Malware Alert: ET TROJAN Request for fake postal receipt from e-mail link(Suricata /w Emerging Threats Pro) -- -- -- -- - "Manager Anthony Haley" Fedex fake parcel receipt scam with link redirecting to URL at malware site: h**p://www.atlantaprinters.net/components/.xoounq.... (DO NOT CLICK ON LINK). - - - - - - - - - Scam seemingly sent by service@imx-postal.com from Turkish IP: 85.153.76.140 (linux.ayvazhosting.com); Actual sender: nakliyf@linux.ayvazhosting.com Reply-To: "Manager Anthony Haley" <service@imx-postal.com> - - - - - - Source IP: 85.153.76.140 Nameserver :ns10.ayvazhosting.com Nameserver :ns11.ayvazhosting.com ISP & Organization: Sistem Gelistirme Servis Telekomunikasyon Ve Ileti Host Name: 85.153.76.140 Country: Sanayi, 07 Antalya, Turkey. - - - - - - - - - - Received: from linux.ayvazhosting.com ([85.153.76.140]) by ***); Tue, 9 Apr 2013 01:49:15 -0700 Received: from nakliyf by linux.ayvazhosting.com with local (Exim 4.80) (envelope-from <nakliyf@linux.ayvazhosting.com>) id 1UModj-0007fl-JZ for ----; Tue, 02 Apr 2013 02:59:51 +0300 To: -- Subject: Tracking Info X-PHP-Script: nakliyefirmalar.com/.554b.php for 127.0.0.1 From: "Manager Anthony Haley" <service@imx-postal.com> X-Mailer: XimianEvolution1.4.6 Reply-To: "Manager Anthony Haley" <service@imx-postal.com> **** Message-Id: <E1UModj-0007fl-JZ@linux.ayvazhosting.com> Date: Tue, 02 Apr 2013 02:59:51 +0300 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - linux.ayvazhosting.com X-AntiAbuse: Original Domain - hotmail.com X-AntiAbuse: Originator/Caller UID/GID - [615 614] / [47 12] X-AntiAbuse: Sender Address Domain - linux.ayvazhosting.com X-Get-Message-Sender-Via: linux.ayvazhosting.com: authenticated_id: nakliyf/only user confirmed/virtual account not confirmed Return-Path: mailto:nakliyf@linux.ayvazhosting.com X-OriginalArrivalTime: 09 Apr 2013 08:49:15.0701 (UTC) FILETIME=[1D86EE50:01CE34FF]
Please help us keep Internet safer and cleaner by leaving a descriptive comment about 85.153.76.140 IP address
- Hacked Gmail accounts
- WordPress Hacking Attempts
- SSH Hacking Attempts
- Why Can't I See The Exact Address?
DNSBL* - is a list of IP addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be used by DNS server software, or as a live DNS zone that can be queried in real-time. DNSBLs are most often used to publish the addresses of computers or networks linked to spamming; most mail server software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists.
WHOIS** - is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. WHOIS lookups were traditionally performed with a command line interface application, and network administrators predominantly still use this method, but many simplified web-based tools exist. WHOIS services are typically communicated using the Transmission Control Protocol (TCP). Servers listen to requests on the well-known port number 43.
** Approximate Geographic Location - This is NOT the exact geographical location of the person/organization with the given IP address. However, this should still give you a good idea about the area/region where this person/orgranization is located.