Рубрика: contabo.de

Received: from outbound1.distribution-ldc.com (outbound1.distribution-ldc.com [185.196.21.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client did not present a certificate) by X (Postfix) with ESMTPS id X for <X>; Wed, 23 Mar 2022 X Message-ID: <X@distribution-ldc.com> Date: Wed, 23 Mar 2022 X Subject: =?utf-8?Q?R=C3=A9f=C3=A9rencement?= Nouveaux Fournisseurs / Referencing New Suppliers From: LOUIS DREYFUS COMPANY DISTRIBUTION <achats@ld-distribution.com> Reply-To:… Читать далее Spam source @185.196.21.11

2022-03-23 honorways.com. 1 IN A 185.225.232.205 2022-03-21 honorways.com. 1 IN A 95.179.176.51 2022-03-04 honorways.com. 60 IN A 66.135.5.40 Received: from o4vo.hothothouse.info (o4vo.hothothouse.info. [45.145.4.145]) From: «Costco» <[]@[].o4vo.hothothouse.info> Subject: New Post: $100 Offer here Date: Wed, 02 Mar 2022 21:2x:xx +0100 https://s3-us-west-2.amazonaws.com/dqan3ch6q/[] 52.218.200.224 http://ringleros.info//cl/4410_md/[] 135.148.12.1 https://cemtasm.com/[] 23.229.68.8 https://honorways.com/r2/7[] 190.124.47.122 http://accesstart.com/aff_c?offer_id=437&aff_id=1193&source=nd&aff_sub=costco&aff_sub2=[]&aff_sub3=1SG&aff_sub4=473816 104.21.6.239 https://targetsoul.ru/[] 172.67.177.195 https://grnep.com/[]?c=%7C437&k=&v=&s=1193&t=&cr=&src=nd&lp=&id=[] 172.67.204.141 https://promo.topdashdeals.com/nc-t2-c2/checkout/?affid=&cid=[]&reqid=&tid=[] 167.172.19.255

3/21/2022: This IP address hosts the A record and a working mailserver for the domain scholarlyopenaccessjournals.com. This domain is active in spam sent by OPast Publishing Group, a publisher of «open-access» journals that solicits contributions and (by implication) fees and/or subscriptions through spam sent to scraped, purchased, and appended lists. A previosu SBL listing for… Читать далее scholarlyopenaccessjournals.com (OPast Publishing Group)

The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Socelars botnet controller located at 161.97.64.205 on port 80 (using HTTP POST): hXXp://www.pouncehousecafe.com/ $ dig +short www.pouncehousecafe.com 161.97.64.205 $ nslookup 161.97.64.205 vmi779689.contaboserver.net Referencing malware binaries (MD5 hash):… Читать далее Socelars botnet controller @161.97.64.205

The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Socelars botnet controller located at 164.68.101.131 on port 80 (using HTTP POST): hXXp://www.shanthikuteera.com/Home/Index/hsadhy $ dig +short www.shanthikuteera.com 164.68.101.131 $ nslookup 164.68.101.131 vmi808518.contaboserver.net Referencing malware binaries (MD5 hash):… Читать далее Socelars botnet controller @164.68.101.131

development-admin-100020001234567891062.tk 2022-03-17 15:49:37 development-admin-100020001234567891069.tk 2022-03-17 15:38:49 development-admin-100020001234567891061.tk 2022-03-17 15:38:34 100000000048465564878544897053-gq.tk 2022-03-17 15:38:47 development-admin-100020001234567891068.tk 2022-03-17 15:34:31 development-admin-100020001234567891067.tk 2022-03-17 15:33:44 development-admin-100020001234567891066.tk 2022-03-17 15:33:39 development-admin-100020001234567891065.tk 2022-03-17 15:33:38 development-admin-100020001234567891064.tk 2022-03-17 15:33:38 development-admin-100020001234567891051.tk 2022-03-17 15:17:43 development-admin-100020001234567891053.tk 2022-03-17 15:17:40 development-admin-100020001234567891058.tk 2022-03-17 14:58:47 development-admin-100020001234567891059.tk 2022-03-17 14:58:35 development-admin-100020001234567891054.tk 2022-03-17 14:59:35 development-admin-100020001234567891056.tk 2022-03-17 14:58:35 development-admin-100020001234567891055.tk 2022-03-17 14:49:37 development-admin-100020001234567891057.tk 2022-03-17 14:49:33 development-admin-100020001234567891052.tk 2022-03-17 14:49:36 freetoram.cf… Читать далее phishing server

This IP address is sending spam for Claimable Training, also known of as ‘Trainer’s Club’ and ‘P2P Hub’. The spam is sent to scraped, purchased, or appended lists offering online training in marketing methods. SPAM SAMPLE: Received: from server.trainingclub.club (server.trainersclub.club [194.233.73.229]) Received: from desktop-h14210u.local (unknown [180.73.87.27]) Date: Fri, 11 Mar 2022 00:##:## +0800 From: «Claimable… Читать далее Spam Emitter (PHP Hub)

The host at this IP address is being (ab)used to «listbomb» email addresses: From: Marc de Be-Wear <noreply@wizicare.com> Subject: Demande d’autorisation BE-WEAR Problem description ============================ Spammers signed up for the bulk email service using the victim’s email address. As a result, the victim is being «listbombed» with transactional messages and bulk email campaigns. Problem resolution… Читать далее Abused / misconfigured newsletter service (listbombing)

We were told this server was cleared of phish site it has not been. 209.126.0.84|10002000300056746456658484757558447759122.tk|2022-03-13 00:51:08 209.126.0.84|10002000300056746456658484757558447759123.tk|2022-03-13 00:26:10 209.126.0.84|10002000300056746456658484757558447759125.tk|2022-03-13 00:50:59 209.126.0.84|10002000300056746456658484757558447759126.tk|2022-03-13 00:31:01 209.126.0.84|10002000300056746456658484757558447759128.tk|2022-03-13 00:26:14 209.126.0.84|10002000300056746456658484757558447759129.tk|2022-03-13 00:26:14 209.126.0.84|10002000300056746456658484757558447759130.tk|2022-03-13 00:30:55

This IP range is sending spam for learningpro360.com, which belongs to P2P Hub, an operator of business training seminars/webinars. P2P Hub appears not to be using that name at the moment, probably to evade detection. SENDING IPs: 178.18.240.2 sha2.learningpro360.com 178.18.240.3 sha3.learningpro360.com 178.18.240.4 sha4.learningpro360.com 178.18.240.5 sha5.learningpro360.com 178.18.240.6 sha6.learningpro360.com SPAM SAMPLE: Received: from sha#.learningpro360.com (sha#.learningpro360.com [178.18.240.##]) Date:… Читать далее learningpro360.com (P2P Hub)