According to our telemetry and our own intelligence, the host at this IP address has been setup by cyber criminals for the exclusive purpose of hosting phishing sites, malware distribution sites and/or botnet controllers. We therefore advise our users to block any traffic from/to this IP address. $ telnet 194.67.105.201 443 Trying 194.67.105.201… Connected to… Читать далее Malware / Botnet / Phishing hosting server @193.187.175.8
Автор: blog
Carding fraud site/forum: wixxx.cc
Stolen credit card data websites. «WIXXX.CC ▶ CC+CVV» https://procrd.biz/threads/wixxx-cc-cc-cvv.22870/page-2#post-142105 >>> https://wixxx.cc/login.php https://carder.uk/ >>> https://wixxx.cc/login.php wixxx.cc. 600 IN A 185.46.11.67 _____________ Was: wixxx.cc. 600 IN A 37.140.198.103 _____________ Was: wixxx.cc. 600 IN A 91.203.193.82 _____________ Was: wixxx.cc. 599 IN A 165.227.203.115 _____________ Was: wixxx.cc. 599 IN A 193.187.173.42 _____________ Was: 31.40.251.82 wixxx.cc 2021-07-25 21:35:42 _____________ Was:… Читать далее Carding fraud site/forum: wixxx.cc
Maili.ee
Longtime ROKSO spam operation Arendame («Mihail Fortis») is spamming from new IPs today. Received: from 77-222-55-220.vps-ptr.clients.spaceweb.ru (77-222-55-220.vps-ptr.clients.spaceweb.ru [77.222.55.220]) Date: Mon, 17 Oct 2016 11:##:## +0300 From: «Maksude uudised» <reply@estdata.pw> Subject: Sõiduauto, erisoodustused ja ev mitteseotud kulud nüüd poole hinnaga <snip> Hind sisaldab õppetööd, õppematerjale, lõunat, kohvipause! Lisainfo ja osavõtuks registreerimine siit või 6556778, 5279999 <snip>… Читать далее Maili.ee
Maili.ee
ROKSO spammer Arendame («Mihail Fortis») is spamming from a new IP address. Received: from maili.pw (77-222-54-2.vps-ptr.clients.spaceweb.ru [77.222.54.2]) Date: Sun, 7 May 2017 20:##:## +0300 From: «E-posti Turundus» <kontakt@maili.pw> Subject: Maili_ee Kevadkampaania! <snip> E-posti turundus Eestis (B2B). masspostitus kampaania soodushinnaga! Lugupeetud Ettevõtja, <snip> Email Address: parimadpakkumised@gmail.com
Maili.ee
ROKSO spammer Arendame («Mihail Fortis») is spamming from a new IP address and domain. Received: from 77-222-55-10.vps-ptr.clients.spaceweb.ru (77-222-55-10.vps-ptr.clients.spaceweb.ru [77.222.55.10]) Date: Wed, 6 Sep 2017 17:##:## +0300 From: «Maksumuudatused» <data@ckiri.xyz> Subject: UUS — Sõiduauto 2018, erisoodustused ja ev mitteseotud kulud — viimased 5 kohta <snip> Tere! Tuletame meelde, et juba järgmine nädal on tulemas eesti ühe… Читать далее Maili.ee
Vulnerability scanner @77.222.55.27
The host at this IP address (77.222.55.27) is either hijacked (compromised) or, more likely, operated by miscreants for the purpose of running port scans on other hosts in the internet. While we don’t know the purpose of the port scans originating from this IP address, such portscans are usually used to: * Find vulnerable devices… Читать далее Vulnerability scanner @77.222.55.27
Malware botnet controller @77.222.60.127
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 77.222.60.127 on port 80 (using HTTP GET): hXXp://extenterms.top/data2.php $ dig +short extenterms.top 77.222.60.127 Other malicious domain names hosted on this IP address:… Читать далее Malware botnet controller @77.222.60.127
Malware distribution @185.26.112.217
The host at this IP address (185.26.112.217) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware: http://wmi.1217bye.host/1.txt AS number: AS48287 AS name: RU-CENTER
Maili.ee
This IP is sending on behalf of Maili.ee. Received: from c3368.colo.hc.ru (unknown [79.174.69.60]) by x (Postfix) with ESMTPS id x for <x>; Sun, 30 Aug 2020 ##:##:## +0100 (BST) From: ABC Keeltekool <VARIOUS@hugemailer.com> <- forgery Subject: Inglise keel täiskasvanutele, koolinortele ja lastele Date: Sun, 30 Aug 2020 ##:##:## +0300
Emotet malware distribution @195.24.68.19 [compromise website]
The host at this IP address is hosting a website that have been compromised by threat actors to distribute Emotet (aka Heodo) malware. The following URL is hosting a webshell that is being accessed by the threat actors programmatically to place malware on the website: URL: http://mobilepro-tm.online/xcuidf.php Host: mobilepro-tm.online IP address: 195.24.68.19 Hostname: wcarp.hosting.nic.ru