.PIF files are like those organs we are said to have for some reason that are not necessary in these modern times. If you still remember the pain of migrating from DOS 5.0 to Windows 3.0, you will remember that we had .PIF files because DOS binaries did not have all the niceties of Windows programs, such as embedded icons and a place to store the default start-up path. Back when Ugg the Caveman was discovering fire and Bill Gates was leading a development team, you could make your DOS Executables APPEAR to be Windows files by sticking a .PIF file of the same name in the same directory. Windows knew that it should associate the .PIF file with the .EXE or .COM file of the same name, and suddenly we had icons! Of course the malware authors have done some sneaky things with this in the past. When Sality was a young pup, browsing a directory that contained the ".pif" format of Sality was enough to get Windows to execute the malware -- because "Active Desktop" knew that if it saw a .PIF file, it should load it so it would know what graphical icon to associate with which programs in the directory listing. Unfortunately, that was all Sality needed to launch itself! So many people were victimized thinking that the AUTORUN=OFF on their thumb drive had failed without realizing it was just what .PIF files did back then.

So, this morning in the Malcovery Spam Data Mine we saw 1,440 copies of a spam message claiming to be from "orange.pl" with the subject "MMS-ie" and a 70,390 byte .zip file with a randomly numbered IMG#####.zip filename. The .ZIP file contained a 126,976 byte .PIF file that was named "IMG875002763.JPEG.pif" and had an MD5 hash of d382068a8666914584d0ae51dd162c6b. When I just checked the file a few minutes ago on VirusTotal, thinking I would see various Zeus-related malware names based on the SCMag / WebSense articles, I was surprised to see that the file was actually TinBa or "Tiny Banker"!

Late last week I was one of the many folks trying to get a friend to get me a copy of the Tinba source code that had been leaked, as Peter Kruse over at CSIS told us on July 10, 2014 (See Tinba/Hunterz source code published. Peter shared a talk The Hunterz Inside Tinba at the recent Cyber Threat Summit, and, with Trend Micro's Robert McArdle and Feike Hacquebord, released a paper called "W32.Tinba, The Turkish Incident" (a 24-page PDF that gives great insights into the malware family).

Tinba: The Polish Incident

Jeżeli Twój telefon nie obsługuje wiadomości multimedialnych, możesz je wysyłać i odbierać korzystając ze Skrzynki MMS lub Albumu MMS. Wystarczy, że zalogujesz się na www.orange.pl. O każdym otrzymanym na skrzynkę MMS-ie powiadomimy Cię E-mail.

Jeśli odbiorca wiadomości nie ma telefonu z obsługą MMS będzie mógł ją odebrać logując się w portalu www.orange.pl, a następnie wybierając Multi Box i zakładkę MMS. Wiadomości multimedialne możesz też wysyłać na dowolny adres e-mail.

In case you aren't as fluent in Polish as the rest of us, here is how Google Translate renders that:

If your phone does not support multimedia messages, you can send and receive using the Crates MMS or MMS Album. Simply log on www.orange.pl. For each received in an MMS message box will send you e-mail. If the recipient of the message does not have MMS-capable phone will be able to pick it up by logging into the portal www.orange.pl, and then select Multi Box and MMS tab. Multimedia messages can also be sent to any e-mail.

The spam from July 11th was also in Polish, and also imitated Orange, although this time the sender was Orange.com. There was a .zip file attached, which contained a file named "DKT_Faktura_indywidualna_2014_07_11_R.pdf.pif" which was 102,400 bytes in size and had an MD5 hash of da9330aa6d275ba28954b88ecf27dedb. The .zip file was 70,323 bytes with MD5 hash of fc1e0a665f99b347e424281a8a6a2526. The spam from July 11th was also Tinba spam, according to many vendors at VirusTotal. But the email body was much simpler. The message, still in Polish, was:

Witamy,

Przesyłamy fakturę Telekomunikacji Polskiej w wersji elektronicznej za czerwiec 2014.

Welcome,

We send an invoice Polish Telecom in the electronic version for June 2014.

But of course it was more malware, disquised as an invoice but actually a .pif file.

The current detection at VirusTotal for that campaign is 33 of 53 detections.

Unlike the Turkish Incident, where Tinba was being dropped by the Blackhole Exploit Kit, in the current spam, Tinba is directly attached to the email message.

This phish has been especially popular this year. Malcovery's PhishIQ service has seen more than 1,000 SFR phish on more than 330 hacked servers so far this year, including dozens just in the month of July 2014. More importantly though, the attackers are growing more sophisticated! The attack described below is one of the most sophisticated phish we've seen to date, employing "man-in-the-middle" logins where SFR credentials are tested before the victim is allowed to proceed, and nearly a dozen customized bank security procedure questions being processed.

In a typical example of these phish, the victim receives an email that appears to be from SFR informing them that an error was made in their bill, "Ce mail vous a été envoyé dans le but de vous informer qu une erreur est survenue lors de l établissement de la dernière facture" and to "Cliquer ici pour ouvrir le formulaire de remboursement" (Click here to open the refund form). The victim is also warned that they need to fill out the form completely, or they won't get their refund (in some cases 95 Euros!):

Veuillez accepter nos excuses par cette erreur comptable. SFR : Service comptabilité de SFR Toute omission, mauvaise saisie, ou non réponse a ce mail entrainera automatiquement une amputation de la somme de quatre-vingt-quinze (95) euros sur votre compte, et aucune réclamation de sera acceptée.

Vos coordonnées n'ont polo été reconnues. -- Your details have not been recognized.
Veuillez recommencer. -- Please try again.
Suite à 5 erreurs sur votre mot de passe, -- After 5 errors on your password
votre compte est bloqué. -- Your account will be blocked.

So, with a little incentive to not lie to the criminal, and a fairly strong reason to believe they are really speaking with SFR, the victim continues to page two after providing true login credentials.

On the second page, the victim is invited to choose their bank from a long list of French banks. Depending on which bank they choose, they will be prompted for appropriate additional verification details used by that bank. Banks on the list include:

• AXA Banque
• Banque AGF / Allianz
• Banque de Savoie
• Banque Dupuy de Parseval
• Banque Marze
• Banque Palatine
• Banque Populaire
• Banque Postale
• Barclays
• BforBank
• Binck.fr
• BNP
• BNP Paribas La NET Agence
• Boursorama Banque
• BPE
• Caisse d'Epargne
• CIC
• Coopabanque
• Crédit Agricole
• Crédit Cooperatif
• Crédit du Nord
• Crédit Mutuel
• Crédit Mutuel de Bretagne
• Crédit Mutuel Massif Central
• Crédit Mutuel Sud-Ouest
• e.LCL
• Fortis Banque
• Fortuneo Banque
• Groupama Banque
• HSBC
• ING Direct
• LCL
• Monabanq
• Societe Generale
• Société Marseillaisle de Crédit
• Autre Banque

• Quel est le prénom de l'aîné(e) de vos cousins et cousines ?
• Quel était le prénom de votre meilleur(e) ami(e) d'enfance ?
• Quel était votre dessin animé préféré ?
• Quel a été votre lieu de vacances préféré durant votre enfance ?

After seeing this message briefly, the visitor is forwarded to the true www.SFR.fr website.

Today a friend mentioned that they had seen several ASProx messages being distributed by domains that looked like law firm names warning of court appearances. I was a bit surprised that this was news to him, as we've been seeing this for some time. I thought it might be interesting to try to identify when the campaign began.

First, I was fairly certain that the campaign my friend referred to was the "Notice to appear" spam that we've written about so many times at Malcovery, but this does seem to be a bit different than the "law firm of the day" notice to appear campaigns we've seen imitating groups like Green Winick and many others including Jones Day (jonesday.com), Latham Watkins (lw.com), Hogan Lovells (hoganlovells.com), McDermitt, Will & Emery (wme.com). Those campaigns were all examples of the ASProx malware. But how are those different than the "truck lawyer" campaigns? It seemed worth taking a look.

For the month of August 2014, so far the daily count on these spam messages has looked like this:

 count |    date    
-------+------------
  1528 | 2014-08-01
   204 | 2014-08-02
  1375 | 2014-08-04
  1670 | 2014-08-05
  1571 | 2014-08-06
  1967 | 2014-08-07
  1541 | 2014-08-08
   129 | 2014-08-09
     1 | 2014-08-10
  1182 | 2014-08-11
  1399 | 2014-08-12
   191 | 2014-08-13
    58 | 2014-08-14
    25 | 2014-08-15
     1 | 2014-08-16
    21 | 2014-08-18
(16 rows)

11727  Urgent court notice
11693  Hearing of your case in Court
11182  Notice to appear
9935  Notice of appearance in court
8424  Notice to Appear
7433  Notice of appearance
7108  Notice to appear in court
6612  Notice to Appear in Court
 643  Court hearing notice
 568  Pretrial notice
 441  Mandatory court appearance

