欢迎光临
我们一直在努力

垃圾邮件”Scan from a Hewlett-Packard Officejet” spam / caskjfhlkaspsfg.ru

转个老外的帖子:http://blog.dynamoo.com/2012/03/scan-from-hewlett-packard-officejet.html

Another malicious spam, this time with an attachment containing obfuscated code leading to caskjfhlkaspsfg.ru.

 

 

Date: Thu, 1 Mar 2012 09:43:50 +0530

From: ARLYNEO93ESQUIVEL@gmail.com

Subject: Fwd: Re: Fwd: Scan from a Hewlett-Packard Officejet #603320

Attachments: HP_Scan-27-499614.htm

 

Attached document was scanned and sent

 

to you using a Hewlett-Packard HP SmartJet 4931F.

 

 

 

Sent by: ARLYNE

Pages : 9

Attachment Type: .HTM [Internet Explorer/Mozilla Firefox]

 

The malware is on caskjfhlkaspsfg.ru:8080/images/aublbzdni.php , as with other recent .ru:8080 attacks, this is multihomed on a familiar set of IP addresses:

 

50.31.1.105 (Steadfast Networks, US)

69.60.117.183 (Colopronto, US)

78.107.82.98 (Corbina Telecom, Russia)

83.238.208.55 (Netia Telekom, Poland)

95.156.232.102 (Optimate-server, Germany)

96.125.168.172 (Websitewelcome, US)

111.93.161.226 (Tata Teleservices, India)

125.19.103.198 (Bharti Infotel, India)

128.134.57.112 (Kwangun University, Korea)

173.203.51.174 (Slicehost, US)

184.106.200.65 (Slicehost, US)

184.106.237.210 (Slicehost, US)

190.81.107.70 (Telemax, Peru)

199.204.23.216 (ECSuite, US)

200.169.13.84 (Century Telecom Ltda, Brazil)

209.114.47.158 (Slicehost, US)

210.56.23.100 (Commission For Science And Technology, Pakistan)

210.109.108.210 (Sejong Telecom, Korea)

 

A bare list for copy-and-pasting:

50.31.1.105

69.60.117.183

78.107.82.98

83.238.208.55

95.156.232.102

96.125.168.172

111.93.161.226

125.19.103.198

128.134.57.112

173.203.51.174

184.106.200.65

184.106.237.210

190.81.107.70

199.204.23.216

200.169.13.84

209.114.47.158

210.56.23.100

210.109.108.210

赞(0) 打赏
未经允许不得转载:刘旭的人个博客 » 垃圾邮件”Scan from a Hewlett-Packard Officejet” spam / caskjfhlkaspsfg.ru
分享到: 更多 (0)
标签:

评论 抢沙发

评论前必须登录!

 

QQ :13945502电话:13913571631

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

微信扫一扫打赏

×
订阅图标按钮