The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 104.198.133.101 on port 443: $ telnet 104.198.133.101 443 Trying 104.198.133.101… Connected to 104.198.133.101. Escape character is… Читать далее Malware botnet controller @104.198.133.101
phishing server
34.106.179.77|authent08userly.com|2022-02-01 21:41:43 34.106.179.77|connects01-user.com|2022-01-31 19:17:15 34.106.179.77|connects02-verifyuser.com|2022-01-31 21:22:07 34.106.179.77|hostb07-userfy.com|2022-02-01 19:37:37 34.106.179.77|secb06-verifyinfo.nsupdate.info|2022-02-02 21:55:26 34.106.179.77|server08-auth-us.com|2022-02-03 22:01:43 34.106.179.77|userfyb03-connect.com|2022-02-01 18:56:46 34.106.179.77|userfyb05connectivity.com|2022-02-02 19:48:18 34.106.179.77|userinfo-b2verify.serveirc.com|2022-02-03 19:54:10 34.106.179.77|users08-authinfos.com|2022-02-03 23:51:46
Cybercrime site/forums
cvv.sale. 600 IN A 35.223.71.162 cvv.im. 600 IN A 35.223.71.162 cvv.zone. 600 IN A 35.223.71.162 ______________________ Was: 47.88.2.56 cvv.im 2022-01-20 05:07:38 47.88.2.56 cvv.sale 2022-01-29 10:26:23 47.88.2.56 cvv.zone 2022-01-23 13:56:56
Malware botnet controllers @34.69.243.155
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 34.69.243.155 on port 443: $ telnet 34.69.243.155 443 Trying 34.69.243.155… Connected to 34.69.243.155. Escape character is… Читать далее Malware botnet controllers @34.69.243.155
Amazon Phish landing sites.
35.221.124.153 aoiessdormi.ga 35.221.124.153 aozoimrmi.ml and many more: aiyiyeosoid.cf aiyiyeosoid.ga aiyiyeosoid.gq aiyiyeosoid.ml amsodnom.ga amsodnom.gq amsodnom.ml aoiesdldoi.cf aoiesdldoi.ga aoiesdldoi.gq aoiesdldoi.ml aoiessdormi.cf aoiessdormi.ga aoiessdormi.gq aoiessdormi.ml aomdiuslouid.cf aomdiuslouid.ga aomdiuslouid.gq aomdiuslouid.ml aozoimrmi.ga aozoimrmi.gq aozoimrmi.ml paodiue.cf paodiue.ga paodiue.gq paodiue.ml siomdiue.cf siomdiue.ga siomdiue.ml
Malware botnet controller @35.247.221.21
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller at 35.247.221.21 on port 443. $ telnet 35.247.221.21 443 Trying 35.247.221.21… Connected to 35.247.221.21. Escape character is ‘^]’ $ dig +short -x 35.247.221.21 66.254.138.34.bc.googleusercontent.com.… Читать далее Malware botnet controller @35.247.221.21
RaccoonStealer botnet controller @159.223.25.220
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. RaccoonStealer botnet controller located at 159.223.25.220 on port 80 (using HTTP POST): hXXp://159.223.25.220/ Referencing malware binaries (MD5 hash): 20c7b0a3a8a030f8eba31a4a3dc52cd5 — AV detection: 55 / 69 (79.71) 344c34de03ae7b7d62a843cb37dacfd8… Читать далее RaccoonStealer botnet controller @159.223.25.220
AgentTesla botnet controller @143.198.217.144
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 143.198.217.144 on port 587 TCP (SMTP to: merchandise@enche.com): $ telnet 143.198.217.144 587 Trying 143.198.217.144… Connected to… Читать далее AgentTesla botnet controller @143.198.217.144
Spamvertised website
Received: from DB6PR0301CA0048.eurprd03.prod.outlook.com (2603:10a6:4:54::16) Date: Thu, 03 Feb 2022 02:5x:xx +0000 From: Top Alternative Investment <[]@[].s100viewpoints.com> Subject: 𝗧𝗵𝗲 𝗴𝗿𝗲𝗮𝘁𝗲𝘀𝘁 𝗺𝗼𝗻𝗲𝘆 𝗿𝗲𝘃𝗼𝗹𝘂𝘁𝗶𝗼𝗻 𝗼𝗳 𝗮𝗹𝗹 𝘁𝗶𝗺𝗲 http://s100viewpoints.com/[] 159.223.48.46 https://volarealora.com/[] 193.124.15.64 https://www.nmxkj4trk.com/[]/?sub1=351076&sub2=[] 34.120.5.10
phishing server
147.182.197.50|citizensauthsec.com|2022-02-05 04:10:55 147.182.197.50|citizenshop.co|2022-02-04 20:31:55 147.182.197.50|citizensonline.net|2022-02-05 01:31:45