  count |                            sender_domain                            
-------+---------------------------------------------------------------------
     7 | accidentlawyers505.com
     1 | addictionrecoverylawyers.com
   328 | alabamatruckaccidentlawyers.com
   375 | alaskatruckaccidentlawyers.com
   352 | albanycountyelderlawyers.com
    11 | americanaccidentlawyers.com
     8 | anewgenerationoflawyers.com
    17 | arizonaspecialedlawyers.com
   363 | arizonatruckaccidentlawyers.com
   358 | arkansastruckaccidentlawyers.com
    12 | auburnbankruptcylawyers.com
    11 | aviationlawyersnetwork.com
   387 | az-lawyersadvice.com
     6 | bellevuebankruptcylawyers.com
   379 | bensonlawyers.com
     1 | bestlawyersinphoenix.com
     8 | bestlosangeleslawyers.com
   355 | best-ontario-lawyers.com
   361 | biofuelawyers.com
   360 | bronx-injury-lawyers.com
   316 | bronx-personal-injury-lawyers.com
    15 | brooklynelderlawyers.com
   371 | brooklyn-lawyers.com
    12 | bvslawyers.com
   326 | calgarydependentadultlawyers.com
   356 | californiatruckaccidentlawyers.com
   299 | californiaviolentcrimeslawyers.com
     5 | canadianduilawyers.com
   362 | capeannlawyers.com
   311 | caraccidentlawyerskc.com
     8 | career-lawyers.com
   318 | childsupportlawyerslosangeles.com
    13 | colobklawyers.com
   409 | coloradotruckaccidentlawyers.com
   395 | columbus-dui-lawyers.com
     9 | commoninterestlawyers.com
   326 | compasslawyers.com
   390 | connecticuttruckaccidentlawyers.com
    14 | contracosta-caraccident-lawyers.com
    17 | criminalcourtlawyers.com
   334 | criminaldefenselawyers360.com
     4 | crownpointindianawilltrustsprobateestatelderlawattorneyslawyers.com
     9 | csduilawyers.com
     5 | deferredstatuslawyers.com
   401 | delawaretruckaccidentlawyers.com
     1 | divorcelawyersinjacksonvillefl.com
     8 | drugcrimedefenselawyers.com
     5 | dubairealestatelawyers.com
     4 | easternnclawyers.com
    11 | employmentlawyersfortlauderdale.com
    10 | ernestolawyers.com
    10 | escortdefenselawyers.com
     1 | estateprotectionlawyers.com
    12 | falveylawyers.com
   354 | familylawyersoforangecounty.com
    10 | fla-injury-lawyers-blog.com
     9 | fl-criminal-defense-lawyers.com
    10 | fl-criminal-lawyers-blog.com
     7 | fllawyersonline.com
    11 | florida-criminal-defense-lawyers.com
     9 | floridaseniorlawyersassoc.com
   370 | floridatruckaccidentlawyers.com
    15 | fortmyersrealestatelawyers.com
    12 | garzalawyers.com
     9 | gatewaylawyers.com
   388 | georgiatruckaccidentlawyers.com
    12 | gofindlawyers.com
    13 | greatnecklawyersassociation.com
    10 | hartfordctlawyers.com
   361 | hawaiitruckaccidentlawyers.com
     9 | hcvlawyers.com
   351 | highdesertlawyers.com
     7 | hounslowlawyers.com
   372 | houstonmesotheliomalawyers.com
     6 | hphlawyersonbloor.com
     9 | huntingtonaccidentlawyers.com
   385 | idahotruckaccidentlawyers.com
    13 | illinoisbicyclelawyers.com
   347 | illinoistruckaccidentlawyers.com
   308 | immlawyers.com
   330 | indianatruckaccidentlawyers.com
     7 | indy-lawyers.com
     5 | institutionalinvestorlawyers.com
   352 | iowatruckaccidentlawyers.com
   340 | kansastruckaccidentlawyers.com
   300 | kentuckytruckaccidentlawyers.com
     9 | kentuckyyounglawyers.com
   337 | lakelanddivorcelawyers.com
    12 | lancasterautoaccidentlawyers.com
     1 | lawusa.com
     6 | lawyeringforlawyers.com
   311 | lawyersadviceinarizona.com
   350 | lawyersadviceinphoenix.com
     8 | lawyersandloans.com
    14 | lawyersbankruptcysolutions.com
     9 | lawyersbocaraton.com
    11 | lawyerscaringforamerica.com
     7 | lawyerscaringforarizona.com
     8 | lawyerscfo.com
   393 | lawyers-connecting.com
     7 | lawyersforeclosuresolutions.com
     8 | lawyers-germany.com
     8 | lawyersinbalance.com
    15 | lawyersinthecloud.com
     3 | lawyerslawfirms.com
     7 | lawyerslongisland.com
    14 | lawyersonlineguide.com
    13 | lawyerstaxsolutions.com
     1 | lawyersthatrock.com
     5 | lawyersvirtualbookkeeper.com
    10 | lawyerswithdepression.com
    11 | loan-modification-lawyers.com
   364 | long-island-lawyers.com
   356 | louisianatruckaccidentlawyers.com
    11 | mailfrauddefenselawyers.com
   376 | mainetruckaccidentlawyers.com
    10 | malpracticelawyersnewyorkcity.com
   329 | manhattan-injury-lawyers.com
   362 | manhattan-personal-injury-lawyers.com
   318 | marylandtruckaccidentlawyers.com
   807 | massachusettstruckaccidentlawyers.com
    10 | medicalmalpraticelawyers.com
   388 | mesotheliomalawyersonline.com
   402 | michigantruckaccidentlawyers.com
     8 | millbrooklawyers.com
   398 | minnesotatruckaccidentlawyers.com
   374 | mississippitruckaccidentlawyers.com
   361 | missouritruckaccidentlawyers.com
     8 | mitpatentlawyers.com
    11 | mittrademarklawyers.com
     7 | mmspersonalinjurylawyers.com
   374 | montanatruckaccidentlawyers.com
    12 | mylawyersolicitors.com
    14 | myreallawyers.com
     7 | naplesbusinesslawyers.com
   373 | nassau-county-lawyers.com
   329 | nebraskaboatinjurylawyers.com
   315 | nebraskatruckaccidentlawyers.com
     1 | nebraskatruckaccidentlawyers.com.com
   351 | nevadatruckaccidentlawyers.com
   384 | newhampshiretruckaccidentlawyers.com
   398 | newjerseytruckaccidentlawyers.com
   370 | newmexicotruckaccidentlawyers.com
   365 | new-york-city-lawyers.com
     9 | newyorkscaffoldlawyers.com
   393 | newyorktruckaccidentlawyers.com
   339 | njlandlordtenantlawyers.com
   351 | northcarolinatruckaccidentlawyers.com
   377 | northdakotatruckaccidentlawyers.com
   284 | nyautoaccidentlawyers.com
   312 | nycaraccidentlawyers.com
    14 | ohadoptionlawyers.com
   383 | ohiotruckaccidentlawyers.com
   344 | oklahomatruckaccidentlawyers.com
   404 | oregon-lawyers.com
   373 | oregontruckaccidentlawyers.com
    11 | palmbayinjurylawyers.com
     8 | panamacitysocialsecuritydisabilityclaimlawyers.com
   321 | phoenixlawyersadvice.com
     8 | pittsburgaccidentlawyers.com
    12 | poptodorova-lawyers.com
     1 | portstlucie-duilawyers.com
    11 | prescriptiondiversiondefenselawyers.com
    17 | probateadministrationlawyers.com
   314 | productsliabilitylawyers360.com
     9 | refineryfirelawyers.com
   356 | rhodeislandtruckaccidentlawyers.com
    13 | robberydefenselawyers.com
   361 | rockland-county-lawyers.com
   343 | saintpaulinjurylawyers.com
    11 | seattlesbestduilawyers.com
     9 | seattle-trial-lawyers.com
    11 | sfmesolawyers.com
   401 | southcarolinatruckaccidentlawyers.com
   396 | southdakotatruckaccidentlawyers.com
     6 | southfloridaworkerscompensationlawyers.com
   316 | southhamptoninjurylawyers.com
   368 | staten-island-lawyers.com
   358 | stentinjurylawyers.com
    14 | success4lawyers.com
   324 | suffolk-county-lawyers.com
     7 | tacomabankruptcylawyers.com
   386 | tennesseetruckaccidentlawyers.com
    13 | thebusinessgrowthlawyers.com
   362 | thechicago-deportationlawyers.com
   307 | the-consumer-lawyers.com
    12 | thelawyerscfo.com
    12 | themauilawyers.com
   333 | thenationstoplawyers.com
     8 | topmultimilliondollartriallawyers.com
   294 | trivalleylawyers.com
   325 | tuscaloosa-lawyers.com
   359 | utahtruckaccidentlawyers.com
   326 | vermonttruckaccidentlawyers.com
   338 | villanuevalawyers.com
     6 | virginia-non-compete-lawyers.com
     7 | virginianoncompetelawyers.com
   395 | virginiatruckaccidentlawyers.com
   361 | washingtontruckaccidentlawyers.com
   338 | westchester-county-lawyers.com
   379 | westvirginiatruckaccidentlawyers.com
     1 | westvirginiatruckaccidentlawyers.com.com
     1 | whsbf-law.com
   386 | wisconsintruckaccidentlawyers.com
    12 | wolfegrouplawyers.com
     8 | wrongfulldeathlawyers.com
   377 | wyomingtruckaccidentlawyers.com
   283 | yourvegaslawyers.com
(208 rows)

([account|answer|confirmation|customer|customercare|customersupport|
customerservice|custservice|custsupport|details|dontreply|help|
identdep|infonum|login|mail|no-reply|noreply|onlinesupport|operate|
operator|reference|reply|security|support|supprefnum|time|update|
verification|][0-9]{3})

From June 1, 2014 to August 18, 2014 more than 25,000 different combinations of the above were used in emails that sent email to the Malcovery Spam Data Mine.

The attached .zip files during that period of time, when unpacked, revealed 39,571 distinct executables, all of which are variants of the "Kuluoz" or "DoFoil" malware.

Because of the apparent polymorphic nature of many of the samples, where each binary is unique, I've only shared the hashes of the non-polymorphic versions - where the same binary was used many times. If the final column is clickable, the link shows the VirusTotal detection rate at the time of our original reporting.

A recent trend in these file names is that the first character, which looks like the letter "C" is actually the Russian "S", a cyrillic look alike for our "C", expressed with the characters: С (ampersand, pound sign, 1057, semicolon). When the word "Court" is spelled with the Cyrillic S instead, a search for the word "Court" will not find it! Here is the word Court twice, first with a "C" and then with the cyrillic equivalent: Court Сourt

My own story actually begins on September 6, 2001. That is the day when I hosted the first InfraGard meeting in Birmingham, Alabama. More than sixty security professionals came to Energen headquarters to hear a description of the InfraGard program and a presentation by Special Agent Mike Mauldin who described to us that when terrorist decide to attack our country, they may actually attack our critical infrastructures rather than a direct military vs. military attack.

Five days later I was in Carlsbad, California where I was supposed to be speaking to a Network Associates Customer Council meeting. I received the phone call early (Pacific time) from my wife who told me to turn on the television. I got up, got dressed, and went down to the bar where people were gathering to watch the big screen tv and try to decide what to do. Obviously, the meeting was canceled. Both planes had hit before my wife called me, but we watched together in horror as the building collapsed. I went back to my room, called my wife, and told her that I would be home as soon as possible, but that I was going to have to drive.

I had 40 hours alone in the car to think about what was going on. To think about what was important. To think about whether I was "making a difference" in what I did for a living. It was a life-changing event.

The 9-11 Memorial

The memorial consists of two very large squares at the location of the original Twin Towers, each has a waterfall heading into a bottomless pit. The names of the victims of the 9/11 attacks are engraved on the edges of the memorial.

I was looking for the name John P. O'Neill. John was featured in a New Yorker story called "The Counter Terrorist" and has a page on PBS FrontLine: The Man Who Knew. John started working the FBI at age 18 as a tour guide, but after college returned as an agent and was sometimes mocked for his obsession with terrorism in general and Al Qaeda in particular. He was already investing "the Blind Sheikh" prior to the first World Trade Center bombing and his dedication to the investigation revealed the relationships between the various attacks the U.S. and its interests suffered around the world. His story is also detailed in the book The Man Who Warned America: The Life and Death of John O'Neill, the FBI's Embattled Counterterror Warrior.

I wore my Birmingham FBI shirt that day and had my wife take a picture of me standing by his name.

Many that day were victims and many were heroes. John O'Neill was the latter. People like him inspire me to do what I do in my own small way to try to protect our country.

