The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Ousaban botnet controller located at 13.78.202.41 on port 80 (using HTTP POST): hXXp://notas-fiscais.com/sala02/soma.php $ dig +short notas-fiscais.com 13.78.202.41
irs phishing server
51.81.80.189|assitances-support.com|2021-12-13 13:56:42 51.81.80.189|irs.gov-get-my-tax-refund-submission.com|2021-12-13 13:03:46 51.81.80.189|irs.gov-get-my-tax-returns.com|2021-12-13 12:03:59 51.81.80.189|irs.gov-irfof-wmsp-tax-refund.com|2021-12-13 14:40:35
Carding fraud site/forums: fe-acc18.ru
Stolen credit card data sites: https://procrd.biz/ >>> https://i.imgur.com/dnhfzOq.gif >>> https://www.fe-acc18.ru/ 159.203.41.229 fe-acc18.ru 2021-12-13 03:21:12 ________________ Was: 216.73.159.30 fe-acc18.ru 2021-12-11 00:05:42 ________________ Was: 45.9.20.217 fe-acc18.ru 2021-12-09 23:33:45 216.73.159.30 fe-acc18.ru 2021-12-11 00:05:42 ________________ Was: 91.241.19.78 fe-acc18.ru 2021-12-09 01:40:53 ________________ Was: fe-acc18.ru. 300 IN A 193.56.146.111 ________________ Was: fe-acc18.ru. 300 IN A 193.56.146.110 ________________ Was: fe-acc18.ru. 300 IN… Читать далее Carding fraud site/forums: fe-acc18.ru
phishing server
137.135.119.103|citiauthorize2.com|2021-12-12 23:30:46 137.135.119.103|citiauthorize3.com|2021-12-12 23:30:48 137.135.119.103|citilogin-secure.com|2021-12-12 02:00:51 137.135.119.103|securedloginciti.com|2021-12-12 00:30:48
BitRAT botnet controller @172.105.27.61
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 172.105.27.61 on port 4898 TCP: $ telnet 172.105.27.61 4898 Trying 172.105.27.61… Connected to 172.105.27.61. Escape character… Читать далее BitRAT botnet controller @172.105.27.61
Vjw0rm botnet controller @198.27.77.242
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 198.27.77.242 on port 1780 TCP: $ telnet 198.27.77.242 1780 Trying 198.27.77.242… Connected to 198.27.77.242. Escape character… Читать далее Vjw0rm botnet controller @198.27.77.242
ArkeiStealer botnet controller @116.202.14.219
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 116.202.14.219 on port 443 TCP: $ telnet 116.202.14.219 443 Trying 116.202.14.219… Connected to 116.202.14.219. Escape character… Читать далее ArkeiStealer botnet controller @116.202.14.219
Malware botnet controller @172.67.156.171
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 172.67.156.171 on port 80 (using HTTP GET): hXXp://installstats.online/reg.php $ dig +short installstats.online 172.67.156.171 Referencing malware binaries (MD5 hash): 4ccf1d875a9caa4eca96e6a479fc37b9 — AV detection:… Читать далее Malware botnet controller @172.67.156.171
phishing server
host benifltspro.one benifltspro.one has address 3.138.145.123 hXXps://benifitaboutpay.xyz/update/ (now hiding behind cloudflare) hXXps://mybenifitnew.xyz/benefit/ (now hiding behind cloudflare) 3.138.145.123|benifitaboutpay.xyz|2021-12-11 01:55:35 3.138.145.123|benifltspro.one|2021-12-12 06:10:40 3.138.145.123|ff-item22.tk|2021-12-10 03:03:04 3.138.145.123|mybenifitdet.xyz|2021-12-12 02:25:58 3.138.145.123|mybenifitnew.xyz|2021-12-11 04:20:38
UPS phishing sites
139.162.125.139|a0zmf-ups.com|2021-12-11 20:20:40 139.162.125.139|a13wb-ups.com|2021-12-11 20:25:48 139.162.125.139|a1dpi-ups.com|2021-12-11 21:00:45 139.162.125.139|a1w0g-ups.com|2021-12-11 20:31:01 139.162.125.139|a1xez-ups.com|2021-12-11 20:45:47 139.162.125.139|a25tq-ups.com|2021-12-11 20:30:44 139.162.125.139|a2acb-ups.com|2021-12-11 21:00:41 139.162.125.139|a2dsd-ups.com|2021-12-11 20:20:48 139.162.125.139|a3bdy-ups.com|2021-12-11 21:00:32 139.162.125.139|a3e0n-ups.com|2021-12-11 20:25:59 139.162.125.139|a3jge-ups.com|2021-12-11 20:25:43 139.162.125.139|a3v00-ups.com|2021-12-11 20:20:50 139.162.125.139|a40cx-ups.com|2021-12-11 21:00:51 139.162.125.139|a4kpm-ups.com|2021-12-11 20:25:36 139.162.125.139|a4rfy-ups.com|2021-12-11 20:30:44 139.162.125.139|a5gqt-ups.com|2021-12-11 20:25:54 139.162.125.139|a5pg2-ups.com|2021-12-11 21:00:46 139.162.125.139|a9ekc-ups.com|2021-12-11 20:25:44 139.162.125.139|aasd1-ups.com|2021-12-11 20:20:34 139.162.125.139|aasdl-ups.com|2021-12-11 20:20:52 139.162.125.139|abzc8-ups.com|2021-12-11 20:25:35 139.162.125.139|ac8pm-ups.com|2021-12-11 20:25:49 139.162.125.139|adyk0-ups.com|2021-12-11 21:00:37 139.162.125.139|af30u-ups.com|2021-12-11 20:20:57 139.162.125.139|afdsr-ups.com|2021-12-11 20:20:50 139.162.125.139|aj7lu-ups.com|2021-12-11 20:35:40 139.162.125.139|ajbnu-ups.com|2021-12-11 20:25:41 139.162.125.139|alg1u-ups.com|2021-12-11… Читать далее UPS phishing sites