domain used in spam operation. maasalong.com [104.21.17.216]
Spamvertised website
2021-12-23 nadisdh.com. 60 IN A 212.109.198.63 2021-12-18 nadisdh.com. 60 IN A 188.120.247.101 2021-12-17 nadisdh.com. 60 IN A 91.223.180.111 2021-12-09 nadisdh.com. 60 IN A 212.109.199.195 2021-12-08 nadisdh.com. 60 IN A 212.109.199.174 Received: from eaquegmhjm.cloudfront.net (20.68.129.110) From: Collagen, Collagen, <noreply@info.dnb.no> Subject: 𝟔 𝐠𝐨𝐝𝐞 𝐠𝐫𝐮𝐧𝐧𝐞𝐫 𝐭𝐢𝐥 å 𝐭𝐚 𝐂𝐨𝐥𝐥𝐚𝐠𝐞𝐧 𝐏𝐥𝐮𝐬 Date: Mon, 06 Dec 2021 10:5x:xx +0000 http://nadisdh.com/rd/[]… Читать далее Spamvertised website
Loki botnet controller @13.68.141.149
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Loki botnet controller located at 13.68.141.149 on port 80 (using HTTP POST): hXXp://nesofirenit.gq/stats/fre.php $ dig +short nesofirenit.gq 13.68.141.149 Other malicious domain names hosted on this IP address:… Читать далее Loki botnet controller @13.68.141.149
Malware botnet controllers @1194.87.1.88
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 194.87.1.88 on port 443: $ telnet 194.87.1.88 443 Trying 194.87.1.88… Connected to 194.87.1.88. Escape character is… Читать далее Malware botnet controllers @1194.87.1.88
Malware botnet controller @195.19.92.105
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller at 195.19.92.105 on port 443. $ telnet 195.19.92.105 443 Trying 195.19.92.105… Connected to 195.19.92.105. Escape character is ‘^]’ Malicious domains observed at this IP… Читать далее Malware botnet controller @195.19.92.105
Malware botnet controller @195.19.92.105
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller at 195.19.92.105 on port 443. $ telnet 195.19.92.105 443 Trying 195.19.92.105… Connected to 195.19.92.105. Escape character is ‘^]’ Malicious domains observed at this IP… Читать далее Malware botnet controller @195.19.92.105
Malware botnet controller @176.9.111.171
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 176.9.111.171 on port 15647 TCP: $ telnet 176.9.111.171 15647 Trying 176.9.111.171… Connected to 176.9.111.171. Escape character… Читать далее Malware botnet controller @176.9.111.171
OskiStealer botnet controller @104.21.4.131
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. OskiStealer botnet controller located at 104.21.4.131 on port 80 (using HTTP POST): hXXp://jessecoltd.ir/6.jpg $ dig +short jessecoltd.ir 104.21.4.131 Referencing malware binaries (MD5 hash): 818856f62f9ef72ae5d9c51877a9b365 — AV detection:… Читать далее OskiStealer botnet controller @104.21.4.131
Spam Web Hosting (OMICS)
12/22/2021: This range is still in use as shown below, so making the SBL listing live. 12/16/2021: Several IP addresses within this /28 host OMICS (Remedy) URIs in spam message headers and message bodies. OVH terminated services to OMICs recently, and the owner of this range appears to be suggesting that they have done so… Читать далее Spam Web Hosting (OMICS)
Spam source @209.85.221.54
Received: by mail-wr1-f54.google.com with SMTP id X.3 for <X>; Wed, 22 Dec 2021 09:22:47 -0800 (PST) xxx X-Received: by 2002:adf:f907:: with SMTP id b7mr2697407wrr.5.1640193766914; Wed, 22 Dec 2021 X Received: from 1036669786545 named unknown by gmailapi.google.com with HTTPREST; Wed, 22 Dec 2021 X From: Edward Bishop <edwarbishopmh@gmail.com> In-Reply-To: <X-X=X@mail.gmail.com> References: <X-X=X@mail.gmail.com> Mime-Version: 1.0 Date: Wed,… Читать далее Spam source @209.85.221.54