Рубрика: rt.ru

This IP address is sending spam for an operator of business training seminars and webinars that spams third-party lists. The current business name that we see is «Skills Network Training & Consultancy», but various other features point to this being the entity that used the name «P2B Hub» last year. Received: from server.trainingclub.club (server.trainersclub.club [194.233.73.229])… Читать далее Spam Emitter (Skills Network Training & Consultancy) (P2P Hub)

Received: from sysmon.eltex-co.ru (95.167.221.156 [95.167.221.156]) by [] with SMTPS id []; Mon, 20 Dec 2021 23:4x:xx -0800 (PST) Received: from gmail.com (unknown [23.146.242.56]) by sysmon.eltex-co.ru (Postfix) with ESMTPSA id [] for []; Tue, 21 Dec 2021 14:3x:xx +0700 (+07) Reply-To: ronevergreen73@gmail.com From: «Mr.Ronald Evergreen» <efexwec@gmail.com> Subject: I await your response…21/12/2021 Date: 21 Dec 2021 02:3x:xx… Читать далее spam emitter @95.167.221.156

Mail server emitting advance fee fraud (‘419’) spam thanks to a compromised password. mail.ip.ncnet.ru. 3600 IN A 77.37.254.238 ========================================================================== Return-Path: <info@emiliaceramica.com> Received: from mail.ip.ncnet.ru (HELO mail.ip.ncnet.ru) (77.37.254.238) by x (x) with ESMTP; Wed, 01 Dec 2021 xx:xx:xx +0000 Received: from [185.24.233.197] (account 111 HELO User) by mail.ip.ncnet.ru (CommuniGate Pro SMTP 5.2.12) with ESMTPA id x;… Читать далее advance fee fraud spam source at ncnet.ru

188.254.0.2 «hs-wismar.de» 2021-12-03T16:50:00Z (+/-10 min) 188.254.0.2/32 (188.254.0.2 .. 188.254.0.2) == Sample ========================== Reply-To: sjillmcallen2@gmail.com From: Shirley Jill McAllen < gerd.baron@hs-wismar.de > To: .* Subject: Good Day Date: .* Message-ID: <2021120319.*..*D.*7.*@hs-wismar.de> MIME-Version: 1.0 Content-Type: text/plain; charset=»utf-8″ Content-Transfer-Encoding: quoted-printable Hello Dear, I know you will be surprised reading from me today but consider=20 this a divine intervention.… Читать далее Phish source

Routing Stolen IP blocks. hXXps://bgp.he.net/AS211849#_prefixes 3 vl199-ds2-j2-r5-19-16.ams1.constant.com (173.199.113.193) 94.9ms ** [neglected] no reply packets received from TTLs 4 through 6 7 ae-2-3204.edge4.Stockholm2.Level3.net (4.69.135.162) 117.7ms 8 213.249.107.130 114.2ms 9 95.167.93.75 185.0ms ** [neglected] no reply packets received from TTL 10 11 48.149.173.1 224.3ms Origin-AS: 211849 Prefix: 48.149.173.0/24 AS-Path: 8220 1299 12389 211849 AS-Org-Name: KAKHAROV-AS Org-Name: The… Читать далее AS211849 IP Hijacking operation

Server distributing phish spam, thanks to a compromised password. kulpole.ru. 3600 IN MX 10 kulpole.tula.net. kulpole.tula.net. 53969 IN A 212.12.2.202 ========================================================================================= Return-Path: <hj788hg@netsatan.com> Received: from kulpole.tula.net (kulpole.tula.net [212.12.2.202]) by x (Postfix) with ESMTP id x for <x>; Thu, 8 Aug 2019 xx:xx:xx +0200 (CEST) Received: from [94.75.219.205] (account info@kulpole.ru [94.75.219.205] verified) by kulpole.tula.net (CommuniGate Pro… Читать далее phish source at kulpole.ru / tula.net

2020-11-12 23:08:11 85.143.202.51.mypharmcompany.su A 95.84.156.191 2020-11-11 15:18:24 canadianherbinc.ru A 95.84.156.191 2020-11-13 08:19:57 curingfastmart.com A 95.84.156.191 2020-11-14 05:34:30 daffiaudrey.ru A 95.84.156.191 2020-11-11 15:28:09 excellenthotinc.ru A 95.84.156.191 2020-11-13 07:03:14 familyrxprogram.ru A 95.84.156.191 2020-11-14 05:34:37 fastcarereward.su A 95.84.156.191 2020-11-11 23:16:01 fastdrugsassist.su A 95.84.156.191 2020-11-12 00:29:54 fastnaturaleshop.ru A 95.84.156.191 2020-11-10 07:21:52 fastrxsupply.su A 95.84.156.191 2020-11-13 19:32:38 globalhotsale.su A 95.84.156.191… Читать далее Canadian Pharmacy

dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 «broadband-95-84-156-217.ip.moscow.rt.ru» Really? That’s where they host the site now? __________ Was: botmasterru.com. 599 IN A 47.254.173.121 botmasterru.com. 599 IN A 8.210.217.157 dns2.botmasterlabs.net. 599 IN A 8.210.217.157 2020-12-10 10:49:26 lockbit-decryptor.top botmasterru.com. 599 IN A __________ Was: botmasterru.com. 599 IN A 8.208.101.41 2020-12-11 10:08:47 botmasterlabs.net A 8.208.101.41 2020-12-08 08:46:39 com-signin-encoding-utf8-ignore-authstate.bar A 8.208.101.41… Читать далее Hosting botmasterlabs.net spam/phish operation

dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 dns1.botmasterlabs.net. 3599 IN A 95.84.156.217 ;; ANSWER SECTION: botmasterlabs.net. 38400 IN A 95.84.156.217 ;; AUTHORITY SECTION: botmasterlabs.net. 38400 IN NS dns1.botmasterlabs.net. botmasterlabs.net. 38400 IN NS dns2.botmasterlabs.net. ;; ADDITIONAL SECTION: dns1.botmasterlabs.net. 38400 IN A 95.84.156.217 dns2.botmasterlabs.net. 38400 IN A 95.165.28.86 botmasterru.com. 599 IN A 46.173.214.59 ____________________ Was: botmasterru.com. 599 IN A… Читать далее Hosting botmasterlabs.net spam/phish operation

dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 dns2.botmasterru.com. 21599 IN A 95.84.156.217 _ «broadband-95-84-156-217.nationalcablenetworks.ru 2021-02-20» Really? That’s where they host the site now? 95.84.156.217 botmasterlabs.net 2021-03-07 95.84.156.217 www.botmasterlabs.net 2021-03-02 95.84.156.217 dns2.botmasterlabs.net 2021-02-27 __________ Was: botmasterru.com. 599 IN A 47.254.173.121 botmasterru.com. 599 IN A 8.210.217.157 dns2.botmasterlabs.net. 599 IN A 8.210.217.157 2020-12-10 10:49:26 lockbit-decryptor.top botmasterru.com. 599 IN A __________… Читать далее Hosting botmasterlabs.net/botmasterru.com spam/phish operation