Blog for hpHosts, and whatever else I feel like writing about ....

Monday 4 June 2012

Alert: Fake meds spam impersonating Digg

Not content with fake meds and exploit etc spam impersonating the likes of Facebook, Twitter, Google and countless others, it seems the fake meds gangs have decided to impersonate Digg now too. Quite why is a bit puzzling, but likely "just because they can". If like me, you have email only displayed in plain text, then you'll see what it is and where its taking you, straight away, else the original HTML version of the email is as per the screenshot on the left.

I've had 3 of these so far, all with different URLs in the emails;

hxxp://rodrigomarchena.com/up/load/
hxxp://nlpguides.com/up/load/
hxxp://elite.edu.pk/up/load/

All leading to the same domain, in this case;

dietpilldrugstore.com

Domain Name: DIETPILLDRUGSTORE.COM

Registrant:
    Nikolay Stolbikov
    Nikolay Stolbikov        (tudor@osmail.net)
    ulitsa Marshala Kazakova d.1 k.2 kv.360
    Sankt-Peterburg
    Sankt-Peterburg,198302
    RU
    Tel. +7.8123274547

Creation Date: 23-May-2012
Expiration Date: 23-May-2013

Domain servers in listed order:
    ns1.dietpilldrugstore.com
    ns2.dietpilldrugstore.com

Administrative Contact:
    Nikolay Stolbikov
    Nikolay Stolbikov        (tudor@osmail.net)
    ulitsa Marshala Kazakova d.1 k.2 kv.360
    Sankt-Peterburg
    Sankt-Peterburg,198302
    RU
    Tel. +7.8123274547

Technical Contact:
    Nikolay Stolbikov
    Nikolay Stolbikov        (tudor@osmail.net)
    ulitsa Marshala Kazakova d.1 k.2 kv.360
    Sankt-Peterburg
    Sankt-Peterburg,198302
    RU
    Tel. +7.8123274547

Billing Contact:
    Nikolay Stolbikov
    Nikolay Stolbikov        (tudor@osmail.net)
    ulitsa Marshala Kazakova d.1 k.2 kv.360
    Sankt-Peterburg
    Sankt-Peterburg,198302
    RU
    Tel. +7.8123274547

Status:LOCKED


Spam has only originated from 2 IPs so far (doubt that's all that is involved, more likely more origins will pop up once more of their spam comes in), as usual.

195.54.2.18 - deimos.surnet.ru - 3239 - 3239 195.54.0.0/20 RU-SURNET Uralsvyazinform, Chelyabinsk branch
213.229.102.22 - server.furnitureinfashion.net - 29550 - 29550 213.229.64.0/18 SIMPLYTRANSIT Simply Transit Ltd

Headers:

Return-Path: <confirm@dealerday.it>
Delivered-To: webhostingunleashed_com@it-mate.co.uk
X-Spam-Flag: YES
X-Spam-Score: 10.737
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.737 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001,
    MIME_HTML_ONLY=0.723, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_SBL=0.141, RCVD_IN_SORBS_WEB=0.77,
    RDNS_NONE=0.793, TO_NO_BRKTS_NORDNS=0.001, URIBL_DBL_SPAM=1.7,
    URIBL_WS_SURBL=1.608] autolearn=spam
Received: from server.furnitureinfashion.net (unknown [213.229.102.22])
    by mail4.emailconfig.com (Postfix) with SMTP id DAE1D39819A
    for <webhostingunleashed_com@it-mate.co.uk>; Mon, 4 Jun 2012 07:57:56 +0100 (BST)
Date: Mon, 4 Jun 2012 07:57:56 -0000
From: "Digg Support" <noreply@e.digg.com>
Message-Id: <4amttet3vqn5sd40eepxtkxnyu0ccw@ebm2.cheetahmail.com>
Mime-Version: 1.0
Subject: [SPAM] Digg Verification
To: webhostingunleashed_com@it-mate.co.uk
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=ISO-8859-1