InfraGard

The Birmingham InfraGard still meets on the Second Tuesday of the month, as we have every month since 9/11. If you are in the Birmingham area, we'd love for you to join us.

And if you don't work in Critical Infrastructure, I still hope you will consider, "What can I do in my role at work, at home, or in our educational system, to help educate the public about risks and threats and to help make our nation safer?"

In yesterday's spam review, we had 4,778 messages that contained this new form of Google URL.

The spammer's objective is to mask the actual location of their spam-advertised domain by advertising a link to Google. Clicking on the Google link is not a "search" but rather a "referral" similar to how Google tracks which advertisement hoster should get credit for the advertisement that has been clicked on. Here's an example of one of the URLs (with a line feed splitting the URL after the "q=".

https://www.google.com/url?q=

http%3A%2F%2F%61%62%73en%74%2Exv%69%73.%72%75%2F&sa=D&usg=AFQjCNF0tD_e2pf9nHzz0AU6MMOpQFjRzw

What you see in the part after the "q=" is an ASCII encoded string, mixed with regular characters. The portion after the "usg=" is what we would normally think of as the tracking ID for an advertisement, and may, in fact, being used in that way, although we do not have confirmation of that yet. Let's decode this one:

%3A = :
%2F%2F = //
%61 = a
%62 = b
&73 = s
en doesn't change, so so far we have "http://absen"
%74 = t
%2E = .
xv doesn't change, so now we have "http://absent.xv"
%69 = i
&73 = s
.
%72 = r
&75 = u
%2F = / ... which gives us "http://absent.xvis.ru/" as our advertised URL.

What is located at that address? A Canadian Health & Care Mall illegal pills site.

Out of the 4,778 emails we had on September 19th that used this form of encoded URLs, we had 1,182 distinct host names on 25 different domain names. Here is the list of distinct domain names:

gnqylnaz.be - hosted on 103.253.114.124 AS23679
medicatingbestshop.com
oeolhcax.eu
swbpheiq.eu
tgsmldok.eu
canadiancareserve.ru
cancerdrugcandidate.ru
coea.ru
curf.ru
curingpharmvalue.ru
faug.ru
globalcarebargain.ru
herbalpillsprogram.ru
hotnaturalshoponline.ru
joue.ru
losm.ru
medicatingrxreward.ru
organicpharmbargain.ru
perfectcuringmart.ru
purepharmacyeshop.ru
remedialfastmarket.ru
rhin.ru
thre.ru
xvis.ru
yourmedsreward.ru

95.31.192.232 hosted all of these, although only the most recent ones were "Google" spam messages.

8/20/2014 22:43 walgreenspills.in
8/20/2014 23:29 hotherbalinvestment.be
8/20/2014 23:31 durtol.ru
8/20/2014 23:38 ithang.ru
8/20/2014 23:42 soug.ru
8/20/2014 23:44 thecaremall.be
8/21/2014 0:25 opey.ru
8/21/2014 0:40 yourcurativeelement.be
8/21/2014 1:53 smartdrugservices.be
8/21/2014 2:49 canadaviagragroup.be
8/21/2014 2:50 puregenericsoutlet.be
8/21/2014 4:58 rhin.ru
8/21/2014 6:37 thepillsinvestment.be
8/21/2014 7:57 wvbjwshe.eu
8/21/2014 9:53 fatmedsdiet.com
8/21/2014 10:23 wkigenercs.eu
8/21/2014 10:25 medicinalherbinc.ru
8/21/2014 10:58 drugstoretabs.com
8/21/2014 11:01 canadabirth.net
8/21/2014 11:14 jfnkpvge.be
8/21/2014 13:17 thesaleprescription.com
8/21/2014 15:59 herbalpillsprogram.ru
8/21/2014 17:53 errals.ru
8/21/2014 20:38 burra.ru
8/21/2014 22:47 xn--80abbcbx9bxag9b0ca3g.xn--p1ai
8/21/2014 23:04 carewiqi.eu
8/22/2014 0:12 web24med.com
8/22/2014 2:07 onlinemedicareeshop.ru
8/22/2014 4:54 mypharmacyeshop.eu
8/22/2014 5:06 thedietpharmacy.net
8/22/2014 10:13 ficoes.ru
8/22/2014 12:06 wauger.ru
8/22/2014 14:25 kitews.ru
8/22/2014 14:30 bopeck.ru
8/22/2014 14:41 edurad.ru
8/22/2014 14:56 gnqylnaz.be
8/22/2014 14:56 ckbpewid.be
8/22/2014 15:21 inamsy.ru
8/22/2014 15:34 coea.ru
8/22/2014 15:34 cushey.ru
8/22/2014 15:35 fqnpuumq.be
8/22/2014 15:39 remedialfastmarket.ru
8/22/2014 16:04 thre.ru
8/22/2014 16:09 isomus.ru
8/22/2014 16:14 themedicarerx.com
8/22/2014 17:07 ecotot.ru
8/22/2014 17:10 discht.ru
8/22/2014 17:51 nictxlzz.be
8/22/2014 18:12 perfectcuringmart.ru
8/22/2014 19:08 xvis.ru
8/23/2014 6:08 fastaidpurchase.ru
8/24/2014 19:37 canadianfirstshop.ru
8/24/2014 20:45 xn--f1abpu.xn--p1ai
8/25/2014 12:22 herbalremedydeal.ru
8/25/2014 12:34 medicatingherbsinc.be
8/25/2014 12:57 llvzqtuw.com
8/25/2014 15:50 luckypharmshop.com
8/25/2014 17:13 safeherbwebmart.ru
8/25/2014 19:46 remedialtabsbargain.ru
8/25/2014 19:55 myudikuqeh.eu
8/25/2014 21:00 thehealthsupply.ru
8/25/2014 22:09 yenexanw.com
8/25/2014 23:10 fastremedyshop.ru
8/25/2014 23:22 bestpillgroup.ru
8/26/2014 0:29 healingprivateinc.ru
8/26/2014 1:53 safepillsmart.ru
8/26/2014 2:19 securegenericdeal.ru
8/26/2014 4:27 familyhealthmart.ru
8/26/2014 5:52 onlinepharmstore.ru
8/26/2014 7:24 safemedsprogram.ru
8/26/2014 16:25 globalcuringstore.ru
8/26/2014 17:05 purewelnessservice.ru
8/26/2014 20:36 medicatingherbstore.ru
8/26/2014 23:13 trustedherbsdeal.ru
8/27/2014 10:10 globaldrugsgroup.ru
8/27/2014 13:43 magicpillssupply.com
8/27/2014 17:04 firstherbgroup.com
8/27/2014 21:41 xn--80afp0g.xn--p1ai
8/28/2014 0:17 globaldrugstore.ru
8/28/2014 2:31 xn--90aedrmc2eb8cpp.xn--p1ai
8/28/2014 8:35 curingsecureeshop.ru
8/28/2014 12:34 yourcurativesupply.ru
8/28/2014 13:02 groupannounces.com
8/28/2014 14:52 perfectpilleshop.ru
8/28/2014 14:58 xn--90afc0c.xn--p1ai
8/28/2014 15:57 magicmedicalquality.ru
8/28/2014 16:33 icfdbrdr.be
8/28/2014 16:48 npzkmnqk.eu
8/28/2014 16:56 ltgizzzo.eu
8/28/2014 17:01 eagwscns.eu
8/28/2014 17:10 gvkvgobs.be
8/28/2014 17:13 ajpxypim.be
8/28/2014 17:18 safenaturalassist.eu
8/28/2014 17:59 cfjzlczi.be
8/28/2014 22:32 luckygenericsale.ru
8/29/2014 1:15 goodmedicalservices.be
8/29/2014 1:47 xn--90aipe.xn--p1ai
8/29/2014 4:02 medicinalbestmart.com
8/29/2014 4:57 medicaldrugelement.ru
8/29/2014 5:28 yourtableteshop.com
8/29/2014 6:50 organichottrade.be
8/29/2014 6:51 mymedicatingoutlet.be
8/29/2014 7:04 curingpharmvalue.ru
8/29/2014 7:38 canadiansloweshop.com
8/29/2014 14:07 bestmedicaloutlet.ru
8/29/2014 16:04 lkdhzpvz.com
8/29/2014 16:34 healingpillservices.ru
8/29/2014 17:11 magicmedicinalmart.ru
8/29/2014 18:55 myremedyprogram.ru
8/29/2014 19:45 curativehealthmall.ru
8/29/2014 23:02 levitramastersdegree.be
8/30/2014 0:15 medicatingsafestore.ru
8/30/2014 3:37 onlinedrugsquality.ru
8/31/2014 16:05 naturalmedicaresale.ru
8/31/2014 20:09 medicalonlineassist.com
8/31/2014 21:51 newcurativequality.ru
8/31/2014 22:12 wdiraijy.com
8/31/2014 23:26 homeherbsservice.ru
8/31/2014 23:56 biologicalfaststore.ru
9/1/2014 9:22 biologicalhotgroup.com
9/1/2014 9:22 curingbestreward.com
9/2/2014 6:22 medicalsmartreward.ru
9/2/2014 9:45 luckydrugseshop.ru
9/2/2014 20:42 familydrugpurchase.com
9/3/2014 2:22 itmdxcuj.com
9/3/2014 4:45 jamawelness.com
9/3/2014 10:40 saleofthecompany.com
9/3/2014 17:02 uqupwgrc.com
9/3/2014 19:40 gentivarx.com
9/3/2014 19:40 gentivawelness.com
9/3/2014 21:22 cfkvonhv.com
9/4/2014 7:59 medicatingrxreward.ru
9/4/2014 7:59 yourmedsreward.ru
9/4/2014 7:59 zdyzrwli.com
9/4/2014 8:01 onlinepillselement.com
9/4/2014 8:02 securedrugassist.eu
9/4/2014 8:03 medicatingbestshop.com
9/4/2014 8:04 hotnaturalshoponline.ru
9/4/2014 8:04 organicpharmbargain.ru
9/4/2014 8:08 curingsmartsale.ru
9/4/2014 8:22 purepharmacyeshop.ru
9/4/2014 16:57 genericmedsprogram.ru
9/4/2014 16:57 medicalsafereward.ru
9/4/2014 18:33 magichealthcaremall.ru
9/4/2014 20:40 canadawelnesstoronto.com
9/5/2014 10:35 homeherbsstore.ru
9/5/2014 23:09 youraidprogram.com
9/6/2014 12:18 yourmedicarebargain.com
9/6/2014 16:49 bestdrugstore.ru
9/6/2014 16:55 canadianpillsmart.ru
9/6/2014 22:39 xn--f1abk7e.xn--p1ai
9/7/2014 2:29 canadianpillsmarket.ru
9/7/2014 4:58 medicinalmedsvalue.com
9/8/2014 4:30 genericpillstoreonline.com
9/8/2014 6:32 medicativemedsinc.be
9/8/2014 12:32 funeralhomemedicareshop.com
9/8/2014 12:54 firstgenericservice.ru
9/8/2014 13:31 equityinvestmentrewards.eu
9/8/2014 17:23 newherbprogram.eu
9/9/2014 15:04 herbalmedspurchase.ru
9/9/2014 15:04 xn--90ankb.xn--p1ai
9/9/2014 15:04 pseh.ru
9/9/2014 15:04 globalherbspurchase.ru
9/9/2014 17:05 magicmedicativemall.ru
9/9/2014 17:05 medicatingsafemart.ru
9/10/2014 20:52 theherbseshop.eu
9/11/2014 0:21 kbazgsmz.com
9/13/2014 19:54 oeolhcax.eu
9/13/2014 20:03 globalcarebargain.ru
9/13/2014 20:04 tgsmldok.eu
9/13/2014 20:23 curf.ru
9/13/2014 20:25 joue.ru
9/14/2014 1:13 medicalpharmacists.com
9/14/2014 5:40 cancerdrugcandidate.ru
9/14/2014 9:29 losm.ru
9/14/2014 9:50 faug.ru
9/14/2014 9:54 swbpheiq.eu
9/14/2014 10:57 canadiancareserve.ru
9/15/2014 18:25 onlinepillquality.ru
9/16/2014 18:59 curativesmartmart.ru
9/17/2014 1:12 curingpillsquality.ru
9/17/2014 9:10 theorganicinc.ru
9/17/2014 22:24 goodcuringservices.ru
9/18/2014 3:15 dnthwxhp.com
9/19/2014 16:51 prescriptionmedhcg.com
9/19/2014 18:28 drugprescriptionlevitra.ru
9/19/2014 22:42 urgentcareprescription.in
9/20/2014 6:45 puremedicalmall.ru

