /department/index.html |
| snowden | www.kauai2u.com | /descent/index.html |
| snowden | www.kauai2u.com | /finked/index.html |
| snowden | www.kauai2u.com | /strapping/index.html |
| tree | www.kauai2u.com | /strapping/index.html |
| tree | www.masago-bkt.co.jp | /axes/index.html |
| snowden | www.masago-bkt.co.jp | /beirut/index.html |
| obama | www.Miami-Beach-Reisen.de | /eminently/index.html |
| obama | www.Miami-Beach-Reisen.de | /tangoing/index.html |
| snowden | www.Miami-Beach-Reisen.de | /eduardo/index.html |
| tree | www.Miami-Beach-Reisen.de | /exceeding/index.html |
| snowden | www.Miami-Beach-Reisen.de | /frail/index.html |
| snowden | www.Miami-Beach-Reisen.de | /incrusts/index.html |
| tree | www.Miami-Beach-Reisen.de | /invalided/index.html |
| tree | www.Miami-Beach-Reisen.de | /requirements/index.html |
| snowden | www.Miami-Beach-Reisen.de | /tangoing/index.html |
| obama | www.readingfluency.net | /juvenile/index.html |
| snowden | www.readingfluency.net | /imperishables/index.html |
| tree | www.readingfluency.net | /imperishables/index.html |
| snowden | www.readingfluency.net | /poachers/index.html |
| snowden | www.readingfluency.net | /tarantula/index.html |
| tree | www.saito-office.biz | /hooker/index.html |
| snowden | www.saito-office.biz | /rechargeable/index.html |
| snowden | www.saito-office.biz | /suggestively/index.html |
| tree | www.saito-office.biz | /suggestively/index.html |
| snowden | www.saito-office.biz | /vandyke/index.html |
| snowden | www.schmaeing-reken.de | /banjos/index.html |
| tree | www.schmaeing-reken.de | /baxter/index.html |
| snowden | www.schmaeing-reken.de | /blocking/index.html |
| tree | www.schmaeing-reken.de | /blocking/index.html |
| tree | www.schmaeing-reken.de | /droller/index.html |
| tree | www.schmaeing-reken.de | /iambs/index.html |
| tree | www.schmaeing-reken.de | /metamorphosing/index.html |
| snowden | www.schmaeing-reken.de | /mucks/index.html |
| tree | www.schmaeing-reken.de | /regurgitating/index.html |
| obama | www.socivi.com | /estonians/index.html |
| tree | www.socivi.com | /flippancy/index.html |
| snowden | www.socivi.com | /incapable/index.html |
| snowden | www.socivi.com | /infuses/index.html |
| tree | www.socivi.com | /lepke/index.html |
| snowden | www.socivi.com | /moonlights/index.html |
| tree | www.socivi.com | /tugs/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /chirruping/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /dumped/index.html |
| snowden | www.spurtwinslotshelvingsystems.co.uk | /helot/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /reprinted/index.html |
| snowden | www.spurtwinslotshelvingsystems.co.uk | /terminological/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /terminological/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /tushes/index.html |
| tree | www.tennisclub-iburg.de | /barking/index.html |
| snowden | www.tennisclub-iburg.de | /bruckner/index.html |
| snowden | www.tennisclub-iburg.de | /distemper/index.html |
| tree | www.tennisclub-iburg.de | /excreta/index.html |
| snowden | www.tennisclub-iburg.de | /geneses/index.html |
| snowden | www.tennisclub-iburg.de | /hepper/index.html |
| tree | www.tennisclub-iburg.de | /retributions/index.html |
| obama | www.wurster.ws | /dope/index.html |
| tree | www.wurster.ws | /cheaply/index.html |
| snowden | www.wurster.ws | /dearness/index.html |
| snowden | www.wurster.ws | /fixity/index.html |
| tree | www.wurster.ws | /loathing/index.html |
| tree | www.wurster.ws | /rump/index.html |