Return-Path: <confirm@dealerday.it>
Delivered-To: webhostingunleashed_com@it-mate.co.uk
X-Spam-Flag: YES
X-Spam-Score: 10.737
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.737 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001,
    MIME_HTML_ONLY=0.723, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_SBL=0.141, RCVD_IN_SORBS_WEB=0.77,
    RDNS_NONE=0.793, TO_NO_BRKTS_NORDNS=0.001, URIBL_DBL_SPAM=1.7,
    URIBL_WS_SURBL=1.608] autolearn=spam
Received: from server.furnitureinfashion.net (unknown [213.229.102.22])
    by mail4.emailconfig.com (Postfix) with SMTP id DAE1D39819A
    for <webhostingunleashed_com@it-mate.co.uk>; Mon, 4 Jun 2012 07:57:56 +0100 (BST)
Date: Mon, 4 Jun 2012 07:57:56 -0000
From: "Digg Support" <noreply@e.digg.com>
Message-Id: <4amttet3vqn5sd40eepxtkxnyu0ccw@ebm2.cheetahmail.com>
Mime-Version: 1.0
Subject: [SPAM] Digg Verification
To: webhostingunleashed_com@it-mate.co.uk
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=ISO-8859-1


Return-Path: <confirm@levinpr.com>
Delivered-To: webhostingunleashed_com@it-mate.co.uk
X-Spam-Flag: YES
X-Spam-Score: 13.216
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.216 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, DATE_IN_FUTURE_12_24=3.199,
    HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PSBL=2.7, RCVD_IN_SBL=0.141,
    RCVD_IN_SORBS_WEB=0.77, SPF_NEUTRAL=0.779, URIBL_JP_SURBL=1.25]
    autolearn=spam
Received: from deimos.surnet.ru (deimos.surnet.ru [195.54.2.18])
    by mail4.emailconfig.com (Postfix) with SMTP id 407A4398199
    for <webhostingunleashed_com@it-mate.co.uk>; Sun, 3 Jun 2012 23:28:18 +0100 (BST)
Date: Mon, 4 Jun 2012 04:28:20 -0700
From: "Digg Support" <noreply@e.digg.com>
Message-Id: <3l2u8vcemcxv0ehidtcn90wj6h8gvt@ebm2.cheetahmail.com>
Mime-Version: 1.0
Subject: [SPAM] Digg Verification
To: webhostingunleashed_com@it-mate.co.uk
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii


A quick check on the IP the fake meds site resides at, shows around 395 domains that are known to have resided there recently (running a check as I write this, but likely some have already moved elsewhere, indeed a quick glance at the results so far, shows some have moved to 91.238.180.91 for example).

I'll pop a copy of the results on here once the validation has finished, but the list of domains in the meantime;