5.104.224.17
64.191.93.214
80.88.12.43
84.22.62.253
103.253.114.124
124.248.205.53
144.76.249.100
193.105.154.220
193.189.116.231
212.83.176.36

Google-redirection spam from September 19, 2014

When an Islamic jihadist decapitates a woman in Oklahoma, the media was falling all over itself with headlines such as these:

MSNBCNo evidence Oklahoma beheading linked to terrorism, police say

The HillAuthorities: No terrorist link to Oklahoma beheading suspect

KFORFBI: Oklahoma beheading not linked to terrorism

The problem with those statements, of course, is that they weren't true. They were statement made in the heat of the moment by officials hoping to prevent panic.

Alton A Nolen was convicted in January of 2011 and sentenced to prison for Possession of Marijuana, Assault and Battery on a Police Officer, Escape from Detention, Possession with intent to Distribute Cocaine. He served his time from March 10, 2011 until March 22, 2013 although the Cocaine sentence by itself was a six year sentence.

Alton AKA Jah'Keem Yisrael

His Facebook page indicates that he graduated from Idabel High School in 2003 and Langston University in 2007 (Business Management Degree). In his posts from 2010, you can see his early Christian influences showing through in some of his posts, such as:

• Sep 5, 2010: "GETN READY ANOTHA WEEK DAT DA LRD HAS BLESSED ME WIT"
• Sep 9, 2010: "THNK U LD....STARTN DIZ NEW JOB TOMORROW GOT ME FEELING LIKE TONY THE TIGER.... ITZ GREAT!!!!LOL"

Prison Islam

• Apr 28, 2013 "Jst A Headz Up This World Is Sitting On Thin Ice...Jst Knw Dat Everything Allah(SAW) Has Created He Can Put To An End Within A Trillion Of A Second...The U Go"
• by June 6, 2013, he is quoting the Koran on Facebook:
  Sura 3; Iya 85 If anyone desires a religion other than Islam (submission to Allah), never will it be accepted of him; and in the Hereafter he will be in the ranks of those who have lost. (including ur prayers) As-Salaamu Alaikium
• by October 31, 2013, he is openly proseletyzing on Facebook:
  "Wondering y u so Christians worship Jesus and are told to end your prayers in his name, When your prayer is Our father which are in Heaven, hallowed be thy name thy kingdom come Luke 1 1:2 & 1st matt 6 9-10...Why worship Jesus when he's not the creator or forgiver..All Praise To Allah The One And Only!!!!! In the Bible if u study it like u spost to it clearly says in the book of matthew 7:21 'None of those who call me Lord' enter the kingdom of God, but only those who does the will of God. Therefore Jesus is Not Lord...."
• and by November 11, 2013 shows the first Jihadi-leaning statement:
  "Why everybody is celebrating veterans day. Worrying about they freedom. What freedom? Don't yall knw them are muslims? Religious people. They pray 5 6 times a day. They not getting high and drunk killin over colors, and when they do kill its for God. Dnt yall knw that same place yall like to go bomb is where Moses and Jesus journeyed to....What freedom? Once again What freedom???Wake Up!!!"
• November 2013 also has him talking about "The Black Man and Woman" are the "True Israelites and the Chosen People of God": "Not Racist...But To The Black Man And Woman aka The Tribe Of Judah...2:29 elderly white woman telling the fake jews in Israel get the hell out of it...3:30 white man telling u that u are the true jews...5:08 elderly woman saying dnt bow to the white man. Islam is the true religion. Wake Up!!!!" (Link to this YouTube video: https://www.youtube.com/watch?v=ja93FjyCSfo)

• December 8, 2013 shows more "Nation of Islam" style Muslim beliefs, claiming that Jesus predicted the coming of Mohammed:
  00:13 THIS RABBI WHOS JEWISH BUT NOT AN TRUE JEW IS TELLING U THAT PROPHET MUHAMMAD IS THE LAST PROPHET, BUT IN ISRAEL THEYRE NOT REALLY SURE OF THIS...MY THANG WITH THEM KNOWING THAT JESUS SPOKE ABOUT A PROPHET WHO WAS TO COME AFTER HIM IN THE BOOK OF JOHN 14:15-16, JOHN16:7-8,AND IN JOHN16:12-13. WHY IS AMERIKA AND A BUNCH OF NONBELIEVERS ALWAYS PUTTING A BUNCH OF VIDEOS ON YOUTUBE STATING THINGS LIKE THIS WORLD IS BOUT TO END LIKE THE 2K THANG OR WHY DO ALL THE CHRISTIAN PREACHERS, CHURCHES AND PEOPLE SAY THINGS LIKE WE ARE IN THE LAST DAYS lol..IF U WERE READING YOUR BIBLES LIKE YOUR SPOST TO HES NOT COMING UNTIL THE COMFORTER AFTER HIM SHOW UP WHICH IS FOUD IN THE VERSES UP ABOVE IN THE THE BIBLE WHO WAS AND IS PROPHET MUHAMMAD. CHEK IT OUT PEOPLE JESUS IS NOT GNE RETURN UNTIL GOD (ALLAH) WORD IS FULFILLED. WAKE UP!!!!!
• December 29, 2013: When Jesus Was Here Rite, He Brung The Gospel Rite, Which Means What? Gospel- Good News. Ok So This Good News Right, Come From Who? God (Allah). Who Is The One And Only Lord Of The Universe. With This Being Said Rite, Why Are You Worshipping Jesus Who In The Quran Was A Messenger. And If Jesus Is Christ Rite, Christ Means Messiah, Why Would The Father Jesus As You Say Be Coming Back To Earth LOl. Say If He Were To Get Killed When He Came Down Here What Is Everyone Gonna Do If Their So Call Lord Is Dead LOl.. God Allah Is Lord And Savior Who Youll Be Standing In Front Of On Judgement Day. Now Who Can Promise Me Jesus Is God, Savior And Holy Spirit And Show Me? Once Again Show Me. You Cant. Islam Is The True Religion!!!! Jesus Was An Messenger. By The Quran This I Promise U.

****InfoFromAMuslim****

• February 8, 2014 shows him desiring to do the Haj:
  As-Salaamu Alakium my brothers and sisters in Islam. Can anybody tell me what's the steps to proceed in participating in hajj?
• March 3 shows Jah'Keem posting a photo of himself feeding the homeless labeled "GOOD DEEDS TO 3 PEOPLE"
• March 7, 2014, Jah'keem updated his cover photo on Facebook to show the attached photo, labeling the photo "With killers and booom." This was still his cover photo up until the day his page was taken offline.
  
  
• March 30, 2014: -
  Rev 21:2 & Rev 21:18 Jerusalem will no longer look like this once Jesus (Esaa in Arbaic Salayi wa alayi salaam Ameen) returns to kill the Dajaal aka Anti-Christ. What's going to happened is once war is over whom the Muslims are going to start- Jesus will come down with 10,000 Angels and kill the Anti-Christ and his army, once it's all over a new Jerusalem will descend down from Heaven once this war is over in Israel. The New Jerusalem will be pure gold. All whom are saved will experience this except people who don't fear God, liars and whoremongers etc....
  ****InfoFromAMuslim****

• April 15, 2014:
  WHAT HAPPENED TO THE BLACK WOMAN EVERYBODY? AMERIKA AKA BABYLON HAS TURN THEM INTO HOES AND MAKES ITS DRUG DEALERS RAP STARS FOR ITS CHILDREN HERE TO LOOK UP TO-JST TO LOK THEM UP. WAKE UP!!!!! THAT MEANS BE WHO YOUR SUPPOST TO BE NOT WHAT YOU SEE ON THE TV ****InfoFromAMuslim****

• By April 18, 2014 Jah'Keem has a long beard in his photos
  
  

Shariah Law

• May 2, 2014:
  Preparing for June. 28th, 2014 which is the start of Ramadan for Muslims all around the World. Completing this all your previous sins from the previous year will be forgiven Alhamdulillah, SubhanAllah, Alahu Aikbar- Alahu Aikbar for Islam!!!!!!!!!
  ****InfoFromAMuslim****

• May 15, 2014:
  (Sura 9 Ayah 113) In Islam we as Muslims are not permitted to pray for Non-Muslim family members. Quote "It is not fitting, for the Prophet and those who believe, that they should pray for forgiveness for Pagans, even though they be of kin, after it is clear to them that they are companions of the Fire"!!!!!!!
  ****InfoFromAMuslim****

• May 19, 2014 - Two posts on Shariah law are made this day. According to multiple accounts in the news, the argument that led to his employment termination at work in September began with him describing the appropriate punishment of offending "white women" under Shariah law. Perhaps this is an allusion to the stoning video linked to from this Facebook page. Others describe that as he beheaded his co-worker, he "chanted from the Koran", which is exactly what happens in the first of this videos, which illustrates the manner in which a muslim would decapitate a non-muslim.

