Received: from spruce-goose-ar.twitter.com (62.210.24.90) From: [] <kundeservice@netonnet.no> Subject: Hei, Inntekten din er klar til å bli tatt ut ! Date: Wed, 24 Nov 2021 10:4x:xx -0500
Scareware scam.
The usual throbbing badly written Japanese «your PC is hacked» call this number 050-5050-0978
Spammer hosting @195.201.212.216
Spammer hosting located here: http://www.win2go.ch $ dig +short www.win2go.ch win2go.ch. 195.201.212.216 Spam sample =========================================================== Received: from mail.paviotupe.online (mail.paviotupe.online [198.91.86.110]) by X (Postfix) with ESMTP id X for <X>; Thu, 25 Nov 2021 X DKIM-Signature: X Received: from hike.mavropole.co.in (198.12.85.164) by mail.paviotupe.online id X for <X>; Thu, 25 Nov 2021 X(envelope-from <bounce2@paramaguty.de>) Message-ID: <X@paramaguty.de> Date: Thu,… Читать далее Spammer hosting @195.201.212.216
idropnews.com spammers @52.2.51.95
52.2.51.95 = idropnews.com idrop-1790182703.us-east-1.elb.amazonaws.com The following related hostnames used for «snowshoe» spamming blog.idrop.io eye.idrop-news.com fb.idropnews.com idrop-news.com idrop.email idrop.io idrop.news idrop.us idropnews.com mail.idrop.us mailhost.idrop-news.com mailin.idrop.us master.idropnews.com mta165.idrop.io mta166.idrop.io mta168.idrop.io mta171.idrop.io mta172.idrop.io mx2.idrop.io mx3.idrop.io newsletter.idrop.io s1.idropnews.com seo.idropnews.com simple.idrop-news.com www.idrop-news.com www.idrop.email www.idrop.io www.idrop.news www.idrop.us — Domain Name: IDROPNEWS.NET Creation Date: 2013-10-02 20:14:00Z Registrar Registration Expiration Date: 2014-10-02 20:14:00Z… Читать далее idropnews.com spammers @52.2.51.95
spam support (domains)
domain used in spam operation. cov3sjak3n.com [34.149.91.72] Affiliate link comes from a hijacked wordpress site on GoDaddy.
spam support (domains)
domain used in spam operation gotowebfast.xyz… 63.250.43.134, 63.250.43.135
spam support (domains)
domain used in spam operation gotowebfast.xyz… 63.250.43.134, 63.250.43.135
spam support (domains)
domain used in spam operation printstylegate.com… 34.149.113.102
Assorted phish landing sites.
Was SBL536489 — 45.8.124.239 Was SBL536276 47.89.252.64/32 Was SBL536138 47.251.44.214/32 Was SBL536089 47.251.12.133/32 Was SBL536014 47.254.184.139/32 finportalspkdeutschland.com has address 45.130.41.12 spkidservice.com has address 45.130.41.12 spk-portal.com has address 45.130.41.12 giro-home-spkupdate.com has address 45.130.41.12 spk-datenmanager.com has address 45.130.41.12 finportalspkdeutschland.com has address 45.8.124.239 spkidservice.com has address 45.8.124.239 spk-portal.com has address 45.8.124.239 kontoabgleichterminal.com has address 45.8.124.239 giro-home-spkupdate.com has address… Читать далее Assorted phish landing sites.
phishing server
165.22.122.244|authupdateings.online|2021-11-23 09:56:50 165.22.122.244|autorilisastions.online|2021-11-23 09:27:44 165.22.122.244|back-up.website|2021-11-23 23:56:36 165.22.122.244|dirrections.store|2021-11-24 00:04:15 165.22.122.244|manages-billingaccounts.info|2021-11-24 02:06:33 165.22.122.244|manages-paymentsbillingaccounts.info|2021-11-24 02:14:00 165.22.122.244|re-autorizers.xyz|2021-11-23 01:44:13 165.22.122.244|re-personalsisations.xyz|2021-11-23 01:58:44