hospitaltab.be
mywelnessasale.be
myprescriptioncialis.be
viagradietfat.be
mastersdegreerx.be
familymedicineviagra.com
leibypharmacylevitra.com
vikingsnotdead.com
dietpillmed.com
contabhealthcare.com
newpillscare.com
afterword.couponkidrugstore.com
astarte.couponkidrugstore.com
dietpilldrugstore.com
hightramplate.com
cialisviagracounterpunch.com
mypillhealth.com
newpillshealth.com
drugstorewichi.com
healthwichi.com
ecstasyherbal.com
pillshealthmedical.com
prescriptionmental.com
herbalwiailanthoidol.com
medwibiol.com
altruism.familymedicinepharm.com
herbalwiendotoxin.com
herbalviagragroup.com
carepharmgroup.com
healthviagras.com
bataviagracialis.com
buygenericspills.com
arontratablet.com
newherbaltablet.com
digitalmediaset.com
medslevitraleiby.com
eaheuwdufpi.net
xchjha.ru
nokitore.bestmedicinepharma.ru
pesid.ru
bestpharmacyonline.ru
cjzkef.ru
sdhfg.ru
mail.sdhfg.ru
sdhfg.ru
sdfjgh.ru
df8vh.ru
lupp.ru
cvnmr.ru
mail.cvnmr.ru
cvnmr.ru
sdfhgs.ru
glfkgs.ru
medicinerxtablets.ru
ns1.medicinerxtablets.ru
ns2.medicinerxtablets.ru
blkfts.ru
mail.blkfts.ru
blkfts.ru
plew.ru
thow.ru
maimy.ru
mail.maimy.ru
maisqucqe.com
malariameds.com
marijuanaviagra.com
marijuanawelness.com
matiestoup.com
mechanisticmed.com
mechanisticmeds.com
medcockburn.mobi
medcontab.com
medcounterpunch.com
medicalhealthpills.com
medicalmedicinerx.com
medicalpharmhospital.com
medicalpharmpatients.com
medicalphurt.com
medicalpillgroup.com
medicalrxgroup.com
medicalspillshealth.com
medicalviagragroup.com
medicalwelloch.com
medicalwelnessmedicine.com
medicareherbalprescription.com
medicarelisprescription.com
medicaremedsgroup.com
medicarepanel.com
medicarepharmdebt.com
medicarepharmgroup.com
medicarepharmtax.com
medicarepillsdrugstorehealth.net
medicareprescriptiongroup.com
medicareprescriptionrepublican.com
medicarerdebt.com
medicarerxdebt.com
medicarerxtax.com
medicaresupplementtablet.com
medicareviagragroup.com
medicarewelbizness.com
medicarewelloch.com
medicarewelnessdebt.com
medicinecell.com
medicineclinical.com
medicinepatient.com
medicinepharmacygroup.com
medicineprescriptionbiological.mobi
medicinerxdoctor.com
medicinetablet.com
medicinetabpause.com
medicinewelmedical.com
medidajkat.com
mednewpharm.com
medpharmcounterpunch.com
medphurt.com
medpillawakening.com
medpillsbirth.com
medpillsgroup.com
medprescriptiondrugs.com
medprescriptiongroup.com
medscanadahalfmile.com
medsciali.com
medscialisgroup.com
medsdebt.com
medsdiabetes.com
medsdiet.com
medsdieteat.com
medsdietgroup.com
medsdose.com
medsdruggroup.com
medsdrugstoregroup.com
medsfat.com
medsfitness.com
medsgenericsbiol.com
medsgenericssexual.com
medshalfmile.com
medshealthpatients.com
medshealthplan.com
medsignaling.com
medslevitraleiby.com
medsmedicaid.com
medsmedicare.com
medsmedicaregroup.com
medsmedicinegroup.com
medsphysicians.com
medspillsdrugstorewalgreens.net
medsrxhealthcare.net
medtabpause.com
medtabsamsung.com
medwelawakening.com
medwelbizness.com
medwelcounterpunch.com
medwelpatients.com
medwibiol.com
medzimbra.com
megapixelmedicare.com
mejhiphy.com
mentalprescriptionhealth.com
mentalviagrahealth.com
mibojmuzz.com
mihdushy.com
milktrawelness.com
miqwajeaj.com
miscarriagepills.com
mlnpillssale.com
mlnsale.com
mnirecvyp.com
mnokzeiwma.com
mnyejwylas.com
mommeds.com
movietestworld.com
mretitmufu.com
mroirnafyaf.com
muhylrezzo.com
mulixuimo.com
multimediaaid.com
multimediafix.com
myargoivmyt.com
mycanadatablet.com
mycanadaviagra.com
mycarepill.com
mycaretab.com
mycialismeds.com
mydbyjniqn.com
mydietablet.com
myhealthcarerx.com
myhealthmeds.com
myherbaltab.com
myherbaltablet.com
mylevitrapills.com
mymedicalpharmacy.com
mymedicaltablet.com
mymedicaremeds.com
mymedicarepills.com
mymedicarepills.mobi
mymedicareprescription.com
mymedpharm.com
mymedsdrugstore.com
mymedshealth.com
mypharmacydrugstore.com
mypharmacyherbal.com
mypharmacylevitra.com
mypharmcanada.com
mypharmcialis.com
mypharmed.com
mypharmedical.com
