{"id":14618,"date":"2013-10-07T00:00:54","date_gmt":"2013-10-07T06:00:54","guid":{"rendered":"https://www.webroot.com/blog/?p=14618"},"modified":"2018-01-30T12:12:00","modified_gmt":"2018-01-30T19:12:00","slug":"cybercriminals-offer-spam-friendly-smtp-servers-rent-part-two","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/10\/07\/cybercriminals-offer-spam-friendly-smtp-servers-rent-part-two\/","title":{"rendered":"Cybercriminals offer spam-friendly SMTP servers for rent – part two"},"content":{"rendered":"

We continue to spot new cybercrime ecosystem<\/strong><\/a> propositions for spam-ready<\/strong><\/a>, cybercrime-friendly SMTP (Simple Mail Transfer Protocol) targeting QA (Quality Assurance) aware cybercriminals looking to gain access to dedicated mail servers with clean IP reputation<\/strong><\/a>, ensuring that their campaigns will reach the recipient’s Inbox. Relying on ‘in-house’ built infrastructure or direct outsourcing to bulletproof hosting providers, these services continue empowering prospective customers with managed, popular spam software compatible services, potentially exposing millions of users to fraudulent or malicious email campaigns.<\/p>\n

Let’s discuss yet another managed service offering spam-ready SMTP servers, and connect it to malicious campaigns that have directly interacted with the same infrastructure it’s currently hosted on, indicating that it’s already “in business”.<\/p>\n

<\/p>\n

Sample screenshot of the inventory of harvested emails offered by the service:<\/strong><\/p>\n

\"Cybercrime_Spam_SMTP_Servers_Buy_Purchase_Rent_Managed_Service\"<\/a><\/p>\n

Sample pricing scheme offered by the spam-ready managed SMTP service in Rubles, based on the number of emails to be delivered:<\/strong><\/p>\n

\"Cybercrime_Spam_SMTP_Servers_Buy_Purchase_Rent_Managed_Service_01\"<\/a><\/p>\n

Sample screenshot of the pricing scheme for high-volume spam customers on a monthly\/yearly basis in Rubles:<\/strong><\/p>\n

\"Cybercrime_Spam_SMTP_Servers_Buy_Purchase_Rent_Managed_Service_02\"<\/a><\/p>\n

The Web site of the service currently responds to 92.53.125.90<\/strong>, with the same IP known to have been participating in a multiple malicious client-side exploits serving campaigns.<\/p>\n

Not surprisingly, we can easily correlate malicious\/spam activity that’s been taking place through related domain that are known to have been responding to the same IP (92.53.125.90<\/strong>) over the past couple of months.<\/p>\n

Known to have responded to the same IP are also the following malicious\/fraudulent domains:<\/strong>
\n1novishop.ru<\/em>
\n2353333.ru<\/em>
\n3-16.ru<\/em>
\na-kara.ru<\/em>
\naist-letit.ru<\/em>
\nakpp-samara.ru<\/em>
\nalekseikondratenko.ru<\/em>
\nantonagafonov.com<\/em>
\napuzzle.ru<\/em>
\nazmarketing.az<\/em>
\nbarguzin.su<\/em>
\nbibcamvids.tmweb.ru<\/em>
\nbigbakery.ru<\/em>
\nblack-panther.ru<\/em>
\nblog-net.ru<\/em>
\nbloody-knight.ru<\/em>
\nbloodyfight.net<\/em>
\nbpost.kz<\/em>
\nbudetsuper.ru<\/em>
\nbumblebee.timeweb.ru<\/em><\/p>\n

We’re also aware of the following malicious MD5s that are known to have directly communicated with the same IP (92.53.125.90) over the last couple of months:<\/strong>
\nMD5: 7803671e9968000944fd784710c1eefd
\nMD5: 3619a6ca52c100abce2c0bd8f8b47c4d
\nMD5: 2dcfa7175ca4585fe2fe5cd2e3df2e4c
\nMD5: d9d78697efae9f4ab91146926a4c6270
\nMD5: 86d5218dd28e13d3422d40a774996677
\nMD5: 437b9b83e1c9c5acabce191622090d57
\nMD5: 8c935280e432afe193b67de986389e84
\nMD5: 0ac8272b54dc0c42d62a2e570dde8ee7
\nMD5: d99399f600b2143167ac3891fa7c2c94
\nMD5: 1f6a6618d1a5d119f7ebb45f05e76066
\nMD5: 087cba21e1fdc739e0ff57528be02bcc
\nMD5: 774c7763a6a0f11628ee7360edb8780e
\nMD5: 21856c83167d364394beb83474379fea
\nMD5: af168e2d558167d85ee25afcb1fce46a<\/p>\n

In particular the samples have phoned back to the following URLs that are known to have responded to the same IP that the managed SMTP spam service is currently hosted on:<\/strong>
\nzazaru.com (92.53.125.90)<\/em>
\nckynyagan.ru (92.53.125.90)<\/em>
\npravonapravo.com.ua (92.53.125.90)<\/em>
\nust-jugan.ru (92.53.125.90)<\/em>
\nrp.fast-worlds.com (92.53.125.90)<\/em>
\nxn—-7sbhbmbrhbip1ajtrecv1fxf.xn--p1ai (92.53.125.90)<\/em>
\nsrub68.ru (92.53.125.90)<\/em>
\nbloodyfight.net (92.53.125.90)<\/em><\/p>\n

All of these sample establish a UDP communication channel to the following C&C server:\u00a0208.115.109.53:8010<\/strong><\/p>\n

How is the actual spamming and acquisition of the spam-ready infrastructure taking place? Through compromised Web sites. Consider going through this assessment of the actual malware<\/strong><\/a> used in these campaign courtesy of the fine\u00a0folks at Abuse.ch.<\/p>\n","protected":false},"excerpt":{"rendered":"

We continue to spot new cybercrime ecosystem propositions for spam-ready, cybercrime-friendly SMTP (Simple Mail Transfer Protocol) targeting QA (Quality Assurance) aware cybercriminals looking to gain access to dedicated mail servers with clean IP reputation, ensuring that their campaigns will reach the recipient’s Inbox. Relying on ‘in-house’ built infrastructure or direct outsourcing to bulletproof hosting providers, […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[5887,11559,16203,4043,16201,4047,4065,10703,16199,16197,4019,4029,5885,5605,3947,10623,10615,15731,11601,3471],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/14618"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=14618"}],"version-history":[{"count":7,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/14618\/revisions"}],"predecessor-version":[{"id":22765,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/14618\/revisions\/22765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=14618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=14618"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=14618"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=14618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}