Blog for hpHosts, and whatever else I feel like writing about ....

Friday 20 January 2012

Formspring continued - this time it's download2d.com as the MITM

Well, seems they're not keeping on top of it that well, still a few from this morning still active;

http://www.formspring.me/kifihicli
http://www.formspring.me/rytelnucom
http://www.formspring.me/abarlafor
http://www.formspring.me/engatreper
http://www.formspring.me/erlasticen
http://www.formspring.me/pharigeschling
http://www.formspring.me/unelsenla
http://www.formspring.me/inphabalra
http://www.formspring.me/epununfin
http://www.formspring.me/fultatici
http://www.formspring.me/aserices
http://www.formspring.me/chiforksore
http://www.formspring.me/kudpadddecir
http://www.formspring.me/stencircdescra
http://www.formspring.me/ticirthetar
http://www.formspring.me/choeropartves
http://www.formspring.me/vagecodi
http://www.formspring.me/gessdermepos
http://www.formspring.me/liastimdieeni
http://www.formspring.me/neumisvalo
http://www.formspring.me/heenacava
http://www.formspring.me/stifgaloco
http://www.formspring.me/gaberlobel
http://www.formspring.me/parkseekannre
http://www.formspring.me/raegraserba
http://www.formspring.me/lavarilang
http://www.formspring.me/tiotenvienes
http://www.formspring.me/egwabuthe
http://www.formspring.me/farmperlirip
http://www.formspring.me/landdeleare
http://www.formspring.me/agotcarfi
http://www.formspring.me/ronanoti
http://www.formspring.me/villotaher
http://www.formspring.me/restpolerbde
http://www.formspring.me/dragtaikrabic
http://www.formspring.me/candanslungfe
http://www.formspring.me/fardicorbui
http://www.formspring.me/linkgencumsdol
http://www.formspring.me/calimasry
http://www.formspring.me/saacoorepen
http://www.formspring.me/elphijezzcal
http://www.formspring.me/prabtasvocom
http://www.formspring.me/bicurldernda
http://www.formspring.me/tyouricuvol
http://www.formspring.me/winscapssacsong
http://www.formspring.me/roiplumabem
http://www.formspring.me/gastmesophi
http://www.formspring.me/geslipasu
http://www.formspring.me/piotainingmint
http://www.formspring.me/ragepenrai
http://www.formspring.me/ransralbemu
http://www.formspring.me/nievancade
http://www.formspring.me/bradconhiveg
http://www.formspring.me/stilmararo
http://www.formspring.me/brusupcendebt
http://www.formspring.me/azmaforcast
http://www.formspring.me/boyporthormi
http://www.formspring.me/catolyre
http://www.formspring.me/blethylfavli
http://www.formspring.me/muefarbesob
http://www.formspring.me/linklearakor
http://www.formspring.me/bayserepe
http://www.formspring.me/conliwealy
http://www.formspring.me/slicuvslacding
http://www.formspring.me/hopsirime
http://www.formspring.me/saucompnahrcut
http://www.formspring.me/sculbitehelp
http://www.formspring.me/izusgapu
http://www.formspring.me/cirefibelt
http://www.formspring.me/bahskabbarssal
http://www.formspring.me/maucloudtili
http://www.formspring.me/trolminthascylc
http://www.formspring.me/riosutewood
http://www.formspring.me/bruxanasla
http://www.formspring.me/cadyslasa
http://www.formspring.me/naibaconci
http://www.formspring.me/balneecomrie
http://www.formspring.me/boesuenocog
http://www.formspring.me/dendsesilmu
http://www.formspring.me/inmorexthand
http://www.formspring.me/lolincontder
http://www.formspring.me/coleracha
http://www.formspring.me/tiolesesar
http://www.formspring.me/dianatabtu
http://www.formspring.me/etrisladbdi
http://www.formspring.me/tactsolnoma
http://www.formspring.me/sipuserli
http://www.formspring.me/festprojized
http://www.formspring.me/suserechoo
http://www.formspring.me/humpspidnote
http://www.formspring.me/neelitony
http://www.formspring.me/dabmetoro
http://www.formspring.me/ticwitopu
http://www.formspring.me/ruisurohyd
http://www.formspring.me/magicimul
http://www.formspring.me/oxospoveab
http://www.formspring.me/ebunarac
http://www.formspring.me/sailighleczu
http://www.formspring.me/dempasesbe
http://www.formspring.me/pabrerisin
http://www.formspring.me/mettgarbacktuan
http://www.formspring.me/yclanasubs
http://www.formspring.me/starlelandspor
http://www.formspring.me/momersusub
http://www.formspring.me/mitlersmirab
http://www.formspring.me/betarafgu
http://www.formspring.me/ifvaccire
http://www.formspring.me/unmayprobas
http://www.formspring.me/nivebulmo
http://www.formspring.me/synchsiriger
http://www.formspring.me/rasutorssa
http://www.formspring.me/nabtiritzkal
http://www.formspring.me/hattuarode
http://www.formspring.me/pastioutherfa
http://www.formspring.me/reterlifac
http://www.formspring.me/protpickgapho
http://www.formspring.me/codifcontga
http://www.formspring.me/konstryppertse
http://www.formspring.me/dverachemmi
http://www.formspring.me/daralsimpno
http://www.formspring.me/scorecdanti
http://www.formspring.me/holrituhe
http://www.formspring.me/siehandcanar
http://www.formspring.me/nosmonsforri
http://www.formspring.me/tencyverock
http://www.formspring.me/mionienseris
http://www.formspring.me/newscorango
http://www.formspring.me/corcipenco
http://www.formspring.me/bilyreco
http://www.formspring.me/huwebfiten
http://www.formspring.me/gigumudna
http://www.formspring.me/petapiforth
http://www.formspring.me/uthicusut


