Last visit was: Sat Jul 05, 2014 2:11 pm
It is currently Sat Jul 05, 2014 2:11 pm

CDC Vaccine Registry phish

Board index » Cybercrime » Phishers

All times are UTC - 5 hours [ DST ]

 Page 1 of 1
  [ 7 posts ] 
  Previous topic | Next topic 
Author Message
AlphaCentauri
 PostPosted: Tue Dec 01, 2009 12:16 pm   
You are kiillllling-a my bizinisss!
User avatar

Joined: Thu Mar 01, 2007 3:01 am
Posts: 5915
This one looks pretty convincing until you dig:

Quote:
Subject: Creation of your personal Vaccination Profile

You have received this e-mail because of the launching of State Vaccination H1N1 Program.
You need to create your personal H1N1 (swine flu) Vaccination Profile on the cdc.gov website. The Vaccination is not obligatory, but every person that has reached the age of 18 has to have his personal Vaccination Profile on the cdc.gov site. This profile has to be created both for the vaccinated people and the not-vaccinated ones. This profile is used for the registering system of vaccinated and not-vaccinated people.
Create your Personal H1N1 Vaccination Profile using the link:
Create Personal Profile [links to http://online.cdc.gov.nyugewc.be/h1n1flu/profile.php?&session_id=[very long alphanumeric ID]&email=[[email protected]]]

Centers for Disease Control and Prevention (CDC) · 1600 Clifton Rd · Atlanta GA 30333 · 800-CDC-INFO (800-232-4636)


Needless to say, nyugewc.be is in Belgium, not Atlanta, Georgia where the Centers for Disease Control is located. Also, the CDC is a federal program and would not be creating a state registry -- state health departments would be doing that. There are minor grammatical and capitalization errors you would hope would be caught before a government email was sent, even though the CDC probably employs an international staff. The spam was mailed from 95.65.244.238, which in in Turkey, also not a likely choice for a US federal program.

The linked page
http://spamtrackers.eu/wiki/index.php/Image:CDC.jpg
has a download vacc_profile.exe, which Avira detects as a trojan TR/Crypt.XPACK.Gen, but only 3 of 41 programs tested at VirusTotal detect it:
http://www.virustotal.com/analisis/be45 ... 1259683346

Quote:
Antivirus ..... Version ..... Result
a-squared ..... 4.5.0.43 ..... -
AhnLab-V3 ..... 5.0.0.2 ..... -
AntiVir ..... 7.9.1.88 ..... TR/Crypt.XPACK.Gen
Antiy-AVL ..... 2.0.3.7 ..... -
Authentium ..... 5.2.0.5 ..... -
Avast ..... 4.8.1351.0 ..... -
AVG ..... 8.5.0.426 ..... -
BitDefender ..... 7.2 ..... -
CAT-QuickHeal ..... 10 ..... -
ClamAV ..... 0.94.1 ..... -
Comodo ..... 3102 ..... -
DrWeb ..... 5.0.0.12182 ..... -
eSafe ..... 7.0.17.0 ..... -
eTrust-Vet ..... 35.1.7150 ..... -
F-Prot ..... 4.5.1.85 ..... -
F-Secure ..... 9.0.15370.0 ..... -
Fortinet ..... 4.0.14.0 ..... -
GData ..... 19 ..... -
Ikarus ..... T3.1.1.74.0 ..... -
Jiangmin ..... 11.0.800 ..... -
K7AntiVirus ..... 7.10.906 ..... -
Kaspersky ..... 7.0.0.125 ..... -
McAfee ..... 5818 ..... -
McAfee+Artemis ..... 5818 ..... -
McAfee-GW-Edition ..... 6.8.5 ..... Heuristic.BehavesLike.Win32.Downloader.H
Microsoft ..... 1.5302 ..... -
NOD32 ..... 4652 ..... a variant of Win32/Kryptik.BFV
Norman ..... 6.03.02 ..... -
nProtect ..... 2009.1.8.0 ..... -
Panda ..... 10.0.2.2 ..... -
PCTools ..... 7.0.3.5 ..... -
Prevx ..... 3 ..... -
Rising ..... 22.24.01.09 ..... -
Sophos ..... 4.48.0 ..... -
Sunbelt ..... 3.2.1858.2 ..... -
Symantec ..... 1.4.4.12 ..... -
TheHacker ..... 6.5.0.2.082 ..... -
TrendMicro ..... 9.100.0.1001 ..... -
VBA32 ..... 3.12.12.0 ..... -
ViRobot ..... 2009.12.1.2065 ..... -
VirusBuster ..... 5.0.21.0 ..... -


