#fake av

[threattrack]

Malicious Bank of America Bill Payment Alert Spam

Subjects Seen:

Unable to process your most recent Bill Payment

Typical e-mail details:

You have a new e-Message from Bank of America This e-mail has been sent to you to inform you that we were unable to process your most recent payment of bill. Please check attached file for more detailed information on this transaction.

Malicious URLs

64.34.70.32:8080/ponyb/gate.php

ns.ntconseil.com/FAyMXA.exe

photolaboratorio85.it/GXxiN.exe

kpcmiami.org/zk9s.exe

Additional Notes:

None at this time.

[threattrack]

Wedding Invitation Spam

Subjects seen:

Wedding Invite

Wedding Invitation

Typical e-mail details:

 You are Cordially Invited to Celebrate the Our Wedding On Tuesday March the 29 at Four O'clock Followed by a Reception Get Full Invitation Text

Malicious URLs

accf.info/components/.cixlcg.php?receipt=ss00_323

ace-press.org/components/.gnucla.php?receipt=ss00_323

ademasde.net/components/.qwas57.php?receipt=ss00_323

advocatus-okara.org/components/.ncefcx.php?receipt=ss00_323

agirversaillesgrandsiecle.org/components/.bhpupz.php?receipt=ss00_323

ahataxi.sk/components/.otmojc.php?receipt=ss00_323

actren.net/components/.z6harp.php?receipt=ss00_323

aegap.org/components/.deyoc5.php?receipt=ss00_323

aegmin.org/components/.0fn0br.php?receipt=ss00_323

affip.org/components/.hwk8qn.php?receipt=ss00_323

Additional Notes:

None at this time.

[threattrack]

Your Facebook Account is Blocked due to Spam Activity

Subjects seen:

Account suspicious activity

Typical e-mail details:

Hi [removed], Your account has been blocked due to spam activity. To verify account, please follow this link: facebook.com/confirmemail.php?e=[removed] You may be asked to enter this confirmation code: [removed] The Facebook Team

Malicious URLs

freshdating2012.info/link.php

moderndating2013.info/link.php

datingcool2012.info/link.php

site-dating2013.info/link.php

datingbest2012.info/link.php

site-dating-2012.info/link.php

domainsstressadd.net/?a=ywzmawq9mdaxmta=

domainsstressadd.net/analizator_data/lkoberdidqxev-a.gguudln.jar

Additional Notes:

None at this time.

[threattrack]

Malicious FedEx Spam Continues

Subjects seen:

Tracking Detail [removed]

Number [removed]

Typical e-mail details:

Your parcel has arrived at the post office at November 26.Our postrider was unable to deliver the parcel to you.

To receive a parcel, please, go to the nearest our office and show this postal receipt.

Malicious URLs

thebusinessplus.com/MUTBQJADRE.html

mylauren.com/CCOSGTLVTA.html

milrecados.com/SWVOXIGJEV.html

cantoncityutah.com/OXSJOVVYOE.html

watertaxis.mobi/APQTJNWNPV.html

affiliate-erfolg.de/KQEZOOWAYE.html

btv-bosseln.de/EJWFBEEBWI.html

atimbershop.com/GULSHSFCHM.html

82.113.204.228//get/43d982be5107d1b8de698e16759b9956.exe

211.172.112.7//get/43d982be5107d1b8de698e16759b9956.exe

Additional Notes:

Related to FedEx spam last seen 11/20.

[threattrack]

Malicious UPS Spam

Subjects seen:

ID (X)SRN[removed]

Typical e-mail details:

Delivery Notification. Your package delivered to the nearest Postal Office. When receiving, please show a mailing receipt. Address of the nearest office you can find on our website.

Malicious URLs

dim4lguazas.es/ASRWFZRMHA.html

linguing.es/RVTEKQCHDQ.html

140.135.66.217//get/43d982be5107d1b8de698e16759b9956.exe

Additional Notes:

None at this time.

[threattrack]

Malicious DHL Spam

Subjects seen:

Number (D)[removed]

Typical e-mail details:

Dear Customer, Your parcel has arrivesd at the post office an October 25th. Our postrider was unable to deliver the parcel to your address. To receive a parcel you must go to the nearest DHL office and show your postal receipt. Thank you for your attention. 

Malicious URLs

smartinfocom.in/ICLNOKDYFS.html

Additional Notes:

None at this time.

[threattrack]

Malicious Delta Airlines Attachment Spam

Subjects seen:

You can download your ticket #ID[removed]

Typical e-mail details:

Dear Customer, ELECTRONIC TICKET NUMBER / EH197152012 SEAT / 75E/ZONE 1 DATE / TIME 2 NOVEMBER, 2012, 08:15 PM ARRIVING / Tacoma FORM OF PAYMENT / XXXXXX TOTAL PRICE / 230.10 USD REF / EF.1075 ST / OK BAG / 1PC Your ticket is attached. You can print your ticket. To open archive, pleace use password: deltaairlines Thank you for using our airline company services. Delta Air Lines.

Malicious URLs

202.169.224.202:8080//get/43d982be5107d1b8de698e16759b9956.exe

Additional Notes:

Related to Delta Airlines Spam last seen 10/10.

[threattrack]

Malicious US Postal Service Spam Continues

Subjects seen:

Delivery refuse ID#[removed]

Typical e-mail details:

Unfortunately we failed to deliver the postal package you have sent on the 27th of October in time, because the recipient’s address is erroneous. Please go to the nearest UPS office and show your shipping label.  <

Malicious URLs

puntog.net/shipping_label_usps.zip

188.212.156.180//get/43d982be5107d1b8de698e16759b9956.exe

Additional Notes:

Related to USPS Spam last seen 11/5.