Massive and repeated spammer hosting going on for several months. Example: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short trk.klclick3.com 13.224.195.45 13.224.195.118 13.224.195.61 13.224.195.52 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received:… Читать далее Spammer hosting @13.224.195.61
Spammer hosting @13.224.195.52
Massive and repeated spammer hosting going on for several months. Example: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short trk.klclick3.com 13.224.195.45 13.224.195.118 13.224.195.61 13.224.195.52 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received:… Читать далее Spammer hosting @13.224.195.52
Spammer hosting @3.64.104.69
Spammer hosting located here: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short bibcart.com 3.64.104.69 18.198.101.167 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received: by mail-ua1-f49.google.com with SMTP id X for <X>; Sat,… Читать далее Spammer hosting @3.64.104.69
Spammer hosting @18.198.101.167
Spammer hosting located here: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short bibcart.com 3.64.104.69 18.198.101.167 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received: by mail-ua1-f49.google.com with SMTP id X for <X>; Sat,… Читать далее Spammer hosting @18.198.101.167
Spammer hosting @3.208.184.222
Spammer hosting located here: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short vkgtrack.com 3.208.184.222 54.237.62.140 52.45.176.128 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received: by mail-ua1-f49.google.com with SMTP id X for <X>;… Читать далее Spammer hosting @3.208.184.222
Spammer hosting @54.237.62.140
Spammer hosting located here: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short vkgtrack.com 3.208.184.222 54.237.62.140 52.45.176.128 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received: by mail-ua1-f49.google.com with SMTP id X for <X>;… Читать далее Spammer hosting @54.237.62.140
Spammer hosting @52.45.176.128
Spammer hosting located here: https://trk.klclick3.com/ls/click?upn=X -> https://nostalgicgig.com/0/0/0/X —> https://greenfeelingz.com/de-shark-1/index_2.php?id=X&s1=X&s2=X&s3=X —> https://greenfeelingz.com/de-shark-1/?X —-> https://bibcart.com/click?trvid=X&s2=X&s1=X&s3=X ——> https://vkgtrack.com/?a=X&oc=X&c=X&s2=X ——> https://shop5.ultramaxtestoenhancer.com/#/de/main/?campaign=X&subid1=X&subid2=&subid3=X&subid4=&temp=X $ dig +short vkgtrack.com 3.208.184.222 54.237.62.140 52.45.176.128 Spam sample ============================== Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) by X (Postfix) with ESMTPS id X for <X>; Sat, 20 Nov 2021 X Received: by mail-ua1-f49.google.com with SMTP id X for <X>;… Читать далее Spammer hosting @52.45.176.128
spam emitters
Received: from s1.megojom.ru (megojom.ru [79.141.73.4]) Date: Sat, 20 Nov 2021 02:0x:xx +0000 From: Aleksandr <info@s1.megojom.ru> Subject: Предложение 79.141.73.2 eseneno.ru 79.141.73.3 derwerer.ru 79.141.73.4 megojom.ru 79.141.73.5 yeremont.ru 79.141.73.6 uwentos.ru 79.141.73.18 kroshem.ru 79.141.73.19 opengmon.ru 79.141.73.20 jombengon.ru 79.141.73.21 veromeng.ru 79.141.73.22 alomengo.ru
phishing server
connection-secured07-wells-farg0.com has address 143.198.159.19
Malware distribution & botnet controller @95.213.165.24
The host at this IP address is currently being used to distribute malware. Malware distribution located here: hXXp://sahpfi06.top/downfiles/file.exe The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller… Читать далее Malware distribution & botnet controller @95.213.165.24