It's botnet hosted:
Quote:
;; QUESTION SECTION:
;online.cdc.gov.nyugewc.be. IN A

;; ANSWER SECTION:
online.cdc.gov.nyugewc.be. 1800 IN A 201.226.30.225
online.cdc.gov.nyugewc.be. 1800 IN A 201.245.214.219
online.cdc.gov.nyugewc.be. 1800 IN A 41.251.26.102
online.cdc.gov.nyugewc.be. 1800 IN A 59.92.38.67
online.cdc.gov.nyugewc.be. 1800 IN A 89.218.225.216
online.cdc.gov.nyugewc.be. 1800 IN A 95.56.119.112
online.cdc.gov.nyugewc.be. 1800 IN A 112.202.208.222
online.cdc.gov.nyugewc.be. 1800 IN A 114.27.194.64
online.cdc.gov.nyugewc.be. 1800 IN A 119.95.219.202
online.cdc.gov.nyugewc.be. 1800 IN A 121.96.99.25
online.cdc.gov.nyugewc.be. 1800 IN A 187.35.57.20
online.cdc.gov.nyugewc.be. 1800 IN A 189.15.118.17
online.cdc.gov.nyugewc.be. 1800 IN A 189.53.127.134
online.cdc.gov.nyugewc.be. 1800 IN A 196.217.230.35
online.cdc.gov.nyugewc.be. 1800 IN A 201.27.211.43


Nameservers:
ns1.davies-estates.com (Xin Net)
ns1.pandachine.com (Moniker)
Top
 Profile  
spamislame
 PostPosted: Tue Dec 01, 2009 2:34 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
This is the same bunch of assholes behind the TRS, Chase Bank, Ally Bank, etc. etc. etc. Zbot infections.

That same domain is still hosting the Ally Bank, Chase Bank and IRS scams as well as this alleged "CDC" scam.

SiL
Top
 Profile  
spamislame
 PostPosted: Tue Dec 01, 2009 2:36 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
Oh!

And Gar Warner is already on it:

http://garwarner.blogspot.com/2009/12/m ... -zeus.html

SiL
Top
 Profile  
AlphaCentauri
 PostPosted: Tue Dec 01, 2009 3:51 pm   
You are kiillllling-a my bizinisss!
User avatar

Joined: Thu Mar 01, 2007 3:01 am
Posts: 5915
One registrar on the case:
Quote:
Hello,

The domain and account have been deleted.

Sincerely,
Moniker.com Support Center
Top
 Profile  
spamislame
 PostPosted: Tue Dec 01, 2009 4:41 pm   
Site Admin
User avatar

Joined: Tue May 09, 2006 9:18 am
Posts: 5022
That's great, but there are, on average, 20,000 or more per day of these domains.

I know Mr. Warner is routinely reporting every single one of them, and has the attention of law enforcement as well.

They're persistent little buggers.

SiL
Top
 Profile  
AlphaCentauri
 PostPosted: Tue Dec 01, 2009 6:29 pm   
You are kiillllling-a my bizinisss!
User avatar

Joined: Thu Mar 01, 2007 3:01 am
Posts: 5915
spamislame wrote:
That's great, but there are, on average, 20,000 or more per day of these domains.


