The Latest in IT Security

“You’ve just ordered pizza from our site” / uiwewsecondary.ru

17
Apr
2012

We haven’t seen this “pizza spam” (or spam pizza?) for a while. Rest assured, it leads to malware on uiwewsecondary.ru:

Date:      Mon, 16 Apr 2012 08:40:47 -0500
From:      [email protected]
Subject:      Order confirmation

You’ve just ordered pizza from our site

Pizza Triple Meat Italiano with extras:
– Ham
– Ham
– Bacon Pieces
– Pineapple
– Onions
– Easy On Cheese
– No Sauce
Pizza Chicken Supreme with extras:
– Ham
– Jalapenos
– Black Olives
– Extra Cheese
– Extra Sauce
Pizza Hawaiian Luau with extras:
– Pepperoni
– Italian Sausage
– Beef
– Pineapple
– Easy On Cheese
– No Sauce
Pizza Chicken Supreme with extras:
– Italian Sausage
– Bacon Pieces
– Italian Sausage
– Jalapenos
– Diced Tomatoes
– Green Peppers
– Easy On Cheese
– Extra Sauce
Drinks
– Fanta x 4
– Limonade x 6
– Schweppes x 6
– Sprite x 2
Total Charge:    89.70$

If you haven’t made the order and it’s a fraud case, please follow the link and cancel the order.
CANCEL ORDER NOW!

If you don’t do that shortly, the order will be confirmed and delivered to you.

With Best Regards
Pizza by AMERIGO

The malicious payload is at uiwewsecondary.ru:8080/internet/fpkrerflfvd.php (report here) hosted on some familiar IP addresses (a subset of the ones found here):

41.168.5.140 (Neotel, South Africa)
62.85.27.129 (Microlink, Latvia)
83.170.91.152 (UK2.NET, UK)
85.214.204.32 (Strato AG, Germany)
88.190.22.72 (Free SAS / ProXad, France)
89.31.145.154 (Nexen, France)
112.78.124.115 (Sakura Internet, Japan)
210.56.23.100 (Commission For Science And Technology, Pakistan)
211.44.250.173 (SK Broadband, Korea)
219.94.194.138 (Sakura Internet, Japan)

Plain list for copy-and-pasting:
41.168.5.140
62.85.27.129
83.170.91.152
85.214.204.32
88.190.22.72
89.31.145.154
112.78.124.115
210.56.23.100
211.44.250.173
219.94.194.138

Leave a reply


Categories

THURSDAY, AUGUST 22, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments

Social Networks