  The beheading video is labeled on Facebook with reference to a verse from the Koran which calls for those who turn away from Islam to be killed:

  The beheading video where Jah'Keem almost certainly learns the proper way to behead a co-worker has been viewed more than 240,000 times. After the video was reported using YouTube's guidelines, marking it as "Violence" with a subcategory "Promotes Terrorism", YouTube marked the video as "for mature audiences".

  The comment I left on the video is this:

  GarWarner: #YouTubeTerroristTraining This is the video that the radical muslim murderer who decapitated his co-worker in Oklahoma City posted on his Facebook page on May 19, 2014. Thank you, YouTube, for training terrorists. When people report this to you as "Violence" that "Promotes Terrorism" we aren't asking you to evaluate whether it needs to be marked as "mature audience" material. We are asking you to take these terrorist training videos off the Internet. 

• May 24, 2014: less than a week after posting the beheading video and the stoning video, Jah'Keem declares Jihad, quoting Jesus to do so:
  Matthew 10:34 Jesus (pbuh Ameen) quotes "Do not think that I came to bring peace on the earth; I did not come to bring peace, but a sword. 35"For I came to SET A MAN AGAINST HIS FATHER, AND A DAUGHTER AGAINST HER MOTHER, AND A DAUGHTER-IN-LAW AGAINST HER MOTHER-IN-LAW;… JIHAD JIHAD JIHAD!
  ****InfoFromAMuslim**** (posted with a photo of a sword)

• May 25, 2014:
  For u Muslims under Islam Its a Major sin in Islam to pay taxes. If u tryna reach Janna you literally can go to your job Human Resource office and file exempt on your 1040s -You have to note that your Muslim!!!
  ****InfoFromAMuslim****

  (when challenged, he posted this reply, also on May 25, 2014:

  Jah'Keem Yisrael: There is no Law stating that you can be punished or harassed for not paying taxes. This is the 16th amendment its your choice. In Islam its Haram to pay taxes and if your trying to avoid this Major sin in Islam you would have to go to your Human Resource office at your job and file exempt on your 1040 and note it with your Muslim!
  ****InfoFromAMuslim****

• On May 30, Jah'Keem posts a photo of a white kid and says he has converted him to Islam:

  One whom was Guided to Islam 2day I offered him Dawah and he took his shahada!
  ****InfoFromAMuslim****

• May 31, 2014 - a post predicting the destruction of white people:

  THIS A PROPHECY IN THE BIBLE PEOPLE TO BE FULFILLED LUKE 21:24......"They will fall by the sword and will be taken as prisoners to all the nations. Jerusalem will be trampled on by the Gentiles until the times of the Gentiles are fulfilled." So when u see the term Gentile in the Bible its relating to the white man and woman! They are descendants of Esau and the Edomites! SHARIA LAW IS COMING!!!!
  ****InfoFromAMuslim****

• May 31, 2014 - Accompanying a photo of the Statue of Liberty

  When other countries look at this woman who sits upon the water they know she is the land of the free. Land of the free means Free from God Allah (swt) Laws of the Bible. Things like she tells u can eat pork when your not suppost to- she sells it in all of her stores Deuteronomy 14:8, Women not keeping their hair covered-forming jealousy 1st Corithians 11:6, same sex marriage when they should be killed Leviticus 20:13. And this is why you Non-Believers raise your kids to join the US Army to fight Allah swt people for the Devil.

  SHARIA LAW IS COMING!!!!!!

  ****InfoFromAMuslim****

Ramadan 2014

• June 15, 2014 - first "weapon" photo - clearly from an online video.

  I JST WANT TO SAY AS AN MUSLIM WE DNT CELEBRATE AMERIKAS HOLIDAYS. A GOOD FATHER IS SOMEONE WHOS RAISING HIS CHILD UP TO BE SUCCESFUL NOT SOMEONE WHOS SMOKING AND DRINKING IN FRONT OF THEY CHILD LEADING THEM TO THE GRAVE OR THE PENITENTARY! SO WHY U MOTHERS WALKING AROUND YOUR HOUSE SMOKING BLUNTS IN FRONT OF YOUR KIDS THINKING INSIDE OF YOUR HEAD WHILE DOING IT "HOW U THANK U GNE BE " IS NOT GOOD PARENTS AND HELL BOUND TO BE IN FOREVER!!!!!!!!!
  ****InfoFromAMuslim****

• June 17, 2014 - Jah'Keem explains that Jesus was never crucified:

  IN ISLAM WE TEACH THAT JESUS WAS NEVER PUT ON THE CROSS THAT HE WAS NEVER CRUCIFIED. IN THE BOOK DEAD SEA SCROLLS THAT WAS TOOKEN OUT THE BIBLE U WILL FIND OUT THAT HE WASNT .....If we read the Gospel of Barnabas, we will find that when Judas came with the Roman troops in order to betray Jesus (pbuh), God raised Jesus (pbuh) unto Him and saved him. He then made Judas look and even speak like Jesus (pbuh) so that the Romans dragged him (Judas) away with them kicking and screaming that he was not Jesus (pbuh) but Judas. Even the Apostles were totally bewildered.

  After the Romans had their fill afflicting Judas with all manner of abuse and torture, he was finally taken to trial. By now he had totally given up hope of ever being believed. So now when he was asked, "art thou Jesus?" He replied "Thou sayest". In other words, "you will not believe me if I say otherwise, so why fight it any more". His enemies (the Romans) then took him, mocked him, kicked him, cut him, spat on him, humiliated him, and tortured him. Finally, they put him up on the cross. It appears, however, that shortly after they took him down, he disappeared from his tomb (maybe to live in disease and torment and die later on if he was not already dead).

  The Gospel of Baranabas then goes on to describe how Jesus (pbuh) returned to the apostles to tell them of how God had saved him from the hands of the Jews and the Romans and how the traitor (Judas) was taken instead.

  ****InfoFromAMuslim****

• July 4, 2014 - feeding the homeless and taking photos again:

  Saw this man and as an Muslim i had to get this Good Deed! 4 burritos and an energx drink lol. Alahu Aikbar! ****InfoFromAMuslim****
• July 15, 2014 - posts that Muslim women in Oklahoma dress inappropriately (posts photo of woman with cleavage showing):

  Hopefully only here in Oklahoma Masjids u see all the supposely Muslimahs without their hijaabs and downblouse shirts!!!

  ****InfoFromAMuslim****

• July 19th posts photos of himself celebrating the evening breaking of the fast at the mosque:

  At the Masjid (Mosque) Choppin It Up With My Brother Abdullah (From Bangladesh) Gettin Ready To Break Our Fast!!!!

  ****InfoFromAMuslim****
• July 21 - more Nation of Islam-style propaganda, claiming that native Central Americans spoke Hebrew prior to being enslaved by the Spanish:

  I WANTED TO UPLOAD THIS VIDEO TO SCHOOL EVERYBODY ON HOW THE MEXICANS, PUERTO RICANS AND DOMINICANS ARE SPEAKING THE SAME LANGUAGE BUT ARE DIFFERENT SKIN COLORS. WELL AFTER THE ISRAELITES FLED ISRAEL (THE WHITE SPANIARDS CAUGHT AND ENSLAVED THEM AND RAPED THEM FROM THEIR ORIGINAL LANGUAGE WHICH WAS HEBREW AND FORCED THEM TO SPEAK SPANISH!!!!

  ****InfoFromAMuslim****

• July 24 - post in support of Gaza (showing photo of ruined building and man with his Koran)

  I SUPPORT ALL THE TRUE AND FAITHFUL FOLLOWERS OF THE LATE PROPHET MUHAMMAD (SALAYI WA ALYI SALAAM AMEEN) IN GAZA! MAY ALLAH (SWT) REWARD THE TRUE AND FAITHFUL FOLLOWERS AMEEN!!

  ****InfoFromAMuslim****

• Also July 24 -

  AMERICA SO CALL HELPS IRAQ (WHICH NOT)- WELL WHY CANT U HELP THE GAZA CITIZENS AGAINST ISRAEL LOL..I UPLOAD THIS PIK BECAUSE AMERICA AND ISRAEL ARE WICKED. WAKE UP MUSLIMS!!!

  ****InfoFromAMuslim****
  (a Photo of a very evil-looking "The Joker" from Batman, with his face exploding)

• August 3, 2014 - attending a Muslim day at Fronteir City amusement park near Oklahoma City several photos posted including himself with "Brother Abdul Raman"
• August 6, 2014 - several more photos:
  A NIGHT AT THE ISLAMIC MOSQUE IN OKLAHOMA CITY, OKLAHOMA WITH TWO OF MY BROTHERS FROM MOROCCO! (SURA 17 AL ISRA) PHOTO PBUH AMEEN!

  ****InfoFromAMuslim****
• August 31, 2014 - Jah'Keem asking questions about why single men get Virgins in the afterlife:

  Allah swt says in the Quran- On the Day of Judgment the righteouss will be joined with their wives, wives joined with their husbands, families reuniting with each other-For the Males who died with no wife He (Allah) swt will give the individuals an virgin woman same age as the individual males whom died not married but made it to Heaven. They will marry each other and whatever it is that their or wanting in Heaven they can have. DNT MATTER WHAT IT IS THEY CAN HAVE IT!!!! MY THING WHY WILL HE NOT JST GIVE THE INDIVIDUALS A WOMAN WHATS SO GUD ABOUT A VIRGIN? IDK.

  ****InfoFromAMuslim****

  (He is answered by "Khalid Ibn Abdul Wahid")
  Khalid Ibn Abdul Wahid: A virgin is pure. Now imagine a woman Allah created JUST FOR YOU. She's gonna be pure just with that alone. So her being a virgin plus Allah creating her just for you I is the highest level of bring pure

• September 5, 2014: (more photos)
  At The Masjid (Mosque)Today For Jumar 9/5/2014 & Peforming Wudu!!!

  ****InfoFromAMuslim****
• From September 15, 17, several "judgement day" posts, quoting the Bible and Koran.

• September 23, 2014 - Jah'Keem Yisrael's last Facebook Post at 9:50 PM, where he posts about the sin of masturbation:

  SHALOM ALHAKEIUM (O YE MUSLIMS) ALLAH (sWT) SAYS IN THE LAST DAYS "PEOPLE WILL BE LOVERS OF THEMSELVES, PROUD AND UNHOLY". SO TO ALL OF U THAT'S MASTURBATING WHICH I THINK IS 80% OF THE WORLD AND FOR WHATEVER THE DESIRE IT IS IN YOUR HEART THAT U DOING IT FOR-U CAN GET! (WARNING) THIS IS THE LAST DAYS....2ND TIMOTHY 3:2 ****InfoFromAMuslim****

• If the "workplace dispute" that led to his firing really was Jah'Keem explaining that women who commit sexual sin should be placed in a pit and stoned, as the video he displayed on May 19th demonstrates,
• and if his response to learning he was fired was to decapitate a coworker while praising Allah
• and if he has declared that white people are cursed of God
• and if he claims Shariah Law is coming to America and the Statue of Liberty should be destroyed

The recording is available here as a m4a file (QuickTime will play it):

SheriffScam.m4a

Here's a transcript:

This message is for (student name). Hi this is officer Steven Jones and I'm calling you from Jefferson County. The reason of my call is to inform you that we have received a legal complaint against you on ??? identity. So if you want to be on the safer side and not get arrested contact on 646 759 4934 I repeat (646) 759-4934. If you disregard this message you alone are responsible for the legal actions that are taken against you. Thank you and have a great day!

