domain used in phishing operation degaussngs.com/sf/tpl9?logo=bestbuy&**REDACTED**
phishing server
129.146.122.66|amazon-availablesignin.ga|2022-01-02 15:09:16 129.146.122.66|amazon-signin.ga|2022-01-01 15:36:25 129.146.122.66|connect-signin.ga|2022-01-01 08:51:15 129.146.122.66|connectivate-siginin.ga|2021-12-31 10:26:11 129.146.122.66|help-chase.ml|2022-01-02 15:03:49 129.146.122.66|online-citi.ga|2022-01-03 15:17:48 129.146.122.66|online-citi.ml|2022-01-03 15:08:08 129.146.122.66|online-citibank.ga|2022-01-03 13:01:44 129.146.122.66|online-citibank.ml|2022-01-03 14:02:28 129.146.122.66|package-tracking.gq|2021-12-31 11:36:28 129.146.122.66|package-usps.ga|2021-12-31 14:56:15 129.146.122.66|secur07c-chase.ga|2021-12-31 14:36:07
phishing server
159.223.66.177|account-location.info|2022-01-01 12:51:10 159.223.66.177|anonprivatedns.com|2022-01-02 16:31:15 159.223.66.177|appie-locations.com|2022-01-03 01:56:05 159.223.66.177|apple-manage-id.com|2022-01-03 11:16:40 159.223.66.177|apple.com-id.uk|2022-01-01 05:31:37 159.223.66.177|customersupport-apple.live|2022-01-01 10:09:36 159.223.66.177|find-apple-iost.com|2022-01-03 10:16:36 159.223.66.177|find-apple-iost.info|2022-01-03 09:40:35 159.223.66.177|find-apple-location.com|2022-01-02 02:00:51 159.223.66.177|find-icloudmap.info|2022-01-02 23:40:57 159.223.66.177|find-lcloud-location.com|2022-01-03 09:46:43 159.223.66.177|findmy-located.info|2022-01-02 01:25:55 159.223.66.177|icloud-findmy-imaps.com|2022-01-02 02:11:11 159.223.66.177|icloud-iocation.com|2022-01-03 01:35:10 159.223.66.177|icloud-maps-us.com|2022-01-03 10:16:37 159.223.66.177|lcloud-fmi-iphone.info|2022-01-02 16:31:02 159.223.66.177|link-id-apple.com|2022-01-01 08:06:06
Snowshoe spammer hosting
Return-Path: []@mail.bondrian.digital> Received: from flint.bondrian.digital (host75.antennebusiness.us [31.210.22.205]) by [] (8.14.7/8.14.7) with ESMTP id [] for []; Mon, 3 Jan 2022 06:[]:[] -0500 Authentication-Results: [] DKIM-Signature: [] DomainKey-Signature: [] Mime-Version: 1.0 Content-Type: multipart/alternative; boundary=»[]» Date: Mon, 3 Jan 2022 12:[]:[] +0100 From: «Destroy Tinnitus» <curetinnitus@bondrian.digital> Reply-To: «Tinnitus Repair» <curetinnitus@bondrian.digital> Subject: Secret Military Project Fixes Tinnitus To:… Читать далее Snowshoe spammer hosting
spam emitter @37.230.114.201
Received: from s8.browesen.ru (37.230.114.201 [37.230.114.201]) Date: Sun, 2 Jan 2022 23:0x:xx +0000 From: Aleksandr <info@s8.browesen.ru> Subject: Предложение
spam emitter @69.169.232.9
Received: from b232-9.smtp-out.ap-southeast-2.amazonses.com (b232-9.smtp-out.ap-southeast-2.amazonses.com. [69.169.232.9]) Date: Sun, 2 Jan 2022 11:3x:xx +0000 From: HeroBook Game <news@herobook.io> Subject: HeroBook launches Airdrop program
Mirai botnet controller @35.197.127.250
Mirai botnet controller hosted here: $ telnet 35.197.127.250 6379 Trying 35.197.127.250… Connected to 35.197.127.250. Escape character is ‘^]’.
AsyncRAT botnet controller @144.126.129.113
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 144.126.129.113 on port 54809 TCP: $ telnet 144.126.129.113 54809 Trying 144.126.129.113… Connected to 144.126.129.113. Escape character… Читать далее AsyncRAT botnet controller @144.126.129.113
phishing server
bi-tly.com != bit.ly or bitly.com 66.29.153.102|24supp.com|2022-01-01 02:00:54 66.29.153.102|2secucitr5a.com|2022-01-02 11:28:40 66.29.153.102|5securcit7.com|2021-12-31 08:45:24 66.29.153.102|997support.com|2022-01-01 08:11:18 66.29.153.102|accesslogin.live|2022-01-03 01:37:51 66.29.153.102|accountupdateboa.com|2022-01-03 01:36:38 66.29.153.102|accountupdateusbank.com|2022-01-01 22:35:46 66.29.153.102|awscitl6z.com|2022-01-02 03:00:59 66.29.153.102|bankofamericasecure.ml|2021-12-31 13:26:03 66.29.153.102|bi-tly.com|2021-12-24 02:06:36 66.29.153.102|boasavingorchecking.com|2022-01-03 03:36:26 66.29.153.102|caligov-prepaidprocessing.com|2021-12-28 23:00:47 66.29.153.102|chase-privacy.com|2021-12-23 10:18:51 66.29.153.102|citib.online|2022-01-03 01:11:21 66.29.153.102|citizensupdate.xyz|2022-01-02 19:20:54 66.29.153.102|confirm0b.com|2021-12-22 11:22:51 66.29.153.102|contactinformation-citi.com|2021-12-26 21:35:49 66.29.153.102|httpsadminpersonal5serveirc.com|2022-01-03 01:58:10 66.29.153.102|infomationupdatewellsfargo.com|2021-12-29 11:29:44 66.29.153.102|informationupdated.com|2021-12-30 22:36:18 66.29.153.102|jpmchasesecure.ml|2021-12-30 19:37:00 66.29.153.102|localbittcoin.com|2021-12-26 10:16:11 66.29.153.102|localsupport247.com|2021-12-27 10:45:21 66.29.153.102|mytmohelp.com|2022-01-03 02:24:28 66.29.153.102|mytmosupport.com|2022-01-02 01:47:38… Читать далее phishing server
phishing server
securewellsdashboar.servehttp.com has address 155.248.196.59