<div dir="ltr">eqrvbczir5ua2emd is a Locky payment site.<div><br></div><div>Attached is a list of all the malware hidden service names we are tracking. </div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 19, 2016 at 9:42 AM, Virgil Griffith <span dir="ltr"><<a href="mailto:i@virgil.gr" target="_blank">i@virgil.gr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This needs to be blocked. Otherwise tucows will take away the <a href="http://tor2web.org" target="_blank">tor2web.org</a> domain.<span></span><br><br>---------- Forwarded message ----------<br>From: <b>Paul Karkas</b> <<a href="mailto:pkarkas@tucows.com" target="_blank">pkarkas@tucows.com</a>><br>Date: Thursday, 19 May 2016<br>Subject: Fwd: Trojan Detected - Please Shut Down! <a href="http://tor2web.org" target="_blank">tor2web.org</a><br><br><br><br>
<div bgcolor="#FFFFFF" text="#000000">
<p> Hello;</p>
<p><br>
</p>
<p>Please note that there is active malware on your site located at</p>
<p><br>
</p>
<p><a href="http://eqrvbczir5ua2emd.tor2web.org/" target="_blank">http://eqrvbczir5ua2emd.tor2web.org/</a><br>
</p>
<p><br>
</p>
<p>This may be due to an exploit , would you kindly remove the link
and let me know so we can put this issue to rest?</p>
<p><br>
</p>
<p>Thank you.</p>
<p><br>
</p>
<p><a href="http://en.wikipedia.org/wiki/malware" target="_blank">http://en.wikipedia.org/wiki/malware</a></p>
<br>
<p>Since you are using Tucows whois privacy, I would kindly ask that
you</p>
<p>let me know how you will respond to this inquiry.</p>
<p><br>
</p>
<p>Should you not respond to this email within 48 hours, or provide</p>
<p>Tucows/Contactprivacy indication that you will respond to the
inquiring</p>
<p>party, Tucows/Contactprivacy may act to remove or reveal the</p>
<p>proxy/privacy services on your domain, as per the terms and
conditions</p>
<p>of the ContactPrivacy service:</p>
<p>see <a href="https://www.opensrs.com/docs/contracts/exhibita.htm" target="_blank">https://www.opensrs.com/docs/contracts/exhibita.htm</a></p>
<p><br>
</p>
<p>Section 33. WHOIS PRIVACY SERVICE</p>
<p><br>
</p>
<p>"g. Right to Suspend and Disable. We shall have the right, at our
sole</p>
<p>discretion and without liability to you or any of your Contacts,
suspend</p>
<p>or cancel your domain name and to reveal Registrant and Contact
Whois</p>
<p>Information in certain circumstances"</p>
<p><br>
</p>
<p>Thank you.</p>
<p><br>
</p>
<p>Paul Karkas</p>
<p>Compliance Officer OpenSRS</p>
<p>Tucows Inc.</p>
<p><a>paul@opensrs.org</a></p>
<p><a href="tel:416-535-0123%20ext%201625" value="+14165350123" target="_blank">416-535-0123 ext 1625</a></p>
<p>Direct line <a href="tel:416-538-5458" value="+14165385458" target="_blank">416-538-5458</a></p>
<p><a href="tel:1-800-371-6992" value="+18003716992" target="_blank">1-800-371-6992</a></p>
<p><br>
</p>
<p><br>
</p>
<p>Paul Karkas</p>
<p>Compliance Manager OpenSRS</p>
<p>Tucows Inc.</p>
<p><a>paul@opensrs.org</a></p>
<p><a href="tel:416-535-0123%20ext%201625" value="+14165350123" target="_blank">416-535-0123 ext 1625</a></p>
<p>Direct line <a href="tel:416-538-5458" value="+14165385458" target="_blank">416-538-5458</a></p>
<p><a href="tel:1-800-371-6992" value="+18003716992" target="_blank">1-800-371-6992</a></p>
<p>Fax416-531-2516</p>
<p>fax416-531-2516<br>
</p>
<div><br>
<br>
-------- Forwarded Message --------
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">Subject:
</th>
<td>Trojan Detected - Please Shut Down! - [BBVA - E2142429]
- 38.229.70.4</td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">Date: </th>
<td>19 May 2016 14:20:02 +0300</td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">From: </th>
<td>RSA Anti-fraud Command Center <a><afcc@rsa.com></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">To: </th>
<td><a>pkarkas@tucows.com</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<p> BBVA - E2142429 </p>
<p> </p>
<p>To whom it may concern: </p>
<p>RSA, The Security Division of EMC (“RSA”), an information
security company, has detected and verified that a Malware (as
defined below) program is being propagated from a server which
is associated with the following URL: </p>
<p> (the “Designated Site”) </p>
<p>From our review, it is our understanding that you operate the
Designated Site and that it is, therefore, under your control. </p>
<p>For the purposes of this letter, “Malware” means any software
applications or executables that perform actions unanticipated
by and without the consent of the person running the software.