Later the same day HER ROOMMATE had the same scam against her, only she happened to be at a place where she could answer the phone! Her call was from "Officer Austin Reed" instead of "Officer Steven Jones".

When we started digging into this scam we realized that this is an EXTREMELY POPULAR scam! We shared the information with the North Alabama Identity Theft Task Force, the Internet Crime & Complaint Center (IC3.gov) and the National Cyber Forensics Training Alliance (NCFTA) and have learned quite a bit more about the scope and range of this attack.

The Scam Structure

1. The victim receives a telephone call with a spoofed callerid to make it appear to be from either the IRS (they often spoof the "1040 hotline"), a law enforcement agency geographically proximal to the potential victim's location, or 911, the emergency contact number used in the United States.
2. The victim will be told that they have committed a crime, which may include running a red light and being caught by a traffic camera, failing to appear for Jury Duty, failing to pay your taxes or failing to pay them on time, or, if an international person, having a problem with immigration paperwork.
3. The victim will be instructed to send a payment immediately, with amounts ranging from $500 to $2,500, and threatened with immediate arrest if they fail to comply.

Recent Alabama Phone Scams

• November 5, Fox 6 WBRC has Birmingham, AL Police Lieutenant Sean Edwards explain that several citizens have called saying they had received these calls spoofing the telephone number of the Birmingham PD (205) 254-1700. See Birmingham Police issues warning to citizens about possible spoofing.
• October 22, 2014, Birmingham News website AL.com quotes the Shelby County Sheriff's Office as having several complaints about this scam imitating their office. The Alabaster, AL Police Department also reported that they have been receiving calls from victims of this scam in the same article. See Scam Alert: 2 Shelby County law enforcement agencies warning of bogus calls.
• September 24, Birmingham Police Commander Terry Kiernan warns of phone scammers imitating the IRS. His department received 20 complaints in the past few days. (See: Local residents complain of new IRS phone scam
• September 22, Hoover, AL Police Department warn of a "Warrant For Your Arrest Scam" on their Facebook page.

• November 6, Iowa State University and the Ames Police Department are receiving scam reports including calls claiming to be university and utility company officials.
• November 6, West Virginia's WCHS and WVAH report Putnam County Sheriff reports a Jury Duty Scam version, where the victim is accused of not showing up for Jury Duty and told to pay $4,500
• October 28, Jury duty scam targets Rockwall County - "My name is Lt. Gary Phillips, I'm with the Rockwall County Sheriff's Department. I need you to call me back at 972-841-5687
• October 22, Pittsburgh PD tells WPXI.com about "Warrant out for your arrest, send money" call scam
• October 22, Kenton County and Hamilton County, Kentucky tell WLWT5 News that a fake "Deputy Morgan" asks for money to keep you out of jail
• October 10, Houston FBI warns of Jury Duty Scam
• September 5, Lee County, Florida Sheriff's Office tells NBC 2Jury duty scam resurfacing locally
• September 3, Parker County Sheriff warns of jury duty scams - Sheriff Larry Fowler says the caller asks for credit card information to pay the fine.
• August 23, Bastrop Police Department warns of calls stating a warrant is out for your arrest.
• April 25, Elizabethtown Police Department, (See Arrest Warrant Scam has come to Elizabethtown
• April 14, 2014 - IRS Reiterates Warning of Pervasive Telephone Scam

What to Do?

• The Best Place to report any type of online scam is the FBI's Internet Crime & Complaint Center. To go directly to their complaint page, use this link:

  https://complaint.ic3.gov.

  Although the form has many questions that you may not be able to answer, complete the form to the best of your ability with the information you DO know. Specifically make sure to note things such as:

  • What name did the person use?
  • Did they call you by name?
  • What agency, department, or company did they claim to be with?
  • What did they accuse you of?
  • How much money did they want you to pay?
  • What number shows up in your callerid?
  • Did they give you any other numbers to call or websites to visit?

  Even if you do not have ALL of this information, any information you share can help link cases together. If someone calling Houston and someone calling Birmingham both told you to call the same phone number, that is a "link". If they used the same Officer Name, that is another "link". The more individual cases we can link together, the better chance we have of catching the criminals!

• IF YOU HAVE THE IRS VERSION of the case, be sure to report the crime to the investigators at the Department of Treasury who have set up a special website for gathering information about this scam:

  http://www.treasury.gov/tigta/contact_report_scam.shtml

• IF YOU HAVE LOST MONEY in your case, be sure to ALSO report this as a crime to your local Police Department!

University Salary Phish Example

++++++++++++++++++++++

From: employeebenefits@uchicago.edu
Subject: Your Salary Raise Confirmation

Hello,

The University is having a salary increase program this year with an average of 2.5%.
The Human Resources department evaluated you for a raise on your next paycheck.
Click below to confirm and access your salary revision documents:

Click Here hxxp://kirovtourism.ru/www.uchicago.edu/Sign-In.htm to access the documents

Sincerely,
Human Resources
The University of Chicago

++++++++++++++++++++++

Recent reports about Your Salary Raise Confirmation

• Longwood.edu (Sep 25, 2014) - www.longwood.edu/usersupport/58483.htm
• UChicago.edu (Sep 22, 2014) - itservices.uchicago.edu/page/email-scam-sep-22-2014-your-salary-raise-confirmation
• WUSTL.edu (Sep 22, 2014) - nso.wustl.edu/securitynewsandnotes
• Geoge Mason ( Sep 17, 2014) - itservices.gmu.edu/alerts/view-alert.cfm?customel_dataPageID_8958=33535
• UOregon (Sep 11, 2014) - www.facebook.com/UOTechDesk/posts/6745046326415720
• USouth Florida (Aug 4, 2014) - hscweb3.hsc.usf.edu/is/phishing-alert-email-with-subject-of-your-usf-salary-raise/
• Brown.edu (Jul 26, 2014) - www.brown.edu/information-technology/alerts/phishing-alert-your-salary-raise-confirmation-0
• Illinois (July 5, 2014) - security.illinois.edu/content/secsup-9121-university-human-resources-phishing-scam
• Virginia Commonwealth (June 30, 2014) - phishing.vcu.edu/2014/06/30/
• Nebraska Wesleyan (Jun 20, 2014) - csit.nebrwesleyan.edu/security_alert_phishing_scam_reported
• UVM.edu (May 28, 2014) - www.uvm.edu/it/?Page=news&storyID=18599&category=etsspotlight
• Michigan State (Mar 17, 2014) - support.anr.msu.edu/support/news/item/email_phishing_attempt_your_salary_raise
• Duke (Ma 13, 2014) - security.duke.edu/phishing-attacks-your-salary-raise-details-march-13-2014
• UPENN.edu (May 6, 2014) - www.upenn.edu/computing/security/phish/
• Georgetown - security.georgetown.edu/students/diy-computer-security/phishing-attacks/phishing-examples
• ODU.edu (Aug 21, 2014) - www.odu.edu/announcements/faculty-staff/2014/8/21/phishing_campaing_ag.iframe.html

DHS / REN-ISAC / Multi-State ISAC Advisory

Some of the email subjects that were mentioned in that advisory include:

• Your Salary Review Documents
• Important Salary Notification
• Your Salary Raise Confirmation
• connection from unexpected IP
• RE: Mailbox has exceeded its storage limit.

If you receive a copy of a phish such as this, please send an alert to: soc@ren-isac.net

US Federal Grant Scam

The scam begins with a phone call, in our case coming from callerid 305.356.9999, claiming that we have been selected to receive a Grant from the Federal Government because of our participation in a survey. Of all the people who have taken this IRS Survey, 1700 people have been selected to receive this grant. The caller then instructs us that we should go to a Western Union location near us and we should call them back once we are at the Western Union for instructions on how to receive our $9,500 grant.

The callback number was (516) 554-0006, which seems to be a New York number in Garden City.

So, we waited a bit and called the criminals back from the Western Union store in my office. (grin).

When we called the 516 number, the line was answered "US Federal Grants" and we were asked for the code that we had been given during the first call. I tried providing a slightly wrong code, and learned that they actually are tracking the codes, because she was unable to look up our information. We provided the correct code and learned that it was "very important that we don't go into the Western Union Store yet!" She then asked me if we were near a grocery store, such as a Seven-11? I told her I had a Publix store nearby but she said that wouldn't work. After some back and forth, we learned that a CVS Pharmacy would work for her needs. She instructed me that I needed me to go to the CVS and buy a GreenDot MoneyPak card for $200.

"You need to put $200 on the card to activate the Money Transfer Control Number, but you will get the $200 back, it will be reimbursed with your grant.

Now, simply let me tell you, you are not going to pay the money to me or to my department. This is your money and it is going to be reimbursed back to you. Before we can transfer the money you have to make a registration with the Federal Reserve Bank and once you make the registration then with the help of the Federal Reserve Bank registration number, I will generate the Money Transfer Control Number so that you can receive your money from the Western Union Store."

Here's the audio clip of that part . . .

(audio)How it works - the woman at US Federal Grants, who sometimes claimed this grant was from the IRS, tells us we need to pay a $200 registration fee.

She then "transferred us" to the Federal Reserve Bank as you can hear with this link.

(audio)Transferred to the Federal Reserve Bank - Kevin Jones, manager of the Federal Reserve Bank took my call and helped me.

Kevin was good enough to explain the whole process of how to purchase a GreenDot MoneyPak card for $200 so that I could "within 5 minutes" pick up my $10,000 - (the $9800 grant + $200 reimbursement for my registration) - from the Western Union Counter. Here's the audio of him explaining it to us:

(audio)The GreenDot MoneyPak Process - as explained by the Federal Reserve Bank's Kevin Jones

What To Do if you are a US Federal Grant Scam victim

• The Best Place to report any type of online scam is the FBI's Internet Crime & Complaint Center. To go directly to their complaint page, use this link:

  https://complaint.ic3.gov.

  Although the form has many questions that you may not be able to answer, complete the form to the best of your ability with the information you DO know. Specifically make sure to note things such as:

  • What name did the person use?
  • Did they call you by name?
  • What agency, department, or company did they claim to be with?
  • How much money did they want you to pay?
  • What number(s) shows up in your callerid?
  • Did they give you any other numbers to call or websites to visit?
  Even if you do not have ALL of this information, any information you share can help link cases together. If someone calling Houston and someone calling Birmingham both told you to call the same phone number, that is a "link". If they used the same Officer Name, that is another "link". The more individual cases we can link together, the better chance we have of catching the criminals!

