CryptBot botnet controller hosted at 185.211.245.158 on port 80 TCP: $ telnet 185.211.245.158 80 Trying 185.211.245.158… Connected to 185.211.245.158. Escape character is ‘^]’.
spam emitters
2021-09-30 spammer still active, listing reactivated 185.186.2.82 185.186.2.83 185.186.2.84 185.186.2.85 185.186.2.86 Received: from s2.albret.ru (albret.ru [185.186.2.140]) Date: Sat, 31 Jul 2021 10:5x:xx +0000 From: Aleksandr <info@s2.albret.ru> Subject: Предложение
phish source at kulpole.ru / tula.net
Server distributing phish spam, thanks to a compromised password. kulpole.ru. 3600 IN MX 10 kulpole.tula.net. kulpole.tula.net. 53969 IN A 212.12.2.202 ========================================================================================= Return-Path: <hj788hg@netsatan.com> Received: from kulpole.tula.net (kulpole.tula.net [212.12.2.202]) by x (Postfix) with ESMTP id x for <x>; Thu, 8 Aug 2019 xx:xx:xx +0200 (CEST) Received: from [94.75.219.205] (account info@kulpole.ru [94.75.219.205] verified) by kulpole.tula.net (CommuniGate Pro… Читать далее phish source at kulpole.ru / tula.net
Canadian Pharmacy
2020-11-12 23:08:11 85.143.202.51.mypharmcompany.su A 95.84.156.191 2020-11-11 15:18:24 canadianherbinc.ru A 95.84.156.191 2020-11-13 08:19:57 curingfastmart.com A 95.84.156.191 2020-11-14 05:34:30 daffiaudrey.ru A 95.84.156.191 2020-11-11 15:28:09 excellenthotinc.ru A 95.84.156.191 2020-11-13 07:03:14 familyrxprogram.ru A 95.84.156.191 2020-11-14 05:34:37 fastcarereward.su A 95.84.156.191 2020-11-11 23:16:01 fastdrugsassist.su A 95.84.156.191 2020-11-12 00:29:54 fastnaturaleshop.ru A 95.84.156.191 2020-11-10 07:21:52 fastrxsupply.su A 95.84.156.191 2020-11-13 19:32:38 globalhotsale.su A 95.84.156.191… Читать далее Canadian Pharmacy
Hosting botmasterlabs.net spam/phish operation
dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 «broadband-95-84-156-217.ip.moscow.rt.ru» Really? That’s where they host the site now? __________ Was: botmasterru.com. 599 IN A 47.254.173.121 botmasterru.com. 599 IN A 8.210.217.157 dns2.botmasterlabs.net. 599 IN A 8.210.217.157 2020-12-10 10:49:26 lockbit-decryptor.top botmasterru.com. 599 IN A __________ Was: botmasterru.com. 599 IN A 8.208.101.41 2020-12-11 10:08:47 botmasterlabs.net A 8.208.101.41 2020-12-08 08:46:39 com-signin-encoding-utf8-ignore-authstate.bar A 8.208.101.41… Читать далее Hosting botmasterlabs.net spam/phish operation
Hosting botmasterlabs.net spam/phish operation
dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 dns1.botmasterlabs.net. 3599 IN A 95.84.156.217 ;; ANSWER SECTION: botmasterlabs.net. 38400 IN A 95.84.156.217 ;; AUTHORITY SECTION: botmasterlabs.net. 38400 IN NS dns1.botmasterlabs.net. botmasterlabs.net. 38400 IN NS dns2.botmasterlabs.net. ;; ADDITIONAL SECTION: dns1.botmasterlabs.net. 38400 IN A 95.84.156.217 dns2.botmasterlabs.net. 38400 IN A 95.165.28.86 botmasterru.com. 599 IN A 46.173.214.59 ____________________ Was: botmasterru.com. 599 IN A… Читать далее Hosting botmasterlabs.net spam/phish operation
njrat botnet controller @95.68.175.128
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 95.68.175.128 on port 6522 TCP: $ telnet 95.68.175.128 6522 Trying 95.68.175.128… Connected to 95.68.175.128. Escape character… Читать далее njrat botnet controller @95.68.175.128
Hosting botmasterlabs.net/botmasterru.com spam/phish operation
dns2.botmasterlabs.net. 3599 IN A 95.84.156.217 dns2.botmasterru.com. 21599 IN A 95.84.156.217 _ «broadband-95-84-156-217.nationalcablenetworks.ru 2021-02-20» Really? That’s where they host the site now? 95.84.156.217 botmasterlabs.net 2021-03-07 95.84.156.217 www.botmasterlabs.net 2021-03-02 95.84.156.217 dns2.botmasterlabs.net 2021-02-27 __________ Was: botmasterru.com. 599 IN A 47.254.173.121 botmasterru.com. 599 IN A 8.210.217.157 dns2.botmasterlabs.net. 599 IN A 8.210.217.157 2020-12-10 10:49:26 lockbit-decryptor.top botmasterru.com. 599 IN A __________… Читать далее Hosting botmasterlabs.net/botmasterru.com spam/phish operation
IP Hijacker and ASN Hijacker routing
7 adm-b3-link.ip.twelve99.net (62.115.58.193) 85.2ms 8 adm-bb3-link.ip.twelve99.net (62.115.122.178) 93.5ms 9 hbg-bb3-link.ip.twelve99.net (80.91.252.43) 96.3ms 10 ffm-bb1-link.ip.twelve99.net (62.115.123.76) 95.4ms ** [neglected] no reply packets received from TTL 11 12 rostelecom-ic319651-ffm-b11.ip.twelve99-cust.net (62.115.151.97) 94.7ms 13 188.128.106.124 179.1ms 14 48.149.173.1 Hijacker AS : Kakharov Orinbassar MaratulyKazakhstan AS211849 Hijacking AS : https://bgp.he.net/AS395153#_graph4 ASNumber: 395153 ASName: VYZE-ASN ASHandle: AS395153 RegDate: 2016-05-11 Updated: 2016-05-11… Читать далее IP Hijacker and ASN Hijacker routing
Abused / misconfigured newsletter service (listbombing)
The host at this IP address is being (ab)used to «listbomb» email addresses: From: bhgymnastics@hotmail.com Subject: Re: BH Gymnastics «Trials Form Update» Problem description ============================ Spammers signed up for the bulk email service using the victim’s email address. As a result, the victim is being «listbombed» with transactional messages and bulk email campaigns. Problem resolution… Читать далее Abused / misconfigured newsletter service (listbombing)