Malware is distributed via many mechanisms including, but not
limited to: email attachments; content injection such as cross
site scripting; exploiting security vulnerabilities in operating
systems and other software; and/or insertion into downloadable
software. Malware is designed, among other things, to
misappropriate personal data in order to engage in fraudulent
transactions using that data, and/or to compromise and co-opt an
end-user’s networked computer; all for the purpose of performing
illegal or improper acts such as misappropriating funds;
carrying out denial of service attacks; and sending unsolicited
mass emails. </p>
<p>For your information, we have analyzed the specific Malware and
enclose a file, which includes: </p>
<ul>
<li>Malware name: <b>Ransom</b> </li>
<li>Description:Ransomware is computer malware which holds a
computer system, or the data it contains, hostage against its
user by demanding a ransom for its restoration. <br>
<a href="http://www.symantec.com/connect/node/1618951" target="_blank">http://www.symantec.com/connect/node/1618951</a> <br>
</li>
<li> <a href="http://eqrvbczir5ua2emd.tor2web.org/" target="_blank">http://eqrvbczir5ua2emd.tor2web.org/</a>
</li>
</ul>
<p>This file also details the method by which it appears that the
Malware is downloaded to a victim’s computer. </p>
<p>In this instance, it is our belief that the specific purpose of
the Malware is to misappropriate account credentials and
identity information from the customers of one or more financial
institutions in order to access their bank accounts
fraudulently. </p>
<p><b>Therefore, we request that you immediately take all actions
necessary to disable and remove this Malware from the
Designated Site.</b> </p>
<p>We specifically would ask that you also take the following
actions: <b>Please provide us with a tar/zip file of all the
content located under the Malware's path (including hidden
files)</b>, so that we may analyze it to help prevent further
attacks. If any customer data has been captured that is stored
on your systems or equipment, please send us that data so that
the customers to whom that data relates can be notified and take
steps to protect their credit. Please provide a copy of any
records you maintain that indicate the name, contact
information, method of payment or similar information that may
be useful in helping learn about the identity and location of
the customer for whom the website has been operated. </p>
<p>We would appreciate your email confirmation that the source of
the Malware infection has been disabled. </p>
<p>We understand that you may not be aware of the above described
improper use of the Designated Site and we thank you for your
cooperation in the prevention of fraudulent online activity. The
foregoing is without prejudice to any and all rights and
remedies of any financial institution impacted by the improper
use of the Designated Site, which rights and remedies are hereby
expressly reserved.<br>
If you need further information, please do not hesitate to
contact RSA at the numbers below. </p>
<p>Sincerely,<br>
RSA SECURITY INC. </p>
<p><b><u>RSA Anti-Fraud Command Center</u></b><br>
Tel: <a href="tel:%2B44%20%280%29800-032-7751" value="+448000327751" target="_blank">+44 (0)800-032-7751</a> (UK) <br>
Tel: <a href="tel:%2B1-866-408-7525" value="+18664087525" target="_blank">+1-866-408-7525</a> (US) <br>
E-mail: <a>afcc@rsa.com</a>
</p>
</div>
</div>
<br>
<br>_______________________________________________<br>
Tor2web-talk mailing list<br>
<a href="mailto:Tor2web-talk@lists.tor2web.org">Tor2web-talk@lists.tor2web.org</a><br>
<a href="https://lists.ghserv.net/mailman/listinfo/tor2web-talk" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/tor2web-talk</a><br></blockquote></div><br></div>