• IF YOUR SCAM MENTIONS THE IRS, be sure to report the crime to the investigators at the Department of Treasury who have set up a special website for gathering information about this scam:

  http://www.treasury.gov/tigta/contact_report_scam.shtml

• IF YOU HAVE LOST MONEY in your case, be sure to ALSO report this as a crime to your local Police Department!

At least 110 articles referring to the study were found in a simple Google News search with headlines ranging from the somewhat accurate:

• Manual Phishing Gmail Attacks Found To Be Very Effective - Top Tech News, Nov 9, 2014
• Google Study Finds Email Scams Are More Effective Than You'd Expect - Huffington Post, Nov 7, 2014
• Old-time phishing scams are working just fine, Google finds - Naked Security, Nov 11, 2014

• Phishing attacks on email accounts are successful 45 percent of the time - Firstpost, Nov 10, 2014
• Phishing scams work 45% of the times: Google study - Times of India, Nov 10, 2014
• Have You Been Scammed? Phishing Emails Successful 45% of the Time - Crave Online, Nov 11, 2014
• A scary number of you are still falling for phishing scams, says Google - Nov 10, 2014

What did Google and UCSD Actual Say about Phishing?

There were several interesting findings in the study. A few that I found interesting included:

• 35% of phishing sites target victims' email
• 21% of phishing sites target banking credentials
• A growing number of phishing sites are targeting App Stores and Social networking credentials
• Account takeovers are primarily Fast and Foreign:
  • 20% of compromised Google accounts were logged into within 30 minutes
  • The top countries of origin for hijackers were China, Ivory Coast, Malaysia, Nigeria, and South Africa
• The easiest way to have your account restored is to have registered an SMS telephone number for out of band contact.

Manual Hijacking

Google provided some statistics on how widely the problem of manual hijacking has been seen in the past. Over calendar 2012-2013, Google's security teams found that approximately 9 manual hijacking cases per day per million active users occurred. With over 500 million subscribers, Google is dealing with thousands of such account hijacks per day.

With Google participating in the research, researchers were able to determine that when an account is taken over, the criminals login to the account and search the email history and address books to determine how best to monetize the account. It seems that every week someone will make the comment in my presence "Yes, I have malware on my computer, but the worst that might happen is they get my email password!" But think about what is possible with that? How would you reset your password at your Bank? Amazon.com? eBay? On most of those sites, clicking "I Forgot My Password" results in an email being sent with a "Reset My Password" link! If the criminal finds an email from your bank in your email history, they now know exactly which bank to visit to click the "I Forgot My Password!" The email account is the key to the entire balance of your account!

The researchers also found that the scam we first wrote about in 2009 in the post Traveler Scams: Email Phishers Newest Scam is still quite prevalent. In this scam, because the criminal has access to your recent sent emails and address book, they are able to contact your friends and family with news of a tragedy while traveling where they desperately need money wired overseas to help them through the crisis. I've met many individuals who have wired money to their friends before realizing it was a scam! They often have stories of how they KNEW the email was truly from their friend, because when they asked questions, their friend replied with details only the friend would know. Often these details made use of prior "private" conversations in the phishing victim's email sent items box!

Popular Email Phish from Malcovery's ThreatHQ System

Google phish locations: November 5-12, 2014

In the Kilobit/Las Vegas indictment, the charges are that Seleznev did "Participate in a Racketeer Influenced Corrupt Organization [RICO]" and "Participated in a Conspiracy to Engage in a Racketeer Influenced Corrupt Organization."

The whole group are described in the indictment like this:

"The defendants herein, and others known and unknown, are members of, employed by, and associates of a criminal organization, hereafter referred to as "the Carder.su organization," whose members engage in acts of identity theft and financial fraud, including, but not limited to, acts involving trafficking in stolen means of identification; trafficking in, production and use of couterfeit identification documents; identity theft; trafficking in, production and use of unauthorized and counterfeit access devices; and bank fraud; and whose members interfere with interstate and foreign commerce through acts of identity theft and financial fraud. Members and associates of the Carder.su organization operate principally in Las Vegas, Nevada, and elsewhere.

The important thing to understand about RICO is that as PART OF THE CORRUPT ORGANIZATION all of the charged members are sentenced as if the whole group did all of the crimes.

What does that mean to Seleznev? In Las Vegas, Nevada, Seleznev is being charged with being part of a RICO group that is credited with directly causing, in actual measured and aggregated fraudulent transaction losses, $50,893,166.35!!

But before Vegas gets their hands on him, Seleznev will face charges in the Western District of Washington for Case # 2:11-cr-0070-RAJ-1.

In that case, Roman Seleznev, AKA TRACK2, AKA Roman Ivanov, AKA Ruben Samvelich, AKA nCuX, AKA Bulba, AKA bandysli64, AKA smaus, AKA Zagreb, AKA shmak is charged with:

(Counts 1-5) Bank Fraud 18:1344 & 2
(6-13)  Intentional Damage to a Protected Computer 18:1030(a)(5)(A) & 1030(c)(4)(B)(i) & 2
(14-21) Obtaining InformationFrom a Protected Computer 18:1030(a)(2) & 1030(c)(2)(ii) & 2
(22) Possession of Fifteen or More Unauthorized Access Devices 18:1029(a)(3) & 1029(c)(1)(A)(i) & 2 
(23-24) Trafficking in Unauthorized Access Devices 18:1029(a)(2) & 1029(c)(1)(A)(i) & 2  
(25-29) Aggravated Identity Theft 18:1028(a)(1) & 2

Washington charges that Seleznev "knowingly and willfully devised and executed and aided and abetted a scheme and artifice to defraud various financial institutions, including, but not limited to, Boeing Employees' Credit Union, Chase Bank, Capital One, Citibank, and Keybank, and to obtain moneys, funds, and credits under the custody and control of the banks by means of material false and fraudulent pretenses, representations and promises, as further described below."

Seleznev would:

1. hack into retail businesses,
2. install malicious computer code onto those hacked computers,
3. and use the malware to steal credit card numbers from the victim businesses' customers
4. market and sell the stolen credit card numbers on "criminally inspired" websites
5. thus allowing these cards and the associated accounts to be used for fraudulent purposes by the customers of his service.

Seleznev's websites for selling cards were primarily bulba.cc, secure.bulba.cc, Track2.name, and secure.Track2.name.

The targeted businesses usually had several "point of sale" terminals "up front" and a "back of the house computer" which may have been a server or perhaps even just the manager's computer.

Some of Seleznov's victims included:

The Broadway Grill - 32,000 unique credit card numbers from Dec 1, 2009 to Oct 22, 2010

Grand Central Baking Company in Seattle, WA

four Mad Pizza restaurants (three in Seattle, one in Tukwila, WA)

Village Pizza in Anacortes, WA

Casa Mia Italian in Yelm, WA.

Schlotsky's Deli in Coeur d'Alene, Idaho

Active Networks in Frostburg, MD

Days Jewelry in Waterville, Maine

Latitude Bar and Grill, NY, NY

Mary's Pizza Shack in Sonoma, CA

City News Stand in Chicago and Evanston, IL

Bulba would advertise when he had new cards for sale, claiming as many as 17,000 "Fresh Dumps" (newly stolen and never before used for fraud) cards and offering guarantees, including free card replacement for cards that were declined. Seleznev/Bulba had such high quality, that the owners of the popular crdsu.su and carder.biz allowed Seleznev and others to assume Monopoly status as the preferred card vendors for their boards, which were extremely prevalent in the underground.

According to the newly unsealed indictment, Seleznev personally stole (through his malware) more than 200,000 cards, and succesfully sold over 140,000 of those cards through his websites bulba.cc and Track2.name between November 15, 2010 and February 22, 2011, generating direct illicit profits in excess of $2,000,000 USD.

Just the cards stolen by Seleznev at the Broadway Grill have been associated with $79,317 in fraudulent charges, and all of the cards stolen by Seleznev are responsible for actual fraud charges of at least $1,175,217.37.

November 15-16, 2010, $83,490 in charges were made against Boeing Employees Credit Union cards.

Jan 31-Feb 1, 2011, $30,716 in charges against BECU.

Seleznev will have a hearing in Guam on July 22, and then be transferred to the Seattle courts.

Seleznev Diplomatic Spat with Russia?

Who are these others who are mentioned? Viktor Bout (Виктор Анатольевич Бут) was arrested in Thailand in 2008 and extradited in 2010 to stand trial for terrorism charges for delivering anti-aircraft missiles to FARC in Colombia. He was convicted by a jury in Manhattan (More from The Guardian) Konstantin Yaroshenko was arrested in May 2010 in Liberia as a cocaine smuggler pilot when he landed his plane in Monrovia, Liberia and was arrested by the DEA as he tried to negotiate a contract for $4.5 million to deliver 5 tons of cocaine from Colombia to West Africa. Yaroshenko was knowingly working with smugglers who were raising funds for the Colombian terror group FARC. (See Superseding Indictment

Towards that end, I've collected full text examples of many of these phish, with links to the University web pages where there students have been warned. Hopefully we can start warning people of national on-going campaigns like this BEFORE they are victimized!

While I was reviewing University Phish for this project, I was especially impressed with the phishing details shared at University of Michigan (Go Blue!) and University of Pennsvylvania. Both are great examples of giving students enough details to understand the scope of the risk at hand.

January 2014 Library Account phish

Subject: Library Account
Dear User,

Your library account has expired, therefore you must reactivate it immediately or it will be closed automatically. If you intend to use this service in the future, you must take action at once! To reactivate your account, simply visit the following page and login with your university account. After logging in, your account is reactivated and it will redirect you to your Library Account.

February Library Account phish

Have you received an email asking you to “validate” your Library Account? This email is attempting to steal Flinders user credentials and is not legitimate.

Don’t follow the links in the email, just delete it. The library will never ask you to login to verify your details or activate your account.

May Library Account phish

June Library Account phish

From: Library
Date: Thu, Jun 26, 2014 at 8:47 AM
Subject: Library Account
To:
Dear User,
Your library account has expired, therefore you must reactivate it immediately or it will be closed automatically. If you intend to use this service in the future, you must take action at once!

To reactivate your account, simply visit the following page and login wilth your library account.