These are redirecting to download2d.com, which then redirects to various locations. Most phishing, and one or two SMS fraud/malware.

http://www.hotrusvids11.com/?sid=17033&tds-key=%5Bkey%5D
http://agentload.b9ee.com/?r=7421&q=archive
http://www.blacktubeaa.com/?sid=17033
http://www.blacktubeaa.com/
http://hidownload.ru/?r=7421&s=19&q=archive
http://geetfile.b9ee.com/?dl=[Will]Resident%20Evil%20Archives%20Resident%20Evil%20[2009,%20Action%20/%20RPG]&size=
http://www.dl-provider.com/download-k:download.html?aff.id=1522
http://bazaporeva.ru/?s=779
http://bazaporeva.ru/download.php?m=32&s=779&l=0
http://andrloads-v55.ru/download.php?m=32&s=779&l=0&calc=1


andrloads-v55.ru uses a .jar that calls out to mobirools.ru, and then via wap4mobi.ru, downloads a .3gp file via the following;

http://inmobapp.ru//download.php?m=32&s=779&l=0
http://mobirools.ru/rools.html
http://wap4mobi.ru/get_files.php?file=MTJfYTgxNzQzZjkuM2dw
http://phoneconvert.ru/midlets/files/12_a81743f9.3gp


References

Formspring.me update
http://hphosts.blogspot.com/2012/01/formspringme-update.html

Alert: Eventbee.com abuse
http://hphosts.blogspot.com/2012/01/alert-eventbeecom-abuse.html

Formspring.me: Second verse, same as the first
http://hphosts.blogspot.com/2012/01/formspringme-second-verse-same-as-first.html

Formspring.me abuse continuing
http://hphosts.blogspot.com/2012/01/formspringme-abuse-continuing.html

Alert: formspring.me abuse surge
http://hphosts.blogspot.com/2011/09/alert-formspringme-abuse-surge.html

Real International Business Corp = NatCoWeb (AS46636)
http://hphosts.blogspot.com/2009/11/real-international-business-corp.html

2 comments:

Unknown said...

Do you think it may be one of the many easy seo programs out there?

MysteryFCM said...

Due to the sites involved, it's highly unlikely.