ns1.pandachine.com is the nameserver. Just a quick search comes up with all these domains depending on it, likely only a small part of the total, since I easily found one not on the list just by matching the pattern of the domain names:
Quote:
nyugewc.be NS ns1.pandachine.com
nyugewd.be NS ns1.pandachine.com
lykasf.be NS ns1.pandachine.com
lykasm.be NS ns1.pandachine.com
nyugewm.be NS ns1.pandachine.com
nyugewn.be NS ns1.pandachine.com
nyugewq.be NS ns1.pandachine.com
nyugewt.be NS ns1.pandachine.com
lykasv.be NS ns1.pandachine.com
nyugeww.be NS ns1.pandachine.com
nyugewy.be NS ns1.pandachine.com
lykasz.be NS ns1.pandachine.com
nyugewz.be NS ns1.pandachine.com
hreesf.im NS ns1.pandachine.com
hreesf.org.im NS ns1.pandachine.com
hrees.org.im NS ns1.pandachine.com
hreesv.org.im NS ns1.pandachine.com
hreesf.com.im NS ns1.pandachine.com
hrees.com.im NS ns1.pandachine.com
hreesv.com.im NS ns1.pandachine.com
hreesf.co.im NS ns1.pandachine.com
hrees.co.im NS ns1.pandachine.com
hreesv.co.im NS ns1.pandachine.com
hrees.im NS ns1.pandachine.com
hreesf.net.im NS ns1.pandachine.com
hrees.net.im NS ns1.pandachine.com
hreesv.net.im NS ns1.pandachine.com
hreesv.im NS ns1.pandachine.com
pandachine.com NS ns1.pandachine.com


The list for ns2.pandachine.com comes up with the same domains, even though dnsstuff traversal doesn't return that result. Perhaps they thought they'd be clever and let us blackhole the one without inactivating the other, or maybe they swap off. I'm not sure why dnsstuff misses it:

Quote:
Looking up at the 2 nyugewy.be. parent servers:
Server Response Time
ns1.davies-estates.com [67.202.107.79] Timeout
ns1.pandachine.com [0.0.0.0] Timeout


When I try an alternate lookup I get
Quote:
dig: couldn't get address for 'ns1.pandachine.com': not found


ns2.pandachine.com isn't responding when I check that way, either.

They've done the same with the other nameserver, too, and since it's still alive, you can query it:
Quote:
; <<>> DiG 9.3.2 <<>> @ns1.davies-estates.com lykasz.be A
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36548
;; flags: qr aa rd; QUERY: 1, ANSWER: 15, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;lykasz.be. IN A

;; ANSWER SECTION:
lykasz.be. 1800 IN A 196.217.221.240
lykasz.be. 1800 IN A 201.43.94.97
lykasz.be. 1800 IN A 201.92.93.89
lykasz.be. 1800 IN A 201.172.137.233
lykasz.be. 1800 IN A 41.251.26.102
lykasz.be. 1800 IN A 95.65.187.65
lykasz.be. 1800 IN A 118.171.133.110
lykasz.be. 1800 IN A 119.95.219.202
lykasz.be. 1800 IN A 125.202.254.181
lykasz.be. 1800 IN A 189.18.151.58
lykasz.be. 1800 IN A 190.25.74.65
lykasz.be. 1800 IN A 190.35.186.15
lykasz.be. 1800 IN A 190.161.75.6
lykasz.be. 1800 IN A 190.163.65.177
lykasz.be. 1800 IN A 190.209.12.55

;; AUTHORITY SECTION:
lykasz.be. 1800 IN NS ns1.davies-estates.com.
lykasz.be. 1800 IN NS ns2.davies-estates.com.

;; ADDITIONAL SECTION:
ns1.davies-estates.com. 1800 IN A 94.23.177.147
ns2.davies-estates.com. 1800 IN A 122.197.244.37

;; Query time: 13 msec
;; SERVER: 94.23.177.147#53(94.23.177.147)
;; WHEN: Tue Dec 1 23:22:08 2009
;; MSG SIZE rcvd: 353


The ns.2 nameserver doesn't show up in dnsstuff. That's the sort of detail Xin Net will miss, too.

.im is Isle of Mann. They appear to be shutting these down much more promptly than .be (Belgium).

The other question is are the phishers really paying for 20,000 domains a day with their own money? If not, it doesn't matter how many they registered in bulk; if they stiffed the registrar by paying with someone else's paypal account, the registrar will probably suspend them in bulk, too.
Top
 Profile  
AlphaCentauri
 PostPosted: Thu Dec 03, 2009 4:57 pm   
You are kiillllling-a my bizinisss!
User avatar

Joined: Thu Mar 01, 2007 3:01 am
Posts: 5915
The CDC has a warning on their website, and has sent out an email alert to addresses on their mailing list:
http://www.cdc.gov/hoaxes_rumors.html
Top
 Profile  
 Page 1 of 1
  [ 7 posts ] 

Board index » Cybercrime » Phishers

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: Wayback machine and 0 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  


Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style originally created by Volize © 2003 • Redesigned SkyLine by MartectX © 2008