mypharmedicare.com
mypharmedicine.com
mypharmhealthcare.com
mypilldrugstore.com
mypillhealthcare.com
mypillmed.com
mypillmedical.com
mypillmedicare.com
mypillsale.com
mypillsdiet.com
mypillsgenerics.com
mypillshealth.com
mypillsmedical.com
myprescriptiongenerics.com
myprescriptionmedicine.com
myrxhealthcare.com
myrxhealthcare.mobi
myrxmedical.com
myrxmedicare.com
mysalepharmacy.com
mysalerx.com
mysaletab.com
mysaletablet.com
mytabdiet.com
mytabdrugstore.com
mytabherbal.com
mytabletdiet.com
mytablethealth.com
mytabletherbal.com
mytabletlevitra.com
mytabletsale.com
mytabmed.com
mytabsale.com
myviagrahealthcare.com
myviagralevitra.com
myviagramedicine.com
myviagrasale.com
mywelnessasale.com
mywelnesscare.com
mywelnessgenerics.com
mywelnesshealthcare.com
mywelnessmed.com
mywelnessmedicare.com
nahrohtyup.com
nakcihrowys.com
nautolqunjo.com
negojanyf.com
neohdijbijl.com
newcanadarx.com
newcanadatablet.com
newcanadaviagra.com
newcialismeds.com
newcialispharmacy.com
newdietrx.com
newhealthprescription.com
newhealthtablet.com
newherbalpharmacy.com
newherbaltab.com
newherbaltablet.com
newlevitrapills.com
newmedicaltablet.com
newmedicarepills.com
newmedpharm.com
newmedpharmacy.com
newmedpills.com
newmedtab.com
newpharmacycare.mobi
newpharmacydrugstore.com
newpharmacymed.com
newpharmacymedicare.com
newpharmacymedicine.com
newpharmdiet.com
newpharmed.com
newpharmedicine.com
newpilldiet.com
newpillevitra.com
newpillherbal.com
newpillmedical.com
newpillmedicare.com
newpillscare.com
newpillscialis.com
newpillshealth.com
newprescriptioncare.com
newprescriptiondrugstore.com
newprescriptiongenerics.com
newprescriptionhealth.com
newprescriptionlevitra.com
newprescriptionmedicine.com
newrxgenerics.com
newrxhealth.com
newrxmedical.com
newrxmedicine.com
newsaletablet.com
newtabcare.com
newtabdiet.com
newtabletcare.com
newtabletdrugstore.com
newtablethealthcare.com
newtabmed.com
newviagracanada.com
newviagradrugstore.com
newviagraherbal.com
newviagramedicare.com
newviagramedicine.com
newviagrasale.com
newwelnessmedicine.com
newwikimed.com
nigliopl.com
nilonsauk.com
nookdrugstoretablets.net
nookdrugtorehealthtablets.com
nookhealthmedstablets.net
nookpillstablets.net
nooktabletsrx.com
nooktoremedstablets.net
nooktoretabletsrx.net
nrekzedja.net
nrydwetovu.com
nursingwikihealth.com
nutritionviagra.com
nyadpill.com
nyctyckap.com
octybtuph.net
odiojbuafa.com
ogsoslezyks.com
ogtaekluc.com
ohloustyd.com
ohmachoufa.com
oivisbilja.com
olwesfocka.com
ommadrugstorepharmacy.com
ommahealthtablets.net
ommapharmacyrx.net
onevoicevitrawelness.com
onkulbyns.com
onogpyddie.com
optimuspharmacy.com
opylpuzry.net
oqulhisfa.com
oqwyucsawhy.com
oraipnuac.com
ordykodad.com
otrowqusu.com
ottawacanadapharm.com
ovuljedumvi.com
oypoyvhesdau.com
ozfiokaxmy.com
painpillstablets.com
pakistancialis.com
pakistanicialis.com
pakistanlismeds.com
pakistanlispharmacy.com
pakistanlnesscialis.com
patientpillmedicine.com
patientrxmedical.com
patientsarmedicine.com
patientscarepharmacy.com
patientsdrugsmedicine.com
patientselnessmedical.com
patientshealthpill.com
patientshealthtablet.com
patientskimedicine.com
patientslnessmedical.com
patientslnessmedicine.com
patientsmedicinepharm.com
patientspharmacymedicine.com
patientspillcare.com
patientspillmedicare.mobi
patientspillmedicine.com
patientspillsmedicine.com
patientsprescriptionmedical.com
patientstabhealthcare.com
patientstablethealthcare.com
patientstabmedicine.com
patientsviagracare.com
patientswelnessmedicine.com
patientsxmedicine.com
pausecanada.com
pausehealthcaretab.com
pausetabgenerics.com
pausetabmed.com
pausetratab.com
pcipharm.com
pctpills.com
pcttab.com
pctviagrasale.mobi
petraeuselnesscialis.com
pharhospital.com
pharmacyawakening.com
pharmacycarepatients.com
pharmacycialisprescription.com
pharmacycifrazier.com
pharmacydebt.com
pharmacydrugstorefda.com
pharmacyfitnessrx.com
pharmacyfood.com
pharmacyhealthcarepatients.com

No comments: