Рубрика: amazon.com

Amazon Web Services hosts the A record and website o the domain hrandpayroll.com, which belongs to Pioneer Educator. ESP SuccessbyEmail is sending spam for Pioneer Educator, a long-term provider of business training seminars/webinars that advertises its services by spamming scraped, purchased, or appended lists. Received: from ae199.saveastamp.com (ae199.saveastamp.com [68.179.38.199]) Date: Tue, 22 Feb 2022 09:##:##… Читать далее Spam Hosting (hrandpayroll.com) (Pioneer Educator)

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) From: «isaac wil» <isaac1378wil@gmail.com> Date: Mon, 21 Feb 2022 10:38:33 -0800 Subject: Re: https://www.linkedin.com/slink?code=dm7UG2Hj&code2=76hunq1oazgtwfxliink7q98layil4qdhg3k0gh6se0kl1hcb2xs3imq4d5pwxligobmq38h47hmt 13.107.42.14 https://storage.googleapis.com/kqi9sax/65068511?dwwf7ekzui/1cdd8if95x6_hhvfguvv+fpze7bnta=zn61nqtmwzn/e2hlexrfn/bair64rgoj7jd4dc5cy5i318urxb34brrirmbhmzcyd7ym4x9r9bnvsmz4vwyrdveevib6s9qm3fkcjj 142.251.40.144 https://uunderbridge.com/0/0/0/88bef8b8f794619e01e7876d8e216a1f/c10 195.225.173.112 https://volantmetals.com/?s1=350266&s2=681949081&s3=2149&s4=1681&ow=&s10=889 104.21.6.202 https://backupmemo.com/d28690bf8a34a2ffa8740f94854be4e5 104.21.70.253 https://droptopz.com/click?s2=[]&s1=350266&s3=2149&trvid=10565&s4=1681&ow=8 52.205.18.96 https://www.pwcf0un6.com/7BZ2W/6JHXF/?sub2=[]&sub1=00050 130.211.37.125 https://essentialconsumerdeals.com/?affid=00050&provider=cf&click_id=[]&c1=&c2=[]&c3= 76.76.21.21

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) From: «isaac wil» <isaac1378wil@gmail.com> Date: Mon, 21 Feb 2022 10:38:33 -0800 Subject: Re: https://www.linkedin.com/slink?code=dm7UG2Hj&code2=76hunq1oazgtwfxliink7q98layil4qdhg3k0gh6se0kl1hcb2xs3imq4d5pwxligobmq38h47hmt 13.107.42.14 https://storage.googleapis.com/kqi9sax/65068511?dwwf7ekzui/1cdd8if95x6_hhvfguvv+fpze7bnta=zn61nqtmwzn/e2hlexrfn/bair64rgoj7jd4dc5cy5i318urxb34brrirmbhmzcyd7ym4x9r9bnvsmz4vwyrdveevib6s9qm3fkcjj 142.251.40.144 https://uunderbridge.com/0/0/0/88bef8b8f794619e01e7876d8e216a1f/c10 195.225.173.112 https://volantmetals.com/?s1=350266&s2=681949081&s3=2149&s4=1681&ow=&s10=889 104.21.6.202 https://backupmemo.com/d28690bf8a34a2ffa8740f94854be4e5 104.21.70.253 https://droptopz.com/click?s2=[]&s1=350266&s3=2149&trvid=10565&s4=1681&ow=8 52.205.18.96 https://www.pwcf0un6.com/7BZ2W/6JHXF/?sub2=[]&sub1=00050 130.211.37.125 https://essentialconsumerdeals.com/?affid=00050&provider=cf&click_id=[]&c1=&c2=[]&c3= 76.76.21.21

The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 3.128.107.74 on port 10328 TCP: $ telnet 3.128.107.74 10328 Trying 3.128.107.74… Connected to 3.128.107.74. Escape character… Читать далее DcRAT botnet controller @3.128.107.74

Received: from fkel.affiliateddeal.com (static.85.189.201.138.clients.your-server.de. [138.201.189.85]) From: Cash App💲 <CashApp@fkel.affiliateddeal.com> Date: Sun, 20 Feb 2022 05:0x:xx +0000 Subject: 💲 CashApp Funds sent to {[] } 💳 ? https://storage.googleapis.com/rdcoffer/offertrc.html#l[] http://olkj.dailycouponcard.com/redirection/rdt.php?track=[] 198.8.93.182 https://offerlink.co/?a=3059&oc=34056&c=66168&m=3&s1=13&s2=[]&email_address=[] 34.255.103.64 https://rdmroot.com/?a=3059&oc=34056&c=66168&m=3&s1=13&s2=[]&email_address=[]&ckmguid=[] 54.74.214.1 https://us-newcashppy.yousweeps.com/#/?reqid=[]2&oid=27945&a=3059&cid=[]&s1=13&email_address=[] 172.67.159.65

Received: from mail211.sea101.rsgsv.net (45.159.12.17) From: Siste dag<info@sovehn.com> Subject: -lt’s time to renew your registration Date: Sat, 19 Feb 2022 12:1x:xx -0500 https://cutt.ly/EPQXnYE 172.67.8.238 http://deedhq.com/vB?MjE5ODI3NW5nNTYwNjYxNEp3MHlPMFRKMlBUcjE0NjkxMVha 209.239.116.49 http://stamptions.com/2198275ng5606614Jw0yO0TJ2PTr146911XZ 206.196.98.136 https://www.zekys.com/TNDQSZH7/XD1GFPDJ/?sub1=2198275&sub2=21b-2198275-5606614-146911-0-08322 35.227.247.224 https://norton.ow5a.net/c/19264/761883/4405?subId1=9887d7d313cc47bfbef318701d7debba&subId2=21b-2198275-5606614-146911-0-08322&sharedid=426430_2198275 99.80.181.127

[!] This SBL record is to show an example of ongoing network abuse. It currently is not being published in the SBL list, but is instead being presented on the webpage so that the network owner has evidence to investigate and correct the problem. w+ 54.240.8.58 a8-58.smtp-out.amazonses.com «a8-58.smtp-out.amazonses.com» 2022-02-17T23:00:00Z (+/-10 min) 54.240.8.58/32 (54.240.8.58 .. 54.240.8.58)… Читать далее spam source

w+ 54.240.8.58 a8-58.smtp-out.amazonses.com «a8-58.smtp-out.amazonses.com» 2022-02-17T23:00:00Z (+/-10 min) 54.240.8.58/32 (54.240.8.58 .. 54.240.8.58) w+ 54.240.10.19 a10-19.smtp-out.amazonses.com «a10-19.smtp-out.amazonses.com» 2022-02-17T22:00:00Z (+/-10 min) w+ 54.240.10.30 a10-30.smtp-out.amazonses.com «a10-30.smtp-out.amazonses.com» 2022-02-17T23:00:00Z (+/-10 min) w+ 54.240.10.92 a10-92.smtp-out.amazonses.com «a10-92.smtp-out.amazonses.com» 2022-02-17T22:20:00Z (+/-10 min) w 54.240.10.173 a10-173.smtp-out.amazonses.com «a10-173.smtp-out.amazonses.com» 2022-02-17T21:50:00Z (+/-10 min) w 54.240.10.199 a10-199.smtp-out.amazonses.com «a10-199.smtp-out.amazonses.com» 2022-02-17T23:00:00Z (+/-10 min) 54.240.10.0/24 (54.240.10.0 .. 54.240.10.255) w 54.240.48.26 a48-26.smtp-out.amazonses.com «a48-26.smtp-out.amazonses.com» 2022-02-17T21:40:00Z… Читать далее spam source

3.18.50.110 campaign.theartcraftgroup.com «campaign.theartcraftgroup.com» 2022-02-17T17:20:00Z => 2022-02-17T17:40:00Z (+/-10 min) 3.18.50.110/32 (3.18.50.110 .. 3.18.50.110) == Sample ========================== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=promotionsnow.com; s=campaign; h=From:From:To:CC:Subject:Date:Message-Id:Content-Type:Received; bh=.*=; b=.*=; Received: from 10.0.200.240 ([10.0.200.240]) by campaign.theartcraftgroup.com with XWall v3.55 ; .* From: Health Promotions Now <NoReply@promotionsnow.com> To: .* <.*> Return-Path: «bounceback@theartcraftgroup.com» <bounceback@theartcraftgroup.com> Reply-To: Health Promotions Now <NoReply@promotionsnow.com> Subject: Shop a Variety… Читать далее spam source

[!] This SBL record is to show an example of ongoing network abuse. It currently is not being published in the SBL list, but is instead being presented on the webpage so that the network owner has evidence to investigate and correct the problem. w+ 54.240.8.58 a8-58.smtp-out.amazonses.com «a8-58.smtp-out.amazonses.com» 2022-02-17T23:00:00Z (+/-10 min) 54.240.8.58/32 (54.240.8.58 .. 54.240.8.58)… Читать далее spam source