Login Page:
xxxxxxxxxxxxxxxxxx
Sincerely,
University of Minnesota Libraries
499 Wilson Library
309 19th Avenue South
Minneapolis, Minnesota 55455
(612) 624-3321 (voice)
(612) 626-9353 (fax)

September Library Account phish

From: Jonathan Heller < jheller@pobox.supenn.edu >
Subject: Library Account Access 
Date: Wed, Sep 10, 2014 2:11 PM 

Dear User, 

Your access to your library account is expiring soon and it won't be accessible for you. You must reactivate your account in order to continue to have access to this service. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

(LINK REMOVED)

If you are not able to login, please contact Library Services Manager at jheller@pobox.upenn.edu .

Sincerely, 
Jonathan Heller 
Library Services Manager 
Access & Delivery Services 
Penn Libraries 
University of Pennsylvania 
(215) 898-8956 
jheller@pobox.upenn.edu 

Alert: Phishing Emails Impersonate UNC Library

Some members of the UNC community have received false emails that appear to be from the Library.

These emails state that “access to your library account is expiring soon and it won’t be accessible for you.” The email directs the recipient to a link that appears to be from the Library.

October Library Account Phish

The University has been recently subjected to a phishing attack. The subject line of these new phishing messages is “Library Account Access”. These emails are designed to appear as if they are coming from the library concerning a library account activation. The phishing emails also contain links to malicious web sites that ask for your University information (Name and student/employee ID).

    From: XXX XXX [mailto:xxxxxxxx@miamioh.edu]
    Sent: Friday, October 10, 2014 12:45 PM
    To: xxxxxxxx@miamioh.edu
    Subject: Library Account Access

    Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to this service. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

(LINK)

If you are not able to login, please contact Library Services Manager at xxxxxxxx@miamioh.edu.

    Sincerely,

    Alison Withers
    Library Services Manager
    Access and Delivery Services
    University Library
    Miami University
    513-529-2938

To:
From: Access Services Manager 
Date: 10/30/2014 11:54AM
Subject: Library Account Access

Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to this service. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library account.

(Link redacted, actual link goes to login.vcu.edu.cavc.tk)

If you are not able to login, please contact Library Services Manager at kbonis@vcu.edu.

Sincerely,

Kerry Bonis
Library Services Manager
Access & Delivery Services
Main Library
Virginia Commonwealth University
(804) 827-3968

November Library Account phish

IIT faculty, staff and students may have received an email to “All Members of the University of Illinois” notifying you about a new library system that requires you to activate a new library account. Do not respond to this email. It is a phishing attempt to collect IIT campus-wide ID numbers (CWIDs).

Library users affiliated with Illinois Tech gain access to subscription databases when off-campus by entering their CWID. Releasing that information to a third-party may result in access to our databases being limited or cut off. You can always safely access the library website by using the IIT Portal links, or going directly to the library website. If you believe your CWID has been compromised, please contact the OTS support desk.

Sample Phishing Email

Subject: Library Account Access
Sender: Jane Sippell 

Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to this service. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

Note – this link appears in the email:

https://libcat.smu.edu/cgi_bin/ldapauth.cgi_loginType=E25JFHNfCD7…

The actual destination does not point to the SMU library catalog but to a web address at http://libcat.smu.edu.cvre.tk

http://libcat.smu.edu.cvre.tk/cgi_bin/ldapauth.cgi_loginType=E25JFHNfCD7v…

If you are not able to login, please contact Access Services Manager at jsippell@smu.edu.

Sincerely,

Jane Sippell
Access Services Manager
Access & Delivery Services
Central University Libraries
Southern Methodist University
(214) 919-5931

From: library (EMAIL ADDRESS REMOVED)
Subject: Library account
Date: November 17, 2014 at 8:46:39 AM MST
Reply-To: (EMAIL ADDRESS REMOVED)

Dear User,

Your library account has expired, therefore you must reactivate it immediately or it will be closed automatically. If you intend to use this service in the future, you must take action at once!

To reactivate your account, simply visit the following page and login with your library account.

Login Page:

(URL REMOVED)

Sincerely,

The University of Arizona Libraries
(ADDRESS, PHONE NUMBER AND URL REMOVED)

Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to this service. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

(LINK)

If you are not able to login, please contact Access Services Manager at *********@wustl.edu.

Sincerely,

University Libraries was alerted that some members of the Ball State community received an email message stating their library account was soon to expire. The email said to reactivate the account by clicking on a web address included in the message. This was a phishing scam and the campus Office of Information Security took steps block access to the phony site.

December Library Account Phish

    From: Library 
    Subject: Library Account
    Sent: Monday, December 01, 2014 8:49 AM
    To: 

    Dear User,
    Your library account has expired, therefore you must reactivate 
    it immediately or it will be closed automatically. If you intend 
    to use this service in the future, you must take action at once!

    To reactivate your account, simply visit the following page 
    and login with your library account.

    Login Page:

    Sincerely,

    McGill Library
    McLennan Library Building
    3459 rue McTavish
    Montreal, Quebec
    H3A 0C9

Subject: Library Account
Date: December 1, 2014

Dear User,

Your library account has expired, therefore you must reactivate it immediately or it will be closed automatically. If you intend to use this service in the future, you must take action at once! To reactivate your account, simply visit the following page and login with your library account.

Login Page:
(BAD LINK)

Sincerely,

Cornell University Library, Ithaca, NY 14853 | (607) 255-4144

Dear User,

Your library account has expired, therefore you must reactivate it immediately or it will be closed automatically. If you intend to use this service in the future, you must take action at once!

To reactivate your account, simply visit the following page and login with your library account.

Login Page:

http://www.lib.utk.edu/reactivation?service

Sincerely,

    University of Tennessee
    University Libraries
    Email: library@utk.edu
    Tel: (865) 974-4351

Date: Thursday, December 18, 2014
Subject: Library Account Access

Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to the library services. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

[LINK REMOVED]

If you are not able to login, please contact [LINK REMOVED] for immediate assistance.

Sincerely,

Access Services Manager
University of Michigan Library
(734) 936-2921
[LINK REMOVED]

Date: Friday, December 19, 2014
Subject: U-M library System Problem
Dear [Your Name],

You are receiving this message because your login and off-campus access may have been compromised.

Your access will be inactive in 3 days. Because of some security problems, we decided to make some changes (Upgrade) and this is due to the implementation of a new version of Central Authentication System(CAS) and Umich WebLogin.
This means while you are off-campus or on-campus you will have no access to library's internal web services.

You can activate it by going again simply login to University of Michigan Library Weblogin System with your U-M LoginID and reactive your access.
Offer that Logout your account and close your browser.

Please note: If you get an Authentication Error ,just try 2 times to login again. Because System will automatically block your IP and Account and you should contact Systems Help Desk to Unlock.

University of Michigan Library
818 Hatcher Graduate Library South
913 S. University Avenue
Ann Arbor, MI 48109-1190
(734) 764-0400
[LINK REMOVED]

Date: Friday, December 19, 2014
Subject: ADMIN

Dear Web-mail Account User,

Your e-mail Account have Exceed the 20 GB e-mail Storage Set-Up by your Service Provider/Admin. You have to contact your Service Provider on Help Desk Support Portal below in less than 48 hours to avoid Suspension of your Web-mail Account if you dont Verify your e-mail account. To keep your Account Safe, Kindly Click the Help Desk Support Blue Portal below:

umich.edu-helpdesk [LINK REMOVED]

SERVICE DESK - IT HELP DESK
©COPYRIGHT 2014 WEB-TEAM. ALL RIGHT RESERVED.

Dear User,

Your access to your library account is expiring soon and it won’t be accessible for you. You must reactivate your account in order to continue to have access to the library services. For this purpose, click the web address below or copy and paste it into your web browser. After logging in, your access is reactivated and you will be redirected to your library profile.

(LINK)

If you are not able to login, please contact James Hart at hartja@wfu.edu for immediate assistance.

Sincerely,

James Hart
Access Services
ZSR Library
Wake Forest University
336-758-4967
hartja@wfu.edu

Worldwide Threat Assessment - Cyber

Cyber Operations

• aggressive attacks against DoD and allied defense networks
• increased cyber-espionage against DoD and Defense Contractor networks
• concerns about supply chain vulnerabilities
• increased use of cyber operations in regional conflicts
• a lack of international "norms of behavior" in cyberspace
• freedom of action, especially by Iran and North Korea, to conduct peacetime cyber offensive attacks on western interests without fear of reprisal
• the use of the Internet by non-state actors for Communication, Propaganda, Fundraising, and Recruitment

The global cyber threat environment presents numerous persistent challenges to the security and integrity of DoD networks and information. Threat actors now demonstrate an increased ability and willingness to conduct aggressive cyberspace operations -- including both service disruptions and espionage -- against U.S. and allied defense information networks. Similarly, we note with increasing concern recent destructive cyber actions against U.S. private-sector networks demonstrating capabilities that could hold U.S. government and defense networks at risk. For 2015, we expect espionage against U.S government defense and defense contractor networks to continue largely unabated, while destructive network attack capabilities continue to develop and proliferate worldwide. We are also concerned about the threat to the integrity of the U.S. defense procurement networks posed by supply chain vulnerabilities from counterfeit and sub-quality components.

Threat actors increasingly are willing to incorporate cyber options into regional and global power projection capabilities. The absence of universally accepted and enforceable norms of behavior in cyberspace contributes to this situation. In response, states worldwide are forming "cyber command" organizations and developing national capabilities. Similarly, cyberspace operations are playing increasingly important roles in regional conflicts -- for example, in eastern Ukraine -- where online network disruptions, espionage, disinformation and propaganda activities are now integral to the conflict.
Iran and North Korea now consider disruptive and destructive cyberspace operations a valid instrument of statecraft, including during what the U.S. considers peacetime. These states likely view cyberspace operations as an effective means of imposing costs on their adversaries while limiting the likelihood of damaging reprisals.

Non-state actors often express the desire to conduct malicious cyber attacks, but likely lack the capability to conduct high-level cyber operations. However, non-state actors, such as Hizballah, AQAP, and ISIL will continue during the next year to effectively use the Internet for communication, propaganda, fundraising and recruitment.

MARFORCYBER background

Norton Scam

iPad / Mac Pop-ups

• mac-issue-online.com -- https://discussions.apple.com/thread/6684596 (800 680 4131)
• apple-alert-online.com -- https://discussions.apple.com/thread/6850245
• safarisecurityissue.com -- https://discussions.apple.com/thread/6516787
• mac-security-alerts.com -- https://discussions.apple.com/thread/6897787
• online-window-security.com -- (Windows - see below)
• window-system-error.com -- suspended (why only this one??)
• mac-pc-alerts.com -
• safarisystemalert.com
• online-system-alerts.com
• safarialerts.com
• window-security-issues.com
• instantcomputerfix.com -- https://discussions.apple.com/thread/6669786
• techcarelive.com -- https://discussions.apple.com/thread/6527487
• safarisystemissue.com
• online-warning-support.com
• quickbo0ks.com
• iexpertstech.com
• ixperts.net
• joinremote.me
• i-xperts.us