Identical spams received today from 192.46.234.{73, 85, 99, 112, 117} Also 104.237.138.184, .194 Also 139.162.162.32 Also 96.126.112.{59, 101, 114, 128} Received: from warsteiner.com (li829-194.members.linode.com [104.237.138.194]) by x (Postfix) with ESMTP id x for <x>; Mon, 11 Oct 2021 ##:##:## +0000 (UTC) Date: Mon, 11 Oct 2021 ##:##:## +0000 To: x From: Nachricht wichtig <dqds@warsteiner.com> Reply-To:… Читать далее Phishing origination against Volksbank eG (German banking group)
Phishing origination against Volksbank eG (German banking group)
Identical spams received today from 192.46.234.{73, 85, 99, 112, 117} Also 104.237.138.184, .194 Also 139.162.162.32 Also 96.126.112.{59, 101, 114, 128} Received: from warsteiner.com (li829-194.members.linode.com [104.237.138.194]) by x (Postfix) with ESMTP id x for <x>; Mon, 11 Oct 2021 ##:##:## +0000 (UTC) Date: Mon, 11 Oct 2021 ##:##:## +0000 To: x From: Nachricht wichtig <dqds@warsteiner.com> Reply-To:… Читать далее Phishing origination against Volksbank eG (German banking group)
Estonian corporate undertaker spam
Received: from adoring-rosalind.46-101-249-55.plesk.page (unknown [46.101.249.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by x (Postfix) with ESMTPS id x for <x>; Mon, 11 Oct 2021 ##:##:## +0100 (BST) Received: by adoring-rosalind.46-101-249-55.plesk.page (Postfix, from userid 10000) id x; Mon, 11 Oct 2021 ##:##:## +0000 (UTC) To: x Subject: Probleemsete ettevõtete eemaldamine X-PHP-Originating-Script:… Читать далее Estonian corporate undertaker spam
Phishing origination against LCL (banking and insurance group in France)
Received: from webmail.unisannio.it (unknown [147.182.219.67]) by x (Postfix) with ESMTPS id x for <x>; Mon, 11 Oct 2021 ##:##:## +0000 (UTC) Received: by webmail.unisannio.it (Postfix, from userid 33) id x; Mon, 11 Oct 2021 ##:##:## +0000 (UTC) To: x Subject: reconfirmer votre numéro mobile X-PHP-Originating-Script: 0:Mpriority.php Date: Mon, 11 Oct 2021 ##:##:## +0000 From: LCL… Читать далее Phishing origination against LCL (banking and insurance group in France)
Phishing payload against Zone.eu
$ host healliser.com healliser.com has address 51.137.149.68 This IP hosts an active phishing payload against customers of the Estonian internet service provider Zone.eu.
Assorted phishing sites:
34.84.186.54 csrf-pb.shop 34.84.186.54 my-soflbank-jp.com 34.84.186.54 mb-solfbank-jp.co 34.84.186.54 info-server.shop 34.84.186.54 soflbank.top 34.84.186.54 my-soflbank-jp.top 34.84.186.54 my-solfbank-jp.co 34.84.186.54 inform-bank.shop 34.84.186.54 etc-malfei-jp.co 34.84.186.54 id-mb-solfbank-jp.co 34.84.186.54 softbank-jp.top 34.84.186.54 my-softbank-jp.shop 34.84.186.54 my-softbank-jp.top
spam emitter @80.78.248.73
Received: from massiveradar.xyz (massiveradar.xyz. [80.78.248.73]) Date: Sun, 10 Oct 2021 16:1x:xx +0000 Subject: BETAALCODE —€[usernname]€ 📩PAYOUT_VERIFICATION 💰€150.000💰WACHT OP U…__ From: 💵Slot Hunter💵 <contact@dailyprosperousnow.com>
RedLineStealer botnet controller @62.109.11.230
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 62.109.11.230 on port 20767 TCP: $ telnet 62.109.11.230 20767 Trying 62.109.11.230… Connected to 62.109.11.230. Escape character… Читать далее RedLineStealer botnet controller @62.109.11.230
RaccoonStealer botnet controller @104.21.31.246
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. RaccoonStealer botnet controller located at 104.21.31.246 on port 80 (using HTTP GET): hXXp://telemirror.top/teneleven11pro $ dig +short telemirror.top 104.21.31.246 Other malicious domain names hosted on this IP address:… Читать далее RaccoonStealer botnet controller @104.21.31.246
phishing server
online-company-services.com has address 66.29.131.85 alerts-info-card-mob.com has address 66.29.131.85 info-contact-us.com has address 66.29.131.85 access-helping.com has address 66.29.131.85 info-notify-wf.com has address 66.29.131.85 access-action-required.com has address 66.29.131.85